joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000efda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jne 0x1000b891
and eax, dword [eax + ebp*2 + 4]
add dword [eax], eax
add byte [ebp - 0x3337b], cl
call dword [eax - 1]
jne 0x1000b8aa
push 0xc6fffffc
test dword [edx + edi*8 - 0x7cfe0001], edi
mov ebp, 0xfffffc68
add byte [edi + edx - 0x7d], dh
mov ebp, 0xfffffc68
add byte [edi], cl
test ah, dl
add dword [eax], eax
add byte [ebx + 0xf010c7d], al
test dl, cl
add dword [eax], eax
add byte [ebx + 0xf080c7d], al
test dword [eax - 0x7fffffff], ecx
movsd dword es:[edi], dword [esi]
dec eax
stc
invalid
mov dword [ecx], vtable.CMFCComObject_class_ATL::CAccessibleProxy_.2.0
mov dword [ecx + 4], vtable.CMFCComObject_class_ATL::CAccessibleProxy_.1.0
mov dword [ecx + 0x10], vtable.CMFCComObject_class_ATL::CAccessibleProxy_.0
mov dword [ecx + 0x14], 0xc0000001
call fcn.1000eef9
jmp 0x1000b877

Function at 0x100116bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002da4c]
jne 0x100116c9
repz ret
jmp fcn.1001720c
Function at 0x10017007
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1002e348]
je 0x10017022
inc edi
cmp edi, 0x17
jb 0x10017013
cmp edi, 0x17
jae 0x100171a2
push ebp
push 3
call fcn.1001d7e5
cmp eax, 1
pop ecx
je 0x1001716e
push 3
call fcn.1001d7e5
test eax, eax
pop ecx
jne 0x10017056
cmp dword [0x10030d70], 1
je 0x1001716e
cmp ebx, 0xfc
je 0x100171a1
push 0x100264b0
mov ebx, 0x314
push ebx
mov ebp, 0x10030f78
push ebp
call fcn.1001302b
add esp, 0xc
test eax, eax
je 0x1001708c
push esi
push esi
push esi
push esi
push esi
call fcn.10016020
add esp, 0x14
push 0x104
mov esi, 0x10030f91
push esi
push 0
mov byte [0x10031095], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100170d0
push 0x10026498
push 0x2fb
push esi
call fcn.1001302b
add esp, 0xc
test eax, eax
je 0x100170d0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10016020
add esp, 0x14
push esi
call fcn.100128f0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x10017115
push esi
call fcn.100128f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1003128c
push 0x10026494
sub ecx, eax
push ecx
push eax
call fcn.10014cc3
add esp, 0x14
test eax, eax
je 0x10017115
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10016020
add esp, 0x14
jmp 0x10017117
xor esi, esi
push 0x10026490
push ebx
push ebp
call fcn.10013117
add esp, 0xc
test eax, eax
je 0x10017137
push esi
push esi
push esi
push esi
push esi
call fcn.10016020
add esp, 0x14
push dword [edi*8 + 0x1002e34c]
push ebx
push ebp
call fcn.10013117
add esp, 0xc
test eax, eax
je 0x10017159
push esi
push esi
push esi
push esi
push esi
call fcn.10016020
add esp, 0x14
push 0x12010
push 0x10026468
push ebp
call fcn.1001d628
add esp, 0xc
jmp 0x100171a1
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x100171a1
cmp ebp, 0xffffffff
je 0x100171a1
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1002e34c]
push dword [esi]
call fcn.100128f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1001d628
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10015acb
xor ebx, ebx
cmp dword [0x10031800], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x1001d6fe
push 0x10027724
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001d7de
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10027718
push edi
call esi
cmp eax, ebx
je 0x1001d7de
push eax
call fcn.10015a5d
mov dword [esp], 0x10027708
push edi
mov dword [0x10031800], eax
call esi
push eax
call fcn.10015a5d
mov dword [esp], 0x100276f4
push edi
mov dword [0x10031804], eax
call esi
push eax
call fcn.10015a5d
mov dword [0x10031808], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10012afb
test eax, eax
pop ecx
pop ecx
je 0x1001d6cc
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10016020
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x1001d6fe
push 0x100276d8
push edi
call esi
push eax
call fcn.10015a5d
cmp eax, ebx
pop ecx
mov dword [0x10031810], eax
je 0x1001d6fe
push 0x100276c0
push edi
call esi
push eax
call fcn.10015a5d
pop ecx
mov dword [0x1003180c], eax
mov eax, dword [0x1003180c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1001d783
cmp dword [0x10031810], ecx
je 0x1001d783
push eax
call fcn.10015ad4
push dword [0x10031810]
mov esi, eax
call fcn.10015ad4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1001d783
cmp edi, ebx
je 0x1001d783
call esi
cmp eax, ebx
je 0x1001d750
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001d750
test byte [ebp - 0x18], 1
jne 0x1001d783
lea eax, [ebp - 0x10]
push eax
call fcn.10012b32
test eax, eax
pop ecx
je 0x1001d76b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10016020
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1001d77a
or dword [ebp + 0x10], 0x200000
jmp 0x1001d7be
or dword [ebp + 0x10], 0x40000
jmp 0x1001d7be
mov eax, dword [0x10031804]
cmp eax, dword [ebp - 8]
je 0x1001d7be
push eax
call fcn.10015ad4
cmp eax, ebx
pop ecx
je 0x1001d7be
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x1001d7be
mov eax, dword [0x10031808]
cmp eax, dword [ebp - 8]
je 0x1001d7be
push eax
call fcn.10015ad4
cmp eax, ebx
pop ecx
je 0x1001d7be
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10031800]
call fcn.10015ad4
cmp eax, ebx
pop ecx
je 0x1001d7de
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001d7e0
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10022998
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1002da4c]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.1002292d
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.10011e60
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x100229e7
cmp dword [ebp - 0x1c], 5
jb 0x100229ff
jmp 0x100229fb
cmp dword [ebp - 0x10], 1
jne 0x100229ff
cmp dword [ebp - 0x1c], 4
ja 0x100229fb
jne 0x100229ff
cmp dword [ebp - 0x18], 0
jbe 0x100229ff
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x100277a8
call fcn.10022801
test eax, eax
jge 0x10022a20
mov byte [0x1002ef7c], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100116bf
add ebp, 0x78
leave
ret
Function at 0x100067a9
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x10014010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
cmp eax, 1
push esi
push edi
jne 0x100068aa
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x100067ee
xor eax, eax
jmp 0x10006945
mov eax, dword [ebp - 0x8c]
mov ecx, dword [ebp - 0x88]
and eax, 0x7fff
cmp ecx, 2
je 0x10006809
or eax, 0x8000
mov edx, dword [ebp - 0x90]
mov dword [0x100153cc], ecx
mov ecx, dword [ebp - 0x94]
mov esi, ecx
shl esi, 8
add esi, edx
push 1
mov dword [0x100153d4], esi
mov dword [0x100153d8], ecx
mov dword [0x100153dc], edx
mov dword [0x100153d0], eax
call fcn.10008962
test eax, eax
pop ecx
je 0x100067e7
call fcn.10007e93
test eax, eax
jne 0x10006855
call fcn.100089c7
jmp 0x100067e7
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10016f7c], eax
call fcn.100087c4
mov dword [0x100153b8], eax
call fcn.10008180
test eax, eax
jge 0x1000687a
call fcn.10007b35
jmp 0x1000684e
call fcn.10008704
test eax, eax
jl 0x100068a3
call fcn.10008412
test eax, eax
jl 0x100068a3
push 0
call fcn.1000784d
test eax, eax
pop ecx
jne 0x100068a3
inc dword [0x100153b4]
jmp 0x10006942
call fcn.100083bf
jmp 0x10006873
xor edi, edi
cmp eax, edi
jne 0x100068e5
cmp dword [0x100153b4], edi
jle 0x100067e7
dec dword [0x100153b4]
cmp dword [0x10015408], edi
jne 0x100068cf
call fcn.100079b9
cmp dword [ebp + 0x10], edi
jne 0x10006942
call fcn.100083bf
call fcn.10007b35
call fcn.100089c7
jmp 0x10006942
cmp eax, 2
jne 0x10006936
call fcn.10007b06
push 0x214
push 1
call fcn.1000813a
mov esi, eax
cmp esi, edi
pop ecx
pop ecx
je 0x100067e7
push esi
push dword [0x100140b0]
push dword [0x10015418]
call fcn.10007a8d
pop ecx
call eax
test eax, eax
je 0x1000692a
push edi
push esi
call fcn.10007b77
pop ecx
jmp 0x10006941
push esi
call fcn.10006f02
pop ecx
jmp 0x100067e7
cmp eax, 3
jne 0x10006942
push edi
call fcn.10007e20
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10006df2
leave
ret 0xc

Function at 0x1000cc20
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x1000cc33
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000cc2f
xor ecx, ecx
cmp word [eax + 0x18], 0x10b
sete cl
mov eax, ecx
pop ebp
ret

Function at 0x1000cc60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x1000cc9f
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x1000cc95
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1000cca1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x1000cc85
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000f28e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x1000f2c9
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x1000f2b0
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x1000f2c1
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1000f2cb
inc edi
add eax, 0x28
cmp edi, esi
jb 0x1000f2a6
xor eax, eax
pop edi
pop esi
ret

Function at 0x1000f447
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push es
add eax, 0x788b0000
cmp al, 3
clc
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.1000f24e
ja 0x1000f424
aaa
les ecx, [edi]
mov bh, 0x47
push es
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.1000f24e
pop ebx
mov ebp, 0x8b6612c4
inc edi
push es
cmp ax, bx
jbe 0x1000f4a8
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1000f4a2
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1000f493
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1000f24e
insb byte es:[edi], dx
pop ss
xor ebp, esp
lea eax, [ebp - 0x58]
push eax
call fcn.1000f25e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1000f213
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000f53c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000f24e
and ebx, ebp
ret 0x8d1a
Function at 0x1000f61c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.1000f25e
push eax
push esi
push dword [ebp + 8]
call fcn.1000f213
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1000f25e
push eax
push esi
push dword [ebp + 8]
call fcn.1000f213
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1000f24e
enter 0xffffffffffff8394, 0x19
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
invalid

Function at 0x1001124e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x10011298
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x1001129d
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41f5c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x41e015
lea edi, [esi - 0x1d015]
push edi
jmp 0x41f5da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41f5e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f5d0
mov eax, 1
add ebx, ebx
jne 0x41f5f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41f604
jne 0x41f623
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f623
dec eax
add ebx, ebx
jne 0x41f610
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x41f5e8
add ebx, ebx
jne 0x41f61f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x41f675
xor ecx, ecx
sub eax, 3
jb 0x41f63b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41f6aa
sar eax, 1
mov ebp, eax
jmp 0x41f646
add ebx, ebx
jne 0x41f646
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f614
inc ecx
add ebx, ebx
jne 0x41f654
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41f614
add ebx, ebx
jne 0x41f661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41f656
jne 0x41f672
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41f656
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41f694
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41f686
jmp 0x41f5d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41f694
add edi, ecx
jmp 0x41f5d6
pop esi
mov edi, esi
mov ecx, 0x17e5
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x41f6c1
mov eax, dword [edi]
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x41f6b2
lea edi, [esi + 0x1d000]
mov eax, dword [edi]
or eax, eax
je 0x41f709
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f044]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41f6c7
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f04c]
or eax, eax
je 0x41f703
mov dword [ebx], eax
add ebx, 4
jmp 0x41f6e4
call dword [esi + 0x1f048]
mov ebp, dword [esi + 0x1f050]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41f73d
sub esp, 0xffffff80
jmp 0x40297c
Function at 0x4153d7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x415416
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x415416
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x415416
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x415416
cmp dword [ecx + 0x74], 0xe
jbe 0x415416
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42233f
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42f6eb
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x442014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edx, eax
mov esi, dword [ebp + 0x10]
and eax, 0x3f
mov ebx, dword [ebp + 0x18]
imul ecx, eax, 0x38
sar edx, 6
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], edx
mov eax, dword [edx*4 + 0x443bb0]
mov dword [ebp - 0x50], ecx
mov eax, dword [ecx + eax + 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x14]
add eax, esi
mov dword [ebp - 0x54], eax
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
cmp byte [ebx + 0x14], 0
mov dword [ebp - 0x6c], eax
jne 0x4223b8
mov ecx, ebx
call fcn.0041afb0
mov eax, dword [ebx + 0xc]
mov esi, dword [ebp + 8]
mov edi, esi
mov ecx, dword [eax + 8]
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x70], ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x60]
mov edx, eax
mov dword [ebp - 0x2c], edx
cmp eax, dword [ebp - 0x54]
jae 0x4226e5
mov edi, dword [ebp - 0x50]
xor ebx, ebx
mov dword [ebp - 0x48], ebx
Function at 0x404d50
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x14
mov esi, edx
mov edi, ecx
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
test eax, eax
je 0x404d7b
mov dword [eax + 8], edi
pop edi
mov dword [eax + 0xc], esi
mov dword [eax + 4], 1
mov dword [eax], 0
pop esi
ret
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3

Function at 0x404da0
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push 0x14
mov esi, edx
mov edi, ecx
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
test eax, eax
je 0x404dd2
mov ecx, dword [esp + 0xc]
mov dword [eax + 8], edi
pop edi
mov dword [eax + 0xc], esi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x10], ecx
pop esi
ret
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3

Function at 0x404e00
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.MSVCR110.dll_malloc]
add esp, 4
test eax, eax
je 0x404e2f
lea ecx, [eax + 0x14]
mov dword [eax + 0x10], esi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], eax
mov dword [eax + 0xc], ecx
pop esi
ret
push str.Out_of_memory_n
call dword [sym.imp.MSVCR110.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR110.dll_fprintf]
add esp, 8
push 1
call dword [sym.imp.MSVCR110.dll_exit]
int3

Function at 0x405ed0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0xc], edx
mov edi, ecx
mov esi, ebx
push 0
mov eax, edx
sub eax, esi
push esi
add eax, ebx
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x405f4b
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x405f3c
mov eax, dword [edi + 4]
push 0x2710
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 1
push eax
mov dword [esp + 0x20], 0x10
call dword [sym.imp.php5.dll_php_poll2]
add esp, 0xc
test eax, eax
jle 0x405f3c
movsx eax, word [esp + 0x16]
test eax, eax
jg 0x405f4d
call dword [sym.imp.php5.dll_php_handle_aborted_connection]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, eax
test esi, esi
jle 0x405f57
mov edx, dword [esp + 0xc]
jmp 0x405ee7
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret