joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55bbf0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x55bc39
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x55c0b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fcd10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0055bc60
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0055bce0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0055bce0
lea ecx, [esi + 0xc]
call fcn.005eb767
lea ecx, [esi + 0x10]
call fcn.005eb767
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0055d270
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0055d270
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0055d270
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.005eb7dc
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.005eb7dc
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x564e30
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x564e7c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x564e7c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x564e66
push eax
call ebp
test ax, ax
jl 0x564e74
inc esi
add edi, 4
cmp esi, 6
jb 0x564e58
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00564b30
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x567c80
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x567ce0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x567ce0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x567ce0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x567ce0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x567d20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x5728e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5728eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5729ee
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x639668]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x639668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x639668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x639668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x639668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x639668]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x639668]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x639668]
xor eax, edx
inc ecx
dec edi
jne 0x572906
pop edi
test esi, esi
je 0x572a10
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x639668]
xor eax, edx
inc ecx
dec esi
jne 0x5729f2
pop esi
pop ebx
not eax
ret
Function at 0x57a770
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5fd8f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0057ab40
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.0057ab40
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.0057abb0
lea ecx, [esp + 0x10]
call fcn.0051c3e0
cmp eax, 1
jae 0x57a818
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x57a883
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x57a883
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.0057abb0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.0051c3e0
cmp eax, 1
jb 0x57a883
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0057a610
test eax, eax
je 0x57a883
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0057a8f0
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.0057ac10
push edi
lea ecx, [esp + 0x24]
call fcn.0057ac30
push esi
lea ecx, [esp + 0x24]
call fcn.0057acd0
push str..tmp
lea ecx, [esp + 0x24]
call fcn.0057ac30
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.0057a5f0
test eax, eax
je 0x57a8b9
inc esi
cmp esi, 0x7a0a1f00
jb 0x57a83a
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0057ab60
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0057ab60
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.0057ac10
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0057ab60
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0057ab60
mov eax, 1
jmp 0x57a8a4
Function at 0x57b040
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fd9a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0057ab40
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.0057abb0
push 0
mov ecx, esi
call fcn.0057afc0
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x57b178
lea ecx, [esp + 0xc]
call fcn.0051c3e0
cmp eax, 1
jae 0x57b0c7
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0057ab60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x57b114
push 0
lea ecx, [esp + 0x10]
call fcn.0051dfc0
push eax
push edi
mov ecx, 0x6ba94c
call fcn.0057a770
test eax, eax
jne 0x57b11c
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0057ab60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.0057abb0
push edi
mov ecx, 0x6ba94c
call fcn.0057a6d0
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.0051dfb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x57b178
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x57b178
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x57b1a8
push 1
mov ecx, esi
call fcn.0057afc0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0057ab60
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.0057ab60
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x57bae0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.0057abb0
pop edi
add esp, 0x104
ret 4
Function at 0x57f270
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5fdec8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
mov dword [esp + 0x24], 0
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov esi, dword [esp + 0x30]
test esi, esi
je 0x57f2b3
mov eax, dword [esi]
jmp 0x57f2b5
xor eax, eax
mov ecx, dword [edi]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x38]
push edx
push eax
push edi
call dword [ecx + 0x74]
test eax, eax
jge 0x57f2d6
push 0x67b330
push edi
push eax
call fcn.005e8585
mov edi, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
mov eax, edi
test esi, esi
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov word [esp + 0xc], 0
mov dword [eax + 4], edx
mov edx, dword [esp + 0x18]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
je 0x57f336
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x57f336
mov eax, dword [esi]
test eax, eax
je 0x57f31d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x57f32d
push eax
call fcn.005eb546
add esp, 4
push esi
call fcn.005eb546
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc

Function at 0x59ac70
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x59aca3
push esi
call fcn.0059fbb0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x59ac9c
mov dword [esi + 0x14], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x59ad29
mov eax, dword [esi + 0x1b8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x59ad12
mov eax, dword [esi + 8]
test eax, eax
je 0x59acc7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b8]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x59ad0e
cmp eax, 2
je 0x59ad12
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x59acba
cmp eax, 3
je 0x59aced
cmp eax, 1
jne 0x59acba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x59acba
mov edx, dword [esi + 0x144]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x59acba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0059ad60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x59ad49
mov ecx, dword [esi]
push esi
mov dword [ecx + 0x14], 0x15
mov edx, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [edx + 0x18], eax
mov ecx, dword [esi]
call dword [ecx]
add esp, 4
push esi
call fcn.0059ad60
add esp, 4
pop esi
ret
Function at 0x5cb080
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x5cb08b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x5cb18e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x63f2b8]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x63f2b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x63f2b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x63f2b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x63f2b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x63f2b8]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x63f2b8]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x63f2b8]
xor eax, edx
inc ecx
dec edi
jne 0x5cb0a6
pop edi
test esi, esi
je 0x5cb1b0
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x63f2b8]
xor eax, edx
inc ecx
dec esi
jne 0x5cb192
pop esi
pop ebx
not eax
ret
Function at 0x5edc99
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5edcd1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005ebc83
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005ebc5b
jmp 0x5edcdd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5ef387
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5ef3c9
call fcn.005f54be
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5ef3c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5ef3c0
xor eax, eax
jmp 0x5ef3d1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005ef3d7
pop edi
pop esi
pop ebx
ret 4

Function at 0x5f59ee
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5f5a1c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5f5a3a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005f5954
jmp 0x5f5a3a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5f5a3a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005f5954
test edi, edi
mov eax, edi
jne 0x5f5a24
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x1c6665f5
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x3f070b85
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x403910
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
add ecx, 4
mov dword [0x4040fe], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404670], eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404604], eax
mov dword [0x4040f6], eax
mov dword [0x4045f0], 0x30
mov dword [0x4045f4], 2
jmp 0x403955
mov dword [0x4045f8], 0x402f69
mov dword [0x4045fc], 0
mov dword [0x404600], 0
mov dword [0x404618], 0x404564
mov dword [0x404610], 0xf
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404608], eax
mov dword [0x40461c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40460c], eax
push 0x4045f0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040f6]
push 0
push 0
push 0x1e5
push 0x203
push 0xfffff98e
push 0xfffff9c0
push 0xcf0000
push str.asdlkjalsdj_ai8
push str.first
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404668], eax
push 5
push dword [0x404668]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404668]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404620]
jmp 0x403a29
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x403a1b
mov eax, dword [0x404628]
jmp 0x403a44
call 0x402a90
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x6abf3283
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x7d655054
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40244c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push esi
push edi
xor eax, eax
mov dword [ebp - 4], edx
mov dword [ebx + 0xc18], eax
mov edi, ecx
cmp byte [ebp + 8], 0
mov esi, 0x80000000
je 0x402475
or esi, 0x40000000
mov dword [ebp - 8], 1
cmp byte [ebx + 0x12], 0
jne 0x402488
cmp byte [ebp + 0xc], 0
je 0x40248c
or dword [ebp - 8], 2
call fcn.00407474
test eax, eax
je 0x4024b8
test edi, edi
je 0x4024b8
cmp word [edi], 0
je 0x4024b8
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push edi
call sub.KERNEL32.DLL_CreateFileW
mov esi, eax
jmp 0x4024d1
push 0
push 0x8000000
push 3
push 0
push dword [ebp - 8]
push esi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
jne 0x4024ea
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x4024ea
mov dword [ebx + 0xc18], 1
xor eax, eax
cmp esi, 0xffffffff
mov byte [ebx + 0x13], 0
setne dl
mov dword [ebx + 0xc], eax
and edx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 9], dl
cmp byte [ebp - 9], 0
je 0x40252c
mov dword [ebx + 4], esi
test edi, edi
je 0x40251d
lea eax, [ebx + 0x416]
mov edx, edi
call fcn.00406fd0
push dword [ebp - 4]
add ebx, 0x15
push ebx
call fcn.0041d080
add esp, 8
mov al, byte [ebp - 9]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4026f4
Capabilities:
Delete file

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0xc], 0
jne 0x402703
cmp byte [ebx + 0x14], 0
jne 0x402707
xor eax, eax
pop ebx
ret
cmp dword [ebx + 4], 0xffffffff
je 0x402714
mov eax, ebx
call fcn.00402688
call fcn.00407474
test eax, eax
je 0x40273d
cmp word [ebx + 0x416], 0
je 0x40273d
add ebx, 0x416
push ebx
call sub.KERNEL32.DLL_DeleteFileW
test eax, eax
setne al
and eax, 1
jmp 0x40274e
add ebx, 0x15
push ebx
call sub.KERNEL32.DLL_DeleteFileA
test eax, eax
setne al
and eax, 1
pop ebx
ret
Function at 0x402750
Capabilities:
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov esi, ecx
test esi, esi
mov edi, eax
mov dword [esp], edx
je 0x402888
mov eax, dword [edi + 0xc]
test eax, eax
je 0x40278b
dec eax
je 0x402775
dec eax
je 0x402781
jmp 0x40278b
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
jmp 0x40278b
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov dword [edi + 4], eax
cmp dword [edi + 0xc], 0
je 0x4027dd
xor ebp, ebp
cmp esi, ebp
jle 0x4027f9
push 0
lea eax, [esp + 8]
push eax
mov edx, esi
sub edx, ebp
cmp edx, 0x4000
jge 0x4027b0
mov ecx, esi
sub ecx, ebp
jmp 0x4027b5
mov ecx, 0x4000
push ecx
mov eax, dword [esp + 0xc]
add eax, ebp
push eax
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
je 0x4027f9
add ebp, 0x4000
cmp esi, ebp
jg 0x402797
jmp 0x4027f9
push 0
lea eax, [esp + 8]
push eax
push esi
push dword [esp + 0xc]
push dword [edi + 4]
call sub.KERNEL32.DLL_WriteFile
test eax, eax
setne bl
and ebx, 1
test bl, bl
jne 0x402884
cmp dword [edi + 0xc], 0
jne 0x402884
mov eax, edi
call fcn.00402a48
push edx
push eax
mov eax, esi
lea ebp, [edi + 0x15]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp + 8], eax
mov eax, ebp
mov dword [esp + 0xc], edx
call fcn.00402e4c
cmp edx, dword [esp + 0xc]
jne 0x40283d
cmp eax, dword [esp + 8]
jbe 0x40285d
jmp 0x40283f
jle 0x40285d
cmp dword [esp + 0xc], 0
jne 0x40284f
cmp dword [esp + 8], 0xffffffff
jbe 0x40285d
jmp 0x402851
jle 0x40285d
mov edx, ebp
mov eax, 0x429d74
call fcn.00415e58
mov edx, ebp
mov eax, 0x429d74
call fcn.00415e84
test al, al
jne 0x40278b
mov edx, ebp
mov eax, 0x429d74
call fcn.00415e2c
jmp 0x402884
mov byte [edi + 8], 1
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x402960
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, eax
push esi
push edi
push ecx
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x402987
cmp esi, 0x4e20
jle 0x40297d
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [esp + 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4029c4
mov eax, ebx
call fcn.00402b98
test al, al
je 0x4029bf
cmp esi, 0x4e20
jle 0x4029bf
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00402960
jmp 0x4029c7
or eax, 0xffffffff
jmp 0x4029c7
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x402c10
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
call fcn.00407474
test eax, eax
je 0x402c36
test ebx, ebx
je 0x402c36
cmp word [ebx], 0
je 0x402c36
push 0
push ebx
call sub.KERNEL32.DLL_CreateDirectoryW
jmp 0x402c3e
push 0
push esi
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
je 0x402c51
mov ecx, edi
mov edx, ebx
mov eax, esi
call fcn.00402ffc
xor eax, eax
jmp 0x402c6c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
je 0x402c60
cmp eax, 3
jne 0x402c67
mov eax, 2
jmp 0x402c6c
mov eax, 1
pop edi
pop esi
pop ebx
ret