joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4207f0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x103]
push 0x7f
push 0
push eax
mov dword [ebp - 0x90c], edi
mov byte [ebp - 0x104], 0
call fcn.0042dfc0
push 0x7f
lea eax, [ebp - 0x83]
mov byte [ebp - 0x84], 0
push 0
push eax
call fcn.0042dfc0
mov ebx, dword [edi]
mov dword [ebp - 0x908], ebx
mov esi, dword [ebx + 0x114]
mov eax, dword [esi + 0x1eb4]
sub eax, dword [esi + 0x1eb0]
add eax, 2
push eax
lea eax, [esi + 0x1cb0]
push eax
push 0x3c
push ebx
call fcn.0041fe30
mov eax, dword [esi + 0x1eb0]
add esp, 0x28
movzx ecx, byte [eax]
inc eax
mov dword [esi + 0x1eb0], eax
cmp ecx, 0x18
je 0x4209e0
cmp ecx, 0x23
je 0x4209bd
cmp ecx, 0x27
jne 0x420a73
push 0
push ecx
push 0xfa
push 0xff
push 0x44ec6c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.0040cdd0
mov esi, dword [esi + 0x1cac]
add esp, 0x1c
mov edi, 4
mov eax, 0x800
test esi, esi
je 0x42095a
mov edx, dword [esi]
mov ecx, edx
lea ebx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4208e0
sub ecx, ebx
lea ebx, [edi + 1]
add ebx, ecx
cmp ebx, 0x7fa
jae 0x420948
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push edx
call fcn.0042d6e0
add esp, 0x10
test eax, eax
je 0x420948
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, edi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, edi
push eax
call fcn.0040cdd0
add esp, 0x1c
mov edi, ebx
mov esi, dword [esi + 4]
test esi, esi
jne 0x4208d6
mov ebx, dword [ebp - 0x908]
mov eax, 0x800
push 0xf0
push 0xff
sub eax, edi
push 0x44ec94
push eax
lea eax, [ebp - 0x904]
add eax, edi
push eax
call fcn.0040cdd0
add esp, 0x14
lea eax, [ebp - 0x904]
add edi, 2
push 0
push edi
push eax
mov eax, dword [ebp - 0x90c]
push dword [eax + 0x154]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x4209b5
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0040b260
add esp, 0xc
lea eax, [edi - 2]
jmp 0x420a60
lea edx, [esi + 0x1c28]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4209c8
push 0xf0
push 0xff
push edx
push 0
push 0x23
jmp 0x420a06
lea edx, [esi + 0x1c08]
mov ecx, edx
lea esi, [ecx + 1]
jmp 0x4209f0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4209f0
push 0xf0
push 0xff
push edx
push 0
push 0x18
push 0xfa
push 0xff
push str._c_c_c_c_s_c_c
sub ecx, esi
lea eax, [ebp - 0x904]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.0040cdd0
add esp, 0x28
lea eax, [ebp - 0x904]
push 0
push esi
push eax
push dword [edi + 0x154]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x420a5d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.0040b260
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push ebx
call fcn.0041fe30
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b207
mov esp, ebp
pop ebp
ret
Function at 0x4216d0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, dword [eax + 0x3a8]
mov edi, dword [eax]
lea ebx, [esi + 0x15c]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
push dword [ebx]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x421763
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.0042e530
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x421796
push str.Received_too_short_packet
push edi
call fcn.0040b260
add esp, 8
mov dword [esi + 0xc], 7
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b207
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004212d0
movzx eax, ax
add esp, 4
mov dword [esi + 0xc], eax
add eax, 0xfffffffd
cmp eax, 3
ja case.default.0x4217b1
jmp dword [eax*4 + 0x4218c8]
cmp edx, 4
jle case.0x4217b1.4
push ebx
call fcn.004212b0
movzx ecx, word [esi + 0x40]
add esp, 4
inc ecx
cmp cx, ax
jne case.0x4217b1.4
lea eax, [edx - 4]
push eax
mov eax, dword [ebx]
add eax, 4
push eax
push 1
push dword [ebp - 0x8c]
call fcn.0040b150
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x421816
push 5
push esi
call fcn.00421fe0
add esp, 8
mov eax, ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b207
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x70], eax
adc dword [edi + 0x74], edx
push dword [edi + 0x74]
push dword [edi + 0x70]
push edi
call fcn.004119e0
jmp 0x42188e
push ebx
call fcn.004212b0
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebx]
add eax, 4
push eax
push 0x44b494
push edi
call fcn.0040b300
add esp, 0x10
jmp case.0x4217b1.4
lea eax, [edx - 2]
push eax
mov eax, dword [ebx]
add eax, 2
push eax
push esi
call fcn.00421480
add esp, 0xc
test eax, eax
je case.0x4217b1.4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b207
mov esp, ebp
pop ebp
ret
push str.Internal_error:_Unexpected_packet
push 0x44b67c
push edi
call fcn.0040b260
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.00411c40
add esp, 4
test eax, eax
je 0x421783
push 5
push esi
call fcn.00421fe0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
mov eax, 0x2a
pop edi
pop esi
pop ebx
call fcn.0042b207
mov esp, ebp
pop ebp
ret
Function at 0x4218e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffd
cmp eax, 4
ja case.0x4218fd.4
jmp dword [eax*4 + 0x421b18]
lea eax, [edi + 0x15c]
push eax
call fcn.004212b0
movzx ecx, word [edi + 0x40]
add esp, 4
movzx esi, ax
lea eax, [ecx + 1]
and eax, 0xffff
cmp eax, esi
jne 0x42192f
mov dword [edi + 0x18], 0
jmp 0x421946
cmp ecx, esi
jne 0x4219ba
push esi
push str.Received_last_DATA_packet_block__d_again._n
push ebx
call fcn.0040b300
add esp, 0xc
mov word [edi + 0x40], si
lea esi, [edi + 0x160]
push 4
push esi
call fcn.00421310
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.004212f0
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x421a8e
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
cmp dword [edi + 0x14c], eax
lea eax, [edi + 0x38]
push eax
setl cl
lea ecx, [ecx*2 + 1]
mov dword [edi], ecx
call fcn.0042df6a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push esi
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.0040b300
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
lea esi, [edi + 0x160]
push 4
push esi
mov word [edi + 0x40], ax
mov dword [edi + 0x18], eax
call fcn.00421310
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.004212f0
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x421a8e
lea eax, [edi + 0x38]
mov dword [edi], 1
push eax
call fcn.0042df6a
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
movzx eax, word [edi + 0x40]
inc dword [edi + 0x18]
inc eax
push dword [edi + 0x18]
and eax, 0xffff
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.0040b300
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x421a6a
mov dword [edi + 8], 0xffffff9d
xor eax, eax
mov dword [edi], 3
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x421af4
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.00408960
push eax
push 0x44b67c
push ebx
call fcn.0040b260
add esp, 0x14
mov eax, 0x37
pop edi
pop esi
pop ebx
pop ebp
ret
lea esi, [edi + 0x160]
push 5
push esi
call fcn.00421310
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.004212f0
add esp, 0x10
lea eax, [edi + 0xc8]
push dword [edi + 0x148]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
mov dword [edi], 3
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push str.tftp_rx:_internal_error
push 0x44b67c
push ebx
call fcn.0040b260
add esp, 0xc
mov eax, 0x47
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x421fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [ecx]
mov eax, dword [eax]
cmp edx, 3
ja case.default.0x421ff2
jmp dword [edx*4 + 0x422048]
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.00421b30
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004218e0
mov dword [ebp + 8], ecx
pop ebp
jmp fcn.004221f0
push str.TFTP_finished
push 0x44b494
push eax
call fcn.0040b300
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0x44b67c
push eax
call fcn.0040b260
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x425890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4258bc
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4258ad
pop edi
xor eax, eax
pop esi
pop ebp
ret
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x4258f0
cmp dword [esi + 8], 0
jne 0x4258e0
push 0x457b40
push dword [eax + 8]
call fcn.0042d85b
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4258e0
pop edi
or eax, 0xffffffff
pop esi
pop ebp
ret
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0042d05b
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x425912
mov eax, dword [esi + 8]
test eax, eax
je 0x42590c
push eax
call fcn.0042d669
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x4285c0
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4285f2
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x428750
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x428783
push 0x2e
push edi
call fcn.0042c620
add esp, 8
test eax, eax
je 0x428781
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x4297d0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [esi + 1]
mov edi, edi
mov al, byte [esi]
inc esi
test al, al
jne 0x4297e0
sub esi, ecx
lea eax, [esi + esi]
push eax
mov dword [ebp - 0xc], eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x429808
lea eax, [edi + 0x1b]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp + 0xc]
push edi
call fcn.0042a570
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x429887
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x42987c
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x10
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x45b004]
add esp, 4
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x429aa0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push edi
mov edi, dword [ebp + 0x10]
push 0xf0000000
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x429b38
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
movdqu xmmword [ebp - 0x18], xmm0
push edi
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.00429ba0
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0042b140
add esp, 0x10
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x429b4a
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042b207
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push dword [ebp - 0x20]
mov eax, dword [ecx]
mov dword [esi], eax
mov eax, dword [ecx + 4]
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push 0
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
xor ecx, ebp
pop esi
call fcn.0042b207
mov esp, ebp
pop ebp
ret
Function at 0x42a5f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x42a61d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x42a664
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x42a66a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x42a6ca
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
lea ebx, [ebx]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
dec dword [ebp + 0x10]
jne 0x42a690
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x42a6f7
nop
mov eax, dword [esi + 4]
push 1
push str.6zlib1.dll
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x4508ff
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x42a6d0
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x43c7e4
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x45b080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0043347a
mov dword [ebp - 0x14], eax
cmp dword [0x45dbe8], esi
jne 0x43c8d7
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x43c864
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x43c9b7
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x43c9b7
push 0x454b14
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43c9b7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x45dbe8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x45dbec], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x45dbf0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45dbf8], eax
test eax, eax
je 0x43c8d4
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x45dbf4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x43c8fc
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x43c8ef
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x43c911
push 4
pop eax
jmp 0x43c9b9
cmp dword [ebp - 0x14], esi
je 0x43c911
push dword [0x45dbe8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x43c8f6
mov eax, dword [0x45dbf4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x43c96f
cmp dword [0x45dbf8], edi
je 0x43c96f
push eax
call ebx
push dword [0x45dbf8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x43c96f
test eax, eax
je 0x43c96f
call ecx
test eax, eax
je 0x43c964
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x43c964
test byte [ebp - 8], 1
jne 0x43c96f
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x43c99f
mov eax, dword [0x45dbec]
cmp eax, edi
je 0x43c99c
push eax
call ebx
test eax, eax
je 0x43c99c
call eax
mov esi, eax
test esi, esi
je 0x43c99c
mov eax, dword [0x45dbf0]
cmp eax, edi
je 0x43c99c
push eax
call ebx
test eax, eax
je 0x43c99c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x45dbe8]
call ebx
test eax, eax
je 0x43c9b7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x43c9b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042b207
mov esp, ebp
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x44da44
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44da90
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44da75
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44da85
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44daa0
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44dadf
test ebx, ebx
je 0x44dab4
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44daa9
cmp ecx, 0xfff1
jb 0x44dac2
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44dbca
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44db04
Function at 0x464094
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x7b
pop ecx
add eax, 0x24ea9aaf
or esp, ebx
push ebx
les edx, [ecx + 0x71]
dec edi
invalid
pop ss
pop ebx
jb 0x464063
hlt

Function at 0x464404
Capabilities:
Encode data using xor

Disassembly:
pop esp
push es
push cs
sbb eax, 0xda3e7c8
wait
adc al, byte [ecx + edx*2 - 0x2bb060d]
push eax
wait
daa
adc byte [ebx + ebp*4 - 0x4b], bl
sub dword [ecx + edx*2 - 0x5a], esi
sbb ebp, ebp
sbb byte [ebx - 0x36], ah
mov word [esi - 0x40], gs
xor eax, 0x8b8d7920
nop
mov eax, 0x88b488a5
lea ecx, [ebx - 0x775a4770]
mov ah, 0x88
mov dword [0x288b32c7], eax
or dword [edx + 0x16], edi
fidiv dword [ecx + 0x2a]
into
push eax
call 0x25a045a9
sbb eax, 0xacdc6a8
sub al, 6
stc
xor al, 0x5b
les eax, [edx]
jnp 0x464387
or cl, 0xd1
cli
push es
or byte [edx], dl
sbb eax, dword [ebx]
stc
adc eax, 0x904c00c6
xor al, 0xb6
mov ebp, 0xc7c9299b
pop edi
and esp, dword [esi + 0x4081eade]
mov eax, 0x530dd866
mov dword [eax], ebx
jne 0x4643aa
stc
insb byte es:[edi], dx
pop edi
sbb dh, al
popal
aam 0xbb
sbb ch, bh
fdivr dword [esi - 0xa7e5e4]
mov esi, 0xff581a1c
dec esp
imul esp, dword [eax], 0xa66bbb1
leave
sar byte [0xa1cb6d17], 0x79
scasb al, byte es:[edi]
mov fs, word [ecx - 0x80]
xor al, 0x5d
sti
not byte [0x89a6054f]
sbb al, ah
sahf
lodsd eax, dword [esi]
dec eax
xchg edx, eax
insb byte es:[edi], dx
ror byte [eax], 0x1c
adc al, 0x35
js 0x464413
pop ss
insd dword es:[edi], dx
retf
arpl bx, bp
jecxz 0x464469
adc bl, dl
pop edx
adc al, 0x74
push esi
ret
out dx, eax
push edi
mov cl, 0x85
pushal
test eax, 0x5594bae6
sub byte [ebp - 0x6e], al
js 0x464411
je 0x46449b
cmp ecx, dword fs:[ebx + 0x581110d3]
loope 0x4644b5
cmp ecx, dword [esi - 0x1497d0c4]
mov dl, 0xa0
sub byte [ebp + ebp*4 + 0x62eaa7f5], cl
cmp al, 0x2f
push 0x28a0b2eb
mov word [ebp + 0x62eaa7f5], gs
ret 0xf030
movhps qword [ecx], xmm5
lodsd eax, dword [esi]
out dx, eax
vpaddsb xmm6, xmm0, xmmword [edi + ebx*8]
dec ecx
add byte [ebp - 0x2a8f42c3], ch
push 0x389ea06d
js 0x464485
adc dword [ecx + ebp*8], ecx
test eax, ebp
clc
aam 0xb9
adc esi, dword [esi + 0x4ff5749f]
adc al, 0xf5
loope 0x46450c
jmp 0xf92eca1f
scasb al, byte es:[edi]
retf
mov cl, 0x72
invalid