joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fcf14
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4fcfb5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x5d4bac
push 0x101
call sub.wsock32.dll_WSAStartup
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4fcf9a
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0040be30
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, 0x4fcfc8
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0x1c]
push eax
push 2
lea edx, [ebp - 0x24]
mov eax, dword [0x5d2f8c]
call fcn.004060fc
mov ecx, dword [ebp - 0x24]
mov dl, 1
mov eax, dword [0x4fc7c0]
call fcn.0040c658
call fcn.0040376c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fcfbc
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.00403d1c
ret

Function at 0x4fd3a4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov al, byte [0x4fd420]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
je 0x4fd3d6
mov dword [ebp - 8], 0x401
mov eax, dword [ebp - 4]
call fcn.004fd424
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x28]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_WSAAsyncSelect
mov al, byte [0x4fd420]
mov edx, dword [ebp - 4]
cmp al, byte [edx + 0x28]
jne 0x4fd419
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x8004667e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
mov esp, ebp
pop ebp
ret

Function at 0x4fd45c
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00404138
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
xor ecx, ecx
mov edx, 4
call fcn.00402ca0
cmp dword [ebp - 0x10], 0
je 0x4fd4cb
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax]
mov byte [ebp - 0x14], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 1]
mov byte [ebp - 0x13], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 2]
mov byte [ebp - 0x12], al
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov al, byte [eax + 3]
mov byte [ebp - 0x11], al
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x4fd610
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fd772
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4fd65f
lea edx, [ebp - 0x20]
mov eax, dword [0x5d2df4]
call fcn.004060fc
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4fc7c0]
call fcn.0040c61c
call fcn.0040376c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
jne 0x4fd69a
lea edx, [ebp - 0x20]
mov eax, dword [0x5d2d24]
call fcn.004060fc
mov ecx, dword [ebp - 0x20]
mov dl, 1
mov eax, dword [0x4fc7c0]
call fcn.0040c61c
call fcn.0040376c
xor eax, eax
push ebp
push 0x4fd73f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040325c
mov eax, dword [ebp + 0xc]
push eax
mov ax, word [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004fd528
mov eax, dword [ebp - 4]
call fcn.004fd3a4
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040325c
push 0x10
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4fd78c
call fcn.004fce34
mov eax, dword [ebp - 4]
test byte [eax + 0x28], 0x10
jne 0x4fd735
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
setne al
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xffff
call fcn.0040325c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4fd75c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fd779
lea eax, [ebp - 0x20]
call fcn.00403cf8
ret
Function at 0x4fd970
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffe8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004fd1cc
xor eax, eax
push ebp
push 0x4fdadf
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4fdac9
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4fd9ba
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4fd9c4
call fcn.0040380c
jmp 0x4fdae6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00413fd4
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1018]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x4fdabe
push 0
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4fda77
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2733
je 0x4fda67
lea eax, [ebp - 0x18]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040325c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004fd928
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4fdaf0]
cmp dl, byte [eax + 0x28]
je 0x4fdac5
call fcn.0040c5c0
jmp 0x4fdac5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
call fcn.00413fe4
jmp 0x4fdac5
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jle 0x4fda95
mov edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00413fe4
jmp 0x4fd9c4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00413fd4
mov ebx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.00413ff0
cmp ebx, eax
jne 0x4fd9c4
push ebp
call fcn.004fd928
pop ecx
jmp 0x4fdac5
push ebp
call fcn.004fd928
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdae6
mov eax, dword [ebp - 4]
call fcn.004fd1e4
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4fdaf4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fdc2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004fd1cc
xor eax, eax
push ebp
push 0x4fdc0d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4fdb48
call fcn.0040380c
jmp 0x4fdc14
push 0
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4fdbf7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2733
je 0x4fdbf7
lea eax, [ebp - 0x14]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov bx, 0xfffe
call fcn.0040325c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x14], 0
je 0x4fdbf7
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 0x14]
call fcn.0040be30
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0xb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
mov eax, 0x4fdc48
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0xb
lea eax, [ebp - 0x2c]
push eax
push 2
lea edx, [ebp - 0x34]
mov eax, dword [0x5d2f8c]
call fcn.004060fc
mov ecx, dword [ebp - 0x34]
mov dl, 1
mov eax, dword [0x4fc7c0]
call fcn.0040c658
call fcn.0040376c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdc14
mov eax, dword [ebp - 4]
call fcn.004fd1e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fdc36
lea eax, [ebp - 0x34]
mov edx, 2
call fcn.00403d1c
ret

Function at 0x500ed4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 8]
cmp dword [esi], 0
jne 0x500f02
mov ecx, 4
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503dc8
call fcn.0040376c
mov eax, dword [esi]
push eax
mov edx, edi
mov ecx, dword [ebp - 4]
xor eax, eax
call fcn.00500e90
mov eax, dword [esi]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [ebx + 0x2c]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x500f3a
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x500f3a
xor eax, eax
jmp 0x500f3c
mov al, 1
test al, al
jne 0x500f5c
call sub.kernel32.dll_GetLastError_1
push eax
mov ecx, 2
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503d04
call fcn.0040376c
mov cl, 1
mov dl, 6
mov eax, ebx
call fcn.00503924
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x501000
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x50102e
mov ecx, 4
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503dc8
call fcn.0040376c
mov eax, dword [ebx]
mov byte [eax + 0x14], 1
mov eax, dword [ebx]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
mov eax, dword [esi + 0x2c]
push eax
call sub.kernel32.dll_ReadFile_1
test eax, eax
jne 0x50105d
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x3e5
je 0x50105d
xor eax, eax
jmp 0x50105f
mov al, 1
test al, al
jne 0x50107f
call sub.kernel32.dll_GetLastError_1
push eax
mov ecx, 3
mov dl, 1
mov eax, dword [0x4ff6e8]
call fcn.00503d04
call fcn.0040376c
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x52d7c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404128
mov eax, dword [ebp - 8]
call fcn.00404128
mov eax, dword [ebp - 0xc]
call fcn.00404128
xor eax, eax
push ebp
push 0x52d897
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x52d8b0
call fcn.00403f7c
lea eax, [ebp - 8]
mov edx, 0x52d8b0
call fcn.00403f7c
lea eax, [ebp - 0xc]
mov edx, 0x52d8b0
call fcn.00403f7c
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00404144
push eax
lea eax, [ebp - 8]
call fcn.00404144
push eax
lea eax, [ebp - 4]
call fcn.00404144
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x52d87c
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x52d8bc
call fcn.00403fc0
mov eax, dword [ebp - 0x10]
mov cx, word [0x52d8d0]
mov dl, 1
call fcn.00459254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x52d89e
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403d1c
ret
Function at 0x5a6948
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404128
mov eax, dword [ebp - 8]
call fcn.00404128
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x5a6a2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00402ca0
mov dword [esi], 0x3c
mov dword [esi + 4], 0x140
call sub.user32.dll_GetActiveWindow
mov dword [esi + 8], eax
mov eax, 0x5a6a3c
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
call fcn.00404138
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
call fcn.00404138
mov dword [esi + 0x10], eax
mov dword [esi + 0x1c], 1
push esi
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x5a69d3
mov ebx, dword [esi + 0x38]
jmp 0x5a69f6
call sub.kernel32.dll_GetLastError_1
lea edx, [ebp - 0x48]
call fcn.0040be30
mov eax, dword [ebp - 0x48]
call fcn.0045934c
jmp 0x5a6a0b
mov eax, dword [0x5d2e70]
mov eax, dword [eax]
call fcn.004510fc
push 0x32
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x5a69ea
push ebx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6a35
lea eax, [ebp - 0x48]
call fcn.00403cf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403d1c
ret

Function at 0x5b1fdc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404128
mov eax, dword [ebp - 8]
call fcn.00404128
mov eax, dword [ebp + 8]
call fcn.00404128
xor eax, eax
push ebp
push 0x5b20b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x5b20c8
call fcn.00403f7c
lea eax, [ebp - 8]
mov edx, 0x5b20c8
call fcn.00403f7c
lea eax, [ebp + 8]
mov edx, 0x5b20c8
call fcn.00403f7c
mov bl, 1
push 1
lea eax, [ebp + 8]
call fcn.00404144
push eax
lea eax, [ebp - 8]
call fcn.00404144
push eax
lea eax, [ebp - 4]
call fcn.00404144
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x5b208d
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x5b20d4
call fcn.00403fc0
mov eax, dword [ebp - 0xc]
mov cx, word [0x5b20e8]
mov dl, 1
call fcn.00459254
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b20b7
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403d1c
lea eax, [ebp + 8]
call fcn.00403cf8
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4cbc6ae6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x3bac332d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x404de5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x408688
cmp edx, dword [eax]
je 0x404e07
add eax, 8
inc ecx
cmp eax, 0x408718
jl 0x404df8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x408688]
jne 0x404f35
mov eax, dword [0x408a48]
cmp eax, 1
je 0x404f0f
test eax, eax
jne 0x404e38
cmp dword [0x4085d4], 1
je 0x404f0f
cmp edx, 0xfc
je 0x404f35
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x404e6f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004032f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004033f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x404eb2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004033f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4065d0
push edi
call fcn.00405720
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004032f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00403300
lea eax, [ebp - 0xa0]
push 0x4065b0
push eax
call fcn.00403300
push dword [esi + 0x40868c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00403300
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00405697
add esp, 0x2c
pop edi
jmp 0x404f35
lea eax, [ebp + 8]
lea esi, [esi + 0x40868c]
push 0
push eax
push dword [esi]
call fcn.004033f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x55730132
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
nop
cmp eax, 0
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7c365d2e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42fcc4
Capabilities:
Access peb ldr_data

Disassembly:
add byte [eax + eax], al
add byte [eax + 0xb8820f], al
add byte [eax], al

Function at 0x43a5c8
Capabilities:
Enumerate pe sections

Disassembly:
push 0x480d38
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a8460]
pushal
test byte [edx], cl
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
xor ebp, ebp
mov dword [esp + 0x1c], vtable.CTList_class_CDevice_.0
and al, 0x1c
sub al, 0x3f
dec eax
add byte [ecx - 0x76dfdb94], cl
insb byte es:[edi], dx
and al, 0x24
mov dword [esp + 0x30], ebp
call fcn.004429e4
test byte [eax], al
add byte [ecx], bh
invalid
xor byte [ebp + 0x1b], dh
mov esi, dword [esi + 0x14]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004425dd
mov eax, esi
jmp 0x43a707
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 8]
cmp eax, ebp
jne 0x43a6c4
call fcn.00442a17
mov eax, dword [eax + 0x30]
lea ecx, [esp + 0x1c]
push ecx
push 0x1200
push 0x1022
mov ecx, eax
call fcn.00443720
add byte [eax], al
test eax, eax
jle 0x43a6c4
mov eax, dword [esp + 0x20]
cmp eax, ebp
mov ebx, eax
je 0x43a6ce
mov edi, dword [eax + 4]
cmp edi, ebp
je 0x43a6ce
jns 0x43a554
add byte [eax], al
mov ebp, dword [esp + 0x38]
lea esp, [esp]
lea edx, [esp + 0x18]
push edx
push 0x60
mov ecx, edi
call fcn.0045112a
imul eax, dword [ecx], 0
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0x34]
mov esi, dword [ebp + 0x30]
and eax, 7
imul ecx, eax
mov eax, 1
or dl, 0xff
cmp esi, eax
jle 0x43a598
lea ebx, [ebx]
add eax, eax
add dl, dl
cmp eax, esi
jl 0x43a590
movzx eax, dl
and eax, dword [ebp + 0x18]
cmp eax, ecx
je 0x43a5c3
test ebx, ebx
je 0x43a6c4
mov eax, dword [ebx + 8]
test eax, eax
je 0x43a6c4
mov edi, dword [eax + 4]
test edi, edi
mov ebx, eax
fdiv dword [ebp - 0x5e]
jmp 0x43a6c4
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + 0x14]
dec ecx
adc al, 0xf
mov dh, 0x5f
or al, 0xf
mov dh, 0x6f
or eax, 0x8face857
add byte [eax], al
Function at 0x43a5d8
Capabilities:
Enumerate pe sections

Disassembly:
cmp ebx, 0xffffffff
je 0x43a6c4
cmp ebp, 0xffffffff
je 0x43a6c4
call fcn.00442aeb
mov eax, dword [eax + 0x24]
test eax, eax
je 0x43a6c4
mov edi, dword [eax + 4]
test edi, edi
je 0x43a6c4
mov eax, dword [edi + 4]
test eax, eax
je 0x43a6c4
add byte [eax], al
test byte [eax + 4], 1
je 0x43a6ac
mov ecx, dword [eax + 0x10]
movzx edx, word [ecx + 4]
movzx esi, dx
mov bh, 0xf2
cmp si, 0x1022
jne 0x43a650
movzx esi, word [ecx + 6]
cmp si, 0x1201
jne 0x43a650
movzx edx, byte [eax + 0xc]
cmp edx, ebx
jne 0x43a6ac
movzx ecx, byte [eax + 0xd]
cmp ecx, ebp
jne 0x43a6ac
mov edx, dword [esp + 0x14]
mov ecx, dword [edx + 0x14]
push eax
jmp 0x43a6a7
movzx esi, dx
cmp si, 0x1022
jne 0x43a665
movzx esi, word [ecx + 6]
cmp si, 0x1202
je 0x43a68f
movzx esi, dx
cmp si, 0x1022
jne 0x43a67a
movzx esi, word [ecx + 6]
cmp si, 0x1203
je 0x43a68f
movzx edx, dx
cmp dx, 0x1022
jne 0x43a6ac
movzx ecx, word [ecx + 6]
cmp cx, 0x1204
jne 0x43a6ac
movzx ecx, byte [eax + 0xc]
cmp ecx, ebx
jne 0x43a6ac
movzx edx, byte [eax + 0xd]
cmp edx, ebp
jne 0x43a6ac
push eax
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x14]
call fcn.00443658
test edi, edi
je 0x43a6c4
mov eax, dword [edi + 8]
test eax, eax
je 0x43a6c4
mov edi, eax
mov eax, dword [eax + 4]
test eax, eax
jne 0x43a610
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
xor ebp, ebp
cmp eax, ebp
mov edi, dword [esi + 0x14]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], vtable.CTList_class_CDevice_.0
mov ecx, eax
mov esi, eax
je 0x43a705
lea esp, [esp]
cmp ecx, ebp
mov esi, dword [esi + 8]
je 0x43a6ff
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
cmp esi, ebp
mov ecx, esi
jne 0x43a6f0
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4