joyce8/EMBER2024-capa huggingface dataset:
Function at 0x788fbf4c
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x7891e1e4]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x41c], ecx
jne 0x788fbf83
xor eax, eax
jmp 0x788fc136
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x78928600]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x788fbfb8
push 2
push ecx
push ecx
push dword [ebp + 8]
call fcn.788fd023
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x788fc086
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x40c], ecx
jbe 0x788fc104
jmp 0x788fbfdf
xor ecx, ecx
mov dword [ebp - 0x410], ecx
mov ecx, dword [ebp - 0x414]
sub ecx, dword [ebp - 0x420]
lea eax, [ebp - 0x408]
cmp ecx, dword [ebp + 0x10]
jae 0x788fc035
mov edx, dword [ebp - 0x414]
inc dword [ebp - 0x414]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x788fc020
inc dword [ebp - 0x41c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x410]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x410]
cmp dword [ebp - 0x410], 0x400
jl 0x788fbff7
mov edi, eax
lea eax, [ebp - 0x408]
sub edi, eax
push 0
lea eax, [ebp - 0x424]
push eax
push edi
lea eax, [ebp - 0x408]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x788fc0b3
mov eax, dword [ebp - 0x424]
add dword [ebp - 0x418], eax
cmp eax, edi
jl 0x788fc0bf
mov eax, dword [ebp - 0x414]
sub eax, dword [ebp - 0x420]
cmp eax, dword [ebp + 0x10]
jb 0x788fbfdd
jmp 0x788fc0bf
push ecx
lea ecx, [ebp - 0x424]
push ecx
push dword [ebp + 0x10]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x788fc0b3
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x40c], 0
mov dword [ebp - 0x418], eax
jmp 0x788fc0bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x788fc12e
cmp dword [ebp - 0x40c], eax
je 0x788fc0fe
push 5
pop esi
cmp dword [ebp - 0x40c], esi
jne 0x788fc0f0
call fcn.788fbd7f
mov dword [eax], 9
call fcn.788fbd92
mov dword [eax], esi
jmp 0x788fc129
push dword [ebp - 0x40c]
call fcn.788fbda5
pop ecx
jmp 0x788fc129
mov edi, dword [ebp - 0x420]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x788fc116
cmp byte [edi], 0x1a
jne 0x788fc116
xor eax, eax
jmp 0x788fc134
call fcn.788fbd7f
mov dword [eax], 0x1c
call fcn.788fbd92
and dword [eax], 0
or eax, 0xffffffff
jmp 0x788fc134
sub eax, dword [ebp - 0x41c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.78809964
leave
ret
Function at 0x7890219c
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
pop edi
je 0x789021db
mov eax, dword [ebp - 0x30]
jmp 0x789021de
or eax, 0xffffffff
leave
ret 4

Function at 0x78902249
Capabilities:
Parse url

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3c
push edi
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], 1
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
pop edi
je 0x7890228a
cmp dword [ebp - 0x34], 0
je 0x7890228a
xor al, al
jmp 0x78902298
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
setne al
leave
ret 4

Function at 0x789030db
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, dword [ebp + 0xc]
xor eax, eax
cmp edi, eax
mov dword [ebp - 0xc], eax
jne 0x789030fa
mov eax, 0x80070057
jmp 0x789031d4
push ebx
mov ebx, dword [ebp + 8]
cmp ebx, eax
je 0x78903109
cmp dword [edi], eax
jbe 0x78903109
mov word [ebx], ax
push esi
lea ecx, [ebp - 8]
push ecx
push 1
push eax
push 0x78903208
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x789031ac
mov eax, dword [edi]
lea ebx, [eax + eax]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push esi
push 0x789031e8
push dword [ebp - 8]
mov dword [ebp + 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
xor edx, edx
cmp esi, edx
jne 0x78903190
mov eax, dword [ebp + 0xc]
xor ecx, ecx
shr eax, 1
dec eax
inc ecx
cmp dword [ebp - 0x10], ecx
mov dword [edi], eax
jne 0x78903190
mov eax, dword [ebp + 8]
cmp eax, edx
je 0x789031a1
cmp word [eax], dx
jne 0x78903179
mov dword [ebp - 0xc], ecx
jmp 0x789031a1
cmp dword [ebp - 4], edx
jbe 0x789031a1
push dword [ebp - 4]
mov word [ebx + eax - 2], dx
push eax
call fcn.7880fbc0
mov dword [edi], eax
jmp 0x789031a1
push edi
push dword [ebp + 8]
call fcn.78903066
mov esi, eax
and esi, 0xffff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x789031dc
cmp esi, 3
jne 0x789031d9
push edi
push ebx
call fcn.78903066
mov esi, eax
and esi, 0xffff
test esi, esi
jle 0x789031d0
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
pop esi
pop ebx
pop edi
leave
ret 8
and dword [edi], 0
cmp dword [ebp - 0xc], 0
je 0x789031c0
xor eax, eax
inc eax
jmp 0x789031d2
Function at 0x7890672f
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x7891e1e4]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
push edi
push 0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
mov edi, ecx
push 2
push dword [edi + 0x5c]
mov dword [ebp - 0x28], 0x20
call esi
test eax, eax
je 0x78906781
push 0x789067ac
lea eax, [ebp - 0x24]
push eax
call fcn.7883c7e8
test eax, eax
je 0x78906781
xor eax, eax
jmp 0x7890679b
push 0
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
push 0x20000005
push dword [edi + 0x5c]
mov dword [ebp - 0x28], 4
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.78809964
leave
ret 4
Function at 0x789067dd
Capabilities:
Initialize winhttp library
Prepare http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x5c]
xor ebx, ebx
cmp eax, ebx
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov dword [ebp - 4], ebx
je 0x78906802
push eax
call edi
mov dword [esi + 0x5c], ebx
mov eax, dword [esi + 0x58]
cmp eax, ebx
je 0x7890680f
push eax
call edi
mov dword [esi + 0x58], ebx
cmp dword [esi + 0x54], ebx
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
jne 0x7890686c
xor edi, edi
push edi
push edi
push edi
push edi
push 0x78906988
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
cmp eax, edi
mov dword [esi + 0x54], eax
je 0x7890694e
push 4
lea ecx, [ebp - 8]
push ecx
push 0x44
push eax
mov dword [ebp - 8], 0xfde9
call ebx
test eax, eax
je 0x7890694e
push 4
lea eax, [ebp - 0xc]
push eax
push 0x54
push dword [esi + 0x54]
mov dword [ebp - 0xc], 0x28
call ebx
test eax, eax
je 0x7890694e
push 0xf
pop ecx
xor eax, eax
lea edi, [ebp - 0x50]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x50]
push eax
push 0
push 0
push dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
je 0x7890694e
cmp dword [ebp - 0x44], edi
je 0x789068b7
cmp dword [ebp - 0x44], 2
je 0x789068b7
mov edi, 0xc00c0241
jmp 0x7890696a
cmp dword [ebp - 0x20], 0
jne 0x789068c7
mov dword [ebp - 0x24], 0x7885fe60
mov dword [ebp - 0x20], edi
push dword [ebp - 0x3c]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x40]
call fcn.788b3548
mov edi, eax
test edi, edi
jl 0x7890696a
push 0
push dword [ebp - 0x38]
push dword [ebp - 4]
push dword [esi + 0x54]
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
test eax, eax
mov dword [esi + 0x58], eax
je 0x7890694e
cmp dword [ebp - 0x44], 2
mov ecx, 0x80
jne 0x78906908
mov ecx, 0x800080
push ecx
xor edi, edi
push edi
push edi
push edi
push dword [ebp - 0x24]
push 0x788ae51c
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
cmp eax, edi
mov dword [esi + 0x5c], eax
je 0x7890694e
push 4
lea ecx, [ebp - 0x10]
push ecx
push 0x3f
push eax
mov dword [ebp - 0x10], 2
call ebx
test eax, eax
je 0x7890694e
and dword [ebp - 0x14], edi
push 4
lea eax, [ebp - 0x14]
push eax
push 0x4d
push dword [esi + 0x5c]
call ebx
test eax, eax
jne 0x78906968
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x7890695c
mov edi, eax
jmp 0x7890696a
and eax, 0xffff
or eax, 0x80070000
jmp 0x78906958
xor edi, edi
cmp dword [ebp - 4], 0
je 0x78906978
push dword [ebp - 4]
call fcn.7880992e
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x789069f0
Capabilities:
Read http header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
xor eax, eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ecx], eax
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
mov esi, 0xffff
push esi
push dword [ebx + 0x5c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
call edi
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x78906a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x78906a6a
cmp dword [ebp - 4], 0
jne 0x78906a70
mov eax, dword [ebp - 8]
shr eax, 1
shl eax, 1
push eax
call fcn.78809af7
test eax, eax
mov dword [ebp - 4], eax
je 0x78906a7f
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push esi
push dword [ebx + 0x5c]
call edi
test eax, eax
mov dword [ebp - 0x10], eax
je 0x78906a2e
cmp dword [ebp - 0x10], 0
jne 0x78906a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x78906a88
mov dword [ebp - 0xc], eax
jmp 0x78906aac
mov dword [ebp - 0xc], 0x8007000e
jmp 0x78906aac
and eax, esi
or eax, 0x80070000
jmp 0x78906a7a
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x78906aa0
mov ecx, dword [ebp - 8]
shr ecx, 1
dec ecx
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 4], 0
mov dword [ecx], eax
cmp dword [ebp - 4], 0
pop edi
pop esi
pop ebx
je 0x78906abd
push dword [ebp - 4]
call fcn.7880992e
mov eax, dword [ebp - 0xc]
leave
ret 0xc
Function at 0x78906be0
Capabilities:
Receive http response

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
call fcn.7881ce37
mov esi, eax
cmp esi, edi
jl 0x78906cd6
lea eax, [ebp - 8]
push eax
mov ecx, ebx
call fcn.7890672f
test eax, eax
jne 0x78906c21
or dword [ebp - 8], 0xffffffff
cmp dword [ebp - 8], edi
je 0x78906cc1
lea eax, [ebp - 0x10]
push eax
push dword [ebx + 0x5c]
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
jmp 0x78906c98
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x10]
call fcn.78901a92
mov esi, eax
cmp esi, edi
jl 0x78906cd6
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [eax + 0x5c]
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x78906ca7
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
add dword [eax + 0x20], ecx
add dword [eax + 0x14], ecx
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
cmp eax, edi
je 0x78906cc1
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 8]
jae 0x78906cc1
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x1c]
push dword [eax + 0x5c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x10], edi
call ebx
test eax, eax
jne 0x78906c39
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jg 0x78906cb5
mov esi, eax
jmp 0x78906cd6
and eax, 0xffff
or eax, 0x80070000
jmp 0x78906cb1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push edi
push edi
xor ecx, ecx
push ecx
push edi
push eax
call dword [edx + 0x14]
mov esi, eax
cmp esi, edi
jge 0x78906ce2
push edi
lea eax, [ebp - 4]
push eax
call fcn.78801470
jmp 0x78906ce4
xor esi, esi
mov ecx, dword [ebp - 0x1c]
push dword [ebp - 4]
add ecx, 0x20
call fcn.7880d26c
push edi
lea eax, [ebp - 4]
push eax
call fcn.78801470
lea eax, [ebp - 4]
push eax
call fcn.78809cc4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x7890d7b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push dword [ebp + 0x10]
xor ebx, ebx
mov byte [ebp - 4], bl
call fcn.788bd6d4
mov esi, eax
cmp esi, ebx
je 0x7890d88c
push dword [0x78918190]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
lea ecx, [ebp - 8]
call fcn.78812c51
cmp dword [ebp + 8], ebx
je 0x7890d86b
mov edi, dword [0x7892d420]
cmp edi, ebx
jne 0x7890d836
push 1
lea ecx, [ebp - 0x14]
call fcn.7880fb12
push ebx
push ebx
push ebx
push dword [0x7892c308]
push 0x788aec44
call fcn.7884aef6
push eax
call fcn.788b18df
mov edi, eax
push edi
mov ecx, 0x7892d420
call fcn.78882665
lea ecx, [ebp - 0x14]
call fcn.7880cf41
mov eax, dword [esi + 4]
shr eax, 2
not eax
and eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.7880fb12
push 1
push ebx
push ebx
push edi
push ebx
mov ecx, esi
call fcn.7883824e
mov edi, eax
push edi
mov ecx, esi
call fcn.788b8917
lea ecx, [ebp - 0x20]
call fcn.7880cf41
jmp 0x7890d8b3
mov eax, dword [esi + 4]
shr eax, 2
not eax
and eax, 1
push eax
lea ecx, [ebp - 0x20]
call fcn.7880fb12
push ebx
mov ecx, esi
call fcn.788b8917
mov edi, dword [esi + 0x78]
jmp 0x7890d861
push dword [ebp + 0x10]
call fcn.7881c6ae
mov edi, eax
cmp edi, ebx
je 0x7890d917
push dword [0x78918190]
mov esi, dword [edi + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
push eax
lea ecx, [ebp - 8]
call fcn.78812c51
lea ecx, [ebp - 8]
call fcn.78812cb2
mov eax, dword [esi + 4]
shr eax, 2
not eax
and eax, 1
push eax
lea ecx, [ebp - 0x2c]
call fcn.7880fb12
mov eax, dword [ebp + 8]
cmp eax, ebx
je 0x7890d8f9
mov eax, dword [eax + 0xc]
cmp eax, ebx
mov dword [ebp + 0x10], eax
jle 0x7890d903
mov ecx, dword [ebp + 8]
push ebx
call fcn.7881c2b3
push edi
push esi
push eax
call fcn.7890d66c
inc ebx
cmp ebx, dword [ebp + 0x10]
jl 0x7890d8e0
jmp 0x7890d903
push edi
push esi
push dword [ebp + 0xc]
call fcn.7890d66c
lea ecx, [ebp - 8]
call fcn.78812174
lea ecx, [ebp - 0x2c]
call fcn.7880cf41
xor eax, eax
jmp 0x7890d91a
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x78914aa1
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0x18
push 0x78914b90
call fcn.78801330
xor esi, esi
mov dword [ebp - 0x24], esi
cmp byte [0x7892ccc8], 0
je 0x78914b35
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push dword [ebp + 0xc]
push 5
push esi
push esi
push esi
cmp byte [ebp + 0x10], 0
je 0x78914adf
push 0x78914b78
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
jmp 0x78914aec
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
mov dword [ebp - 0x20], eax
cmp eax, esi
jne 0x78914b0d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x28], eax
cmp eax, esi
jle 0x78914b0a
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x24], eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x1c], esi
je 0x78914b6b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x78914b6b
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edx, dword [ebp + 0xc]
mov dword [edx + 4], eax
cmp eax, esi
jne 0x78914b52
mov eax, 0x8007000e
jmp 0x78914b6e
mov ecx, dword [ebx]
mov esi, dword [ebx + 4]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx]
mov dword [edx], eax
mov eax, dword [ebp - 0x24]
call fcn.78801370
ret 0xc
Function at 0x484180
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4e000]
mov dword [edi + 0x70d18], 0x2eeb9eeb
push edi
jmp 0x4841aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4841b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4841a0
mov eax, 1
add ebx, ebx
jne 0x4841c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4841d4
jne 0x4841f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4841f3
dec eax
add ebx, ebx
jne 0x4841e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4841b8
add ebx, ebx
jne 0x4841ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x484245
xor ecx, ecx
sub eax, 3
jb 0x48420b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48427a
sar eax, 1
mov ebp, eax
jmp 0x484216
add ebx, ebx
jne 0x484216
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4841e4
inc ecx
add ebx, ebx
jne 0x484224
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4841e4
add ebx, ebx
jne 0x484231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x484226
jne 0x484242
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x484226
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x484264
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x484256
jmp 0x4841a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x484264
add edi, ecx
jmp 0x4841a6
pop esi
mov edi, esi
mov ecx, 0x321f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x484282
cmp byte [edi], 0x16
jne 0x484282
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x484287
lea edi, [esi + 0x81000]
mov eax, dword [edi]
or eax, eax
je 0x4842ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x88620]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8873c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4842b4
mov ecx, edi
jns 0x4842e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x88744]
or eax, eax
je 0x4842f9
mov dword [ebx], eax
add ebx, 4
jmp 0x4842d1
call dword [esi + 0x88740]
mov ebp, dword [esi + 0x88748]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x484333
sub esp, 0xffffff80
jmp 0x4349ef
Function at 0x404a65
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx + 0xcec83df], ecx
or dword [ebp + 0xc], eax
push ebx
push esi
xor eax, 0x8307508d
loop 0x404a6a
cmp edx, eax
ljmp 0x73f8

Function at 0x408db0
Capabilities:
Set socket configuration

Disassembly:
rol al, cl
pop edi
pop esi
pop ebx
pop ebp
call 0x90d08dba
pop ds
nop
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
xor eax, dword [ebx]
test dword [ebp + 0xf], esp
xchg ebp, eax
ror dword [ecx + 0x4d60fc4d], 0xc
cmp ecx, 0x40
push esi
jg 0x409303
je 0x408fdb
dec ecx
cmp ecx, 0x1f
invalid
dec ebp
push ebp
or byte [esi + 0x4d], dh
jb 0x40904c
add al, 0x51
mov ebp, dword [esi + 0x1001a004]
or edx, ebp
push 0x5aff
push eax
inc dword [esi + sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0x3c
movzx esi, byte [eax]
invalid
jb 0x40909c
add al, 0x8d
inc ebp
push esi
push 4
sub byte [edx + 1], ch
push 6
push ecx
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x409086
mov eax, dword [ebx - 0x6e093e12]
call [eax]
test eax, eax
jne 0x409078
pop esi
mov esp, ebp
pop ebp
stosd dword es:[edi], eax
sub byte [eax], al
call esi
add eax, 0xafc80
pop esi
xchg ecx, eax
in eax, 0x5d
ret 0xb3
leave
retf
ret 0xc
adc byte [ebp - 0x5bf58be1], al
pop esi
mov eax, 0x9226
pop ebx
pop ebp
ret

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
in eax, dx
cmc
pop ss
or byte [edx - 0x3f7ba1ba], cl
setb byte [esi - 0x74aca500]
dec esi
dec eax
xor eax, eax
push ebx
cmp ecx, 1
push edi
mov dword [ebp - 4], eax
mov dword [eax + ecx - 0x62], ebp
sbb dword [eax + eax + 0x7e8b0000], 0x19f8d73c
test byte [ecx - 0x75000000], dl
pop esi
cmp byte [ebx + 0x576ffff], al
or eax, 0xffffffff
jg 0x40b313
mov eax, edi
mov eax, ecx
add al, 0x8d
dec ebp
cld
push 0
push ecx
push eax
jno 0x40b371
call dword [sym.imp.KERNEL32.dll_WriteFile]
test esi, ecx
push ss
das
mov eax, dword [ebp - 4]
mov ebp, edi
push eax
mov ecx, dword [esi + 0x54]
add edi, esi
adc dword [ebp], 0x2b
clc
add ebx, eax
mov dword [esi + 0x50], edx
test edi, eax
sahf
dec esi
push esp
ja 0x40b375
jnp 0x40b38c
or byte [edi - 0x39], bl
inc esi
cmp al, 0
add byte [eax], al
add byte [ebx + 0x5e], bl
mov esp, ebp
pop ebp
ret 4
xchg ecx, eax
dec esi
mov eax, dword [ebp - 4]
cld
mov edx, dword [esi + 0x50]
scasb al, byte es:[edi]
push esp
inc edi
dec ebp
mov ecx, dword [ecx + 8]
mov dword [esi + 0x50], edx
adc ecx, 0
test dword [0x75541d89], ebx
pop sp
jne 0x40b3f4
pop esp
inc esi
cmp al, 0
add byte [eax], al
add byte [ebx + 0x5b5f0845], cl
pop esi
mov esp, ebp
pop ebp
ret 4
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx