joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4569d7
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.00455e8d
call 0x455f86
jmp 0x45698b
mov dword [esp + 0x24], eax
jmp 0x456a06
push 0
jmp 0x456981
pushal
jmp 0x455f81
pushfd
cmp dword [esp + 4], 0
jne 0x4569af
je 0x456966
pop eax
sub eax, 0xfd631983
jmp 0x4569c5
jmp 0x456a1c
call 0x4569d7
inc ecx
inc esp
push esi
inc ecx
push eax
dec ecx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add bl, ch
mov edx, 0x6f089a18
lcall 0xf90a, 0x6fff7a25
mov bl, 0x52
int 0x5c
scasd eax, dword es:[edi]
mov dh, 0xe8
or al, 0
add byte [eax], al
push edx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x456a5c
dec ebx
jns 0x4569fb
push eax
call fcn.0043ef04
jmp 0x455e88
popal
jmp 0x456a22
inc dword [esp + 8]
popfd
ret
inc dword [esp + 8]
popfd
ret
add ebx, 0xeb083542
cmp ebx, 0xeb08360e
jmp 0x456a58
movzx ebx, byte [eax]
jmp 0x456a28
je 0x456a92
jne 0x455fd1
jno 0x456a53
invalid
call fcn.00456ab1
mov dword [esp + 4], esi
call int.00456a9b
int3
outsb dx, byte [esi]
test dh, bh
invalid

Function at 0x456b44
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 5]
mov word [esp], bx
lea esp, [esp + 3]
push ecx
jmp 0x456b79

Function at 0x456b5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
ret
call fcn.00456b44
jne 0x456b59
outsb dx, byte [esi]
or eax, edi
cmp eax, 0x2c45d545
fbld tbyte [edx - 0x2b]
inc esi
aam 0xb3
dec esi
invalid

Function at 0x456c53
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov al, byte [esp]
push edi
mov di, 0xa390
mov edi, dword [esp]
mov al, byte [esp]
xchg di, ax
jmp 0x456bd9
mov dword [esp], eax
bswap esi
mov esi, dword [esp]
mov ax, 0x5d2a
not si
mov ah, byte [esp]
jmp 0x456ae5
mov esi, dword [esp + 8]
lea esp, [esp + 0x10]
push 0
jmp 0x456b73
mov si, 0x3675
mov ah, byte [esp + 1]
mov eax, dword [esp + 4]
mov esi, edi
mov esi, 0xd1a62f29
mov esi, 0x889ff936
jmp 0x456b0f
pushfd
call fcn.00456b5a
mov ecx, edx
mov ecx, 0xf113d4a4
setns ch
mov cx, 0x6275
push eax
xchg ecx, eax
jmp 0x456bb8
mov ecx, 0x9f5d3019
bswap edx
rdtsc
mov dx, word [esp]
bswap eax
rdtsc
jmp 0x456c00
lea eax, [ebx*4]
lea ecx, [eax*4]
bswap eax
mov ch, byte [esp]
push edx
xchg dx, ax
jmp 0x456b8b
mov si, word [esp]
pop edi
mov eax, ecx
mov eax, ebx
push ecx
mov ah, bh
jmp 0x456b2a
mov ch, 0x24
mov word [esp], bp
mov eax, dword [esp]
lea esp, [esp + 2]
pop eax
bswap ecx
jmp 0x456c2b
pop edx
xchg al, ch
mov al, byte [esp]
lea eax, [esi*4]
mov cx, word [esp]
push bp
jmp 0x456bea
lea ecx, [eax - 0x1b]
pop ecx
jmp 0x456c3d
mov cx, 0x1870
lea ecx, [ecx + ebx]
lea ecx, [ebx + edi]
mov cl, 0xb4
bswap ecx
mov ch, al
jmp 0x456c15
cmp dword [esp + 4], 0
jmp 0x456ca8
push sp
pop dword [esp]
pop esi
jmp 0x456afb

Function at 0x459108
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0x43e146
Function at 0x47b5d4
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x47b5f7
add esp, 2
lea esp, [esp + 2]
jmp 0x47b625

Function at 0x4ec3af
Capabilities:
Check for peb beingdebugged flag

Disassembly:
lea esp, [esp + 0x22]
jmp 0x4ec3d4
lea esp, [esp + 2]
mov dword [esp + 0x24], edi
lea esp, [esp + 0x24]
mov eax, dword fs:[0x30]
jmp 0x4ec400
Function at 0x410c70
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0x4025e6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x70
call sub.MSVBVM60.DLL___vbaChkstk
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x14], 0x401f20
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 1
mov dword [ebp - 4], 2
push 0xffffffffffffffff
call dword [sym.imp.MSVBVM60.DLL___vbaOnError]
mov dword [ebp - 4], 3
call fcn.00404fd8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
lea eax, [ebp - 0x64]
push eax
push 0x28
mov ecx, dword [ebp - 0x6c]
push ecx
call fcn.00405038
mov dword [ebp - 0x70], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x70], 0
setne dl
neg edx
movsx eax, dx
test eax, eax
je 0x410e25
mov dword [ebp - 4], 4
xor ecx, ecx
test ecx, ecx
je 0x410d46
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0x1c
lea edx, [ebp - 0x6c]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0x1c
lea ecx, [ebp - 0x60]
push ecx
push 0
mov edx, dword [ebp - 0x64]
push edx
call fcn.00405088
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
jmp 0x410e25
mov dword [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
push 0x404ae4
lea ecx, [ebp - 0x68]
push ecx
call dword [sym.imp.MSVBVM60.DLL___vbaStrToAnsi]
push eax
push 0
call fcn.004050e8
mov dword [ebp - 0x6c], eax
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
xor edx, edx
cmp dword [ebp - 0x6c], 0
setne dl
neg edx
mov word [ebp - 0x74], dx
lea ecx, [ebp - 0x68]
call dword [sym.imp.MSVBVM60.DLL___vbaFreeStr]
movsx eax, word [ebp - 0x74]
test eax, eax
je 0x410e25
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x60], 1
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410dc3
mov dword [ebp - 0x8c], 0
jmp 0x410dcf
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x8c], eax
lea ecx, [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x74]
imul edx, edx, 0xc
lea eax, [ebp + edx - 0x5c]
push eax
push 8
call dword [sym.imp.MSVBVM60.DLL___vbaCopyBytes]
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x74], 0
cmp dword [ebp - 0x74], 2
jae 0x410e06
mov dword [ebp - 0x90], 0
jmp 0x410e12
call dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
mov dword [ebp - 0x90], eax
mov ecx, dword [ebp - 0x74]
imul ecx, ecx, 0xc
mov dword [ebp + ecx - 0x54], 2
jmp 0x410d14
mov dword [ebp - 4], 0x11
mov edx, dword [ebp - 0x64]
push edx
call fcn.00404e50
call dword [sym.imp.MSVBVM60.DLL___vbaSetSystemError]
push 0x410e4d
jmp 0x410e4c
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x10002520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10124d90
push fcn.1006c220
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x1012c034]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x100025c3
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x100025c3
mov esi, dword [edx + ecx + 0xd8]
lea eax, [esi + ecx]
cmp edi, eax
jb 0x100025c3
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x100025c3
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002740
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
cmp edi, 0x7ff80000
jbe 0x10002768
lea esi, [edi - 0x7ff80000]
cmp edi, 0x80000000
jb 0x1000276d
mov ebx, 0xfff80000
jmp 0x10002773
mov esi, 0x10000
lea ebx, [edi + 0x7ff80000]
mov edx, dword [0x10131760]
mov eax, dword [0x10131768]
mov dword [ebp - 4], ebx
test edx, edx
jne 0x10002791
test eax, eax
je 0x100027a4
mov edx, eax
mov dword [0x10131760], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x100027a4
cmp ecx, esi
jb 0x100027a4
cmp ecx, ebx
jbe 0x10002924
mov edx, eax
mov dword [0x10131760], edx
test eax, eax
je 0x100027da
mov ecx, eax
test eax, eax
je 0x100027c9
mov eax, dword [ecx + 8]
test eax, eax
je 0x100027c9
cmp eax, esi
jb 0x100027c9
cmp eax, ebx
jbe 0x10002924
mov edx, dword [edx + 4]
mov ecx, edx
mov dword [0x10131760], edx
mov eax, edx
test ecx, ecx
jne 0x100027b2
and edi, 0xffff0000
mov ebx, edi
cmp edi, esi
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jbe 0x10002854
lea eax, [ebx - 0x70000000]
mov edx, 0x6fff0000
cmp eax, 0x10000000
lea eax, [ebp - 0x40]
push 0x1c
cmovbe ebx, edx
push eax
push ebx
call ecx
test eax, eax
je 0x1000284e
cmp dword [ebp - 0x30], 0x10000
jne 0x1000281e
cmp dword [ebp - 0x34], 0x10000
jae 0x1000282b
mov ebx, dword [ebp - 0x3c]
add ebx, 0xffff0000
cmp ebx, esi
jmp 0x100027e4
push 0x40
push 0x3000
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x10131760], edx
test edx, edx
jne 0x100028e9
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp edi, dword [ebp - 4]
jae 0x1000294a
lea eax, [edi - 0x70000000]
mov edx, 0x80010000
cmp eax, 0x10000000
mov ebx, esi
push 0x1c
lea eax, [ebp - 0x24]
cmovbe edi, edx
push eax
push edi
call ecx
test eax, eax
je 0x1000294a
cmp dword [ebp - 0x14], 0x10000
jne 0x100028d1
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x10000
jb 0x100028d4
movzx edx, di
test edx, edx
je 0x100028b2
mov edi, dword [ebp - 0x24]
mov eax, 0x10000
sub eax, edx
sub ecx, eax
add edi, eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], edi
push 0x40
push 0x3000
push 0x10000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edx, eax
mov dword [0x10131760], edx
test edx, edx
jne 0x100028e9
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x24]
add edi, ecx
cmp edi, dword [ebp - 4]
jae 0x1000294a
mov ecx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1000285d
mov eax, dword [0x10131768]
xor ecx, ecx
mov dword [edx + 4], eax
mov edi, 0x7fd
mov dword [edx], 0x52727464
lea eax, [edx + 0xffe0]
mov dword [edx + 8], 0
mov dword [0x10131768], edx
mov dword [eax + 0x18], ecx
mov ecx, eax
sub eax, 0x20
sub edi, 1
jne 0x10002911
mov ebx, dword [ebp - 4]
mov dword [edx + 8], ecx
mov eax, dword [edx + 8]
cmp eax, esi
jb 0x1000294a
cmp eax, ebx
ja 0x1000294a
mov ecx, dword [eax + 0x18]
movaps xmm0, xmmword [0x101210a0]
pop edi
mov dword [edx + 8], ecx
pop esi
movups xmmword [eax], xmm0
pop ebx
movups xmmword [eax + 0x10], xmm0
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a90
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x1013175c], 0
jne 0x10002afd
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
mov edx, 0x1013175c
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x10002afd
push esi
mov esi, dword [0x10131768]
mov dword [0x10131770], eax
mov dword [0x10131774], eax
mov dword [0x1013176c], eax
mov dword [0x10131758], eax
mov dword [0x10131764], eax
test esi, esi
je 0x10002af6
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
lea eax, [ebp - 4]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x10002ae0
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x10dd
mov esp, ebp
pop ebp
ret

Function at 0x10003020
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x10131758]
test eax, eax
jne 0x10003099
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov esi, dword [ebp + 8]
cmp esi, eax
jne 0x10003041
xor eax, eax
pop esi
pop ebp
ret 4
push edi
push 8
call fcn.100671c0
add esp, 4
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x10003085
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 8
push edi
call fcn.10067210
add esp, 8
mov dword [0x10131758], esi
mov eax, esi
mov dword [0x10131764], 0
pop edi
pop esi
pop ebp
ret 4
mov eax, dword [0x1013176c]
mov dword [edi + 4], esi
mov dword [edi], eax
xor eax, eax
mov dword [0x1013176c], edi
pop edi
pop esi
pop ebp
ret 4
Function at 0x10021f50
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
lea edi, [ebp - 0xc]
mov ecx, 3
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10132022
call fcn.10067a80
mov dword [ebp - 8], 0
jmp 0x10021f87
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x10]
jae 0x10021faa
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
imul eax, dword [ebp + 8], 0x1000193
mov dword [ebp + 8], eax
jmp 0x10021f7e
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.10067a50
mov esp, ebp
pop ebp
ret

Function at 0x10033af0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
push ebx
push esi
push edi
mov edi, ebp
xor ecx, ecx
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x10132025
call fcn.10067a80
mov esi, esp
push 0
push 0
push 0
push 0x10033290
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10067a50
pop edi
pop esi
pop ebx
add esp, 0xc0
cmp ebp, esp
call fcn.10067a50
mov esp, ebp
pop ebp
ret

Function at 0x1007bef0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1007bb10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1007bf22
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x100f71c0]
call dword [ebp - 8]
jmp 0x1007bf2c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret

Function at 0x100d6911
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d6142
Function at 0x402680
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x409008], 0x8088405
inc edx
mov dword [ebx + 0x409008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402f18
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x40a034], 0
je 0x402f79
cmp word [0x40a208], 0xd7b2
jne 0x402f41
cmp dword [0x40a210], 0
jbe 0x402f41
mov eax, 0x40a204
call dword [0x40a220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x409060
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fa0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x409024], 0
jne 0x402f95
push 0
push 0x409058
push 0x409060
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404058
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [edx + 0x51fffffc], esi
mov byte [ebp - 0x34d], 0x75
invalid
invalid
invalid

Function at 0x404700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosd dword es:[edi], eax

Function at 0x4057d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004037df
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x4057fd
jmp 0x4051bc
cmp dword [ebp - 0x37c], 0
je 0x40580b
jmp 0x4058c0
push 0
push 0
push 2
push 0
push 2
push 0x40000000
push dword [ebp - 0x3a0]
call dword [ebp - 0x3c8]
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 0xffffffff
je 0x405864
push 0
lea eax, [ebp - 0x6c4]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x748]
push dword [ebp - 0x380]
call dword [ebp - 0x730]
push dword [ebp - 0x380]
call dword [ebp - 0x680]
jmp 0x405869
jmp 0x4051bc
and dword [ebp - 0x37c], 0
push dword [ebp - 0x3a0]
call dword [ebp - 0x704]
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 0
je 0x4058b0
lea eax, [ebp - 0x714]
push eax
call fcn.0040382a
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.004037df
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x4058bb
jmp 0x4058c0
jmp 0x4051bc

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret
Function at 0x404fe0
Capabilities:
Delete file

Disassembly:
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
ret

Function at 0x404ff0
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
push str.CommonProgramFiles
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jbe 0x405042
add eax, 0x1c
cmp eax, edi
jae 0x405042
push esi
call fcn.004074c2
lea eax, [esi + eax*2]
add esp, 4
cmp eax, esi
jbe 0x40502c
cmp word [eax - 2], 0x5c
jne 0x40502c
add eax, 0xfffffffe
push 0x4154b8
push eax
call fcn.00407509
add esp, 8
mov eax, 1
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x4050b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dl, 0xb6
test esi, esi
jbe 0x4050d2
mov ecx, dword [esp + 8]
push ebx
mov bl, byte [eax + ecx]
xor bl, dl
mov byte [eax + ecx], bl
inc eax
cmp eax, esi
mov dl, bl
jb 0x4050c2
pop ebx
pop esi
ret 8
Function at 0x40dad1
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40dac1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40dadf
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
or byte [ecx], al
add byte [eax], al
or byte [ecx], al
add byte [eax], al
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40db3d
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40db24
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40db2d
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40db37
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40db19
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40daa3
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x40dc04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
Function at 0x40dc19
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0040d3fa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d3af
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0040d3fa
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040d3af
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
invalid
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4041e9
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x19c], eax
push esi
mov eax, dword [0x407018]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
mov esi, 0x40750c
mov dword [esp + 0xc], 0x40750c
call fcn.004024d0
xor esi, esi
mov eax, 0x407510
mov dword [esp + 0x1b0], esi
call fcn.004021d0
xor ecx, ecx
mov eax, 0x407540
mov byte [esp + 0x1b0], 1
call fcn.00402550
cmp dword [0x4074fc], esi
jne 0x4010b4
cmp dword [0x407500], esi
jne 0x4010b4
lea eax, [esp + 0x14]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
cmp eax, esi
je 0x4010b4
mov ecx, eax
lea eax, [esp + 0x10]
call fcn.00402550
mov ecx, dword [eax]
push 0x405750
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x10], ecx
call sub.MSVCR90.dll__CxxThrowException
inc dword [0x4074fc]
mov dword [0x407530], esi
mov dword [0x407534], esi
mov dword [0x40753c], esi
mov dword [0x407538], esi
mov dword [0x40751c], 0xffffffff
mov eax, 0x40750c
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.0040377c
add esp, 0x1ac
ret

Function at 0x4011c0
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
sub esp, 0x14
mov eax, dword [0x407018]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, 0x40750c
call fcn.00401380
test al, al
je 0x4011e4
mov eax, esi
call fcn.004012f0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov esi, eax
mov eax, 2
push 0x27dd
mov word [esp + 8], ax
call sub.WSOCK32.dll_htons
push 0
mov word [esp + 0xa], ax
call sub.WSOCK32.dll_htonl
push 0x10
lea ecx, [esp + 8]
push ecx
push esi
mov dword [esp + 0x14], eax
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
jne 0x40124f
push esi
call sub.WSOCK32.dll_closesocket
call sub.WSOCK32.dll_WSAGetLastError
push eax
mov esi, 0x40750c
call fcn.004011a0
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0040377c
add esp, 0x14
ret
push 0xa
push esi
call sub.WSOCK32.dll_listen
cmp eax, 0xffffffff
je 0x401227
mov eax, 0x40750c
call fcn.00402530
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [0x407520], edx
mov edx, dword [esp + 0x10]
mov dword [0x407524], eax
mov eax, 0x40750c
mov dword [0x40751c], esi
mov dword [0x407528], ecx
mov dword [0x40752c], edx
call fcn.00402540
push 0x40753c
push 0
push 0x40750c
push 0x401570
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x407538], eax
test eax, eax
jne 0x4012dd
mov eax, 0x40750c
call fcn.004012f0
xor al, al
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0040377c
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
mov al, 1
call fcn.0040377c
add esp, 0x14
ret