joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8930
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x90], esi
mov eax, dword [esi + 0x18]
mov edi, dword [eax + 0x230]
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [edi + 0x13c]
push ebx
add eax, 4
push eax
push dword [edi + 0x148]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
mov dword [edi + 0x134], eax
cmp dword [edi + 0x130], ebx
jne 0x4e89c2
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [edi + 0xb0]
push eax
call fcn.004fb160
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [edi + 0x130], eax
mov edx, dword [edi + 0x134]
cmp edx, 4
jge 0x4e89f5
push str.Received_too_short_packet
push esi
call fcn.004c2280
add esp, 8
mov dword [edi + 0xc], 7
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x148]
push eax
call fcn.004e8540
movzx eax, ax
add esp, 4
mov dword [edi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4e8a16
jmp dword [eax*4 + 0x4e8b4c]
cmp edx, 4
jle case.0x4e8a16.4
lea eax, [edi + 0x148]
push eax
call fcn.004e8520
movzx ecx, word [edi + 0x144]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x4e8a16.4
lea eax, [edx - 4]
push eax
mov eax, dword [edi + 0x148]
add eax, 4
push eax
push 1
push esi
call fcn.004c27a0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je case.0x4e8a16.4
push 5
push edi
call fcn.004e9370
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 0x148]
lea eax, [edi + 0x148]
add ecx, 4
lea esi, [edx - 4]
push eax
mov dword [ebp - 0x8c], ecx
call fcn.004e8520
push esi
push dword [ebp - 0x8c]
movzx eax, ax
mov dword [edi + 8], eax
call fcn.004e94a0
add esp, 0xc
cmp eax, esi
mov esi, dword [ebp - 0x90]
jae case.0x4e8a16.4
push dword [ebp - 0x8c]
push str.TFTP_error:__s
push esi
call fcn.004c2340
jmp 0x4e8b15
lea eax, [edx - 2]
push eax
mov eax, dword [edi + 0x148]
add eax, 2
push eax
push edi
call fcn.004e8700
mov ebx, eax
add esp, 0xc
test ebx, ebx
je case.0x4e8a16.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x55e644
push esi
call fcn.004c2280
add esp, 0xc
push esi
call fcn.004d21a0
add esp, 4
test eax, eax
je 0x4e89e2
push 5
push edi
call fcn.004e9370
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
Function at 0x4e9370
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x4e9380
jmp dword [edx*4 + 0x4e93d4]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004e8e30
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004e8b60
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004e95d0
push str.TFTP_finished
push 0x55e644
push ecx
call fcn.004c2340
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x55e644
push ecx
call fcn.004c2280
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x4eb4f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x599d78]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x4eb542
push 3
push 2
push eax
push eax
push 6
call fcn.004f1350
add esp, 0x14
test al, al
je 0x4eb536
mov dword [0x599d78], 2
mov esp, ebp
pop ebp
ret
mov dword [0x599d78], 1
jmp 0x4eb547
cmp eax, 2
je 0x4eb587
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x4eb56e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x4eb587
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x4ebf30
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebx + 8]
push dword [edi + 0x14]
lea eax, [edi + 0x18]
push eax
push dword [edi + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4ebf70
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea eax, [edi + 0xbc]
push eax
push dword [ebp + 0xc]
call fcn.004ec4c0
add esp, 0xc
pop edi
pop ebx
pop ebp
ret
push dword [ebp + 0xc]
mov byte [edi + 0x15e], 1
push ebx
call fcn.004ec260
push dword [edi + 0xec]
cmp dword [edi], 5
lea eax, [edi + 0xbc]
push eax
push dword [edi + 0x120]
lea eax, [edi + 0xf0]
mov ecx, 0x565510
push eax
push dword [edi + 0x98]
mov eax, str.QUIC
cmovne eax, ecx
push eax
push str._s_socket__d_connected:___s:_d_______s:_d_
push ebx
push dword [ebp + 0xc]
call fcn.004c23c0
push 1
push dword [edi + 0x98]
call fcn.004f6710
add esp, 0x34
xor eax, eax
pop edi
pop ebx
pop ebp
ret

Function at 0x4ec040
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
jne 0x4ec064
push dword [ecx + 0x14]
lea eax, [ecx + 0x18]
push eax
push dword [ecx + 0x98]
call dword [sym.imp.WS2_32.dll_connect]
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret

Function at 0x4ec070
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x14]
mov eax, dword [ebx]
push 0
push dword [ebp + 0x10]
mov eax, dword [eax + 8]
push ecx
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4ec100
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x4ec0cb
mov dword [edi], 0x51
jmp 0x4ec0fd
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004b26f0
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.004c2280
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x934], esi
mov dword [edi], 0x38
or esi, 0xffffffff
push dword [edi]
push esi
push dword [ebp + 0x10]
push str.nw_in_read_len_zu______d__err_d
push dword [ebx]
push dword [ebx + 4]
call fcn.004c23c0
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
Function at 0x4ec260
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1c8]
test dword [eax + 0x44], 0x800
jne 0x4ec381
push 0x80
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.004fb6e0
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x4ec311
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.004b26f0
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.004c2280
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.004c33d0
add esp, 0x10
test al, al
jne 0x4ec381
push edi
call fcn.0051868b
mov esi, eax
call fcn.0051868b
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push dword [esi]
call fcn.004b26f0
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.004c2280
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret

Function at 0x4ec5e0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
cmp byte [esi + 0x6ce], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4ec62d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d:_errno__d
jmp 0x4ec694
push dword [esi + 0x668]
mov dword [ebp - 0x10], 1
call fcn.004c45b0
push dword [esi + 0x66c]
imul eax, eax, 0x3e8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
call fcn.004c45b0
add esp, 8
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4ec69d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:_errno__d
push esi
call fcn.004c2340
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
Function at 0x4ec6b0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 4
push eax
push 1
push 6
push dword [ebp + 0xc]
mov dword [ebp - 0x108], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4ec712
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004b26f0
push eax
push str.Could_not_set_TCP_NODELAY:__s
push esi
call fcn.004c2340
add esp, 0x18
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
Function at 0x4f7b20
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4f7b45
mov eax, 0x1b
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4f7b75
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, 2
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4f7cf0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4f7d23
push 0x2e
push edi
call fcn.004fc320
add esp, 8
test eax, eax
je 0x4f7d21
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4f8390
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x595534]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f8427
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.004f8490
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.004f91e0
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x4f8439
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004ff9ee
mov esp, ebp
pop ebp
ret
Function at 0x4f8bc0
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000040
push 0x18
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4f8be5
mov eax, 0x1b
pop esi
pop ebp
ret
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x800c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4f8c15
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
mov eax, 2
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret

Function at 0x4f8d40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x595170]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f8d6d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4f8db4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4f8dba
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4f8e1b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4f8de0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4f8e47
mov eax, dword [esi + 4]
push 1
push 0x567378
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x567379
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4f8e20
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4f9280
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4f92d2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4f92d8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x50403c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x5362ab
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053612a

Function at 0x53d589
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0053d249
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x65657c9b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x69767619
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000a010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x1009fa70
mov dword [ebp - 0x2c], 0x6f0053
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x28], 0x740066
mov dword [ebp - 0x24], 0x610077
mov edx, 0x14
mov dword [ebp - 0x20], 0x650072
sub esi, eax
mov dword [ebp - 0x1c], 0x57005c
mov dword [ebp - 0x18], 0x610068
mov dword [ebp - 0x14], 0x65006c
mov dword [ebp - 0x10], 0x6c0043
mov dword [ebp - 0xc], 0x610065
mov dword [ebp - 8], 0x6e
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x1000a094
movzx ecx, word [esi + eax]
test cx, cx
je 0x1000a094
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x1000a076
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x1009fa70
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret

Function at 0x1000a800
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.10038a90
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x1000a830
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.10056e00
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.1006483a
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
Function at 0x1000ad90
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.10038a90
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x4004]
push edi
mov edi, dword [ebp + 0xc]
push 0x4000
push 0
push eax
call fcn.10056e00
add esp, 0xc
mov dword [ebp - 0x4008], 0
test esi, esi
je 0x1000ae87
test edi, edi
je 0x1000ae87
lea eax, [ebp - 0x4008]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x1000ae87
cmp eax, 0x3fff
ja 0x1000ae87
lea ecx, [ebp - 0x4004]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1000ae87
lea eax, [ebp - 0x4010]
push eax
lea eax, [ebp - 0x400c]
push eax
push 0x10081784
lea eax, [ebp - 0x4004]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x1000ae87
mov esi, dword [ebp + 0x10]
lea eax, [esi + esi]
push eax
push 0
push edi
call fcn.10056e00
mov ecx, dword [ebp - 0x400c]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push esi
lea eax, [esi - 1]
push eax
push edi
call fcn.1000da10
add esp, 0x2c
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
Function at 0x1000b280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007ab5b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x1009d258]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.10035710
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 0x208
call fcn.10056e00
add esp, 0x14
lea ecx, [ebp - 0x219]
call fcn.10009f30
mov ecx, eax
test ecx, ecx
je 0x1000b3bf
mov eax, dword [ebp - 0x220]
mov edx, eax
nop dword [eax]
mov si, word [edx]
cmp si, word [ecx]
jne 0x1000b336
test si, si
je 0x1000b332
mov si, word [edx + 2]
cmp si, word [ecx + 2]
jne 0x1000b336
add edx, 4
add ecx, 4
test si, si
jne 0x1000b310
xor ecx, ecx
jmp 0x1000b33b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1000b376
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x228]
push eax
push 0x10081ac4
lea ecx, [ebp - 0x219]
call fcn.1000a010
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x220]
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
cmp word [ebp - 0x218], 0x31
lea esi, [eax - 0x10]
sete bl
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1000b3a2
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10038a7a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10007bc0
int3