joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102bd930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x38
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, 0x2d17
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov eax, 0xb8c
mov dword [0x102e50b4], 0
mov dword [0x102e50b8], 0
mov dword [0x102e50c4], 0
mov dword [ebp - 0x14], eax
mov eax, dword [0x102e50ac]
add eax, 0xffffdbca
mov dword [0x102e50b0], eax
mov dword [0x102e50ac], 0xb8c
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov eax, ebx
mov dword [ebp - 0x18], eax
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ebx
jne 0x102bd9c7
mov eax, dword [ebp - 0x20]
mov dword [0x102e50b0], eax
add esp, 0x38
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
mov edi, 0x100
add ecx, 0xffffe6cf
mov ebx, esi
add ebx, 1
add eax, 1
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x102e50b4], edx
mov dword [0x102e50b0], 0x2089
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x2c]
movzx ecx, byte [ecx + edx]
mov dword [ebp - 0x40], edx
mov edx, dword [ebp - 0x38]
add ecx, edx
mov eax, ecx
cdq
idiv edi
mov dword [0x102e50b8], edx
mov ecx, dword [ebp - 0x3c]
mov dword [0x102e50b0], ecx
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x40]
mov cl, byte [ecx + edi]
mov byte [0x102e50bc], cl
mov dword [0x102e50ac], 0x136f
mov ecx, dword [ebp - 0x2c]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x2c]
mov byte [edx + edi], cl
mov dword [0x102e50b0], 0xf56
mov cl, byte [0x102e50bc]
mov edx, dword [0x102e50b8]
mov edi, dword [ebp - 0x2c]
mov byte [edi + edx], cl
mov dword [0x102e50ac], 0x2311
mov edx, dword [0x102e50b4]
movzx edx, byte [edi + edx]
mov ecx, dword [0x102e50b8]
movzx ecx, byte [edi + ecx]
add ecx, edx
mov dword [0x102e50b0], 0xa5a
and ecx, 0xff
mov dword [0x102e50c4], ecx
mov cl, byte [edi + ecx]
mov edx, dword [ebp - 0x24]
mov ch, byte [edx + esi]
mov dword [0x102e50ac], 0x6f8
xor ch, cl
mov edx, dword [ebp - 0x28]
mov byte [edx + esi], ch
mov esi, dword [ebp - 0x10]
cmp ebx, esi
mov dword [ebp - 0x44], ebx
jne 0x102bdad5
mov eax, dword [0x102e50ac]
add eax, 0x218b
mov dword [ebp - 0x20], eax
jmp 0x102bd9b7
mov eax, dword [0x102e50ac]
mov ecx, dword [0x102e50b8]
mov edx, dword [0x102e50b4]
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
jmp 0x102bd9c7
Function at 0x102bdafa
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x90
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov dword [0x102e50ac], 0x1c0e
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.102bd126
lea ecx, [0x102bd446]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x30], edx
mov dword [esp + 0x60], 0x136e00
mov edx, dword [0x102e5098]
mov dword [esp + 0x78], edx
mov edx, dword [0x102e509c]
mov dword [esp + 0x40], edx
mov edx, dword [0x102e50a0]
mov dword [esp + 0x54], edx
mov edx, dword [0x102e50a4]
mov dword [esp + 0x4c], edx
mov edx, dword [0x102e50a8]
mov dword [esp + 0x7c], edx
mov dword [0x102e50ac], 0x1fcb
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x102bdba4
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x102bdbc7
jmp 0x102bdbb3
mov eax, dword [esp + 8]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
je 0x102bdb86
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x102bdba4
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [0x102e50ac], 0xe25
mov dword [0x102e50b0], 0x265c
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x34], edx
call fcn.102bccc5
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
jne 0x102bdb9c
lea eax, [esp + 0x20]
mov dword [0x102e50ac], 0x1c67
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.102bcb5e
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x102e50ac], 0x1592
mov dword [esp + 8], eax
jmp 0x102bdb9c
Function at 0x406977
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004062d8
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x4069e9
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x4069e9
cmp dword [ebp + 0x18], 1
je 0x4069ee
cmp dword [ebp + 0x18], 2
je 0x4069ee
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x4069f3
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406a56
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406aa0
test edi, edi
jne 0x406a63
mov word [esi], ax
jmp 0x406aa2
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406b9d
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406bbf
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406e3c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x432414], 0
push esi
jne 0x406e76
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406e4d
mov dword [ecx*4 + 0x432410], edx
inc ecx
cmp ecx, 0x100
jl 0x406e48
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406ea0
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x432410]
inc esi
sub edx, 1
jne 0x406e88
not ecx
mov eax, ecx
pop esi
ret 0xc

Function at 0x4022e0
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push dword [0x40374f]
call dword [sym.imp.pdh.dll_PdhCloseQuery]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x40230e
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x401775], eax
ret
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x445d1a
Capabilities:
Encode data using xor

Disassembly:
shl dword [edx - 0x2207a4e9], cl
sahf
add dh, dh
js 0x445d4e
arpl word [ebp - 0x5ad35d16], sp
add al, 0x43
push dword [eax - 0x19]
invalid
adc eax, 0xc40ef37a
pushal
add eax, 0x95f65fa5
dec esi
std
aam 0x1a
jnp 0x445d0d
rcr dword [edx + 0x55f9616a], 1
invalid

Function at 0x44831a
Capabilities:
Encode data using xor

Disassembly:
and eax, edx
mov esi, 0x77424e5
invalid
paddw mm4, qword [esi - 0x10]
dec ebx
and byte [edx + 0x51], cl
pop edi
movsb byte es:[edi], byte [esi]
jo 0x44824d
and al, bh
xor al, byte ss:[ebx + 0x25]
mov dl, 0xc8
cmovno eax, dword [edi]
add al, 0xa0
mov eax, 0x37f54bde
mov bh, 0x41
popal
mov bh, 0x34
adc byte [bx + di + 0x5503], ch
sbb byte [eax - 0x29], bh
iretd
sbb edx, dword [edx*4 - 0x3c558ba3]
adc dword [ebx], ecx
iretd
je 0x4482bf
ret
adc ebp, edx
add al, 0x8d
popfd
pop ds
stc
or eax, 0x7f21512e
sti
enter 0x2a7a, 0xfffffffffffffff4
fst dword [edi + edi]
jmp 0x44836c
pushfd
je 0x44830f
adc eax, 0x84d45a3
push eax
mov ebp, 0x6644999a
loop 0x448313
inc ecx

Function at 0x44ab82
Capabilities:
Authenticate hmac

Disassembly:
mov ecx, 0x75f8f673
pop esi
aad 0xad
cmp byte [edi - 0x40ec0efe], al
mov bh, 0x1b
jbe 0x44ac05
out dx, al
xchg byte [0x6cf00b50], bh
sub dl, byte [edi + 0x6d]
sbb al, 0xf7
xchg edi, eax
push esi
neg ah
daa
mov bh, 0x24
add dl, 0xda
movsb byte es:[edi], byte [esi]
in eax, dx
add al, 0xe2
and eax, dword [esi]
fnstcw word [ecx + eax - 0x71b47df8]
jns 0x44abf3
xchg ebx, eax
out dx, eax
call 0x6335c9ca
les esp, [esi - 0x5a]
pop eax
movsb byte es:[edi], byte [esi]
inc ecx
mov al, byte [0x3c43c55d]
cmp byte [ecx], cl
invalid
Function at 0x4dda1e
Capabilities:
Encode data using xor

Disassembly:
mov dword [ecx + ebp + 0x1e303176], edi
or al, 0xd3
rol dword [ebx], cl
invalid
invalid
frstor dword [edx]
invalid
rol dword [ebx], cl
lea edi, [ebp + 0x367622dd]
xchg ebp, eax
xchg ebp, eax
or al, 0x5b
jle 0x4dda16
sar byte [edi + 3], 0xa
xor dword [ecx + eax*4], ebp
pop edx
jae 0x4dda25
invalid
push ebp
insb byte es:[edi], dx
jae 0x4dda34
sub bh, dl
push edi
cmc
ljmp 0x6d8d

Function at 0x4e18a0
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0xc], 0
mov al, byte [0x65f037]
xor al, byte [0x65f030]
mov byte [0x65f037], al
mov ecx, dword [0x65f024]
mov edx, dword [0x65f020]
lea eax, [edx + ecx*2]
mov dword [0x65f020], eax
xor ecx, ecx
mov cl, byte [0x65f037]
mov edx, dword [0x65f028]
and edx, 3
imul ecx, edx
mov eax, dword [0x65f024]
add eax, ecx
mov dword [0x65f024], eax
mov dword [ebp - 0x1c], 0x5a4d
mov dword [ebp - 0xc], 0x4550
mov cl, byte [0x65f030]
and cl, byte [0x65f03d]
mov byte [0x65f030], cl
xor edx, edx
mov dl, byte [0x65f030]
sar edx, 1
or edx, 1
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
fdivr qword [0x65f040]
fst qword [0x65fbd0]
fadd qword [0x65b860]
fstp qword [0x65fbd0]
mov eax, dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x65f024]
shl ecx, 1
or ecx, dword [0x65f020]
add byte gs:[ecx + 0x45c7d84d], cl
fadd qword [eax]
add byte [eax], al
add bh, bl
insd dword es:[edi], dx
fcomp st(4)
add eax, 0x65f040
fstp qword [0x65f040]
mov edx, dword [0xa5ff38]
cmp edx, dword [0x65f020]
je 0x4e1993
mov eax, dword [0x65f020]
xor eax, dword [0xa5ff38]
mov dword [0x65f020], eax
jmp 0x4e1f73
mov cl, byte [0x65f036]
xor cl, byte [0x65f037]
mov byte [0x65f036], cl
mov edx, dword [0x65f028]
shr edx, 1
mov eax, dword [0x65f02c]
add eax, edx
mov dword [0x65f02c], eax
xor ecx, ecx
mov cl, byte [0x65f037]
mov edx, dword [0x65f02c]
and edx, 7
imul ecx, edx
mov eax, dword [0x65f028]
add eax, ecx
invalid
Function at 0x4e1a32
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
mov dl, byte [0x65f031]
or dl, byte [0xa5ff44]
mov byte [0x65f031], dl
xor eax, eax
mov al, byte [0x65f035]
sar eax, 1
or al, 1
mov dword [ebp - 0x30], eax
fild dword [ebp - 0x30]
fdivr qword [0x65f048]
fst qword [0x65fbe0]
fadd qword [0x65b858]
fstp qword [0x65fbe0]
mov cl, byte [0x65f035]
and cl, byte [0x65f036]
mov byte [0x65f035], cl
mov edx, dword [0x65f020]
shr edx, 5
mov eax, dword [0x65f024]
and eax, edx
mov dword [0x65f024], eax
xor ecx, ecx
mov cl, byte [0x65f036]
mov edx, dword [0x65f020]
and edx, 8
imul ecx, edx
mov eax, dword [0x65f02c]
or eax, ecx
mov dword [0x65f02c], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x1000
adc byte [eax], al
add byte [ecx + 0x558bf04d], cl
invalid
mov dword [ebp - 0x18], edx
mov al, byte [0x65f032]
xor al, byte [0x65f03e]
mov byte [0x65f032], al
xor ecx, ecx
mov cl, byte [0x65f030]
sar ecx, 2
or ecx, 3
mov dword [ebp - 0x34], ecx
fild dword [ebp - 0x34]
fdivr qword [0x65fbd8]
fst qword [0x65fbd8]
fadd qword [0x65fbd0]
fstp qword [0x65fbd8]
mov edx, dword [ebp - 0x10]
push edx
call fcn.0044bb10
add esp, 4
test eax, eax
je 0x4e1bec
mov eax, dword [0x65f028]
shl eax, 1
or eax, dword [0x65f02c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0
fild qword [ebp - 0x3c]
fadd qword [0x65f040]
fstp qword [0x65f040]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov dx, word [ecx]
cmp edx, dword [ebp - 0x1c]
je 0x4e1b4e
jmp 0x4e1bec
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
xor eax, eax
mov ax, word [edx]
cmp eax, dword [ebp - 0xc]
je 0x4e1b6c
jmp 0x4e1bec
mov ecx, dword [0x65f020]
shl ecx, 3
or ecx, dword [0x65f024]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], 0
fild qword [ebp - 0x44]
fstp qword [0x65f048]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x85ff00], eax
mov dl, byte [0xa5ff44]
and dl, byte [0x65f03a]
lock add byte gs:[eax - 0x5a00bbeb], cl
add byte [ecx + 0x65f024], ah
cmp dword [ebp - 0x10], 0x1000000
ja 0x4e1a6d

Function at 0x4e1aba
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
adc byte [eax], al
add byte [ecx + 0x558bf04d], cl
invalid
Function at 0x57741e
Capabilities:
Encode data using xor

Disassembly:
or al, byte [eax*8 - 0xc6a42fb]
mov ebx, 0x67c8d1cd

Function at 0x60ee50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [0x65f020]
mov cl, byte [0x65f037]
mov al, byte [0x65f030]
push ebx
push esi
mov esi, dword [0x65f024]
xor cl, al
xor ebx, ebx
lea edx, [edx + esi*2]
mov bl, cl
mov dword [0x65f020], edx
mov edx, dword [0x65f028]
and edx, 3
push edi
imul edx, ebx
add esi, edx
mov dl, byte [0x65f03d]
and al, dl
mov byte [0x65f037], cl
mov byte [0x65f030], al
or al, 2
shr al, 1
and eax, 0xff
mov dword [0x65f024], esi
mov dword [ebp - 4], eax
fild dword [ebp - 4]
fdivr qword [0x65f040]
fadd qword [0x65b860]
fstp qword [0x65fbd0]
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [0x65f024]
mov edx, dword [0x65f020]
mov dword [ebp - 8], 0
lea ecx, [eax + eax]
mov eax, dword [0xa5ff38]
or ecx, edx
invalid

Function at 0x60f4be
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x65f031]
mov bl, byte [0x65f03b]
xor bl, al
mov eax, dword [ecx]
mov byte [0x65f03b], bl
mov bl, byte [0x65f039]
xor esi, eax
mov al, byte [0x65f032]
xor bl, al
mov eax, dword [ebp - 4]
add ecx, 4
xor edi, eax
cmp ecx, 0x65fe30
mov byte [0x65f039], bl
jb 0x60f4af
mov ecx, dword [0x65f024]
mov dword [ebp - 8], 0
mov dword [0x65f028], edi
pop edi
lea eax, [ecx*8]
or eax, edx
mov dword [ebp - 0xc], eax
mov eax, esi
fild qword [ebp - 0xc]
pop esi
pop ebx
fstp qword [0x65f040]
mov esp, ebp
pop ebp
ret
Function at 0x403070
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
mov eax, dword [0x49c544]
mov ecx, dword [0x499450]
sub esp, 0xc24
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403172
mov esi, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x49c544], 0x959
jne 0x403158
call esi
push 0
lea eax, [esp + 0x434]
push eax
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
xor eax, eax
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
push 0
push 0x402c84
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventA]
mov eax, dword [esp + 0x14]
push eax
call fcn.00402ee0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x4030b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc24
ret
Function at 0x40a9c0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f760]
jne 0x40a9ca
repz ret
jmp fcn.0040d3d7

Function at 0x40b02f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00408ee0
and dword [ebp - 4], 0
cmp dword [0x431f70], 0
mov ebx, eax
jne 0x40b0e0
push 0x401ab8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b191
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401aac
push edi
call esi
test eax, eax
je 0x40b191
push eax
call fcn.00408e6e
mov dword [esp], 0x401a9c
push edi
mov dword [0x431f70], eax
call esi
push eax
call fcn.00408e6e
mov dword [esp], 0x401a88
push edi
mov dword [0x431f74], eax
call esi
push eax
call fcn.00408e6e
mov dword [esp], 0x401a6c
push edi
mov dword [0x431f78], eax
call esi
push eax
call fcn.00408e6e
pop ecx
mov dword [0x431f80], eax
test eax, eax
je 0x40b0e0
push 0x401a54
push edi
call esi
push eax
call fcn.00408e6e
pop ecx
mov dword [0x431f7c], eax
mov eax, dword [0x431f7c]
cmp eax, ebx
je 0x40b138
cmp dword [0x431f80], ebx
je 0x40b138
push eax
call fcn.00408ee9
push dword [0x431f80]
mov esi, eax
call fcn.00408ee9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b138
test edi, edi
je 0x40b138
call esi
test eax, eax
je 0x40b12f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b12f
test byte [ebp - 0xc], 1
jne 0x40b138
or dword [ebp + 0x10], 0x200000
jmp 0x40b171
mov eax, dword [0x431f74]
cmp eax, ebx
je 0x40b171
push eax
call fcn.00408ee9
pop ecx
test eax, eax
je 0x40b171
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b171
mov eax, dword [0x431f78]
cmp eax, ebx
je 0x40b171
push eax
call fcn.00408ee9
pop ecx
test eax, eax
je 0x40b171
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431f70]
call fcn.00408ee9
pop ecx
test eax, eax
je 0x40b191
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b193
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40158f
Capabilities:
Enumerate pe sections
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push esi
push edi
call sub.KERNEL32.dll_GetTickCount
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA

Function at 0x4015b0
Capabilities:
Enumerate pe sections

Disassembly:
cmp byte [ebp - 0x104], 0
jne 0x4016ff
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
rcl byte [edi - 0x73], cl
inc esp
or byte [eax], bl
cmp byte [ebp - 0x104], 0
jne 0x40188e
add byte [eax], al
add byte [ebx - 0x3ca2e73c], al
int3
push 0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetFileAttributesExA
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov ecx, dword [0x42373f]
inc ecx
cdq
idiv ecx
mov edi, eax
and edi, 0xffffffa8
mov dword [ebp - 0x108], edi
or esi, esi
jne 0x4019d7
or ebp, dword [eax]
add dword [eax], eax
add bh, bh
jne 0x4018dc
push edx
jmp 0x4018e6
pop ss
push 0x100
push dword [ebp + 0xc]
push ecx
push dword [0x662b2010]
call dword [0x662b1034]
jmp 0x4018fc
pop esi
pop ebp
ret 8
mov eax, dword [ebp - 0x108]
pop edi
pop esi
leave
ret

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x24883b18
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0xbdb4084
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x8717985
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42cd70
mov ecx, 0x70db5564
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219