joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe5a9af
Capabilities:
Packed with generic packer

Disassembly:
push eax
lea esp, [esp + 4]
jbe 0xe47726
movsx di, al
and cx, 0xa63
dec bh
mov edi, dword [edx + 0x24]
rcr bx, cl
bts ebx, ecx
add edi, eax
stc
mov ebx, dword [edx + 0x20]
test ax, 0xd5a5
rcr cx, cl
add ebx, eax
jmp 0xe500bf
cmp al, 0x61
cmc
stc
pushal
sub ecx, dword [edx + 0x10]
test ah, 0x9b
mov byte [esp + 4], ch
call fcn.00e5cdf7
sar dh, 4
shl di, cl
xor eax, eax
adc ecx, 0xd5666207
sete cl
mov dword [ebp - 8], 0
dec ecx
cmp edi, edi
shl ecx, cl
mov ecx, dword [edx + 0x18]
stc
clc
cmp ecx, dword [ebp - 8]
push 0xffd7a496
push dword [esp]
push ebx
lea esp, [esp + 0xc]
jbe 0xe4e121
cmc
rcr edi, cl
sub ecx, 1
or si, cx
mov dword [ebp - 4], ecx
test dl, 0x48
sal ch, cl
mov ecx, dword [ebp - 8]
movzx si, bl
add ecx, dword [ebp - 4]
bt cx, 6
not di
sar di, cl
shr ecx, 1
cmp edx, ecx
bt ax, ax
bswap di
and di, ax
mov edi, dword [ebx + ecx*4]
mov si, 0xb66c
call int.00e575af
mov ebp, 0xe00876bb
fistp dword [edx]
pop edi
xor byte [edx], 0x96
add byte [edi], bl
xor byte [eax + eax*4], 0xa1
cmp byte [eax], ah
sbb eax, esp
jmp dword [ebx]
push edi
mov dword [ebp - 0x10], ecx
xor cl, 0xf7
shrd cx, ax, cl
shrd cx, bp, 0xa
pop ecx
mov ecx, dword [ebp + 0xc]
pushfd
cmp ecx, 0xffff
lea esp, [esp + 4]
ja 0xe45ee0
jbe 0xe47726
or bh, al
bt si, dx
or bx, si
mov edi, dword [edx + 0x24]
lea ecx, [ecx*2 - 0x7e304db8]
clc
add cx, bx
shr ch, 7
add edi, eax
cmp ah, 0x87
rcl bh, 2
mov ebx, dword [edx + 0x20]
rcr cl, cl
dec cl
rcl cl, 6
sub ch, 0xdf
add ebx, eax
ror cl, cl
shr cl, 3
shld cx, cx, cl
mov dword [ebp - 8], 0
xor cl, al
mov ch, 0x39
bswap cx
mov ecx, dword [edx + 0x18]
call fcn.00e55f03
jns 0xe52ade
imul ebx, dword [edi + esi*4 - 0x11d3e525], 0xffffff8a
bound edx, qword [esp + edx*2 + 0x35ca0f06]
add cl, byte [edi + 9]
aam 0xe4
stosb byte es:[edi], al
scasd eax, dword es:[edi]
jge 0xe52b02
and eax, 0xdd9a05fa
add bh, byte [ecx - 0x1637479f]
or byte [edi + 0x1d15b82a], ch
invalid
cli
add eax, 0xb902dd9a
popal
mov eax, 0xaf08e9c8
sub bh, byte [eax - 0x263be2eb]
add dword [edx], eax
jmp 0xdcbf8971
scasb al, byte es:[edi]
mov cl, 0x8a
xchg edi, eax
scasd eax, dword es:[edi]
dec ebp
jmp loc.00e043b0
cmp ax, 0x1e62
or ebx, ebx
call fcn.00e4b39a
mov byte [esp + 4], bh
push ebp
lea esp, [esp + 0x28]
je 0xe4e121
movsx cx, bl
add edx, eax
sal cl, 4
and ch, 0xaf
add cl, 0x27
mov ecx, dword [esi + 0x7c]
bt bx, bp
add ecx, edx
bt dx, 5
stc
jmp 0xe52a47
mov word [esp], 0x948c
lea esp, [esp + 0x10]
call fcn.00e6046e
push esi
jmp 0xe5f083
lea esp, [esp + 4]
jne 0xe441dc
lahf
pushal
bswap eax
mov ax, sp
mov eax, dword [edx + 8]
push dword [esp]
lea esp, [esp + 0x24]
jmp 0xe55922
Function at 0xe5c802
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xaa2eef4e
lea esp, [esp + 4]
jbe 0xe4e121
rcr esi, cl
shld di, bx, 3
bts di, 0xa
or esi, ebp
sub ecx, 1
rol si, cl
ror si, cl
or di, 0x3eaf
mov dword [ebp - 4], ecx
or ch, 0xc8
mov ecx, dword [ebp - 8]
neg di
bsr di, sp
pushfd
add ecx, dword [ebp - 4]
cmc
bswap si
shrd si, sp, 5
bts si, 6
shr ecx, 1
shrd di, sp, cl
test cl, dl
push dword [esp]
push 0x93a3d81d
mov edi, dword [ebx + ecx*4]
pushal
add edi, eax
jmp 0xe618ae
mov byte [esp], cl
mov dword [esp + 0x2c], eax
call fcn.00e585a1
inc esp
dec esp
adc eax, dword [esi + 0x246e1e66]
lea esp, [esp + 0x2c]
jae 0xe47862
jbe 0xe4e121
movzx si, dl
bsf di, si
rol di, 0xa
call fcn.00e578c8
call fcn.00e541b9
sbb bh, bh
cwde
sbb ebx, ebx
sbb ch, bh
push 0xf21447b0
push 0x4355edb5
sub al, 0x6d
in eax, 0xd0
mov edi, 0x3a17657c
or byte [esp + ebx*4 + 0x56], bl
push ds
push ds
cmp esi, ecx
xor dword [ecx + 0xbb05fbf], esp
or eax, 0x2ba55a50
out 0x43, eax
push 0xfffffffffffffff7
aad 0xe9
or dword [esi], edx
dec esi
jnp 0xe5c7fa
jecxz 0xe5c83f
imul ebp, dword [eax + 0x44637c87], 0xb7400be8
sbb byte [ebp + 0x319e03a3], dh
jae 0xe5c82e
mov byte [esi + 0x6ded9adf], ah
retf
not si
mov esi, dword [ebp + 0xc]
mov byte [esp + 4], 0x45
pushfd
jmp 0xe5a967
Function at 0xe5cf3a
Capabilities:
Encode data using xor

Disassembly:
cmp ebx, 0x8312d3da
cmp al, byte [edi]
cwde
jmp 0xe56174
stc
cmp ah, ch
push 0x39452b22
cmp ecx, dword [ebp - 4]
push eax
lea esp, [esp + 8]
jae 0xe4e121
pushal
jmp 0xe5d57e
call 0xe60f04
rcl dword [ecx - 0x247fdb0d]
sbb dh, byte [esp + ecx*8 - 0x745748f4]
and al, 0x80
fistp dword [edx]
mov ah, 0xcc
or al, 0xb7
test al, 0x8b
dec edi
dec esi
mov ebx, dword [ebx]
xor eax, 0x825da2ad
jl 0xe5617b
lodsb al, byte [esi]
jbe 0xe561c7
push esi
jmp 0xe0636750
mov dword [esi - 0x634c1273], esp
mov al, byte [0x870437c6]
adc ah, dh
push eax
salc
jmp 0xe56223
movsb byte es:[edi], byte [esi]
test dword gs:[0xadde1e65], ebx
hlt
rol al, 7
stc
add esp, 0x54
js 0xe42372
cmp al, byte [edi]
pushal
cwde
lea edi, [edi + 1]
bswap ax
push dword [esp + 4]
mov word [esp], 0x1c84
mov eax, dword [esp + 0x24]
pushfd
pushfd
mov word [esp + 0xc], si
lea esp, [esp + 0x30]
ja 0xe52158
jbe 0xe5dd5e
pushfd
mov byte [esp], dh
lea esp, [esp + 4]
jb 0xe52abe
bt dx, dx
call fcn.00e4281d
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
push ebx
je 0xe5d008
imul ebp, dword [esi + 0x67], 0x68600057
js 0xe5cfa2
insb byte es:[edi], dx
sbb dword [ebp + 0x4c6f845], ecx
and al, 0xd0
inc ebp
clc
mov byte [esp], 0xd0
xchg dword [esp + 0x24], eax
call fcn.00e41db8
cmp edi, esp
xchg edi, eax
enter 0xffffffffffffdb12, 0x1a
pop eax
push 0xffffffffffffffe7
cli
test al, 0x44
xor dword [esi], edi
sbb eax, 0x78a1b0f1
js 0xe5cfaf
invalid
inc esp
fdivrp st(4)
lodsb al, byte [esi]
sbb dl, byte [eax - 0x21232d51]
fcom dword [edx + 0x67]
adc byte [ebx + ebp*8 + 0x273ac4c], al
adc dh, byte [edi + ecx]
sub ah, al
retf 0xe979
push ss
idiv byte [ebp - 0x1e002cdc]
stosb byte es:[edi], al
xchg edx, eax
inc edi
cwde
and byte [ebp + 0x1b], 0x6a
or byte [ebx], 0x2e
and esi, dword [0xf2a57be3]
or dword [ecx - 0x4a], ebp
or dword [ecx - 0x4a], ebp
cmpsd dword [esi], dword es:[edi]
test byte [ebp - 0x2bf45453], dl
dec esi
ja 0xe5d020
push edi
mov bh, 0x28
imul ecx, dword [ecx + 0x24766996], 0xc23e46c6
fdivr st(3)
invalid
add ecx, 1
pushal
mov dword [ebp - 8], ecx
push dword [esp + 4]
push dword [esp]
lea esp, [esp + 0x48]
jmp 0xe630c5
call 0xe52c38
pushfd
pushfd
lea esp, [esp + 8]
je 0xe5ab30
xchg si, di
not si
lea edx, [ebx + 4]
bswap cx
mov ecx, dword [ebp - 8]
shld si, bx, cl
sal di, 1
stc
pushfd
add ecx, dword [ebp - 4]
shld si, si, 9
sub si, bx
btc si, 8
call fcn.00e440ca
pop ecx
rcl dword [esi + 0x1adab1c7], 0x57
ja 0xe6315c
dec ebx
xlatb
sti
pop cx
pop ds
int 0xeb
stosd dword es:[edi], eax
outsd dx, dword ss:[esi]
jo 0xe63153
int3
cmp ebx, esi
and ebx, dword [ebx + 0x2d1b6dd0]
mov ebx, 0xced6de01
add esi, ebx
salc
into
sub byte [ebx + 0x7997196d], al
invalid
Function at 0x401230
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push 0
push str._SignCraCK_
push 1
push 2
call fcn.00401290
push str.Enter
push 4
call fcn.00401400
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov esi, 0x7530
push 0
push 0x401150
call edi
push 0xa
call ebx
dec esi
jne 0x401263
push str.Leave
push 4
call fcn.00401400
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x401400
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.004041a0
mov eax, dword [0x40733c]
push ebp
push esi
mov esi, dword [esp + 0x1120]
cmp esi, eax
push edi
jb 0x4015f9
mov eax, dword [esp + 0x1128]
test eax, eax
je 0x4015f9
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
jbe 0x401452
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
push str.GWCLI
shl esi, 4
add esi, 0x407344
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x40]
push 0x800
push eax
call fcn.00401610
mov edx, dword [esp + 0x1150]
lea ecx, [esp + 0x1154]
push ecx
push edx
lea eax, [esp + 0x850]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x858]
push 0x7ff
lea edx, [esp + 0x5c]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x20]
mov byte [esp + 0x81f], 0
push 0x407444
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x24]
push 0x407448
push ecx
call esi
mov al, byte [0x407340]
add esp, 0xc
test al, 1
mov byte [esp + 0x81f], 0
je 0x40153e
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x407340], 2
je 0x4015f9
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push ebp
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4015f9
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebp
push ebp
push esi
call edi
cmp eax, 0x400000
jbe 0x40158f
mov ebp, 1
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x500000
jbe 0x4015af
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0xc]
push 0
push eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x4015f9
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
add esp, 0x1114
ret
Function at 0x401aa0
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401b22
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401b0e
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
je 0x401afc
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401b0e
jmp 0x401adf
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x18]
mov ebp, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret

Function at 0x403550
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x110]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov edx, ecx
push edi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x10], 0
and ecx, 3
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push str.ProgramFiles
call esi
call fcn.004019b0
test eax, eax
je 0x4035da
mov al, byte [esp + 0x120]
test al, al
je 0x4035da
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push str.ProgramFiles_x86_
call esi
lea edx, [esp + 0x10]
push edx
push str._sGatewaySSLVPN
push ebx
push ebp
call fcn.00401610
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x403860
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea edx, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4038a1
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
mov dword [ecx], edx
add esp, 8
ret 8
Function at 0x403a60
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
lea ecx, [esp + 8]
push ebx
push ebp
push esi
push edi
call fcn.004036d0
mov edi, dword [esp + 0x13c]
mov esi, 0x10008
test edi, edi
je 0x403a88
mov esi, 0x10108
mov ebx, dword [esp + 0x138]
test ebx, ebx
jne 0x403aac
lea ecx, [esp + 0x18]
call fcn.004036e0
pop edi
pop esi
pop ebp
mov eax, 0x3f2
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x134]
push edi
push ebx
push ebp
call fcn.00403b90
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403b6f
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x40]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x403b28
test esi, esi
jne 0x403b64
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push edi
push ecx
push edx
call fcn.00403a60
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403ad8
jmp 0x403b64
lea ecx, [esp + 0x24]
call fcn.004036d0
push edi
push ebx
push ebp
call fcn.00403b90
add esp, 0xc
test edi, edi
je 0x403b51
push edi
push ebx
push ebp
call fcn.004039f0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403b5b
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0x24]
call fcn.004036e0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.004036e0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x408510
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x614
lea eax, [esp + 0x114]
push ebx
push esi
mov esi, dword [esp + 0x620]
push 0xff
mov ebx, ecx
push eax
push 2
push esi
mov dword [ebx + 0x15d0], esi
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
push esi
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
lea ecx, [esp + 0x13c]
push 0xcc0000
push ecx
push str.ShockwaveFlash
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x40857d
pop esi
pop ebx
add esp, 0x614
ret 0xc
push edi
push 1
push esi
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
push esi
mov ecx, ebx
mov dword [ebx + 0x15e4], esi
call fcn.0040a7e0
mov edx, dword [esp + 0x62c]
test edx, edx
je 0x4085bf
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4085bf
mov ecx, dword [0x43cb50]
push edx
call fcn.0040b4e0
jmp 0x408704
lea edx, [esp + 0x1c]
push 0x104
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
lea eax, [esp + 0x30]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x408704
push ebp
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, eax
push 0
push 0
lea ecx, [esi - 8]
push ecx
push edi
call ebp
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x20]
push 8
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [esp + 0x14], 8
jne 0x4086fc
cmp dword [esp + 0x18], 0xfa123456
jne 0x4086fc
mov edx, dword [esp + 0x1c]
push 0
sub esi, edx
push 0
sub esi, 8
mov dword [ebx + 0x15e8], 1
push esi
push edi
call ebp
push 0
push 0
mov ecx, ebx
call fcn.0041fb30
mov ebp, eax
test ebp, ebp
je 0x4086fc
lea ecx, [esp + 0x20]
push ecx
call fcn.0040bf20
push eax
mov dword [ebx + 0x15cc], eax
call fcn.0041ed00
mov dword [ebp + 0x94], eax
mov esi, dword [esp + 0x24]
add esp, 8
mov dword [esp + 0x10], 0
cmp esi, 0x400
jbe 0x4086b6
mov eax, 0x400
jmp 0x4086bc
test esi, esi
mov eax, esi
je 0x4086f5
lea edx, [esp + 0x10]
push 0
push edx
push eax
lea eax, [esp + 0x230]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4086f5
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x224]
push eax
push ecx
mov ecx, ebp
sub esi, eax
call fcn.0041e680
mov eax, dword [esp + 0x10]
test eax, eax
ja 0x4086a7
mov ecx, ebp
call fcn.0041e4e0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov ecx, dword [0x43cb50]
call fcn.004092d0
mov edx, dword [esp + 0x628]
mov eax, dword [ebx + 0x15e4]
push edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebx + 0x15e4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x614
ret 0xc
Function at 0x409490
Capabilities:
Create process on windows

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
push str.FSCommand:
push edi
call fcn.0041ec50
mov esi, eax
add esp, 8
test esi, esi
je 0x409643
push str.quit
push esi
call fcn.0041ec90
add esp, 8
test eax, eax
je 0x4094d7
mov eax, dword [0x43cb50]
mov ecx, dword [eax + 0x15d4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
pop edi
pop esi
pop ebp
ret
push str.fullscreen
push esi
call fcn.0041ec90
add esp, 8
test eax, eax
je 0x409506
mov edx, dword [esp + 0x18]
push edx
call fcn.00409670
mov ecx, dword [0x43cb50]
add esp, 4
push eax
call fcn.00408dc0
pop edi
pop esi
pop ebp
ret
push str.allowscale
push esi
call fcn.0041ec90
add esp, 8
test eax, eax
je 0x409543
mov eax, dword [esp + 0x18]
push eax
call fcn.00409670
mov ecx, dword [esp + 0x14]
add esp, 4
neg eax
sbb eax, eax
push 2
and al, 0xfd
add eax, 3
mov dword [ecx + 0x14b4], eax
call fcn.0041ff40
pop edi
pop esi
pop ebp
ret
push str.exec
push esi
call fcn.0041ec90
add esp, 8
test eax, eax
je 0x4095b3
mov ebp, dword [esp + 0x18]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
inc esi
push esi
call fcn.00406d10
mov edi, eax
add esp, 4
test edi, edi
je 0x40966a
push ebx
xor ebx, ebx
test esi, esi
jle 0x40959c
mov edx, ebp
sub edx, edi
mov cl, byte [edx + eax]
cmp cl, 0
mov byte [eax], cl
je 0x409598
inc ebx
inc eax
cmp ebx, esi
jl 0x409586
jmp 0x40959c
mov byte [ebx + edi], 0
push 5
push edi
call dword [sym.imp.KERNEL32.dll_WinExec]
push edi
call fcn.00406d20
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
ret
push str.showmenu
push esi
call fcn.0041ec90
add esp, 8
test eax, eax
je 0x40966a
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
push ecx
call fcn.00409670
mov dword [esi + 0x14a0], eax
mov edx, dword [0x43cb50]
add esp, 4
mov eax, dword [edx + 0x15e4]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov ecx, dword [esi + 0x14a0]
test ecx, ecx
jne 0x409626
test eax, eax
je 0x40966a
mov ecx, dword [0x43cb50]
push 0
mov dword [ecx + 0x1618], eax
mov edx, dword [0x43cb50]
mov eax, dword [edx + 0x15e4]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
pop edi
pop esi
pop ebp
ret
mov eax, dword [0x43cb50]
mov ecx, dword [eax + 0x1618]
mov edx, dword [eax + 0x15e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_SetMenu]
pop edi
pop esi
pop ebp
ret
mov eax, dword [esp + 0x10]
push edi
mov ecx, dword [eax + 0x15cc]
push ecx
call fcn.0040b590
mov edx, dword [esp + 0x24]
mov esi, eax
push edx
push esi
call fcn.0040a540
push esi
call fcn.0041ecf0
add esp, 0x14
pop edi
pop esi
pop ebp
ret
Function at 0x4b7901
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x4b7941
mov cl, byte [ebp + 0x14]
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
mov byte [edx + eax], cl
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x4b7913
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4b7947
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor eax, eax
cmp eax, dword [ebp + 0x10]
jge 0x4b7984
mov ecx, esi
add cl, al
xor byte [edx + eax], cl
mov cl, byte [edx + eax]
and cl, 0xf
xor ebx, ebx
mov bl, byte [edx + eax]
sar ebx, 4
and bl, 0xf
xor bl, cl
shl ebx, 4
or cl, bl
xor cl, byte [ebp + 0x14]
mov byte [edx + eax], cl
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x4b7959
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret