joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8000]
push edi
or ebp, 0xffffffff
jmp 0x40c7a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40c7a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40c798
mov eax, 1
add ebx, ebx
jne 0x40c7bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40c7b0
jne 0x40c7cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c7b0
xor ecx, ecx
sub eax, 3
jb 0x40c7e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40c852
mov ebp, eax
add ebx, ebx
jne 0x40c7eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40c7f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40c81c
inc ecx
add ebx, ebx
jne 0x40c808
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40c7fd
jne 0x40c819
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40c7fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40c83c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40c82d
jmp 0x40c79e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40c83c
add edi, ecx
jmp 0x40c79e
pop esi
mov edi, esi
mov ecx, 0xf3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40c85a
cmp byte [edi], 6
jne 0x40c85a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40c85f
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x40c8ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40c88c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc02c]
or eax, eax
je 0x40c8c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40c8a9
call dword [esi + 0xc030]
popal
jmp 0x40140c
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x408a60
pop dword [ebp - 0xc]
mov eax, 0xd73e86e
sub eax, 0xd335e0e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xf2587227
add dword [ebp - 0x1c], 0x5bf9d324
mov dword [ebp - 0x18], 0xd65c8cda
add dword [ebp - 0x18], 0x5bd6bf6b
mov dword [ebp - 0x14], 0xb1e701c8
sub dword [ebp - 0x14], 0x659abd9a
mov dword [ebp - 0x10], 0x82358025
sub dword [ebp - 0x10], 0x82358025
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5718fc97
sub dword [ebp - 0x1c], 0xe2a69341
mov dword [ebp - 0x18], 0x1ed4bd02
sub dword [ebp - 0x18], 0xdd685b8d
mov dword [ebp - 0x14], 0x83336217
sub dword [ebp - 0x14], 0x1fc3f5ab
mov dword [ebp - 0x10], 0x1b8bbc0b
add dword [ebp - 0x10], 0xe47443f5
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3c497
push 0
call eax
mov ecx, 0x79fd5010
add ecx, 0x86030307
mov edi, eax
mov ebx, 0xdffaf66e
sub ebx, 0xdfb9466e
add ebx, dword [ebp - 0xc]
mov esi, 0x5863dca6
add dword [ebp - 4], 0x50354a40
mov edx, dword [ebx]
xor dword [ebp - 4], 0x661ae9c9
sub edx, esi
xor dword [ebp - 8], eax
mov dword [edi], edx
sub dword [ebp - 4], esi
add edi, 0x7299eebc
add edi, 0x8d661148
add ebx, 0x6b3db778
add ebx, 0x94c2488c
loop 0x408b72
add eax, 0x9f7dcefe
sub eax, 0x9f7c8fcf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xe0414790
sub ecx, 0xe0014790
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x6fc420a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x6fc420f8
cmp byte [esi + ebx - 1], 0xa
je 0x6fc420cc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x6fc47084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x6fc42750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xfc
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call sym.___wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x6fc42928
mov edi, dword [0x6fc47084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], edi
je 0x6fc42837
test byte [0x6fc43030], 8
jne 0x6fc428d0
lea ebx, [ebp - 0xe0]
mov edi, ebx
test byte [0x6fc43040], 8
jne 0x6fc42890
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x6fc427d9
cmp esi, 3
jbe 0x6fc42848
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x6fc427ea
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xfc
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x6fc45a68]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x6fc427d9
mov dword [esp], 0x6fc43040
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x6fc427b0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call sym._sprintf
add edi, eax
jmp 0x6fc427b0
mov dword [esp], 0x6fc43030
call sym.___wine_dbg_get_channel_flags
test al, 8
je 0x6fc4279b
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xe0]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea edi, [ebx + eax]
jmp 0x6fc427a3
mov eax, 0xffffffff
jmp 0x6fc42837
Function at 0x401940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x405080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x88]
push 0
push ecx
push dword [ebp + 0xc]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2010
push 0
push 0
push 0xa
push dword [ebp + 0x10]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00402b70
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 2
push 0x404158
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401160
mov esp, ebp
pop ebp
ret

Function at 0x401a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x405080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2080
push 8
push 8
push 0x10
push eax
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00402b70
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401160
mov esp, ebp
pop ebp
ret

Function at 0x401a90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x405080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esi + 0x1000]
cmp eax, 0x2000
jb 0x401ad4
xor eax, eax
cmp byte [esi], al
je 0x401ac7
lea ebx, [ebx]
inc eax
cmp byte [esi + eax], 0
jne 0x401ac0
push 0
lea ecx, [ebp - 0x88]
push ecx
push eax
push esi
jmp 0x401b43
push 0
lea eax, [ebp - 0x88]
push eax
push 0xb
push str._pszString
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x2080
push 8
push 8
push 0x10
push esi
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00402b70
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x88]
push eax
push 1
push 0x404168
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401160
mov esp, ebp
pop ebp
ret
Function at 0x401b70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x405080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x2000
push 0
push 0
push 0xa
push dword [ebp + 8]
lea eax, [ebp - 0xac]
push 0xa8
push eax
call fcn.00402b70
push 0x2008
push 0
push 0
mov word [ebp + eax - 0xac], 0x2820
lea esi, [eax + 2]
push 0x10
push dword [ebp + 8]
mov eax, 0xa8
sub eax, esi
push eax
lea eax, [ebp - 0xac]
add eax, esi
push eax
call fcn.00402b70
add esp, 0x38
lea ecx, [ebp - 0xb0]
add eax, esi
push 0
mov byte [ebp + eax - 0xac], 0x29
inc eax
push ecx
push eax
lea eax, [ebp - 0xac]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00401160
mov esp, ebp
pop ebp
ret

Function at 0x401c20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x405080]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x2008
push 0
push 0
push 0x10
push dword [ebp + 8]
lea eax, [ebp - 0x84]
push 0x80
push eax
call fcn.00402b70
add esp, 0x1c
lea ecx, [ebp - 0x88]
push 0
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401160
mov esp, ebp
pop ebp
ret

Function at 0x402580
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [0x4055d0]
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x4025ad
push 0x17
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
je 0x4025ad
mov ecx, edi
int 0x29
mov esi, dword [0x4055c4]
test esi, esi
je 0x4025c6
mov ecx, esi
call dword [section..rdata]
call esi
test eax, eax
je 0x4025c6
int3
mov esi, dword [0x4055c8]
test esi, esi
je 0x402640
cmp dword [0x4055cc], 0
je 0x402640
push 0
mov ecx, esi
call dword [section..rdata]
call esi
mov eax, dword [ebx + 0xb8]
push 0x38
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x38]
push 0
push eax
mov dword [ebp - 0x50], 0xc0000409
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], edi
call sym.tstVBoxGINA.exe_nocrt_memset
mov esi, dword [0x4055cc]
lea eax, [ebp - 0x50]
add esp, 0xc
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], ebx
mov ecx, esi
push eax
call dword [section..rdata]
call esi
lea ebx, [ebx]
push 0xc0000409
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x402640
Function at 0x4027e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 3
jne 0x4028f3
shr eax, 8
cmp al, 0x32
jae 0x4028f3
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402813
mov eax, dword [ecx + 0x3c]
add eax, ecx
jmp 0x402815
mov eax, ecx
cmp dword [eax], 0x4550
jne 0x4028f7
push esi
movzx esi, word [eax + 0x14]
add esi, eax
movzx eax, word [eax + 6]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4028f2
push ebx
add esi, 0x20
push edi
lea esp, [esp]
mov ebx, dword [esi]
mov eax, dword [esi + 8]
cmp ebx, eax
jbe 0x4028e3
mov edi, dword [esi + 4]
sub ebx, eax
add edi, eax
add edi, ecx
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jns 0x40286b
push ebx
push 0
push edi
call sym.tstVBoxGINA.exe_nocrt_memset
add esp, 0xc
jmp 0x4028e0
mov eax, edi
and ecx, 0x20000000
and eax, 0xfffff000
mov dword [ebp - 0xc], eax
mov eax, edi
and eax, 0xfff
add eax, 0xfff
add eax, ebx
and eax, 0xfffff000
neg ecx
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
sbb ecx, ecx
push eax
and ecx, 0x3c
lea eax, [ebp - 8]
add ecx, 4
push ecx
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], ecx
push eax
push 0xffffffffffffffff
mov dword [ebp - 4], ecx
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
test eax, eax
js 0x4028df
push ebx
push 0
push edi
call sym.tstVBoxGINA.exe_nocrt_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtProtectVirtualMemory]
jmp 0x4028e0
int3
mov ecx, dword [ebp + 8]
add esi, 0x28
sub dword [ebp - 0x10], 1
jne 0x402840
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
int3
Function at 0x4014a9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x250
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x21c], 6
push ebx
push ebx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push esi
push esi
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x220], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push edx
push edx
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x238]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push ecx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push ebx
lea ebx, [ebp - 0x210]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push esi
push esi
mov dword [esp + 4], ebx
mov dword [esp], 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push eax
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileW]
sub esp, 0x1c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 8]
lea eax, [ebx - 3]
pop ebx
pop esi
pop ebp
ret

Function at 0x401692
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
jmp loc.00463000

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x433004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401669
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x244
mov dword [ebp - 0xc], 0x43304a
mov dword [ebp - 0x10], 0x50
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00401571
movzx eax, ax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00423450
mov ebx, eax
mov eax, dword [ebp + 8]
mov ecx, eax
call fcn.00423470
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_gethostname]
call eax
sub esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4016f3
mov dword [esp], 4
call fcn.0042e920
mov dword [eax], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x436e70
mov dword [esp], eax
call fcn.0042eca0
mov eax, dword [ebp - 0x10]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [ebp - 0x22a], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x228], eax
mov word [ebp - 0x22c], 2
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x401756
mov dword [esp], 4
call fcn.0042e920
mov dword [eax], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0x436e70
mov dword [esp], eax
call fcn.0042eca0
mov dword [ebp - 0x20], 0x2710
mov dword [ebp - 0x24], 0x80000
mov dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0xffffffff
jne 0x40179b
mov dword [esp], 4
call fcn.0042e920
mov dword [eax], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x436e70
mov dword [esp], eax
call fcn.0042eca0
nop
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40d030
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.00418500
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.00418500
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x40d090
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x44a068]
test esi, esi
jle 0x40d1b0
mov eax, dword [0x44a06c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x40d0c4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x40d147
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x40d0b0
mov dword [esp], ebx
call fcn.0040da90
mov edi, eax
test eax, eax
je 0x40d1d7
mov eax, dword [0x44a06c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.0040dbd0
mov edx, dword [0x44a06c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x40d1b7
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x40d140
lea edx, [eax - 0x40]
and edx, 0xffffffbf
jne 0x40d150
add dword [0x44a068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x44a06c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x40d140
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.0040d030
lea esi, cs:[esi]
nop
xor esi, esi
jmp 0x40d0ce
mov eax, dword [0x44a06c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.0040d030
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.0040d030
lea esi, cs:[esi]
nop
Function at 0x40d700
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x44a084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x44a07c]
sub esp, 4
test ebx, ebx
je 0x40d755
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
mov esi, eax
sub esp, 4
call edi
test esi, esi
je 0x40d74e
test eax, eax
jne 0x40d74e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x40d730
mov dword [esp], 0x44a084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40da90
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x40dab5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x40dac0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x40dab5
push esi
push ebx
mov ebx, dword [esp + 0xc]
movzx eax, word [ecx + 0x400014]
movzx esi, word [ecx + 0x400006]
sub ebx, 0x400000
lea eax, [edx + eax + 0x18]
test si, si
je 0x40db08
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40dafe
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40db0a
add ecx, 1
add eax, 0x28
cmp esi, ecx
jne 0x40daf0
xor eax, eax
pop ebx
pop esi
ret