joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b576
Capabilities:
Encode data using xor

Disassembly:
arpl word [esp + edi*8 - 2], cx
mov ecx, 0x9e20ca38
inc esi
inc ebx
mov edx, 0x4acfa3a3
test esp, 0x1e2fa01f
pop esp
dec esi
mov eax, 0x1c011eeb
xlatb
aad 0x15
mov ebx, 0xdc78cc7d
in al, dx
push 0x76a34496
jmp 0x43b4da
inc esp
mov dword [0xfaeb6476], eax
inc edi
call 0x50d1e016
push ss
xor ebp, edx
and edi, esp
cmp al, byte [edi]
mov word [ebp + 3], cs
into
out 0xd6, al
sti
push ebx
not ebx
pop esp
mov ebp, 0x5bb93b30
xchg ebp, eax
rol dword [edx], 0x6a
sbb eax, 0x5f27e31a
jmp 0x43b587
movsb byte es:[edi], byte [esi]
inc edi
add eax, 0x2b5b5ac6
mov esi, 0xdd51c6a7
loop 0x43b4b1
retf 0x782b
out 0xc5, al
jl 0x43b585
xchg byte [edi + 0x18], dh
cmp al, 0x3a
movsb byte es:[edi], byte [esi]
out 0x3e, al
jns 0x43b5e8
jae 0x43b50d
xchg byte [edi], dh
aaa
daa
mov dl, 0x3f
in al, dx
fidiv dword [edi - 0x31]
push ebp
movsb byte es:[edi], byte [esi]
xor al, 0xfa
jmp 0x43b586
mov ebx, 0x30553207
cmc
jne 0x43b614
movsb byte es:[edi], byte [esi]
invalid
adc dl, bl
inc ebp
cmp byte [edi], ch
cmp al, 0x3b
sub edx, dword [ebp - 0x70]
scasb al, byte es:[edi]
sub ecx, dword [edi]
shr dl, 1
jnp 0x43b66a
sub byte [esi + 0x3ecafe9a], bl
xchg ecx, eax
pop edi
je 0x43b5bc
sub bh, byte [edi + 0xc916640]
jg 0x43b61b
cmp esp, dword [ebp - 0x14]
in al, dx
fistp dword [ecx]
fdiv st(1), st(0)
and esp, dword [ebp - 0x35]
sub ebx, edi
cmp eax, 0x83e5f90
cmp al, 0x26
retf
or byte [esi], bh
test eax, 0x3a8a1c46
and al, 0x73
fidiv dword [edx + 0x61]
add eax, 0x223b16ca
pop ss
xor cl, byte [eax]
sbb al, 0xb2
jb 0x43b60d
hlt
std
adc al, 0x3c
cmp al, dl
aam 0x8b
in al, dx
test eax, 0x49debde5
aaa
mov cl, 0xb6
sub ecx, dword [edi]
test eax, 0x6f3057a1
retf 0x75a8
Function at 0x5af7a5
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x20
jno 0x5af767
out dx, al
mov al, byte [0xd01339d7]
fcmovnb st(0), st(7)
invalid
adc dword [edi + esi*4 + 0x72ab176d], edi
fiadd dword [esi + 0x16fcadaf]
sbb dh, 0x25
and eax, 0xb00e0bec
add eax, 0xbfa2bd02
jecxz 0x5af7f9
and eax, 0xb00e0bec
add eax, 0xbfa2bd02
jecxz 0x5af7f9
xor byte [edi + 0x34b3e437], dh
cmp ah, dh
cmp esi, esi
loopne 0x5af762
sbb eax, 0x5088b715
xchg esp, eax
mov byte [eax - 0x6c], dl
sub dword [esi + edi*8 + 0x33], edx
push edx
mov byte gs:[0x6b2702e6], al
sub edi, ecx
push esi
xor cl, byte [edi + 0x2e32afe]
ja 0x5af796
adc dword [edi], ebx
jo 0x5af7f3
sbb dword [ebx - 0x4b], 0x7b910e20
aaa
salc
push ds
jmp 0x5af7c0
xchg edx, eax
mov edi, 0x6de54479
aad 0x72
lcall 0x4ac0, 0xc9ac42c
mov ah, 0x35
invalid

Function at 0x5fc6ff
Capabilities:
Authenticate hmac

Disassembly:
or ah, ah
push 1
mov byte [0xffdb4465], al
in al, 0x6a
add dword [edx - 0x24bb9b], esp
mov bl, 0x84
push ebp
adc eax, 0xe3eba217
shl dword [edx], cl
adc esi, dword [0x25cf804b]
imul ebx, dword [ecx], 0xffffffcc
adc edi, esi
jne 0x5fc746
pushal
stosd dword es:[edi], eax
push ebp
test eax, 0x49c28a4f
mov dword [0x8e721020], eax
jecxz 0x5fc751
sbb al, 0xb4
daa
push cs
cdq
push ebx
cdq
je 0x5fc6ca
mov ch, 0x98
inc eax
sal esp, cl
bound edx, qword [edi]
aas
imul ebp, dword gs:[edx - 0x2d], 0x47
or eax, 0x6e24568a
adc dword [ebx + 0x2a3c3fd0], edi
inc eax
enter 0xffffffffffffa99c, 0xffffffffffffffc2
inc eax
int3
enter 0x1b2f, 0xffffffffffffffe4
jmp 0x5fc759
jns 0x5fc6cb
scasd eax, dword es:[edi]
retf 0x4a9f
je 0x5fc740
xchg dword [ebx - 0x5c], esi
and dh, ah
lcall 0x562a, 0x1ce609c4
invalid
les ecx, [ecx]
out 0x1c, al
sub dl, byte [esi - 0x39]
jmp 0x5fc772
invalid
Function at 0x407e30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407f09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407e68
mov eax, dword [ebp - 4]
call fcn.00407220
jmp 0x407e70
mov eax, dword [ebp - 4]
call fcn.00407c1c
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407ebc
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407ea6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.00407220
jmp 0x407eb8
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407c1c
inc ebx
dec esi
jne 0x407e80
push 1
push dword [ebp - 4]
push 0x407f20
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f84
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407f10
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
nop
mov ebx, 0x408ecc
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x13882ef6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x41266fd
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x9dccd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x9dcd1c
mov cl, byte [ebx + esi]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [ebx + esi], cl
inc esi
cmp esi, edi
jb 0x9dcce2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x9dcd80
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9dcdd2
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x9dcdd8
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x9f52c5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f4f85

Function at 0x9fa0bf
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.009f9f3e

Function at 0x9ff670
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x9ff69d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x9ff69d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x18d69ff
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, str.p__
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x20302fd0
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x406cd0
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x1c0
mov eax, dword [0x41304c]
xor eax, esp
mov dword [esp + 0x1b8], eax
push ebx
push esi
push edi
lea eax, [esp + 0x30]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
xor eax, eax
cmp dword [0x4161d8], 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], eax
mov eax, dword [0x4161c4]
mov dword [esp + 0xc], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 6
jae 0x406d45
mov eax, 0x4161c4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x406d98
mov esi, dword [esp + 0xc]
test esi, esi
je 0x406d91
mov edi, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov ebx, dword [sym.imp.MSVCR90.dll_strcpy_s]
mov eax, dword [esi + 0x18]
mov eax, dword [eax + 4]
push eax
call edi
push eax
push 0x64
push 0x415c60
call ebx
mov esi, dword [esi + 0x1c]
add esp, 0xc
test esi, esi
jne 0x406d70
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040c1a6
add esp, 0x1c0
ret
Function at 0x407c30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x5c
push esi
push 0x44
lea eax, [esp + 0x1c]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x84]
push eax
push 0
mov dword [esp + 0x40], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop esi
add esp, 0x5c
ret

Function at 0x407f10
Capabilities:
Terminate process

Disassembly:
sub esp, 0x444
mov eax, dword [0x41304c]
xor eax, esp
mov dword [esp + 0x43c], eax
push 0x434
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call sub.MSVCR90.dll_memset
add esp, 0xc
call fcn.00407bd0
lea edx, [esp]
jmp 0x407f50
movzx ecx, word [eax]
mov word [edx], cx
add eax, 2
add edx, 2
test cx, cx
jne 0x407f50
lea ecx, [esp]
push ecx
call fcn.00407c30
add esp, 4
push 0
call dword [sym.imp.MSVCR90.dll_exit]
int3

Function at 0x407f80
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test edi, edi
jle 0x407fb2
mov ebx, dword [sym.imp.WS2_32.dll_recv]
mov edx, dword [0x413528]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x407fb8
add esi, eax
cmp esi, edi
jl 0x407f93
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x407fc0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor esi, esi
test edi, edi
jle 0x407ff2
mov ebx, dword [sym.imp.WS2_32.dll_send]
mov edx, dword [0x413528]
push 0
mov eax, edi
sub eax, esi
push eax
lea ecx, [esi + ebp]
push ecx
push edx
call ebx
cmp eax, 0xffffffff
je 0x407ff8
add esi, eax
cmp esi, edi
jl 0x407fd3
pop esi
pop ebp
mov al, 1
pop ebx
ret
pop esi
pop ebp
xor al, al
pop ebx
ret

Function at 0x408000
Capabilities:
Send data
Send data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_htonl]
mov edi, dword [sym.imp.WS2_32.dll_send]
mov dword [esp + 0xc], eax
xor esi, esi
lea esp, [esp]
mov eax, dword [0x413528]
push 0
mov ecx, 4
sub ecx, esi
push ecx
lea edx, [esp + esi + 0x14]
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x408048
add esi, eax
cmp esi, 4
jl 0x408020
pop edi
mov al, 1
pop esi
ret
pop edi
xor al, al
pop esi
ret
Function at 0x4081a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x40cfd9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
push edi
mov eax, dword [0x41304c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
lea edi, [esp + 0xc]
call fcn.00408050
test al, al
je 0x408201
mov eax, dword [esp + 0xc]
inc eax
push eax
call fcn.0040ba54
mov ecx, dword [esp + 0x10]
mov esi, eax
mov byte [esi + ecx], 0
mov edi, dword [esp + 0x10]
push esi
call fcn.00407f80
add esp, 8
test al, al
jne 0x408215
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
xor al, al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x2c], esp
push esi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea ecx, [esp + 0x30]
call fcn.004096d0
add esp, 0x1c
mov ecx, dword [esp + 0x40]
push eax
mov dword [esp + 0x3c], 0
call dword [0x40f158]
lea ecx, [esp + 0x14]
mov dword [esp + 0x38], 0xffffffff
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push esi
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x30
ret
Function at 0x409940
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x510
mov eax, dword [0x41304c]
xor eax, esp
mov dword [esp + 0x50c], eax
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x116]
push ecx
mov word [esp + 0x118], ax
call sub.MSVCR90.dll_memset
xor edx, edx
push 0x102
push edx
lea eax, [esp + 0x1e]
push eax
mov word [esp + 0x20], dx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
mov dword [esp + 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [esp]
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 8], 0x64
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea edx, [esp + 0x10c]
push edx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
lea eax, [esp + 0xc]
push eax
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
mov ecx, dword [esp + 0x514]
add esp, 8
xor ecx, esp
call fcn.0040c1a6
add esp, 0x510
ret
Function at 0x40c1a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41304c]
jne 0x40c1b0
repz ret
jmp fcn.0040c6c0

Function at 0x4282a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x17000]
push edi
jmp 0x4282ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4282c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4282b0
mov eax, 1
add ebx, ebx
jne 0x4282d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4282c8
jne 0x4282e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4282c8
xor ecx, ecx
sub eax, 3
jb 0x4282f8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42836a
mov ebp, eax
add ebx, ebx
jne 0x428303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428310
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x428334
inc ecx
add ebx, ebx
jne 0x428320
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x428315
jne 0x428331
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428315
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x428354
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x428345
jmp 0x4282b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x428354
add edi, ecx
jmp 0x4282b6
pop esi
mov edi, esi
mov ecx, 0x115
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x428372
cmp byte [edi], 3
jne 0x428372
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x428377
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x4283e6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x28000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x280c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4283a4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x280cc]
or eax, eax
je 0x4283e0
mov dword [ebx], eax
add ebx, 4
jmp 0x4283c1
call dword [esi + 0x280c8]
mov ebp, dword [esi + 0x280d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42841a
sub esp, 0xffffff80
jmp 0x409ac0
Function at 0x409888
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40995b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409974
push ebx
push 0x409980
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409908
mov al, 0x62
call fcn.00409460
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040985c
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409911
call fcn.0040985c
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409962
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409a14
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
jmp 0x409abd
cmp dword [esi + 0x10], 0x1000
jne 0x409aa9
test byte [esi + 0x15], 1
jne 0x409aa9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409a68
cmp eax, 2
je 0x409a68
cmp eax, 0x10
je 0x409a68
cmp eax, 0x20
jne 0x409a7d
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409a7d
mov bl, 1
xor ebp, ebp
jmp 0x409a8e
mov eax, dword [esi]
add eax, ebp
call fcn.00409a0c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409a81
test bl, bl
je 0x409aa9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409ac8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409a40
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x403015
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403024
pop dword [ebp - 0x4c]
mov eax, 0x403024
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x600d915c
sub dword [ebp - 0x5c], 0x11bb4c11
mov dword [ebp - 0x58], 0x23e859b9
add dword [ebp - 0x58], 0xe4af28c
mov dword [ebp - 0x54], 0xd624c3de
add dword [ebp - 0x54], 0x76278050
mov dword [ebp - 0x50], 0x21cb085b
add dword [ebp - 0x50], 0xde34f7a5
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x9df91f49
add eax, 0x6247612f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xea786658
sub dword [ebp - 0x5c], 0x7605fd02
mov dword [ebp - 0x58], 0xc56f8f8
sub dword [ebp - 0x58], 0xcaea9783
mov dword [ebp - 0x54], 0xe89a6413
add dword [ebp - 0x54], 0x7ad50859
mov dword [ebp - 0x50], 0x3e25ea35
add dword [ebp - 0x50], 0xc1da15cb
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x6298c70e
add eax, 0x9da7b96e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c59c
push 0
call eax
mov ecx, 0x5d40
mov edx, eax
mov ebx, 0x43c1c985
add ebx, 0xbc834a7b
add ebx, dword [ebp - 0x4c]
mov esi, 0x4b431c13
sub esi, 0x2c9ff633
sub dword [ebp - 8], edi
mov edi, dword [ebx]
mov dword [ebp - 4], 0xf744ffbf
xor edi, esi
add dword [ebp - 4], 0x2644c841
mov dword [edx], edi
add edx, 4
add ebx, 4
loop 0x40313b
add eax, 0x43401f4d
sub eax, 0x433eb77a
mov ebx, eax
add eax, 0x9d91c783
sub eax, 0x9d91c77e
mov ecx, 0x4cad7328
add ecx, 0xb3928cd8
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x409e75
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x409eb4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x409eb4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409eb4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x409eb4
cmp dword [ecx + 0x74], 0xe
jbe 0x409eb4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40e3ba
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x45b03c
push str.FlsAlloc
push 0x1f
call fcn.0040e282
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e3ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a570]
call esi
jmp 0x40e3f4
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40e438
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x45b060
push str.FlsGetValue
push 0x21
call fcn.0040e282
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e46f
push dword [ebp + 8]
mov ecx, esi
call dword [0x45a570]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40e477
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x45b074
push str.FlsSetValue
push 0x22
call fcn.0040e282
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40e4b1
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x45a570]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]