joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d272c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d27c1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d27d8
mov edx, dword [ebp - 4]
call fcn.00405720
push 0xff
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xff
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 8]
call fcn.00405898
push eax
call sub.kernel32.dll_GetVolumeInformationA
mov eax, dword [ebp - 0xc]
xor edx, edx
push edx
push eax
mov eax, ebx
call fcn.0040a420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d27c8
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040542c
ret

Function at 0x4d28a8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d2982
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov ecx, 0x4d2998
mov edx, dword [ebp - 4]
call fcn.00405720
mov eax, dword [ebp - 8]
call fcn.00405898
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 6
ja case.0x4d28f2.0
jmp dword [eax*4 + 0x4d28f9]
mov eax, ebx
mov edx, 0x4d29a4
call fcn.0040545c
jmp 0x4d2967
mov eax, ebx
mov edx, 0x4d29b4
call fcn.0040545c
jmp 0x4d2967
mov eax, ebx
mov edx, 0x4d29c4
call fcn.0040545c
jmp 0x4d2967
mov eax, ebx
mov edx, 0x4d29d4
call fcn.0040545c
jmp 0x4d2967
mov eax, ebx
mov edx, 0x4d29e4
call fcn.0040545c
jmp 0x4d2967
mov eax, ebx
mov edx, 0x4d29f4
call fcn.0040545c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d2989
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040542c
ret
Function at 0x4d4c84
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405888
xor eax, eax
push ebp
push 0x4d4dc5
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4d4d95
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00405898
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.0040aa28
test al, al
jne 0x4d4d05
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403858
lea eax, [ebp - 0x1d0]
call fcn.004035f4
call fcn.004030d4
push dword [0x4e4f5c]
push 0x4d4ddc
push dword [0x4e4f60]
push 0x4d4ddc
push dword [0x4e4f64]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.0040579c
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.004d0420
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.00405bb8
call fcn.00403f50
call fcn.004030d4
lea eax, [ebp - 0x1d0]
call fcn.00403920
call fcn.004030d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d4d9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4dcc
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.0040542c
lea eax, [ebp - 4]
call fcn.00405408
ret
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x401029
mov al, byte [esi + 1]
inc esi
test al, al
je 0x401021
cmp al, 0x22
jne 0x401015
cmp byte [esi], 0x22
jne 0x401033
inc esi
jmp 0x401033
cmp al, 0x20
jle 0x401033
inc esi
cmp byte [esi], 0x20
jg 0x40102d
mov al, byte [esi]
test al, al
je 0x40103d
cmp al, 0x20
jle 0x401026
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004025da
push 0x404004
push section..data
call fcn.004025c0
test byte [ebp - 0x18], 1
pop ecx
pop ecx
je 0x40106d
movzx eax, word [ebp - 0x14]
jmp 0x401070
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov esi, eax
call fcn.004025f2
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4024d0
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
jne 0x40245b
mov eax, dword [0x40468e]
jmp 0x4024b8
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop eax
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, edi
push 0x4046d0
push dword [0x4046a6]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4046d0
push dword [0x4046a6]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x50], eax
push 0
push 0
push 0
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_GetMessageW]
and eax, eax
je 0x4024b5
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x402497
mov eax, dword [ebp - 0x14]
call fcn.00401fd0
pop ebx
pop edi
pop esi
leave
ret 0x10
push ebp
mov ebp, esp
sub esp, 0x50
mov ebx, str.dewjts
mov eax, dword [ebp + 8]
mov dword [0x4045b0], eax
push str.Troots
mov edi, dword [0x4045b0]
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
push 0x7f02
mov dword [ebp - 0x38], edi
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
mov eax, 0
mov dword [ebp - 0x34], eax
mov eax, 3
mov dword [ebp - 0x48], eax
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadIconW]
xor eax, eax
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x4c]
push ecx
mov dword [ebp - 0x4c], 0x30
mov eax, 0x402080
mov dword [ebp - 0x44], eax
mov eax, 0xe
mov dword [ebp - 0x2c], eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
mov dword [0x4045b4], ebp
mov edi, eax
inc eax
push edi
push dword [0x4045b0]
dec eax
push edi
push edi
push eax
push ebx
push edi
push edi
push 0x80ca0000
push str.Troots
push str.dewjts
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
jmp 0x402450

Function at 0x449937
Capabilities:
Encode data using xor

Disassembly:
push 0xc
push 0x4cf6a0
call 0x5e402320
and dword [ebp - 0x1c], 0
inc dword [eax]
add bh, bh
xor al, ch
push es
jnp 0x44994b
pop ebp
ret 0x8983
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x33f839c4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x4a8432c7
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1001aeee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1001aefd
pop dword [ebp - 0x3c]
mov eax, 0x64c3e3fa
add eax, 0xab3dcb03
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xe22340d9
add dword [ebp - 0x4c], 0x6c2f0472
mov dword [ebp - 0x48], 0xc63b6a93
add dword [ebp - 0x48], 0x6bf7e1b2
mov dword [ebp - 0x44], 0x6e9defdb
add dword [ebp - 0x44], 0xddae5453
mov dword [ebp - 0x40], 0x23a93c07
sub dword [ebp - 0x40], 0x23a93c07
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xbbc29ab5
sub eax, 0xabc0da35
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe3040123
add dword [ebp - 0x4c], 0x916e6833
mov dword [ebp - 0x48], 0x3d7d048d
add dword [ebp - 0x48], 0x3ef5ce8
mov dword [ebp - 0x44], 0x2a3e96cf
sub dword [ebp - 0x44], 0xc6cf2a63
mov dword [ebp - 0x40], 0xa03f38df
add dword [ebp - 0x40], 0x5fc0c721
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3949a
push 0
call eax
mov ecx, 0x4f6f
mov ebx, eax
mov esi, 0xa0a0b2c5
add esi, 0x6f61b53b
add esi, dword [ebp - 0x3c]
mov edi, 0xd305da99
add dword [ebp - 0x14], eax
mov edx, dword [esi]
add dword [ebp - 0x38], 0xe542e17f
xor edx, edi
mov dword [ebx], edx
mov dword [ebp - 0x34], 0xb6633a6e
add ebx, 4
add esi, 0x55a9fb8b
add esi, 0xaa560479
loop 0x1001b00e
add eax, 0xc9e3cc3b
sub eax, 0xc9e29bac
xor ebx, ebx
add ebx, eax
add eax, 0xcc74191d
add eax, 0x338be6e8
mov ecx, 0x10000000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x40b8c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x9000]
push edi
jmp 0x40b8da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b8e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b8d0
mov eax, 1
add ebx, ebx
jne 0x40b8f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b8e8
jne 0x40b904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b8e8
xor ecx, ecx
sub eax, 3
jb 0x40b918
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b98a
mov ebp, eax
add ebx, ebx
jne 0x40b923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b954
inc ecx
add ebx, ebx
jne 0x40b940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b935
jne 0x40b951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b935
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b974
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b965
jmp 0x40b8d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b974
add edi, ecx
jmp 0x40b8d6
pop esi
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b9d3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe948]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe9a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b991
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe9a8]
or eax, eax
je 0x40b9cd
mov dword [ebx], eax
add ebx, 4
jmp 0x40b9ae
call dword [esi + 0xe9a4]
mov ebp, dword [esi + 0xe9ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40ba07
sub esp, 0xffffff80
jmp 0x4022b0
Function at 0x40a24f
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Encode data using xor
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
mov dword [0x67353c], eax
cmp eax, 0xffffffff
jmp 0x4682f8
call edi
cmp byte [0x673415], 0
jne 0x52f595
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x778d
xor cx, word [eax*2 + 0x56ab14]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 4
jl 0x41fde5
lea edx, [ebp - 0x118]
push esi
push edx
call fcn.00433ca4
add esp, 8
push 0x1f4
inc esi
call edi
cmp esi, 0xa
jg 0x52f5aa
jmp dword [0x41fe33]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052df32
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x973
xor cx, word [eax*2 + 0x56aabc]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 5
jl 0x436a73
lea edx, [ebp - 0x118]
jmp 0x533d26
xor cx, word [eax*2 + 0x56aaec]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 0x12
jl 0x54a520
lea edx, [ebp - 0x118]
push edx
call fcn.00433ca4
add esp, 4
push 0
push 0
push 0
push 0x529a06
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
mov dword [0x673424], eax
xor esi, esi
jmp 0x41fdd4
jne 0x436a6a
xor eax, eax
nop
lea ecx, [eax + 1]
imul ecx, ecx, 0x3295
xor cx, word [eax*2 + 0x56aaa8]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 9
jl 0x468301
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
lea edx, [ebp - 0x118]
push edx
push 0x62e3c8
call dword [sym.imp.msvcrt.dll_sprintf]
push 0x62e3c8
call fcn.00433ca4
add esp, 0x10
xor eax, eax
jmp 0x436a5a
mov eax, dword [0x673424]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x673424]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x67353c]
push edx
jmp 0x54d7d6
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0052df32
mov esp, ebp
pop ebp
ret
cmp byte [0x673415], 0
jne 0x52f595
jmp 0x50afbe
push edx
call fcn.00433ca4
xor eax, eax
mov ecx, esi
xor ecx, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, 2
push ecx
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
xor esi, dword [ebp + 8]
push 0x10
lea edx, [ebp - 0x14]
mov word [ebp - 0x12], ax
mov eax, dword [0x67353c]
push edx
push eax
mov dword [ebp - 0x10], esi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x54a4ea
xor eax, eax
lea ecx, [eax + 1]
jmp dword [0x533d85]
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x3e69
xor cx, word [eax*2 + 0x56aadc]
inc eax
mov word [ebp + eax*2 - 0x11a], cx
cmp eax, 6
jl 0x54a4ec
lea edx, [ebp - 0x118]
push edx
call fcn.00433ca4
add esp, 4
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x7c86
jmp 0x45a67c
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [0x67353c], 0
jmp dword [0x54d7ef]
Function at 0x40dec2
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
push edi
mov edi, dword [0x67353c]
call esi
cdq
mov ecx, 0x3e8
idiv ecx
jmp 0x46d370
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
je 0x442129
mov cl, byte [ebp - 0x53]
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x44211b
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0052df32
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x50], 0xa
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x54], 1
mov word [ebp - 0x58], dx
mov edx, ecx
sub edx, dword [ebp - 0x58]
mov word [ebp - 0x56], dx
call esi
and eax, 0x800000ff
jns 0x5022f3
jmp dword [0x46d3a3]
cmp byte [ebp - 0x54], 0
mov byte [ebp - 0x53], al
je 0x502312
mov cl, al
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x502304
push 0
push 0x50
lea eax, [ebp - 0x58]
jmp 0x442104
Function at 0x4c1d28
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x114
push 0
push 0x6732f8
mov dword [0x673410], eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov esi, 0x6732f8
mov dword [0x6732f8], 0x114
call fcn.0046d607
mov edi, eax
xor eax, eax
jmp 0x464944
lea ecx, [eax + 1]
imul ecx, ecx, 0x4f5a
xor cx, word [eax*2 + 0x56a19c]
inc eax
mov word [ebp + eax*2 - 0x30a], cx
cmp eax, 5
jl 0x464944
jmp dword [0x464971]
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x10043a
jmp 0x464908
Function at 0x4cb2b1
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov dword [edi], ecx
mov edx, dword [eax + 0x50]
sub edx, eax
mov eax, dword [0x673528]
lea edx, [edx + eax - 0xf8]
shr edx, 2
mov dword [edi + 4], edx
lea eax, [ebp - 0x7c]
push eax
add edx, edx
push 0x40
add edx, edx
push edx
push ecx
mov dword [edi + 8], 4
call esi
mov dword [ebp - 0x72], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call dword [sym.imp.msvcrt.dll_rand]
imul edi, eax
mov eax, dword [0x67352c]
mov edx, dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x48093e
mov dword [ebp - 0x14], 0xb9000000
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0xff59aaf3
mov byte [ebp - 8], dl
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x84], eax
lea edi, [eax + 0x100]
mov eax, dword [0x67352c]
xor ecx, ecx
mov dword [ebp - 0x80], ebx
cmp cx, word [eax + 6]
jae 0x49163a
lea esi, [edi + 0xc]
mov edi, edi
mov edx, dword [ebx + eax + 0x104]
add edx, dword [0x673528]
lea ecx, [esi + 8]
mov dword [esi], edx
mov edx, dword [ebx + eax + 0x100]
jmp dword [0x42d10d]
mov dword [ebp - 0x5a], edi
mov edi, dword [ebp - 0x84]
mov dword [ebp - 0x36], esi
mov dword [ebp - 0x48], 0xffffffe9
movzx eax, word [eax + 6]
lea ecx, [eax + eax*2 + 3]
add ecx, ecx
add ecx, ecx
mov dword [ebp - 0x2d], ecx
mov dword [ebp - 0x27], 0xffffffb0
mov dword [ebp - 0x22], 0x5265c00
mov dword [ebp - 0x1d], edx
mov dword [ebp - 0x15], edi
mov dword [ebp - 0x10], 0x6c
mov ecx, 0x1c
lea esi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call dword [ebp - 0x84]
jmp dword [0x480996]
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea ecx, [eax + 0xf8]
jmp 0x401ca0
mov dword [ebp - 0x70], 0x3c8b0000
mov dword [ebp - 0x6c], 0x4c3831a
mov dword [ebp - 0x68], 0x831a0c8b
mov dword [ebp - 0x64], 0x348b04c3
mov dword [ebp - 0x60], 0x4c3831a
mov dword [ebp - 0x5c], 0xb860
mov dword [ebp - 0x58], 0xaf0f0000
mov dword [ebp - 0x54], 0x490731c1
mov dword [ebp - 0x50], 0x8304c783
mov dword [ebp - 0x4c], 0x8f0f00f9
mov dword [ebp - 0x48], ebx
jmp 0x524954
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x40
push 0x3000
xor ebx, ebx
push 0x1000
mov dl, 0xd1
push ebx
mov dword [ebp - 0x78], 0xbb
mov dword [ebp - 0x74], 0xba00
jmp 0x49a138
mov dword [ebp - 0x44], 0x6861
mov dword [ebp - 0x40], 0x56540000
mov dword [ebp - 0x3c], 0x5104c96b
mov dword [ebp - 0x38], 0xb957
mov dword [ebp - 0x34], 0xd1ff0000
mov dword [ebp - 0x30], 0xfb8158
mov dword [ebp - 0x2c], 0xf000000
mov dword [ebp - 0x28], 0x8c
mov dword [ebp - 0x24], 0x6800
mov dword [ebp - 0x20], 0xb90000
mov dword [ebp - 0x1c], 0x51000000
mov dword [ebp - 0x18], 0xbfc031
jmp 0x42d0a8
Function at 0x4d4391
Capabilities:
Terminate process

Disassembly:
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x8416d8], 2
cmp dword [ebp - 0x1c], ebx
jne 0x468720
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x8416e0], ebx
je 0x468749
push 0x8416e0
call fcn.004b214b
pop ecx
test eax, eax
je 0x468749
push ebx
push 2
push ebx
call dword [0x8416e0]
push dword [0x62e054]
push dword [0x62e058]
jmp 0x503d7a
xor esi, esi
inc esi
mov eax, dword [0x8416d8]
cmp eax, esi
jne 0x46fa38
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x4dd879
mov eax, dword [0x8416d8]
test eax, eax
jne 0x4dd873
mov dword [0x8416d8], esi
push 0x56a174
jmp 0x4dd84e
cmp dword [0x62e06c], ebx
jne 0x48f523
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x62e068]
call fcn.004797c9
ret
push 0x10
push 0x56ac68
call fcn.0053bc50
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x8416dc
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x46fa1b
cmp eax, esi
jne 0x49f05b
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x46fa1e
push 0x3e8
jmp dword [0x49f066]
push 0x40100a
call fcn.00401000
call fcn.004da516
jmp 0x49f015
push 0x56a168
call 0x52df46
pop ecx
pop ecx
test eax, eax
je 0x4dd879
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x48f52f
mov dword [0x62e06c], esi
mov eax, dword [0x8416d8]
cmp eax, esi
jne 0x46870f
push 0x56a164
push 0x56a15c
jmp 0x4686fe
push dword [0x62e050]
call 0x4e3861
add esp, 0xc
mov dword [0x62e068], eax
cmp dword [0x62e05c], ebx
jne 0x48f511
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x4fc69a
Capabilities:
Encode data using xor

Disassembly:
call dword [sym.imp.msvcrt.dll_sprintf]
lea eax, [ebp - 0x10c]
add esp, 0x24
push 0x509e0a
ret
cmp eax, 8
jl 0x48786b
lea edx, [ebp - 0x20c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x509e4a
lea eax, [ebp - 0x310]
push eax
push 0
mov dword [ebp - 0x310], 0
call esi
mov ecx, dword [ebp - 0x310]
jmp 0x539e84
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x314], edi
test edi, edi
je 0x509e51
xor eax, eax
mov edi, edi
lea ecx, [eax + 1]
imul ecx, ecx, 0x3ebf
xor cx, word [eax*2 + 0x56a740]
inc eax
mov word [ebp + eax*2 - 0x20e], cx
jmp 0x43fe6a
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
jmp 0x508aba
push ebx
push esi
push edi
mov dword [ebp - 0x318], eax
test eax, eax
je 0x509e51
mov byte [eax], 0
xor eax, eax
lea esp, [esp]
lea ecx, [eax + 1]
imul ecx, ecx, 0x2514
xor cx, word [eax*2 + 0x56a730]
inc eax
mov word [ebp + eax*2 - 0x30e], cx
cmp eax, 7
jl 0x508ad4
jmp 0x48784a
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0052df32
mov esp, ebp
pop ebp
ret
push ecx
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
lea edx, [ebp - 0x310]
mov ebx, eax
push edx
push ebx
call esi
test ebx, ebx
je 0x509e4a
xor eax, eax
cmp dword [ebx], eax
je 0x549f86
lea ecx, [eax + 1]
imul ecx, ecx, 0x23be
xor cx, word [eax*2 + 0x56a754]
inc eax
mov word [ebp + eax*2 - 0x20e], cx
cmp eax, 0xc
jmp 0x549f36
jl 0x539eac
movzx edx, byte [ebx + 0x199]
movzx eax, byte [ebx + 0x198]
movzx ecx, byte [ebx + 0x197]
push edx
movzx edx, byte [ebx + 0x196]
push eax
movzx eax, byte [ebx + 0x195]
push ecx
movzx ecx, byte [ebx + 0x194]
push edx
push eax
push ecx
lea edx, [ebx + 0x10c]
push edx
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x10c]
push ecx
jmp 0x42f69a
lea edx, [eax + 1]
imul edx, edx, 0x1d70
xor dx, word [eax*2 + 0x56a770]
push 0x47f6bc
ret