joyce8/EMBER2024-capa huggingface dataset:
Function at 0x866700
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [esp + 0x8c]
push ebx
push ebp
push esi
mov ebx, dword [eax + 0x780]
push edi
mov edi, dword [eax]
mov dword [esp + 0x10], 0x80
mov edx, dword [ebx + 0x144]
lea eax, [esp + 0x10]
lea ebp, [ebx + 0x14c]
lea ecx, [esp + 0x18]
push eax
push ecx
mov eax, dword [ebp]
mov ecx, dword [ebx + 0x14]
add edx, 4
push 0
push edx
push eax
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [ebx + 0x13c], eax
mov eax, dword [ebx + 0x138]
test eax, eax
jne 0x866789
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x18]
mov edx, ecx
lea edi, [ebx + 0xb8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
mov dword [ebx + 0x138], eax
mov eax, dword [ebx + 0x13c]
mov esi, 4
cmp eax, esi
jge 0x8667ba
push str.Received_too_short_packet
push edi
call fcn.0084fa40
add esp, 8
mov dword [ebx + 0xc], 7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x88
ret
push ebp
call fcn.00866930
and eax, 0xffff
add esp, 4
mov dword [ebx + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x8667d7
jmp dword [eax*4 + 0x866920]
cmp dword [ebx + 0x13c], esi
jle case.0x8667d7.4
push ebp
call fcn.008662e0
mov cx, word [ebx + 0x30]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x8667d7.4
mov edx, dword [ebx + 0x13c]
mov eax, dword [ebp]
mov ecx, dword [esp + 0x9c]
sub edx, esi
add eax, esi
push edx
push eax
push 1
push ecx
call fcn.0084ff70
mov esi, eax
add esp, 0x10
test esi, esi
je 0x866840
push 5
push ebx
call fcn.00865a30
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
mov eax, dword [ebx + 0x13c]
mov ecx, dword [edi + 0x98]
sub eax, 4
cdq
add ecx, eax
mov dword [edi + 0x98], ecx
mov ebp, dword [edi + 0x9c]
adc ebp, edx
mov dword [edi + 0x9c], ebp
mov eax, dword [edi + 0x98]
mov edx, ebp
push edx
push eax
push edi
call fcn.0085cf00
jmp 0x8668e9
push ebp
call fcn.008662e0
mov ebp, dword [ebp]
and eax, 0xffff
add ebp, esi
mov esi, dword [ebx + 0x13c]
sub esi, 4
mov dword [ebx + 8], eax
push esi
push ebp
call fcn.00866950
add esp, 0xc
cmp eax, esi
jae case.0x8667d7.4
push ebp
push str.TFTP_error:__s_n
push edi
call fcn.0084f980
jmp 0x8668e9
mov ecx, dword [ebx + 0x13c]
mov edx, dword [ebp]
sub ecx, 2
add edx, 2
push ecx
push edx
push ebx
call fcn.00866980
add esp, 0xc
test eax, eax
je case.0x8667d7.4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
push str.Internal_error:_Unexpected_packet
push 0x8c43b0
push edi
call fcn.0084fa40
add esp, 0xc
mov eax, dword [esp + 0x9c]
push eax
call fcn.0085d0e0
add esp, 4
test eax, eax
je 0x8667ad
push 5
push ebx
call fcn.00865a30
add esp, 8
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret
Function at 0x868b20
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x868b59
mov ecx, dword [esp + 0x194]
push eax
push str.WSAStartup_failed___d_
push ecx
call fcn.0084fa40
add esp, 0xc
mov eax, 2
add esp, 0x190
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ax, word [esp]
cmp al, 2
jne 0x868b79
xor edx, edx
mov dl, ah
test dl, dl
jne 0x868b79
xor eax, eax
add esp, 0x190
ret
mov eax, dword [esp + 0x194]
push str.insufficient_winsock_version_to_support_telnet
push eax
call fcn.0084fa40
add esp, 8
mov eax, 2
add esp, 0x190
ret

Function at 0x868d00
Capabilities:
Send data
Send data on socket

Disassembly:
mov al, byte [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push edi
push 0
lea ecx, [esp + 0x14]
mov edx, dword [esi + 0x408]
mov edi, dword [esi]
push 3
push ecx
push edx
mov byte [esp + 0x20], 0xff
mov byte [esp + 0x21], bl
mov byte [esp + 0x22], al
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x868d4d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.0084fa40
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esi]
push eax
push ebx
push str.SENT
push ecx
call fcn.00868d70
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x869ef0
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push edi
mov eax, dword [eax]
mov dword [esp + 8], eax
mov edi, dword [eax + 0x128]
mov eax, dword [esp + 0x14]
cmp eax, 0x1f
jne 0x86a059
push ebp
push esi
lea ebp, [edi + 0x1cb0]
lea esi, [edi + 0x1eb0]
cmp ebp, esi
mov dword [esi], ebp
jae 0x869f2d
mov byte [ebp], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x869f3b
mov byte [eax], 0xfa
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x869f49
mov byte [eax], 0x1f
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov cx, word [edi + 0x1ca8]
mov ebx, dword [sym.imp.WS2_32.dll_htons]
push ecx
call ebx
mov dx, word [edi + 0x1caa]
mov dword [esp + 0x1c], eax
push edx
call ebx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x869f78
mov dl, byte [esp + 0x1c]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x869f89
mov dl, byte [esp + 0x1d]
mov byte [ecx], dl
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x869f96
mov byte [ecx], al
mov ecx, dword [esi]
inc ecx
mov dword [esi], ecx
mov ecx, dword [esi]
cmp ecx, esi
jae 0x869fa3
mov byte [ecx], ah
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x869fb1
mov byte [eax], 0xff
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
cmp eax, esi
jae 0x869fbf
mov byte [eax], 0xf0
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
mov ebx, dword [esp + 0x10]
mov ecx, eax
lea edx, [edi + 0x1cb2]
sub ecx, ebp
mov dword [edi + 0x1eb4], eax
sub ecx, 2
mov dword [esi], ebp
push ecx
push edx
push 0x3e
push ebx
call fcn.00869be0
add esp, 0x10
mov esi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push ebp
mov ebp, dword [esp + 0x24]
mov eax, dword [ebp + 0x408]
push eax
call esi
test eax, eax
jge 0x86a018
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0084fa40
add esp, 0xc
lea ecx, [edi + 0x1cb3]
push 4
push ecx
push ebp
call fcn.0086a060
mov edx, dword [ebp + 0x408]
add esp, 0xc
add edi, 0x1cb7
push 0
push 2
push edi
push edx
call esi
pop esi
pop ebp
test eax, eax
jge 0x86a059
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0084fa40
add esp, 0xc
pop edi
pop ebx
pop ecx
ret
Function at 0x86c620
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
shr eax, 0x1f
mov ebx, dword [edi]
add edx, eax
cmp edx, 2
je 0x86c65c
push str.Couldnt_set_desired_mode
push ebx
call fcn.0084fa40
add esp, 8
mov eax, 0x11
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x86c673
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0084f980
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0x13
jne 0x86c68b
push edi
call fcn.0086afe0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x86c69f
push edi
call fcn.0086c6d0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x86c6b3
push edi
call fcn.0086c7e0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x86c6c3
push edi
call fcn.0086c800
add esp, 4
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x86ce10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov ebp, dword [ebx + 0x40c]
mov esi, dword [ebx]
lea eax, [esp + 0x20]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
or edi, 0xffffffff
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x86ce5e
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push ebx
call fcn.00855930
add esp, 8
cmp edi, 0xffffffff
jne 0x86ce88
push str.Error_accept__ing_server_connect
push esi
call fcn.0084fa40
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.Connection_accepted_from_server_n
push esi
call fcn.0084f980
push 1
push edi
mov dword [ebx + 0x544], 0
mov dword [ebx + 0x40c], edi
call fcn.0087a140
mov dword [ebx + 0x85c], 1
mov eax, dword [esi + 0x600]
add esp, 0x10
test eax, eax
je 0x86cf01
push 1
push esi
call fcn.0084f920
mov ecx, dword [esi + 0x604]
push 1
push edi
push ecx
call dword [esi + 0x600]
push 0
push esi
mov edi, eax
call fcn.0084f920
add esp, 0x1c
test edi, edi
je 0x86cf01
push ebx
call fcn.0086b920
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x877e80
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x877ec2
lea edx, [esp + 0xc]
push 4
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
pop ecx
ret

Function at 0x8787c0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
test eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
je 0x8787da
cmp dword [eax], 0
jne 0x8787f4
test ebx, ebx
je 0x8787e3
cmp dword [ebx], 0
jne 0x8787f4
test esi, esi
je 0x878888
cmp dword [esi], 0
je 0x878888
mov ecx, dword [esp + 0x24]
push ebp
test ecx, ecx
lea ebp, [esp + 0xc]
jge 0x878805
xor ebp, ebp
jmp 0x878848
jle 0x87883c
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
shl edx, 3
mov dword [esp + 0x10], edx
jmp 0x878848
test ecx, ecx
jne 0x878848
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
test esi, esi
je 0x878855
cmp dword [esi], 0
je 0x878855
mov edx, esi
jmp 0x878857
xor edx, edx
test ebx, ebx
je 0x878864
cmp dword [ebx], 0
je 0x878864
mov ecx, ebx
jmp 0x878866
xor ecx, ecx
test eax, eax
je 0x87886f
cmp dword [eax], 0
jne 0x878871
xor eax, eax
push ebp
push edx
push ecx
push eax
mov eax, dword [esp + 0x28]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebp
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x24]
push ecx
call fcn.00878790
add esp, 4
pop esi
pop ebx
add esp, 8
ret
Function at 0x87d750
Capabilities:
Move file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.00857da0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 1
push ebx
push ebp
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x87d7b1
push edi
push esi
call fcn.00857da0
push edx
push eax
call fcn.00857e40
add esp, 0x10
test edx, edx
jl 0x87d7b8
jg 0x87d78e
test eax, eax
jb 0x87d7b8
test edx, edx
jg 0x87d7b8
jl 0x87d79b
cmp eax, 0x3e8
ja 0x87d7b8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x87d773
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x8822f0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x882322
push 0x2e
push esi
call fcn.008427a0
add esp, 8
test eax, eax
je 0x882320
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x882370
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x20
push 0xf0000040
push 1
push 0
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x882399
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x14], 8
mov dword [esp + 0x24], ecx
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.00882470
lea ecx, [esp + 0x20]
push 8
push ecx
call fcn.00887aa0
mov ecx, dword [esp + 0x10]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push 0
push 0
push 0x14
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x882418
mov edx, dword [esp]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 4]
mov dword [eax + 4], ecx
lea ecx, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
push ecx
push eax
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
add esp, 0x20
ret
Function at 0x887b50
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000040
push 1
lea edi, [esi + 4]
push 0
push 0
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x887b8e
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0x887ba0
Capabilities:
Hash data via wincrypt

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
ret

Function at 0x888580
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push eax
call dword [0x8c1930]
mov edi, eax
add esp, 4
test edi, edi
jne 0x8885a3
pop edi
pop esi
ret
lea eax, [edi + 0xc]
push ebx
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, dword [esi + 0xc]
mov edx, eax
add edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [edi + 8], edx
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
push ebp
jbe 0x8885ee
push eax
call dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call dword [esi + 4]
mov ebx, dword [edi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
add ebx, eax
push edx
push ebx
call dword [esi + 8]
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x8885f2
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi + 4]
push ecx
call dword [esi]
mov edx, dword [edi + 8]
push edx
call dword [esi]
mov eax, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
test eax, eax
jbe 0x888658
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [ebx]
mov cl, byte [0x8bc3cc]
xor al, cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov edx, dword [edi + 4]
push 1
push ecx
push edx
call dword [esi + 4]
mov al, byte [ebx]
mov dl, byte [0x8bc3cd]
xor al, dl
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
mov edx, dword [edi + 8]
push 1
push ecx
push edx
inc ebx
call dword [esi + 4]
mov eax, dword [esp + 0x34]
add esp, 0x18
dec eax
mov dword [esp + 0x1c], eax
jne 0x888611
cmp ebp, dword [esi + 0x10]
jae 0x888684
mov eax, dword [edi + 4]
push 1
push 0x8bc3cc
push eax
call dword [esi + 4]
mov ecx, dword [edi + 8]
push 1
push 0x8bc3cd
push ecx
call dword [esi + 4]
mov eax, dword [esi + 0x10]
add esp, 0x18
inc ebp
cmp ebp, eax
jb 0x88865d
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x88aa35
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x88aa55
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0083d1e5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x88aa78
test byte [esp + 8], 2
je 0x88aa78
call fcn.0083d258
mov dword [eax], 0xd
call fcn.0083d261
mov dword [eax], 5
jmp 0x88aa51
xor eax, eax
ret
Function at 0x4dfa59
Capabilities:
Encode data using xor

Disassembly:
out 0xd2, eax
in eax, dx
mov ebx, 0x2ee9be99
cdq
mov esi, 0xdbc2ee9
lcall 0x7a69, 0xe72bb46c
mov esi, 0x180d1c81
cdq
mov esi, 0xdbc2ee9
lcall 0x7a69, 0xe72bb46c
mov esi, 0x180d1c81
loopne 0x4dfa9f
fld qword [ecx - 0x37]
les esi, [0xf75b81cf]
nop
xor byte [edx + edi*2 - 0x3b513177], bh
cdq
daa
dec ebx
fsubr dword [ebx + 0x6e13e696]
mov esi, dword [esi]
push ds
mov ecx, 0x5fa6ba9e
xor eax, 0x22a039d8
wait
adc edx, dword [ebx]
sbb al, al
outsd dx, dword [esi]
mov dword [edx], ebp
call [eax - 0x73]
pop eax
lea esp, [eax]
sbb byte [ecx], bl
jno 0x4dfaa8
and byte [eax], bl
sbb dword [ecx + 4], esi
add eax, 0xf47f3ec9
jg 0x4dfa9d
hlt
stosd dword es:[edi], eax
xchg esi, eax
mov cl, 0x92
sahf
daa
aas
cmp al, byte [ebx + 0x2ffcbb08]
add bl, byte [edx]
or byte [ebx + 0x1a022ffc], bh
stosd dword es:[edi], eax
xor byte [0x908f1d7b], 0xea
pop ebx
jns 0x4dfab2
mov dword [ebx - 0x5d], edi
mov ecx, dword [edx - 0x17c9cfdd]
or eax, 0xebdf68b9
or al, 0xcb
jbe 0x4dfa55
xlatb
loope 0x4dfa99
mov bh, 0x52
xchg edi, eax
sbb bh, byte [edi]
scasb al, byte es:[edi]
call 0x534b31c3
and cl, dh
mov ebx, 0x5b357fc7
dec edi
out 0x3a, eax
in eax, dx
xchg esi, eax
push eax
mov esp, 0xfbb760ef
je 0x4dfade
sahf
xchg edi, eax
jl 0x4dfaa6
add byte [eax], dl
wait
sti
jnp 0x4dfb6d
mov ah, 5
sar dword [ecx], 0x92
jne 0x4dfa97
sbb ah, byte [0xfe539598]
cmp ch, byte [esi + 0xb]
push cs
jle 0x4dfae3
cli
imul esp, esp, 0x9d9217ce
imul esi, ecx, 0xffffffb5
test al, 0x8b
into
scasb al, byte es:[edi]
adc dh, byte [ecx + ebx*4 - 0x739d6df]
or eax, 0xfffccc99
test eax, 0x175739c3
stosb byte es:[edi], al
push ebx
cwde
aaa
add al, 0xcc
push ebx
mov ah, 0x9f
sahf
cdq
test al, 0xf9
int3
out dx, eax
invalid
Function at 0x41f993
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f9d2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f9d2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f9d2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f9d2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f9d2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x432150
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43217d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43217d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x759350f2
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x6a6424de
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401935
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00410330
mov eax, dword [0x245826c]
mov ecx, dword [0x2457cf8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4019ed
push ebx
push edi
mov ebx, ecx
mov edi, eax
cmp dword [0x245826c], 0x959
jne 0x4019dc
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push str.Mokigehate_xolega_viricuh_mazu_fiboy
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push str.Yimu_givexohipalipen
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push str.Hipejes_joh_jagibavicedok_lozofowegad_dinomebaxedidox
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push str.pajebipew
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
call fcn.00401544
add ebx, 8
dec edi
jne 0x401961
pop edi
pop ebx
pop esi
leave
ret
Function at 0x401cc6
Capabilities:
Clear file content
Get common file path

Disassembly:
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x245826c], 0x400
push edi
jne 0x401d19
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateW]
push esi
call fcn.00404241
push esi
call fcn.004049c8
push esi
push esi
call fcn.00404813
push esi
call fcn.00404a7e
push esi
push esi
call fcn.0040427b
add esp, 0x1c
xor edi, edi
cmp edi, 0x16c76
jge 0x401d2b
push esi
push esi
call dword [sym.imp.USER32.dll_SetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0x12e5c52
jg 0x401d51
inc edi
cmp edi, 0x3003f
jl 0x401d1b
mov eax, dword [0x43ab7c]
mov dword [0x245826c], eax
call fcn.004019f0
mov edi, 0x3078f
cmp dword [0x245826c], 0x51f
jne 0x401d7d
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x401d65
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x402850
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov eax, 0x432a6d
call fcn.004328f0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403526
xor edi, edi
push 4
mov dword [ebp - 4], edi
call fcn.00404a8d
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x402898
call fcn.004032da
mov dword [ebx], eax
call fcn.00403099
mov ecx, eax
call fcn.004011a5
mov eax, ebx
jmp 0x40289a
xor eax, eax
mov dword [esi + 0x38], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea ecx, [esi + 0x1c]
mov dword [esi + 0x24], ecx
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x2c]
mov dword [esi + 0x34], ecx
mov dword [eax], edi
mov eax, dword [esi + 0x24]
mov dword [eax], edi
mov eax, dword [esi + 0x34]
mov dword [eax], edi
mov eax, dword [esi + 0x10]
mov dword [eax], edi
mov eax, dword [esi + 0x20]
mov dword [eax], edi
mov eax, dword [esi + 0x30]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
pop edi
mov dword [esi], vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x405115
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43999c]
jne 0x40511f
repz ret
jmp fcn.0040ba6c