joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467034
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 0x18]
call fcn.0041ac90
cmp dword [ebp + 0x24], 0
jne 0x467058
cmp dword [ebp + 0x20], 0
jb 0x46707d
jmp 0x46705a
jl 0x46707d
push dword [ebp + 0x24]
push dword [ebp + 0x20]
mov edx, dword [ebp + 8]
push edx
call fcn.00466130
add esp, 0xc
mov ebx, eax
test ebx, ebx
jne 0x46707d
push 2
call fcn.00465c04
pop ecx
or ebx, 0xffffffff
test ebx, ebx
jl 0x467118
mov dword [ebp - 4], 0x100
lea eax, [ebp - 4]
lea edx, [ebp - 0x104]
push eax
push edx
mov ecx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.DLL_recvfrom
mov ebx, eax
call sub.WS2_32.DLL_WSAGetLastError
mov esi, eax
push esi
call fcn.00465c84
pop ecx
cmp ebx, 0xffffffff
jne 0x4670d3
cmp esi, 0x2714
jne 0x4670d3
call fcn.0042557c
test ax, ax
je 0x46708c
test edi, edi
je 0x467118
cmp dword [ebp + 0x1c], 0
je 0x467118
cmp ebx, 0xffffffff
jne 0x4670ef
xor eax, eax
mov dword [edi], eax
mov edx, dword [ebp + 0x1c]
xor ecx, ecx
mov dword [edx], ecx
jmp 0x467118
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x104]
push eax
push edx
mov ecx, dword [ebp - 4]
inc ecx
push ecx
call fcn.0043b368
pop ecx
push eax
call fcn.004ab6c8
add esp, 0xc
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp - 4]
mov dword [eax], edx
call fcn.0041ad00
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4673b4
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
cmp dword [ebp + 0xc], 2
jne 0x467405
mov eax, dword [ebp + 0x10]
push eax
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 8], eax
push 0
call sub.WS2_32.DLL_htonl
mov dword [ebp - 4], eax
lea edx, [ebp - 8]
push 8
push edx
push 0xc
push 0
mov ecx, dword [ebp + 8]
push ecx
call sub.WS2_32.DLL_setsockopt
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4673f5
xor eax, eax
jmp 0x4673fa
call sub.WS2_32.DLL_WSAGetLastError
push eax
call fcn.00465c84
pop ecx
mov eax, ebx
jmp 0x467410
push 4
call fcn.00465c04
pop ecx
or eax, 0xffffffff
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4678f8
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x46790f
cmp byte [ebx], 0
jne 0x467916
xor eax, eax
jmp 0x4679a8
cmp dword [ebp + 0xc], 2
jne 0x4679a4
push ebx
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x467958
mov eax, str.255.255.255.255
mov edx, ebx
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x467952
test cl, cl
je 0x467958
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x467952
add eax, 2
add edx, 2
test cl, cl
jne 0x467936
je 0x467958
xor esi, esi
jmp 0x46795d
mov esi, 1
test esi, esi
jne 0x46798c
call fcn.0041ac90
push ebx
call sub.WS2_32.DLL_gethostbyname
test eax, eax
je 0x467987
mov edx, dword [eax + 0xc]
cmp dword [edx], 0
je 0x467987
mov eax, dword [eax + 0xc]
mov esi, 1
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ebp - 4], eax
call fcn.0041ad00
test esi, esi
je 0x4679a4
mov eax, dword [ebp - 4]
push eax
call sub.WS2_32.DLL_inet_ntoa
mov ebx, eax
push ebx
call fcn.004a87bc
pop ecx
mov edi, eax
test esi, esi
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4679b0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 2
jne 0x467a68
xor esi, esi
xor ebx, ebx
call fcn.0041ac90
push edi
call sub.WS2_32.DLL_inet_addr
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x467a08
mov eax, str.255.255.255.255
mov edx, edi
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x467a17
test cl, cl
je 0x467a06
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x467a17
add eax, 2
add edx, 2
test cl, cl
jne 0x4679ea
jne 0x467a17
push 2
push 4
lea eax, [ebp - 8]
push eax
call sub.WS2_32.DLL_gethostbyaddr
mov esi, eax
test esi, esi
jne 0x467a23
push edi
call sub.WS2_32.DLL_gethostbyname
mov esi, eax
call fcn.0041ad00
test esi, esi
je 0x467a38
jmp 0x467a2f
inc ebx
mov eax, dword [esi + 0xc]
cmp dword [eax + ebx*4], 0
jne 0x467a2e
test ebx, ebx
jle 0x467a68
push ebx
call fcn.0043dbdc
pop ecx
mov dword [ebp - 4], eax
mov edx, dword [esi + 0xc]
mov eax, dword [edx + ebx*4 - 4]
mov edx, dword [eax]
push edx
call sub.WS2_32.DLL_inet_ntoa
mov edi, eax
push edi
push ebx
mov eax, dword [ebp - 4]
push eax
call fcn.0042a964
add esp, 0xc
dec ebx
jne 0x467a46
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4a68c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4a68fb
push esi
call fcn.0045a45c
pop ecx
mov edi, eax
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp eax, 0xffffffff
je 0x4a68e7
test al, 0x50
je 0x4a68eb
xor ebx, ebx
jmp 0x4a68f0
mov ebx, 1
test edi, edi
je 0x4a68fb
push edi
call fcn.0043b450
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4a6958
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp + 8]
push eax
call fcn.004497bc
pop ecx
mov ebx, eax
push 0
push 0
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov esi, eax
test esi, esi
je 0x4a69ac
mov eax, esi
add eax, eax
push eax
call fcn.0043b368
pop ecx
mov dword [ebp - 4], eax
push esi
mov edx, dword [ebp - 4]
push edx
push ebx
call sub.KERNEL32.DLL_GetEnvironmentVariableW
mov ecx, dword [ebp - 4]
push ecx
call fcn.004498b0
pop ecx
mov edi, eax
mov eax, dword [ebp - 4]
push eax
call fcn.0043b450
pop ecx
push ebx
call fcn.0043b450
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4a9788
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffcb4
push 0x100
call fcn.0043b368
pop ecx
mov ebx, eax
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a9a07
push str.ntdll.dll
call sub.KERNEL32.DLL_GetModuleHandleW
mov edi, 0x55300b
mov esi, 0x55300b
test eax, eax
je 0x4a97df
push str.wine_get_version
push eax
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x4a97df
mov edi, str.__Wine_
mov eax, dword [esp + 0x10]
sub eax, 1
jb 0x4a9963
je 0x4a97fd
dec eax
je 0x4a9837
dec eax
je 0x4a996a
jmp 0x4a996f
cmp dword [esp + 4], 4
jne 0x4a9815
cmp dword [esp + 8], 0xa
jae 0x4a9815
mov esi, 0x553069
jmp 0x4a996f
cmp dword [esp + 4], 4
jne 0x4a982d
cmp dword [esp + 8], 0xa
jne 0x4a982d
mov esi, 0x55306d
jmp 0x4a996f
mov esi, 0x553071
jmp 0x4a996f
cmp dword [esp + 4], 6
jne 0x4a98de
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a98d4
mov eax, dword [esp + 8]
cmp eax, 2
jne 0x4a9885
cmp byte [esp + 0x22e], 1
jne 0x4a987b
mov esi, 0x553075
jmp 0x4a996f
mov esi, str._Server_2012
jmp 0x4a996f
cmp eax, 1
jne 0x4a98a8
cmp byte [esp + 0x22e], 1
jne 0x4a989e
mov esi, 0x553085
jmp 0x4a996f
mov esi, str._Server_2008_R2
jmp 0x4a996f
test eax, eax
jne 0x4a98ca
cmp byte [esp + 0x22e], 1
jne 0x4a98c0
mov esi, str._Vista
jmp 0x4a996f
mov esi, str._Server_2008
jmp 0x4a996f
mov esi, 0x55300b
jmp 0x4a996f
mov esi, 0x55300b
jmp 0x4a996f
cmp dword [esp + 4], 5
jne 0x4a9939
cmp dword [esp + 8], 2
jb 0x4a9939
mov dword [esp + 0x230], 0x11c
lea eax, [esp + 0x230]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a9932
cmp byte [esp + 0x34a], 1
jne 0x4a9919
mov esi, str._XP_x64
jmp 0x4a996f
push 0x59
call sub.USER32.DLL_GetSystemMetrics
test eax, eax
je 0x4a992b
mov esi, str._Server_2003_R2
jmp 0x4a996f
mov esi, str._Server_2003
jmp 0x4a996f
mov esi, 0x55300b
jmp 0x4a996f
mov eax, dword [esp + 4]
cmp eax, 5
jne 0x4a9950
cmp dword [esp + 8], 1
jne 0x4a9950
mov esi, 0x5530d1
jmp 0x4a996f
cmp eax, 5
jne 0x4a995c
mov esi, str._2000
jmp 0x4a996f
mov esi, 0x5530db
jmp 0x4a996f
mov esi, str._32s
jmp 0x4a996f
mov esi, 0x5530e4
mov ax, word [esp + 0xc]
and ax, 0xffff
movzx edx, ax
push edx
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
push esi
push str.Windows_s_s__lu._lu._04u
push 0x100
push ebx
call fcn.004a86c0
add esp, 0x20
lea edx, [esp + 0x14]
test edx, edx
je 0x4a9a1a
lea ecx, [esp + 0x14]
push ecx
call fcn.004498b0
pop ecx
mov edi, eax
xor esi, esi
mov eax, edi
jmp 0x4a99b8
inc esi
inc eax
cmp byte [eax], 0
je 0x4a99d4
movsx edx, byte [eax]
cmp edx, 0x20
je 0x4a99b6
cmp edx, 9
je 0x4a99b6
cmp edx, 0xa
je 0x4a99b6
cmp edx, 0xd
je 0x4a99b6
cmp byte [edi + esi], 0
je 0x4a99fe
push 0xff
push 0x553101
push ebx
call fcn.004a932c
add esp, 0xc
add esi, edi
push 0xff
push esi
push ebx
call fcn.004a932c
add esp, 0xc
push edi
call fcn.0043b450
pop ecx
jmp 0x4a9a1a
push str.Windows
push 0x100
push ebx
call fcn.004a86c0
add esp, 0xc
mov eax, ebx
add esp, 0x34c
pop edi
pop esi
pop ebx
ret
Function at 0x4a9a28
Capabilities:
Check os version

Disassembly:
add esp, 0xfffffdd0
mov dword [esp], 0x114
push esp
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a9ad2
mov edx, dword [esp + 4]
cmp edx, 6
setae al
and eax, 1
cmp edx, 5
setae cl
mov dword [0x552ff4], eax
mov dword [0x552ff8], eax
mov eax, dword [esp + 0x10]
and ecx, 1
cmp eax, 2
mov dword [0x552ffc], ecx
sete dl
and edx, 1
cmp eax, 1
sete cl
and ecx, 1
mov dword [0x553000], edx
mov dword [0x553004], ecx
cmp dword [0x552ff8], 0
jne 0x4a9ad2
cmp dword [esp + 4], 5
jne 0x4a9ad2
cmp dword [esp + 8], 2
jb 0x4a9ad2
mov dword [esp + 0x114], 0x11c
lea eax, [esp + 0x114]
push eax
call sub.KERNEL32.DLL_GetVersionExW
test eax, eax
je 0x4a9ad2
cmp byte [esp + 0x22e], 1
setne dl
and edx, 1
mov dword [0x552ff8], edx
mov dword [0x552ff0], 1
add esp, 0x230
ret

Function at 0x4ab364
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4ac704
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ac720
call fcn.004adb9c
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4ac73c
test bl, 1
je 0x4ac73c
call fcn.004b1cd4
mov dword [eax], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4ac920
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.004ad738
test byte [ebp + 0xd], 0xc0
jne 0x4ac944
mov eax, dword [0x553dbc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4ac951
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4ac97e
je 0x4ac990
sub ecx, 0x100
je 0x4ac99e
sub ecx, 0x100
je 0x4ac9a5
sub ecx, 0x100
je 0x4ac997
jmp 0x4ac9ac
sub ecx, 0x600
je 0x4ac9a5
sub ecx, 0x100
je 0x4ac990
jmp 0x4ac9ac
mov edi, 1
jmp 0x4ac9b1
mov edi, 2
jmp 0x4ac9b1
mov edi, 4
jmp 0x4ac9b1
mov edi, 5
jmp 0x4ac9b1
mov edi, 3
test byte [ebp + 0xd], 1
je 0x4ac9d8
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x553834]
test al, 0x80
je 0x4ac9d1
mov ebx, 0x80
jmp 0x4ac9ea
mov ebx, 1
jmp 0x4ac9ea
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4ac9ea
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x4ac9fc
je 0x4aca05
dec eax
je 0x4aca0e
jmp 0x4aca17
mov dword [ebp - 4], closesocket
jmp 0x4aca26
mov dword [ebp - 4], 0x40000000
jmp 0x4aca26
mov dword [ebp - 4], 0xc0000000
jmp 0x4aca26
push 1
call fcn.004adb30
pop ecx
mov ebx, eax
jmp 0x4acb16
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4aca42
sub eax, 0x10
je 0x4aca49
sub eax, 0x10
je 0x4aca52
sub eax, 0x10
je 0x4aca5b
jmp 0x4aca5b
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4aca62
mov dword [ebp - 8], 1
jmp 0x4aca62
mov dword [ebp - 8], 2
jmp 0x4aca62
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x4acacf
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x4acac4
test byte [ebp + 0xd], 1
je 0x4acabf
mov ebx, 0x50
jmp 0x4acac4
mov ebx, 2
push ebx
call fcn.004adb30
pop ecx
mov ebx, eax
jmp 0x4acb16
mov edi, esi
push edi
call fcn.004ac884
pop ecx
test eax, eax
je 0x4acae3
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x4acaef
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004ad858
add esp, 8
mov ebx, eax
inc eax
jne 0x4acb16
push 4
call fcn.004adb30
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
call fcn.004ad76c
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b1c6c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x4b1cce
call fcn.004b1c1c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004ab86c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004ab86c
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4b1d4c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x554d20], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4b1e26
cmp dword [0x554d1c], 0
jne 0x4b1e26
cmp dword [0x554f28], 0
je 0x4b1de0
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004b1b1c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4b1dc6
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004b1b1c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4b1dc6
lea ebx, [ebp - 0x84]
jmp 0x4b1dc7
inc ebx
call fcn.004b1d08
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4b1e61
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x554d24
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004ab86c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x554d27
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4b1e61
cmp dword [0x554d1c], 0
je 0x4b1e40
cmp dword [0x554d1c], 0xffffffff
je 0x4b1e61
push esi
call dword [0x554d1c]
pop ecx
mov eax, dword [0x554d20]
test eax, eax
je 0x4b1e61
cmp dword [0x554d20], 0xffffffff
je 0x4b1e61
cmp byte [eax], 0
je 0x4b1e61
push esi
push eax
call fcn.004b1c6c
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b2684
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x556db4], 0
jne 0x4b2705
cmp dword [0x556dd4], 0
jne 0x4b26b4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x556dd4], eax
test eax, eax
jne 0x4b26b4
push str.GetEnvironmentStrings_failed
call fcn.004b1e78
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x556dd4]
jmp 0x4b26c8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004ab86c
pop ecx
mov edi, eax
test eax, eax
jne 0x4b26c0
lea edi, [ebp + 1]
push edi
call fcn.004aa8b8
pop ecx
mov ebx, eax
mov dword [0x556db8], ebx
test ebx, ebx
jne 0x4b26f2
xor eax, eax
jmp 0x4b27c8
push edi
mov edx, dword [0x556dd4]
push edx
push ebx
call fcn.004ab6c8
add esp, 0xc
jmp 0x4b2725
xor esi, esi
mov ebx, dword [0x556db4]
jmp 0x4b271f
push eax
call fcn.004ab86c
pop ecx
test eax, eax
jne 0x4b271b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4b270f
lea ebx, [esi + 4]
push 4
mov dword [0x556dbc], ebx
inc ebx
push ebx
call fcn.004aa6b8
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x4b2748
xor eax, eax
jmp 0x4b27c8
cmp dword [0x556db4], 0
jne 0x4b2779
xor esi, esi
mov ebx, dword [0x556db8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x4b276a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004ab86c
pop ecx
mov edi, eax
test eax, eax
jne 0x4b2760
jmp 0x4b27aa
xor esi, esi
mov ebx, dword [0x556db4]
mov eax, dword [esp]
mov edi, eax
jmp 0x4b27a4
push eax
call fcn.004ab86c
pop ecx
test eax, eax
je 0x4b2799
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x4b279d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x4b2788
mov eax, dword [0x556db4]
test eax, eax
je 0x4b27ba
push eax
call fcn.004aa8c8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x556db4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4b32c4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x4b32ea
test esi, esi
je 0x4b32ea
call fcn.004b1cd4
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x4b335c
call fcn.004b2fd8
mov ebx, eax
test eax, eax
jne 0x4b3305
call fcn.004b1cd4
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x4b335c
mov edx, dword [ebp + 0x10]
mov dword [ebx + 4], edx
lea edx, [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
mov eax, dword [ebp + 0x20]
mov dword [ebx + 0x54], eax
push edx
mov ecx, dword [ebp + 0x18]
push ecx
push ebx
push 0x4b3220
push esi
mov eax, dword [ebp + 0x14]
push eax
call sub.KERNEL32.DLL_CreateThread
test eax, eax
jne 0x4b3350
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x718
jne 0x4b3349
push 0x59
call fcn.004adb30
pop ecx
jmp 0x4b335c
call fcn.004adb9c
jmp 0x4b335c
mov dword [ebx + 8], eax
test edi, edi
je 0x4b335c
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x183e090e
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x64f51526
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x402218
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x44319d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 0
mov eax, dword [0x458c4c]
lea ecx, [esi + 4]
mov dword [ecx], eax
mov edx, dword [0x458c4c]
lea edi, [esi + 8]
mov dword [edi], edx
mov eax, dword [0x458c4c]
lea ebp, [esi + 0xc]
mov dword [ebp], eax
mov edx, dword [0x458c4c]
lea ebx, [esi + 0x10]
mov dword [ebx], edx
mov eax, dword [0x458c4c]
mov dword [esi + 0x14], eax
mov edx, dword [0x458c4c]
mov dword [esi + 0x18], edx
mov eax, dword [0x458c4c]
mov dword [esi + 0x24], eax
lea edx, [esp + 0x24]
mov byte [esp + 0x1c], 0xe
push edx
mov dword [esi], 0x446948
call fcn.0042955d
lea eax, [esp + 0x28]
mov ecx, edi
push eax
call fcn.0042955d
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebp
call fcn.0042955d
lea edx, [esp + 0x30]
mov ecx, ebx
push edx
call fcn.0042955d
lea eax, [esp + 0x34]
lea ecx, [esi + 0x14]
push eax
call fcn.0042955d
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esi + 0x18]
call fcn.0042955d
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x44]
mov dword [esi + 0x1c], edx
push ecx
lea ecx, [esi + 0x24]
mov dword [esi + 0x20], eax
call fcn.0042955d
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 5
call fcn.00429424
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 4
call fcn.00429424
mov byte [esp + 0x1c], 3
lea ecx, [esp + 0x2c]
call fcn.00429424
lea ecx, [esp + 0x30]
mov byte [esp + 0x1c], 2
call fcn.00429424
lea ecx, [esp + 0x34]
mov byte [esp + 0x1c], 1
call fcn.00429424
lea ecx, [esp + 0x38]
mov byte [esp + 0x1c], 0
call fcn.00429424
lea ecx, [esp + 0x44]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00429424
mov ecx, dword [esp + 0x14]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x24
Function at 0x404528
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4437a2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 0
mov eax, dword [0x458c4c]
lea edi, [esi + 4]
mov dword [edi], eax
mov ecx, dword [0x458c4c]
lea ebp, [esi + 8]
mov dword [ebp], ecx
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push edx
push eax
push ecx
lea ecx, [esi + 0xc]
mov byte [esp + 0x28], 5
call fcn.00403240
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
lea ecx, [esi + 0x1c]
mov byte [esp + 0x28], 6
call fcn.00403240
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
lea ecx, [esi + 0x2c]
mov byte [esp + 0x28], 7
call fcn.00403240
mov edx, dword [0x458c4c]
lea ebx, [esi + 0x3c]
mov dword [ebx], edx
lea eax, [esp + 0x24]
mov ecx, edi
push eax
mov byte [esp + 0x20], 9
mov dword [esi], 0x446f78
call fcn.0042955d
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.0042955d
lea edx, [esp + 0x50]
mov ecx, ebx
push edx
call fcn.0042955d
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], 1
call fcn.00429424
lea ecx, [esp + 0x28]
mov byte [esp + 0x1c], 0
call fcn.00429424
lea ecx, [esp + 0x50]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00429424
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0x30