joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57f911
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
or eax, eax
mov bh, 8
salc
mov dword [edx], ebx
popfd
sbb dword [ebx + ebp*8], 0x3d
outsd dx, dword [esi]
xlatb
jns 0x57f95e
scasb al, byte es:[edi]
call 0x9bb74f2c
cmp dh, byte [ebx + 0xd]
xchg ebx, eax
in eax, dx
movsb byte es:[edi], byte [esi]
invalid
wait
xchg esp, eax
mov bh, 0x5a
dec ecx
jns 0x57f8d7
lea esi, [edi - 0x2e]
xchg dword [edi], eax
pop es
pop es
out dx, al
pop ds
jmp 0x57f940
xlatb
and esp, dword [eax - 0x4ac77a70]
or al, 0xac
jns 0x57f8f3
loope 0x57f905
daa
jns 0x57f992
int 0x7d
sub dword [ebx - 0x18f482e5], eax
test byte [edi], dh
jge 0x57f94d
out 0x84, eax
aaa
and edx, dword [esi - 0x13]
out dx, eax
scasd eax, dword es:[edi]
xor cl, al
push ss
stosd dword es:[edi], eax
jecxz 0x57f92b
call 0x3df4ab80
or eax, 0x56554ea9
in al, 0xb
test esp, 0x873bbf82
daa
or byte [0xfc7415a5], ah
cdq
cmp byte [edi + 0x827873b], 0x25
movsd dword es:[edi], dword [esi]
adc eax, 0x9a99fc74
out dx, eax
sub eax, 0x68371641
lcall 0x6837, 0x16412def
xacquire xchg dword [edx], esi
xchg ecx, eax
sub al, 0x2a
mov ch, 0xda
out dx, al
mov cl, 0xd0
xchg byte [esi], ch
test eax, 0x54aa92b1
push ebp
jo 0x57f9fc
jns 0x57fa01
pop ds
pop es
loop 0x57f96a
pop ds
fisub word [edi - 0x7f]
mov byte [0x7ffe1f4d], al
sbb al, 0xe9
mov eax, dword [0x23a885e7]
mov byte [eax - 0x4e2f8518], dh
sbb eax, 0xa9933161
loopne 0x57f9a0
pop ds
invalid
sal byte [ecx - 0x6cce9ee3], 1
test eax, 0xb3bef7e0
test byte [edx + edx*8 + 0x25], 0x83
in al, dx
sub al, 0xf7
lds ecx, [eax]
xchg byte [ecx - 0x365d3015], bh
xchg ecx, eax
sub cl, byte [edi + 0x238e8730]
adc dh, ch
invalid
mov esi, 0xd24cf6b3
and eax, 0x2cf2ec83
test ebp, 0xebb98608
iretd
in eax, 0x6b
popfd
xor al, 0xfa
cld
xchg ebx, eax
mov dword [ebx], ebx
xor bl, byte [esi - 1]
js 0x57fa03
invalid

Function at 0x581c79
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
mov dword [0x6ea95000], eax
sub cl, al
mov ecx, 0xf1bddc72
adc bh, byte [eax]
lds esi, [esi + 0x5e81e357]
xchg ecx, eax
add edx, edx
sahf
mov cl, 0x7f
xchg dword [edi + 0x53], ebp
call 0xffe9411
adc eax, 0xfaa3169f
in eax, dx
inc edi
mov byte [0xca25fc33], al
xchg dword [0x1b96bdf4], ecx
adc byte [ecx], cl
push ss
mov dword [0xa247edfa], eax
xor edi, esp
and eax, 0xf40d87ca
mov ebp, 0x9101b96
mov al, byte [0xd8a89bec]
outsd dx, dword [esi]
neg dword [edi - 0x7a]
pop edi
xchg byte [edx - 0x1f], al
invalid
pop edi
xchg byte [edx - 0x1f], al
sbb ebx, dword [esi + ebx*8 - 0x22e531af]
pushfd
ficom word [ecx - 0x32]
sbb bl, ch
mov dh, 0xf0
sub ah, dl
mov cl, 0x30
sahf
sbb dh, byte [ebx + 0x43a61ec7]
mov bl, 0x5f
xchg byte [edx - 0x23], ah
js 0x581c60
add byte [di + 0x22], bh
mov ebx, 0xe8150917
xchg ecx, eax
mov dl, byte [esi - 0x37]
push esi
loop 0x581cbd
pushfd
jecxz 0x581c3b
dec edi
xor dword [edi], edi
ljmp 0x4a88
Function at 0x586a1c
Capabilities:
Encode data using xor

Disassembly:
jl 0x5869fe
mov bl, 0xce
int 0xf
dec edi
dec ebx
add dword [eax - 0x3a], eax
cmp byte [esi - 0x535fea6c], cl
daa
hlt
mov ss, word [ebp + edx - 0xbd85360]
loope 0x586a3c
stc
nop
jnp 0x586a3d
movhps qword [edx - 0x46d3aedc], xmm4
sub al, 0xb9
ror edx, cl
lcall 0x6edf, 0xf4751a8f
cld
sbb ah, byte [0x6ee79452]
imul ebx, ecx, 0xe18a1e66
and al, 0xed
xor ebp, ebx
jne 0x586a10
test byte [0x23970b9a], dh
pop ss
or bh, dl
mov eax, 0xedd07ed5
mov dl, 0xe3
cmp byte [edx + 0x5c], dh
jecxz 0x586a77
jb 0x586a9d
std
jge 0x586aa2
mov ebx, 0x3535df4b
dec eax
test dword [ebp + 0x2f], esi
xchg ecx, eax
jge 0x5869f2
cmp ecx, dword gs:[edi - 0x75]
mov edx, 0xc3717c3
invalid
dec edx
int3
cmovno esi, dword [edi + edx*8 + 0xc]
out 0x75, eax
cld
push ebx
dec edx
test eax, 0xb6aac67d
fimul word [esi]
stosb byte es:[edi], al
mov dh, 0xde
push cs
jb 0x586b02
push eax
pop eax
clc
aas
mov al, 0x13
aaa
and byte [eax + esi*4], bh
inc edi
mov ecx, 0xc94c4bbd
and al, 0x4b
leave
movsb byte es:[edi], byte [esi]
sbb dword [ebx - 0x41886fa6], edi
pop edx
and al, 0xf1
outsd dx, dword [esi]
imul edi, esp, 0xaf9dbff5
scasd eax, dword es:[edi]
dec ecx
into
mov ah, 0x86
je 0x586b31
inc esi
pushal
loop 0x586a95
xor al, 0x6e
push ecx
jg 0x586b4f
je 0x586aa9
int 0xf9
stc
jbe 0x586ada
sar edi, 1
outsb dx, byte [esi]
mov eax, 0x6941a9ef
xor eax, dword [esi + 0x3e]
push ecx
std
jl 0x586acb
xchg edx, eax
xor byte [esi + 0x4c75082b], cl
out dx, eax
add ecx, esp
aad 0x87
add dword [ebx + 0x34], 0x7e
movsb byte es:[edi], byte [esi]
cdq
test eax, 0x8945c7aa
and dword [ebx], ebx
xor al, 5
mov dword [ebp - 0x77], 0x5341b21
or al, 0x9e
sbb al, 0x10
cmc
inc dword [ebx - 0x31]
out dx, eax
adc esp, dword [ecx + 0x3c]
cmp eax, 0x3a85cf3
test al, 3
fistp word [edi]
scasd eax, dword es:[edi]
pop edx
sbb eax, 0x6a83101a
mov byte [esi], bh
jne 0x586b30
or al, 0x3c
lahf
insd dword es:[edi], dx
iretd
cwde
into
jecxz 0x586b41
test eax, 0x31424dfe
cmp eax, 0x32cabd66
pop ecx
mov edx, 0x1d7c384a
adc esi, dword [ebp + eax*2 + 0x49]
cmp byte [ebp + ebx + 0x13], bh
je 0x586b8c
dec ecx
inc ebp
cmp dword gs:[edi - 0x3d], ecx
mov ebx, dword [esi]
dec ebx
dec ebx
add byte [eax + ecx*8], dh
xor al, 0xc8
cmp dword [eax], edi
call 0x57a84b0a
pop ecx
jecxz 0x586b18
push 0x6b773811
test dword [esi], esi
and byte [ebp - 0x26], dl
adc bl, byte [ecx]
lea esi, [ebx - 0x29]
lahf
popfd
aad 0x76
xor byte [edx - 0x38], dl
jg 0x586ba2
invalid
cmp dword [ecx + ecx*4 - 0x6386c2c], edi
cld
mov bl, 0x3e
shr dword [ebx], 0xb1
jg 0x586ba9
mov dl, 3
and bl, byte [eax]
dec ebx
pop ds
dec esi
arpl word [edx + 0x59], si
invalid
inc eax
mov esi, 0xdc2d1a29
cmp byte [edx - 0x21], bh
mov bh, 0xfa
cdq
in eax, 0x17
jge 0x586b52
loope 0x586bf4
add dword [ebx], 0x67fed201
cmpsb byte [esi], byte es:[edi]
and eax, 0x1b87140f
jg 0x586bff
inc edi
insd dword es:[edi], dx
jl 0x586b71
mov eax, 0xf363358
invalid
inc esp
sub eax, 0xe1c6e927
or byte [ebx + 7], cl
int 0x38
push ecx
add ch, byte [eax - 0x6b]
or dword [edx - 0x1c1ca468], edi
outsb dx, byte [esi]
pop eax
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
popfd
popal
Function at 0x588b5d
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
xchg edx, eax
inc edx
xchg byte [edx - 0x5e], ch
mov al, 0x21
jo 0x588bbd
mov ch, 0x2d
sub byte [ecx + esi*8 - 0x1ae8a07d], dl
pop esi
pop ds
and al, 0xcb
outsb dx, byte [esi]
dec edi
cmp bh, bh
and dword [eax + 0x4d3396e7], esi
pop es
mov bl, 0xd9
inc edx
cli
xchg edx, eax
iretd
out 0xd1, al
fiadd word [0x341244f8]
sub eax, 0xb6ddcf76
xchg ecx, eax
push 0x3c
sal byte [edi + 0x2e], 1
ja 0x588bfe
call 0x87a5c1f5
sahf
cmp eax, 0xe47fde50
or byte [edi], dh
xor byte [ebp - 0x33], bl
xor dword [ebp - 0x7067c695], edx
jb 0x588bdb
mov ch, 0x1f
js 0x588c3d
dec ebp
lodsb al, byte [esi]
xchg esp, eax
push dword [edi - 0x43e4cb8c]
xlatb
or edi, edx
fld dword [esi + 0x146b97d6]
scasb al, byte es:[edi]
adc al, 0xae
adc dword [ecx], edi
sar dword [ecx - 0x41], 0x81
sahf
pop edx
push cs
push es
add eax, 0x27b6fc82
lea esp, [edx]
out 0x49, al
cmp ecx, esi
sar dword [ebp + 8], 0x96
clc
mov esp, 0xb9574ea5
aaa
mov dh, 0x17
xchg ebx, eax
hlt
mov bl, 0xa3
xchg ebp, eax
call 0xbbe64451
push esi
invalid
mov dword [0x1ce82e95], eax
mov eax, 0xc556bb8d
invalid
sbb eax, dword [edi]
cdq
mov dh, 0x17
jle 0x588bce
aaa
pop eax
push es
cmpsb byte [esi], byte es:[edi]
jns 0x588c2d
cmpsd dword [esi], dword es:[edi]
mov cl, 0x98
inc ebx
out dx, eax
add al, 0xc8
sub dword [edi - 0x19f07b12], 0x7505d68e
pop edi
pop edi
imul esp, dword [eax - 0x5a], 2
push ecx
fcomp dword [esi + 0x43a428d7]
dec bx
dec ebx
cdq
mov esp, 0xd1173f07
dec edi
loope 0x588c2c
aas
pop ss
ror dword [edi - 0x1f], 1
mov bh, 0xf
xor dh, bl
or al, 0x37
wrmsr
fimul word [edi + esi]
jle 0x588c6f
idiv dword [ebp + 6]
lodsb al, byte [esi]
call 0x949afda2
push 0x3a07a548
enter 0xffffffffffffcbd8, 0xffffffffffffff9f
xchg byte [ebp - 0x40], ch
insd dword es:[edi], dx
inc edi
push cs
call 0xf1ad5948
fdivp st(2)
dec ecx
push es
inc edx
cmc
int 0x77
test al, 0x94
out dx, eax
add dl, byte [0x38233a0c]
je 0x588d07
jne 0x588cdb
sbb cl, byte [ebp + 0x27]
sub dword [eax], edi
dec ecx
inc esp
cld
arpl di, dx
aaa
jmp 0x588c7f
invalid
adc eax, dword [edi]
lea ebp, [edx + 0x70]
mov ch, 0xc3
or edi, 0x1ced027e
Function at 0x61bd6b
Capabilities:
Encode data using xor

Disassembly:
call dword [edi]
inc dword [ebx - 0x1f]
mov gs, word [esi + 0x51daef78]
push ebx
out dx, eax
ficom dword [ecx + 0x53]
adc ecx, dword [eax + 0x7c]
cmc
mov eax, 0x5e4cd3d0
aam 0x5f
xor al, 0x1f
hlt
clc
rol byte [esi - 0x70], 0x9c
invalid
fmulp st(0)
rol dword [ebx - 0x2d], 0x4a
jne 0x61bd34
sal eax, 1
pop ebp
aaa
js 0x61bd5e
mov bh, 0x44
call 0x8c927b91
inc ecx
shl ebx, 0x14
and al, byte [esi + 0x53]
or eax, 0x3fdaeac8
push edi
jle 0x61bd3c
fsub dword [edi + 0x7d71e1b0]
jne 0x61be12
or ch, byte [ebx + 0x61]
shr byte [ebx + 0x48], 1
aad 0x5f
adc byte [ecx], al
xchg edi, eax
ret 0x527b
invalid

Function at 0x65a2fc
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b96], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b95], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b94], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b93], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b92], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b91], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEFL]
mov byte [0x665b90], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEFL]
mov byte [0x665b8f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x65a407
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x65a409
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret
Function at 0x65a41c
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0065ace6
cmp dword [0x66542c], ecx
jne 0x65a521
mov ecx, fcn.0065b06a
cmp dword [0x665430], ecx
jne 0x65a521
mov ecx, fcn.0065b262
cmp dword [0x665434], ecx
jne 0x65a521
mov ecx, fcn.0065b57c
cmp dword [0x665438], ecx
jne 0x65a521
mov ecx, 0x65961c
cmp dword [0x66543c], ecx
jne 0x65a521
xor eax, eax
mov ecx, 0x65962c
cmp dword [0x665440], ecx
jne 0x65a521
mov ecx, dword [0xa6860c]
test ecx, ecx
jne 0x65a521
call fcn.0065a2fc
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x65a521
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0xa6860c], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0065ace6
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret

Function at 0x660d34
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
test esi, esi
je 0x660e57
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetLocalTime
sub esp, 4
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x24], eax
movzx ecx, word [esp + 0x32]
movzx edx, word [esp + 0x2c]
movzx ebx, word [esp + 0x34]
movzx ebp, word [esp + 0x36]
movzx edi, word [esp + 0x38]
movzx eax, word [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02d__02d__04d__02d:_02d:_02d._03d
mov dword [esp], 0xa6ab8c
call sub.USER32.DLL_wsprintfA
mov dword [esp], 0xa6ab8c
call fcn.0065b9f8
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0xa6ab8c
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov edi, dword [esp + 0x54]
mov dword [esp], edi
call fcn.0065b9f8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x660e68
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0xa6abac]
mov eax, dword [0xa6abb0]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x660f5d
test ecx, ecx
jne 0x660f5d
cmp dword [0x667260], 0
je 0x660f9f
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.00660bfc
test eax, eax
jne 0x660eea
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.00660bfc
test eax, eax
je 0x660eed
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x660f3d
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x661068
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x660f3d
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x661029
test ecx, ecx
je 0x660f74
cmp ecx, 0xffffffff
je 0x661029
mov dword [esp], edi
call ecx
mov eax, dword [0xa6abb0]
test eax, eax
je 0x661029
cmp eax, 0xffffffff
je 0x661029
cmp byte [eax], 0
je 0x661029
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00660d34
jmp 0x661029
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.0065b9f8
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret

Function at 0x6627a0
Capabilities:
Set thread local storage value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call sub.KERNEL32.DLL_TlsSetValue
ret 8
Function at 0x403f58
Capabilities:
Accept command line arguments

Disassembly:
push ebx
mov edx, ebp
push 0x45c666fd
invalid
jmp 0x403f97
je 0x403f6e
cmp cl, 0x45
je 0x403f6e
nop
mov cl, byte [eax + 1]
nop
inc eax
test cl, cl
jne 0x403f5f
cmp byte [eax], 0
je 0x403f79
nop
jmp 0x403f7d
xor eax, eax
ret
xor ecx, ecx
mov eax, section..text
nop
add eax, ecx
inc byte [eax]
inc byte [eax]
inc ecx
jmp 0x403fa2
mov cl, byte [eax]
test cl, cl
jmp 0x403f5d
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
jmp 0x403f91
cmp ecx, 0x2e12
jl 0x403f7f
nop
xor ecx, ecx
jmp 0x403fc8
nop
jmp 0x403ff7
cmp ecx, 0xeac
jmp 0x403fe7
mov eax, section..data
nop
add eax, ecx
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc byte [eax]
inc ecx
jmp 0x403fbe
jl 0x403fad
jmp 0x403fb8
jmp 0x4039c2

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5a5d59ab
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x900e34b5
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x402634
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_inet_addr]
call esi
cmp eax, 0xffffffff
je 0x402655
push dword [ebp + 8]
call esi
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
pop esi
jne 0x402682
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x402682
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x402682
push 4
push eax
lea eax, [ebp - 4]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 4]
leave
ret 8

Function at 0x402689
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
and dword [ebp - 4], 0
imul edx, edx, 0x9e3779b9
push esi
mov esi, dword [ebp + 0xc]
test edx, edx
mov eax, dword [esi]
mov ecx, dword [esi + 4]
je 0x4026fe
mov esi, dword [ebp + 8]
push ebx
push edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, ecx
sub dword [ebp - 4], 0x61c88647
add ebx, eax
lea eax, [ebx + edi]
mov edi, eax
mov ebx, eax
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, dword [ebp - 4]
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp - 4]
xor ebx, eax
add ebx, ecx
cmp dword [ebp - 4], edx
lea ecx, [ebx + edi]
jne 0x4026ac
mov esi, dword [ebp + 0xc]
pop edi
pop ebx
mov dword [esi], eax
mov dword [esi + 4], ecx
pop esi
leave
ret

Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x401d9d
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 4, 0
mov esi, eax
mov edi, dword [0x404050]
cdq
or di, 1
idiv edi
mov edx, dword [0x404050]
mov ebx, esi
add edx, eax
mov eax, 0x404054
call fcn.00401cc0
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x403135
push eax
sub edi, fcn.004028df
push edi
push fcn.004028df
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp - 4], 0
je 0x401e13
mov eax, fcn.004028df
mov ebx, esi
mov edx, edi
call fcn.00401cc0
mov edx, 0x1c000
mov eax, 0x404054
mov ebx, esi
call fcn.00402423
leave
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x10008d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
or dword [ebp - 0x14], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
mov ebx, 0x126
push ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.10009396
pop ecx
cmp eax, esi
jne 0x10008d7a
xor eax, eax
jmp 0x10008da0
mov edx, 0x30ddc18
xor edi, edi
sub edx, eax
mov ebx, edi
and ebx, 0xf
mov bl, byte [ebx + 0x30ddc04]
lea ecx, [edi + eax]
xor bl, byte [edx + ecx]
inc edi
mov byte [ecx], bl
mov ebx, 0x126
cmp edi, ebx
jb 0x10008d83
mov dword [ebp - 0x1c], eax
cmp eax, esi
jne 0x10008daf
push 0xfffffffffffffffe
pop eax
jmp 0x10008ee9
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push esi
push 0x8000
push ebx
push eax
mov eax, dword [0x30de3f4]
push 8
push 1
call dword [eax]
test eax, eax
je 0x10008e4b
push 0xf0000000
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x30de3f0]
call dword [eax + 0x44]
test eax, eax
jne 0x10008e00
push 0xf0000008
push 1
push esi
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x30de3f0]
call dword [eax + 0x44]
test eax, eax
je 0x10008e4b
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
mov eax, dword [0x30de3f4]
push 0x10001
push dword [ebp - 4]
call dword [eax + 4]
test eax, eax
je 0x10008e4b
lea eax, [ebp - 8]
push eax
mov eax, dword [0x30de3f0]
push esi
push esi
push 0x8004
push dword [ebp - 4]
call dword [eax + 0x48]
test eax, eax
je 0x10008e4b
mov eax, dword [0x30de3f0]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [eax + 0x4c]
test eax, eax
jne 0x10008e53
call dword [0x30d707c]
jmp 0x10008e98
mov eax, dword [ebp + 8]
xor edi, edi
add eax, 0xff
mov ecx, dword [ebp + 8]
mov bl, byte [eax]
lea edx, [edi + ecx]
mov cl, byte [edx]
mov byte [edx], bl
inc edi
mov byte [eax], cl
dec eax
cmp edi, 0x80
jb 0x10008e5d
mov eax, dword [0x30de3f0]
push esi
push esi
push dword [ebp - 0xc]
push 0x100
push dword [ebp + 8]
push dword [ebp - 8]
call dword [eax + 0x50]
test eax, eax
je 0x10008e98
mov dword [ebp - 0x14], 1
cmp dword [ebp - 8], esi
je 0x10008ea8
push dword [ebp - 8]
mov eax, dword [0x30de3f0]
call dword [eax + 0x5c]
cmp dword [ebp - 0xc], esi
je 0x10008eb8
push dword [ebp - 0xc]
mov eax, dword [0x30de3f0]
call dword [eax + 0x58]
cmp dword [ebp - 4], esi
je 0x10008ec9
mov eax, dword [0x30de3f0]
push esi
push dword [ebp - 4]
call dword [eax + 0x54]
cmp dword [ebp - 0x10], esi
je 0x10008ed9
push dword [ebp - 0x10]
mov eax, dword [0x30de3e4]
call dword [eax + 0x2c]
mov eax, 0x126
lea ecx, [ebp - 0x1c]
call fcn.100093ac
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret