joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100046c0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10032550
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10043054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.1000f3ed
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.1000e594
mov dword [esi + 4], eax
lea ebx, [edi + 4]
mov eax, dword [ebp - 0x10]
lea edx, [edi + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [eax + 0x18]
mov ebx, dword [ebp - 0x10]
add esp, 8
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x10]
mov dword [edi + 0x34], esi
add edi, 0x14
mov dword [ebx], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
lea esi, [eax + 0x24]
mov byte [ebx + 0x48], 0
add eax, 0x28
mov byte [ebx + 0x3d], 0
mov ebx, dword [ebp - 0x14]
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x1c], edi
mov dword [ebx + 0x2c], esi
mov ebx, dword [ebp - 0x14]
mov dword [edx], 0
mov edx, dword [ebp - 0x10]
mov dword [ecx], 0
mov ecx, dword [0x10044f90]
mov dword [eax], 0
mov eax, dword [0x10044f8c]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [esi], 0
mov dword [edx + 0x40], eax
mov eax, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x44], ecx
mov dword [edx + 0x38], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007090
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100327dd
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10043054]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x100070fa
sub eax, 1
jne 0x10007139
mov eax, dword [ebp + 8]
push 0
push 0
push eax
push 0x10007150
push 0
push 0
mov dword [0x10044fb0], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x100070ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0xfffffffffffffffe
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x10007139
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0x80
push ecx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0
call fcn.1000d270
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10007139
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10023725
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10023596

Function at 0x10023b07
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10037100
push 0x100370f8
push str.FlsAlloc
push 0x1e
call fcn.100239d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10023b3b
push dword [ebp + 8]
mov ecx, esi
call dword [0x100331c0]
call esi
jmp 0x10023b41
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10023b85
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10037110
push 0x10037108
push str.FlsGetValue
push 0x20
call fcn.100239d1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10023bbc
push dword [ebp + 8]
mov ecx, esi
call dword [0x100331c0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100242f7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.100104c0
mov eax, dword [0x10043054]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.10021075
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10024339
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10024495
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.100311a0
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x10044b48]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.10025be0
mov ecx, dword [esi*4 + 0x10044b48]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x1002448e
cmp eax, dword [edi + ecx + 0x24]
jne 0x1002448e
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002448e
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10025be0
add esp, 0x14
test edx, edx
jl 0x1002448e
jg 0x10024404
test eax, eax
jb 0x1002448e
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x1002448e
jl 0x1002441e
cmp dword [ebp - 0x1008], eax
ja 0x1002448e
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x1002443c
test ebx, ebx
je 0x10024475
cmp ecx, edi
jae 0x10024475
mov al, byte [ecx]
cmp al, 0xd
jne 0x10024456
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10024462
cmp byte [ecx + 1], 0xa
jne 0x10024462
inc ecx
jmp 0x10024462
movzx eax, al
movsx eax, byte [eax + 0x10043470]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x1002443c
cmp edx, ebx
jne 0x1002443c
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10024493
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1000f3df
leave
ret
Function at 0x10025098
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10044b48]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100250d8
cmp byte [ebx], 0xa
jne 0x100250d8
or byte [eax + edi + 0x28], 4
jmp 0x100250dd
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x100251db
mov al, byte [edx]
cmp al, 0x1a
je 0x100251bd
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x1002510c
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x10025131
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x1002513b
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x100250ee
jmp 0x100251db
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100251b8
cmp dword [ebp - 0xc], 0
je 0x100251b8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x10044b48]
test byte [eax + edi + 0x28], 0x48
je 0x10025192
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1002517d
mov byte [esi], dl
jmp 0x1002518e
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10044b48]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x100251db
cmp byte [ebp - 1], 0xa
jne 0x100251a1
cmp esi, ebx
jne 0x100251a1
mov byte [esi], 0xa
jmp 0x100251da
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10025bfe
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x100251db
mov byte [esi], 0xd
jmp 0x100251da
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x10044b48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100251d7
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100251db
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100251e4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x10044b48]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10025227
cmp word [esi], dx
jne 0x10025227
or byte [edi + eax + 0x28], 4
jmp 0x1002522c
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x10025365
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10025345
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x1002526e
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x100252a4
cmp eax, edx
jae 0x100252b0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x10025246
jmp 0x10025365
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025341
cmp dword [ebp - 0x14], 0
je 0x10025341
mov eax, dword [ebx*4 + 0x10044b48]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10025319
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x1002535f
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x10044b48]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x10044b48]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x10044b48]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x10025362
pop ebx
cmp word [ebp - 4], bx
jne 0x1002532a
cmp esi, dword [ebp + 0xc]
jne 0x1002532a
mov word [esi], bx
jmp 0x10025362
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10025bfe
add esp, 0x10
cmp word [ebp - 4], bx
je 0x10025365
push 0xd
jmp 0x1002535e
mov ecx, dword [ebx*4 + 0x10044b48]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1002535c
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10025365
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x100298f1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1002998e
push ebx
push esi
call fcn.100298ba
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100286c5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002993b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002998d
push edi
push eax
call fcn.10022533
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002995b
call fcn.1002214f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1002998c
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100286c5
add esp, 0x20
test eax, eax
jne 0x1002997a
push edi
call fcn.1002214f
jmp 0x10029982
push ebx
call fcn.1002214f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10030541
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100304bd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100306b9
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100306b9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10030668
jg 0x1003059a
test eax, eax
je 0x1003065e
push 1
push 0x1000
call fcn.100214e6
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100305c0
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x10030655
push 0x8000
push ebx
call fcn.100303ee
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100305ec
jg 0x100305e7
cmp ecx, 0x1000
jb 0x100305ec
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.10021f4f
add esp, 0x10
cmp eax, 0xffffffff
je 0x10030631
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100305e7
jl 0x10030618
test ecx, ecx
jne 0x100305d9
push dword [ebp - 0xc]
push ebx
call fcn.100303ee
push esi
call fcn.1002214f
add esp, 0xc
xor edi, edi
jmp 0x100306ca
cmp byte [edi + 0x24], 0
je 0x10030648
cmp dword [edi + 0x20], 5
jne 0x10030648
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10030653
mov edi, dword [edi + 0x18]
jmp 0x10030655
xor edi, edi
push esi
call fcn.1002214f
pop ecx
jmp 0x100306ca
test ecx, ecx
jg 0x1003062a
jl 0x10030668
test eax, eax
jae 0x1003062a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10025bfe
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1003068b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1003062a
jmp 0x100306c2
push ebx
call fcn.1002c2ed
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1003062a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x100306ca
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x100306c7
mov edi, dword [edi + 0x18]
jmp 0x100306ca
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10025bfe
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x807d19
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
lea eax, [ebp - 0x140]
push 0x100
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x807d7f
mov eax, dword [eax + 0xc]
push esi
lea ecx, [ebp - 0x40]
xor esi, esi
sub ecx, eax
mov edx, dword [eax]
test edx, edx
je 0x807d7a
mov edx, dword [edx]
inc esi
mov dword [ecx + eax], edx
add eax, 4
cmp esi, 0x10
jl 0x807d50
jmp 0x807d7a
mov eax, dword [ebp + esi*4 - 0x44]
dec esi
test eax, eax
je 0x807d7a
push eax
push dword [ebp + 8]
call fcn.00807545
pop ecx
pop ecx
test esi, esi
jg 0x807d66
pop esi
leave
ret

Function at 0x807d81
Capabilities:
Create tcp socket
Create thread
Create udp socket
Start tcp server

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x2c
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
push 0x2c
push 0
push esi
mov dword [0x808244], esi
call sub.MSVCRT.dll_memset
call fcn.008071e7
push esi
mov dword [esi + 0x24], eax
call fcn.00807d19
push esi
call fcn.00807c77
push esi
call fcn.00807400
push esi
call fcn.008074a2
mov edi, dword [sym.imp.WS2_32.dll_htons]
and dword [esi + 4], 0
add esp, 0x20
mov word [esi], 2
push 0x412
call edi
mov ebx, dword [sym.imp.WS2_32.dll_socket]
push 6
push 1
push 2
mov word [esi + 2], ax
call ebx
mov ebp, dword [sym.imp.WS2_32.dll_bind]
jmp 0x807e23
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_closesocket]
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
mov word [esi], 2
and dword [esi + 4], 0
push 0x412
call edi
push 6
push 1
push 2
mov word [esi + 2], ax
call ebx
push 0x10
push esi
push eax
mov dword [esi + 0x10], eax
call ebp
test eax, eax
jne 0x807df3
push bind
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_listen]
mov ebp, dword [sym.imp.KERNEL32.DLL_CreateThread]
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push ebx
push esi
push 0x807b7a
push ebx
push ebx
call ebp
push 0x1c
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
push 0x1c
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0x10
lea eax, [edi + 0x18]
mov dword [edi], esi
mov dword [eax], 0x10
push eax
lea eax, [edi + 8]
push eax
push dword [esi + 0x10]
call dword [sym.imp.WS2_32.dll_accept]
cmp eax, ebx
mov dword [edi + 4], eax
jg 0x807e9e
push 0x32
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x807e56
lea eax, [esp + 0x10]
push eax
push ebx
push edi
push 0x80783e
jmp 0x807e52

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..reloc
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x68e07241
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x78a773b0
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401e50
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
lea ecx, [esp + 0x14]
mov edx, dword [esp + 0x5c]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push edx
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x402000
Capabilities:
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov eax, dword [esp + 8]
ret 8

Function at 0x402030
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
ret 8

Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e072
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x7e466c37
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x6ae54722
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x7fb163
Capabilities:
Encode data using xor

Disassembly:
pop word [esp]
neg cx
jmp 0x7fb185

Function at 0x7fb29f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf07e8088
jmp 0x7fb358
push dword [esp + 0x19]
jmp 0x7fb2be
pushal
pop dword [esp + 9]
push word [esp + 0x18]
jb 0x7fb271
push dword [esp + 0x19]
jmp 0x7fb2a8
lea esp, [esp + 3]
mov dword [esp], ebx
jmp 0x7fb287
lea esp, [esp + 2]
mov dword [esp + 0x1c], esp
pushal
jmp 0x7fb2d1
lea esp, [esp + 2]
mov dword [esp + 0x1c], esp
pushal
push dword [esp + 0x12]
jmp 0x7fb313
push dword [esp + 0x12]
jmp 0x7fb313
lea esp, [esp + 6]
call fcn.007fb2d7
pushfd
jmp 0x7fa7a9
mov edi, dword [esp + 0x2c]
setns bh
mov cl, 0x3d
seto bl
jmp 0x7fb384
rdtsc
lea ebp, reloc.oleaut32.dll_SysFreeString
bswap eax
jmp 0x7fb33c
jmp 0x7fb39f
mov ebp, esp
xor dx, dx
jns 0x7fbba2
lea eax, reloc.oleaut32.dll_SysFreeString
rdtsc
bsf ax, dx
jmp 0x7fbb79
lea esi, [esp]
lea ebp, [ebx + ebp]
lea eax, reloc.oleaut32.dll_SysFreeString
btr ebp, esi
jb 0x7fb364
and ch, 0xcb
jmp 0x7fb3a2
and ch, 0xcb
sub esp, 0xc0
jmp 0x7fb366
rdtsc
bsf ax, dx
lea eax, reloc.oleaut32.dll_SysFreeString
jmp 0x7fbb73

Function at 0x7fb2fd
Capabilities:
Execute anti-debugging instructions

Disassembly:
je 0x7fb2ee
adc ch, bl
inc esi
mov esi, 0xff4b2889
je 0x7fb2f8
adc ch, bl
cmp al, 0x8d
lea esp, [esp + 2]
mov dword [esp + 0x38], ebp
call fcn.007fb2fd
stc
pushal
not byte [ecx - 0x62fe20a0]
fild word [ecx]
popfd
or eax, 0x6c13a754
jg 0x7fb339
cmpsd dword [esi], dword es:[edi]
adc ebp, dword [edi + edi*2 + 0x46]
int1
and al, 4
mov dword [esp + 0x38], esi
call fcn.007fb332
in eax, dx
jb 0x7fb2e9
xchg dword [edx - 0x50], esi
in eax, dx
ja 0x7fb2f6
xor byte [ecx - 0x47], 0xea
cmp bl, ch
loopne 0x7fb2c8
jl 0x7fb363
sub al, 0xf
cdq
invalid
fsubr st(3)
cmp dword [ebx - reloc.oleaut32.dll_SysFreeString], ecx

Function at 0x7fb332
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x38], edi
lea esp, [esp + 0x38]
jmp 0x7fb31c

Function at 0x7fc3b5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dh, byte [esp]
mov dl, ah
mov ax, 0x7564
pushal