joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499905
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x499a1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x499a1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.004beda3
mov esi, eax
test esi, esi
je 0x499a1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x499a1d
mov ecx, esi
call fcn.00499870
cmp edi, eax
jge 0x499a1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x4999a3
mov dword [esp + 0x34], 1
jmp 0x4999fe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x499a1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00498e70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x49fb10
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x49fb76
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x49fb76
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x49fb57
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4a06b0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004a0800
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4a06d0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4a06b1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004a0800
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4a06d0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4a0700
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4a0757
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x4a076d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.004a0790
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x4a0790
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x4a0820
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4a0869
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x4a0ce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4ce270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004a0890
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004a0910
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004a0910
lea ecx, [esi + 0xc]
call fcn.004bd2e2
lea ecx, [esi + 0x10]
call fcn.004bd2e2
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004a3140
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004a3140
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004a3140
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004bd357
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004bd357
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x4a1988
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ce498
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4a1998
call fcn.004a1eb0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x4a1a7b
cmp byte [edi], 0
je 0x4a1a7b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4a19bd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004a06b0
test eax, eax
jne 0x4a19dd
push 0x8520f0
lea ecx, [esi + 0x38]
call fcn.004bd4e0
jmp 0x4a1a7b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004a0700
test eax, eax
jne 0x4a1a0c
mov ecx, esi
call fcn.004a0800
push edi
add esi, 0x38
push 0x8520cc
push esi
call fcn.004bad2a
add esp, 0xc
jmp 0x4a1a7b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.004a2730
test eax, eax
je 0x4a1a74
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.004a1b50
test eax, eax
jne 0x4a1a90
push edi
lea eax, [esi + 0x38]
push 0x8520a8
push eax
call fcn.004bad2a
add esp, 0xc
mov ecx, esi
call fcn.004a1eb0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x4a1b38
mov ecx, dword [0x852360]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.004bad2a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004a07b0
test eax, eax
jne 0x4a1afa
push 0x85208c
lea ecx, [esi + 0x38]
call fcn.004bd4e0
jmp 0x4a1b0a
push 0xfa
mov ecx, esi
call fcn.004a2730
test eax, eax
jne 0x4a1b27
mov ecx, esi
call fcn.004a1eb0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004bd357
jmp 0x4a1a7b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004bd357
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x4bf747
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4bf77f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004bd7fe
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004bd7d6
jmp 0x4bf78b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c0e38
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c0e7a
call fcn.004c6c26
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c0e7a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c0e71
xor eax, eax
jmp 0x4c0e82
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c0e88
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c7156
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c7184
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c71a2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c70bc
jmp 0x4c71a2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c71a2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c70bc
test edi, edi
mov eax, edi
jne 0x4c718c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40a850
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x453d88]
jne 0x40a85a
repz ret
jmp fcn.0040cadc

Function at 0x40b291
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x453d88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00405ee1
and dword [ebp - 0x14], 0
cmp dword [0x457300], 0
mov dword [ebp - 0x18], eax
jne 0x40b344
push 0x402afc
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b3ec
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402af0
push ebx
call edi
test eax, eax
je 0x40b3ec
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402ae0
push ebx
mov dword [0x457300], eax
call edi
push eax
call esi
push 0x402acc
push ebx
mov dword [0x457304], eax
call edi
push eax
call esi
push 0x402ab0
push ebx
mov dword [0x457308], eax
call edi
push eax
call esi
mov dword [0x457310], eax
test eax, eax
je 0x40b344
push 0x402a98
push ebx
call edi
push eax
call esi
mov dword [0x45730c], eax
mov eax, dword [0x45730c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b39d
cmp dword [0x457310], ecx
je 0x40b39d
push eax
call esi
push dword [0x457310]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b39d
test ebx, ebx
je 0x40b39d
call edi
test eax, eax
je 0x40b394
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b394
test byte [ebp - 8], 1
jne 0x40b39d
or dword [ebp + 0x10], 0x200000
jmp 0x40b3d0
mov eax, dword [0x457304]
cmp eax, dword [ebp - 0x18]
je 0x40b3d0
push eax
call esi
test eax, eax
je 0x40b3d0
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b3d0
mov eax, dword [0x457308]
cmp eax, dword [ebp - 0x18]
je 0x40b3d0
push eax
call esi
test eax, eax
je 0x40b3d0
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x457300]
call esi
test eax, eax
je 0x40b3ec
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b3ee
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a850
leave
ret
Function at 0x43aa20
Capabilities:
Accept command line arguments
Delete directory
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1420
call fcn.0040cd20
cmp dword [0x22902a8], 0x37
jne 0x43aadf
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x4032b8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x24]
push eax
push 0x4032f0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0xc24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x820]
push edx
push 0
push 0x403384
push 0x403394
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x4033c0
push 0x4033c8
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov eax, dword [0x22902ac]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x45c40c]
mov byte [eax + esi], dl
add esp, 0x1420
ret

Function at 0x43ab10
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov edx, dword [0x453f64]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x453f60]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x453f68]
mov dword [esp + 0x20], edx
mov edx, dword [0x453f6c]
push edi
mov dword [esp + 0x14], eax
mov edi, 0xc6ef3720
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov ebp, 0x20
jmp 0x43ab64
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x18]
mov edx, eax
shl edx, 4
add edx, dword [esp + 0x1c]
add eax, edi
xor ecx, edx
xor ecx, eax
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov dword [0x228f22c], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x22902a8], 0x1be
lea ebx, [edi + esi]
jne 0x43abb9
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x24]
mov dword [0x228f230], 0xff6b3619
xor eax, ebx
xor dword [esp + 0x10], eax
mov dword [0x228f234], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add edi, 0x61c88647
dec ebp
jne 0x43ab60
cmp dword [0x22902a8], 0x8d4
jne 0x43ac1f
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x60
ret 4
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x60
ret 4
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x428450
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
jmp 0x428468
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x42850c
mov edx, dword [ebp - 4]
sub edx, 0x231d
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + eax*2 + 0x463a]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
shr eax, 0xc
cmp eax, 3
jne 0x428507
mov ecx, dword [ebp - 8]
push ecx
call fcn.00428a00
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x4284c6
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x4284c6
xor eax, eax
jmp 0x42850c
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax - 0x4c3f8]
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
add ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebp + 0x10]
mov dword [edx + eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x4c3f8
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx]
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
jmp 0x42845f
mov esp, ebp
pop ebp
ret
Function at 0x9531eb
Capabilities:
Execute anti-debugging instructions

Disassembly:
call 0x952b42
jmp 0x953179
mov dword [esp + 0x24], eax
jmp 0x953199
call 0x952bdc
jmp 0x953254
push edx
mov dword [esp], eax
pop word [esp]
call fcn.00952c43
call 0x952c0b
pop edi
outsd dx, dword [esi]
outsb dx, byte [esi]
js 0x952c72
je 0x952c0b
jmp 0x953151
lea esp, [esp + 4]
push 0
pushfd
jmp 0x952bf1
push eax
call fcn.0094590a
jmp 0x952b3d
pop ecx
jmp 0x953210
popal
inc dword [esp + 8]
jmp 0x9531ce
add ebx, 0x93c13220
jmp 0x9531d0
popfd
ret
cmp ebx, 0x93c132ec
je 0x953234
jne 0x952ba7
call 0x9531eb
jae 0x953259
jb 0x953255
arpl word [ecx + 0x74], sp
add cl, ch
je 0x9531f9
add byte [eax], al
movsb byte es:[edi], byte [esi]
lea ebx, reloc.kernel32.dll_DeleteCriticalSection
mov dword [ebx], eax
pop ebx
movzx ebx, byte [eax]
jmp 0x9531b8
sub ecx, 0x100131ae
push ebx
mov ebx, ecx
jmp 0x9531f1
popfd
ret
add byte [eax], al
add bl, ch
push esp
add byte [eax], al
call dword [eax - 0x18]
mov ebx, 0xe9ffff26
push ebx
clc
invalid
pop eax
sub eax, 0x7a137811
jmp 0x953273
jp 0x953246
pop ss
jne 0x95321b
pushal
jmp 0x952bd7
call 0x953283
dec ebp
push ebx
push esi
inc ebx
push edx
push esp
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
jp 0x953287
add byte [eax], al
xor al, 0x27
add byte [edi], dh
dec esi
fnstcw word [eax]
pushfd
cmp dword [esp + 4], 0
jmp 0x95326b
Function at 0x97b6a8
Capabilities:
Encrypt data using aes

Disassembly:
stc
jmp 0x97b6af
xor edx, eax
bswap esi
lea esi, [eax + edx]
Function at 0xc5fa0b
Capabilities:
Access peb ldr_data

Disassembly:
pop word [esp + 9]
lea esp, [esp + 1]
mov dword [esp + 0x30], edi
lea esp, [esp + 0x30]
jmp 0xc5fc14
push edx
mov byte [esp + 9], bh
jmp 0xc5f9ee
mov eax, dword [esi]
pop esi
mov eax, dword [eax + 8]
call fcn.00c5fa91
mov eax, dword [ebx]
pop ebx
push esi
mov esi, eax
jmp 0xc5fa3d
mov dword [esp], esi
mov byte [esp + 1], bh
lea esp, [esp + 4]
popal
lea ebx, [ebx + 0x1c]
jmp 0xc5fa68
pushal
setae bh
mov dword [esp + 0x10], eax
push edx
mov byte [esp + 2], dh
jmp 0xc5fac0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
push ebx
jmp 0xc5fb13

Function at 0xc5fa91
Capabilities:
Parse pe header

Disassembly:
call fcn.00c5e27c
jmp 0xc5fa70
mov byte [esp], dh
lea esp, [esp + 2]
push eax
jmp 0xc5e277
mov al, 0x36
mov al, byte [esp]
lea eax, [ebp*4]
sete al
mov eax, dword [esp]
call fcn.00c5fa97
cmp byte [edx + 0x75ba4f28], bh
sbb esi, dword [edx + 0x6d]
jl 0xc5faf8
invalid
pop dword [esp]
jmp 0xc5fa48
cmp dword [eax], reloc.kernel32.dll_DeleteCriticalSection
mov byte [0x75ffffe7], al
pop edi
int3

Function at 0xc5fa97
Capabilities:
Parse pe header

Disassembly:
push eax
jmp 0xc5a015
call fcn.00c5a01a
movzx ebx, word [eax + 0x3c]
jmp 0xc5fb97
jmp 0xc5faea
mov word [esp], di
lea esp, [esp + 8]
call fcn.00c5fa99
cmp word [eax], 0x5a4d
je 0xc5e2a4
jne 0xc5fb63
sub eax, 0x10000
jmp 0xc5faf7
add ebx, eax
cmp word [ebx], 0x4550
je 0xc59f84
jne 0xc5fb63
jns 0xc5fba4
xchg edx, eax
cmc
add al, 0x83
dec ecx
leave
pop ecx
cmp bl, cl
push es
jmp 0x6b65f421

Function at 0xc5fad1
Capabilities:
Parse pe header

Disassembly:
mov word [esp], bx
pop word [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
jmp 0xc5faf7
Function at 0x4498ac
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00448fa8
ret

Function at 0x44a3ac
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, ecx
mov esi, eax
xor eax, eax
mov dword [edx], esi
mov ecx, dword [edx]
cmp word [ecx], 0x5a4d
jne 0x44a3fa
mov edx, dword [edx]
mov edx, dword [edx + 0x3c]
add edx, esi
mov dword [ebx], edx
mov edx, dword [ebx]
cmp dword [edx], 0x4550
jne 0x44a3fa
mov edx, dword [ebx]
mov edi, dword [edx + 0xa0]
test edi, edi
je 0x44a3fa
mov edx, dword [ebx]
test byte [edx + 0x16], 1
jne 0x44a3fa
mov edx, edi
mov eax, esi
call fcn.0044a3a4
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x44e3e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x44e3ec
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004484c8
xor eax, eax
push ebp
push 0x409902
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x44e426
mov eax, dword [ebp - 8]
call fcn.00448144
jmp 0x44e4df
lea eax, [ebp - 0xc]
mov edx, 0x409918
call fcn.004481dc
lea eax, [ebp - 0x10]
mov edx, 0x409924
call fcn.004481dc
lea eax, [ebp - 0x14]
mov edx, 0x409930
call fcn.004481dc
lea eax, [ebp - 0x18]
mov edx, 0x40993c
call fcn.004481dc
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00448398
lea eax, [ebp - 0x20]
call fcn.00448144
mov eax, dword [ebp - 4]
call fcn.004482d8
mov esi, eax
test esi, esi
jle 0x44e4d4
mov ebx, 1
mov eax, dword [ebp - 0x1c]
call fcn.004482d8
push eax
mov eax, ebx
pop edx
mov ecx, edx
cdq
idiv ecx
mov edi, edx
inc edi
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax + edi - 1]
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor edx, eax
lea eax, [ebp - 0x24]
call fcn.00448280
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
call fcn.004482e0
inc ebx
dec esi
jne 0x44e48e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
call fcn.00448198
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409909
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.00448168
lea eax, [ebp - 4]
call fcn.00448144
ret