joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424eb0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x14]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x48], ecx
push edi
mov dword [esi + 0x4c], edx
xor edi, edi
mov dword [esi + 0x50], eax
cmp dword [0x479a98], edi
jne 0x424ee0
mov dword [0x479a98], edi
lea ecx, [esi + 0x20]
push ecx
push 0x47a240
mov ebx, 0x479a68
call fcn.00413080
add esp, 8
push edi
push 0x80
push 0x80000000
push 0
lea edx, [ebp + 0xc]
movzx ebx, ax
push edx
push 0
mov eax, esi
call fcn.00425490
mov eax, dword [ebp + 0x18]
sub eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
sub ecx, dword [ebp + 0xc]
push eax
push ecx
lea edx, [esi + 0x34]
push edx
lea ecx, [esi + 0x38]
lea edx, [esi + 0x30]
call fcn.00424da0
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov ecx, dword [esi + 4]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [ebp + 8]
sub eax, 0
je 0x424f8a
dec eax
je 0x424f76
dec eax
jne 0x424f8f
call fcn.00425240
mov edx, dword [esi + 4]
push 0
push edx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
call fcn.004250f0
mov edx, dword [esi + 4]
push 0
push edx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
call fcn.00424fa0
mov edx, dword [esi + 4]
push 0
push edx
call edi
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x424fa0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [esi + 0x50]
sub eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
sub ecx, dword [esi + 0x44]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
mov dword [ebp - 8], ecx
fild dword [ebp - 8]
push ebx
push edi
mov edi, 0x32
fdivp st(1)
mov dword [ebp - 8], edi
fstp dword [ebp - 0xc]
fild dword [ebp - 8]
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
fmul dword [ebp - 0xc]
mov dword [ebp - 0x14], edi
call fcn.0045a750
mov ecx, dword [esi + 0x44]
mov ebx, eax
mov eax, dword [esi + 0x4c]
mov edx, eax
sub edx, ecx
mov dword [ebp - 0x10], ebx
cmp edi, edx
jge 0x4250be
sub eax, edi
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x50]
sub eax, dword [esi + 0x48]
push 3
sub eax, ebx
cdq
sub eax, edx
sar eax, 1
add eax, dword [esi + 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 0x30]
push eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ecx, dword [esi + 0x50]
sub ecx, dword [esi + 0x48]
mov edx, dword [esi + 0x4c]
sub edx, dword [esi + 0x44]
mov eax, dword [esi + 0x24]
push 0xcc0020
push ecx
mov ecx, dword [ebp - 0x10]
push edx
mov edx, dword [ebp - 0x14]
push 0
push 0
push eax
mov eax, dword [esi + 0x30]
push ecx
push edx
push 0
push 0
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
mov ecx, dword [esi + 4]
push ecx
mov dword [ebp - 4], 0x1ff0000
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [esi + 0x30]
push 2
mov ebx, eax
xor eax, eax
lea edx, [ebp - 4]
push edx
push eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push ecx
mov ecx, dword [esi + 4]
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x1c]
push eax
push ebx
push ecx
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov edx, dword [esi + 4]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov eax, dword [esi + 0x40]
push 0x14
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add edi, 0x32
mov dword [ebp - 8], edi
cmp edi, 0x41a
jl 0x424fcd
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4250e4
push 0x43
push 0
push 0
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0x3c]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x425240
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [esi + 0x4c]
sub eax, dword [esi + 0x44]
mov ecx, dword [esi + 0x50]
sub ecx, dword [esi + 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x3c]
push ebx
push edi
mov dword [ebp - 0x10], ecx
test eax, eax
je 0x42526a
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ebx, ebx
lea esp, [esp]
mov dl, bl
add dl, dl
add dl, dl
mov cl, 0xf5
mov word [ebp - 4], 0
mov byte [ebp - 1], 1
lea eax, [edx + ebx]
mov edx, dword [esi + 4]
add al, al
sub cl, al
push edx
mov byte [ebp - 2], cl
call dword [sym.imp.USER32.dll_GetDC]
push 2
mov edi, eax
xor eax, eax
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0x24]
push eax
lea edx, [ebp - 0xc]
push edx
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov ecx, dword [esi + 4]
push edi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [esi + 0x40]
push 0x14
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc ebx
cmp ebx, 0x14
jl 0x425270
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x427380
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4614d9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x4776f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov eax, dword [section..data]
mov edx, dword [eax + 0xc]
mov ecx, section..data
call edx
add eax, 0x10
mov dword [edi], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
add ebx, 0x30
mov dword [ebp - 0x10], 1
call fcn.00429920
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x427a20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, ecx
mov ecx, 1
push edi
mov edi, dword [ebp + 0x18]
mov dword [esp + 0xc], ebx
cmp eax, ecx
jne 0x427a6b
cmp dword [esi + 0x28], 0
mov dword [esi + 0x24], ecx
jne 0x427a50
or eax, 0xffffffff
jmp 0x427a55
call fcn.00427b00
mov dword [edi], eax
cmp dword [esi + 0x24], 0
je 0x427a9b
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 3
jne 0x427ab9
movsx eax, bx
shr ebx, 0x10
mov dword [esi + 0x24], ecx
movsx ecx, bx
push ecx
push eax
mov ebx, esi
call fcn.00427bd0
mov dword [edi], 0
cmp dword [esi + 0x24], 0
jne 0x427a5d
mov ebx, dword [esp + 0xc]
cmp dword [esi + 0x24], 0
jne 0x427a5d
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push edi
push ebx
push eax
push ecx
push edx
mov ecx, esi
call fcn.00422c90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp eax, 2
jne 0x427a95
mov eax, dword [esi + 0x80]
push eax
mov dword [esi + 0x24], ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x427aee
mov ecx, dword [esi + 0x80]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x80]
push edx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [edi], 0
jmp 0x427a57

Function at 0x429920
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [ebx]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea esi, [eax + 1]
test esi, esi
jns 0x42993b
push 0x80070057
call fcn.004136e0
mov eax, dword [edi]
mov edx, dword [eax - 8]
mov ecx, 1
sub ecx, dword [eax - 4]
sub edx, esi
or ecx, edx
jge 0x429957
mov eax, esi
mov ecx, edi
call fcn.00413680
mov eax, dword [edi]
push esi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42997e
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test eax, eax
je 0x429982
push ecx
push eax
call fcn.0042b50a
add esp, 8
test eax, eax
js 0x429931
mov ecx, dword [edi]
cmp eax, dword [ecx - 8]
jg 0x429931
mov dword [ecx - 0xc], eax
mov ecx, dword [edi]
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, esi
pop esi
ret
Function at 0x42a010
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x47a2b0], 0
push esi
push edi
jne 0x429f86
call fcn.00429eef
test eax, eax
je 0x429fcb
mov eax, dword [0x47a2b0]
cmp eax, 1
jne 0x429fa7
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x429fcb
jmp 0x42a00d
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x42a00d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x429fcf
xor eax, eax
jmp 0x42a00d
mov eax, dword [esi]
push dword [0x47a2b0]
call edi
mov edi, eax
test edi, edi
je 0x429ff1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x42a00d
lea edi, [esi + 0xff0]
push esi
push dword [0x47a2b0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x429ff7
mov eax, esi
pop edi
pop esi
ret
jmp 0x429f72

Function at 0x42ab2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4776f4]
jne 0x42ab39
repz ret
jmp fcn.0043032c
Function at 0x442022
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4776f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00430c6e
and dword [ebp - 0x14], 0
cmp dword [0x47b2c0], 0
mov dword [ebp - 0x18], eax
jne 0x4420d5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x44217d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4676e0
push ebx
call edi
test eax, eax
je 0x44217d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4676d0
push ebx
mov dword [0x47b2c0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x47b2c4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x47b2c8], eax
call edi
push eax
call esi
mov dword [0x47b2d0], eax
test eax, eax
je 0x4420d5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x47b2cc], eax
mov eax, dword [0x47b2cc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x44212e
cmp dword [0x47b2d0], ecx
je 0x44212e
push eax
call esi
push dword [0x47b2d0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x44212e
test ebx, ebx
je 0x44212e
call edi
test eax, eax
je 0x442125
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x442125
test byte [ebp - 8], 1
jne 0x44212e
or dword [ebp + 0x10], 0x200000
jmp 0x442161
mov eax, dword [0x47b2c4]
cmp eax, dword [ebp - 0x18]
je 0x442161
push eax
call esi
test eax, eax
je 0x442161
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x442161
mov eax, dword [0x47b2c8]
cmp eax, dword [ebp - 0x18]
je 0x442161
push eax
call esi
test eax, eax
je 0x442161
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x47b2c0]
call esi
test eax, eax
je 0x44217d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x44217f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ab2f
leave
ret

Function at 0x446930
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp eax, edx
je 0x44695f
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x446940
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
ret
Function at 0x44af30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x45e168
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4776f4]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
mov eax, dword [0x4776f4]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, dword [esp + 0x44]
mov esi, ecx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
cmp dword [esi + 0x78], ecx
jne 0x44b00d
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x44b00d
mov ecx, dword [esi + 0x84]
cmp dword [ecx - 4], edi
jle 0x44b00d
mov eax, dword [eax + 0x18]
test al, 3
jne 0x44afab
test eax, 0x1000000
je 0x44b00d
push str.Cant_terminate_a_sub_expression_with_an_alternation_operator_.
lea ecx, [esp + 0x18]
call fcn.004054c0
mov edi, dword [esi + 0x64]
sub edi, dword [esi + 0x5c]
xor eax, eax
push edi
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
mov dword [ecx + 0x10], eax
mov dword [ecx + 0x14], 0xf
push eax
mov dword [esp + 0x64], eax
mov byte [ecx], al
lea eax, [esp + 0x3c]
push eax
call fcn.00406c30
push edi
push 0x11
mov ecx, esi
call fcn.0044a350
cmp dword [esp + 0x28], 0x10
jb 0x44b006
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0042ab24
add esp, 4
xor al, al
jmp 0x44b08e
mov edx, dword [esi + 0x84]
sub edx, dword [esi + 0x80]
test edx, 0xfffffffc
je 0x44b08c
mov eax, dword [esi + 0x84]
cmp dword [eax - 4], edi
jle 0x44b08c
mov edx, dword [eax - 4]
cmp dword [esi + 0x80], eax
je 0x44b040
add eax, 0xfffffffc
mov dword [esi + 0x84], eax
mov eax, dword [esi]
mov ecx, dword [eax + 0x13c]
mov ebx, dword [eax + 0x140]
sub ebx, ecx
add ebx, 3
and ebx, 0xfffffffc
add ebx, ecx
mov dword [eax + 0x140], ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x140]
sub ecx, dword [eax + 0x13c]
mov eax, dword [eax + 0x13c]
sub ecx, edx
mov dword [eax + edx + 8], ecx
mov ecx, dword [esi + 0x84]
sub ecx, dword [esi + 0x80]
test ecx, 0xfffffffc
jne 0x44b021
mov al, 1
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0042ab2f
add esp, 0x30
ret 4
Function at 0x45a200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x469009
mov dword [esp], eax
mov dword [esp + 4], 0x468a00
mov dword [esp + 8], 0x46900c
mov dword [esp + 0xc], 0x4689fc
mov dword [esp + 0x10], 0x467074
mov dword [esp + 0x14], str..__
mov dword [esp + 0x18], 0x464560
mov dword [esp + 0x1c], 0x4670a4
mov dword [esp + 0x20], 0x4689f8
mov dword [esp + 0x24], 0x4689f4
mov dword [esp + 0x28], 0x4689f0
mov dword [esp + 0x2c], 0x467070
mov dword [esp + 0x30], 0x4689ec
mov dword [esp + 0x34], 0x4689e8
mov dword [esp + 0x38], 0x4670a8
mov dword [esp + 0x3c], 0x4689e4
mov dword [esp + 0x40], str._____
mov dword [esp + 0x44], str.0123456789
mov dword [esp + 0x48], 0x4686d8
mov dword [esp + 0x4c], 0x468794
mov dword [esp + 0x50], 0x467090
mov dword [esp + 0x54], 0x467088
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x4689d0
mov dword [esp + 0x64], 0x4689cc
mov dword [esp + 0x68], 0x4689c8
mov dword [esp + 0x6c], 0x467080
mov dword [esp + 0x70], 0x4646a8
mov dword [esp + 0x74], 0x4686cc
mov dword [esp + 0x78], 0x4686ac
mov dword [esp + 0x7c], str.rwa
mov dword [esp + 0x80], 0x468698
mov dword [esp + 0x84], 0x468690
mov dword [esp + 0x88], 0x46868c
mov dword [esp + 0x8c], 0x4686d4
mov dword [esp + 0x90], 0x4689c4
mov dword [esp + 0x94], 0x464880
mov dword [esp + 0x98], 0x469198
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x469194
mov dword [esp + 0xc0], 0x468760
mov dword [esp + 0xc4], 0x468744
mov dword [esp + 0xc8], 0x46456c
mov dword [esp + 0xcc], str.ZYXWVUTSRQPONMLKJIHGFDBA
mov dword [esp + 0xd0], 0x468788
mov dword [esp + 0xd4], 0x4670d0
mov dword [esp + 0xd8], 0x4686a4
mov dword [esp + 0xdc], 0x468764
mov dword [esp + 0xe0], 0x46876c
mov dword [esp + 0xe4], 0x4689c0
mov dword [esp + 0xe8], 0x468778
mov dword [esp + 0xec], 0x46875c
cmp cl, 0x3c
jae 0x45a41d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x503014eb
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x3f096344
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4de117
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xf1
cli
fcom qword [eax - 0x31202802]
mov ebx, 0x30bec630
adc dword [ebp - 0x4c3a1566], esi
fild qword [0x3087b9ce]
adc byte [ebx], 0xef
movsd dword es:[edi], dword [esi]
cwde
pop ss
sahf
push ds
xchg edi, eax
sub cl, ah
fist dword [esi + 0x52]
pop ebx
jb 0x4de17a
jae 0x4de179
pop ebx
adc dword [edx], esp
enter 0xfffffffffffffd77, 0x6f
sbb al, 0xc0
dec eax
ror dword [ecx + 0x58], 0xa5
mov edx, 0xbe989606
shr ecx, cl
invalid
jle 0x4de142
add byte [eax], al
pushfd
mov byte [esp + 8], al
inc esp
and al, 8
call fcn.004ec62f
mov al, 7
jne 0x4de0d0
pop ebx
push ebx
sbb al, 0x2a
lahf
salc
sbb byte [eax - 0x14], bh
sbb eax, 0xa9552bd8
js 0x4de119
or bh, byte [edi]
popfd
outsd dx, dword [esi]
add ebp, dword [eax]
and al, 0x35
xchg edi, eax
xor al, 0x9c
mov dh, bl
dec esp
dec esp
invalid
inc esi
xor bl, byte [edx]
fsub qword [esi + 0x7ebc070]
sbb al, 0x44
mov word [edx], es
fsubp st(6)
retf
test bh, dh
wait
in eax, dx
and dword [edx - 0x5fade199], eax
call 0x447e3ea2
and byte [edi + 0x1e], 0x52
mov al, byte [0x305d1ee8]
inc esp
sbb al, 0xea
pop eax
or ebx, ecx
add ebx, edx
stc
insd dword es:[edi], dx
sbb ch, bl
push edx
mov ch, 0xf
mov gs, ax
jne 0x4de175
sub byte [0xe819406d], ch
jg 0x4de158
or esp, esp
adc byte [ebx + 0x522cfed8], 0x61
test eax, 0x2b941f8b
ret

Function at 0x4ec054
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.004df48a
bt dx, 0xd
xor ecx, ecx
lea esp, [esp + 4]
js 0x59b048
call fcn.004d9f31
pushal
pushal
pushfd
lea esp, [esp + 0x44]
jae 0x4ebd30
cmp ebx, 0x3f271502
push 0xc20fa4ab
push dword [esp]
cmc
sub eax, eax
call fcn.004de879
invalid
pushal
lea esp, [esp + 0x20]
call fcn.004d9f31
push 0xd5bf3665
pushfd
push 0x4431354f
lea esp, [esp + 0xc]
jae 0x4ebd30
stc
test si, 0x9f45
sub eax, eax
pushfd
push 0x9b0a892f
push 0x56f0a7
call fcn.005a67a7
out dx, al
invalid

Function at 0x5a0c0c
Capabilities:
Authenticate hmac

Disassembly:
push edi
pushfd
pushfd
add edi, eax
cmp di, 0xc694
stc
cmc
mov edi, dword [edi + ecx*4]
cmp bh, 0x6b
test cl, 0xc9
mov word [esp + 4], 0x4153
test edi, edi
mov byte [esp + 8], 0x71
mov word [esp], 0x12a9
mov byte [esp + 4], dl
lea esp, [esp + 0x30]
je 0x5a8664
clc
add eax, edi
pushal
clc
call fcn.005a1a4a
clc
pushfd
mov edi, dword [edx + 0x24]
clc
stc
add edi, eax
pushal
bt edx, ebp
movzx ecx, word [edi + ecx*2]
bt bp, 0xd
cmc
bsr di, di
mov edi, dword [edx + 0x1c]
jmp 0x4df1f6
mov byte [esp + 0xc], 0xf
lea esp, [esp + 0x10]
jne 0x4eb579
jp 0x4ed18a
not di
mov edi, dword [edx + 0x24]
bt ebp, 1
bt ax, 5
jmp 0x5a7c91
Function at 0x4010cc
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4010de
mov eax, dword [0x41b08b]
shl eax, 2
mov dword [0x41b08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405a00
pop edx
call fcn.00404d9c
call fcn.00405a04
push 0
call fcn.00406cd8
pop ecx
push 0x41b034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x41b093], eax
push 0
jmp fcn.0040b264

Function at 0x40140c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x46a170]
mov edx, dword [0x46a178]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x46a174]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x46a17c]
mov dword [0x46f58c], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401550
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4014bb
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401552
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00405ecc
add esp, 0xc
test eax, eax
je 0x4014d5
xor eax, eax
jmp 0x401552
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4014fe
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401552
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x46a16c], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x46a16c]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x401549
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x401552
mov eax, 1
jmp 0x401552
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40155c
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba8
push ebx
push esi
lea eax, [ebp - 0x458]
push eax
push 0x1ff
call sub.KERNEL32.DLL_GetTempPathA
push str.YShow3D.exe
lea edx, [ebp - 0x458]
push edx
call sub.KERNEL32.DLL_lstrcatA
push 4
push 0x1000
push 0xf000
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
test ebx, ebx
jne 0x4015a9
xor eax, eax
jmp 0x40166f
push ebx
push 0x45b0a4
call fcn.0040d930
add esp, 8
lea edx, [ebp - 0x458]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push edx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x4015f1
push 0
lea eax, [ebp - 4]
push eax
push 0xf000
push ebx
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x458]
push ecx
call sub.KERNEL32.DLL_lstrcatA
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.00405d20
add esp, 0xc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
push 0x10
push 0
lea edx, [ebp - 0x58]
push edx
call fcn.00405d20
add esp, 0xc
lea ecx, [ebp - 0x58]
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x458]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x40165f
xor eax, eax
jmp 0x40166f
push 0xffffffffffffffff
mov edx, dword [ebp - 0x58]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret