joyce8/EMBER2024-capa huggingface dataset:
Function at 0x876ad8
Capabilities:
Encode data using base64

Disassembly:
inc ecx
test bh, 0xab
test bx, di
cmp edi, 5
jmp 0xbd674e
mov dword [ebp - 0x28], edi
jmp 0xc77854
inc edi
cmp bl, 0x25
jmp 0xbd6955
adc ecx, ecx
rep stosw word es:[edi], ax
or ecx, 0xae2f9f85
shrd eax, esp, 0xa9
setb cl
mov ecx, dword [ebp + 8]
jmp 0xca7a0c
inc cl
neg cl
xor bl, cl
neg byte [esp + 8]
lea ecx, [esp + ecx + 0xc]
mov word [ecx], di
call fcn.00c9400c
stc
clc
sub esi, edi
test bp, ax
mov dword [ebp - 0x44], esi
xadd si, si
xor si, 0x6ebd
mov esi, edi
shl esi, cl
bts ecx, edi
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ebx
cmp bx, si
clc
mov byte [ebp - 1], bl
clc
test si, dx
sub esi, edi
stc
test esp, eax
mov dword [ebp - 0x48], esi
mov esi, dword [eax]
mov dword [ecx], ebx
adc cx, dx
shl cl, 3
mov ecx, dword [ebp + 0x14]
stc
mov dword [ecx], ebx
shl ch, 0xa0
btr cx, sp
mov ecx, dword [eax + 4]
sub eax, ebx
bt eax, 6
lea ecx, [ecx + esi]
cwde
bts eax, esi
mov eax, 0x300
test ebp, eax
cmp edi, edx
shl eax, cl
stc
mov dword [ebp - 0x3c], esi
cmc
mov dword [ebp - 0x14], ebx
test edi, ebx
mov dword [ebp - 0x10], edi
cmp esi, edi
jmp 0xc6366b
je 0x87e2ff
movzx edx, byte [ecx]
shl esi, 8
jmp 0x7c0ccb
cmp ecx, dword [ebp - 0x40]
jmp 0xbb76c2
jl 0xbbb641
mov dword [ebp - 8], ecx
xor cl, dh
lea esp, [esp]
xadd ecx, edx
setae ch
test si, 0xb293
or esi, edx
jmp 0x7b084c
mov dword [ebp - 0x2c], edi
jmp 0xc650c8
add eax, 0x736
jmp 0x7b96e0
je 0x80bd3a
mov ecx, eax
cmp eax, edi
sar ah, 0xbf
mov eax, 0x400
mov edi, edx
sar edx, cl
movzx edx, ax
mov eax, edx
stc
shl edx, 0x10
cmp esp, 0xf2b3a20d
cmc
or eax, edx
stc
clc
shr ecx, 1
rep stosd dword es:[edi], eax
jmp 0x80bd28
mov dword [ebp - 0x24], edi
jmp 0xbf944f
lea eax, [ecx - 1]
clc
stc
mov dword [ebp - 0x40], eax
xor esi, esi
clc
stc
or eax, 0xffffffff
cmp dx, sp
sub edi, edi
jmp 0xbbb641

Function at 0xb85e62
Capabilities:
Encode data using xor

Disassembly:
call fcn.008a61d9
xchg ebx, eax
cmp dh, byte [ecx + edx*2]
daa
xchg edx, eax
insb byte es:[edi], dx
sub ebp, dword gs:[edi]
popal
xor byte [edx], dl
mov ah, 6
xchg ecx, eax
outsd dx, dword [esi]
cli
les esp, [ecx - 0x1b5f0129]
mov eax, dword [0xe4a0fed7]
mov edx, 0xe58fb92b
adc ah, 0x41
dec edx
xchg esp, eax
sbb eax, 0x18f93733
bound edx, qword [ebx + 0x52c8601a]
jae 0xb85ebb
dec edi
sbb eax, dword [ebp + 0x418bd8fe]
add byte [ecx], ch
js 0xb85ea3
jle 0xb85e7a
salc
adc eax, 0xffffbf0d
or ebp, ebx
xchg ebx, eax
wait
push es
neg dword [esi]
xor ecx, dword [edx + 0x7f]
les esi, [ebx - 0x8d6e2e]
cmpsb byte [esi], byte es:[edi]
invalid
sbb byte [0x9b8e9756], ah
cli
cdq
sbb al, 0x3b
dec edx
xchg ecx, eax
mov dh, byte [ebp - 0x7c57d43a]
out dx, al
imul ebx, dword [esi - 0x427bbdeb], 0xa920de6b
xchg ebx, eax
sbb eax, 0xb228be8c
adc eax, 0x15d03613
mov bl, 0x3a
xor al, 0x30
das
std
sub edx, dword [ecx - 0x4c02771a]
invalid

Function at 0xb8cf59
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp], 0x66e138d7
call fcn.00bd8fc9
Function at 0xbb71b5
Capabilities:
Encode data using base64

Disassembly:
mov dx, word [esi + edx - 0x40be7a6c]
jne 0xbb1359
push 0xea131e9a
adc esi, 6
push 0xe9b8babf
mov word ss:[eax], dx
lea esp, [esp + 8]
jmp fcn.007e585a
jge 0x879415
and esi, 0xff
mov dword [esp], 0xf63513a8
mov esi, dword [esi*4 + 0xc69c98]
shr ecx, 8
call fcn.00b82934
mov eax, 0xbab61a98
mov edx, 0x40be7a38
mov eax, dword [esi + edx - 0x40be7a38]
shl dl, 0xe1
jg 0x7803a0
mov ecx, 0xba253d3e
add ecx, ecx
sub ecx, ecx
mov dx, word [ebp + ecx]
adc cx, cx
sub cl, cl
sbb cx, cx
lea ebp, [ebp + ecx + 2]
xor cl, byte [esi + ecx*2]
call fcn.0080c91f
invalid

Function at 0xbbb61c
Capabilities:
Encode data using base64

Disassembly:
and cl, al
mov word [esi], cx
lea esp, [esp + 4]
jmp fcn.00c3d0b8
mov al, byte [esi + 2]
mov dword [esp], 0xff9b3c21
not byte [esp + 2]
add esi, 2
not cl
dec dword [esp]
not al
jle 0xb7edc1
cmp si, dx
cmc

Function at 0xc1b2d4
Capabilities:
Encode data using base64

Disassembly:
adc esi, 4
mov dword [esp], 0xfc349911
xor edx, ebx
ror edx, 1
shr byte [esp + 3], 3
jb 0xb8071c

Function at 0xc1eaed
Capabilities:
Encode data using base64

Disassembly:
xor al, 0x9d
sub al, 0xc
call fcn.00832eb2
mov edx, dword [ebp]
call fcn.007fff37
or byte [esp + 4], 5
jno 0xbe0aef

Function at 0xc50b9c
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
cmp edi, 0x2595aa2c
mov ebp, esp
add edx, ecx
ror edx, cl
jmp 0xc716da
mov edx, dword [ebp + 8]
cmp cx, 0x8bb6
test di, 0xfebb
sub esp, 0x114
push esi
cmp si, bp
test edx, edx
jmp 0x84ae86

Function at 0xc541a2
Capabilities:
Encode data using base64

Disassembly:
push 0xaba725ab
add esi, 2
push 0x218c5505
mov word [esi], cx
call fcn.00c3d501
dec ebx
jne 0xc91aba
mov eax, 0xbb13604
mov eax, dword [ebp + eax - 0xbb13604]
jmp 0xc5418d
jmp 0xc91a8e
not edx
mov dword [ebp], edx
jmp fcn.00c50bd2
call eax
push 0x4fb51b05
mov ebp, dword [ebp - 4]
call fcn.00ca5b0a
call fcn.008a6262
mov edx, 0x512c9e96
mov edx, dword [esi + edx - 0x512c9e96]
mov ecx, 0xb0b10bb
movzx cx, byte [edx + ecx - 0xb0b10bb]
jmp 0x7e1e13
test ecx, ecx
lea esp, [esp + 4]
je 0xc30952
movzx eax, byte [esi]
xor eax, edx
push 0xae0967bd
call fcn.00c30914
push 0x50ac8814
test ebx, ebx
lea esp, [esp + 4]
je 0x865fb8
mov eax, dword [ebp + ebx*4]
push 0xfa82de2f
mov dword [esp], eax
jmp 0x865fb1

Function at 0xc65ed6
Capabilities:
Encode data using base64

Disassembly:
mov dword [ebp], edx
call fcn.00c4cfa5

Function at 0xc6f637
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 0x14]
jno fcn.00bfff60

Function at 0xc7699d
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esi]
mov ecx, 0x7d17fb91
mov cl, byte [ecx + esi - 0x7d17fb8d]
add esi, 2
call fcn.007ded68
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x501711
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esp
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
mov ax, word [esp + 2]
mov dword [0x504b40], eax
xor eax, eax
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x4c], 0x30
call fcn.00501709
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x50134a
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], str.Jungo
mov dword [ebp - 0x20], eax
call fcn.00501706
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
test eax, eax
je 0x5017f5
mov eax, 0x80000000
push edi
push dword [ebp - 0x38]
push edi
push edi
push eax
push eax
push eax
push eax
push 0
push str.180000
push str.Jungo
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push eax
mov dword [0x504b38], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x504b38]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push edi
push edi
push edi
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
je 0x5017f5
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call edi
lea ecx, [ebp - 0x1c]
push ecx
call ebx
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call esi
test eax, eax
jne 0x5017da
mov esp, ebp
pop ebp
ret
Function at 0x408932
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
call fcn.0040895c
push edi
mov edi, dword [esp]
add esp, 4
or ecx, ecx
xor dword [esi], edx
add esi, 1
add edi, edi
sub ecx, 0x34f253e0
cmp esi, ebx
jne fcn.00408932
ret
Function at 0x10005ac4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x102307ec]
jne 0x10005ace
repz ret
jmp fcn.1000743f

Function at 0x100084ff
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100047a6
and dword [ebp - 4], 0
cmp dword [0x10232308], 0
mov ebx, eax
jne 0x100085b0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10008661
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10008661
push eax
call fcn.10004734
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10232308], eax
call esi
push eax
call fcn.10004734
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1023230c], eax
call esi
push eax
call fcn.10004734
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10232310], eax
call esi
push eax
call fcn.10004734
pop ecx
mov dword [0x10232318], eax
test eax, eax
je 0x100085b0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004734
pop ecx
mov dword [0x10232314], eax
mov eax, dword [0x10232314]
cmp eax, ebx
je 0x10008608
cmp dword [0x10232318], ebx
je 0x10008608
push eax
call fcn.100047af
push dword [0x10232318]
mov esi, eax
call fcn.100047af
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10008608
test edi, edi
je 0x10008608
call esi
test eax, eax
je 0x100085ff
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100085ff
test byte [ebp - 0xc], 1
jne 0x10008608
or dword [ebp + 0x10], 0x200000
jmp 0x10008641
mov eax, dword [0x1023230c]
cmp eax, ebx
je 0x10008641
push eax
call fcn.100047af
pop ecx
test eax, eax
je 0x10008641
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10008641
mov eax, dword [0x10232310]
cmp eax, ebx
je 0x10008641
push eax
call fcn.100047af
pop ecx
test eax, eax
je 0x10008641
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10232308]
call fcn.100047af
pop ecx
test eax, eax
je 0x10008661
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10008663
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10009710
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1022faa4], 0
mov byte [0x1022faa8], 0
mov dword [0x1022faa0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1000984f
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x100
mov dword [ebp - 0x28], eax
xor esi, esi
mov dword [ebp - 0x2c], edx
mov edx, esi
mov esi, dword [ebp - 0x10]
div esi
add ecx, 0xfffff6b9
mov dword [0x1022faac], 0
mov edi, dword [0x1022faa4]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1022faac], esi
mov dword [0x1022fa9c], 0x1dfc
mov eax, esi
cdq
mov esi, dword [ebp - 0x2c]
idiv esi
mov dword [0x1022faa4], edx
mov dword [0x1022fa98], ecx
mov ecx, dword [ebp - 0x28]
mov cl, byte [ebx + ecx]
mov byte [0x1022faa8], cl
mov dword [0x1022fa9c], 0xe30
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x28]
mov byte [ebx + edx], cl
mov ecx, dword [0x1022fa9c]
add ecx, 0xfffffd81
mov dword [0x1022fa98], ecx
mov cl, byte [0x1022faa8]
mov edx, dword [0x1022faa4]
mov byte [ebx + edx], cl
mov edx, dword [0x1022faa0]
add edx, 1
mov dword [0x1022faa0], edx
cmp edx, 0x100
mov dword [ebp - 0x30], edx
jl 0x1000983c
jmp 0x10009834
mov eax, 0x1fdd
xor ecx, ecx
mov dword [0x1022faa0], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x10009750
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1022fa98]
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
jmp 0x10009750
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1022fa98], 0x1fdd
mov eax, dword [0x1022faa0]
add eax, 1
mov dword [0x1022faa0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1000984f
jmp 0x10009818
Function at 0x1000a950
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1022fa98], 0x512
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000a9db
xor eax, eax
mov dword [0x1022fa9c], 0x1864
mov dword [ebp - 0x14], eax
jmp 0x1000aa79
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x1000aa33
jmp 0x1000a986
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1000aa4b
jmp 0x1000a986
mov eax, dword [ebp - 0x1c]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], eax
jge 0x1000a9f1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
jne 0x1000a9c4
mov eax, dword [ebp - 0x20]
mov dword [0x1022fa9c], 0x11c4
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x18], eax
jne 0x1000a986
mov dword [0x1022fa9c], 0x2624
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x1000a99a
jmp 0x1000a986
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1000a9af
jmp 0x1000a986
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1000a986
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1000a986
mov eax, dword [ebp - 0x14]
add esp, 0x20
pop ebp
ret
Function at 0x1000ae70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x1022faa0], 0
mov dword [0x1022faa4], 0
mov dword [0x1022fab0], 0
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x1000afd3
xor eax, eax
mov ecx, eax
mov edx, eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1000aecb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, ecx
add edi, 1
mov dword [0x1022fa98], 0x1e8a
add edx, 1
mov dword [ebp - 0x2c], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1022faa0], edx
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x2c]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1022faa4], edx
mov dword [0x1022fa98], 0x40c5
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1022faa8], cl
mov dword [0x1022fa9c], 0x471
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1022faa8]
mov edx, dword [0x1022faa4]
mov byte [ebx + edx], cl
mov edx, dword [0x1022faa0]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1022faa4]
movzx ecx, byte [ebx + ecx]
add ecx, edx
and ecx, 0xff
mov dword [0x1022fab0], ecx
mov dword [0x1022fa98], 0x1cd9
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x1022fa9c], 0xbad
mov dword [0x1022fa98], 0x1439
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x38], edi
je 0x1000afd1
mov eax, dword [0x1022faa4]
mov ecx, dword [0x1022faa0]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], eax
jmp 0x1000aecb
jmp 0x1000afd3
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1000afe0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x88]
lea ecx, [esp + 0x28]
mov dword [0x1022fa98], 0x20bf
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.100098b0
lea ecx, [0x10009610]
mov edx, dword [esp + 0x88]
mov dword [esp + 0x28], edx
mov dword [esp + 0x54], 0x134200
mov edx, dword [0x1022fa84]
mov dword [esp + 0x4c], edx
mov edx, dword [0x1022fa88]
mov dword [esp + 0x5c], edx
mov edx, dword [0x1022fa8c]
mov dword [esp + 0x68], edx
mov edx, dword [0x1022fa90]
mov dword [esp + 0x64], edx
mov edx, dword [0x1022fa94]
mov dword [esp + 0x34], edx
mov dword [0x1022fa98], 0x212d
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1000b074
mov eax, dword [esp + 0x18]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x14], eax
jne 0x1000b09b
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ecx
je 0x1000b0af
mov eax, dword [esp + 0x14]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x1000b074
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x44], ecx
mov dword [0x1022fa9c], 0x1fcc
mov eax, dword [ecx + eax + 0x50]
mov dword [esp + 0x7c], eax
call fcn.1000a950
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x18], ecx
jne 0x1000b06c
lea eax, [esp + 0x28]
mov ecx, dword [esp + 0x90]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.1000a260
mov ecx, esp
lea edx, [esp + 0x28]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x1022fa98], 0x1ed4
mov dword [esp + 0x18], eax
jmp 0x1000b06c
Function at 0x406840
Capabilities:
Connect socket

Disassembly:
inc edx
nop
nop
xchg ebx, eax
mov ecx, 0x28904390
nop
nop
dec esp
nop
push ebp
mov ebp, esp
mov ch, ah
adc byte [edx], al
add byte [eax], al
push ebx
mov ebx, dword [ebp + 8]
push esi
sti
cmp eax, 0xf8830443
dec dword [edi]
test byte [ecx + eax + 0x4b8b0000], dl
adc byte [ebp - 0x767bf037], al
add dword [eax], eax
add byte [ebx + 0x4e8b0ca4], cl
adc al, 0x8d
push esi
sub byte [ecx + 0x52], dl
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x4069b8
jno 0x4068b8
fadd st(1)
inc eax
add bh, bh
salc
test dword [0xff9840f], ecx
add byte [eax], al
call esi
add eax, 0xafc80
add byte [eax + 0xf000b23], 0x85
push esp
add dword [ebp + 0x527b8b00], eax
mov esi, dword [ebx - 0x46]
mov eax, edi
mov bl, 0xc6
jne 0x4068d5
pop edi
pop esi
mov eax, 0x3e23b4
pop ebx
pop ebp
in eax, 0x5d
ret 0x4064
jo 0x406888
invalid
pop edi
pop esi
xor eax, eax
pop ebx
sti
in eax, 0x5d
ret 0x1308
mov esi, dword [eax + edx - 0x77]
jae 0x4069d2
push es
sbb ebp, dword [edx]
add byte [ebp + 7], dh
mov dword [ebx + 0xe], 1
mov ecx, dword [eax + 0x18]
imul edx, dword [esi + edi + 0x2d0499bf], 0xf3d2d300
cmpsb byte [esi], byte es:[edi]
mov edi, 0x2d0499
rcl edx, cl
repe cmpsb byte [esi], byte es:[edi]
jne 0x40698a
pop edi
mov dword [ebx + 0x30], 0x4da0001
push ss
xor eax, eax
cmp cl, byte [ebx + 0x8c278e5]
add byte [eax + 0x975ef], bh
pop edi
sbb byte [ebx - 0x75], 0xe5
pop ebp
ret 0x8e
Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
nop
sub eax, 0x403e10
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4024ca
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x42f180]
xor eax, ebp
mov dword [ebp + 0x90], eax
mov eax, dword [ebp + 0x9c]
mov dword [ebp - 0x78], ecx
lea ecx, [edx + eax - 0x16]
sub eax, dword [ecx + 0x10]
push esi
sub eax, dword [ecx + 0xc]
push edi
mov edi, dword [ebp + 0xa0]
sub eax, 0x22
lea esi, [edx + eax]
xor edx, edx
mov dword [edi], edx
mov dword [ebx], edx
cmp dword [ecx], 0x6054b50
mov dword [ebp - 0x80], edi
jne 0x40260f
cmp dword [esi], 0x1234567b
je 0x402534
push edx
mov edi, str.Invalid_cfgdata_magic_number__see_bdist_wininst.py_
call fcn.00402209
pop ecx
jmp 0x402611
cmp eax, edx
jl 0x40260f
mov ecx, dword [esi + 8]
cmp ecx, edx
je 0x402550
mov edx, esi
sub edx, dword [esi + 4]
sub edx, ecx
mov dword [0x431560], edx
sub eax, dword [esi + 4]
mov ecx, dword [ebp - 0x78]
sub eax, dword [esi + 8]
mov edi, esi
mov dword [ecx], eax
sub edi, dword [esi + 4]
push 0x104
call fcn.00408087
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x40260f
lea eax, [ebp - 0x74]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4025fd
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push 0
push 0x4259a8
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4025fd
xor eax, eax
push eax
push eax
push eax
push dword [esi + 4]
push eax
push dword [ebp - 0x7c]
push 2
call fcn.004010aa
add esp, 0x1c
mov dword [ebp - 0x78], eax
test eax, eax
je 0x40260f
push dword [esi + 4]
push edi
push eax
call fcn.00408be0
mov eax, dword [ebp - 0x78]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4025d1
sub eax, esi
lea eax, [eax + edi + 1]
push eax
call fcn.0041da36
pop ecx
mov ecx, dword [ebp - 0x80]
push dword [ebp - 0x78]
mov dword [ecx], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebx], eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
inc eax
jmp 0x402611
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edi, str.Could_not_create_temporary_file
call fcn.00402209
pop ecx
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop edi
xor ecx, ebp
pop esi
call fcn.00407875
add ebp, 0x94
leave
ret
Function at 0x40108e
Capabilities:
Check if file exists
Create process on windows
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x433c24]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x438130
push 0x67
push edi
call esi
push 0x64
push 0x438068
push 0x6d
push edi
call esi
mov eax, edi
call fcn.00401222
mov eax, dword [ebp + 0x10]
mov edx, 0x438c38
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4010dd
call fcn.00403469
push 0x7d0
mov dword [0x434f90], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401502
test eax, eax
je 0x401116
call fcn.00402d31
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
call fcn.00401e5f
pop ecx
test eax, eax
jne 0x401138
mov ecx, dword [esp + 0x21c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413a49
mov esp, ebp
pop ebp
ret 0x10
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.004160a0
mov ecx, dword [0x438880]
add esp, 0xc
test ecx, ecx
jbe 0x401185
cmp word [0x438884], 0
jbe 0x401185
mov esi, 0x4354d8
call fcn.00403405
mov ax, word [0x438884]
mov word [0x4354e8], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x3e8
xor edx, edx
mov esi, ecx
div esi
xor edx, edx
mov ebx, 0x438e40
div ecx
push edx
push 0x42c7c8
push ebx
call fcn.00402d16
add esp, 0xc
call fcn.004026f9
lea edi, [esp + 0x10]
call fcn.00405816
push 0x42c7e0
mov esi, 0x104
mov eax, edi
push esi
push eax
call fcn.00413c41
add esp, 0xc
push ebx
mov eax, edi
push esi
push eax
call fcn.00413c41
add esp, 0xc
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40120d
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
xor eax, eax
push eax
push 0x42ca0c
mov ecx, edi
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004024a3
jmp 0x40110e