joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ba30
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00405060
call sub.kernel32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x40ba66
jmp 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba63
cmp al, 0x20
je 0x40ba63
cmp al, 0x22
jne 0x40ba89
jmp 0x40baf4
cmp al, 0x20
lea esi, [esi]
je 0x40ba90
test al, al
je 0x40baa5
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x40ba77
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x40bb0a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x40ba97
cmp al, 0x20
je 0x40ba97
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x40bab4
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401803
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x40bafe
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x40baf0
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x40ba90
cmp al, 9
je 0x40ba97
jmp 0x40baa5

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x5b2752e5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2af5671d
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405c8e
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x405d74
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040603f
test bl, 8
mov dword [ebp - 8], eax
je 0x405db3
push edi
call dword [0x408170]
neg eax
sbb eax, eax
inc eax
add dword [0x42a2e8], eax
jmp 0x405f30
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x405dcd
test eax, eax
je 0x405ede
test bl, 2
je 0x405ede
mov esi, 0x425750
push edi
push esi
call fcn.00406668
cmp dword [ebp + 8], 0
je 0x405dec
push 0x40a59c
push esi
call fcn.00406684
jmp 0x405df2
push edi
call fcn.00405f83
cmp word [edi], 0
jne 0x405e02
cmp word [0x425750], 0x5c
jne 0x405e0d
push 0x40a014
push edi
call fcn.00406684
push edi
call fcn.0040667e
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [0x40816c]
mov esi, eax
cmp esi, 0xffffffff
je 0x405ed3
cmp word [ebp - 0x22c], 0x2e
jne 0x405e57
cmp word [ebp - 0x22a], 0
je 0x405eb6
cmp word [ebp - 0x22a], 0x2e
jne 0x405e57
cmp word [ebp - 0x228], 0
je 0x405eb6
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406668
test byte [ebp - 0x258], 0x10
je 0x405e82
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405eb6
push dword [ebp + 0xc]
push edi
call fcn.00405d74
jmp 0x405eb6
push dword [ebp - 4]
push edi
call fcn.00405d2c
test eax, eax
jne 0x405eae
cmp dword [ebp - 4], eax
je 0x405ea6
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push 0
push edi
call fcn.00406428
jmp 0x405eb6
inc dword [0x42a2e8]
jmp 0x405eb6
push edi
push 0xfffffffffffffff2
call fcn.004056ca
lea eax, [ebp - 0x258]
push eax
push esi
call dword [0x408168]
test eax, eax
jne 0x405e2f
push esi
call dword [0x408164]
cmp dword [ebp + 8], 0
je 0x405ede
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405f30
cmp dword [ebp - 8], esi
jne 0x405ef2
inc dword [0x42a2e8]
jmp 0x405f30
push edi
call fcn.0040699e
test eax, eax
je 0x405f30
push edi
call fcn.00405f37
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.00405d2c
test eax, eax
jne 0x405f28
cmp dword [ebp - 4], esi
je 0x405eea
push edi
push 0xfffffffffffffff1
call fcn.004056ca
push esi
push edi
call fcn.00406428
jmp 0x405f30
push edi
push 0xffffffffffffffe5
call fcn.004056ca
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc
Function at 0x404325
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push str.FlsGetValue
push 0x40e42c
push str.FlsGetValue
push 2
call fcn.00405f32
add esp, 0x10
push dword [ebp + 8]
test eax, eax
je 0x40434c
call eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop ebp
ret

Function at 0x404947
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push str.FlsGetValue
push 0x40e42c
push str.FlsSetValue
push 3
call fcn.00405f32
add esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x404971
call eax
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop ebp
ret

Function at 0x406027
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push str.FlsGetValue
push 0x40e42c
push str.FlsAlloc
push 0
call fcn.00405f32
add esp, 0x10
test eax, eax
je 0x40604e
push dword [ebp + 8]
call eax
pop ebp
ret
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x406809
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1fc
mov eax, dword [0x415f14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfffffffffffffff4
call fcn.00404221
mov esi, eax
pop ecx
test esi, esi
je 0x406875
cmp esi, 0xffffffff
je 0x406875
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x1f8]
mov al, byte [edx]
mov byte [ecx], al
inc ecx
lea eax, [ebp - 4]
cmp ecx, eax
je 0x406850
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x406839
xor eax, eax
push eax
mov byte [ebp - 5], al
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1fc]
push eax
lea eax, [ebp - 0x1f8]
sub ecx, eax
dec ecx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040518a
mov esp, ebp
pop ebp
ret

Function at 0x406cc3
Capabilities:
Parse pe header

Disassembly:
call fcn.00407996
test al, al
jne 0x406ccf
xor al, al
ret
push 0
call fcn.004022a6
pop ecx
mov ecx, eax
test ecx, ecx
je 0x406ccc
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x406ccc
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x406ccc
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x406ccc
cmp dword [eax + 0x74], 0xe
jbe 0x406ccc
cmp dword [eax + 0xe8], 0
setne al
ret
Function at 0x40770f
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.00407987
test al, al
jne 0x407724
xor eax, eax
jmp 0x40784b
push ebx
xor ecx, ecx
mov ebx, 0x417dec
xor eax, eax
lock cmpxchg dword [ebx], ecx
test eax, eax
jne 0x407848
push esi
push edi
push 0x800
push eax
mov edi, 0x40f3d0
push edi
call fcn.0040246e
mov esi, eax
add esp, 0xc
mov dword [ebp - 4], esi
test esi, esi
jne 0x407787
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x407839
push esi
push esi
push edi
call fcn.0040246e
add esp, 0xc
lea ecx, [ebp - 4]
push eax
call fcn.004032ca
mov esi, dword [ebp - 4]
test esi, esi
je 0x407839
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push esi
call edi
mov dword [ebp - 4], eax
test eax, eax
je 0x407839
push str.MessageBoxW
push esi
call edi
mov dword [ebp - 8], eax
test eax, eax
je 0x407839
push dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_EncodePointer]
call edi
mov ecx, 0x417df0
xchg dword [ecx], eax
push dword [ebp - 8]
call edi
mov ecx, 0x417df4
xchg dword [ecx], eax
push str.GetActiveWindow
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417df8
xchg dword [ecx], eax
push str.GetLastActivePopup
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417dfc
xchg dword [ecx], eax
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417e00
xchg dword [ecx], eax
push str.GetUserObjectInformationW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
mov ecx, 0x417e04
xchg dword [ecx], eax
mov ecx, esi
xor eax, eax
lock cmpxchg dword [ebx], ecx
neg eax
sbb eax, eax
and esi, eax
jmp 0x40783b
xor ebx, ebx
test esi, esi
je 0x407846
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407919
Capabilities:
Create thread
Print debug messages

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004075ca
Function at 0x4018f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x40196a
cmp dword [ebp - 0x118], 0
je 0x40196a
jmp 0x4019cc
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x4019cc
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x431314], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x431330], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.004011b0
mov eax, dword [ebp + 8]
mov dword [0x43132c], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401300
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x40196a
mov esp, ebp
pop ebp
ret

Function at 0x401a60
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x431320], 0x24e1
mov eax, dword [0x431320]
sub eax, 0x24e1
mov dword [0x431320], eax
mov ecx, 1
test ecx, ecx
je 0x401b0b
mov edx, dword [0x431320]
cmp edx, dword [ebp + 0xc]
jb 0x401a97
jmp 0x401b0b
cmp dword [0x431320], 0
jne 0x401ab5
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401ab5
xor eax, eax
jmp 0x401b0b
mov eax, dword [ebp + 8]
add eax, dword [0x431320]
mov ecx, dword [eax]
add ecx, dword [0x431320]
mov edx, dword [ebp + 8]
add edx, dword [0x431320]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x431320]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x431320]
push eax
call fcn.004011c0
add esp, 8
mov ecx, dword [0x431320]
add ecx, 4
mov dword [0x431320], ecx
jmp 0x401a7d
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d7a
sub eax, 0x403d20
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x100f7cc0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100f7ead
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa7000]
push edi
or ebp, 0xffffffff
jmp 0x100f7cea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100f7cf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f7ce0
mov eax, 1
add ebx, ebx
jne 0x100f7d03
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100f7d14
jne 0x100f7d33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f7d33
dec eax
add ebx, ebx
jne 0x100f7d20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100f7cf8
add ebx, ebx
jne 0x100f7d2f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100f7d85
xor ecx, ecx
sub eax, 3
jb 0x100f7d4b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100f7dba
sar eax, 1
mov ebp, eax
jmp 0x100f7d56
add ebx, ebx
jne 0x100f7d56
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f7d24
inc ecx
add ebx, ebx
jne 0x100f7d64
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100f7d24
add ebx, ebx
jne 0x100f7d71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100f7d66
jne 0x100f7d82
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100f7d66
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100f7da4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100f7d96
jmp 0x100f7ce6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100f7da4
add edi, ecx
jmp 0x100f7ce6
pop esi
mov edi, esi
mov ecx, 0x321c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100f7dc2
cmp byte [edi], 0x1e
jne 0x100f7dc2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100f7dc7
lea edi, [esi + 0xf0000]
mov eax, dword [edi]
or eax, eax
je 0x100f7e3f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf8c38]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf8d50]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100f7df4
mov ecx, edi
jns 0x100f7e23
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf8d54]
or eax, eax
je 0x100f7e39
mov dword [ebx], eax
add ebx, 4
jmp 0x100f7e11
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100f7e70
cmp al, 0xef
ja 0x100f7e63
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100f7e45
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100f7e52
mov ebp, dword [esi + 0xf8d58]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100f7ea4
sub esp, 0xffffff80
jmp 0x1006529d
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x76443b7c
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x11f5341c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40c6a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40c6c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c6c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c6b8
mov eax, 1
add ebx, ebx
jne 0x40c6db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c6d0
jne 0x40c6ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c6d0
xor ecx, ecx
sub eax, 3
jb 0x40c700
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c772
mov ebp, eax
add ebx, ebx
jne 0x40c70b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c718
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c73c
inc ecx
add ebx, ebx
jne 0x40c728
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c71d
jne 0x40c739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c71d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c75c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c74d
jmp 0x40c6be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c75c
add edi, ecx
jmp 0x40c6be
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c7c4
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc050]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c779
mov ecx, edi
jns 0x40c7a8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc054]
or eax, eax
je 0x40c7be
mov dword [ebx], eax
add ebx, 4
jmp 0x40c796
call dword [esi + 0xc05c]
mov ebp, dword [esi + 0xc058]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40c7f8
sub esp, 0xffffff80
jmp 0x40a94c

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x406f30
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push 0x558b18f2
enter 0xffffffffffffca8b, 0x56
push esi
mov esi, dword [ebp - 0x33]
and eax, 3
push edi
mov dword [edx], 0x3a004c00
je 0x406f76
test esi, esi
je 0x406f6b
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x406f65
cmp eax, 3
xor dl, byte [eax]
test cl, 2
je 0x406fc6
pop edi
add byte [edi + 0x5e000111], 0x5d
add byte [esi + 0x5d], bl
aad 0x18
push es
pop edi
mov eax, 0x2f
pop esi
cmpsb byte [esi], byte es:[edi]
ret 0xd818
mov eax, dword [ebp + 0x10]
ja 0x406f3b
jne 0x406f82
mov eax, 0xad02
mov cl, 0x7d
dec edx
push edi
push ecx
mov ecx, dword [ebp + 0x14]
push ecx
push eax
push esi
push edx
call 0x6a406fa0
xor dword [ecx + 0x5d5e3618], 0xffffffc2
sbb byte [ebx - 0x70], dl
jmp 0x8b958932
daa
jl 0x40705d
cmp al, 0xf8
jg 0x40707d
push 0x2640f434
push esi
call dword [0xc11c]
mov edx, eax
cmp dh, bh
cmp cl, cl
push dword [ebx]
rol byte [ebx - 0x510df73c], 0xf7
ror dword [ecx + 0x3b], 1
ror dword [edi], 1
test dword [eax + eax - 0x7caa0000], ecx
jae 0x406fbd
rol dword [eax], 0x89
inc ebp
clc
adc dword [esi - 0x13b27208], eax
lea edx, [ebp - 0x24]
mov dword [esp + ebp*8], esi
xchg dword [ebp - 0x10], ebx
inc esi
dec ebp
call 0x8b4cc59a
inc ebp
or al, 0x8b
int 0xc
cmp dword [ecx], ebx
je 0x304123c6
mov eax, dword [ebp + 0xc]
mov ecx, ebp
or al, 0x39
sbb dword [edi], ecx
test byte [eax - 0x2acfff4d], ch
adc esp, edi
aad 0x11
cld
mov edx, dword [ebp + 0x1c]
push 0xfffffffffffffffd
push edx
call fcn.00404a60
clc
xor eax, eax
mov esi, edi
mov ecx, 0xe3
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
and ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x5a]
mov ecx, eax
mov edx, dword [ecx + 0xc]
mov ebp, dword [eax + 0x51558b17]
push edx
or eax, 0x56088b02
mov dword [eax], eax
sub al, 0xe8
jne 0x407056
call fcn.00406dd0
add esp, 0xc
test ebx, ebx
jne 0x4070a5
invalid
or al, 0x85
invalid
imul eax, dword [ebp - 0xc], 0xffffff85
sal byte [ebp + ecx + 0x50], 0x8b
inc ebp
sbb al, 0x50
or eax, 0x1c458b50
push eax
call 0x3fd350
inc esi
add al, 0x8b
dec ebp
push ebx
lahf
push edx
jmp 0x4070ae
push esi
call dword [sym.imp.WSOCK32.dll_gethostbyname]
cmp eax, ebx
mov dword [ebp + 0x18], eax
jne 0x407010
mov eax, dword [eax + ebx*8 - 0x3f]
inc eax
push ebx
call esi
test eax, eax
je 0x4070c6
call esi
pop edi
pop esi
add eax, 0xafc80
pop ebx
mov esp, ebp
js 0x407068
mov edx, dword [ebx + 4]
mov dword [esi + 4], edx
mov dword [0xc458b24], esi
mov eax, dword [ebp + 0xc]
adc ebp, 4
in al, dx
fimul word [ecx + 0x488bfc7d]
or al, 0x83
cmp al, 0xf
add byte [esi - 0x7b], dl
pop ebx
invalid
xchg edi, eax
pop esi
xor eax, eax
pop ebx
mov esp, dword [edi + 0x5590c35d]
mov ebp, esp
sub esp, 0x9354
mov ecx, dword [ebp + 0x5a]
push ebx
push esi
xor esi, esi
mov eax, dword [ecx]
insb byte es:[edi], dx
push ecx
add al, 0x89
inc ebp
hlt
Function at 0x407d20
Capabilities:
Encode data using xor

Disassembly:
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0xc
or al, 2
lodsb al, byte [esi]
add ecx, dword [esp + ecx]
dec edx
dec eax
or al, 0xd8
sub byte [esp + ecx], cl
or al, 0xc
inc edi
or al, 0xc7
or al, 0xe4
add al, 0xc
or al, 0x5f
or al, 0xc
or al, 0xc
or al, 0xc
or al, 0x3f
scasb al, byte es:[edi]
add bl, byte [ecx + 0xc8f0c03]
or al, 0xc
or al, 7
or byte [ecx], cl
or al, 0xa
or al, 0xb
or al, 4
lea ecx, [ecx]
mov byte [0x8900d77b], al
jns 0x407d06
cmp esp, dword [esi]
jp 0x407ccb
add byte [ecx + edi*2 - 0xb], al
add cl, bl
cmp eax, 0x79a2fa4d
inc eax
cwde
pop ds
jns 0x407cdb
add byte [ebp + 0x79], bh
pop ds
add byte [ebx + 0x7a], dh
inc eax
add byte [eax], al
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or dh, ch
or byte [eax], cl
retf 0xe408
or byte [eax], cl
or byte [edx], dl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
jo 0x407d0a
or bh, dl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
add dword [edx], eax
or byte [eax], cl
or byte [edx], al
or byte [edx], dh
add edx, ecx
or byte [eax], cl
or byte [eax], cl
or byte [edx + 0x4022b08], dh
or byte [eax], cl
or byte [eax], cl
enter 0xfffffffffffff408, 8
or byte [eax], cl
je 0x407d0d
or byte [eax], cl
or byte [eax], cl
fimul word [eax]
or byte [eax], cl
or byte [eax], cl
or dh, bl
or byte [eax], cl
or byte [eax], cl
or byte [eax], cl
or byte [ecx], bh
or byte [eax], cl
push es
or byte [eax], cl
or byte [eax], cl
cmp dword [eax], ecx
or byte [esi], al
or byte [edx], cl
push ss
not byte [bx + si - 0x4870]
nop
nop
or edx, dword [ebp - 0x75]
push ebp
mov ebp, esp
sub esp, 0x58
push esi
lea eax, [ebp - 0x58]
sbb ecx, dword [ebx + 0x4dac107d]
cld
push eax
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x5f]
push ecx
mov ecx, dword [ebp - 0x4a]
push edx
push edi
push eax
push ecx
call fcn.00407ec0
imul ecx, dword [ebp - 4], 0x8314fd8d
les ebx, [eax]
mov esp, esp
clc
test ecx, ecx
inc ebx
imul esi, dword [ebp + esi*2 - 0x3a], 0xffffff92
sub eax, 0x8d01728d
jl 0x407d5f
call dword [ebx - 0x7b]
add edi, dword [esi + 0xf]
push ebx
test dword [ebx], eax
jle 0x407d74
scasd eax, dword es:[edi]
cmp al, 1
xor byte [ebp + 6], dh
dec edi
dec ecx
test ecx, ecx
jg 0x407d65
mov dword [ebp + 0x10], edi
mov edi, esi
or al, 0x85
pop edx
xadd byte [ebx + ecx*8 - 0x34e0d66a], dh
sub ecx, edi
cmp ecx, 0x4b
xchg esp, eax
invalid