joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d350
Capabilities:
Create tcp socket
Create thread
Create udp socket
Set socket configuration

Disassembly:
sub esp, 0x14
xor eax, eax
test si, si
je 0x40d441
test edi, edi
je 0x40d441
push ebx
push 0x24
call fcn.004085f0
add esp, 4
push 0
push 0
mov ebx, eax
push 1
push 0
mov dword [ebx], 0x756470
mov dword [ebx + 4], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [ebx + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x40d3ac
call fcn.0040d7b0
xor ebx, ebx
test ebx, ebx
je 0x40d43e
xor eax, eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x1c]
mov ecx, 2
push esi
mov dword [esp + 0x10], eax
mov word [esp + 0xc], cx
call dword [sym.imp.WS2_32.dll_htons]
push 1
lea edx, [esp + 0xb]
push edx
push 4
mov word [esp + 0x16], ax
mov byte [esp + 0x13], 1
mov eax, dword [ebx + 8]
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [ebx + 8]
push 0x10
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40d424
call fcn.0040d7b0
xor eax, eax
pop ebx
add esp, 0x14
ret
push 0
push 0
push ebx
push 0x40d580
push 0
push 0
mov dword [ebx + 0xc], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x14], eax
mov eax, ebx
pop ebx
add esp, 0x14
ret
Function at 0x40d680
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, eax
xor al, al
push edi
mov byte [esp + 0x13], al
test ecx, ecx
je 0x40d79a
cmp dword [ecx], 0x756470
jne 0x40d79a
cmp dword [ebp + 0xc], 0
je 0x40d79a
test esi, esi
je 0x40d79a
lea edi, [esi + 4]
push edi
call fcn.00408610
mov ebx, eax
mov eax, dword [ebp + 0xc]
push esi
push eax
lea ecx, [ebx + 4]
push ecx
mov dword [esp + 0x24], ebx
mov dword [ebx], esi
call sub.ntdll.dll_memcpy
xor eax, eax
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov word [esp + 0x36], ax
mov eax, dword [ebp + 0x14]
add esp, 0x10
mov edx, 2
push eax
mov word [esp + 0x1c], dx
call dword [sym.imp.WS2_32.dll_htons]
mov ecx, dword [ebp + 0x10]
mov word [esp + 0x1a], ax
mov dword [esp + 0x1c], ecx
test edi, edi
je 0x40d770
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push 0x10
lea edx, [esp + 0x1c]
push edx
push 0
push edi
push ebx
push ecx
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
cmp esi, 0xffffffff
je 0x40d768
mov edx, dword [ebp + 8]
push esi
add edx, 0x1c
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
sub edi, esi
add ebx, esi
test edi, edi
jne 0x40d716
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408760
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
jne 0x40d789
mov ebx, dword [esp + 0x14]
push ebx
mov byte [esp + 0x17], 1
call fcn.00408760
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00408760
mov al, byte [esp + 0x17]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40d820
Capabilities:
Create tcp socket
Create thread
Create udp socket

Disassembly:
sub esp, 0x10
push ebx
push 0x24
call fcn.004085f0
add esp, 4
push 0
push 0
mov ebx, eax
push 1
push 0
mov dword [ebx], 0x756470
mov dword [ebx + 4], 1
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x11
push 2
push 2
mov dword [ebx + 0x10], eax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 8], eax
cmp eax, 0xffffffff
jne 0x40d869
call fcn.0040d7b0
xor ebx, ebx
test ebx, ebx
je 0x40d8ca
xor eax, eax
mov dword [esp + 6], eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov word [esp + 0x12], ax
mov eax, 2
push 0x10
lea ecx, [esp + 8]
mov word [esp + 8], ax
mov edx, dword [ebx + 8]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x40d8ac
call fcn.0040d7b0
xor eax, eax
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x18]
push 0
push 0
push ebx
push 0x40d580
push 0
push 0
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebx + 0x14], eax
mov eax, ebx
pop ebx
add esp, 0x10
ret
Function at 0x40e070
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSASend]
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 0x260]
push edi
push 0
push esi
push 0
lea eax, [esp + 0x1c]
push eax
push 1
lea edi, [esi + 0x1c]
push edi
push ecx
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
je 0x40e0e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e0e0
cmp eax, 0x2733
jne 0x40e0e6
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x260]
push 0
push esi
push 0
lea edx, [esp + 0x1c]
push edx
push 1
push edi
push eax
mov dword [esp + 0x2c], 0
call ebx
test eax, eax
jne 0x40e0a2
pop edi
pop ebp
mov al, 1
pop ebx
ret
pop edi
pop ebp
xor al, al
pop ebx
ret

Function at 0x40e1e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
mov edx, dword [esi + 0x260]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_WSARecv]
push ebp
push edi
xor eax, eax
push eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
lea edi, [esi + 0x208]
push edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
lea ebp, [esi + 0x224]
push ebp
push edx
call ebx
test eax, eax
je 0x40e262
mov edi, edi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x40e262
cmp eax, 0x2733
jne 0x40e26b
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esi + 0x260]
xor eax, eax
push eax
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
push ebp
push edx
call ebx
test eax, eax
jne 0x40e220
pop edi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret
pop edi
pop ebp
xor al, al
pop ebx
add esp, 8
ret
Function at 0x40e2f0
Capabilities:
Set socket configuration

Disassembly:
sub esp, 0x1c
cmp dword [esp + 0x20], 0
push esi
push edi
mov esi, eax
mov edi, ecx
jne 0x40e482
test ebx, ebx
je 0x40e482
call fcn.0040b960
push eax
lea eax, [edi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov eax, dword [esi + 0x18]
sub eax, 0
je 0x40e3de
sub eax, 1
jne 0x40e4d9
cmp byte [edi + 0x275], al
je 0x40e34c
add edi, 0x21c
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
lea ecx, [edi + 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [edi + 0x27c]
push ebx
add edx, 0x44
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
mov eax, dword [edi + 0x264]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ecx
mov ecx, dword [edi + 0x27c]
lea eax, [esp + 8]
lea edx, [edi + 8]
push eax
mov dword [esp + 0x20], edx
push ecx
mov ecx, 3
mov edx, edi
mov dword [esp + 0x28], ebx
call fcn.0040dcd0
add esp, 8
mov eax, edi
call fcn.0040e280
test al, al
jne 0x40e4d9
mov byte [edi + 0x275], 1
pop edi
pop esi
add esp, 0x1c
ret
cmp byte [edi + 0x275], 0
je 0x40e3f7
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
pop edi
pop esi
add esp, 0x1c
ret
add dword [esi + 0x28], ebx
mov eax, dword [esi + 0x28]
cmp eax, dword [esi + 0x24]
jae 0x40e417
add dword [esi + 0x20], ebx
sub dword [esi + 0x1c], ebx
push edi
call fcn.0040e070
add esp, 4
pop edi
pop esi
add esp, 0x1c
ret
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov ecx, dword [edi + 0x268]
mov edx, dword [edi + 0x26c]
mov eax, dword [edi + 0x264]
mov dword [esp + 0xc], ecx
mov ecx, dword [edi + 0x278]
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x30]
mov dword [esp + 0x18], ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x270]
mov dword [esp + 0x1c], edx
mov edx, dword [edi + 0x27c]
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
push edx
mov ecx, 2
mov edx, edi
mov dword [esp + 0x28], eax
call fcn.0040dcd0
add esp, 8
pop edi
pop esi
add esp, 0x1c
ret
add esi, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 4
lea edx, [esp + 0x2c]
push edx
mov eax, 1
push 0x80
mov word [esp + 0x34], ax
mov eax, dword [edi + 0x260]
push 0xffff
xor ecx, ecx
push eax
mov byte [edi + 0x275], 1
mov word [esp + 0x3e], cx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [edi + 0x260]
push ecx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [edi + 0x260], 0xffffffff
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x40e5b0
Capabilities:
Create tcp socket
Create udp socket
Get system information on windows
Set socket configuration

Disassembly:
sub esp, 0x38
push edi
push 0x4c
call fcn.004085f0
mov edi, eax
add esp, 4
test edi, edi
je 0x40e736
lea eax, [esp + 0x18]
push eax
mov dword [edi], 0x494f4350
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x2c]
lea eax, [edi + 0x20]
lea edx, [ecx + ecx]
push eax
mov dword [edi + 4], edx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [edi + 0x10], eax
test eax, eax
je 0x40e72f
push 0
push 0
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [edi + 8], eax
test eax, eax
je 0x40e72f
call fcn.0040b5f0
mov dword [edi + 0xc], eax
test eax, eax
je 0x40e72f
push 1
push 0
push 0
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
mov dword [edi + 0x14], eax
cmp eax, 0xffffffff
je 0x40e72f
push 1
lea ecx, [esp + 0xb]
push ecx
push 4
push 0xffff
push eax
mov byte [esp + 0x1b], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
mov ecx, dword [esp + 0x44]
xor eax, eax
mov dword [esp + 0xa], eax
mov dword [esp + 0xe], eax
mov dword [esp + 0x12], eax
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x40]
mov edx, 2
push ecx
mov word [esp + 0xc], dx
mov dword [esp + 0x10], eax
call dword [sym.imp.WS2_32.dll_htons]
push 0x10
lea edx, [esp + 0xc]
mov word [esp + 0xe], ax
mov eax, dword [edi + 0x14]
push edx
push eax
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x40e72f
mov ecx, dword [edi + 0x14]
push bind
push ecx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x40e72f
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
mov dword [edi + 0x18], eax
test eax, eax
je 0x40e72f
mov edx, dword [edi + 0x14]
push 8
push eax
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x40e72f
push esi
xor esi, esi
cmp dword [edi + 4], esi
jbe 0x40e70f
mov eax, dword [edi + 0xc]
push 0
push 0
push edi
push 0x40e4e0
push 0
push eax
call fcn.0040b6a0
inc esi
add esp, 0x18
cmp esi, dword [edi + 4]
jb 0x40e6f1
mov ecx, dword [edi + 0xc]
push 0
push 0
push edi
push 0x40deb0
push 0
push ecx
call fcn.0040b6a0
add esp, 0x18
pop esi
mov eax, edi
pop edi
add esp, 0x38
ret
call fcn.0040db90
xor eax, eax
pop edi
add esp, 0x38
ret
Function at 0x40e9d9
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40ea0a
mov eax, dword fs:[4]
mov dword [ebp + 8], eax
mov eax, dword fs:[8]
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 4]
jb 0x40ea11
cmp ebx, dword [ebp + 8]
jae 0x40ea11
xor eax, eax
jmp 0x40ebf7
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40ea22
xor eax, eax
inc eax
jmp 0x40ebf6
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40ea34
cmp ecx, edx
jae 0x40ea98
cmp dword [eax + 4], 0
je 0x40ea3d
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40ea29
cmp dword [ebp + 8], 0
je 0x40ea57
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40ea98
cmp eax, esi
jae 0x40ea98
mov ecx, dword [0x413a08]
mov esi, ebx
and esi, 0xfffff000
xor eax, eax
test ecx, ecx
jle 0x40ea79
cmp dword [eax*4 + 0x413a10], esi
je 0x40ea9f
inc eax
cmp eax, ecx
jl 0x40ea6b
lea eax, [ebp + 8]
push eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
or edi, 0xffffffff
push edi
call sub.ntdll.dll_NtQueryVirtualMemory
test eax, eax
jl 0x40eb0f
mov eax, dword [ebp + 8]
jmp 0x40eb11
xor eax, eax
jmp 0x40ebf6
test eax, eax
jle 0x40ea1a
xor edx, edx
mov ebx, 0x413a50
inc edx
mov edi, ebx
xchg dword [edi], edx
test edx, edx
jne 0x40ea1a
cmp dword [eax*4 + 0x413a10], esi
je 0x40eaee
lea eax, [ecx - 1]
test eax, eax
jl 0x40eadb
cmp dword [eax*4 + 0x413a10], esi
je 0x40ead7
dec eax
jns 0x40eacb
test eax, eax
jge 0x40eaec
cmp ecx, 0x10
jge 0x40eae7
inc ecx
mov dword [0x413a08], ecx
lea eax, [ecx - 1]
jmp 0x40eaee
je 0x40eb06
xor edx, edx
test eax, eax
jl 0x40eb06
lea ecx, [edx*4 + 0x413a10]
mov edi, dword [ecx]
inc edx
cmp edx, eax
mov dword [ecx], esi
mov esi, edi
jle 0x40eaf4
xor eax, eax
xchg dword [ebx], eax
jmp 0x40ea1a
xor eax, eax
test eax, eax
je 0x40ebf4
cmp dword [ebp - 8], 0x1000000
jne 0x40ebf4
test byte [ebp - 0xc], 0xcc
je 0x40eb86
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40ebf4
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40ebf4
cmp word [eax + 0x18], 0x10b
jne 0x40ebf4
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40ebf4
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40eb86
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40eb86
test byte [ecx + 0x27], 0x80
jne 0x40ea98
xor eax, eax
inc eax
mov ecx, eax
mov edx, 0x413a50
xchg dword [edx], ecx
test ecx, ecx
jne 0x40ebf6
mov ecx, dword [0x413a08]
test ecx, ecx
mov edx, ecx
jle 0x40ebb5
lea eax, [ecx*4 + 0x413a0c]
cmp dword [eax], esi
je 0x40ebb5
dec edx
sub eax, 4
test edx, edx
jg 0x40eba9
test edx, edx
jne 0x40ebe6
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40ebc2
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40ebda
lea eax, [edx*4 + 0x413a10]
mov edi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], esi
mov esi, edi
jle 0x40ebc8
cmp ecx, 0x10
jge 0x40ebe6
inc ecx
mov dword [0x413a08], ecx
xor eax, eax
mov ecx, 0x413a50
xchg dword [ecx], eax
jmp 0x40ea1a
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x4939069f
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x6a3d08ed
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40d8ee
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6a
nop
sub eax, 0x403d10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x40118f
Capabilities:
Accept command line arguments
Create thread

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403004], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [0x40300c], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [0x403010], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403008], eax
push 0x403018
push 0
push 0
push 0x4010ad
push 0x1000
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x40301c], eax
push 1
push dword [0x403008]
push 0
push dword [0x403004]
call 0x4011f8
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x4012e6
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.MeltWindowClass
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x403004]
push 0
push 0
push dword [0x403010]
push dword [0x40300c]
push 0x80000000
push 0x80000000
push 0x80000000
push str.Melt_Display_Hack
push str.MeltWindowClass
push 0x28
call sub.user32.dll_CreateWindowExA
mov dword [section..data], eax
push dword [ebp + 0x14]
push dword [section..data]
call sub.user32.dll_ShowWindow
push dword [section..data]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4012df
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4012b8
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x4011f8
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403004], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [0x40300c], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [0x403010], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403008], eax
push 0x403018
push 0
push 0
push 0x4010ad
push 0x1000
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x40301c], eax
push 1
push dword [0x403008]
push 0
push dword [0x403004]
call 0x4011f8
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov dword [ebp - 0x30], 0x30
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x28], 0x4012e6
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
push dword [ebp + 8]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], str.MeltWindowClass
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassExA
push 0
push dword [0x403004]
push 0
push 0
push dword [0x403010]
push dword [0x40300c]
push 0x80000000
push 0x80000000
push 0x80000000
push str.Melt_Display_Hack
push str.MeltWindowClass
push 0x28
call sub.user32.dll_CreateWindowExA
mov dword [section..data], eax
push dword [ebp + 0x14]
push dword [section..data]
call sub.user32.dll_ShowWindow
push dword [section..data]
call sub.user32.dll_UpdateWindow
push 0
push 0
push 0
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_GetMessageA
or eax, eax
je 0x4012df
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_TranslateMessage
lea eax, [ebp - 0x4c]
push eax
call sub.user32.dll_DispatchMessageA
jmp 0x4012b8
mov eax, dword [ebp - 0x44]
leave
ret 0x10
Function at 0x40529a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x460f3c]
jne 0x4052a4
repz ret
jmp fcn.00409092

Function at 0x40bb2c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406cf4
and dword [ebp - 4], 0
cmp dword [0x462850], 0
mov ebx, eax
jne 0x40bbdd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40bc8e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40bc8e
push eax
call fcn.00406c82
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x462850], eax
call esi
push eax
call fcn.00406c82
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x462854], eax
call esi
push eax
call fcn.00406c82
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x462858], eax
call esi
push eax
call fcn.00406c82
pop ecx
mov dword [0x462860], eax
test eax, eax
je 0x40bbdd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406c82
pop ecx
mov dword [0x46285c], eax
mov eax, dword [0x46285c]
cmp eax, ebx
je 0x40bc35
cmp dword [0x462860], ebx
je 0x40bc35
push eax
call fcn.00406cfd
push dword [0x462860]
mov esi, eax
call fcn.00406cfd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40bc35
test edi, edi
je 0x40bc35
call esi
test eax, eax
je 0x40bc2c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40bc2c
test byte [ebp - 0xc], 1
jne 0x40bc35
or dword [ebp + 0x10], 0x200000
jmp 0x40bc6e
mov eax, dword [0x462854]
cmp eax, ebx
je 0x40bc6e
push eax
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc6e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40bc6e
mov eax, dword [0x462858]
cmp eax, ebx
je 0x40bc6e
push eax
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc6e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x462850]
call fcn.00406cfd
pop ecx
test eax, eax
je 0x40bc8e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40bc90
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x410220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
or ebx, 0x8a
bswap ebx
rol edi, 0x2b
inc eax
rol edi, 0xe3
bswap ebx
imul edx
dec edi
ror esi, 0x99
add ebx, 0x11
neg esi
mov eax, 0x45
rcr edx, 0x9b
neg edx
bswap eax
sub esi, 0x50
dec ebx
imul eax
rol edi, 0x6b
bswap edi
bswap eax
sbb eax, 0x49
sbb edi, 0xd0
rol esi, 0x53
not esi
not esi
rol ebx, 0x26
rcl edx, 0x61
mov eax, 0xee
and eax, 0x6e
bswap eax
sub edi, 0xd3
rcl eax, 0x63
dec edx
sub esi, 0x21
not edi
dec edi
add eax, 0x87
rol esi, 0x48
sbb eax, 0x77
neg edi
rcr edi, 0xda
and edx, 0x95
not ebx
neg edx
bswap esi
inc edx
mov esi, 0xa6
or eax, 0xba
neg esi
xor ecx, ecx
xor edi, edi
dec ebx
add edi, 0xfb
not edx
and esi, 0x90
rol edx, 0xf7
mov esi, 0xd3
inc ebx
neg edx
sub edx, 0x66
rcr edi, 0x48
sbb edi, 0x4b
not edx
and edx, 0xb6
imul edi
sbb ebx, 0xd2
add edi, 0x25
not edx
ror ebx, 0xcb
not esi
bswap edi
imul edi
ror ebx, 6
dec edi
inc edi
inc ebx
mov ebx, 0x74
bswap ebx
neg eax
or eax, 0xb9
mov edx, 0x1a
add ebx, 0x62
inc edi
or ebx, 0x29
bswap eax
rcr eax, 0x2f
or eax, 0xf9
rcl edx, 3
imul ebx
rol eax, 0x87
add edi, 0x21
bswap ebx
add edi, 0x62
rcl edi, 0xd6
sbb eax, 0xd2
imul esi
inc edx
rcr edx, 0x39
bswap ebx
neg edx
imul edi
mov ecx, dword [ebp + 0xc]
sub edi, 0xc3
not ebx
inc ebx
neg esi
inc esi
imul ebx
dec esi
neg edx
or edi, 9
add edi, 0x4f
inc edx
dec edx
imul eax
bswap ebx
bswap edi
inc esi
rcr esi, 0xfe
sbb edi, 0x4f
sub esi, 0xe0
inc ebx
dec edi
sbb edx, 0x97
imul edi
sub edx, 0xb5
neg edx
imul edx
and ebx, 0xb9
imul ebx
dec esi
bswap ebx
bswap esi
neg ebx
rcl ebx, 0xbb
add edi, 0xcd
inc eax
dec eax
dec esi
dec edi
bswap edi
mov eax, 0x28
ror edx, 0xe9
sub ebx, 0x62
rcl esi, 0xee
imul ebx
not edx
rol eax, 0xc1
dec ebx
imul edi
bswap esi
not edi
mov edi, dword [ebp + 8]
xor eax, ebx
xor esi, ebx
mov esi, ebx
not byte [edi]
xor eax, ebx
xor ebx, eax
xor esi, esi
xor ebx, ebx
xor eax, eax
xor ebx, esi
mov eax, esi
mov ebx, ebx
xor eax, eax
add byte [edi], 0x48
mov eax, ebx
xor ebx, ebx
xor eax, esi
xor eax, eax
xor esi, ebx
mov esi, ebx
xor eax, esi
mov esi, ebx
mov ebx, ebx
sub byte [edi], 0x97
xor eax, esi
xor ebx, eax
mov eax, esi
mov esi, esi
xor eax, ebx
xor ebx, ebx
mov ebx, esi
mov ebx, eax
mov eax, eax
imul byte [edi]
inc edi
loop 0x4103cd
pop edi
pop esi
pop ebx
pop ebp
ret