joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0860
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e9f28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
mov al, byte [esi]
mov byte [esp + 0x10], al
call fcn.00401510
mov ecx, dword [0x4ec400]
push ecx
push 0
push esi
lea ecx, [esp + 0x18]
call fcn.00415fc0
mov eax, dword [esi + 4]
mov dword [esp + 0x24], 0
test eax, eax
jne 0x4b08c0
mov ecx, 0x4ec3fc
jmp 0x4b08c7
mov edx, dword [esi + 8]
lea ecx, [edx + eax - 1]
mov bl, byte [0x50fa14]
mov dl, byte [ecx]
cmp dl, bl
je 0x4b0943
test eax, eax
jne 0x4b08de
mov eax, 0x4ec3fc
jmp 0x4b08e5
mov ecx, dword [esi + 8]
lea eax, [ecx + eax - 1]
mov dl, byte [eax]
mov al, byte [0x50fa15]
cmp dl, al
je 0x4b0943
mov eax, dword [0x4ec400]
mov edx, dword [esp + 0x14]
sub eax, edx
cmp eax, 1
ja 0x4b0905
call fcn.004b0f00
mov ecx, dword [esp + 0x14]
push 0
lea esi, [ecx + 1]
lea ecx, [esp + 0x10]
push esi
call fcn.00401580
test al, al
je 0x4b0937
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
movsx edx, bl
add ecx, eax
mov dh, dl
push esi
mov byte [ecx], dl
lea ecx, [esp + 0x10]
call fcn.00401560
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0xc]
push ecx
push edx
jmp 0x4b0949
mov eax, dword [esp + 0x34]
push eax
push esi
mov esi, dword [esp + 0x34]
push esi
call fcn.004b0d50
mov ecx, dword [esp + 0x1c]
add esp, 0xc
test ecx, ecx
je 0x4b098b
mov al, byte [ecx - 1]
test al, al
je 0x4b0981
cmp al, 0xff
je 0x4b0981
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.004b124a
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x4b0c90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e9f50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
lea eax, [esp + 0xc]
push edi
mov esi, ecx
push eax
mov dword [esp + 0x10], esi
call fcn.00434a00
add esp, 4
mov edi, eax
xor ebx, ebx
mov ecx, esi
mov dword [esp + 0x28], ebx
call fcn.004be8d2
mov dl, byte [edi]
lea ecx, [esi + 0xc]
mov byte [esp + 0x28], 1
mov byte [ecx], dl
mov dword [ecx + 4], ebx
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebx
mov eax, dword [0x4ec400]
push eax
push ebx
push edi
call fcn.00415fc0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
cmp eax, ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], edx
mov dword [esi], 0x4ec420
je 0x4b0d2b
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4b0d22
cmp al, 0xff
je 0x4b0d22
dec al
mov byte [ecx], al
jmp 0x4b0d2b
push ecx
call fcn.004b124a
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x4ecf0c
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x4d6c30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor eax, eax
mov cl, byte [edx]
test cl, cl
je 0x4d6c52
Function at 0x2e001992
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x2e03da4c]
jne 0x2e00199c
repz ret
jmp fcn.2e027a26

Function at 0x2e010c88
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e028d1f
call fcn.2e001440
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call fcn.2e025cc1
test ax, ax
je 0x2e010d3c
lea eax, [ebp - 0x14]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010d3c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push ebx
mov edi, str.progid
push edi
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x2e010d30
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.2e025cc1
pop ecx
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x18]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x14]
mov byte [ebp - 4], 1
call esi
test eax, eax
jne 0x2e010d24
push dword [ebp - 0x10]
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.2e025cc1
push dword [ebp - 0x10]
mov byte [ebp - 4], bl
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, esi
call fcn.2e001489
ret

Function at 0x2e010d44
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e028d4a
call fcn.2e0276dc
mov eax, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov byte [ebp - 0x2d], 0
cmp dword [eax + 0x10], edi
jbe 0x2e010e1f
push eax
lea ecx, [ebp - 0x2c]
call fcn.2e025cc1
push esi
mov dword [ebp - 4], edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push esi
lea ecx, [ebp - 0x2c]
call fcn.2e025cc1
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x2e010d90
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x34]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e010e0f
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010e06
mov eax, dword [ebp - 0x38]
inc eax
push eax
call fcn.2e025cc1
mov edi, eax
pop ecx
mov dword [ebp - 0x3c], edi
lea eax, [ebp - 0x38]
push eax
push edi
push 0
push 0
push esi
push dword [ebp - 0x34]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010dfb
push edi
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push edi
mov ecx, ebx
call fcn.2e025cc1
mov byte [ebp - 0x2d], 1
push edi
mov byte [ebp - 4], 0
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.2e025cc1
mov al, byte [ebp - 0x2d]
call fcn.2e02774b
ret 8
Function at 0x2e010e2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x2e028d77
call fcn.2e001440
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
xor ebx, ebx
push 0x80000001
call esi
cmp eax, ebx
je 0x2e010e62
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call esi
cmp eax, ebx
jne 0x2e010ecd
lea eax, [ebp + 8]
push eax
push ebx
mov esi, 0x2e02b538
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e010ec4
mov eax, dword [ebp + 8]
cmp eax, ebx
jl 0x2e010ec4
inc eax
push eax
call fcn.2e025cc1
mov edi, eax
pop ecx
mov dword [ebp - 0x14], edi
lea eax, [ebp + 8]
push eax
push edi
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e010eb9
push edi
call sub.MSVCR100.dll_strlen
pop ecx
mov ecx, dword [ebp + 0xc]
push eax
push edi
call fcn.2e025cc1
mov bl, 1
or dword [ebp - 4], 0xffffffff
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e001489
ret 8
Function at 0x2e025cc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x2e025cd0
pop dword [ebp - 0x50]
mov eax, 0x1b657f89
sub eax, 0xed6322b9
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2e519ffc
add dword [ebp - 0x60], 0x2000a54f
mov dword [ebp - 0x5c], 0xefe3aef0
sub dword [ebp - 0x5c], 0xbdb062ab
mov dword [ebp - 0x58], 0xd8066683
sub dword [ebp - 0x58], 0x8bba2255
mov dword [ebp - 0x54], 0xa62167fe
add dword [ebp - 0x54], 0x59de9802
lea eax, [ebp - 0x60]
push eax
mov eax, 0x92e2e98f
sub eax, 0x64e0394f
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe8124b2a
add dword [ebp - 0x60], 0x8c601e2c
mov dword [ebp - 0x5c], 0xf4e708a3
add dword [ebp - 0x5c], 0x4c8558d2
mov dword [ebp - 0x58], 0xe237da34
add dword [ebp - 0x58], 0x81379238
mov dword [ebp - 0x54], 0xa52f9564
add dword [ebp - 0x54], 0x5ad06a9c
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3a9df4bb
sub eax, 0xc9b447f
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3a4dc
push 0
call eax
mov ecx, 0x35ec
mov edi, eax
mov ebx, 0xdcb926f4
sub ebx, 0xaeb43ef4
add ebx, dword [ebp - 0x50]
mov esi, 0x237cc848
add esi, 0x82d4dc92
add dword [ebp - 0x3c], esi
mov edx, dword [ebx]
add dword [ebp - 0x30], 0x6179081d
add edx, esi
xor dword [ebp - 8], 0x1b7f716e
mov dword [edi], edx
xor dword [ebp - 0x10], 0x65d9c159
add edi, 0x8fe445e6
add edi, 0x701bba1e
add ebx, 4
loop 0x2e025dec
add eax, 0xca83
mov ebx, eax
add eax, 0xc12c3dec
sub eax, 0xc12c3de7
mov ecx, 0x2e000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10027d88
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x10027d97
pop dword [ebp - 0x18]
mov eax, 0x10027d97
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x261a32d8
sub dword [ebp - 0x28], 0xd7c7ed8d
mov dword [ebp - 0x24], 0x92bde675
add dword [ebp - 0x24], 0x9f7565d0
mov dword [ebp - 0x20], 0xf76e3386
add dword [ebp - 0x20], 0x54de10a8
mov dword [ebp - 0x1c], 0x9c379ee
add dword [ebp - 0x1c], 0xf63c8612
lea eax, [ebp - 0x28]
push eax
mov eax, 0x67afeab7
sub eax, 0x57abd9df
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0xf40a9fb3
sub dword [ebp - 0x28], 0x7f98365d
mov dword [ebp - 0x24], 0x47c7165f
add dword [ebp - 0x24], 0xf9a54b16
mov dword [ebp - 0x20], 0xe55a27f
add dword [ebp - 0x20], 0x5519c9ed
mov dword [ebp - 0x1c], 0x6814a5c2
sub dword [ebp - 0x1c], 0x6814a5c2
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0x7dc4e1e1
sub eax, 0x6dc0d169
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x4bc5f
push 0
call eax
mov ecx, 0x4069
mov ebx, eax
mov esi, 0xb8eb50ee
add esi, 0x57199912
add esi, dword [ebp - 0x18]
mov edi, 0x94489307
mov edx, dword [esi]
mov dword [ebp - 0x10], 0xbccefeba
xor edx, edi
mov dword [ebx], edx
sub dword [ebp - 0xc], eax
add ebx, 0x42906e1
sub ebx, 0x42906dd
add esi, 0x5c6a3dc8
add esi, 0xa395c23c
loop 0x10027ea8
add eax, 0x1f1369f6
add eax, 0xe0ed8a81
mov ebx, eax
add eax, 0xd88245e2
sub eax, 0xd88245dd
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x1003f584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004acd0]
jne 0x1003f58e
repz ret
jmp fcn.1003fc70
Function at 0x10003370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x1000337f
pop dword [ebp - 0x1c]
mov eax, 0xf9ad8145
add eax, 0x1652b23a
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x8d20b21c
sub dword [ebp - 0x2c], 0x3ece6cd1
mov dword [ebp - 0x28], 0x675096c5
sub dword [ebp - 0x28], 0x351d4a80
mov dword [ebp - 0x24], 0x3eabc045
sub dword [ebp - 0x24], 0xf25f7c17
mov dword [ebp - 0x20], 0xa92e3ff2
sub dword [ebp - 0x20], 0xa92e3ff2
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xbb92eeed
sub eax, 0xab913edd
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x4422f99c
sub dword [ebp - 0x2c], 0xcfb09046
mov dword [ebp - 0x28], 0xf1e761d8
add dword [ebp - 0x28], 0x4f84ff9d
mov dword [ebp - 0x24], 0xd4ff247b
add dword [ebp - 0x24], 0x8e7047f1
mov dword [ebp - 0x20], 0xf289af2e
sub dword [ebp - 0x20], 0xf289af2e
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x9a961336
sub eax, 0x8a946322
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x40144
push 0
call eax
mov ecx, 0xff35d3ad
add ecx, 0xca7b76
mov edx, eax
mov edi, 0x2cce1d6c
add edi, 0xe3349294
add edi, dword [ebp - 0x1c]
mov esi, 0xf2a14357
sub esi, 0xc12819e1
mov ebx, dword [edi]
sub dword [ebp - 0x18], ecx
xor ebx, esi
sub dword [ebp - 0x14], 0xcfb3b710
mov dword [edx], ebx
sub dword [ebp - 0x14], ebx
add edx, 0xa6cb3b49
add edx, 0x5934c4bb
add edi, 0x483db10
add edi, 0xfb7c24f4
loop 0x100034a1
add eax, 0x43181b45
add eax, 0xbce9141a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x4bc8097e
add ecx, 0xc437f682
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401000
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
push str.CUSTOM
push 0x409030
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x40101d
pop edi
pop esi
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40102d
pop edi
pop esi
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40103d
pop edi
pop esi
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0xc]
pop edi
mov dword [ecx], eax
mov eax, esi
pop esi
ret

Function at 0x401060
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401134
cmp eax, esi
jae 0x401134
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], 0x5c
jne 0x4010a6
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebx - 1], al
push ebp
push 0
call fcn.00403ec0
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str..exe
add ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
add ebp, ecx
cmp ebp, esi
pop ebp
jae 0x401134
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov al, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x401140
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4040
call fcn.00403fc0
mov eax, dword [esp + 0x4044]
mov ecx, dword [esp + 0x4048]
push ebx
push esi
push edi
mov dword [esp + 0xc], eax
push 0x38
lea eax, [esp + 0x10]
lea edx, [esp + 0x50]
mov ebx, 0x4000
push str.1.0.4
push eax
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
call fcn.00401680
lea ecx, [esp + 0x18]
push 4
push ecx
call fcn.004016a0
mov esi, dword [esp + 0x406c]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0x14
test eax, eax
jne 0x4011f4
lea edx, [esp + 0x48]
push 0
push edx
mov edx, dword [esp + 0x24]
mov eax, ebx
lea ecx, [esp + 0x54]
sub eax, edx
push eax
push ecx
push esi
call edi
lea eax, [esp + 0xc]
lea edx, [esp + 0x4c]
push 4
push eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edx
call fcn.004016a0
add esp, 8
test eax, eax
je 0x4011bd
lea ecx, [esp + 0x44]
push 0
push ecx
mov ecx, dword [esp + 0x24]
sub ebx, ecx
lea edx, [esp + 0x54]
push ebx
push edx
push esi
call edi
lea eax, [esp + 0xc]
push eax
call fcn.00401520
add esp, 4
pop edi
pop esi
pop ebx
add esp, 0x4040
ret
Function at 0x404220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x404240
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00405458
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x404261
test byte [esp + 8], 2
je 0x404261
mov dword [0x40ce9c], 0xd
mov dword [0x40cea0], 5
jmp 0x40423c
xor eax, eax
ret
Function at 0x63bc90
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063bca0

Function at 0x63bf20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063bf30

Function at 0x4017c7
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
call sub.kernel32.dll_GetCommandLineA
mov dword [0x405120], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40508e], ecx
mov dword [0x405124], 0x30
mov dword [0x405128], 3
mov dword [0x405130], 0
mov dword [0x405134], 0
mov dword [0x40512c], 0x4030d6
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x405086], ebx
mov dword [0x405138], ebx
mov dword [0x405144], 0xf
mov dword [0x40514c], 0x405067
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x40513c], eax
mov dword [0x405150], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x405140], eax
push 0x405124
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x405086]
push 0
push 0
push 0x2bc
push 0x1f4
push 0xa0
push 0x12c
push 0x40000
push str.Hello_word
push str.2class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x405118], eax
push 0
push dword [0x405118]
call sub.user32.dll_ShowWindow
push dword [0x405118]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
push 0x405154
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4018eb
push 0x405154
call sub.user32.dll_TranslateMessage
push 0x405154
call sub.user32.dll_DispatchMessageA
jmp 0x4018c1
mov eax, dword [0x40515c]
mov esi, dword [0x4051b4]
lea ecx, [0x405086]
add esi, eax
call esi
ret
Function at 0xe63d4b
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esp, [esp + 0x20]
jmp 0xe4a4f2

Function at 0xe7ce52
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
jmp 0xe7ceb3
push ebx
jmp 0xe7ced9
call 0xe7d045
ja 0xe482ea
test eax, 0x52f615c8
call 0x71aef077
cmp byte [eax - 0x7cb22d05], bl
push dword [edi + ecx]
add dword [ebp + 0x47], 3
add byte [edx + 4], dh
jmp 0xe7d632
mov ch, 0xae
ja 0xe48319
sti
loope 0xe48318
dec esi
fnstcw word [eax]
push dx
mov word [esp], ax
push word [esp]
jmp 0xe7d5e7
fst dword [ecx + 3]
add byte [ecx], ch
dec eax
push 0xcff6eb9f
call fcn.00e58170
sub cl, cl
stosb byte es:[edi], al
lahf
jmp 0xe48312
jmp 0xe7d8ce
mov bl, byte [ecx + 2]
sub esp, 0x1f
push dword [esp + 0xe]
jmp 0xe7d6f9
push bx
jmp 0xe7d5f5
jmp 0xe7d718
lea esp, [esp + 1]
lea esp, [esp + 3]
jmp 0xe7ce49
jmp 0xe7ce31
mov ecx, dword [ebp + 8]
call 0xe7ce52
in al, 0x66
pop dword [esp]
add esp, 0
lea esp, [esp + 2]
jmp 0xe7ce89
lea esp, [esp + 4]
cmp esi, 0x1a
jmp 0xe7cec9
mov byte [ecx], dl
sub esp, 8
pop word [esp + 1]
lea esp, [esp + 2]
jmp 0xe7ce5f
cmp esi, 0x34
jmp 0xe7cefe
jae 0xe48219
xchg cl, ch
lea ecx, [esi + 0x41]
jmp 0xe481fa
cmp esi, eax
lea esp, [esp + 4]
jae 0xe48285
pushfd
xchg dword [esp], ecx
jmp 0xe7cf0c
jae 0xe4822f
lea ecx, [esi + 0x47]
jmp 0xe481fa
pushal
mov ecx, dword [esp + 0x1d]
lea esp, [esp + 0x24]
lea ecx, [esi - 4]
jmp 0xe481fa
je 0xe482de
cmp al, 0x2f
jne 0xe48325
je 0xe482de
mov eax, 0x44b5d23c
test dword [esi + reloc.WINMM.dll_midiStreamOut], ecx
mov ecx, 0x1de24b28
lea esp, [esp + 4]
cmp al, 0x2b
push cx
lea esp, [esp + 2]
jmp 0xe7d5c3
lea esp, [esp + 2]
jmp 0xe7d6b7
inc ecx
jbe 0xe7d609
xchg ebx, eax
test byte [0xfa8046b5], 0x5a
add eax, 0xfa8046b5
pop edx
mov ch, 0x46
cmp dl, 0x5a
push ebp
lea esp, [esp + 4]
jbe 0xe4835b
ja 0xe48371
sti
jno 0xe7d603
xor byte [ebx - 0x3e], 0xfb
jb 0xe7d608
xchg dword [edx - 0x39], esi
push dword [edi - 0x19]
xor byte [ecx - 0x35], 0xea
mov dl, byte [ecx + 1]
cmp dl, 0x41
jb 0xe48371
jmp 0xe7d60b
cmp dl, 0x61
call fcn.00e7d656
jne 0xe48325
je 0xe4835b
rol byte [ecx - 0x2f], cl
mov al, 0x43
add dword [eax - reloc.WINMM.dll_midiStreamOut], 0xfffffffa
sub ecx, dword [edi]
test byte [ebp - 0x54], bh
cld
inc dword [eax - reloc.WINMM.dll_midiStreamOut]
lea esp, [esp + 4]
jb 0xe483ca
stc
call fcn.00e7d707
inc esp
neg esi
sub dword [eax - 0x15], ecx
lea esp, [esp + 3]
lea esp, [esp + 0x20]
cmp bl, 0x41
pushfd
jmp 0xe7d6e3
pushal
jmp 0xe7d92a
mov eax, 0x403
not bx
lea esp, [esp + 0x20]
pop ebx
ret

Function at 0xf3e024
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg ch, bl
pop edx
pushfd
jmp 0xf3e04b
xchg word [esp + 7], dx
pop ax
bt esi, ebp
mov word [esp + 0x1d], bx
pop word [esp + 0x25]
mov ax, word [esp + 0x24]
jmp 0xf3e487
lea edi, reloc.WINMM.dll_midiStreamOut
Function at 0xf3e2af
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x15]
xchg bh, ch
setne dh
neg cx
xchg byte [esp], dh
jmp 0xf3e0b6
bswap edi
mov cx, di
pop esi
rdtsc
mov ebx, ecx
lea ecx, [eax + 0xf1]
jmp 0xf3e078
lea esp, [esp]
lea ebx, [edx + esi]
btc cx, bp
sbb si, 0xddd
mov ebp, dword [esp]
call fcn.00f3e0a0
test byte [esi + 0x54], ah
push sp
bsr esi, esp
xchg word [esp + 0xf], cx
mov bp, di
lea esp, [esp + 1]
bswap esi
jmp 0xf3e08e
or ebx, esi
mov dx, 0x9124
xchg ch, dl
lea edi, [esp + ebp]
pop ebp
sub esp, 2
jmp 0xf3e0ce
xchg dword [esp + 0x16], ecx
lea esp, [esp + 0xe]
push word [esp + 0x17]
mov al, 0x54
xchg edi, eax
mov bx, 0x8e54
jmp 0xf3e109
stc
xchg byte [esp + 6], ah
push dword [esp + 2]
bsr bx, sp
lea eax, [edx + esi]
jmp 0xf3e2e6
xchg cx, bp
mov esi, 0x6fa7b786
rdtsc
xchg dword [esp + 5], edx
jmp 0xf3e2fd
mov ecx, dword [esp + 0xc]
push dword [esp + 7]
mov ah, byte [esp + 5]
mov bx, ax
pop edi
mov edi, 0xb040fc2c
jmp 0xf3e2d0
mov esi, 0x44cc3377
push word [esp + 7]
cmp bx, 0xcfa6
mov cx, 0xa1d9
mov al, 0xdb
mov ch, byte [esp + 0x11]
jmp 0xf3e338
inc eax
rdtsc
cmc
add esp, 8
sub esp, 0xf
stc
jmp 0xf3e37d
mov ah, byte [esp + 0x14]
mov ax, word [esp + 0xd]
pop si
call fcn.00f3e41a
in al, dx
inc esi
jno 0xf3e3ec
jae 0xf3e3e4
xchg word [esp + 9], cx
xchg dword [esp + 9], ecx
lea ebx, [ecx + edx]
xchg bh, bl
mov al, byte [esp + 6]
seto bl
btr si, sp
jmp 0xf3e367
add esp, 0
pushal
mov cx, word [esp + 0x24]
rdtsc
lea esi, [esp + edx]
xchg dh, dl
jmp 0xf3e1a5
pop ebx
dec ecx
xchg word [esp + 0x14], di
setbe bh
pop si
lea ebx, [edx + ebp]
jmp 0xf3e3ff
setnp al
jmp 0xf3e3b4
lea eax, reloc.WINMM.dll_midiStreamOut
lea esp, [esp + 0x17]
enter 0xffffffffffffffff, 0xffffffffffffff8d
and al, 0x17
mov byte [esp + 1], dh
cld
jmp 0xf3e425
mov esi, ebp
xchg ebx, edx
inc cx
lea ebp, [edx*4]
mov di, 0x4e5e
jmp 0xf3e3e9
mov dx, word [esp + 2]
mov cx, word [esp]
sub esp, 7
mov dword [esp + 4], esp
call 0xf3e43b
cmp byte [esi - 0x46], ah
loopne 0xf3e465
add esp, 0
call fcn.00f3e468
push esp
insb byte es:[edi], dx
jae 0xf3e48c
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
sbb ecx, dword [edx + 0xf012474]
xchg esi, eax
lds esp, [esi - 0x79]
shl dword [esi - 0x75], 1
stc
mov dh, byte [esp + 1]
setbe ch
xchg cx, dx
mov di, cx
rcr ebp, cl
bsr esi, edx
jmp 0xf3e39f
invalid
inc esi
bsr cx, di
add esp, 0x21
xchg byte [esp + 4], ah
xchg dword [esp], edx
cpuid
jmp 0xf3e451

Function at 0xf4292a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0xf3dfff
call fcn.00f3e004
call 0xf42033
jmp 0xf42964
jmp 0xf42984
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xf42959
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xf4202e
pop eax
sub eax, 0xb42033
push eax
jmp 0xf3bb13
mov word [esp], di
mov byte [esp + 2], bh
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0xf4292c