joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.00401bc8
jmp 0x406676

Function at 0x438ca0
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x438a14
mov ecx, ecx
call fcn.00438cd6
sub ebx, 0x5747863f
sub ebx, 0x965e5fd3
xor dword [eax], edi
add ecx, 0x9310d6d7
mov ecx, ebx
inc eax
add ecx, 0x1d73976b
cmp eax, edx
jne fcn.00438ca0
mov ebx, ebx
dec ecx
inc ebx
ret
Function at 0x1000625d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x1000628b
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x10006292
cmp ebx, dword [eax + 4]
jae 0x10006292
xor eax, eax
jmp 0x10006482
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x100062a3
xor eax, eax
inc eax
jmp 0x10006481
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x100062b9
cmp ecx, edx
jae 0x100063fe
cmp dword [eax + 4], 0
je 0x100062c2
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x100062aa
cmp dword [ebp + 8], 0
je 0x100062e4
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x100063fe
cmp eax, esi
jae 0x100063fe
mov eax, dword [0x1000b040]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x10006309
cmp dword [esi*4 + 0x1000b048], edi
je 0x10006402
inc esi
cmp esi, eax
jl 0x100062f7
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [0x10008120]
test eax, eax
je 0x1000647e
cmp dword [ebp - 8], 0x1000000
jne 0x1000647e
test byte [ebp - 0xc], 0xcc
je 0x10006387
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x1000647e
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x1000647e
cmp word [eax + 0x18], 0x10b
jne 0x1000647e
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x1000647e
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x10006387
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x10006387
test byte [ecx + 0x27], 0x80
jne 0x100063fe
push 1
push 0x1000b088
call dword [0x1000811c]
test eax, eax
jne 0x1000629b
mov ecx, dword [0x1000b040]
test ecx, ecx
mov edx, ecx
jle 0x100063bb
lea eax, [ecx*4 + 0x1000b044]
cmp dword [eax], edi
je 0x100063bb
dec edx
sub eax, 4
test edx, edx
jg 0x100063af
test edx, edx
jne 0x100063ec
push 0xf
pop ebx
cmp ecx, ebx
jg 0x100063c8
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x100063e0
lea eax, [edx*4 + 0x1000b048]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x100063ce
cmp ecx, 0x10
jge 0x100063ec
inc ecx
mov dword [0x1000b040], ecx
push 0
push 0x1000b088
call dword [0x1000811c]
jmp 0x1000629b
xor eax, eax
jmp 0x10006481
test esi, esi
jle 0x1000629b
mov ebx, dword [0x1000811c]
push 1
push 0x1000b088
call ebx
test eax, eax
jne 0x1000629b
cmp dword [esi*4 + 0x1000b048], edi
je 0x10006458
mov eax, dword [0x1000b040]
lea esi, [eax - 1]
test esi, esi
jl 0x10006446
cmp dword [esi*4 + 0x1000b048], edi
je 0x10006442
dec esi
jns 0x10006436
test esi, esi
jge 0x10006456
cmp eax, 0x10
jge 0x10006451
inc eax
mov dword [0x1000b040], eax
lea esi, [eax - 1]
jmp 0x10006458
je 0x10006470
xor ecx, ecx
test esi, esi
jl 0x10006470
lea eax, [ecx*4 + 0x1000b048]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x1000645e
push 0
push 0x1000b088
call ebx
jmp 0x1000629b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x403e59
pop dword [ebp - 0x34]
mov eax, 0x1e7651a4
add eax, 0xe1c9ecb5
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x5fbd30a8
sub dword [ebp - 0x44], 0x116aeb5d
mov dword [ebp - 0x40], 0x7a370178
add dword [ebp - 0x40], 0xb7fc4acd
mov dword [ebp - 0x3c], 0x3aedf73a
add dword [ebp - 0x3c], 0x115e4cf4
mov dword [ebp - 0x38], 0x2394bae3
add dword [ebp - 0x38], 0xdc6b451d
lea eax, [ebp - 0x44]
push eax
mov eax, 0xb625bada
add eax, 0x4a1ab58a
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2f094783
sub dword [ebp - 0x44], 0xba96de2d
mov dword [ebp - 0x40], 0x6f890ff2
add dword [ebp - 0x40], 0xd1e35183
mov dword [ebp - 0x3c], 0xabf47cba
sub dword [ebp - 0x3c], 0x4885104e
mov dword [ebp - 0x38], 0xa7552da4
sub dword [ebp - 0x38], 0xa7552da4
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x39dcd
push 0
call eax
mov ecx, 0xd49b71e7
sub ecx, 0xd49b1d71
mov edx, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x34]
mov esi, 0x6d17a020
mov dword [ebp - 0x14], 0x4fc200b5
mov edi, dword [ebx]
add dword [ebp - 0xc], edi
xor edi, esi
xor dword [ebp - 0x1c], edx
mov dword [edx], edi
mov dword [ebp - 0xc], 0xeddf5e80
add edx, 4
add ebx, 0x4f9a5b40
sub ebx, 0x4f9a5b3c
loop 0x403f6a
add eax, 0x144ab
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x74ee3b59
sub ecx, 0x74ae3b59
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x408890
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.00402de0
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
jne 0x4088d4
push 0xcc
push 0x499e08
push 4
mov ecx, dword [ebp - 4]
call fcn.00406c30
or eax, 0xffffffff
jmp 0x40898e
cmp dword [ebp + 8], 0
je 0x4088e0
cmp dword [ebp + 0xc], 0
jg 0x4088fc
push 0xd3
push 0x499e18
push 2
mov ecx, dword [ebp - 4]
call fcn.00406c30
or eax, 0xffffffff
jmp 0x40898e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 1
mov ecx, dword [ebp + 8]
push ecx
call fcn.00429fa0
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40894d
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.004289f0
add esp, 4
test eax, eax
jne 0x40894d
push 0xdb
push 0x499e28
push 0x80000000
mov ecx, dword [ebp - 4]
call fcn.00406c30
or eax, 0xffffffff
jmp 0x40898e
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call fcn.00428a80
add esp, 4
test eax, eax
je 0x40898b
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
call fcn.00428630
add esp, 4
push 0xe3
push 0x499e38
push 0x80000000
mov ecx, dword [ebp - 4]
call fcn.00406c30
or eax, 0xffffffff
jmp 0x40898e
mov eax, dword [ebp - 8]
add esp, 8
cmp ebp, esp
call fcn.00425e10
mov esp, ebp
pop ebp
ret 8
Function at 0x40de90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x495416
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov eax, dword [0x4b7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.00402de0
cmp dword [ebp + 0xc], 0
jne 0x40def2
push 0x4b
push 0x49a164
push 2
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
xor al, al
jmp 0x40e098
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
je 0x40df13
push 0x53
push 0x49a178
push 4
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
xor al, al
jmp 0x40e098
push 0x58
push 0x49a18c
push 1
push 0x1c
call fcn.00425bc0
add esp, 0x10
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x40df43
mov ecx, dword [ebp - 0x18]
call fcn.00410340
mov dword [ebp - 0x20], eax
jmp 0x40df4a
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x38], eax
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x38], 0
jne 0x40df89
push 0x5c
push 0x49a1b4
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
mov ecx, dword [ebp - 0x10]
call fcn.0040eb20
xor al, al
jmp 0x40e098
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x38]
call fcn.00410820
movzx eax, al
test eax, eax
jne 0x40dfbb
push 0x63
push 0x49a1c8
push 7
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
mov ecx, dword [ebp - 0x10]
call fcn.0040eb20
xor al, al
jmp 0x40e098
push 0x6c
push 0x49a1dc
push 1
push 4
call fcn.00425bc0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x10]
cmp dword [eax + 0x14], 0
jne 0x40e003
push 0x73
push 0x49a1f0
push 1
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
mov ecx, dword [ebp - 0x10]
call fcn.0040eb20
xor al, al
jmp 0x40e098
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 0x30], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x34], ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.00406d20
mov eax, dword [ebp - 0x10]
add eax, 0x2c
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
push 0x40e950
push 0
push 0
call fcn.0042e480
add esp, 0x18
mov edx, dword [ebp - 0x10]
mov ecx, dword [edx + 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x14]
cmp dword [eax], 0
jne 0x40e078
push 0x98
push 0x49a204
push 0x80000000
mov ecx, dword [ebp - 0x10]
call fcn.00406c30
mov ecx, dword [ebp - 0x10]
call fcn.0040eb20
xor al, al
jmp 0x40e098
push 0
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x2c]
push edx
mov ecx, 0x4b9574
call fcn.0040ec20
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x38]
call fcn.00410970
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x20
cmp ebp, esp
call fcn.00425e10
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4492c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4492dd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x4492e4
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x4492fb
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043aa50
add esp, 4
or eax, 0xffffffff
jmp 0x4492fd
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x48d2c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4979a3
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push edi
lea edi, [ebp - 0x54]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4b7040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.00402990
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.00406ce0
movzx ecx, al
test ecx, ecx
je 0x48d335
mov dword [ebp - 0x48], 0xfffffffe
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00402ae0
mov eax, dword [ebp - 0x48]
jmp 0x48d3e5
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x40]
call fcn.00402990
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.00406ce0
movzx eax, al
test eax, eax
je 0x48d37b
mov dword [ebp - 0x4c], 0xfffffffe
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00402ae0
mov eax, dword [ebp - 0x4c]
jmp 0x48d3e5
lea ecx, [ebp - 0x40]
call fcn.00402bc0
push eax
lea ecx, [ebp - 0x24]
call fcn.00402bc0
push eax
call fcn.0042b0f0
add esp, 8
test eax, eax
je 0x48d3c0
mov dword [ebp - 0x50], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00402ae0
mov eax, dword [ebp - 0x50]
jmp 0x48d3e5
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x40]
call fcn.00402ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.00402ae0
mov eax, dword [ebp - 0x54]
push edx
mov ecx, ebp
push eax
lea edx, [0x48d410]
call fcn.00425db0
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x54
cmp ebp, esp
call fcn.00425e10
mov esp, ebp
pop ebp
ret

Function at 0x493e10
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x493e2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x493e36
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x493e4d
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043aa50
add esp, 4
or eax, 0xffffffff
jmp 0x493e4f
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x493e60
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x493e7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x493e84
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x493e9b
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043aa50
add esp, 4
or eax, 0xffffffff
jmp 0x493e9d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x421f80
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x421fad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x421fad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4233c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
xor esi, esi
cmp dword [esp + 0x10], esi
jbe 0x423413
push ebx
mov ebx, dword [esp + 0x14]
and ebx, 1
mov al, byte [esi + ebp]
mov ecx, 0x42f098
xor al, 0x73
sub al, 0x58
push ebx
mov byte [esi + ebp], al
call fcn.00402454
push eax
call fcn.00401d5b
mov al, byte [esi + ebp]
sub al, 0x14
xor al, 0x74
add al, 0x4e
xor al, 0x70
sub al, 0x65
xor al, 0x22
sub al, 0x73
xor al, 0x2a
mov byte [esi + ebp], al
inc esi
pop ecx
cmp esi, dword [esp + 0x14]
jb 0x4233d9
pop ebx
pop esi
pop ebp
ret

Function at 0x423416
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42e040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.006:107_4:_00007:277_0:_004:_04:_008:_08:_08:_8:_7:2_3:_9:193_4:_
lea ecx, [ebp - 0x1c]
call fcn.00401f47
push 0xc
call fcn.0040626e
pop ecx
test eax, eax
je 0x42344d
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call section..bss
jmp 0x42344f
xor eax, eax
mov eax, dword [eax + 4]
shl eax, 2
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x40
push 0x4ac
push 0x58c638
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_FreeConsole]
call fcn.0042339a
mov edx, 0x58c638
add edx, 0x188
mov esi, 0x430038
push esi
call edx
lea ecx, [ebp - 0x1c]
call fcn.00403359
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004062ac
leave
ret
Function at 0x10002f1e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10002f2d
pop dword [ebp - 0x50]
mov eax, 0x10002f2d
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xe3e0496d
add dword [ebp - 0x60], 0x6a71fbde
mov dword [ebp - 0x5c], 0xe2a25285
sub dword [ebp - 0x5c], 0xb06f0640
mov dword [ebp - 0x58], 0xac15e32c
add dword [ebp - 0x58], 0xa0366102
mov dword [ebp - 0x54], 0xe3471942
add dword [ebp - 0x54], 0x1cb8e6be
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2b10a28e
add dword [ebp - 0x60], 0x4961c6c8
mov dword [ebp - 0x5c], 0x327a967d
sub dword [ebp - 0x5c], 0xf10e3508
mov dword [ebp - 0x58], 0x167827f8
sub dword [ebp - 0x58], 0xb308bb8c
mov dword [ebp - 0x54], 0x16fa635b
sub dword [ebp - 0x54], 0x16fa635b
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x44473541
sub eax, 0x3446e50d
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x35f24
push 0
call eax
mov ecx, 0x44f7
xor ebx, ebx
add ebx, eax
mov esi, 0x10040600
add esi, dword [ebp - 0x50]
mov edi, 0x44e159db
sub edi, 0xc1671851
sub dword [ebp - 8], 0x98fd0d3d
mov edx, dword [esi]
mov dword [ebp - 0x48], 0x6fc125d4
xor edx, edi
mov dword [ebx], edx
mov dword [ebp - 0x24], 0xbca5d121
add ebx, 4
add esi, 0x54995a50
sub esi, 0x54995a4c
loop 0x1000303b
add eax, 0x97402b26
add eax, 0x68c0db89
mov ebx, eax
add eax, 5
mov ecx, 0xa6d0fbb8
add ecx, 0x692f0448
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x4038d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x70]
push ebx
sub esp, 0xbc
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], 0x14
mov dword [esp + 8], esi
mov dword [esp + 4], 0x44d
mov dword [esp], ebx
call sub.user32.dll_LoadStringW
mov dword [ebp - 0x48], 0x30
sub esp, 0x10
mov dword [ebp - 0x44], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
mov dword [ebp - 0x40], 0x402ad0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], ebx
call sub.user32.dll_LoadIconW
sub esp, 8
mov dword [ebp - 0x30], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.user32.dll_LoadCursorW
sub esp, 8
mov dword [ebp - 0x2c], eax
mov dword [esp], 4
call sub.gdi32.dll_GetStockObject
mov dword [ebp - 0x24], 1
sub esp, 4
mov dword [ebp - 0x28], eax
mov dword [esp], 0x32
mov dword [ebp - 0x20], esi
call sub.user32.dll_GetSystemMetrics
sub esp, 4
mov edi, eax
mov dword [esp], 0x31
call sub.user32.dll_GetSystemMetrics
sub esp, 4
mov dword [esp + 0x14], 0x8000
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.user32.dll_LoadImageW
mov dword [ebp - 0x1c], eax
sub esp, 0x18
lea eax, [ebp - 0x48]
mov dword [esp], eax
call sub.user32.dll_RegisterClassExW
sub esp, 4
test ax, ax
je 0x403b10
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x80000000
mov dword [esp + 0x18], 0x80000000
mov dword [esp + 0x14], 0x80000000
mov dword [esp + 0x10], 0x80000000
mov dword [esp + 0xc], 0xca0000
mov dword [esp], 0
call sub.user32.dll_CreateWindowExW
sub esp, 0x30
mov esi, eax
test eax, eax
je 0x403b10
mov eax, dword [ebp + 0x14]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.user32.dll_ShowWindow
sub esp, 8
mov dword [esp], esi
call sub.user32.dll_UpdateWindow
sub esp, 4
mov dword [esp], ebx
lea ebx, [ebp - 0x8c]
mov dword [esp + 4], 0x4b1
call sub.user32.dll_LoadAcceleratorsW
sub esp, 8
mov edi, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x3e8
mov dword [esp + 4], 0x3e8
mov dword [esp], esi
call sub.user32.dll_SetTimer
sub esp, 0x10
jmp 0x403aab
mov dword [esp], ebx
call sub.user32.dll_DispatchMessageW
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.user32.dll_GetMessageW
sub esp, 0x10
test eax, eax
je 0x403b00
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.user32.dll_TranslateAcceleratorW
sub esp, 0xc
test eax, eax
jne 0x403aa0
mov dword [esp], ebx
call sub.user32.dll_TranslateMessage
sub esp, 4
jmp 0x403aa0
mov eax, dword [ebp - 0x84]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov dword [esp], 1
call sub.kernel32.dll_ExitProcess
Function at 0x403d10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 1
call dword [sym.imp.ucrtbase.dll__configure_wide_argv]
call dword [sym.imp.ucrtbase.dll__initialize_wide_environment]
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call dword [sym.imp.ucrtbase.dll__get_initial_wide_environment]
mov ebx, eax
mov eax, dword [0x40003c]
cmp word [eax + 0x40005c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__set_app_type]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x403d80
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
call sub.kernel32.dll_GetCommandLineW
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x403e0b
cmp ax, 9
je 0x403df8
cmp ax, 0x20
je 0x403df8
mov dword [ebp - 0x6c], 0
xor edi, edi
lea esi, [esi]
cmp ax, 0x5c
je 0x403e58
cmp ax, 0x22
je 0x403e68
mov dword [ebp - 0x6c], 0
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x403e0b
cmp ax, 9
sete cl
cmp ax, 0x20
mov esi, ecx
sete cl
mov edx, esi
or dl, cl
je 0x403db0
test edi, 1
jne 0x403db0
lea esi, [esi]
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x403df8
cmp ax, 0x20
je 0x403df8
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.kernel32.dll_GetStartupInfoW
sub esp, 4
test byte [ebp - 0x30], 1
je 0x403e80
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.kernel32.dll_GetModuleHandleW
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004038d0
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add dword [ebp - 0x6c], 1
jmp 0x403dcb
and dword [ebp - 0x6c], 1
jne 0x403dc4
xor edi, 1
jmp 0x403dcb
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x403e23