joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422a9f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x485c40]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x422adf
cmp byte [ebx], 0xa
jne 0x422adf
or byte [eax + edi + 0x28], 4
jmp 0x422ae4
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x422be2
mov al, byte [edx]
cmp al, 0x1a
je 0x422bc4
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x422b13
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x422b38
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x422b42
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x422af5
jmp 0x422be2
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422bbf
cmp dword [ebp - 0xc], 0
je 0x422bbf
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x485c40]
test byte [eax + edi + 0x28], 0x48
je 0x422b99
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x422b84
mov byte [esi], dl
jmp 0x422b95
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x485c40]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x422be2
cmp byte [ebp - 1], 0xa
jne 0x422ba8
cmp esi, ebx
jne 0x422ba8
mov byte [esi], 0xa
jmp 0x422be1
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042361f
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x422be2
mov byte [esi], 0xd
jmp 0x422be1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x485c40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x422bde
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x422be2
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x422beb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x485c40]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x422c2e
cmp word [esi], dx
jne 0x422c2e
or byte [edi + eax + 0x28], 4
jmp 0x422c33
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x422d86
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x422d66
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x422c75
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x422cab
cmp eax, edx
jae 0x422cb7
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x422c4d
jmp 0x422d86
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x422d62
cmp dword [ebp - 0x14], 0
je 0x422d62
mov eax, dword [ebx*4 + 0x485c40]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x422d3a
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x422d03
mov word [esi], cx
jmp 0x422d36
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x485c40]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x485c40]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x485c40]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x422d86
pop ebx
cmp word [ebp - 4], bx
jne 0x422d4b
cmp esi, dword [ebp + 0xc]
jne 0x422d4b
mov word [esi], bx
jmp 0x422d83
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0042361f
add esp, 0x10
cmp word [ebp - 4], bx
je 0x422d86
push 0xd
jmp 0x422d7f
mov ecx, dword [ebx*4 + 0x485c40]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x422d7d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x422d86
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x429a40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x429a6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x429a6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push 0x408420
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x408400
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4083d4
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.kernel32.dll_GetStdHandle]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x15840b95
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x66dc5ca7
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401a8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c0d0]
jne 0x401a96
repz ret
jmp fcn.00402bc6

Function at 0x40f895
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403616
and dword [ebp - 4], 0
cmp dword [0x42e2fc], 0
mov ebx, eax
jne 0x40f946
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40f9f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40f9f7
push eax
call fcn.004035a4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e2fc], eax
call esi
push eax
call fcn.004035a4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e300], eax
call esi
push eax
call fcn.004035a4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e304], eax
call esi
push eax
call fcn.004035a4
pop ecx
mov dword [0x42e30c], eax
test eax, eax
je 0x40f946
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035a4
pop ecx
mov dword [0x42e308], eax
mov eax, dword [0x42e308]
cmp eax, ebx
je 0x40f99e
cmp dword [0x42e30c], ebx
je 0x40f99e
push eax
call fcn.0040361f
push dword [0x42e30c]
mov esi, eax
call fcn.0040361f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f99e
test edi, edi
je 0x40f99e
call esi
test eax, eax
je 0x40f995
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f995
test byte [ebp - 0xc], 1
jne 0x40f99e
or dword [ebp + 0x10], 0x200000
jmp 0x40f9d7
mov eax, dword [0x42e300]
cmp eax, ebx
je 0x40f9d7
push eax
call fcn.0040361f
pop ecx
test eax, eax
je 0x40f9d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9d7
mov eax, dword [0x42e304]
cmp eax, ebx
je 0x40f9d7
push eax
call fcn.0040361f
pop ecx
test eax, eax
je 0x40f9d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e2fc]
call fcn.0040361f
pop ecx
test eax, eax
je 0x40f9f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40f9f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x425ffb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp esi, 0x5026c
jne 0x426098
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
push 0x42e3e0
mov byte [0x42e3e0], 0x6b
mov byte [0x42e3e1], 0x65
mov byte [0x42e3e2], 0x72
mov byte [0x42e3e3], 0x6e
mov byte [0x42e3e4], 0x65
mov byte [0x42e3e5], 0x6c
mov byte [0x42e3e6], 0x33
mov byte [0x42e3e7], 0x32
mov byte [0x42e3e8], 0x2e
mov byte [0x42e3e9], 0x64
mov byte [0x42e3ea], 0x6c
mov byte [0x42e3eb], 0x6c
mov byte [0x42e3ec], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x42e7a4]
push dword [0x42e6ec]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x36edcb
jl 0x426003
pop esi
leave
ret
Function at 0x426272
Capabilities:
Clear file content
Create pipe
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x42e7a4]
push ebx
mov ebx, dword [0x42e6ec]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp eax, 0x5dd
jne 0x426298
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.0042619c
cmp dword [0x42e7a4], 0x2f
pop ecx
jne 0x4262f3
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
push ebx
mov ebx, dword [ebp - 0x10]
call fcn.004261e6
cmp dword [0x42e7a4], 0x568
pop ecx
jne 0x426310
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
pop esi
pop ebx
leave
ret
Function at 0x4266d8
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x42c0d0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x42e7a4], 0xbf9
jne 0x426708
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [0x42e7a4], 0x3dc
mov dword [0x42e798], 0x8e55ceaa
jne 0x426733
push esi
push str.sutejoyuvefejavasayoz_kuradahehihugas
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x4266f5
cmp esi, 0x8465cd
jne 0x42674d
mov eax, dword [0x42d780]
add eax, 0xa231
mov dword [0x42e7a4], eax
cmp dword [0x42e7a4], 0x141
jne 0x42677a
push str.gacepelorawagemuyutajewelaxizebu_hiyupehiliyi_toxayekuxo_ziyapemiket_siwiyorosahasopisuzofuwuxuv
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
or dword [0x42e46c], 0xffffffff
mov dword [0x42e468], 0xec58acac
inc esi
cmp esi, 0x125483c
jl 0x426736
call fcn.00426314
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401a8c
add esp, 0x804
ret 0x10
Function at 0x72e1c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x72e2e8
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.0072e0ac
mov eax, dword [esi]
call fcn.0040a34c
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41b688]
call fcn.0040a500
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.00404980
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.00404980
add ebx, 0x1c
mov eax, dword [esi]
call fcn.0040a34c
mov dword [ebp - 0xc], eax
mov eax, dword [0x755e28]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.006e764c
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00405454
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.0040a34c
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.006e7628
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x98]
mov ebx, eax
mov eax, ebx
call fcn.006e7624
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.006e7644
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72e2ef
lea eax, [ebp - 4]
mov edx, dword [0x41b688]
call fcn.0040a50c
ret

Function at 0x733af8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
xor eax, eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], eax
xor eax, eax
push ebp
push 0x733ba9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x54]
xor ecx, ecx
mov edx, 0x44
call fcn.00405454
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
push 0x733bc0
lea edx, [ebp - 0x5c]
xor eax, eax
call fcn.00404b9c
push dword [ebp - 0x5c]
push 0x733bd0
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00409190
mov eax, dword [ebp - 0x58]
call fcn.00408e9c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x733b8e
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x733bb0
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407fc8
ret
Function at 0x735380
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffca8
xor eax, eax
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x34c], eax
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x354], eax
mov dword [ebp - 0x344], eax
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x73560b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.006215c4
mov eax, dword [ebp - 4]
call fcn.00423060
lea ecx, [ebp - 0x338]
mov edx, 0x735624
mov eax, dword [ebp - 4]
call fcn.0042319c
mov edx, dword [ebp - 0x338]
lea eax, [ebp - 4]
call fcn.00408390
xor ecx, ecx
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x2e0]
call fcn.00405194
call fcn.00404880
lea eax, [ebp - 0x2e0]
call fcn.00404de0
call fcn.00404880
mov edx, 0x73563c
lea eax, [ebp - 0x2e0]
call fcn.00405b74
call fcn.00405dd8
call fcn.00404880
push 0x735654
lea edx, [ebp - 0x340]
xor eax, eax
call fcn.00404b9c
push dword [ebp - 0x340]
push 0x73566c
lea eax, [ebp - 0x33c]
mov edx, 3
call fcn.00409190
mov edx, dword [ebp - 0x33c]
lea eax, [ebp - 0x2e0]
call fcn.00405b74
call fcn.00405dd8
call fcn.00404880
push 0x73567c
lea edx, [ebp - 0x348]
xor eax, eax
call fcn.00404b9c
push dword [ebp - 0x348]
push 0x73566c
push 0x7356a0
lea eax, [ebp - 0x344]
mov edx, 4
call fcn.00409190
mov edx, dword [ebp - 0x344]
lea eax, [ebp - 0x2e0]
call fcn.00405b74
call fcn.00405dd8
call fcn.00404880
push 0x7356c0
lea edx, [ebp - 0x354]
xor eax, eax
call fcn.00404b9c
mov eax, dword [ebp - 0x354]
lea edx, [ebp - 0x350]
call fcn.00423238
push dword [ebp - 0x350]
push 0x73566c
lea eax, [ebp - 0x34c]
mov edx, 3
call fcn.00409190
mov edx, dword [ebp - 0x34c]
lea eax, [ebp - 0x2e0]
call fcn.00405b74
call fcn.00405dd8
call fcn.00404880
mov edx, 0x7356e4
lea eax, [ebp - 0x2e0]
call fcn.00405b74
call fcn.00405dd8
call fcn.00404880
lea eax, [ebp - 0x2e0]
call fcn.00405344
call fcn.00404880
lea eax, [ebp - 0x334]
xor ecx, ecx
mov edx, 0x44
call fcn.00405454
mov dword [ebp - 0x308], 1
mov word [ebp - 0x304], 0
lea eax, [ebp - 0x2f0]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
push 0x73566c
push dword [ebp - 4]
push 0x73566c
lea eax, [ebp - 0x358]
mov edx, 3
call fcn.00409190
mov eax, dword [ebp - 0x358]
call fcn.00408e9c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x7355e5
mov eax, dword [ebp - 0x2ec]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x2f0]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x735612
lea eax, [ebp - 0x358]
mov edx, 9
call fcn.00407fc8
lea eax, [ebp - 4]
call fcn.00407f68
ret
Function at 0x7358a8
Capabilities:
Create process on windows
Terminate process

Disassembly:
add esp, 0xffffffac
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x44
call fcn.00405454
mov dword [esp + 0x3c], 1
mov word [esp + 0x40], 1
mov eax, dword [0x755b6c]
mov eax, dword [eax]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
push esp
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [0x75f75c]
call fcn.00408e9c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x735912
mov eax, dword [esp + 4]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [esp]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
call fcn.00735380
push 0
call sub.KERNEL32.DLL_ExitProcess_1
add esp, 0x54
ret

Function at 0x735924
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040804c
xor eax, eax
push ebp
push 0x735aad
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
xor edx, edx
mov eax, 2
call fcn.007347d0
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.007347f0
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x735a79
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00408f58
mov eax, dword [ebp - 0x23c]
lea edx, [ebp - 0x238]
call fcn.00423390
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.004214e0
mov eax, dword [ebp - 0x234]
push eax
lea edx, [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.004214e0
mov edx, dword [ebp - 0x240]
pop eax
call fcn.004092a0
je 0x735a4c
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
mov ecx, 0x104
call fcn.00408f58
mov eax, dword [ebp - 0x248]
lea edx, [ebp - 0x244]
call fcn.004214e0
mov eax, dword [ebp - 0x244]
push eax
lea edx, [ebp - 0x24c]
mov eax, dword [ebp - 4]
call fcn.004214e0
mov edx, dword [ebp - 0x24c]
pop eax
call fcn.004092a0
jne 0x735a66
push 0
mov eax, dword [ebp - 0x228]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
push eax
call sub.KERNEL32.DLL_TerminateProcess
mov edi, eax
lea edx, [ebp - 0x230]
mov eax, esi
call fcn.00734810
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x7359a7
push esi
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x735ab4
lea eax, [ebp - 0x24c]
mov edx, 7
call fcn.00407fc8
lea eax, [ebp - 4]
call fcn.00407f68
ret
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004016ae
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219