joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d0d18d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d0d1923
lea eax, [esp + 0x28]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
add esp, 0x3c
ret
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 8]
cmp dword [ecx + 8], eax
mov edx, dword [edx + 8]
sbb eax, eax
cmp dword [ecx + 8], edx
mov edx, 1
cmova eax, edx
ret

Function at 0x6d0d3d00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], 0x6d0d6508
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
jmp fcn.6d0d3d60
Function at 0x6d0d3d60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x6d0d93b8]
test esi, esi
jle 0x6d0d3e4d
mov edi, dword [0x6d0d93bc]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x6d0d3d94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x6d0d3e46
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x6d0d3d80
mov dword [esp], eax
mov esi, eax
call fcn.6d0d4500
test eax, eax
mov edi, eax
je 0x6d0d3e8a
mov esi, dword [0x6d0d93bc]
lea ebx, [ebx + ebx*2]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call fcn.6d0d4610
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x6d0d93bc]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6d0d3e6a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x6d0d3e3f
sub eax, 0x40
and eax, 0xffffffbf
je 0x6d0d3e3f
mov eax, dword [esp + 0x20]
add ebx, dword [0x6d0d93bc]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x6d0d3e54
add dword [0x6d0d93b8], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor ebx, ebx
jmp 0x6d0d3d9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6d0d3d00
mov eax, dword [0x6d0d93bc]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6d0d3d00
mov dword [esp + 4], esi
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6d0d3d00
lea esi, [esi]
Function at 0x401028
Capabilities:
Encode data using xor

Disassembly:
push ebp
movzx eax, al
shl eax, 4
mov ebp, esp
push edi
lea edi, [edx + 0x10]
push esi
push ebx
sub esp, 8
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
mov ebx, edx
xor ecx, ecx
add esi, eax
mov al, byte [esi + ecx]
inc ecx
xor byte [ebx], al
inc ebx
cmp ecx, 4
jne 0x40104c
add edx, 4
add dword [ebp - 0x10], 4
cmp edx, edi
jne 0x401040
pop eax
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4011a4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
add ebx, eax
mov dword [ebp - 0x20], eax
mov eax, 0x10
mov dword [ebp - 0x2c], ebx
mov esi, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], esi
je 0x401375
cmp eax, 0x10
jne 0x401363
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1c]
mov ecx, 4
lea edx, [ebp - 0x1c]
lea esi, [eax + 0xf0]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
call fcn.00401028
mov dword [ebp - 0x28], 1
lea edx, [ebp - 0x1c]
lea edi, [ebp - 0x18]
mov ecx, edx
mov byte [ebp - 0x21], 0
mov eax, ecx
movzx esi, byte [eax]
inc byte [ebp - 0x21]
add eax, 4
mov bl, byte [esi + str.cw]
mov byte [eax - 4], bl
cmp byte [ebp - 0x21], 4
jne 0x401209
inc ecx
cmp edi, ecx
jne 0x401203
mov al, byte [ebp - 0x17]
mov cl, byte [ebp - 0x1b]
cmp dword [ebp - 0x28], 0xe
mov byte [ebp - 0x1b], al
mov al, byte [ebp - 0x13]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0xf]
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0x1a]
mov byte [ebp - 0x13], al
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x12], cl
mov cl, byte [ebp - 0x16]
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0xe]
mov byte [ebp - 0xe], cl
mov cl, byte [ebp - 0x19]
mov byte [ebp - 0x16], al
mov al, byte [ebp - 0xd]
mov byte [ebp - 0x19], al
mov al, byte [ebp - 0x11]
mov byte [ebp - 0xd], al
mov al, byte [ebp - 0x15]
mov byte [ebp - 0x15], cl
mov byte [ebp - 0x11], al
je 0x401323
lea eax, [edx + 0x10]
mov dword [ebp - 0x30], eax
mov al, byte [edx]
mov cl, byte [edx + 1]
mov bl, 0x1b
add edx, 4
xor ecx, eax
mov byte [ebp - 0x21], al
mov al, byte [edx - 2]
xor al, byte [edx - 1]
movzx edi, byte [ebp - 0x21]
mov byte [ebp - 0x22], al
mov esi, eax
mov eax, ecx
shr al, 7
xor esi, ecx
add ecx, ecx
imul eax, ebx
xor edi, esi
xor edi, eax
mov al, byte [edx - 3]
xor al, byte [edx - 2]
xor ecx, edi
mov edi, eax
shr al, 7
imul eax, ebx
mov byte [edx - 4], cl
mov ecx, esi
xor cl, byte [edx - 3]
add edi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
xor ecx, edi
movzx edi, byte [edx - 1]
shr al, 7
mov byte [edx - 3], cl
mov ecx, esi
xor cl, byte [edx - 2]
imul eax, ebx
xor esi, edi
xor ecx, eax
mov al, byte [ebp - 0x22]
add eax, eax
xor eax, ecx
mov cl, byte [ebp - 0x21]
xor cl, byte [edx - 1]
mov byte [edx - 2], al
mov eax, ecx
add ecx, ecx
shr al, 7
imul eax, ebx
xor esi, eax
xor ecx, esi
mov byte [edx - 1], cl
cmp dword [ebp - 0x30], edx
jne 0x40127e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
call fcn.00401028
inc dword [ebp - 0x28]
jmp 0x4011fb
mov ecx, dword [ebp + 8]
mov eax, 0xe
lea edx, [ebp - 0x1c]
call fcn.00401028
mov eax, 0xf
mov esi, dword [ebp + 8]
mov dl, byte [esi + eax + 0xf0]
cmp dl, 0xff
jne 0x401356
mov byte [esi + eax + 0xf0], 0
sub eax, 1
jae 0x401338
jmp 0x401361
mov edi, dword [ebp + 8]
inc edx
mov byte [edi + eax + 0xf0], dl
xor eax, eax
mov edi, dword [ebp - 0x20]
mov dl, byte [ebp + eax - 0x1c]
inc eax
inc dword [ebp - 0x20]
xor byte [edi], dl
jmp 0x4011c0
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40b09c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], ebx
mov eax, dword [ebx + 0x3c]
mov eax, dword [ebx + eax + 0x78]
mov dword [esp], eax
call fcn.00411d88
mov dword [esp + 4], ebx
lea esi, [ebx + eax]
mov eax, dword [esi + 0x20]
mov dword [esp], eax
call fcn.00411d88
add eax, ebx
mov dword [ebp - 0x1c], eax
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x24]
mov dword [esp], eax
call fcn.00411d88
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], edi
je 0x40b15f
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edi*4]
mov dword [esp], eax
call fcn.00411d88
lea ecx, [ebx + eax]
mov dword [esp], ecx
mov dword [ebp - 0x28], ecx
call fcn.0040b66c
mov ecx, dword [ebp - 0x28]
cmp eax, 0xa6caa1c5
jne 0x40b146
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x1c]
mov dword [esp], eax
call fcn.00411d88
mov ecx, dword [ebp - 0x20]
mov dword [esp + 4], ebx
add eax, ebx
add ecx, ebx
movzx edx, word [ecx + edi*2]
mov eax, dword [eax + edx*4]
mov dword [esp], eax
call fcn.00411d88
jmp 0x40b161
mov dword [esp], ecx
call fcn.0040b66c
mov ecx, eax
lea eax, [edi + 1]
cmp ecx, 0xffe885ef
je 0x40b11b
mov edi, eax
jmp 0x40b0ec
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b1b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov eax, dword [0x417318]
mov dword [ebp - 0x14], eax
mov eax, dword [eax + 0x48e]
test eax, eax
je 0x40b275
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 0x444]
test edx, edx
jne 0x40b275
mov ecx, dword [eax + 0x3c]
mov esi, dword [eax + ecx + 0x78]
add esi, eax
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov ebx, dword [esi + 0x1c]
add ecx, eax
add edi, eax
mov dword [ebp - 0x20], ecx
mov ecx, dword [esi + 0x18]
add ebx, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ebx
xor ebx, ebx
mov edi, dword [ebp - 0x10]
cmp dword [ebp - 0x1c], edi
je 0x40b26c
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
mov esi, dword [edi + esi*4]
cmp word [eax + esi], 0x775a
jne 0x40b267
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x10]
test ebx, ebx
movzx esi, word [edi + esi*2]
jne 0x40b245
mov edi, dword [ebp - 0x18]
mov ebx, dword [edi + esi*4]
add ebx, eax
jmp 0x40b267
mov ecx, dword [ebp - 0x18]
mov edi, dword [ecx + esi*4]
add edi, eax
mov esi, edi
sub edi, ebx
mov ecx, edi
cmp esi, ebx
jae 0x40b25d
mov edi, ebx
sub edi, esi
mov ecx, edi
test edx, edx
je 0x40b265
cmp ecx, edx
jae 0x40b267
mov edx, ecx
inc dword [ebp - 0x10]
jmp 0x40b214
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x444], edx
add esp, 0x18
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40b618
Capabilities:
Hash data using djb2

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
test ebx, ebx
je 0x40b665
mov ecx, ebx
mov eax, 0x1505
mov dl, byte [ecx]
test esi, esi
jne 0x40b63d
test dl, dl
jne 0x40b64c
jmp 0x40b665
mov edi, ecx
sub edi, ebx
cmp edi, esi
jae 0x40b665
test dl, dl
jne 0x40b64c
inc ecx
jmp 0x40b65a
cmp dl, 0x60
jbe 0x40b65a
cmp dword [ebp + 0x10], 0
je 0x40b65a
sub edx, 0x20
imul eax, eax, 0x21
movzx edx, dl
inc ecx
add eax, edx
jmp 0x40b631
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b66c
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov eax, 0x1505
mov ebp, esp
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x40b686
imul eax, eax, 0x21
add eax, edx
jmp 0x40b677
pop ebp
ret

Function at 0x40cf3c
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
push edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov cl, byte [edx + esi*4]
mov byte [eax + esi*4], cl
mov cl, byte [edx + esi*4 + 1]
mov byte [eax + esi*4 + 1], cl
mov cl, byte [edx + esi*4 + 2]
mov byte [eax + esi*4 + 2], cl
mov cl, byte [edx + esi*4 + 3]
mov byte [eax + esi*4 + 3], cl
inc esi
cmp esi, 8
jne 0x40cf4b
mov dl, byte [eax + 0x1e]
mov edi, esi
movzx ebx, byte [eax + 0x1c]
movzx ecx, byte [eax + 0x1d]
mov byte [ebp - 0xd], dl
mov dl, byte [eax + 0x1f]
mov byte [ebp - 0xe], dl
and edi, 7
jne 0x40cfc2
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ecx + str.cw]
mov bl, byte [ebx + str.cw]
mov cl, byte [edx + str.cw]
movzx edx, byte [ebp - 0xe]
mov byte [ebp - 0xe], bl
mov ebx, esi
mov dl, byte [edx + str.cw]
shr ebx, 3
mov byte [ebp - 0xd], dl
mov edx, edi
xor dl, byte [ebx + 0x41829c]
mov ebx, edx
jmp 0x40cfed
cmp edi, 4
jne 0x40cfed
movzx edx, byte [ebp - 0xd]
movzx edi, byte [ebp - 0xe]
mov bl, byte [ebx + str.cw]
mov cl, byte [ecx + str.cw]
mov dl, byte [edx + str.cw]
mov byte [ebp - 0xd], dl
mov dl, byte [edi + str.cw]
mov byte [ebp - 0xe], dl
mov dl, byte [ebp - 0xd]
xor dl, byte [eax + 2]
inc esi
add eax, 4
xor bl, byte [eax - 4]
xor cl, byte [eax - 3]
mov byte [eax + 0x1e], dl
mov dl, byte [ebp - 0xe]
xor dl, byte [eax - 1]
mov byte [eax + 0x1c], bl
mov byte [eax + 0x1d], cl
mov byte [eax + 0x1f], dl
cmp esi, 0x3c
jne 0x40cf6f
pop eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d430
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x4c
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
test ebx, ebx
je 0x40d451
cmp dword [ebp + 0xc], 0
jne 0x40d458
xor eax, eax
jmp 0x40d532
mov eax, dword [ebx + 0x3c]
xor esi, esi
add eax, ebx
mov edx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add edx, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [edx + 0x18]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], esi
je 0x40d451
lea eax, [ebx + ecx]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov edi, dword [eax + esi*4]
mov dword [ebp - 0x40], edx
mov dword [esp + 4], ecx
add edi, ebx
mov dword [esp + 8], 1
mov dword [esp], edi
call fcn.0040b618
cmp eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x40]
jne 0x40d52c
mov eax, dword [ebp - 0x34]
add esi, esi
add esi, ebx
movzx eax, word [esi + eax]
mov esi, dword [ebp - 0x30]
lea eax, [ebx + eax*4]
mov ecx, dword [eax + esi]
add ecx, ebx
mov dword [ebp - 0x24], ecx
cmp ecx, edx
jae 0x40d4d5
mov eax, dword [ebp - 0x24]
jmp 0x40d532
mov eax, dword [ebp - 0x2c]
add eax, ebx
add eax, edx
cmp ecx, eax
jae 0x40d4d0
mov dword [esp], edi
call fcn.00412854
mov dword [ebp - 0x1c], edi
mov word [ebp - 0x20], ax
inc eax
mov word [ebp - 0x1e], ax
mov eax, dword [0x417318]
mov eax, dword [eax + 0xe0]
test eax, eax
je 0x40d451
lea edx, [ebp - 0x24]
mov dword [esp], ebx
mov dword [esp + 0xc], edx
xor edx, edx
mov dword [esp + 8], edx
lea edx, [ebp - 0x20]
mov dword [esp + 4], edx
call eax
sub esp, 0x10
test eax, eax
jns 0x40d4d0
jmp 0x40d451
inc esi
jmp 0x40d47f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x411d88
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add ecx, dword [ecx + 0x3c]
movzx eax, word [ecx + 0x14]
lea eax, [ecx + eax + 0x18]
cmp edx, dword [eax + 0x14]
jb 0x411dce
movzx ecx, word [ecx + 6]
imul ecx, ecx, 0x28
add ecx, eax
cmp eax, ecx
je 0x411dcc
mov ebx, dword [eax + 0xc]
cmp edx, ebx
jb 0x411dc7
mov esi, dword [eax + 0x10]
add esi, ebx
cmp edx, esi
jae 0x411dc7
add edx, dword [eax + 0x14]
sub edx, ebx
jmp 0x411dce
add eax, 0x28
jmp 0x411dac
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop ebp
ret
Function at 0x1000b700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xd
push dword [ecx + 0x38]
call dword [sym.imp.USER32.dll_SendMessageA]
pop ebp
ret 8

Function at 0x1000b800
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000b80f
pop dword [ebp - 0x4c]
mov eax, 0x94001c3a
sub eax, 0x83ff642b
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x7b510121
sub dword [ebp - 0x5c], 0x2cfebbd6
mov dword [ebp - 0x58], 0xf1ababcf
sub dword [ebp - 0x58], 0xbf785f8a
mov dword [ebp - 0x54], 0x55d2bd9b
sub dword [ebp - 0x54], 0x986796d
mov dword [ebp - 0x50], 0x679e69fa
sub dword [ebp - 0x50], 0x679e69fa
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xf1cdc9a4
sub eax, 0xe1ccd8f4
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x228ff098
sub dword [ebp - 0x5c], 0xae1d8742
mov dword [ebp - 0x58], 0x3d6ea2a3
add dword [ebp - 0x58], 0x3fdbed2
mov dword [ebp - 0x54], 0xac8e2d29
add dword [ebp - 0x54], 0xb6e13f43
mov dword [ebp - 0x50], 0xb9702b66
add dword [ebp - 0x50], 0x468fd49a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x46d3a699
add eax, 0xc92d4a0f
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf31
push 0
call eax
mov ecx, 0x89f48e6c
sub ecx, 0x89f435ab
xor esi, esi
add esi, eax
mov edi, 0x25b9ca78
add edi, 0xea486d88
add edi, dword [ebp - 0x4c]
mov ebx, 0x28b9503
sub ebx, 0x6d0e9166
sub dword [ebp - 0x34], edx
mov edx, dword [edi]
xor dword [ebp - 0x44], edx
xor edx, ebx
mov dword [esi], edx
add esi, 4
add edi, 4
loop 0x1000b933
add eax, 0x1c774b03
sub eax, 0x1c75f52c
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x422560
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42258d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42258d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x430260
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.004024ea
push eax
call fcn.00401dd2
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42f040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401fdd
push 0xc
call fcn.00406576
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x47d040
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0x42339a
lea ecx, [ebp - 0x28]
call fcn.00401d1e
lea ecx, [ebp - 0x28]
call fcn.004040aa
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, 0x47d040
add edx, 0x188
mov esi, 0x431040
push esi
call edx
cmp dword [ebp - 0x24], 0
jne 0x4234c4
lea ecx, [ebp - 0x1c]
call fcn.004033ef
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004065b4
leave
ret
call fcn.0040dc7b
int3
Function at 0x10014940
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001494f
pop dword [ebp - 0x2c]
mov eax, 0xa65f6e48
add eax, 0x69a1db07
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x96897013
add dword [ebp - 0x3c], 0xb7c8d538
mov dword [ebp - 0x38], 0x1bf0206d
add dword [ebp - 0x38], 0x16432bd8
mov dword [ebp - 0x34], 0x8197da2f
add dword [ebp - 0x34], 0xcab469ff
mov dword [ebp - 0x30], 0x3608aec4
sub dword [ebp - 0x30], 0x3608aec4
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xd65343b6
sub eax, 0xc64ed2ee
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x203ed7d9
sub dword [ebp - 0x3c], 0xabcc6e83
mov dword [ebp - 0x38], 0x39b9add4
sub dword [ebp - 0x38], 0xf84d4c5f
mov dword [ebp - 0x34], 0xda6fa551
add dword [ebp - 0x34], 0x88ffc71b
mov dword [ebp - 0x30], 0x6973b8ab
add dword [ebp - 0x30], 0x968c4755
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x68af65b7
sub eax, 0x58aaf4d3
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x4403b
push 0
call eax
mov ecx, 0x123d39b6
sub ecx, 0x123ceb61
mov esi, eax
mov edx, 0x5df9921a
add edx, 0xb20c9de6
add edx, dword [ebp - 0x2c]
mov edi, 0x7a8e277a
sub edi, 0x30bafcd5
sub dword [ebp - 0x10], 0xeab00209
mov ebx, dword [edx]
xor dword [ebp - 8], esi
add ebx, edi
mov dword [esi], ebx
xor dword [ebp - 4], 0x383d5ec4
add esi, 4
add edx, 0x45816467
add edx, 0xba7e9b9d
loop 0x10014a71
add eax, 0xf62af623
sub eax, 0xf629c9fc
mov ebx, eax
add eax, 0x6678c4a8
sub eax, 0x6678c4a3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x40ac03
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x148], 0
mov dword [ebp - 0x144], 0
lea eax, [ebp - 0x140]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
je 0x40ac5f
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp eax, 1
jne 0x40ac5f
mov dword [ebp - 0x144], 1
cmp dword [ebp - 0x148], 0
je 0x40ac75
mov eax, dword [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x144]
mov esp, ebp
pop ebp
ret 4
Function at 0x42dc72
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44703f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov dword [ebp - 0x74], ecx
lea ecx, [ebp - 0x58]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov eax, dword [str.RCChange.exe]
push eax
lea ecx, [ebp - 0x6c]
push ecx
mov ecx, dword [ebp - 0x74]
add ecx, 0xe4
call sym.RemoteCtrl.exe_public:_class_CString___thiscall_CMfsInfo::GetInstPath_void_
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x78]
mov dword [ebp - 0x7c], edx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x70]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0x80], eax
mov edx, dword [ebp - 0x80]
mov dword [ebp - 0x84], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x84]
push eax
lea ecx, [ebp - 0x58]
call fcn.004437c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x70]
call fcn.00443754
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.00443754
lea ecx, [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
lea edx, [ebp - 0x68]
push edx
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x58]
call sym.RemoteCtrl.exe_public:_char_const____thiscall_CMyString::operator_char_const__void_const
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00443754
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x43163f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4473ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x44c840
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x20], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x24], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x28], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x1c], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
push 0x80
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xb0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xb4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x10], 2
mov edx, dword [ebp - 0x10]
mov dword [edx + 8], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xb8], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xbc], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0xc0], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc4], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0xc8], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret