joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b430
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x11c]
push esi
mov esi, dword [esp + 0x118]
mov dword [esp + 0xc], 0x10
test ecx, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 1
jne 0x1001b46b
push ecx
push ecx
push ecx
lea eax, [esp + 0x1c]
lea ecx, [esi + 1]
push eax
push ecx
jmp 0x1001b4c3
cmp ecx, 0xffffffff
jne 0x1001b482
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x1001b4b1
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0x10]
push eax
push 0
push 0
lea edx, [esi + 1]
push ecx
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x1001b4d7
or eax, 0xffffffff
pop esi
add esp, 0x110
ret
lea eax, [esp + 0x10]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1001b51c
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x128]
push edx
push 0
push eax
push ecx
push esi
call sub.WS2_32.dll_recvfrom
test eax, eax
jg 0x1001b521
mov eax, 0xfffffffc
pop esi
add esp, 0x110
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x110
ret

Function at 0x1001b640
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
sub esp, 0x10c
mov ecx, dword [esp + 0x114]
push esi
mov esi, dword [esp + 0x114]
mov dword [esp + 0xc], 1
test ecx, ecx
mov dword [esp + 0x10], esi
jne 0x1001b673
push ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
lea ecx, [esi + 1]
push ecx
jmp 0x1001b6cb
cmp ecx, 0xffffffff
jne 0x1001b68a
mov dword [esp + 4], 0
mov dword [esp + 8], 0
jmp 0x1001b6b9
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 4], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
shl edx, 3
mov dword [esp + 8], edx
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push eax
push 0
push ecx
lea edx, [esi + 1]
push 0
push edx
call sub.WS2_32.dll_select
test eax, eax
jge 0x1001b6df
or eax, 0xffffffff
pop esi
add esp, 0x10c
ret
lea eax, [esp + 0xc]
push eax
push esi
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x1001b718
mov ecx, dword [esp + 0x124]
mov edx, dword [esp + 0x11c]
mov eax, dword [esp + 0x120]
push 0x10
push ecx
push 0
push edx
push eax
push esi
call sub.WS2_32.dll_sendto
pop esi
add esp, 0x10c
ret
mov eax, 0xfffffffd
pop esi
add esp, 0x10c
ret
Function at 0x1001b750
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
lea eax, [esp + 4]
push esi
push 0x100
push eax
call sub.WS2_32.dll_gethostname
test eax, eax
jge 0x1001b774
xor eax, eax
pop esi
add esp, 0x104
ret
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostbyname
mov esi, eax
test esi, esi
mov dword [esp + 4], esi
jne 0x1001b790
pop esi
add esp, 0x104
ret
push ebx
push ebp
mov ebp, dword [esp + 0x114]
push edi
xor ebx, ebx
jmp 0x1001b7a2
mov esi, dword [esp + 0x10]
mov edx, dword [esi + 0xc]
cmp dword [edx + ebx*4], 0
je 0x1001b7f1
push 0x100
call sub.MSVCRT.dll_malloc
mov dword [ebp + ebx*4], eax
mov eax, dword [esi + 0xc]
add esp, 4
mov ecx, dword [eax + ebx*4]
mov edx, dword [ecx]
push edx
call sub.WS2_32.dll_inet_ntoa
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + ebx*4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc ebx
cmp ebx, 0xa
rep movsb byte es:[edi], byte [esi]
jl 0x1001b79e
pop edi
mov eax, ebx
pop ebp
pop ebx
pop esi
add esp, 0x104
ret

Function at 0x1001b870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov edx, dword [esp + 0x18]
lea eax, [esp]
lea ecx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0xc], 0x10
call sub.WS2_32.dll_getsockname
test eax, eax
jne 0x1001b8a6
mov eax, dword [esp + 6]
push eax
call sub.WS2_32.dll_ntohs
and eax, 0xffff
add esp, 0x14
ret
or eax, 0xffffffff
add esp, 0x14
ret

Function at 0x1001c8a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x1001c8ac
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x1001c93f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x1001c909
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.1001c950
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x1001c8de
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x1001c970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x1001ca6d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x1001c9c2
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x1001c9ee
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.1001c950
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x1001ca2f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x1001c9b1
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x1001e8a0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x10028ac4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x1001e8b3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x1001e8f4
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x10028b6c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x1001e926
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001e92a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x1001e91b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x1001e948
mov bl, byte [esp + ecx + 0x4c]
jmp 0x1001e94c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x1001e93d
xor ecx, ecx
mov eax, 0x10028ad4
xor ebx, ebx
mov bl, byte [ecx + 0x10028b7c]
cmp byte [esp + ebx + 0x14], 0
je 0x1001e977
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x10028b94]
cmp byte [esp + ebx + 0x14], 0
je 0x1001e98e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x1001e95e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x1001e8e7
lea edx, [esp + 0x84]
push edx
call fcn.1001e9d0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x10002050
Capabilities:
Create thread

Disassembly:
cmp byte [0x10006434], 0
jne 0x10002080
push 0
push 0
push 0
push 0x10001e00
push 0
push 0
mov byte [0x10006434], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10002080
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
ret

Function at 0x10002090
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100020b9
push 0
push 0
push 0
push 0x10001e00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100020b9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop ebp
ret 0xc
Function at 0x428cb0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
push eax
push ecx
push 0xca62c1d6
push 0x8f1bbcdc
push 0x6ed9eba1
push 0x5a827999
push edx
call fcn.00429060
ret 0x18

Function at 0x428f40
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0xfffffff
imul eax, eax, 8
jo 0x428f60
test ecx, 0x10000000
je 0x428f5d
or eax, 0x80000000
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x428f70
Capabilities:
Hash data using sha1

Disassembly:
mov ecx, dword [esp + 4]
mov eax, ecx
and eax, 0x3fffffff
imul eax, eax, 2
jo 0x428f9a
test ecx, 0x40000000
je 0x428f8d
or eax, 0x80000000
test ecx, 0x80000000
je 0x428f97
or al, 1
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]

Function at 0x428fa0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
mov ecx, esi
mov eax, esi
and ecx, 0x3ffffff
imul ecx, ecx, 0x20
jo 0x428fde
and eax, 0xf8000000
cdq
and edx, 0x7ffffff
add eax, edx
sar eax, 0x1b
and eax, 0x1f
or ecx, eax
test esi, 0x4000000
pop esi
je 0x428fd9
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x428ff0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, eax
xor edx, ecx
jge 0x429005
add eax, ecx
jo 0x429016
ret 8
xor eax, 0x80000000
add eax, ecx
jo 0x429016
xor eax, 0x80000000
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop

Function at 0x429020
Capabilities:
Hash data using sha1

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
mov eax, ebx
and ecx, 1
imul ecx, ecx, 0x40000000
jo 0x429057
and al, 0xfc
cdq
and edx, 3
add eax, edx
sar eax, 2
and eax, 0x3fffffff
or ecx, eax
test bl, 2
pop ebx
je 0x429052
or ecx, 0x80000000
mov eax, ecx
ret 4
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
Function at 0x401140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
push esi
push edi
lea edi, [ebp - 0x464]
mov ecx, 0x119
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
mov esi, esp
lea eax, [ebp - 0x210]
push eax
push 0xfa
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp esi, esp
call fcn.004175bb
mov dword [ebp - 0x218], 0x4213fc
push 0x208
push 0
lea ecx, [ebp - 0x424]
push ecx
call fcn.00404770
add esp, 0xc
lea edx, [ebp - 0x210]
mov dword [ebp - 0x430], edx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x430]
mov dx, word [ecx]
mov word [ebp - 0x436], dx
add dword [ebp - 0x430], 2
cmp word [ebp - 0x436], 0
jne 0x4011ba
mov eax, dword [ebp - 0x430]
sub eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x434]
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x440], eax
lea edx, [ebp - 0x424]
add edx, 0xfffffffe
mov dword [ebp - 0x444], edx
mov eax, dword [ebp - 0x444]
mov cx, word [eax + 2]
mov word [ebp - 0x446], cx
add dword [ebp - 0x444], 2
cmp word [ebp - 0x446], 0
jne 0x401208
mov edi, dword [ebp - 0x444]
mov esi, dword [ebp - 0x43c]
mov edx, dword [ebp - 0x440]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x450], ecx
mov edx, dword [ebp - 0x44c]
mov ax, word [edx]
mov word [ebp - 0x452], ax
add dword [ebp - 0x44c], 2
cmp word [ebp - 0x452], 0
jne 0x401262
mov ecx, dword [ebp - 0x44c]
sub ecx, dword [ebp - 0x450]
mov edx, dword [ebp - 0x450]
mov dword [ebp - 0x458], edx
mov dword [ebp - 0x45c], ecx
lea eax, [ebp - 0x424]
add eax, 0xfffffffe
mov dword [ebp - 0x460], eax
mov ecx, dword [ebp - 0x460]
mov dx, word [ecx + 2]
mov word [ebp - 0x462], dx
add dword [ebp - 0x460], 2
cmp word [ebp - 0x462], 0
jne 0x4012b0
mov edi, dword [ebp - 0x460]
mov esi, dword [ebp - 0x458]
mov eax, dword [ebp - 0x45c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x4213f8
lea ecx, [ebp - 0x424]
push ecx
call fcn.0040661e
add esp, 8
mov dword [ebp - 0x42c], eax
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00407973
add esp, 8
movzx ecx, byte [ebp + 0xc]
test ecx, ecx
je 0x40133b
mov edx, dword [ebp - 0x42c]
push edx
push 0x4213f4
call fcn.00407973
add esp, 8
mov eax, dword [ebp - 0x42c]
push eax
call fcn.00405e5c
add esp, 4
push edx
mov ecx, ebp
push eax
lea edx, [0x401378]
call fcn.00417567
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004037ab
add esp, 0x464
cmp ebp, esp
call fcn.004175bb
mov esp, ebp
pop ebp
ret
Function at 0x401640
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push esi
push edi
lea edi, [ebp - 0x204]
mov ecx, 0x81
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x420004]
xor eax, ebp
mov dword [ebp - 4], eax
push 1
push str.testFX_...
call fcn.00401140
add esp, 8
mov dword [ebp - 0x114], pe_nt_image_headers32
mov eax, dword [ebp - 0x114]
push eax
push 0
lea ecx, [ebp - 0x108]
push ecx
call fcn.00404770
add esp, 0xc
mov esi, esp
lea edx, [ebp - 0x120]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.004175bb
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0
jne 0x4017cc
push 1
push str.read_SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full_OK
call fcn.00401140
add esp, 8
mov esi, esp
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push 0x4212f4
mov edx, dword [ebp - 0x120]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.004175bb
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x4017b7
push 0
push str.read_value_version_ok__:
call fcn.00401140
add esp, 8
mov dword [ebp - 0x200], 0
mov dword [ebp - 0x204], 0
jmp 0x401755
mov eax, dword [ebp - 0x204]
add eax, 2
mov dword [ebp - 0x204], eax
mov ecx, dword [ebp - 0x204]
cmp ecx, dword [ebp - 0x114]
jae 0x40178e
mov edx, dword [ebp - 0x200]
mov eax, dword [ebp - 0x204]
mov cl, byte [ebp + eax - 0x108]
mov byte [ebp + edx - 0x1f8], cl
mov edx, dword [ebp - 0x200]
add edx, 1
mov dword [ebp - 0x200], edx
jmp 0x401746
push 1
lea eax, [ebp - 0x1f8]
push eax
call fcn.00401140
add esp, 8
push str.4.5.2
lea ecx, [ebp - 0x1f8]
push ecx
call fcn.00401500
add esp, 8
jmp 0x4017dd
push 0
push str.read_value_version_nok__:
call fcn.00401140
add esp, 8
xor eax, eax
jmp 0x4017dd
push 1
push str.cant_read_registry_:_SOFTWAREMicrosoftNET_Framework_SetupNDP_v4Full__
call fcn.00401140
add esp, 8
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x40180c]
call fcn.00417567
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004037ab
add esp, 0x204
cmp ebp, esp
call fcn.004175bb
mov esp, ebp
pop ebp
ret
Function at 0x40de52
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040dcd1

Function at 0x40f0ac
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040ed6c

Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150
Function at 0x43aeb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1540
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x4b7794
call fcn.0046d85c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0046a036
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43b440
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1540
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4e406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], 0x4b83f0
call fcn.0046d85c
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.0046a036
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44b4c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b26c7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4e406c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
push 0x48
call fcn.0046d85c
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
lea esi, [edi + 0xc]
mov dword [edi + 4], 1
lea ecx, [esi + 4]
mov dword [edi + 8], 1
xor eax, eax
mov dword [edi], 0x4ceb1c
mov dword [esi], 0x4c8c18
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
mov dword [ebp - 0x14], esi
mov word [ecx], ax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
push 0xb
mov byte [ebp - 4], 8
push 0x4c8904
mov byte [esi + 0x34], 1
call fcn.00407cf0
xorps xmm0, xmm0
mov eax, ebx
movq qword [ebx], xmm0
mov dword [ebx], esi
mov dword [ebx + 4], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x33d65125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x33d65134
pop dword [ebp - 0x14]
mov eax, 0x49ba5915
add eax, 0xea1bf81f
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2c2f33e7
sub dword [ebp - 0x24], 0xdddcee9c
mov dword [ebp - 0x20], 0x5d4eae01
add dword [ebp - 0x20], 0xd4e49e44
mov dword [ebp - 0x1c], 0xead87335
add dword [ebp - 0x1c], 0x6173d0f9
mov dword [ebp - 0x18], 0xe071f4de
add dword [ebp - 0x18], 0x1f8e0b22
lea eax, [ebp - 0x24]
push eax
mov eax, 0x29b2f5f5
sub eax, 0xf5e2e4ed
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x168791f8
sub dword [ebp - 0x24], 0xa21528a2
mov dword [ebp - 0x20], 0xaff36976
sub dword [ebp - 0x20], 0x6e870801
mov dword [ebp - 0x1c], 0x1d62605b
add dword [ebp - 0x1c], 0x460d0c11
mov dword [ebp - 0x18], 0xb07bb186
sub dword [ebp - 0x18], 0xb07bb186
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x6a47e93a
sub eax, 0x3677d816
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x35706
push 0
call eax
mov ecx, 0x3d1a
mov ebx, eax
mov edx, 0x26742d89
add edx, 0xd62e277
add edx, dword [ebp - 0x14]
mov edi, 0x30403de4
sub edi, 0x9061d04e
mov dword [ebp - 8], 0xf00237ef
mov esi, dword [edx]
sub dword [ebp - 0x10], 0x69d71288
sub esi, edi
xor dword [ebp - 8], edx
mov dword [ebx], esi
add dword [ebp - 4], ecx
add ebx, 4
add edx, 0xb9e2935c
add edx, 0x461d6ca8
loop 0x33d65250
add eax, 0xf33f13af
sub eax, 0xf33e2c74
mov ebx, eax
add eax, 0x72d96d4b
sub eax, 0x72d96d46
mov ecx, 0x33d00000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret