joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d77a0
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x94
mov eax, dword [esp + 0x9c]
push esi
push 0x40
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x24], 0x67452301
mov dword [esp + 0x28], 0xefcdab89
mov dword [esp + 0x2c], 0x98badcfe
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
call fcn.005d75b0
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.005d76e0
mov esi, dword [esp + 0xb0]
add esp, 0x14
xor edx, edx
mov cl, byte [esp + edx + 4]
mov al, cl
and cl, 0xf
sar al, 4
and al, 0xf
cmp al, 0xa
movsx eax, al
jge 0x5d781a
add eax, 0x30
jmp 0x5d781d
add eax, 0x57
mov byte [esi], al
cmp cl, 0xa
movsx eax, cl
jge 0x5d782c
add eax, 0x30
jmp 0x5d782f
add eax, 0x57
mov byte [esi + 1], al
inc edx
add esi, 2
cmp edx, 0x10
jl 0x5d7800
pop esi
add esp, 0x94
ret

Function at 0x5d7850
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x84
push ebx
mov ebx, dword [esp + 0x90]
push ebp
mov ebp, dword [esp + 0x90]
push esi
push edi
mov ecx, 0x10
xor eax, eax
mov edi, ebp
mov esi, dword [esp + 0xa0]
rep stosd dword es:[edi], eax
mov ecx, 8
mov edi, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
test esi, esi
mov dword [esp + 0x14], 0x9d14e9a1
mov dword [esp + 0x18], 0x593b6b0e
je 0x5d78db
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x28
jne 0x5d78bf
mov byte [esi + 0x20], al
mov ecx, 0x20
jmp 0x5d78c9
cmp ecx, 0x38
jle 0x5d78c9
mov ecx, 0x38
mov eax, ecx
lea edi, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x9b5af4
test ecx, ecx
je 0x5d790f
mov edi, ecx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x38
jle 0x5d78fa
mov ecx, 0x38
xor eax, eax
test ecx, ecx
jle 0x5d790f
mov dl, byte [eax + 0x9b5af4]
xor byte [esp + eax + 0x1c], dl
inc eax
cmp eax, ecx
jl 0x5d7900
lea eax, [esp + 0x14]
push eax
push ebp
call fcn.005d77a0
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.01d0a8e3
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea esi, [edx + ebp]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x10], esi
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
cdq
and edx, 3
and ecx, 3
add eax, edx
rep movsb byte es:[edi], byte [esi]
sar eax, 2
xor ecx, ecx
test eax, eax
jle 0x5d7974
mov esi, ebp
mov dl, byte [esi]
add esi, 4
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, eax
jl 0x5d7967
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x5d8540
Capabilities:
Encode data using base64
Terminate process

Disassembly:
sub esp, 0x118
mov ecx, 0x3f
mov eax, 0x80808080
push ebx
push ebp
push esi
push edi
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, 0x41
mov cl, al
sub cl, 0x41
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x5a
jle 0x5d8562
mov eax, 0x61
mov dl, al
sub dl, 0x47
mov byte [esp + eax + 0x28], dl
inc eax
cmp eax, 0x7a
jle 0x5d8576
mov eax, 0x30
mov cl, al
add cl, 4
mov byte [esp + eax + 0x28], cl
inc eax
cmp eax, 0x39
jle 0x5d858a
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x53], 0x3e
mov byte [esp + 0x57], 0x3f
mov byte [esp + 0x65], 0
mov dword [esp + 0x18], ebp
je 0x5d871d
mov ebx, dword [esp + 0x130]
mov dword [esp + 0x10], 3
mov dword [esp + 0x14], 4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
xor eax, eax
lea esi, [edx + ecx]
movsx ecx, byte [esi + eax]
mov dl, byte [esp + ecx + 0x28]
test dl, 0x80
jne 0x5d86ee
mov byte [esp + eax + 0x20], cl
mov byte [esp + eax + 0x1c], dl
inc eax
cmp eax, 4
jl 0x5d85ec
mov esi, dword [esp + 0x138]
mov edx, dword [esp + 0x10]
cmp edx, dword [esi]
jle 0x5d8656
mov eax, dword [esp + 0x14]
push eax
call fcn.005f1c67
mov ecx, dword [esi]
mov esi, ebx
mov edx, ecx
mov edi, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
mov dword [esp + 0x2c], eax
rep movsb byte es:[edi], byte [esi]
call fcn.005f1b7e
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x2c]
add esp, 8
mov dword [ecx], eax
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x10]
mov dl, ch
mov al, cl
sar dl, 4
shl al, 2
or dl, al
mov eax, dword [esp + 0x14]
mov byte [ebx + ebp], dl
inc ebp
inc eax
mov cl, ch
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1e]
mov dl, al
inc edi
sar dl, 2
shl cl, 4
or dl, cl
mov ecx, dword [esp + 0x14]
shl al, 6
or al, byte [esp + 0x1f]
mov byte [ebx + ebp], dl
inc ebp
mov edx, edi
inc ecx
inc edx
mov byte [ebx + ebp], al
mov al, byte [esp + 0x22]
inc ebp
inc ecx
inc edx
mov dword [esp + 0x10], edi
cmp al, 0x3d
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
je 0x5d8703
mov cl, byte [esp + 0x23]
xor eax, eax
cmp cl, 0x3d
setne al
add eax, 2
cmp eax, 3
jl 0x5d8703
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x12c]
or ecx, 0xffffffff
xor eax, eax
add edx, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], edx
cmp edx, ecx
jae 0x5d8724
jmp 0x5d85dc
push ecx
push str.Illegal_character__c_in_input._n
call fcn.005f345d
add esp, 8
push 1
call fcn.005f376b
mov eax, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [eax], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
mov ebx, dword [esp + 0x130]
mov ecx, dword [esp + 0x134]
mov byte [ebx + ebp], 0
pop edi
pop esi
mov dword [ecx], ebp
mov eax, ebx
pop ebp
pop ebx
add esp, 0x118
ret
Function at 0x5dbe60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xa24878]
xor edx, edx
cmp eax, edx
jne 0x5dbe86
xor eax, eax
mov byte [eax + 0xa24778], al
inc eax
cmp eax, 0x100
jl 0x5dbe6e
mov dword [0xa24878], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xa24778
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5dbf17
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5dbeea
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5dbeb8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5dbf20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5dbf73
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5dbf5a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5e28f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6169ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.005e3210
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x9b5d4c
call fcn.00603657
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x5e2983
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00603657
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x5e297c
push 0
mov ecx, eax
call fcn.005d9a90
mov dword [esi + 0xc], eax
jmp 0x5e2985
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x5e2985
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x605d16
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x605d4e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00603d71
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00603d49
jmp 0x605d5a
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x607511
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x607553
call fcn.0060e25f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x607553
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x60754a
xor eax, eax
jmp 0x60755b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00607561
pop edi
pop esi
pop ebx
ret 4

Function at 0x60e78f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x60e7bd
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x60e7db
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0060e6f5
jmp 0x60e7db
mov eax, dword [esi + 0x14]
test eax, eax
je 0x60e7db
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0060e6f5
test edi, edi
mov eax, edi
jne 0x60e7c5
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10002ab4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push edi
push 1
pop esi
call fcn.100027a8
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
and dword [ecx + 0x136], 0
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
inc ebp
or byte [esi], cl
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
mov dword [ebp + 8], edi
push es
add al, byte [eax]
add byte [ebp + 0x9c9184], cl
add byte [eax], al
mov eax, esi
mov esi, edi
mov edi, esp
jl 0x10002aea
mov esi, 0x3e8
call int.10002a32
dec esi
jne 0x10002b13
pop edi
pop esi
jnp 0x10002b7c
ret

Function at 0x10006752
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x20
mov eax, dword [esi*4 + 0x1004c308]
pop edx
and eax, dword [ebp + 8]
sub edx, esi
cmp edx, esi
jl 0x10006797
push ebx
mov ebx, dword [ebp + 8]
mov edi, edx
sub edi, esi
mov ecx, edi
shr ebx, cl
mov ecx, edx
mov edx, ebx
mov ebx, eax
shr ebx, cl
mov ecx, edi
xor edx, ebx
and edx, dword [esi*4 + 0x5004c38c]
shl edx, cl
add eax, edx
mov edx, edi
cmp edx, esi
jge 0x1000676e
pop ebx
test edx, edx
jle 0x100067ad
mov edi, eax
mov ecx, esi
shr edi, cl
xor edi, dword [ebp + 8]
and edi, dword [edx*4 + 0x1004c38c]
add eax, edi
fistp qword [esi + 0x5d]
ret
Function at 0x10006deb
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call 0x50046eb8
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
pop esi
ret

Function at 0x10007a95
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x10007acf
mov eax, dword [ebp - 4]
push dword [eax + edi]
call esi
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x10007acc
push 0xd
xor eax, eax
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 5
add edx, dword [ebp - 0x10]
sub eax, 0x61c88647
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
add ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add dword [ebp + 8], edx
dec ecx
jne 0x10007ae3
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10007dd7
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, dword [ebp + 8]
push dword [edi]
call esi
push dword [edi + 4]
mov dword [ebp + 8], eax
call esi
mov ebx, eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
lea edi, [ebp - 0x14]
sub eax, ecx
mov dword [ebp + 0xc], 4
mov dword [ebp - 4], eax
jmp 0x10007e11
mov eax, dword [ebp - 4]
mov edi, 0xd6ff3834
mov dword [edi], eax
add edi, 4
dec dword [ebp + 0xc]
jne 0x10007e0e
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 8]
shr edx, 1
add edx, dword [ebp - 8]
shl esi, 4
add esi, dword [ebp - 0xc]
xor edx, esi
mov esi, dword [ebp + 8]
add esi, eax
xor edx, esi
sub ebx, edx
mov edx, ebx
mov esi, ebx
shr edx, 5
add edx, dword [ebp - 0x10]
shl esi, 4
add esi, dword [ebp - 0x14]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add eax, 0x61c88647
sub dword [ebp + 8], edx
dec ecx
jne 0x10007e28
push dword [ebp + 8]
mov esi, dword [sym.imp.WS2_32.dll_htonl]
call esi
mov edi, dword [ebp + 0x10]
push ebx
mov dword [edi], eax
call esi
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c44c
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x10047722
call fcn.10046e80
sub esp, 0x194
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x10], esi
lea eax, [esi + 8]
mov dword [esi + 4], 0x1004c2a8
push eax
call edi
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x20]
xor ebx, ebx
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov dword [ebp - 4], ebx
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call 0x1020d2f2
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.1000d2f2
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x41]
mov byte [ebp - 4], 2
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.1000d2f2
mov dword [esi + 0x35c], ebx
mov byte [esi + 0x360], bl
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x364]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x374]
mov byte [eax], cl
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov cl, byte [ebp + 0xb]
lea eax, [esi + 0x384]
mov byte [eax], cl
mov ebx, dword [eax + 4]
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0x394]
mov dword [eax], 0x1004c2a8
add eax, 4
push eax
call edi
lcall 0x3b0, 0x8e8d0b45
add byte [eax], al
mov byte [ebp - 4], 7
mov byte [ecx], al
mov al, byte [ebp + 0xb]
mov byte [ecx + 1], al
mov byte [ecx + 0x48], bl
call fcn.1000d65d
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 8
mov dword [esi + 0x3c0], eax
mov eax, dword [eax + 0x10]
add eax, 2
lea ecx, [esi + 0x3c4]
push eax
call fcn.1000ccb6
mov byte [esi + 0x3d4], bl
lea edi, [esi + 0x3d8]
mov eax, 0x1000daa0
mov dword [edi + 0x10], esi
mov dword [edi + 4], ebx
mov dword [edi + 0x14], eax
mov byte [edi + 0x18], 1
mov dword [edi], 0x1004c428
lea eax, [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
push eax
push 0x101
mov byte [esi + 0x3f4], bl
mov dword [esi], 0x1004c424
mov dword [esi + 0x50], ebx
mov dword [esi + 0x154], ebx
mov dword [esi + 0x258], ebx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push ebx
mov ecx, edi
call fcn.1000cd32
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10012556
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
pop edi
jne 0x10012564
push ebx
lea ecx, [esi + 0x7c]
call fcn.10013a80
Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x141f1f0b
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..text
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x1eb3675a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x401290
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], str.WindowsApp
mov dword [ebp - 0x60], sym.__Z15WindowProcedureP6HWND__jjl_16
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x68], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
test ax, ax
jne 0x401344
mov dword [ebp - 0x6c], 0
jmp 0x401412
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov eax, 0x80000000
mov dword [esp + 0x14], eax
mov eax, 0x80000000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Windows_App
mov dword [esp + 4], str.WindowsApp
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x40140c
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x4013c4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
leave
ret 0x10
Function at 0x401f30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x402f6f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f9c
mov ecx, dword [0x42f098]
push edi
add eax, ecx
push edi
push eax
mov dword [0x420c6c], eax
push dword [0x409020]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call 0x4403e6
cmp eax, edi
jl 0x403093
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x409020]
call ebx
test eax, eax
je 0x403090
cmp dword [ebp - 4], esi
jne 0x403090
push dword [ebp + 8]
add dword [0x420c6c], esi
call 0x44a3e6
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403093
cmp dword [ebp + 0x10], edi
jne 0x40305f
cmp dword [ebp + 8], edi
jle 0x40308b
mov esi, 0x41cc28
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x40300f
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
push edi
push esi
push dword [0x409020]
call ebx
test eax, eax
je 0x403090
cmp edi, dword [ebp - 4]
jne 0x403090
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40305b
cmp dword [ebp + 0x14], edi
jne 0x40305b
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x420c6c], eax
cmp dword [ebp + 8], 0
jg 0x403002
jmp 0x40308b
push 0xfffffffffffffffe
jmp 0x403092
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40306a
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push edi
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409020]
call ebx
test eax, eax
je 0x403090
mov eax, dword [ebp - 4]
add dword [0x420c6c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403093
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10