joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405b80
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [sym.imp.msvcrt.dll__osver]
mov ebx, dword [ebp + 0x14]
mov eax, dword [eax]
test ah, 0x80
je 0x405ba1
mov eax, dword [0x4133c0]
test eax, eax
jne 0x405bc6
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [0x4133c0], 0
call sub.msvcrt.dll_fflush
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
lea edx, [ebp - 0x24]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileSize
sub esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x405d20
mov eax, dword [ebx + 0x10]
mov esi, dword [ebp - 0x20]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
lea edx, [ebp - 0x1c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
je 0x405da0
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x20]
jbe 0x405d55
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub esp, 0x10
sub edx, dword [ebp - 0x28]
sbb ecx, dword [ebp - 0x24]
cmp ecx, 0
jl 0x405d04
jle 0x405d37
cmp ecx, 0
mov esi, edx
jl 0x405cad
jle 0x405d41
mov esi, 0x200
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], ecx
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
lea ecx, [ebp - 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x4131c0
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x3c]
sub esp, 0x14
test eax, eax
je 0x405d70
mov eax, dword [ebp - 0x2c]
cmp esi, eax
ja 0x405d70
xor edi, edi
sub edx, eax
sbb ecx, edi
cmp ecx, 0
jge 0x405c95
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
sub esp, 4
jmp 0x405ba1
call sub.KERNEL32.dll_GetLastError
test eax, eax
je 0x405c0f
mov eax, 0xffffffff
jmp 0x405bbe
cmp edx, 0
jbe 0x405d04
jmp 0x405c9b
cmp edx, 0x200
jbe 0x405cad
lea esi, [esi]
jmp 0x405ca8
jb 0x405ba1
cmp eax, dword [ebp - 0x28]
nop
ja 0x405c56
jmp 0x405ba1
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call sub.msvcrt.dll__get_osfhandle
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
jmp 0x405d2d
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x405d2d
jmp 0x405c47
Function at 0xa61f60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x79d015
lea edi, [esi - 0x39c015]
mov dword [edi + 0x617bdc], 0x4ee04ec
push edi
or ebp, 0xffffffff
jmp 0xa61f8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xa61f91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa61f80
mov eax, 1
add ebx, ebx
jne 0xa61fa3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xa61fb4
jne 0xa61fd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa61fd3
dec eax
add ebx, ebx
jne 0xa61fc0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xa61f98
add ebx, ebx
jne 0xa61fcf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xa62025
xor ecx, ecx
sub eax, 3
jb 0xa61feb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xa6205a
sar eax, 1
mov ebp, eax
jmp 0xa61ff6
add ebx, ebx
jne 0xa61ff6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa61fc4
inc ecx
add ebx, ebx
jne 0xa62004
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xa61fc4
add ebx, ebx
jne 0xa62011
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xa62006
jne 0xa62022
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xa62006
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xa62044
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xa62036
jmp 0xa61f86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xa62044
add edi, ecx
jmp 0xa61f86
pop esi
mov edi, esi
mov ecx, 0x17e17
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xa62062
cmp byte [edi], 0x67
jne 0xa62062
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xa62067
lea edi, [esi + 0x649000]
mov eax, dword [edi]
or eax, eax
je 0xa620d6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6624ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6625dc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xa62094
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6625e0]
or eax, eax
je 0xa620d0
mov dword [ebx], eax
add ebx, 4
jmp 0xa620b1
call dword [esi + 0x6625f0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xa62107
cmp al, 0xef
ja 0xa620fa
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xa620dc
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xa620e9
mov ebp, dword [esi + 0x6625e4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x662162]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xa62153
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x401007
Capabilities:
Delete file
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.00409970
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [eax]
mov eax, dword [eax + 4]
xor ebx, ebx
cmp dword [0x2af9a94], 0x594
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], eax
jne 0x401042
push ebx
lea eax, [ebp - 0x838]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x423ee8]
mov dword [ebp - 0x28], eax
mov eax, dword [0x423eec]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
call fcn.00401000
mov eax, dword [0x423ef0]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [0x423ef4]
add esi, 0x23f
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x2af9a94], 0xc
mov dword [ebp - 4], eax
jne 0x4010da
push ebx
lea eax, [ebp - 0x438]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosw word es:[edi], ax
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x20]
lea eax, [ebp - 0x1038]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov eax, dword [0x2af9a94]
cmp eax, 0xfa9
jne 0x4010f6
mov dword [0x2af9a90], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401111
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2af9444], ebx
mov ecx, dword [ebp - 0xc]
mov edx, edi
lea eax, [esi + edi]
shr edx, cl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x2af9a8c], 0xf4ea3dee
add edx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
shr eax, cl
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub edi, dword [ebp - 4]
add esi, 0x61c88647
dec dword [ebp - 0x1c]
mov dword [ebp - 0x14], edi
jne 0x40107d
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], edi
pop edi
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4046e7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x423400]
jne 0x4046f1
repz ret
jmp fcn.004074bb

Function at 0x4070ed
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004040ee
and dword [ebp - 4], 0
cmp dword [0x425efc], 0
mov ebx, eax
jne 0x40719e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40724f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40724f
push eax
call fcn.0040407c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425efc], eax
call esi
push eax
call fcn.0040407c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f00], eax
call esi
push eax
call fcn.0040407c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425f04], eax
call esi
push eax
call fcn.0040407c
pop ecx
mov dword [0x425f0c], eax
test eax, eax
je 0x40719e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040407c
pop ecx
mov dword [0x425f08], eax
mov eax, dword [0x425f08]
cmp eax, ebx
je 0x4071f6
cmp dword [0x425f0c], ebx
je 0x4071f6
push eax
call fcn.004040f7
push dword [0x425f0c]
mov esi, eax
call fcn.004040f7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4071f6
test edi, edi
je 0x4071f6
call esi
test eax, eax
je 0x4071ed
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4071ed
test byte [ebp - 0xc], 1
jne 0x4071f6
or dword [ebp + 0x10], 0x200000
jmp 0x40722f
mov eax, dword [0x425f00]
cmp eax, ebx
je 0x40722f
push eax
call fcn.004040f7
pop ecx
test eax, eax
je 0x40722f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40722f
mov eax, dword [0x425f04]
cmp eax, ebx
je 0x40722f
push eax
call fcn.004040f7
pop ecx
test eax, eax
je 0x40722f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425efc]
call fcn.004040f7
pop ecx
test eax, eax
je 0x40724f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407251
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x40225f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
jmp loc.0040a46a
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403cf8
nop
sub eax, 0x403c9e
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp int.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4c9342ed
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..text_1
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xa4d29f2
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x4019d5
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0x6dc]
mov dword [esi], 0x405638
call sub.MFC42.DLL_CString::CString
jmp loc.00447650

Function at 0x4037d7
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea ecx, [ebp - 4]
call fcn.00404146
movsx eax, byte [ebp + 8]
Function at 0x406f87
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push esi
push edx
call 0xe14116a0
cmp ah, al
sbb byte [edi + 0x5e], bl
sub eax, 0xfb99f5c2
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x5f
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor al, 0xdb
cmp eax, ebx
mov ah, ah
jne 0x406fa7
jne 0x406fba
mov esi, str.0.0.0.0
mov al, byte [esi]
cmp al, 2
psubusw mm7, qword [ecx + 0x3c00b01f]
cmp dword [edi], ecx
invalid

Function at 0x4073b0
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [edi + 0x407c04]
call dword [esi - 0x6b]
sar byte [ebx - 0x3f7a03c0], 1
jne 0x4073e3
mov ecx, dword [ebx + 4]
lea edx, [ebp - 4]
sbb dword [edi - 0x53aa7220], esi
add ebx, 8
into
lea esi, [edx]
rcl byte [edx + 0x6a]
add dword [ecx + 0x50], edx
xor dl, al
push edx
push 1
push ecx
push eax
call 0x407450
cmp esp, 0x18
jmp 0x407417
cmp eax, 1
je 0x4073f8
cmp eax, 0xffffffc2
jne 0x4073d2
and dword [esp + eax + 0x33], 0xffffffc0
stc
mov ecx, dword [edi - 0x74ca1404]
add eax, dword [ebx + 0x4d8d04c3]
cld
mov eax, dword [ebx]
add ebx, 4
lea ecx, [ebp - 4]
lea edx, [ebp - 0x54]
push ecx
lea ecx, [ebp - 0x30]
fcom qword [ecx + 0x6a]
xchg esp, eax
push eax
mov dword [ebp - 0x18], eax
fsubr qword [bx + si + 0xe]
add byte [ebx - 0x54aaeb3c], al
push ebp
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4077df
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
sar edx, 0x23
add al, byte [eax]
add byte [edx + 0x46], dh
mov eax, 0xb1000194
cmp edx, ebx
cld
jae 0xcffc77df
dec esi
out 6, al
xor byte [esi + 0x3b39fcfc], bl
enter 0x6089, 0xfffffffffffffffc
jb 0x407440
jmp 0x4077df
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x407aeb
mov eax, 0xf01c07d
test edi, esi
add al, byte [eax]
add byte [ebx + 0x458be055], cl
cld
cmp edx, eax
jbe 0x667aeb
cmp byte [ebp - 0x74], 0x30
jne 0x407aa5
inc ebp
sti
test byte [ecx + 0x44], cl
test byte [esi - 0x74fffffe], cl
inc ebp
hlt
mov edi, dword [ebp + 0xc]
insd dword es:[edi], dx
inc ebp
hlt
Function at 0x40a420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x40a42a
mov edx, dword [edx + 0x14]
nop
jmp 0x40a43d
mov esi, dword [edx + 0x28]
nop
jmp 0x40a44b
xor edi, edi
movzx ecx, word [edx + 0x26]
nop
xor eax, eax
jmp 0x40a460
lodsb al, byte [esi]
jmp 0x40a472
cmp al, 0x61
nop
jmp 0x40a483
jl 0x40a4a3
nop
jmp 0x40a496
nop
jmp 0x40a4a1
sub al, 0x20
nop
ror edi, 0xd
nop
add edi, eax
dec ecx
nop
jne 0x40a452
push edx
push edi
mov edx, dword [edx + 0x10]
jmp 0x40a4c4
mov eax, dword [edx + 0x3c]
nop
add eax, edx
nop
jmp 0x40a4dc
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x40a690
add eax, edx
nop
push eax
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
jmp 0x40a501
mov ecx, dword [eax + 0x18]
nop
jmp 0x40a50f
test ecx, ecx
nop
jmp 0x40a51e
je 0x40a67b
xor edi, edi
jmp 0x40a537
dec ecx
jmp 0x40a546
mov esi, dword [ebx + ecx*4]
jmp 0x40a556
add esi, edx
nop
jmp 0x40a569
nop
jmp 0x40a576
xor eax, eax
nop
lodsb al, byte [esi]
jmp 0x40a588
ror edi, 0xd
add edi, eax
jmp 0x40a59a
cmp al, ah
nop
jne 0x40a569
nop
jmp 0x40a5af
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
jne 0x40a504
nop
jmp 0x40a5ca
pop eax
mov ebx, dword [eax + 0x24]
jmp 0x40a5d9
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
nop
jmp 0x40a5ef
add ebx, edx
nop
mov eax, dword [ebx + ecx*4]
add eax, edx
nop
jmp 0x40a609
mov dword [esp + 0x24], eax
nop
pop ebx
jmp 0x40a61d
pop ebx
jmp 0x40a62e
popal
nop
jmp 0x40a640
pop ecx
pop edx
nop
jmp 0x40a656
push ecx
jmp 0x40a666
jmp eax
nop
jmp 0x40a68f
pop eax
pop edi
nop
pop edx
mov edx, dword [edx]
nop
jmp 0x40a6a3
jmp 0x40a43d

Function at 0x40a890
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x40a892
ret
Function at 0x407a60
Capabilities:
Authenticate hmac
Encode data using xor
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 4], edx
push esi
mov esi, ecx
push edi
cmp ebx, 0x40
jbe 0x407ac8
push ebx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x70], 0x67452301
mov dword [ebp - 0x6c], 0xefcdab89
mov dword [ebp - 0x68], 0x98badcfe
mov dword [ebp - 0x64], 0x10325476
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x18], 0
call fcn.00406ca0
lea edx, [ebp - 0x70]
lea ecx, [ebp - 0x14]
call fcn.00406fb0
lea eax, [ebp - 0x14]
mov ebx, 0x10
mov dword [ebp - 4], eax
push 0x40
lea edi, [esi + 0x1486]
push 0
push edi
call sub.VCRUNTIME140.dll_memset
push 0x40
add esi, 0x14c6
push 0
push esi
call sub.VCRUNTIME140.dll_memset
push ebx
push dword [ebp - 4]
push edi
call sub.VCRUNTIME140.dll_memcpy
push ebx
push dword [ebp - 4]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x30
mov eax, 0x40
xor byte [esi - 0x40], 0x36
lea esi, [esi + 1]
xor byte [esi - 1], 0x5c
sub eax, 1
jne 0x407b04
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42edc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], 0xfcfffeff
mov eax, dword [ebp - 4]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x114]
mov edx, dword [esi + 0x48]
lea ecx, [esi + 0x44]
push pe_nt_image_headers32
push eax
call fcn.00408120
test eax, eax
js 0x42ee9d
cmp dword [0x44f480], 0
je 0x42ee1c
lea eax, [ebp - 0x114]
push eax
push dword [esi + 8]
push str._3d:_DNSServiceGetProperty__s_
push 1
call fcn.0041dc40
add esp, 0x10
mov ecx, str.DaemonVersion
lea eax, [ebp - 0x114]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42ee47
test dl, dl
je 0x42ee43
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42ee47
add eax, 2
add ecx, 2
test dl, dl
jne 0x42ee27
xor eax, eax
jmp 0x42ee4c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x42ee9d
mov edi, dword [esi + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0x4000000
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
mov dword [ebp - 4], 0xb8d33200
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push 0xc
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 0xc
jge 0x42eedc
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push 0xc
jmp 0x42eecb
mov edi, dword [esi + 8]
lea eax, [ebp - 8]
push 0
push 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
mov ebx, eax
cmp ebx, 4
jge 0x42eedc
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
mov ecx, eax
call fcn.00408040
push eax
call esi
push eax
push 4
push ebx
push edi
push str.ERROR:_send_all__d__wrote__d_of__d_errno__d___s_
push 0
call fcn.0041dc40
add esp, 0x1c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret