joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40101d
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x40103f
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
fninit
push 0x80000301
push 0
push 0x3e8
push 1
mov ebx, 0x1bc
call fcn.0046d800
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4010e0
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.0040122a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0x101
call dword [sym.imp.WSOCK32.dll_WSAStartup]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x401117
push 6
call fcn.0046cc8f
add esp, 4
push 0x80000301
push 0
push 8
push reloc.WSOCK32.dll_connect
push 0
push 0x4992d0
push 2
mov ebx, 0x138
call fcn.0046d830
add esp, 0x1c
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0040124b
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x401160
push ebx
call fcn.0046cc7d
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x5f5d7e], eax
push 0x80000301
push 0
push 0x80
push 0x80000301
push 0
push 8
push 2
mov ebx, 0xc8
call fcn.0046d8a0
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.004013b1
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4011ba
push ebx
call fcn.0046cc7d
add esp, 4
push 0
mov ebx, 4
mov eax, 0x475110
call fcn.0046d760
add esp, 4
mov dword [0x5f5d82], eax
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x4011ff
nop
nop
nop
nop
nop
nop
call fcn.004014b1
mov eax, 0
jmp 0x401214
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x401225
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x405d6b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405da6
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0046d8c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405e09
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0046d8a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405e2d
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0046d8c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405e90
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0046d8a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405eb4
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0046d8c0
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x405f17
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0046d8a0
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x405f1f
mov esp, ebp
pop ebp
ret
Function at 0x40c3c8
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push getsockname
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40c3e6
mov eax, 0x4996d7
push eax
push 1
mov ebx, 0x194
call fcn.0046dd20
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40c410
mov eax, 0
jmp 0x40c484
push esi
push ebx
push edi
push edx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
jle 0x40c471
add eax, 8
mov edi, eax
mov ebx, edi
push edi
xor al, al
pop esi
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov edi, eax
push edx
cld
xor ecx, ecx
dec ecx
mov edx, ecx
xor eax, eax
xor ebx, ebx
lodsb al, byte [esi]
xor al, cl
mov cl, ch
mov ch, dl
mov dl, dh
mov dh, 8
shr bx, 1
rcr ax, 1
jae 0x40c45a
xor ax, 0x8320
xor bx, 0xedb8
dec dh
jne 0x40c449
xor ecx, eax
xor edx, ebx
dec edi
jne 0x40c43a
not edx
not ecx
mov eax, edx
rol eax, 0x10
mov ax, cx
pop ecx
pop edx
pop edi
pop ebx
pop esi
leave
ret 4
mov esp, ebp
pop ebp
ret 4
Function at 0x40e12d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40e16b
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x40e1f1
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e202
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 4], eax
push getsockname
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40e219
mov eax, 0x4996d7
push eax
push 1
mov ebx, 0x194
call fcn.0046dd20
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.0040122a
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
push 1
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.0040e393
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push 0x40
push 0x1000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40e28c
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 0x14]
push 0xa0000101
push 0
push 0x5f0a1d
push 3
mov ebx, 0x914
call fcn.0046d960
add esp, 0x28
push dword [ebp - 8]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40e301
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x40e32d
push 6
call fcn.0046cc8f
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x40e347
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40e37b
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40e38c
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x410115
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [0x5f5f16]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41014e
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0046ed00
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x410184
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x499668]
fstp qword [ebp - 0x18]
mov dword [ebp - 0x1c], esp
fld qword [ebp - 0x18]
call fcn.00401925
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
nop
nop
nop
nop
cmp dword [ebp - 0x1c], esp
je 0x4101c8
push 6
call fcn.0046cc8f
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4101e4
push eax
mov ebx, eax
call fcn.00401346
inc eax
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4101e9
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4101fa
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4
Function at 0x41877f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x4187ac
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
mov eax, 0
setne al
jmp 0x4187c0
mov esp, ebp
pop ebp
ret 4

Function at 0x418df9
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push 0x1c
call fcn.0046cc83
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 7
rep stosd dword es:[edi], eax
mov dword [ebp - 8], 0
jmp 0x418e38
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0x1c
push dword [ebp - 4]
push 3
call dword [0x5f5f5a]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x418eda
push 6
call fcn.0046cc8f
add esp, 4
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
fild qword [ebx]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
mov ebx, dword [ebp - 0x10]
fild qword [ebx]
fstp qword [ebp - 0x20]
fsub qword [ebp - 0x20]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
fdiv qword [0x5f0fff]
fstp qword [ebp - 0x30]
push 0x80000601
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
mov ebx, 0x9dc
call fcn.0046e220
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x418f65
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x41a163
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x40
call fcn.0046cc83
add esp, 4
mov dword [ebp - 4], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 0x10
rep stosd dword es:[edi], eax
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
mov dword [ebx], 0x40
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x41a1ba
push 6
call fcn.0046cc8f
add esp, 4
mov ebx, dword [ebp - 4]
add ebx, 8
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 8]
fild qword [ebx]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fdiv qword [0x5f1023]
fstp qword [ebp - 0x18]
push 0x80000601
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 1
mov ebx, 0x9dc
call fcn.0046e220
add esp, 0x10
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x168
call fcn.0046dda0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
jmp 0x41a219
push eax
mov ebx, dword [ebp - 4]
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x420d53
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x420d91
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x420e17
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x420e28
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 4], eax
push getsockname
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x420e3f
mov eax, 0x4996d7
push eax
push 1
mov ebx, 0x194
call fcn.0046dd20
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
call fcn.0040122a
mov dword [ebp - 0xc], eax
push 1
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.0040e393
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], esp
push 0x40
push 0x1000
push 0x64
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x420ea4
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0x80000301
push 0
push dword [ebp - 0x14]
push 0xa0000101
push 0
push 0x5f11fd
push 3
mov ebx, 0x914
call fcn.0046d960
add esp, 0x28
push dword [ebp - 8]
push dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call dword [ebp - 0x14]
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x420f19
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 0x18], esp
push 0x8000
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x420f45
push 6
call fcn.0046cc8f
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x420f5f
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x420f93
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x420fa4
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x421102
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], 0
jmp 0x421124
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
mov dword [ebp - 4], 0
nop
push eax
push ecx
push edx
push ebx
push esi
push edi
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WSOCK32.dll_getsockname
cpuid
shr ecx, 0x10
mov esi, ecx
nop
pop edx
pop ecx
pop ebx
nop
push ebx
push ecx
push edx
mov eax, getsockname
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x64]
add esi, eax
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, al
add esi, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 1
cpuid
xor ebx, ebx
mov bl, dl
add esi, ebx
nop
nop
imul esi, esi, 0x88
nop
nop
push ebx
push ecx
push edx
mov eax, getsockname
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
imul edx, edx, 6
add esi, edx
nop
nop
nop
pop edx
pop ecx
pop ebx
nop
nop
nop
push ebx
push ecx
push edx
mov eax, reloc.WSOCK32.dll_getsockname
cpuid
shr ecx, 0x10
imul ecx, ecx, 9
add esi, ecx
pop edx
pop ecx
pop ebx
nop
nop
nop
xor esi, 0x124254
mov dword [ebp - 4], esi
pop edi
pop esi
pop ebx
pop edx
pop ecx
pop eax
nop
nop
nop
mov eax, dword [ebp - 4]
jmp 0x42125f
mov esp, ebp
pop ebp
ret
Function at 0x422f80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x422f95
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push edx
mov edx, 1
mov edx, 2
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
pop edx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x3f8f8711
xor ecx, 0x640b644b
xor ecx, 0x466136d3
xor ecx, 0x483de5da
xor ecx, 0x3a0b3a2c
xor ecx, 0x573b37ec
xor ecx, 0x72ea4e61
xor ecx, 0x23277ceb
xor ecx, 0x5a60a04b
xor ecx, 0x261cf56d
xor ecx, 0xe5fb601
xor ecx, 0x2d083c3f
xor ecx, 0x499be607
xor ecx, 0x3d1e028a
xor ecx, 0x2f83feea
xor ecx, 0x577aa7b7
xor ecx, 0x3119467
xor ecx, 0x5dc2607
xor ecx, 0x4f7c6f2f
xor ecx, 0x5f2e23b4
xor ecx, 0x5a2d3620
xor ecx, 0x68e93342
xor ecx, 0x4c645ddf
xor ecx, 0x25b86a3c
xor ecx, 0x62d07170
xor ecx, 0x1788ecb0
xor ecx, 0x5b7c9a3f
xor ecx, 0x570e28de
xor ecx, 0x45fc0029
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x423007
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x42310a
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8

Function at 0x424f39
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push 0
push 0
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x424f86
push 6
call fcn.0046cc8f
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x424f9d
mov eax, 0x4996d7
jmp 0x42501f
push 0x80000301
push 0
push dword [ebp + 0xc]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0046d910
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x424fda
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x425000
push 6
call fcn.0046cc8f
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x42501a
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42501f
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x425030
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x425a81
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
jmp 0x425a96
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push esi
xor esi, esi
nop
mov eax, reloc.WSOCK32.dll_getsockname
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, getsockname
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0xb94f70cd
mov eax, reloc.WSOCK32.dll_getsockname
cpuid
shr ecx, 0x10
add esi, ecx
nop
nop
mov eax, getsockname
cpuid
shr edx, 0x18
shr ecx, 0x18
add edx, ecx
add esi, edx
nop
mov eax, 1
xor edx, edx
cpuid
add esi, edx
xor esi, eax
rdtsc
add esi, edx
xor esi, 0x84806cb7
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4270b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
jmp 0x4270ca
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
push ebx
mov ebx, 1
mov ebx, 2
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 4
mov ebx, 2
mov ebx, 5
mov ebx, 5
pop ebx
push edx
push ecx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea ecx, ds:[esi*4]
mov ecx, dword [eax + ecx]
xor ecx, 0x35b81e3
xor ecx, 0x58bfbed3
xor ecx, 0x3f7fd214
xor ecx, 0x68cc610f
xor ecx, 0x9de286b
xor ecx, 0x27c8273b
xor ecx, 0x236ac5c9
xor ecx, 0x5b86e547
xor ecx, 0x5a510045
xor ecx, 0x349c206a
xor ecx, 0x77fc18fd
xor ecx, 0x544fb449
xor ecx, 0x432028be
xor ecx, 0x7d5c34f0
xor ecx, 0x4f678c6b
xor ecx, 0x7dba083c
xor ecx, 0x6b3828db
xor ecx, 0x2c8baceb
xor ecx, 0x2413bc01
xor ecx, 0x25097cc9
xor ecx, 0x4ab0a136
xor ecx, 0x13a7f90f
xor ecx, 0x26292c2
xor ecx, 0x62af7d00
xor ecx, 0x2903c7d9
xor ecx, 0x45fc0029
xor ecx, 0x570e28de
xor ecx, 0x5b7c9a3f
xor ecx, 0x1788ecb0
nop
nop
nop
nop
nop
nop
lea edx, ds:[esi*4]
mov dword [eax + edx], ecx
add esi, 1
cmp esi, dword [ebp + 0xc]
jne 0x42713c
pop esi
pop ecx
pop edx
nop
push ecx
push eax
mov eax, 1
mov ecx, 2
mov eax, 4
mov ecx, 2
pop eax
pop ecx
nop
jmp 0x42723f
nop
nop
nop
nop
nop
nop
mov esp, ebp
pop ebp
ret 8

Function at 0x4273cf
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
jmp 0x4273f1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pushal
mov eax, 1
mov eax, 2
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 4
mov eax, 2
mov eax, 5
mov eax, 6
popal
fninit
mov dword [ebp - 8], esp
push 0
call dword [0x5f5ef2]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x427452
push 6
call fcn.0046cc8f
add esp, 4
push 0x80000301
push 0
push dword [0x5f5dd6]
push 1
mov ebx, 0xc
mov eax, 0x4751a0
call fcn.0046d760
add esp, 0x10
push dword [ebp + 8]
call fcn.00427525
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x427495
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x80000301
push 0
push dword [0x5f5dd6]
push 1
mov ebx, 0x10
mov eax, 0x4751c0
call fcn.0046d760
add esp, 0x10
mov eax, dword [ebp - 4]
test eax, eax
je 0x4274d9
push eax
mov ebx, eax
call fcn.00401346
inc eax
push eax
call fcn.0046cc83
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x42750d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x42751e
push ebx
call fcn.0046cc7d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4