joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push 0x1e
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.004066e0
add esp, 0xc
mov dword [ebp - 0x1c], 3
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], ecx
mov edx, 0x614
mov word [ebp - 0x10], dx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esp, ebp
pop ebp
ret

Function at 0x401bd0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc08
mov eax, dword [0x422050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.00407d60
add esp, 8
mov dword [ebp - 0xc08], 0
jmp 0x401c11
mov edx, dword [ebp - 0xc08]
add edx, 1
mov dword [ebp - 0xc08], edx
lea eax, [ebp - 0x404]
push eax
call fcn.00409430
add esp, 4
cmp dword [ebp - 0xc08], eax
jae 0x401c4b
mov ecx, dword [ebp - 0xc08]
movsx edx, byte [ebp + ecx - 0x404]
cmp edx, 0x2f
jne 0x401c49
mov eax, dword [ebp - 0xc08]
mov byte [ebp + eax - 0x404], 0x5c
jmp 0x401c02
push 0x400
lea ecx, [ebp - 0xc04]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x404]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0xc04]
push eax
call fcn.0040a643
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b9a
mov esp, ebp
pop ebp
ret

Function at 0x401da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x422050]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.004066e0
add esp, 0xc
lea ecx, [ebp - 0x804]
push ecx
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x804]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00405b9a
mov esp, ebp
pop ebp
ret
Function at 0x405820
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x405832
cmp dword [ebp + 0xc], 0
jne 0x405839
xor eax, eax
jmp 0x4058f1
push 0xc
call dword [ebp + 8]
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405851
xor eax, eax
jmp 0x4058f1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 4], eax
push 0x400
call dword [ebp + 8]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
je 0x4058ee
mov dword [ebp - 8], 0
jmp 0x40588e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x100
jge 0x4058ee
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], 0
jmp 0x4058af
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 8
jge 0x4058dd
mov eax, dword [ebp - 0xc]
and eax, 1
je 0x4058cd
mov ecx, dword [ebp - 0xc]
shr ecx, 1
xor ecx, 0xedb88320
mov dword [ebp - 0x14], ecx
jmp 0x4058d5
mov edx, dword [ebp - 0xc]
shr edx, 1
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
jmp 0x4058a6
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4], ecx
jmp 0x405885
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x41171c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00411599

Function at 0x412fa8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00412c4a

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x40db80
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4143d8], 0
jne 0x40dc01
cmp dword [0x4143f8], 0
jne 0x40dbb0
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4143f8], eax
test eax, eax
jne 0x40dbb0
push str.GetEnvironmentStrings_failed
call fcn.0040cbf0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4143f8]
jmp 0x40dbc4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dbbc
lea edi, [ebp + 1]
push edi
call fcn.00405c3c
pop ecx
mov ebx, eax
mov dword [0x4143dc], ebx
test ebx, ebx
jne 0x40dbee
xor eax, eax
jmp 0x40dcc4
push edi
mov edx, dword [0x4143f8]
push edx
push ebx
call fcn.004069b8
add esp, 0xc
jmp 0x40dc21
xor esi, esi
mov ebx, dword [0x4143d8]
jmp 0x40dc1b
push eax
call fcn.00406b08
pop ecx
test eax, eax
jne 0x40dc17
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc0b
lea ebx, [esi + 4]
push 4
mov dword [0x4143e0], ebx
inc ebx
push ebx
call fcn.00405a3c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40dc44
xor eax, eax
jmp 0x40dcc4
cmp dword [0x4143d8], 0
jne 0x40dc75
xor esi, esi
mov ebx, dword [0x4143dc]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40dc66
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00406b08
pop ecx
mov edi, eax
test eax, eax
jne 0x40dc5c
jmp 0x40dca6
xor esi, esi
mov ebx, dword [0x4143d8]
mov eax, dword [esp]
mov edi, eax
jmp 0x40dca0
push eax
call fcn.00406b08
pop ecx
test eax, eax
je 0x40dc95
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40dc99
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40dc84
mov eax, dword [0x4143d8]
test eax, eax
je 0x40dcb6
push eax
call fcn.00405c4c
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4143d8], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x635e116d
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data_1
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x73541911
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x78114bfc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rsrc
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x20a57b97
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x38c21b0d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3c8b25a9
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4011f0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov eax, dword [0x418004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push str.SignMachineSemaphore
push 0
push 0x100002
mov dword [0x4192d4], eax
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov edi, eax
test edi, edi
je 0x40131e
push str.SignMachineSharedData
push 0
push 6
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov ebx, eax
test ebx, ebx
je 0x401315
push esi
push 0
push 0
push 0
push 6
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
test esi, esi
je 0x401306
push ecx
lea ecx, [ebp - 0x470]
call fcn.00401030
cmp dword [ebp - 0x60], 0
je 0x4012ee
lea eax, [ebp - 0x474]
mov dword [ebp - 0x474], 0
push eax
lea ecx, [ebp - 0x470]
call fcn.00401100
mov edx, dword [ebp - 0x474]
mov eax, 0
add edx, 2
mov dword [ebp - 0x474], 0x80070057
mov ecx, edx
mov dword [ebp - 0x478], edx
shr ecx, 1
cmove eax, dword [ebp - 0x474]
test eax, eax
js 0x4012dd
push ecx
lea eax, [ebp - 0x470]
mov edx, ecx
push eax
push ecx
mov ecx, esi
call fcn.004011a0
mov edx, dword [ebp - 0x478]
jmp 0x4012e6
test ecx, ecx
je 0x4012e6
xor ecx, ecx
mov word [esi], cx
test eax, eax
jne 0x401300
mov word [esi + edx*2], ax
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push 0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
call esi
push edi
call esi
pop esi
jmp 0x401332
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x401332
push 0x30
push str.Close
push 0x41657c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push dword [0x4192d4]
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.00401352
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401589
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4169d8
call fcn.00401c50
push 1
call fcn.0040174c
pop ecx
test al, al
jne 0x401440
push 7
call fcn.00401a4c
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00401717
mov byte [ebp - 0x24], al
mov eax, dword [0x418acc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x401439
test eax, eax
jne 0x4014aa
mov dword [0x418acc], ecx
push 0x411164
push 0x41114c
call fcn.00404b07
pop ecx
pop ecx
test eax, eax
je 0x40148d
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x401583
push 0x411148
push 0x411140
call fcn.00404aab
pop ecx
pop ecx
mov dword [0x418acc], 2
jmp 0x4014af
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004018a6
pop ecx
call fcn.00401a40
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x4014df
push esi
call fcn.0040181c
pop ecx
test al, al
je 0x4014df
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00401c45
call esi
call fcn.00401a46
mov esi, eax
cmp dword [esi], edi
je 0x4014fd
push esi
call fcn.0040181c
pop ecx
test al, al
je 0x4014fd
push dword [esi]
call fcn.00404daa
pop ecx
call fcn.00401b67
movzx eax, ax
push eax
call fcn.00404a65
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00404cb9
test al, al
jne 0x401528
push esi
call fcn.00404de2
test bl, bl
jne 0x401531
call fcn.00404d85
push edi
push 1
call fcn.004018c3
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x401583
call fcn.00401c96
ret
call fcn.0040193b
jmp 0x401421
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x223c6f5e
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2e6d1fa0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x62
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp - 0x31]
push esi
push 0x782c8845
push eax
push esi
call fcn.004086e0
mov ecx, dword [ebp + 8]
mov edx, dword [0xc940c0c8]
push eax
push ecx
sub dword [edx + 0x40], 0x68
adc ah, 0x40
add byte [edx - 1], dl
adc eax, 0xb940c1ed
mov eax, dword [0x694102ac]
enter 0x14c4, 0xffffffffffffff85
sal byte [edi + ecx + 0x50], 0x68
push esp
rol byte [eax], cl
call dword [0x40c17f]
rol ah, 8
pop edi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
adc eax, 0x90900090
nop
nop
nop
inc ebx
nop
nop
push ebp
mov ebp, esp
cmp ebp, esp
push ebx
adc al, 0x8b
jne 0x401eb3
push edi
sub dword [esi + 0x14], eax
xor byte [ebp + 8], al
call 0xec6a00
mov dword [0x41b2a0], eax
dec ecx
dec ebx
lodsb al, byte [esi]
add byte [ebx + 0x41b2a0], ah
mov dword [0x410ba4], edx
mov ebx, eax
mov eax, dword [ebp - 0x58]
test eax, eax
mov edi, edx
jne 0x401f0d
mov ecx, dword [esi + 4]
popfd
stosd dword es:[edi], eax
push 0
push ecx
call 0x1298c70
jne 0x401e7a
cmp byte [eax], cl
add byte [eax], al
mov dword [edx + 0x83c], edx
mov dword [esi + 0x18], 0
das
adc eax, 0x1101ec
mov dword [esi + 0x14], edx
mov eax, dword [0x7a0260]
test eax, eax
je 0x401f3a
mov eax, dword [0x4102d7]
inc ebp
retf 0xc803
mov ecx, dword [esi + 0x4600b338]
mov eax, dword [0x40d028]
mov ebp, dword [eax + 0x40d02c]
adc cl, al
push edx
xchg byte [eax + ecx], bh
add byte [eax], al
adc eax, edx
cmp edi, eax
invalid
pop edx
add byte [eax], al

Function at 0x405640
Capabilities:
Encode data using xor

Disassembly:
push edi
hlt
pop esi
xor al, dl
adc byte [eax], al
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x74]
jg 0x40563b
push edi
loopne 0x40561d
je 0x4056ac
mov edi, dword [eax + edx]
mov esi, dword [ebp + 0x10]
sbb eax, 0x4a8d0c7d
adc byte [ebp + 0x392074c0], al
js 0x405664
cmp dword [eax + 4], edi
jne 0x405667
cmp dword [eax + 8], esi
mov ah, 0x7f
or byte [edi + edi*2 - 0x167437c8], dh
cmp al, cl
mov ebp, ecx
test eax, eax
jne 0x40565d
cld
or al, 0x8b
mov esi, dword [eax + 0x19]
mov eax, dword [eax - 0x3b]
mov ebp, ebp
mov dword [edx + 0x21], eax
mov eax, dword [edx + 0x65]
lea ecx, [edx + 0x38]
test eax, eax
je 0x4056ac
cmp dword [eax + 4], edi
jne 0x405691
cmp dword [eax + 8], esi
je 0x4056a0
mov ecx, eax
mov eax, dword [eax]
rcl bh, 0xee
pop edi
hlt
mov esi, dword [eax]
mov dword [ecx], esi
mov ecx, dword [edx + 0x3c]
mov ebx, ecx
mov dword [edx + 0x20], eax
dec ebp
pop esi
pop ebx
pop ebp
invalid
Function at 0x406fa0
Capabilities:
Set socket configuration

Disassembly:
dec ebp
sbb byte [ebx - 0x1074f7ab], cl
push esi
mov esi, dword [ebp + 0xc]
add dword [ebx + 0x2c7d403], 0
add byte [ecx - 0x49], dh
je 0x406f76
test esi, esi
je 0x406f6b
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x406fc8
cmp eax, 3
je 0x406f6b
test cl, 0x3a
je 0x406f7d
pop edi
inc edi
xchg dword [ecx], edx
bound eax, qword [eax]
pop esi
add eax, 0x5f9c18c2
pop edi
mov eax, 0x16
pop esi
ret 0xb1
mov ecx, dword [ecx]
adc byte [eax + eax*8 + 0x75], bl
add eax, 0x9eb8
add byte [ebx + 0x517a1c7d], cl
mov eax, 0x9e
mov edi, dword [ebp + 0x1c]
jp 0x406fd8
mov ecx, dword [ebp + 0x14]
push ebp
push eax
push esi
push edx
call fcn.00406fa0
add esp, 0xfffffff9
pop edi
pop esi
pop ebp
imul ebx, dword [eax], 0xf
nop
cmpsb byte [esi], byte es:[edi]
nop
nop
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
je 0x406f34
jne 0x406fb7
mov eax, dword [0xbcf33bdb]
mov dword [ebp - 0xc], esi
jne 0x406fba
mov esi, str.0.0.0.0
hlt
mov al, byte [esi]
cmp al, 0x30
jl 0x407055
cmp al, 0x39
cmovs esi, dword [ecx - 0x74000000]
push 0xffffffffffffffd6
mov cl, 0
add byte [eax], al
mov word [edx - 0x2a], gs
inc eax
add byte [esi - 1], dl
adc eax, sym.imp.MSVCRT.dll_strspn
mov edx, eax
mov edi, esi
or dword [edi - 0x7cfdcc01], 0xffffffc4
or dl, dh
mov bh, 0xba
rcl dword [edx - 0x7af02ec5]
jnp 0x406fef
xchg ebx, eax
add ah, cl
call dword [sym.imp.WSOCK32.dll_inet_addr]
mov ebx, ebp
and ah, byte [ebp + 0x4d7af845]
in al, dx
lea edx, [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
sbb eax, 0x5589e86b
or al, 0x8b
pop ss
or al, 0x51
dec eax
or al, 0x39
sbb ecx, edx
test byte [eax - 0x76fffff3], ch
pop ebp
cld
mov ecx, dword [edx + 0x68]
push 0x38
push edx
enter 0xffffffffffffda1e, 0xffffffffffffffff
dec dword [ebx - 0x743f3d08]
idiv dword [ecx + 0xe]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x12]
stc
jge 0x406fe5
mov dword [esi], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [edi + edx]
mov ecx, esi
adc al, 0x52
push 0xffffffffffffffae
mov edx, edi
push esi
mov dword [esi + 0x2c], ecx
sub al, 0xa4
movsb byte es:[edi], byte [esi]
jne 0x407056
dec dword [esi - 0x7af3196b]
xchg esp, eax
jne 0x4070a5
mov ebp, dword [0xdac085f4]
or eax, 0x1c458b50
push eax
call 0x3f8c65
mov dword [0x84d8b04], ebp
mov dword [ecx], edx
jmp 0x4070ae
mov esp, dword [esi]
add al, 0x89
push esi
in eax, dx
invalid
mov eax, dword [ebp + 0xc]
add edi, 4
mov ebx, esi
mov dword [ebp - 4], edi
and cl, byte [eax + 0xc]
sar byte [edi + ecx], 1
add byte [edi], cl
test dword [ebx - 1], ebx
test byte [ecx - 0x3fcca1b4], dh
movsd dword es:[edi], dword [esi]
mov esp, ebp
pop ebp
push ss
nop
push ebp
mov ebp, esp
sbb dword [eax + 0x2f2], 0xdade4d9d
push esi
xor esi, esi
mov edi, dword [ebp - 0x7650ae75]
inc ebp
hlt

Function at 0x414dea
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi], ecx
dec ebx
add esi, 4
add eax, 0xa272eae7
and eax, edi
cmp esi, edx
jne fcn.00414dea
ret