joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51a770
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x555c38]
test eax, eax
je 0x51a7a5
mov ecx, dword [eax]
test ecx, ecx
je 0x51a808
add eax, 4
xor edi, edi
nop
cmp byte [ecx], 1
sbb edi, 0
inc edi
mov ecx, dword [eax]
add eax, 4
test ecx, ecx
jne 0x51a790
jmp 0x51a834
mov esi, dword [0x555c70]
test esi, esi
jne 0x51a7d2
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov esi, eax
mov dword [0x555c70], esi
test esi, esi
jne 0x51a7d2
mov dword [esp], str.GetEnvironmentStrings_failed
call fcn.00519910
mov esi, dword [0x555c70]
mov dword [esp], esi
call fcn.0050e100
test eax, eax
je 0x51a80c
xor ebx, ebx
xor edi, edi
mov ebp, esi
nop word cs:[eax + eax]
lea ebx, [eax + ebx + 1]
inc edi
lea ebp, [ebp + eax + 1]
mov dword [esp], ebp
call fcn.0050e100
test eax, eax
jne 0x51a7f0
inc ebx
jmp 0x51a813
xor edi, edi
jmp 0x51a834
mov ebx, 1
xor edi, edi
mov dword [esp], ebx
call fcn.0050d45c
mov dword [0x555c34], eax
test eax, eax
je 0x51a88d
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0050ddd0
lea eax, [edi + 4]
mov dword [0x555c3c], eax
add edi, 5
mov dword [esp], edi
mov dword [esp + 4], 4
call fcn.0050d440
mov esi, eax
test esi, esi
je 0x51a88d
mov edi, dword [0x555c38]
test edi, edi
je 0x51a891
mov edx, dword [edi]
test edx, edx
je 0x51a8ca
lea eax, [edi + 4]
xor ecx, ecx
nop word [eax + eax]
cmp byte [edx], 0
je 0x51a880
mov edx, dword [eax - 4]
mov dword [esi + ecx*4], edx
jmp 0x51a881
dec ecx
inc ecx
mov edx, dword [eax]
add eax, 4
test edx, edx
jne 0x51a870
jmp 0x51a8c6
xor eax, eax
jmp 0x51a8dd
mov ebx, dword [0x555c34]
mov dword [esp], ebx
call fcn.0050e100
test eax, eax
je 0x51a8d2
mov ebp, esi
nop word cs:[eax + eax]
mov dword [ebp], ebx
lea ebx, [ebx + eax + 1]
mov dword [esp], ebx
call fcn.0050e100
add ebp, 4
test eax, eax
jne 0x51a8b0
test edi, edi
je 0x51a8d2
mov dword [esp], edi
call fcn.0050d46c
mov dword [0x555c38], esi
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51af90
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebp, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov esi, dword [esp + 0x20]
mov dword [esp + 4], 1
mov dword [esp + 8], esi
cmp ebx, 1
jne 0x51aff1
mov eax, dword [0x555cb4]
lea ecx, [eax + 1]
mov dword [0x555cb4], ecx
test eax, eax
jne 0x51aff1
call sub.KERNEL32.DLL_GetEnvironmentStringsW
mov dword [0x555c74], eax
sub esp, 0xc
push dword [esi + 0x44]
call fcn.0050f328
add esp, 8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0051ad68
add esp, 0x10
push ebp
push ebx
push edi
push dword [esi + 0x18]
call fcn.0051b8d4
mov esi, eax
test ebx, ebx
jne 0x51b044
dec dword [0x555cb4]
jne 0x51b044
sub esp, 0xc
push edi
call fcn.00519b60
add esp, 8
lea eax, [esp + 0xc]
push 1
push eax
call fcn.0051ad68
add esp, 0x10
mov eax, dword [0x555c74]
test eax, eax
je 0x51b044
sub esp, 0xc
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsW
add esp, 0xc
mov dword [0x555c74], 0
mov eax, esi
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x51b56c
Capabilities:
Create thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov edi, edx
mov ebx, ecx
cmp edi, 0xf
jg 0x51b595
test edi, edi
je 0x51b595
call fcn.00519778
mov dword [eax], 0x13
mov eax, 0xffffffff
jmp 0x51b61b
call fcn.0051b238
mov esi, eax
test esi, esi
je 0x51b5e9
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi + 4], ebp
mov dword [esi + 0x14], ebx
mov dword [esi + 0x58], eax
sub esp, 8
lea eax, [esp + 0x10]
push eax
push ecx
push esi
push 0x51b70c
push edi
push edx
call sub.KERNEL32.DLL_CreateThread
add esp, 8
test eax, eax
je 0x51b5fb
mov ecx, dword [esp + 0x2c]
mov dword [esi + 8], eax
test ecx, ecx
je 0x51b61b
mov edx, dword [esp + 8]
mov dword [ecx], edx
jmp 0x51b61b
call fcn.00519778
mov dword [eax], 8
mov eax, 0xffffffff
jmp 0x51b61b
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x51b616
sub esp, 0xc
push 0x59
call fcn.0050ff6c
add esp, 0x10
jmp 0x51b61b
call fcn.0051000c
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x51b734
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push edi
push esi
sub esp, 0x64
mov esi, dword [esp + 0x70]
mov dword [esp], 0x555cc4
call sub.KERNEL32.DLL_EnterCriticalSection
sub esp, 4
mov eax, dword [0x559174]
cmp eax, 0x232
jl 0x51b79e
mov eax, dword [esp + 0x74]
mov byte [esp + 0x24], 0
mov dword [esp + 0x20], 0x20726f72
mov dword [esp + 0x1c], 0x72652065
mov dword [esp + 0x18], 0x726f6870
mov dword [esp + 0x14], 0x616d6553
mov dword [esp + 4], eax
lea edi, [esp + 0x14]
mov dword [esp], edi
call fcn.0050dfb4
mov dword [esp], edi
call fcn.00519910
mov eax, dword [0x559174]
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x555cc4]
mov dword [esp], eax
call sub.KERNEL32.DLL_InitializeCriticalSection
sub esp, 4
mov eax, dword [0x559174]
lea ecx, [eax + 1]
mov dword [0x559174], ecx
lea eax, [eax + eax*2]
lea eax, [eax*8 + 0x555cc4]
mov dword [esi], eax
mov dword [esp], 0x555cc4
call sub.KERNEL32.DLL_LeaveCriticalSection
add esp, 0x60
pop esi
pop edi
ret

Function at 0x51b7e4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
sub esp, 0x58
mov eax, dword [esp + 0x60]
mov byte [esp + 0x18], 0
mov dword [esp + 0x14], 0x20726f72
mov dword [esp + 0x10], 0x72652065
mov dword [esp + 0xc], 0x726f6870
mov dword [esp + 8], 0x616d6553
mov dword [esp + 4], eax
lea esi, [esp + 8]
mov dword [esp], esi
call fcn.0050dfb4
mov dword [esp], esi
call fcn.00519910
add esp, 0x58
pop esi
ret

Function at 0x51fd20
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [0x5595a4]
mov dword [esp], eax
call fcn.00521e4a
sub esp, 4
mov esi, eax
test esi, esi
je 0x51fd87
xor edi, edi
nop
cmp edi, 3
ja 0x51fd87
inc edi
xor ebx, ebx
xor eax, eax
nop word [eax + eax]
cmp byte [ebx*8 + 0x5595a8], 0
je 0x51fd7d
mov ecx, dword [ebx*8 + 0x5595ac]
test ecx, ecx
je 0x51fd7d
mov edx, dword [esi + ebx*4]
test edx, edx
je 0x51fd7d
mov dword [esi + ebx*4], 0
mov dword [esp], edx
call ecx
mov eax, 1
inc ebx
cmp ebx, 0x32
jne 0x51fd50
test eax, eax
jne 0x51fd40
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x43b643
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x43b3c1
inc esi
push esi
pop esi
add ebx, ebx
call fcn.0043b680
sub esi, 0x3523052d
add esi, ebx
inc ebx
xor dword [edi], edx
or esi, esi
sub ebx, ebx
add esi, 1
inc edi
and ebx, esi
sub esi, ebx
and esi, ebx
cmp edi, ecx
jne fcn.0043b643
push 0x20e6bda0
mov esi, dword [esp]
add esp, 4
ret
Function at 0x4014e1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [0x40a00c], 1
mov eax, dword [0x40a00c]
mov dword [0x40a020], eax
mov eax, dword [0x40a020]
mov dword [0x40a01c], eax
mov dword [0x40a010], 0
mov dword [esp], str.POSIXLY_CORRECT
call sub.msvcrt.dll_getenv
mov dword [0x40a018], eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2d
jne 0x40153a
mov dword [0x40a014], 2
add dword [ebp + 8], 1
jmp 0x401573
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2b
jne 0x401554
mov dword [0x40a014], 0
add dword [ebp + 8], 1
jmp 0x401573
mov eax, dword [0x40a018]
test eax, eax
je 0x401569
mov dword [0x40a014], 0
jmp 0x401573
mov dword [0x40a014], 1
mov eax, dword [ebp + 8]
leave
ret
Function at 0x4024a9
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x94
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov word [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov word [ebp - 0x2e], 0
mov dword [ebp - 0x34], 0x101
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
call sub.KERNEL32.dll_GetCurrentProcess
mov ebx, eax
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 2
lea edx, [ebp - 0x60]
add edx, 0x40
mov dword [esp + 0xc], edx
mov dword [esp + 8], ebx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_DuplicateHandle
sub esp, 0x1c
mov eax, dword [0x40a078]
lea edx, [ebp - 0x1c]
mov dword [esp + 0x24], edx
lea edx, [ebp - 0x60]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x4025c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
jmp 0x40261e
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 8], 0xa
mov dword [esp + 4], 0x40a0d0
mov dword [esp], eax
call sub.msvcrt.dll__itoa
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], str.Failed_to_execute_shell__error___s
call fcn.00402dec
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x4028ec
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov word [ebp - 0xa], 0x101
movzx eax, word [ebp - 0xa]
lea edx, [ebp - 0x1a0]
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WSOCK32.DLL_WSAStartup
sub esp, 8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40293f
movzx eax, word [ebp - 0x1a0]
cmp al, 1
jne 0x402937
movzx eax, word [ebp - 0x1a0]
shr ax, 8
cmp al, 1
je 0x402940
call sub.WSOCK32.DLL_WSACleanup
nop
jmp 0x402940
nop
leave
ret
Function at 0x403f3d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov edx, dword [0x40a148]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
mov ebx, eax
cmp ebx, 1
je 0x403f8a
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp + 4], eax
mov dword [esp], str.udptest_first_write_failed___errno__d
call fcn.00402dec
mov eax, dword [0x40a070]
test eax, eax
je 0x403fa2
mov eax, dword [0x40a070]
mov dword [esp], eax
call sub.msvcrt.dll__sleep
jmp 0x40401b
mov word [0x40a06c], 0
mov dword [0x40a070], 5
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x7a69
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.004036da
mov ebx, eax
test ebx, ebx
jle 0x403ff4
mov eax, dword [ebp + 8]
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.WSOCK32.DLL_shutdown
sub esp, 8
mov eax, ebx
mov dword [esp], eax
call sub.WSOCK32.DLL_closesocket
sub esp, 4
mov dword [0x40a070], 0
movzx eax, word [0x40a06c]
add eax, 1
mov word [0x40a06c], ax
call sub.msvcrt.dll__errno
mov dword [eax], 0
mov edx, dword [0x40a148]
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
mov ebx, eax
cmp ebx, 1
jne 0x40405a
mov eax, dword [ebp + 8]
jmp 0x404083
mov eax, dword [ebp + 8]
mov dword [esp + 4], 2
mov dword [esp], eax
call sub.WSOCK32.DLL_shutdown
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WSOCK32.DLL_closesocket
sub esp, 4
mov eax, 0xffffffff
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x404249
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
jmp 0x4042ee
movzx eax, byte [ebx]
cmp al, 0xff
jne 0x4042e7
mov byte [0x40a07e], 0xff
add ebx, 1
sub esi, 1
movzx eax, byte [ebx]
cmp al, 0xfb
je 0x404284
movzx eax, byte [ebx]
cmp al, 0xfc
jne 0x404289
mov edi, 0xfffffffe
movzx eax, byte [ebx]
cmp al, 0xfd
je 0x404297
movzx eax, byte [ebx]
cmp al, 0xfe
jne 0x40429c
mov edi, 0xfffffffc
mov eax, edi
test al, al
je 0x4042e8
mov eax, edi
mov byte [0x40a07f], al
add ebx, 1
sub esi, 1
movzx eax, byte [ebx]
mov byte [0x40a080], al
mov edx, 0x40a07e
mov eax, dword [0x407008]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.WSOCK32.DLL_send
sub esp, 0x10
mov edi, 0
jmp 0x4042e8
nop
add ebx, 1
sub esi, 1
test esi, esi
jg 0x404262
lea esp, [ebp - 0xc]
add esp, 0
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405a70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea esi, [ebp + 0xc]
add ebx, 0x40
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], ebx
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov eax, dword [ebp + 8]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort

Function at 0x405ac0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, eax
mov esi, edx
mov edi, ecx
test ecx, ecx
jne 0x405ae4
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
leave
ret
lea eax, [ebp - 0x38]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x405b80
mov eax, dword [ebp - 0x24]
cmp eax, 4
jne 0x405b55
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x24]
cmp eax, 4
je 0x405ad9
cmp eax, 0x40
je 0x405ad9
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
mov ebx, dword [ebp - 0xc]
sub esp, 0x10
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
leave
ret
cmp eax, 0x40
je 0x405b0a
mov dword [esp + 8], 0x40
lea eax, [ebp - 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x405b0a
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00405a70
nop
lea esi, [esi]
Function at 0x44b9f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.HSP1
lea edi, [esi - 0x2c000]
push edi
or ebp, 0xffffffff
jmp 0x44ba12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x44ba19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44ba08
mov eax, 1
add ebx, ebx
jne 0x44ba2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x44ba3c
jne 0x44ba4c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x44ba4c
dec eax
add ebx, ebx
jne 0x44ba48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x44ba20
xor ecx, ecx
sub eax, 3
jb 0x44ba64
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x44bad6
sar eax, 1
mov ebp, eax
jmp 0x44ba6f
add ebx, ebx
jne 0x44ba6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x44ba7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44baa0
inc ecx
add ebx, ebx
jne 0x44ba8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x44ba81
jne 0x44ba9d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x44ba81
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44bac0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44bab1
jmp 0x44ba0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44bac0
add edi, ecx
jmp 0x44ba0e
pop esi
mov edi, esi
mov ecx, 0x328
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44bade
cmp byte [edi], 2
jne 0x44bade
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x44bae3
lea edi, [esi + 0x49000]
mov eax, dword [edi]
or eax, eax
je 0x44bb5b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4d140]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4d17c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44bb10
mov ecx, edi
jns 0x44bb3f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4d180]
or eax, eax
je 0x44bb55
mov dword [ebx], eax
add ebx, 4
jmp 0x44bb2d
call dword [esi + 0x4d184]
popal
jmp 0x402940
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x41c1e86
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x10bf28b7
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0xbd0058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xbd01a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xbd007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbd006a
add dl, dl
jne 0xbd0089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbd00dc
xor eax, eax
add dl, dl
jne 0xbd0096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xbd017d
add dl, dl
jne 0xbd00a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbd00b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbd00bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbd00c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xbd00d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xbd0075
mov eax, 1
add dl, dl
jne 0xbd00ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xbd00f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbd00e1
sub eax, ebx
mov ebx, 1
jne 0xbd0128
mov ecx, 1
add dl, dl
jne 0xbd010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbd0119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbd0105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbd0075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xbd013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xbd014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xbd0136
cmp eax, 0x7d00
jae 0xbd016d
cmp eax, 0x500
jb 0xbd0168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbd0075
cmp eax, 0x7f
ja 0xbd0170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xbd0075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xbd019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xbd0075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x6d004cfb
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6d982018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x6d982018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x6d004e0d
jmp 0x6d004eff
jmp 0x6d004ff1
jmp 0x6d0050e3
jmp 0x6d0051d5
jmp 0x6d0052c7
jmp 0x6d0053b9
jmp 0x6d0054ab
jmp 0x6d00559d
jmp 0x6d00568f
jmp 0x6d005781
jmp 0x6d005873
jmp 0x6d005965
jmp 0x6d005a57
jmp 0x6d005b49
jmp 0x6d005c3b
jmp 0x6d005d2d
mov dword [ebp - 0x14], 0
jmp 0x6d005e26
jmp 0x6d005f18
jmp 0x6d00600a
jmp 0x6d0060fc
jmp 0x6d0061ee
jmp 0x6d0062e0
jmp 0x6d0063d2
jmp 0x6d0064c4
jmp 0x6d0065b6
jmp 0x6d0066a8
jmp 0x6d00679a
jmp 0x6d00688c
jmp 0x6d00697e
jmp 0x6d006a70
jmp 0x6d006b62
jmp 0x6d006c54
jmp 0x6d006d46
mov dword [ebp - 0x18], 0
jmp 0x6d006e3f
jmp 0x6d006f31
jmp 0x6d007023
jmp 0x6d007115
jmp 0x6d007207
jmp 0x6d0072f9
jmp 0x6d0073eb
jmp 0x6d0074dd
jmp 0x6d0075cf
jmp 0x6d0076c1
jmp 0x6d0077b3
jmp 0x6d0078a5
jmp 0x6d007997
jmp 0x6d007a89
jmp 0x6d007b7b
jmp 0x6d007c6d
jmp 0x6d007d5f
mov dword [ebp - 0x10], 0
jmp 0x6d007e58
jmp 0x6d007f4a
jmp 0x6d00803c
jmp 0x6d00812e
jmp 0x6d008220
jmp 0x6d008312
jmp 0x6d008404
jmp 0x6d0084f6
jmp 0x6d0085e8
jmp 0x6d0086da
jmp 0x6d0087cc
jmp 0x6d0088be
jmp 0x6d0089b0
jmp 0x6d008aa2
jmp 0x6d008b94
jmp 0x6d008c86
jmp 0x6d008d78
mov dword [ebp - 0x10], 0
jmp 0x6d00de26
jmp 0x6d008e76
jmp 0x6d008f68
jmp 0x6d00905a
jmp 0x6d00914c
jmp 0x6d00923e
jmp 0x6d009330
jmp 0x6d009422
jmp 0x6d009514
jmp 0x6d009606
jmp 0x6d0096f8
jmp 0x6d0097ea
jmp 0x6d0098dc
jmp 0x6d0099ce
jmp 0x6d009ac0
jmp 0x6d009bb2
jmp 0x6d009ca4
jmp 0x6d009d96
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [0x6d982014]
add eax, edx
mov dword [ebp - 0x14], eax
jmp 0x6d009e99
jmp 0x6d009f8b
jmp 0x6d00a07d
jmp 0x6d00a16f
jmp 0x6d00a261
jmp 0x6d00a353
jmp 0x6d00a445
jmp 0x6d00a537
jmp 0x6d00a629
jmp 0x6d00a71b
jmp 0x6d00a80d
jmp 0x6d00a8ff
jmp 0x6d00a9f1
jmp 0x6d00aae3
jmp 0x6d00abd5
jmp 0x6d00acc7
jmp 0x6d00adb9
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, dword [0x6d98201c]
add eax, edx
mov dword [ebp - 0x18], eax
jmp 0x6d00aebc
jmp 0x6d00afae
jmp 0x6d00b0a0
jmp 0x6d00b192
jmp 0x6d00b284
jmp 0x6d00b376
jmp 0x6d00b468
jmp 0x6d00b55a
jmp 0x6d00b64c
jmp 0x6d00b73e
jmp 0x6d00b830
jmp 0x6d00b922
jmp 0x6d00ba14
jmp 0x6d00bb06
jmp 0x6d00bbf8
jmp 0x6d00bcea
jmp 0x6d00bddc
mov eax, dword [0x6d982008]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x18]
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x14]
mov dword [esp], edx
call eax
jmp 0x6d00beec
jmp 0x6d00bfde
jmp 0x6d00c0d0
jmp 0x6d00c1c2
jmp 0x6d00c2b4
jmp 0x6d00c3a6
jmp 0x6d00c498
jmp fcn.6d00c58a
mov eax, dword [0x6d982018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x6d008d84
nop
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219