joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
xor ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax + eax*4]
add eax, eax
add eax, eax
mov edx, ecx
sub edx, eax
mov al, byte [edx + edi]
mov byte [ebp + ecx - 0x106], cl
mov byte [ebp + ecx - 0x208], al
inc ecx
cmp ecx, 0x100
jl 0x40aa12
xor eax, eax
lea ebx, [ebx]
movzx ecx, byte [ebp + eax - 0x208]
movzx edx, byte [ebp + eax - 0x106]
add ecx, esi
lea esi, [ecx + edx]
and esi, 0x800000ff
jns 0x40aa75
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [ebp + eax - 0x106]
mov dl, byte [ebp + esi - 0x106]
mov byte [ebp + eax - 0x106], dl
inc eax
mov byte [ebp + esi - 0x106], cl
cmp eax, 0x100
jl 0x40aa50
xor eax, eax
xor cl, cl
mov byte [ebp - 0x107], 0
cmp dword [ebp + 0xc], eax
jbe 0x40ab21
mov edi, dword [ebp + 8]
push ebx
jmp 0x40aab6
mov cl, byte [ebp - 0x108]
mov dl, byte [eax + edi]
inc cl
mov byte [ebp - 0x108], cl
movzx esi, cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, byte [ebp - 0x107]
add ecx, ebx
mov byte [ebp - 0x107], cl
movzx ebx, byte [ebp + esi - 0x106]
movzx ecx, cl
lea ecx, [ebp + ecx - 0x106]
mov byte [ebp - 1], bl
movzx ebx, byte [ecx]
mov byte [ebp + esi - 0x106], bl
movzx ebx, byte [ebp - 1]
mov byte [ecx], bl
movzx ebx, byte [ebp + esi - 0x106]
add bl, byte [ecx]
inc eax
movzx ecx, bl
mov cl, byte [ebp + ecx - 0x106]
xor cl, dl
mov byte [eax + edi - 1], cl
cmp eax, dword [ebp + 0xc]
jb 0x40aab0
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push 0x77
push esi
mov dword [ebp - 0x20], 0x6f726863
mov dword [ebp - 0x1c], 0x635f656d
mov dword [ebp - 0x18], 0x646c6968
mov dword [ebp - 0x14], 0x6c6c642e
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
call fcn.00409c00
add esp, 8
test eax, eax
jne 0x40b993
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 0x1c]
push ecx
call fcn.0040ace0
add esp, 8
test eax, eax
je 0x40ba1e
push ebx
push edi
push eax
push esi
call fcn.00406b10
mov edx, dword [esi + 0xca0]
push 0x15db1ddc
push 0
push 0
mov edi, eax
push edx
lea eax, [esi + 0xc94]
push eax
call fcn.00414e40
add esp, 0x1c
mov ebx, eax
call fcn.0041f0ba
mov dword [eax + 3], esi
call fcn.0041f0cc
mov dword [eax + 3], esi
test edi, edi
je 0x40b9f1
push 1
push 2
call fcn.0041f0ba
add eax, 2
push eax
lea ecx, [esi + 0x1934]
push ecx
push edi
push esi
call fcn.004055a0
add esp, 0x18
test ebx, ebx
je 0x40ba13
push 0
push 0
call fcn.0041f0cc
add eax, 2
push eax
lea edx, [esi + 0x19b4]
push edx
push ebx
push esi
call fcn.004055a0
add esp, 0x18
push esi
call fcn.004175d0
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40e270
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
in al, dx
sub esp, 0x328
push ebx
push esi
inc esp
nop
nop
nop
dec esp
movsb byte es:[edi], byte [esi]
popal
cmpsd dword [esi], dword es:[edi]
add eax, 0xffffffa0
add byte [ebx], bh
jae 0x40e309
jl 0x40e272
or dword [ecx + 0x19], esi
fsubr dword ss:[edx]
cmp al, 0xab
mov esp, 0x6df3b406
outsb dx, byte [esi]
mov al, 0x7b
outsb dx, byte [esi]
inc eax
stosb byte es:[edi], al
nop
push ebx
cwde
fcomp qword [edi + 0x4adfd542]
push cs
jp 0x40e312
xchg edx, eax
add ah, dl
nop
sahf
inc eax
invalid
lodsd eax, dword [esi]
dec ecx
in al, dx
dec esp
and al, 0xb4
mov al, 0x26
mov bl, 0x8b
mov gs, word [edi]
push edx
ret
push 0x4379824c
pop edx
cmpsd dword [esi], dword es:[edi]
pop edi
rcr bh, 1
imul byte [esi]
aam 0x25
fcompi st(6)
aam 0x25
push ds
loop 0x40e372
sub cl, byte [eax - 0x4a7559c3]
inc edx
add al, 0xb9
jecxz 0x40e323
imul edx, dword [esp + ebx - 0x7b87a1d0], 0x57
push ebx
xor byte [esi + 0x78], bl
test byte [edi + 0x53], dl
jge 0x40e2cc
adc eax, 0x7f8fbf40
jne 0x40e328
mov ebp, 0xcd137a24
lcall 0x4ad, 0xf7fb6a12
dec edx
mov al, 0x7b
pop ds
xchg ecx, eax
stc
out dx, al
mov cl, 9
lahf
sbb dword [esi], ecx
out 0x77, eax
or al, 0x3e
dec edi
cmpsd dword [esi], dword es:[edi]
sub eax, 0x7982250f
scasb al, byte es:[edi]
jns 0x40e37d
inc ecx
xor byte [ecx - 0xf9e4cae], dh
iretd
les eax, [ecx]
adc dword [edi], eax
and byte [ecx], bh
fnstcw word [eax + 0x39868bc5]
in eax, 0xf3
getsec
cmp ebp, esp
getsec
dec ebx
movsb byte es:[edi], byte [esi]
jecxz 0x40e3e5
stosd dword es:[edi], eax
xchg ebx, eax
invalid
into
test edi, ebp
mov dh, 0x61
push eax
adc esp, eax
jb 0x40e3f5
jnp 0x40e3e8
cmp edx, esi
mov byte [0xbb31f8f6], al
movsd dword es:[edi], dword [esi]
sti
pop ecx
inc eax
clc
xor dword [ebx + 0x4059fba5], edi
shl byte [ecx - 0x17], cl
mov eax, dword [0x8f510b7d]
xchg ebx, eax
pop ebp
dec ecx
mov dh, 0x38
sub byte [esi + 0x74], dh
lahf
movsb byte es:[edi], byte [esi]
retf 0x7df5
Function at 0x41e98a
Capabilities:
Encode data using xor

Disassembly:
add ebp, 0x1b639801
cmp byte [0x4d9d92a], bl
xor ebp, dword [0xec688f9c]
js fcn.0041e98a
mov dword [0x7b6ab78], esp
shl dword [0xa34d2fd], 0xdd
shl byte [0xa56b633c], 0xc
jb fcn.0041e98a
shl dword [0x61b34f72], 0xc6
jo fcn.0041e98a
test dword [0xabef5870], esi
cmp ebx, dword [0x35f540ef]
shl byte [0x96cc83e6], 0x7e
dec esp
ror dword [0x48731f67], 0x4e
mov dword [0x2c117b09], esp
movsw word es:[edi], word [esi]
or byte [0x5d3450e7], cl
jp fcn.0041e98a
pop dword [0x8dfcd47a]
movsb byte es:[edi], byte [esi]
dec ebx
test byte [0x1a45903a], ah
lodsd eax, dword [esi]
xchg dword [0x56e772e], ecx
test dword [0x6f58d2a1], ecx
or ebx, dword [0xa21a349f]
lodsb al, byte [esi]
add bl, byte [0x3d1832e0]
adc al, 0xb1
jne fcn.0041e98a
shr dword [0x8f23c675], 0x7d
sbb dl, byte [0xe5535782]
lea edi, [0xbf1dbc68]
js fcn.0041e98a
sbb esp, dword [0xdfbb0178]
and al, 0xb6
add ebx, dword [0x8d385f7]
push eax
xor ebx, dword [0x777725d1]
sbb dword [0xeb1c3d11], ebx
test ebp, 0x772c3292
and esp, dword [0x3dd9ee1b]
call fcn.0041e98a
add eax, dword [0xff0dbae8]
sbb ebx, dword [0x256d276d]
cmp ah, 0
sbb eax, dword [0x841ebf7]
sbb byte [0xe53ad914], ah
or dword [0x8a7917c8], edi
lodsd eax, dword [esi]
cmp dword [0xc20dc5f0], esi
xchg dword [0xcbcb948b], ebp
rcl dword [0xb54bb61e], 0x4d
ror dword [0x4b3b9237], 0xef
add edx, dword [0x3405e38b]
sbb dword [0x1de303d], ebp
xor esi, dword [0x661629d]
mov esp, dword [0x6bf59e3e]
sub bl, byte [0x643994f2]
ror byte [0x523884d0], 0xd3
lea edi, [0xd5691dc0]
ret
Function at 0x401e40
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp + 0xc]
push esi
lea eax, [ebp - 0x78]
push 0xffffffffffffffb0
inc ebp
mov byte [edx - 0x50], ch
push eax
push esi
call 0xa83286e0
mov ecx, dword [ebp - 0x3a]
mov ebx, dword [ebp + 0x3e135f]
push eax
test eax, 0x1cabc283
lodsb al, byte [esi]
aam 0x5b
add ch, ch
call [eax + eax*4]
rol dword [eax], 0xa1
lodsb al, byte [esi]
push ebx
inc ecx
add byte [ebx - 0x3f7aeb0f], al
je 0x401e4c
sal byte [edi + ecx*8 + 0x50], 0x68
push esp
rol byte [eax], cl
push eax
push str.Total_of__d_requests_completed_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 8
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
pop esi
nop
mov ebp, 0x909090a5
nop
nop
pushal
nop
nop
nop
push ebp
in al, dx
xchg ecx, eax
in al, dx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp al, 0x46
adc al, 0x94
inc ebp
or al, ch
pop eax
dec ebx
add byte [eax], al
mov dword [0x4187a0], eax
mov dword [0x410b6d], edx
mov ebx, eax
mov eax, dword [esi + 0x6a]
test eax, eax
mov ebp, dword [esi + 0x28b4075]
add al, 0x6a
add byte [edx], ch
push ecx
call fcn.00408c70
mov dword [esi + 0x5f0808], ebx
pop ebx
je 0x401e7a
or byte [eax], al
add bh, al
inc esi
sbb byte [eax], al
outsd dx, dword [esi]
add byte [eax], al
mov edx, dword [0x41f6ec]
fcom qword [esi + 0x14]
mov eax, dword [0x411460]
test eax, eax
je 0x401f3a
mov eax, dword [0x9e6a0270]
mov ecx, edx
sub cl, al
out 0xd6, eax
adc al, 0xeb
sub eax, 0x22388e83
add byte [eax], al
mov eax, dword [0xb1d0a7]
mov edx, dword [0x5e40a32c]
add ecx, eax
mov eax, dword [esi + 0x29f2083c]
push ebp
ret 0xf83b
mov ebp, dword [ecx + 0x18]
mov ebx, dword [0x8995f7]
bound eax, qword [esi + 4]
lea ecx, [ebp + 8]
add edx, ebx
push ecx
push edx
push eax
call 0x6c8ac0
test eax, eax
in eax, dx
xor eax, dword [ebx + 0x37d60b79]
cmp eax, 0x6a0afd68
je 0x401f8a
fcomp st(1)
cld
or al, byte [eax]
je 0x401f8a
popfd
push edi
std
test byte [edx + 0x24fd1974], cl
std
cmp eax, dword [eax]
xchg esp, esp
cmp eax, 0xc00afca1
je 0x401f8a
cmp eax, 0x4888b3
jne 0x402030
mov eax, dword [ebp + 0x25]
xchg dword [0x4102a0], ebx
mov edi, dword [0x6702a4]
clc
fadd dword [ebx + 0x73e161d7]
mov al, byte [0x89004102]
cmp eax, 0x4102a4
aaa
push esi
sbb byte [ebx - 0x2ffcebb2], cl
push esp
enter 0x5689, 0x18
mov dword [esi + 0x14], ecx
invalid
mov ebx, dword [0x4102bc]
push 0x1140d4bc
inc ebx
mov dword [0x41efbc], ebx
call dword [0x1631c164]
push esi
sub eax, 0x9c1a26
add esp, 0x61
pop edi
and byte [ebx - 0x75], bl
in eax, 0x5d
ret
Function at 0x405f20
Capabilities:
Allocate thread local storage
Encode data using xor

Disassembly:
sahf
mov ebx, 0x7bbd93b
jle 0x405f02
lea ecx, [ebx - 0x6f]
cmp eax, dword [edi + 0x1f]
dec ebp
dec ebx
inc ecx
mov edx, dword [eax - 4]
add edx, 2
mov dword [eax], edx
pop ebp
xor byte [edx - 0x2d7bb9ea], cl
dec ebx
xor dh, al
cmc
mov edx, dword [ebp + 0xc]
add eax, 4
dec edx
mov dword [ebp + 0xc], edx
jne 0x405ee3
mov eax, dword [ebp + 8]
mov dword [esp + esi*2], 0
pop ebx
cmp byte [edi - 0x75], bl
ret
test al, 0x8b
in al, dx
pop es
in al, dx
cwde
add dword [eax], eax
mov eax, dword [0x268a88a1]
pop es
enter 0xffffffffffff8540, 0xffffffffffffffda
mov dword [0x41c888], eax
je 0x405ed1
std
ror byte [ebx - 0x723c911b], 0xd6
clc
push 0x479be8
add byte [ebx - 0x17afb3c], al
jne 0x405fd6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
setnp dl
inc ecx
add al, ch
adc al, 0xd4
sub bh, bh
test eax, eax
jne 0x405fdb
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
call 0xf4f60
test dword [ebp + 0x22b80974], esi
dec esi
add byte [eax], al
mov esp, ebp
pop ebp
ret
mov eax, 0x5cff11
mov esp, ebp
pop ebp
ret

Function at 0x408ac0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
pop ss
mov ebx, 0xc4d8bd7
push esi
mov ebp, dword [ebx]
adc byte [ecx + 0x4d8bf84d], cl
or byte [edx], ch
and byte [esi], al
push 0
lea edx, [ebp - 4]
jo 0x408b23
hlt
push eax
push edx
mov dword [ebp - 4], 0
add byte [eax], al
call dword [sym.imp.WS2_32.dll_WSASend]
and al, 0xf8
jne 0x408b2a
push edi
cmp dword [sym.imp.WSOCK32.dll_WSAGetLastError], edi
call [ebx - 0x7b]
sar byte [ebx + 0x5f06890a], 0xd2
mov edi, dword [esi + 0x5d]
ret 0x64
pop esi
mov esp, ebp
jno 0x408aea
or al, 0
cmp al, byte [ebp - 4]
mov dword [esi], eax
loope 0x408af1
pop esi
mov esp, ebp
pop ebp
ret 0x49

Function at 0x40a4b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
test byte [ebp + 0x14], 0x4b
mov esi, dword [ebp + 8]
neg eax
sbb eax, eax
neg eax
dec eax
push ebx
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
inc eax
add byte [ebp + 0x14024b1b], al
jne 0x40a510
mov edx, dword [esi + 0x14]

Function at 0x40a580
Capabilities:
Encode data using xor

Disassembly:
ljmp 0x558b:0x1173c63b
push ebp
mov ebp, esp
pop ss
mov ebx, dword [0x40c18b]
push esi
push edi
mov edi, dword [ebp - 0x1b]
push 0x2f
push edi
call dword [ecx + eax - 0xf74a8a4]
call ebx
je 0x40a561
adc byte [ebx], bh
xor al, byte [ecx]
add cl, byte [ebx - 0x21097a10]
push cs
push 0x3a
push edi
call ebx
mov esi, eax
dec esi
les ecx, [eax]
test esi, esi
je 0x40a629
lea eax, [esi + 1]
pop edi
popfd
pop ebx
pop ebp
ret 4
push ecx
call [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
inc eax
mov dword [esi], eax
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x2125bbf
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x1e592052
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x50872d13
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x50872d22
pop dword [ebp - 0x28]
mov eax, 0x50872d22
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x620807b0
add dword [ebp - 0x38], 0xec4a3d9b
mov dword [ebp - 0x34], 0xdcb0afe8
sub dword [ebp - 0x34], 0xaa7d63a3
mov dword [ebp - 0x30], 0x2635612b
sub dword [ebp - 0x30], 0xd9e91cfd
mov dword [ebp - 0x2c], 0x7716932d
sub dword [ebp - 0x2c], 0x7716932d
lea eax, [ebp - 0x38]
push eax
mov eax, 0x84cd6338
add eax, 0xcbb9ad48
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xf24c3ea7
add dword [ebp - 0x38], 0x82262aaf
mov dword [ebp - 0x34], 0x519339f
sub dword [ebp - 0x34], 0xc3acd22a
mov dword [ebp - 0x30], 0x5980f844
sub dword [ebp - 0x30], 0xf6118bd8
mov dword [ebp - 0x2c], 0x1c56dd56
add dword [ebp - 0x2c], 0xe3a922aa
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x379cd
push 0
call eax
mov ecx, 0x67200b3
sub ecx, 0x671b597
xor ebx, ebx
add ebx, eax
mov esi, 0x740ae1dc
sub esi, 0x238351dc
add esi, dword [ebp - 0x28]
mov edi, 0x4c4b900c
sub edi, 0x25edd988
sub dword [ebp - 4], 0x528a52ff
mov edx, dword [esi]
xor dword [ebp - 0x14], ebx
xor edx, edi
add dword [ebp - 0x10], edx
mov dword [ebx], edx
xor dword [ebp - 0x14], 0xc86fad97
add ebx, 0x1df3a209
sub ebx, 0x1df3a205
add esi, 0x578f6b4c
sub esi, 0x578f6b48
loop 0x50872e3c
add eax, 0xb8a7b1dd
add eax, 0x47596d66
xor ebx, ebx
add ebx, eax
add eax, 0x1648599d
add eax, 0xe9b7a668
mov ecx, 0x339202de
sub ecx, 0xe30b02de
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x5087472e
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push esi
mov esi, ecx
call fcn.50874717
and byte [esi + 0xc], 0
mov eax, 0x50870000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x1c]
push 0
push eax
mov dword [esi], 0x3c
call sub.MSVCR70.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
cmp dword [ebp - 0xc], 2
jne 0x50874788
cmp dword [ebp - 0x18], 5
jb 0x508747a0
jmp 0x5087479c
cmp dword [ebp - 0xc], 1
jne 0x508747a0
cmp dword [ebp - 0x18], 4
ja 0x5087479c
jne 0x508747a0
cmp dword [ebp - 0x14], 0
jbe 0x508747a0
mov byte [esi + 0xc], 1
lea eax, [esi + 0x18]
push eax
mov dword [esi + 0x10], 0x700
mov dword [esi + 0x14], 0x50875050
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
add ebp, 0x78
leave
ret
Function at 0x10001020
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.ws2_32
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1000744c], eax
test eax, eax
jne 0x100010a4
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x310]
push 0x10004100
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push str.AheadLib
lea edx, [ebp - 0x310]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [0x1000744c]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000331c
mov esp, ebp
pop ebp
ret

Function at 0x100010c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x1000744c], 0
push esi
mov esi, ecx
jne 0x100010f0
call fcn.10001020
test eax, eax
jne 0x100010f0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [0x1000744c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x10001152
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, esi
shr ecx, 0x10
test ecx, ecx
jne 0x10001122
push esi
lea edx, [ebp - 0x44]
push 0x1000412c
push edx
call edi
add esp, 0xc
lea esi, [ebp - 0x44]
push esi
lea eax, [ebp - 0x148]
push 0x10004130
push eax
call edi
add esp, 0xc
push 0x10
push str.AheadLib
lea ecx, [ebp - 0x148]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000331c
mov esp, ebp
pop ebp
ret
Function at 0x10001210
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
jne 0x1000123d
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10001309
mov cl, 0x90
push edi
mov byte [ebp - 0x18], cl
or cl, 0xff
mov dword [ebp - 0x1c], 0x909090e9
mov dword [ebp - 0x14], 0x81ec8b55
mov word [ebp - 0x10], 0x7cc4
mov byte [ebp - 0xe], 0xfe
mov byte [ebp - 0xd], cl
mov byte [ebp - 0xc], cl
mov dword [ebp - 0xb], 0x33575653
mov byte [ebp - 7], 0xdb
lea esi, [eax + 0x1000]
xor edi, edi
push ebx
jmp 0x10001280
mov edx, 0xe
lea eax, [ebp - 0x14]
mov ecx, esi
lea ebx, [ebx]
mov ebx, dword [ecx]
cmp ebx, dword [eax]
jne 0x100012b2
sub edx, 4
add eax, 4
add ecx, 4
cmp edx, 4
jae 0x10001290
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100012b2
mov al, byte [eax + 1]
cmp al, byte [ecx + 1]
je 0x100012cd
inc edi
inc esi
cmp edi, 0x500000
jl 0x10001280
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000331c
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0x20]
push edx
push 0x40
mov ecx, 0x10001170
sub ecx, esi
push 5
sub ecx, 5
push esi
mov dword [ebp - 0x1b], ecx
call edi
test eax, eax
je 0x10001307
mov eax, dword [ebp - 0x1c]
mov cl, byte [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x20]
push edx
push eax
push 5
push esi
mov byte [esi + 4], cl
call edi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1000331c
mov esp, ebp
pop ebp
ret

Function at 0x10001320
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
cmp eax, 1
jne 0x100013a1
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov edi, dword [sym.imp.KERNEL32.dll_TlsAlloc]
xor esi, esi
nop
call edi
mov dword [esi + 0x10007450], eax
add esi, 4
cmp esi, 0x7d0
jb 0x10001340
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push section..text
push 4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov ecx, str.SmartCost_Bills.exe
mov dword [0x10007448], eax
call fcn.10001210
mov ecx, str.SmartCost_Budget.exe
call fcn.10001210
mov ecx, str.BillsEditor.exe
call fcn.10001210
mov ecx, str.SmartCost_Budget_Bills
call fcn.10001210
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
test eax, eax
jne 0x100013d4
mov edi, dword [sym.imp.KERNEL32.dll_TlsFree]
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [esi + 0x10007450]
push ecx
call edi
add esi, 4
cmp esi, 0x7d0
jb 0x100013b0
mov eax, dword [0x10007448]
test eax, eax
je 0x100013d4
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc

Function at 0x1000331c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10003326
repz ret
jmp fcn.100036bc
Function at 0x4090e4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4095b0
call fcn.004093a8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409144
cmp eax, 0xffffffff
je 0x409144
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40913d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40913d
cmp edx, 0x10000000
jae 0x40913d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40913a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4091b0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4091ee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4091e6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4091f0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4091d6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4092c0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4092f1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4092f1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x4092f1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10002bec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1000e0cc]
jne 0x10002bf6
repz ret
jmp fcn.10004f9d

Function at 0x1000679e
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x10006723
cmp dword [eax + 0xc], ebx
je 0x100067c6
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.1000617e
arpl dx, dx
xchg ebp, eax
adc edi, dword [ecx]
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x100067b4
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x1000678f
and eax, 0xffff
push eax
jmp 0x10006793
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10006143
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x1000696d
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x10006774
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x10006715
call fcn.1000617e
in eax, dx
and dh, 8
invalid
invalid

Function at 0x100067d1
Capabilities:
Inspect section memory permissions

Disassembly:
mov al, byte [0x3b000000]
ret

Function at 0x10007479
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 4], eax
invalid