joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f434
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x414a03
call fcn.00414450
sub esp, 0x10
mov eax, dword [0x417020]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
and dword [ebp - 4], 0
and dword [ebp - 0x18], 0
push 1
push dword [esi + 4]
call edi
push 2
push dword [esi + 4]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
call edi
push dword [esi + 4]
mov dword [ebp - 0x14], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x40f574
test ebx, ebx
je 0x40f574
cmp dword [ebp - 0x14], 0
je 0x40f574
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0040f234
test eax, eax
je 0x40f55c
push 1
push ebx
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
call ebx
push 0
push dword [ebp - 0x14]
call ebx
push 1
push dword [ebp - 0x1c]
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x130
push dword [esi + 4]
call edi
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
je 0x40f4e3
push 0
push eax
call ebx
push 0x138
push dword [esi + 4]
call edi
test eax, eax
je 0x40f4f6
push 0
push eax
call ebx
push 0x131
push dword [esi + 4]
call edi
test eax, eax
je 0x40f509
push 0
push eax
call ebx
push 0x139
push dword [esi + 4]
call edi
test eax, eax
je 0x40f51c
push 0
push eax
call ebx
cmp dword [ebp - 0x18], 0
lea ecx, [ebp - 0x10]
jne 0x40f52c
push 0x1f4
jmp 0x40f531
push 0x1f5
call fcn.0040eddc
test eax, eax
je 0x40f574
push dword [ebp - 0x10]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
test edi, edi
je 0x40f574
lea eax, [esi + 0x1c]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x34]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40f574
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push 0
push ebx
call edi
test byte [esi + 0x4c], 2
je 0x40f574
push 1
push dword [ebp - 0x14]
call edi
lea ecx, [ebp - 0x10]
call fcn.0040e46d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40feb3
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x4188a0]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x402610
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40ffa0
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x40ff94
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x40ff42
xor edi, edi
jmp 0x40ff8b
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x40ff3e
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_unsigned_int___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::size_void_const]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCP60.dll_public:_char_const____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::data_void_const]
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x40ff3e
push dword [ebp - 0x38]
mov ecx, dword [ebp + 8]
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.004140a8
leave
ret 8
Function at 0x40ffaf
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4188a0]
push esi
push 0xf0000000
xor esi, esi
push 0x18
push esi
mov dword [ebp + 0x39c], eax
push esi
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x80], 0x20
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov byte [ebp + 0x390], 0x1b
mov byte [ebp + 0x391], 0x4e
mov byte [ebp + 0x392], 0x86
mov byte [ebp + 0x393], 8
mov byte [ebp + 0x394], 0x69
mov byte [ebp + 0x395], 3
mov byte [ebp + 0x396], 0x9a
mov byte [ebp + 0x397], 0x35
mov byte [ebp + 0x398], 0xfd
mov byte [ebp + 0x399], 0x4e
mov byte [ebp + 0x39a], 0xb
mov byte [ebp + 0x39b], 0xb4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x410111
push ebx
push edi
lea eax, [ebp - 0x74]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x410068
xor edi, edi
jmp 0x410103
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0xc
lea eax, [ebp + 0x390]
push eax
push dword [ebp - 0x74]
call edi
test eax, eax
jne 0x410085
xor edi, edi
jmp 0x4100fa
push 0x40267c
push dword [ebp + 0x3a8]
mov dword [ebp - 0x7c], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x4100dd
push ebx
push 0x400
lea eax, [ebp - 0x70]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
jbe 0x4100d5
add dword [ebp - 0x7c], eax
push esi
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call edi
test eax, eax
je 0x410127
cmp dword [ebp - 0x7c], 0x4000
jb 0x4100a1
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push esi
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3ac]
push 2
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x4100fa
inc edi
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop esi
call fcn.004140a8
add ebp, 0x3a0
leave
ret 8
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x41010f
Function at 0x4107a9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4107d5
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4107d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4107d7
xor eax, eax
ret 8

Function at 0x4140a8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4188a0]
jne 0x4140b1
ret
jmp 0x4140b6
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x4188a0]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x418a40]
test eax, eax
je 0x4140da
call eax
cmp dword [0x418a44], 0
je 0x414121
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x418a44]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.004140a8
add ebp, 0x2a8
leave
ret
Function at 0x51a110
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe0000]
push edi
jmp 0x51a12a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x51a131
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a120
mov eax, 1
add ebx, ebx
jne 0x51a143
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x51a154
jne 0x51a173
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a173
dec eax
add ebx, ebx
jne 0x51a160
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x51a138
add ebx, ebx
jne 0x51a16f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x51a1c5
xor ecx, ecx
sub eax, 3
jb 0x51a18b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x51a1fa
sar eax, 1
mov ebp, eax
jmp 0x51a196
add ebx, ebx
jne 0x51a196
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a164
inc ecx
add ebx, ebx
jne 0x51a1a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x51a164
add ebx, ebx
jne 0x51a1b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x51a1a6
jne 0x51a1c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x51a1a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x51a1e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x51a1d6
jmp 0x51a126
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x51a1e4
add edi, ecx
jmp 0x51a126
pop esi
mov edi, esi
mov ecx, 0x91a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x51a202
cmp byte [edi], 9
jne 0x51a202
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x51a207
lea edi, [esi + 0x118000]
mov eax, dword [edi]
or eax, eax
je 0x51a27f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12f368]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12f448]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x51a234
mov ecx, edi
jns 0x51a263
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12f450]
or eax, eax
je 0x51a279
mov dword [ebx], eax
add ebx, 4
jmp 0x51a251
call dword [esi + 0x12f44c]
mov ebp, dword [esi + 0x12f454]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x17f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x51a2b3
sub esp, 0xffffff80
jmp 0x41382f
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x405b32
pop dword [ebp - 0x28]
mov eax, 0x920927df
add eax, 0x6e373353
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x5006c637
add dword [ebp - 0x38], 0xfe4b7f14
mov dword [ebp - 0x34], 0xad025c0a
add dword [ebp - 0x34], 0x8530f03b
mov dword [ebp - 0x30], 0x79abf1d0
add dword [ebp - 0x30], 0xd2a0525e
mov dword [ebp - 0x2c], 0xcde27c87
sub dword [ebp - 0x2c], 0xcde27c87
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xbcbab21b
sub dword [ebp - 0x38], 0x484848c5
mov dword [ebp - 0x34], 0x45d959e5
add dword [ebp - 0x34], 0xfb930790
mov dword [ebp - 0x30], 0x50710ea5
sub dword [ebp - 0x30], 0xed01a239
mov dword [ebp - 0x2c], 0xc05d0b3b
sub dword [ebp - 0x2c], 0xc05d0b3b
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xce57e7f2
add eax, 0x31e8988a
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x397e4
push 0
call eax
mov ecx, 0x7b7e5a8b
add ecx, 0x8481f764
xor ebx, ebx
add ebx, eax
mov esi, 0x451400
add esi, dword [ebp - 0x28]
mov edi, 0x92ef5834
add edi, 0x24eaea0f
add dword [ebp - 0x1c], 0x7fa0c6e7
mov edx, dword [esi]
add dword [ebp - 0x1c], eax
sub edx, edi
sub dword [ebp - 4], 0x877e18e3
mov dword [ebx], edx
xor dword [ebp - 0x18], 0xb45b4a79
add ebx, 0x84818c2e
add ebx, 0x7b7e73d6
add esi, 0x82de6bef
sub esi, 0x82de6beb
loop 0x405c4b
add eax, 0x14eaf2f0
sub eax, 0x14e9b861
xor ebx, ebx
add ebx, eax
add eax, 0xe463c847
add eax, 0x1b9c37be
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x401090
Capabilities:
Hide graphical window

Disassembly:
mov ebp, esp
push esi
lea eax, [0x4032cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp + 4]
mov dword [0x403183], eax
xor eax, eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x4010bd
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403183]
mov dword [ebp - 0x48], eax
mov eax, 0x402353
mov dword [ebp - 0x54], eax
mov ecx, str.secondclass
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x403183]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403328], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403328]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x40117b
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x40116d
mov esp, ebp
ret
Function at 0x401840
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4018a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x415078]
test esi, esi
jle 0x4019c0
mov eax, dword [0x41507c]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x4018d4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401957
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x4018c0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x4019e7
mov eax, dword [0x41507c]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x41507c]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x4019c7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401950
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401960
add dword [0x415078], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x41507c]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401950
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x4018de
mov eax, dword [0x41507c]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x401ea0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x415094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x41508c]
sub esp, 4
test ebx, ebx
je 0x401ef5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401eee
test esi, esi
je 0x401eee
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ed0
mov dword [esp], 0x415094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x402220
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402245
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402250
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402245
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x402298
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x40228e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x40229a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x402280
xor eax, eax
pop ebx
pop esi
ret
Function at 0x40f580
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov dword [esp], ebp
call sym._strlen
mov dword [esp + 0x1c], eax
xor eax, eax
lea esi, [esi]
mov byte [esi + eax], al
add eax, 1
cmp eax, 0x100
jne 0x40f5a0
xor ebx, ebx
xor ecx, ecx
lea esi, [esi]
mov eax, ebx
movzx edi, byte [esi + ebx]
cdq
idiv dword [esp + 0x1c]
movsx eax, byte [ebp + edx]
mov edx, edi
movzx edx, dl
add ecx, edx
add ecx, eax
mov eax, ecx
sar eax, 0x1f
shr eax, 0x18
add ecx, eax
movzx ecx, cl
sub ecx, eax
lea eax, [esi + ecx]
movzx edx, byte [eax]
mov byte [esi + ebx], dl
mov edx, edi
add ebx, 1
mov byte [eax], dl
cmp ebx, 0x100
jne 0x40f5b8
add esp, 0x2c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f610
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov eax, dword [esp + 0x24]
mov edi, dword [esp + 0x18]
test eax, eax
je 0x40f673
xor edx, edx
xor ebx, ebx
xor ecx, ecx
mov dword [esp], edx
lea esi, [esi]
mov edx, dword [esp]
add edx, 1
movzx eax, dl
lea esi, [edi + eax]
mov dword [esp], eax
movzx eax, byte [esi]
add ecx, eax
movzx ecx, cl
lea ebp, [edi + ecx]
movzx edx, byte [ebp]
mov byte [esi], dl
mov edx, dword [esp + 0x20]
mov byte [ebp], al
add al, byte [esi]
mov esi, dword [esp + 0x1c]
movzx eax, al
movzx eax, byte [edi + eax]
xor al, byte [esi + ebx]
mov byte [edx + ebx], al
add ebx, 1
cmp dword [esp + 0x24], ebx
jne 0x40f630
add esp, 4
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40fbb0
Capabilities:
Initialize winsock library

Disassembly:
push edi
mov ecx, 0x2a
push esi
mov esi, 0x411200
push ebx
sub esp, 0x250
lea edi, [esp + 0x18]
lea ebx, [esp + 0xbc]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x18]
mov esi, 0x29
lea esi, [esi]
mov eax, edi
test esi, esi
jle 0x40fc05
lea esi, [esi]
lea esi, [esi]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
cmp edx, ecx
jle 0x40fbfe
mov dword [eax], ecx
mov dword [eax + 4], edx
add eax, 4
cmp eax, ebx
jne 0x40fbf0
sub esi, 1
lea eax, [ebx - 4]
cmp ebx, edi
je 0x40fc18
mov ebx, eax
jmp 0x40fbe0
lea eax, [esp + 0xc0]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov edx, eax
sub esp, 8
mov eax, 1
test edx, edx
jne 0x40fc43
call sym._get_time.part.0
add esp, 0x250
pop ebx
pop esi
pop edi
ret