joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b30
Capabilities:
Create tcp socket
Create thread
Create udp socket
Initialize winsock library

Disassembly:
sub esp, 0x1a0
lea eax, [esp + 0x10]
push esi
mov esi, dword [ecx]
push eax
push 0x101
call sub.WS2_32.dll_WSAStartup
test eax, eax
je 0x404b58
xor al, al
pop esi
add esp, 0x1a0
ret 4
mov ecx, dword [esp + 0x1a8]
mov word [esp + 4], 2
push ecx
mov dword [esp + 0xc], 0
call sub.WS2_32.dll_htons
push 0
push 1
push 2
mov word [esp + 0x12], ax
call sub.WS2_32.dll_socket
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x404b97
xor al, al
pop esi
add esp, 0x1a0
ret 4
lea edx, [esp + 4]
push 0x10
push edx
push eax
call sub.WS2_32.dll_bind
test eax, eax
je 0x404bc2
mov eax, dword [esi]
push eax
call sub.WS2_32.dll_closesocket
mov dword [esi], 0xffffffff
xor al, al
pop esi
add esp, 0x1a0
ret 4
mov ecx, dword [esi]
push 0xa
push ecx
call sub.WS2_32.dll_listen
test eax, eax
je 0x404bea
mov edx, dword [esi]
push edx
call sub.WS2_32.dll_closesocket
mov dword [esi], 0xffffffff
xor al, al
pop esi
add esp, 0x1a0
ret 4
push esi
push 0
push 0x4048e0
call dword [sym.imp.MSVCRT.dll__beginthread]
push 0
call dword [sym.imp.MSVCRT.dll__sleep]
add esp, 0x10
mov al, 1
pop esi
add esp, 0x1a0
ret 4
Function at 0x96a1d6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
and dword [ebp - 4], 0
mov edi, dword [ebp + 8]
push 0x96a208
push dword fs:[0]
mov dword fs:[0], esp
cmp word [edi], 0x5a4d
pop word fs:[0]
add esp, 4
jmp 0x96a229
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
jne 0x96a2ab
mov eax, edi
add eax, dword [edi + 0x3c]
cmp word [eax], 0x4550
jne 0x96a2ab
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, 1
jl 0x96a2ab
xor ecx, ecx
mov cx, word [eax + 0x16]
and ecx, 0x2000
test ecx, ecx
je 0x96a2ab
xor ecx, ecx
mov cx, word [eax + 0x14]
cmp ecx, 0x60
jl 0x96a2ab
cmp ecx, 0xe0
ja 0x96a2ab
cmp dword [eax + 0x78], 0
je 0x96a2ab
cmp dword [eax + 0x7c], 0
je 0x96a2ab
mov edx, dword [eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x14]
mov ebx, dword [ebp + 0x18]
mov dword [ebx], ecx
mov ecx, dword [edx + 0x20]
add ecx, edi
mov ebx, dword [ebp + 0xc]
mov dword [ebx], ecx
mov ecx, dword [edx + 0x1c]
add ecx, edi
mov ebx, dword [ebp + 0x10]
mov dword [ebx], ecx
mov ecx, dword [edx + 0x24]
add ecx, edi
mov ebx, dword [ebp + 0x14]
mov dword [ebx], ecx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop ebx
leave
ret
Function at 0x96a8ad
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x96a8e6
mov edx, dword [eax + 0xc]
cmp dword [esp + 0x10], edx
jb 0x96a8de
mov edi, dword [eax + 8]
add edi, edx
cmp dword [esp + 0x10], edi
jb 0x96a8e8
inc esi
add eax, 0x28
cmp esi, ecx
jb 0x96a8ca
xor eax, eax
pop edi
pop esi
ret

Function at 0xbab092
Capabilities:
Parse pe header

Disassembly:
mov dword [0xbca004], esp
push 0xbab0d5
jmp 0xbab0a0
jmp 0xbab0a5
jmp 0xbab0a9
jmp 0xbab0ac
push dword fs:[0]
jmp 0xbab0b7
jmp 0xbab0ba
jmp 0xbab0be
jmp 0xbab0c2
jmp 0xbab0c5
mov dword fs:[0], esp
jmp 0xbab0d0
jmp fcn.00bab9a4
Function at 0x6f4baf
Capabilities:
Encode data using xor

Disassembly:
mov edi, eax
mov esi, edx
mov eax, 0x41363233
xor al, byte [esi]
call fcn.006f4be6
mov ebx, eax
xor ah, byte [esi]
call fcn.006f4be6
shr ecx, 2
mov edx, ecx
xor dword [edi], eax
mov cl, al
add edi, 4
rol ebx, cl
xor eax, ebx
mov cl, bh
ror eax, cl
add ebx, eax
dec edx
jne 0x6f4bcd
ret

Function at 0x6f4be6
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
push edx
xor edx, edx
dec esi
inc esi
xor ah, byte [esi]
xor al, dl
add eax, 0x6e203cc5
add eax, 0x21424a6
mov cl, al
ror eax, cl
xor eax, 0x8372a5a7
dec dx
jne 0x6f4bef
cmp byte [esi], 0
jne 0x6f4bec
pop edx
pop esi
pop ecx
ret

Function at 0x6f4c37
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
add edx, 0x89421025
bswap edx
mov eax, dword [esi]
sub eax, edx
xor eax, ebx
mov ebx, dword [esi]
mov dword [edi], eax
add esi, 4
add edi, 4
dec ecx
jne 0x6f4c4b
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x6f6e7d
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
pushal
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [edi]
mov ecx, dword [edi + 4]
imul eax, dword [ebp + 0x10], 0x9e3779b9
cmp dword [ebp + 0x10], 0
jbe 0x6f6edd
mov edx, ebx
shl edx, 4
sub ecx, edx
mov edx, dword [esi + 8]
xor edx, ebx
sub ecx, edx
mov edx, ebx
shr edx, 5
xor edx, eax
sub ecx, edx
sub ecx, dword [esi + 0xc]
mov edx, ecx
shl edx, 4
sub ebx, edx
mov edx, dword [esi]
xor edx, ecx
sub ebx, edx
mov edx, ecx
shr edx, 5
xor edx, eax
sub ebx, edx
sub ebx, dword [esi + 4]
sub eax, 0x9e3779b9
dec dword [ebp + 0x10]
jmp 0x6f6e93
mov dword [edi], ebx
mov dword [edi + 4], ecx
popal
leave
ret 0xc
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x42182f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
fld st(6)
test dword [0xfafffff9], edx
mov byte [ebp - 0x6ea], 0xd5
mov byte [ebp - 0x6e9], 0xd0
mov byte [ebp - 0x6e8], 0xd9
mov byte [ebp - 0x6e7], 0xbc
call fcn.0041fc8d
xchg dword [eax - 0x6b], esp
dec edi
lea eax, [ebp - 0x6f4]
push eax
call fcn.0041fc9d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041fc52
out 0xff, al
inc dword [ebx - 0x7a76f33c]
sar al, 1
invalid
inc dword [ebx - 0x6fb5b]
inc dword [eax]
push 1
pop eax
test eax, eax
je 0x421d33
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x421808
and byte [ebp - 0x77c], 0
cmp dword [ebp - 0x6fc], 1
jne 0x4218b9
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
inc dword [eax]
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
invalid
test dword [esi - 8], edi
invalid

Function at 0x421c59
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x421c70
jmp 0x42162f
cmp dword [ebp - 0x37c], 0
je 0x421c7e
jmp 0x421d33
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x421cd7
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x421cdc
jmp 0x42162f
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x421d23
lea eax, [ebp - 0x714]
push eax
call fcn.0041fc9d
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.0041fc52
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x421d2e
jmp 0x421d33
jmp 0x42162f
cmp dword [ebp - 0x37c], 0
jne 0x421ddd
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041fe69
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x421dc9
lea eax, [ebp - 0x714]
push eax
call fcn.0041fc9d
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.0041fd32
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
invalid
Function at 0x422294
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov edi, 0x43b5f8
cmp eax, ebx
je 0x4222b2
mov ecx, dword [eax]
jmp 0x4222bf
mov ecx, dword [esi + 8]
cmp ecx, ebx
je 0x4222bd
mov ecx, dword [ecx]
jmp 0x4222bf
mov ecx, edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x4222c8
mov edi, dword [edx]
test eax, eax
je 0x4222da
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x4222e9
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebp + 8]
push str.copy
push edi
push ecx
push eax
push 2
call fcn.00401566
add esp, 0x18
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call fcn.00435d1f
test eax, eax
je 0x42236d
test byte [ebp - 4], 1
je 0x42236d
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42236d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x42233c
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x422347
mov ebx, 0x80004005
push ebx
push 0x548
push str.apply.cpp
call fcn.00432f06
push dword [ebp + 0xc]
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push ebx
call fcn.00430126
add esp, 0xc
jmp 0x4223f5
push 0
lea edi, [esi + 0x20]
push edi
push esi
push 0x421ab7
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
test eax, eax
jne 0x4223f5
cmp dword [edi], ebx
je 0x4223b2
mov esi, 0x80070642
push esi
push 0x552
push str.apply.cpp
mov ebx, esi
call fcn.00432f06
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.BA_aborted_copy_of_payload_from:__ls_to:__ls.
push esi
jmp 0x4223ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4223c6
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
test ebx, ebx
js 0x4223d1
mov ebx, 0x80004005
push ebx
push 0x556
push str.apply.cpp
call fcn.00432f06
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.Failed_attempt_to_copy_payload_from:__ls_to:__ls.
push ebx
call fcn.00430126
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x4223fe
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 4], 0
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 4]
push edi
mov edi, 0x43b5f8
test ecx, ecx
je 0x42241d
mov eax, dword [ecx]
jmp 0x422426
mov eax, dword [esi + 8]
test eax, eax
je 0x42242b
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42242e
mov dword [ebp - 8], edi
mov edx, dword [esi + 0xc]
test edx, edx
je 0x42243c
mov eax, dword [edx]
mov dword [ebp - 0xc], eax
jmp 0x42243f
mov dword [ebp - 0xc], edi
lea ebx, [ecx + 0x2c]
test ecx, ecx
jne 0x42246f
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [edx + 0x14]
lea ebx, [edx + 0x40]
mov dword [ebp - 0x10], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test ecx, ecx
je 0x42247a
xor eax, eax
test edx, edx
setne al
add eax, 0x20000150
jmp 0x422489
mov eax, dword [ecx + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ecx + 0x1c]
jmp 0x422452
mov eax, dword [esi + 8]
neg eax
sbb eax, eax
and eax, 3
add eax, 0x2000014f
push dword [ebx]
push str.download
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push 2
call fcn.00401566
mov edi, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 4]
push eax
push edi
call fcn.00435d1f
test eax, eax
je 0x42250d
test byte [ebp - 4], 1
je 0x42250d
and dword [ebp - 4], 0xfffffffe
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x42250d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4224de
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
test esi, esi
js 0x4224e9
mov esi, 0x80004005
push esi
push 0x577
push str.apply.cpp
call fcn.00432f06
push edi
push str.Failed_to_clear_readonly_bit_on_payload_destination_path:__ls
push esi
call fcn.00430126
add esp, 0xc
jmp 0x42259d
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0x421ab7
mov dword [ebp - 0x18], esi
mov eax, dword [ebx]
push 0x62
pop ecx
cmp cx, word [eax]
jne 0x42256d
push 0x69
pop ecx
cmp cx, word [eax + 2]
jne 0x42256d
push 0x74
pop ecx
cmp cx, word [eax + 4]
jne 0x42256d
push 0x73
pop ecx
cmp cx, word [eax + 6]
jne 0x42256d
movzx ecx, word [eax + 8]
push 0x3a
pop edx
cmp dx, cx
je 0x42255d
push 0x73
pop edx
cmp dx, cx
jne 0x42256d
push 0x3a
pop ecx
cmp cx, word [eax + 0xa]
jne 0x42256d
push dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push edi
push ebx
push eax
call fcn.004280b2
jmp 0x422586
push edi
push dword [ebp - 0x10]
lea eax, [ebp - 0x20]
push dword [ebp - 0x14]
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
push eax
push dword [esi]
call fcn.0042786c
mov esi, eax
test esi, esi
jns 0x42259d
push edi
push dword [ebx]
push str.Failed_attempt_to_download_URL:__ls_to:__ls
push esi
call fcn.00430126
add esp, 0x10
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x4110f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x41119d
test eax, edx
je 0x4111a0
push 0
push 0
cmp word [eax - 0xa], 2
je 0x41111d
push edx
mov edx, eax
mov eax, esp
call fcn.00407100
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x411133
push eax
lea eax, [esp + 8]
call fcn.00407100
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x411142
movzx eax, word [eax]
sub eax, ecx
jmp 0x411169
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x411183
add ecx, 4
js 0x41115a
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x411180
push eax
mov eax, ecx
mov edx, 2
call fcn.0040626c
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x411167
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x411169
xor eax, eax
ret
test eax, eax
je 0x4111b0
test edx, edx
jne 0x411104
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x446f44
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov esi, dword [eax + 0x20]
mov eax, esi
call fcn.004380b4
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x18], eax
mov cx, 1
mov edx, 0x40
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x18]
cmp word [eax], 0x5a4d
jne 0x447034
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x18]
mov edx, dword [eax + 0x3c]
xor ecx, ecx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x18]
cmp eax, dword [edx + 0x3c]
jne 0x447034
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea edx, [eax + 0xc]
mov ecx, 4
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
cmp eax, 4
jne 0x447034
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0xc], 0x4550
jne 0x447034
mov eax, esi
call fcn.004380b4
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x10], eax
mov cx, 1
mov edx, 0x14
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x14]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0x10]
cmp word [eax], 0x14c
jne 0x447034
mov eax, esi
call fcn.004380b4
add eax, dword [esi + 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov dword [edx + 0x14], eax
mov cx, 1
mov edx, 0xe0
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov bl, 1
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x447c34
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
int 0x2e
pop ebp
ret 8

Function at 0x447c69
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447ca4
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0xc
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447ce0
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447d1c
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x14
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447d58
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x18
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447d94
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x1c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x447dd0
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
add esp, 0x28
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x4577dc
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4577e2
ret

Function at 0x462284
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x462441
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
jne 0x46241d
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x38], 0
je 0x46241d
mov eax, dword [ebp - 0xc]
add eax, 0x2c
push eax
mov eax, dword [ebp - 0xc]
add eax, 0x28
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 0x28]
add ebx, ebx
add ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
imul ebx
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x462250]
call fcn.00408aa0
add esp, 4
lea eax, [ebp - 4]
call fcn.00409fec
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [0x5e8a3c]
push eax
call fcn.00455c90
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.004088d8
push eax
push ebx
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
lea eax, [ebp - 0x38]
xor ecx, ecx
mov edx, 0x2c
call fcn.00404938
mov dword [ebp - 0x38], 0x2c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
neg eax
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], 1
mov word [ebp - 0x2a], 0x20
mov dl, 1
mov eax, dword [0x4572e8]
call fcn.0045edf4
mov ebx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x30], ebx
xor ecx, ecx
push ebp
push 0x4623fb
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, ebx
mov dl, 7
call fcn.004609d8
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x2c]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov ebx, dword [eax]
call dword [ebx + 0x6c]
push 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov edx, dword [eax]
call dword [edx + 0x70]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
call fcn.0045f714
call fcn.0045a558
push eax
call fcn.0040c1dc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
mov dl, 1
call fcn.0045fa6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46241d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462448
lea eax, [ebp - 8]
mov edx, dword [0x462250]
call fcn.00408bc0
lea eax, [ebp - 4]
call fcn.00409fec
ret
Function at 0x4b54f4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00404938
ret
Function at 0x4d0f2c
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
dec eax
test eax, eax
jl 0x4d0f49
inc eax
xor edx, edx
mov ecx, dword [ebx + 4]
add ecx, edx
xor byte [ecx], 0x5b
inc edx
dec eax
jne 0x4d0f3d
pop ebx
ret
Function at 0x673390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [eax - 0x19f44188]
call fcn.0081497d

Function at 0x673a23
Capabilities:
Packed with generic packer

Disassembly:
movsx cx, cl
sete cl
movzx cx, bl
nop
push esp
mov ecx, dword [esp + 4]
lea esp, [esp + 8]
jo 0x77a607
push esi
mov dword [esp], 0x26964416
xchg dword [esp + 4], ecx
pushal
xchg dword [esp + 0x20], ecx
pushfd
setae ch
not cx
mov ecx, 0x50fefe
mov word [esp + 4], si
mov ecx, dword [ecx + 0x26dcdd]
pushal
push ebp
pushfd
lea ecx, [ecx + 0x71a5860c]
call fcn.007b2d22
invalid
push esi
pushal
call fcn.007bb023
add dword [esi + 0x5a27c9e2], ebp
fcom qword [ebx]
xor eax, 0x4ab91753
mov bl, 0xc
adc al, 0xe3
xchg ebp, eax
pop ebx
adc al, 0xdf
jle 0x77a688
jno 0x77a689
dec ebx
inc edi
jo 0x77a68f
push ebp
cmp dword [ebp + 0x7a], esi
clc
loop 0x77a603
mov edi, 0xc8e9d52f
outsb dx, byte [esi]
jecxz 0x77a6a5
mov al, 0x83
xchg esp, eax
inc ecx
loope 0x77a671
invalid
aaa
fld xword [eax + 0x45]
lodsb al, byte [esi]
sbb al, 0x79
rol cl, cl
xchg byte [ecx + ecx*4 - 0x2d333b8d], cl
cwde
dec edi
int3
sub cl, byte [edi + 0xa]
scasd eax, dword es:[edi]
lds esi, [ebp - 0x2575184]
dec edi
or ch, byte [edi - 0x51834a3b]
scasb al, byte es:[edi]
test al, 0xfd
or eax, 0x52a1ec05
and byte [ecx + 0x38df3aa3], al
js 0x77a6a0
push ecx
xchg edx, eax
mov eax, dword [0x130d15ef]
movq mm7, mm4
adc ecx, dword [edi]
outsd dx, dword [esi]
cld
add bh, byte [ebx + 0x7722c111]
add ebp, dword [ebx + ebx*2]
popal
jl 0x77a6f7
test byte [ecx + ebx - 0x2fc5f604], cl
xor ah, al
call 0x97d8f842
test byte [0xb6e31db], dh
aad 0x20
shr dword [0x7e81bd1c], cl
stosd dword es:[edi], eax
inc esp
xlatb
mov esi, 0xcaab3fb4
inc edx
invalid
in al, 0x5e
mov ah, 0x70
lodsb al, byte [esi]
outsd dx, dword [esi]
mov al, 0x83
xchg esp, eax
lea edx, [eax + 0x179d9c85]
scasd eax, dword es:[edi]
pop esi
ret 0x967d

Function at 0x681d1f
Capabilities:
Access peb ldr_data

Disassembly:
lea esp, [esp + 0x30]
call fcn.004380d4
shl cx, cl
btc cx, 0xf
sub eax, eax
clc
add ch, ah
pop edx
sub cl, dl
sal ecx, cl
bt bp, sp
shrd cx, sp, cl
pop ecx
pushfd
push 0xf81bcdf4
mov ecx, dword [esp + 8]
stc
push ebx
mov dword fs:[eax], edx
adc ax, bp
sete al
adc ah, 0x6a
mov dword [esp + 0xc], 0x8cadd7
xor eax, 0x7c4c2ad0
push dword [esp + 8]
or al, dl
movzx ax, bl
mov eax, dword [ebp - 0x28]
cmc
push dword [esp + 0xc]
cmp edx, edi
mov dword [ebp - 0x84], eax
call fcn.0073979f
lodsb al, byte [esi]
pop edx
pop es
mov ch, 0x93
retf 0xa954