joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086860
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x100ae210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
cmp edi, 8
mov dword [ebp - 0x50], eax
ja 0x10086895
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.1007eb10
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.10086960
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.10086750
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.10086960
xor eax, eax
push 0x40
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push eax
add esi, 0x28
push esi
call fcn.1007eb10
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1007b431
mov esp, ebp
pop ebp
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4041cc
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040405d
mov ecx, 0x1f1
call 0x4041cc
rcr dword [esi + 0x30], 0x4c
push cs
pop es
xor byte [esi + ecx + 7], cl
loop 0x4041cf
ljmp 0xcb6:0xda8d5821

Function at 0x40a4a1
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x4fb8
add byte [ebp - 0x3d], bl
nop
nop
invalid
nop
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4b92bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1410
cmp edx, dword [eax]
je 0x4b92df
add eax, 8
inc ecx
cmp eax, 0x4c14a0
jl 0x4b92d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1410]
jne 0x4b940d
mov eax, dword [0x4c5d9c]
cmp eax, 1
je 0x4b93e7
test eax, eax
jne 0x4b9310
cmp dword [0x4c1338], 1
je 0x4b93e7
cmp edx, 0xfc
je 0x4b940d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b9347
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b9ca0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba130
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b938a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba130
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be83c
push edi
call fcn.004bc000
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b9ca0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9cb0
lea eax, [ebp - 0xa0]
push 0x4be81c
push eax
call fcn.004b9cb0
push dword [esi + 0x4c1414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9cb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bbf74
add esp, 0x2c
pop edi
jmp 0x4b940d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1414]
push 0
push eax
push dword [esi]
call fcn.004ba130
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40b890
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x464504]
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
cmp byte [0x45d698], 0
mov ecx, esp
mov dword [0x464504], ecx
mov dword [esp], eax
mov dword [esp + 4], str.Kernel.AllocHeapMem
je 0x40b8d2
cmp ebx, 0xfffffff0
jle 0x40b91e
cmp ebx, 0xffef
jle 0x40b944
jmp 0x40b95c
mov ebp, 0x60000000
nop word [eax + eax]
push 0x40
push 0x2000
push ebp
push 0x1000000
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
jne 0x40b9a8
push 0x40
push 0x2000
push ebp
push 0
call sub.KERNEL32.dll_VirtualAlloc
sar ebp, 1
je 0x40b911
test eax, eax
je 0x40b8e0
test eax, eax
jne 0x40b9aa
jmp 0x40ba0c
push 0x464504
push 0x6e
call fcn.00401380
add esp, 8
push 0x428
push str.Kernel.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
push 0x10000
push 9
push dword [0x45d69c]
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test esi, esi
jne 0x40b977
add ebx, 0x10
push ebx
push 9
push dword [0x45d69c]
call sub.KERNEL32.dll_HeapAlloc
mov esi, eax
test esi, esi
je 0x40ba0c
lea eax, [esi + 0xf]
and eax, 0xfffffff0
mov dword [edi], eax
mov dword [eax + 8], esi
push esi
push 1
push dword [0x45d69c]
call sub.KERNEL32.dll_HeapSize
mov ecx, dword [edi]
sub esi, ecx
add esi, eax
mov dword [ecx], esi
add dword [0x45c65c], esi
mov eax, dword [ecx]
add dword [0x45c660], eax
jmp 0x40ba12
sar ebp, 1
push 0x40
push 0x1000
push 0x400
push eax
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
test esi, esi
jne 0x40b9e8
push 0x464504
push 0x6f
call fcn.00401380
add esp, 8
push 0x447
push str.Kernel.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
add ebp, ebp
mov dword [edi], esi
mov dword [esi + 8], ebp
mov dword [esi], 0
mov dword [esi + 4], 0
push edi
push ebx
call fcn.0040ba80
add esp, 8
mov eax, dword [edi]
cmp dword [eax], ebx
jge 0x40ba12
mov dword [edi], 0
mov eax, dword [esp]
mov dword [0x464504], eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40ba80
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
sub esp, 8
mov eax, dword [0x464504]
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov dword [esp], eax
mov eax, esp
mov dword [esp + 4], str.Kernel.GrowHeapMem
mov dword [0x464504], eax
mov eax, dword [edi]
cmp dword [eax], esi
jle 0x40bad2
push 0x464504
push 0x6e
call fcn.00401380
add esp, 8
push 0x415
push str.Kernel.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
mov eax, dword [edi]
cmp dword [eax + 8], esi
jl 0x40bb0d
add esi, 0x3ffff
and esi, 0xfffc0000
push 0x40
push 0x1000
push esi
push eax
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x40bb0d
mov eax, dword [edi]
mov ecx, esi
mov edx, esi
sub ecx, dword [eax]
add dword [0x45c65c], ecx
sub edx, dword [eax]
add dword [0x45c660], edx
mov dword [eax], esi
mov eax, dword [esp]
mov dword [0x464504], eax
add esp, 8
pop esi
pop edi
ret
Function at 0x411870
Capabilities:
Check http status code
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x220
mov eax, dword [0x464504]
mov edi, dword [esp + 0x234]
mov esi, esp
mov dword [0x464504], esi
mov dword [esp], eax
mov dword [esp + 4], str.HostFiles.Delete
cmp word [edi], 0
jne 0x4118cb
push 0x464504
push 0x64
call fcn.00401380
add esp, 8
push 0x271
push str.HostFiles.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
mov esi, dword [0x464504]
lea eax, [esp + 0x14]
push 0x20c
push 0
push eax
call fcn.00420480
add esp, 0xc
lea eax, [esp + 8]
mov dword [esp + 8], esi
mov dword [esp + 0xc], str.HostFiles.ThisFile
mov dword [esp + 0x10], 0x456e4c
mov dword [0x464504], eax
lea eax, [esp + 0x18]
push 0x104
push eax
push edi
call fcn.00401e00
add esp, 0xc
lea ebx, [esp + 0x10]
push 0x457128
push ebx
call fcn.00409d50
add esp, 8
mov ecx, dword [esp + 8]
mov esi, eax
test esi, esi
mov dword [0x464504], ecx
je 0x4119e3
mov eax, dword [esi + 0x230]
cmp eax, 0xffffffff
je 0x411959
push eax
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [esp + 0x23c]
mov dword [ecx], eax
mov dword [esi + 0x230], 0xffffffff
push edi
call sub.KERNEL32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4119fc
test al, 1
jne 0x411a22
xor ebp, ebp
call sub.KERNEL32.dll_GetTickCount
mov edi, eax
nop dword [eax]
lea eax, [edi + ebp]
push eax
push ebx
push dword [esp + 0x240]
call fcn.00415530
add esp, 0xc
push ebx
push dword [esp + 0x238]
call sub.KERNEL32.dll_MoveFileW
test eax, eax
jne 0x411a41
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esp + 0x23c]
cmp eax, 0x56
mov dword [ecx], eax
jle 0x4119d0
cmp eax, 0xb7
je 0x4119d5
cmp eax, 0x57
je 0x4119d5
jmp 0x411a6d
cmp eax, 0x50
jne 0x411a50
inc ebp
cmp ebp, 0xc8
jne 0x411980
jmp 0x411a6d
push edi
call sub.KERNEL32.dll_DeleteFileW
test eax, eax
je 0x411a31
mov eax, dword [esp + 0x23c]
mov dword [eax], 0
jmp 0x411a6d
push 0x464504
push 0x65
call fcn.00401380
add esp, 8
push 0x27f
push str.HostFiles.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
mov eax, dword [esp + 0x23c]
mov dword [eax], 0x13
jmp 0x411a6d
call sub.KERNEL32.dll_GetLastError
mov ecx, dword [esp + 0x23c]
mov dword [ecx], eax
jmp 0x411a6d
mov eax, dword [esp + 0x23c]
mov dword [eax], 0
jmp 0x411a54
test eax, eax
jne 0x411a6d
mov dword [esi + 0x24], 3
add esi, 0x28
push 0x104
push esi
push ebx
call fcn.00401e00
add esp, 0xc
mov eax, dword [esp]
mov dword [0x464504], eax
add esp, 0x220
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x415840
Capabilities:
Delete file

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x464504]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp + 0x2c]
mov dword [esp + 4], eax
lea eax, [esp + 4]
mov dword [esp + 8], str.HostFiles.CloseFile
mov dword [0x464504], eax
mov ebp, dword [ebx + 0x24]
cmp ebp, 4
jne 0x41589d
mov eax, dword [ebx - 4]
push ebx
call dword [eax - 0x10]
add esp, 4
lea eax, [ebx + 0x230]
mov dword [esp], eax
push dword [ebx + 0x230]
call sub.KERNEL32.dll_FlushFileBuffers
mov dword [esi], eax
mov edi, esi
mov ebp, dword [ebx + 0x24]
mov eax, dword [0x464504]
jmp 0x4158a8
lea ecx, [ebx + 0x230]
mov edi, esi
mov dword [esp], ecx
mov dword [ebx + 0x24], 5
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
mov dword [esp + 0x10], str.HostFiles.CloseFileHandle
xor esi, esi
mov dword [0x464504], eax
mov eax, dword [ebx + 0x230]
cmp eax, 0xffffffff
je 0x4158e2
push eax
call sub.KERNEL32.dll_CloseHandle
test eax, eax
jne 0x4158e2
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [edi], esi
mov ecx, 0xb
mov eax, dword [esp]
bt ecx, ebp
mov dword [eax], 0xffffffff
mov eax, dword [esp + 0xc]
mov dword [0x464504], eax
jae 0x415912
cmp word [ebx + 0x28], 0
je 0x415912
add ebx, 0x28
push ebx
call sub.KERNEL32.dll_DeleteFileW
mov dword [edi], eax
mov eax, dword [esp + 4]
mov dword [0x464504], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x415ad0
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [0x464504]
mov esi, dword [esp + 0x20]
lea edx, [esp + 4]
mov dword [0x464504], edx
cmp eax, 4
mov dword [esp + 4], ecx
mov dword [esp + 8], str.HostFiles.FlushBuffer
jb 0x415b27
push 0x464504
push 0xfffffffffffffff9
call fcn.00401380
add esp, 8
push 0x29e
push str.HostFiles.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
xor eax, eax
mov edi, dword [esi + eax*4 + 0x240]
test edi, edi
je 0x415be7
cmp byte [edi], 0
je 0x415be7
mov eax, dword [esi + 0x230]
cmp eax, 0xffffffff
jne 0x415b67
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00415c00
add esp, 8
mov eax, dword [esi + 0x230]
cmp eax, 0xffffffff
je 0x415be7
mov dword [esp], 0
mov ebx, esp
push 0
push ebx
push dword [edi + 4]
push eax
call sub.KERNEL32.dll_SetFilePointer
mov dword [esp], eax
lea eax, [edi + 0xc]
push 0
push ebx
push dword [edi + 8]
push eax
push dword [esi + 0x230]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x415ba0
mov eax, dword [esp]
cmp eax, dword [edi + 8]
jge 0x415bcf
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 0xc], eax
push 0x464504
push 0x65
call fcn.00401380
add esp, 8
push 0x2a8
push str.HostFiles.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
mov byte [edi], 0
call sub.KERNEL32.dll_GetTickCount
mov dword [esi + 0x250], eax
mov dword [esi + 0x254], 0
mov eax, dword [esp + 4]
mov dword [0x464504], eax
add esp, 0x10
pop esi
pop edi
pop ebx
ret
Function at 0x415cc0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x21c
mov eax, dword [0x464504]
mov edi, dword [esp + 0x230]
mov ecx, esp
mov esi, dword [esp + 0x234]
mov dword [0x464504], ecx
mov dword [esp], eax
mov dword [esp + 4], str.HostFiles.CreateDir
cmp word [edi], 0
jne 0x415d1c
push 0x464504
push 0x64
call fcn.00401380
add esp, 8
push 0x2ff
push str.HostFiles.c
push 0x43d25a
call fcn.00424f0d
add esp, 0xc
lea ebx, [esp + 8]
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
push ebx
push edi
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
mov dword [esi], eax
je 0x415d4d
mov dword [esi], 0
jmp 0x415d79
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
and eax, 0xfffffffe
cmp eax, 2
jne 0x415d79
lea ebp, [esp + 0x14]
push ebp
push edi
call fcn.00415df0
add esp, 8
push esi
push ebp
call fcn.00415cc0
add esp, 8
cmp dword [esi], 0
je 0x415d8c
mov eax, dword [esp]
mov dword [0x464504], eax
add esp, 0x21c
pop esi
pop edi
pop ebx
pop ebp
ret
push ebx
push edi
call sub.KERNEL32.dll_CreateDirectoryW
test eax, eax
mov dword [esi], eax
jne 0x415d45
call sub.KERNEL32.dll_GetLastError
mov dword [esi], eax
jmp 0x415d79
Function at 0x41a310
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x464504]
mov edi, dword [esp + 0x18]
mov dword [esp], eax
mov eax, esp
mov dword [esp + 4], str.OmcObjLoader.AllocModMem
mov dword [0x464504], eax
mov eax, dword [0x45d9ac]
mov ecx, dword [eax - 4]
push eax
call dword [ecx - 0x14]
add esp, 4
mov esi, eax
mov eax, dword [edi + 0x30]
mov ecx, dword [edi + 0x34]
mov dword [edi + 0x130], eax
add ecx, dword [edi + 0x2c]
test esi, esi
mov dword [edi + 0x134], ecx
mov dword [edi + 0x138], 0
je 0x41a3b2
xor eax, eax
mov ebx, 0xffffffff
nop dword [eax]
test eax, eax
jne 0x41a39d
push 0x40
push 0x3000
push dword [edi + 0x130]
push esi
call sub.KERNEL32.dll_VirtualAlloc
inc ebx
add esi, 0x1000000
mov dword [edi + 0x138], eax
cmp ebx, 0x63
jb 0x41a370
test eax, eax
je 0x41a3cd
mov eax, dword [edi + 0x134]
test esi, esi
je 0x41a3e9
push 0x40
push 0x3000
push eax
push esi
jmp 0x41a3f3
push 0x40
push 0x3000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov dword [edi + 0x138], eax
xor esi, esi
test eax, eax
jne 0x41a39d
mov dword [edi + 0x13c], 0
cmp dword [0x45ea80], 0
jg 0x41a4cd
jmp 0x41a557
push 0x40
push 0x3000
push eax
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
mov dword [edi + 0x13c], eax
je 0x41a4a4
cmp dword [0x45ea80], 3
mov bl, 1
jl 0x41a559
push 0x10
push str.Desc_addr_size
call dword [0x45ea7c]
add esp, 8
push dword [edi + 0x138]
call dword [0x45ea74]
add esp, 4
mov eax, dword [edi + 0x130]
mov ecx, eax
sar ecx, 0x1f
push ecx
push eax
call dword [0x45ea78]
add esp, 8
push 0x10
push str._Mod_addr_size
call dword [0x45ea7c]
add esp, 8
push dword [edi + 0x13c]
call dword [0x45ea74]
add esp, 4
mov eax, dword [edi + 0x134]
mov ecx, eax
sar ecx, 0x1f
push ecx
push eax
call dword [0x45ea78]
add esp, 8
push 0xd
push str._Alast_addr
call dword [0x45ea7c]
add esp, 8
push esi
call dword [0x45ea74]
add esp, 4
call dword [0x45ea6c]
jmp 0x41a559
push 0x8000
push 0
push dword [edi + 0x138]
call sub.KERNEL32.dll_VirtualFree
mov dword [edi + 0x138], 0
cmp dword [0x45ea80], 0
jle 0x41a557
push 0x11
push str._Desc_addr_size
call dword [0x45ea7c]
add esp, 8
push dword [edi + 0x138]
call dword [0x45ea74]
add esp, 4
mov eax, dword [edi + 0x130]
mov ecx, eax
sar ecx, 0x1f
push ecx
push eax
call dword [0x45ea78]
add esp, 8
push 0x10
push str._Mod_addr_size
call dword [0x45ea7c]
add esp, 8
push dword [edi + 0x13c]
call dword [0x45ea74]
add esp, 4
mov eax, dword [edi + 0x134]
mov ecx, eax
sar ecx, 0x1f
push ecx
push eax
call dword [0x45ea78]
add esp, 8
push 0xd
push str._Alast_addr
call dword [0x45ea7c]
add esp, 8
push esi
call dword [0x45ea74]
add esp, 4
call dword [0x45ea6c]
xor ebx, ebx
mov eax, dword [esp]
mov dword [0x464504], eax
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0x431928
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004318aa

Function at 0x439ffa
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00439e70
Function at 0x54ee90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x11d000]
push edi
jmp 0x54eeaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54eeb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54eea0
mov eax, 1
add ebx, ebx
jne 0x54eec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54eed4
jne 0x54eef3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54eef3
dec eax
add ebx, ebx
jne 0x54eee0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54eeb8
add ebx, ebx
jne 0x54eeef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x54ef45
xor ecx, ecx
sub eax, 3
jb 0x54ef0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54ef7a
sar eax, 1
mov ebp, eax
jmp 0x54ef16
add ebx, ebx
jne 0x54ef16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54eee4
inc ecx
add ebx, ebx
jne 0x54ef24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54eee4
add ebx, ebx
jne 0x54ef31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54ef26
jne 0x54ef42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54ef26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54ef64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54ef56
jmp 0x54eea6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54ef64
add edi, ecx
jmp 0x54eea6
pop esi
mov edi, esi
mov ecx, 0x26d7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54ef82
cmp byte [edi], 9
jne 0x54ef82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x54ef87
lea edi, [esi + 0x142000]
mov eax, dword [edi]
or eax, eax
je 0x54efff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x150958]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x150ad4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54efb4
mov ecx, edi
jns 0x54efe3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x150adc]
or eax, eax
je 0x54eff9
mov dword [ebx], eax
add ebx, 4
jmp 0x54efd1
call dword [esi + 0x150ad8]
mov ebp, dword [esi + 0x150ae0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x31f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x54f033
sub esp, 0xffffff80
jmp 0x4028c8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405e80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x240
lea eax, [esp + 0x13c]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x148]
push str.svchost.exe
push ecx
call sub.MSVCRT.dll_strstr
add esp, 8
test eax, eax
jne 0x405f83
lea edx, [esp + 0x148]
push 0x409eb0
push edx
call sub.MSVCRT.dll_fopen
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x405f83
lea eax, [esp + 0xc]
lea ecx, [esp + 0x68]
push eax
lea edx, [esp + 0x14]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
push ebx
call fcn.00405830
add esp, 0x14
test al, al
je 0x405f6b
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x68]
push ecx
lea eax, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.00405970
add esp, 0x10
mov edi, eax
push 0x40
push 0x1000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
je 0x405f83
mov edx, dword [esp + 0xc]
push esi
lea eax, [esp + 0x6c]
push edx
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x34]
push ecx
push edx
push ebx
call fcn.00405a00
mov eax, dword [esp + 0x24]
push edi
push esi
lea ecx, [esp + 0x88]
push eax
lea edx, [esp + 0x34]
push ecx
lea eax, [esp + 0x50]
push edx
push eax
call fcn.00405c90
add esp, 0x30
push ebx
call sub.MSVCRT.dll_fclose
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x240
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x240
ret

Function at 0x40d3ff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cld
mov ecx, 0x89e7ccf9
dec edi
adc cl, ch
or ecx, 0xffffffff
inc ecx
xchg bh, bh
xchg bh, bh
wait
lodsd eax, dword [esi]
nop
mov ecx, ecx
nop
lea edi, [eax + ebx]
not ch
not ch
cld
nop
cmp ecx, dword [edx + 0x18]
jmp 0x40d406
add esi, dword [edi + eax*4]
ret 4
sbb eax, 0x5d
add edi, dword [edx + 0x1c]
add esi, dword [edx + 0x24]
movzx eax, word [esi + ecx*2]
not edx
not edx
cmp edx, ebx
mov esi, ebx
jmp 0x40d228
mov cl, 0x2d
xchg cl, ch
or ch, 0x73
sub al, cl
xchg cl, al
mov al, 1
not ah
dec edi
mov esi, ebx
mov eax, ebx
add eax, dword [ebx + 0x3c]
mov cl, 0xa9
xchg cl, cl
not ecx
add edi, ebp
inc ecx
mov cl, 0x9e
mov edi, 0xca81c23d
cld
add edx, dword [eax + 0x78]
nop
mov ch, al
or cl, 0x65
add esi, dword [edx + 0x20]
jmp 0x40d200
ret
mov edx, ebx
jmp 0x40d3b7
je 0x40d3fe
and eax, 0
imul eax, eax, 0xf
stc
push eax
movzx eax, byte [edi]
jmp 0x41209b
xor eax, 0xd69ca326
sub eax, dword [esp + 4]
cld
nop
jne 0x40d20c
and eax, 0xffffffbc
not ah
mov edi, ebx
mov esi, ebx
jmp 0x40d298
sub dword [esp], eax
inc edi
wait
cmp byte [edi], 0
mov cl, cl
pop eax
xchg edi, esp
xchg edi, esp
not bh
not bh
ja 0x40d40f
jmp 0x40d5a4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219