joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d00e0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
push ebx
mov dword [ebp - 4], eax
cmp dword [eax + 0x28], 0
je 0x4d0128
mov eax, dword [0x5891d0]
mov edx, dword [ebp - 4]
mov eax, dword [eax + 0x168]
cmp eax, dword [edx + 0x28]
jne 0x4d0128
mov eax, dword [0x5891d0]
cmp byte [eax + 0x114], 0
jne 0x4d0128
mov eax, dword [0x5895a0]
mov edx, dword [0x5895a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov ebx, dword [ebp - 4]
mov eax, dword [0x5895a0]
mov edx, dword [0x5895a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
cmp eax, dword [ebx + 4]
jne 0x4d021e
mov eax, dword [0x5891d0]
cmp byte [eax + 0x114], 0
jne 0x4d021e
mov eax, dword [0x5895a0]
mov edx, dword [0x5895a0]
mov edx, dword [edx]
call dword [edx + 0x6c]
call fcn.00543440
mov eax, dword [0x5891d0]
cmp dword [eax + 0x168], 0
je 0x4d01e3
push 0x10
push 0
mov eax, dword [0x5891d0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x25c]
mov eax, dword [0x5891d0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x250]
mov eax, dword [0x5891d0]
mov eax, dword [eax + 0x168]
push dword [eax + 0x130]
push 0
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_SetWindowPos
mov eax, dword [0x5891d0]
mov eax, dword [eax + 0x168]
call fcn.004ee020
test al, al
je 0x4d01e3
push 0
mov eax, dword [0x5891d0]
call fcn.0041f670
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5891d0]
call fcn.00422460
jmp 0x4d02b5
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4d0273
mov eax, dword [ebp - 4]
mov edx, dword [0x5891d0]
mov eax, dword [eax + 0x28]
cmp eax, dword [edx + 0x168]
jne 0x4d0273
mov eax, dword [ebp - 4]
push dword [eax + 0x10]
mov eax, dword [ebp - 4]
push dword [eax + 0xc]
push 0x112
mov eax, dword [ebp - 4]
push dword [eax + 4]
call sub.user32.dll_DefWindowProcA
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x24]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5891d0]
call fcn.00422460
jmp 0x4d02b5
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x4d02b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
test dword [eax + 0x488], 8
je 0x4d02b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
mov dword [eax + 0xc], 1
mov eax, dword [ebp - 4]
mov byte [eax + 0x2c], 0
mov eax, dword [0x5895a0]
mov edx, dword [0x5895a0]
mov edx, dword [edx]
call dword [edx + 0x8c]
pop ebx
leave
ret
Function at 0x4d5100
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0x30], 8
mov eax, fcn.004d3b20
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
call fcn.00413020
mov dword [ebp - 0x20], eax
mov eax, str.MAINICON
push eax
push dword [0x60b2b0]
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x4d5156
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [ebp - 0x1c], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, str.Window
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
cmp byte [ebp - 8], 0
je 0x4d51ce
or dword [ebp - 0x30], 0x800
cmp dword [0x5a0cf0], 6
jb 0x4d51a8
or dword [ebp - 0x30], 0x20000
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], 0
mov eax, str.HintWindow
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x30]
push eax
call sub.user32.dll_RegisterClassW
test ax, ax
setne byte [ebp - 8]
mov al, byte [ebp - 8]
leave
ret

Function at 0x4d6090
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x34]
push ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov byte [ebp - 0xc], 0
mov eax, dword [ebp - 8]
push dword [eax - 8]
call sub.user32.dll_GetClipboardData
mov edx, dword [ebp - 8]
mov dword [edx - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x14], 0
je 0x4d613d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalSize
mov edx, dword [ebp - 8]
mov dword [edx - 0x1c], eax
mov eax, dword [ebp - 8]
cmp dword [eax - 0x1c], 0
jle 0x4d613d
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalLock
mov edx, dword [ebp - 8]
mov dword [edx - 0x18], eax
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x4d611f
mov eax, dword [ebp - 8]
mov edx, dword [eax - 0x18]
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 0x1c]
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
call dword [ebx + 0x84]
call fcn.0040e080
mov eax, dword [ebp - 8]
push dword [eax - 0x14]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d6139
call fcn.0040e1b0
mov byte [ebp - 0xc], 1
mov al, byte [ebp - 0xc]
pop ebx
leave
ret
Function at 0x4d67a0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x78]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov eax, 1
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x20]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x4d690b
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x4d68a6
lea eax, [ebp - 0x40]
call fcn.00403df0
lea eax, [ebp - 0x44]
call fcn.00403df0
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea eax, [ebp - 0x44]
call fcn.0046aef0
mov edx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
call fcn.00408f10
lea eax, [ebp - 0x44]
call fcn.00403df0
lea eax, [ebp - 0x54]
call fcn.00403df0
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x10]
call fcn.0046aea0
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
call fcn.00408f10
call fcn.0046b4e0
mov ebx, eax
mov eax, str._DataSize
push eax
push dword [ebp - 0x40]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x44]
mov edx, str.TWin32WidgetSet.ClipboardGetOwnerShip_DataHandle
mov eax, ebx
call fcn.0046c970
mov eax, dword [ebp - 0xc]
mov byte [eax - 0x10], 0
jmp 0x4d690b
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x14], eax
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x4d68e9
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x70]
mov ecx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ebx, dword [ebx]
call dword [ebx + pe_nt_image_headers32]
call fcn.0040e080
push dword [ebp - 0x10]
call sub.kernel32.dll_GlobalUnlock
pop eax
test eax, eax
je 0x4d6900
call fcn.0040e1b0
push dword [ebp - 0x10]
push dword [ebp - 4]
call sub.user32.dll_SetClipboardData
call fcn.0040e080
lea eax, [ebp - 0x54]
call fcn.00403df0
lea eax, [ebp - 0x44]
call fcn.00403df0
lea eax, [ebp - 0x40]
call fcn.00403df0
pop eax
test eax, eax
je 0x4d6932
call fcn.0040e1b0
pop ebx
leave
ret
Function at 0x528fa0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov ebx, edx
mov esi, ecx
cmp ebx, esi
jl 0x52900b
sub esi, 1
lea esi, [esi]
add esi, 1
push dword [ebp - 8]
push esi
mov ecx, esi
mov eax, ecx
sar eax, 0x1f
mov edx, eax
mov eax, ecx
xor eax, edx
sub eax, edx
and eax, 0x1f
mov ecx, edx
xor ecx, eax
mov eax, ecx
sub eax, edx
mov edx, eax
mov eax, dword [ebp - 4]
push dword [eax + edx*4]
push edi
mov ecx, esi
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00528540
cmp ebx, esi
jg 0x528fd0
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x543820
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x3c], 0
mov eax, 1
lea edx, [ebp - 0x34]
lea ecx, [ebp - 0x1c]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x5438b1
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextLengthW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040ad30
cmp dword [ebp - 0xc], 0
jbe 0x543890
mov eax, dword [ebp - 0xc]
add eax, 1
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x543884
mov eax, 0x60b2e0
push eax
push dword [ebp - 4]
call sub.user32.dll_GetWindowTextW
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
call fcn.0040ad30
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
call fcn.0040b5c0
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 8]
call fcn.0042b220
call fcn.0040e080
lea eax, [ebp - 0x3c]
call fcn.0040b3a0
lea eax, [ebp - 0x10]
call fcn.0040a670
pop eax
test eax, eax
je 0x5438d0
call fcn.0040e1b0
leave
ret
Function at 0x55f8a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
test eax, eax
je 0x55f8c7
sub eax, 1
je 0x55f8ce
sub eax, 1
je 0x55f8d5
sub eax, 1
je 0x55f8e3
sub eax, 1
je 0x55f8dc
jmp 0x55f8e8
mov eax, 0
jmp 0x55f8e8
mov eax, 1
jmp 0x55f8e8
mov eax, 2
jmp 0x55f8e8
mov eax, 4
jmp 0x55f8e8
mov eax, 3
test edx, edx
jne 0x55f8f1
mov edx, 0x60b2e0
push esi
push ecx
push eax
push 0
push edx
push dword [ebx + 0x14]
call sub.advapi32.dll_RegSetValueExA
mov dword [ebx + 4], eax
test eax, eax
sete al
pop esi
pop ebx
leave
ret 8

Function at 0x560960
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x15c]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x15c], 0
mov eax, 1
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x13c]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x560a6d
mov eax, dword [ebp - 4]
mov edx, 0
call fcn.00408f10
lea eax, [ebp - 0x2c]
mov edx, 0x28
call fcn.0055fbd0
lea eax, [ebp - 0x2c]
push eax
push 0x28
call sub.user32.dll_GetKeyboardLayoutList
lea ebx, [eax - 1]
mov dword [ebp - 0x130], 0
cmp ebx, dword [ebp - 0x130]
jl 0x560a6d
sub dword [ebp - 0x130], 1
lea esi, [esi]
add dword [ebp - 0x130], 1
push 0x100
lea eax, [ebp - 0x12c]
push eax
push 2
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp + eax*4 - 0x2c]
call fcn.00452a50
and eax, 0xffff
push eax
call sub.kernel32.dll_GetLocaleInfoA
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x560a2f
push 0
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp - 4]
mov ecx, 0x5fe5c4
call fcn.00409010
push 0
push 1
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x12c]
mov cx, 0
mov edx, 0xff
call fcn.004098d0
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, dword [ebp - 4]
call fcn.00409010
cmp ebx, dword [ebp - 0x130]
jg 0x5609e4
call fcn.0040e080
lea eax, [ebp - 0x15c]
call fcn.00403df0
pop eax
test eax, eax
je 0x560a87
call fcn.0040e1b0
pop ebx
leave
ret
Function at 0x5647b0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x3c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x564885
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00442d00
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0xc]
call fcn.00408f10
mov edx, dword [ebp - 0xc]
mov eax, str._UNC_
call fcn.0044dc90
test al, al
je 0x564828
lea eax, [ebp - 0xc]
mov ecx, 8
mov edx, 1
call fcn.0040a120
jmp 0x56484b
mov edx, dword [ebp - 0xc]
mov eax, 0x5ff6a8
call fcn.0044dc90
test al, al
je 0x56484b
lea eax, [ebp - 0xc]
mov ecx, 4
mov edx, 1
call fcn.0040a120
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.004420a0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00442de0
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0xc]
call fcn.00408f10
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x564878
mov eax, 0x60b2e0
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete byte [ebp - 8]
call fcn.0040e080
lea eax, [ebp - 0x3c]
call fcn.00403df0
lea eax, [ebp - 0x38]
call fcn.00403df0
lea eax, [ebp - 0xc]
call fcn.00403df0
pop eax
test eax, eax
je 0x5648ac
call fcn.0040e1b0
mov al, byte [ebp - 8]
leave
ret

Function at 0x565a10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0x14], 0
cmp eax, dword [ebp - 0x14]
jl 0x565a79
sub dword [ebp - 0x14], 1
add dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x10]
mov cl, byte [ebp - 0x18]
mov dl, byte [edx]
xor dl, cl
and edx, 0xff
mov ecx, dword [ebp - 0x18]
shr ecx, 8
and ecx, 0xffffff
mov edx, dword [edx*4 + 0x5a2d80]
xor ecx, edx
mov dword [ebp - 0x18], ecx
add dword [ebp - 0x10], 1
cmp eax, dword [ebp - 0x14]
jg 0x565a44
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
leave
ret

Function at 0x566190
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
mov dword [ebp - 8], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040de00
call fcn.0040fa10
push eax
test eax, eax
jne 0x56620b
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x5a31b0
call sub.advapi32.dll_AllocateAndInitializeSid
or eax, eax
setne al
mov byte [ebp - 0x38], al
call fcn.00441bf0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0
call sub.advapi32.dll_CheckTokenMembership
test eax, eax
je 0x566207
mov eax, dword [ebp - 0xc]
or eax, eax
setne al
mov byte [ebp - 4], al
jmp 0x56620b
mov byte [ebp - 4], 0
call fcn.0040e080
cmp dword [ebp - 8], 0
je 0x56621e
push dword [ebp - 8]
call sub.advapi32.dll_FreeSid
pop eax
test eax, eax
je 0x566228
call fcn.0040e1b0
mov al, byte [ebp - 4]
leave
ret
Function at 0x5707d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0x10], 0
cmp eax, dword [ebp - 0x10]
jl 0x570833
sub dword [ebp - 0x10], 1
add dword [ebp - 0x10], 1
mov edx, dword [ebp - 0x18]
mov cl, byte [ebp - 0x14]
mov dl, byte [edx]
xor dl, cl
and edx, 0xff
mov ecx, dword [ebp - 0x14]
shr ecx, 8
mov edx, dword [edx*4 + 0x5a2d80]
xor ecx, edx
mov dword [ebp - 0x14], ecx
add dword [ebp - 0x18], 1
cmp eax, dword [ebp - 0x10]
jg 0x570804
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
leave
ret

Function at 0x57e5a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
lea ebx, [eax - 1]
mov dword [ebp - 0x10], 0
cmp ebx, dword [ebp - 0x10]
jl 0x57e651
sub dword [ebp - 0x10], 1
add dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x1c]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x14], eax
xor eax, 1
mov edx, dword [ebp - 0x14]
imul edx, eax
shr edx, 8
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
xor eax, edx
mov edx, dword [ebp - 0x18]
mov byte [edx], al
mov eax, dword [ebp - 0x18]
mov al, byte [eax]
mov edx, dword [ebp - 0x24]
call fcn.00565a90
mov dword [ebp - 0x24], eax
and eax, 0xff
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
imul eax, eax, 0x8088405
add eax, 1
mov dword [ebp - 0x20], eax
shr eax, 0x18
mov edx, dword [ebp - 0x1c]
call fcn.00565a90
mov dword [ebp - 0x1c], eax
add dword [ebp - 0x18], 1
cmp ebx, dword [ebp - 0x10]
jg 0x57e5e8
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x24]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x10], edx
pop ebx
leave
ret
Function at 0x57e670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.0057e750
mov dword [ebp - 0x14], 0
sub dword [ebp - 0x14], 1
mov esi, esi
add dword [ebp - 0x14], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
and eax, 0xffff
or eax, 2
mov dword [ebp - 0x18], eax
xor eax, 1
mov edx, dword [ebp - 0x18]
imul edx, eax
shr edx, 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
movzx eax, byte [ecx + eax]
xor eax, edx
mov edx, dword [ebp - 0x14]
mov byte [ebp + edx - 0x24], al
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x14]
mov al, byte [ebp + eax - 0x24]
call fcn.00565a90
mov edx, dword [ebp - 0xc]
mov dword [edx + 8], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
and eax, 0xff
mov edx, dword [ebp - 0xc]
add eax, dword [edx + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
imul eax, eax, 0x8088405
add eax, 1
mov edx, dword [ebp - 0xc]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
shr eax, 0x18
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 0x10]
call fcn.00565a90
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
cmp dword [ebp - 0x14], 0xb
jl 0x57e698
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 0x19]
sete byte [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov dl, byte [ebp - 0x10]
mov byte [eax + 4], dl
mov al, byte [ebp - 0x10]
leave
ret 4
Function at 0x40a260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c4d3
mov eax, dword fs:[0]
push eax
sub esp, 0x110
mov eax, dword [0x439080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
xorps xmm0, xmm0
mov dword [esi], 0
xor eax, eax
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 7
mov word [esi + 4], ax
push esi
push 0xf003f
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
push 0x80000002
mov dword [ebp - 0x40], 0x4f0053
mov dword [ebp - 0x3c], 0x540046
mov dword [ebp - 0x38], 0x410057
mov dword [ebp - 0x34], 0x450052
mov dword [ebp - 0x30], 0x41005c
mov dword [ebp - 0x2c], 0x4c004f
mov dword [ebp - 0x28], 0x41005c
mov dword [ebp - 0x24], 0x4c004f
mov dword [ebp - 0x20], 0x530020
mov dword [ebp - 0x1c], 0x690068
mov dword [ebp - 0x18], 0x6c0065
mov dword [ebp - 0x14], 0x64
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x40a346
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f010
mov esp, ebp
pop ebp
ret
push 1
lea ecx, [ebp - 0x11c]
call fcn.00403120
lea eax, [ebp - 0x10c]
mov byte [ebp - 4], 1
push str.AOLSBREG::AOLSBREG___RegOpenKeyEx_Failed
push eax
call fcn.00401250
add esp, 8
mov ecx, eax
push edi
call fcn.0040a410
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x11c]
call fcn.004090e0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00405e50
push eax
lea ecx, [ebp - 0x6c]
call fcn.00403840
push 0x437418
lea eax, [ebp - 0x6c]
push eax
call fcn.0041021e
int3
Function at 0x40ca20
Capabilities:
Check mutex on windows
Get file attributes

Disassembly:
push ecx
push ebx
push esi
mov ebx, ecx
push edi
push str.AOLSB_update_running_version
mov dword [esp + 0x10], ebx
push dword [ebx]
call fcn.00401870
push eax
call fcn.00402380
mov edi, dword [sym.imp.KERNEL32.dll_OpenMutexW]
add esp, 0xc
push dword [0x439008]
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
je 0x40caa2
push ebp
push str.We_got_a_handle_to_the_mutex___wait_for_aolsb_to_exit
push dword [ebx]
call fcn.004014f0
push eax
call fcn.00402380
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
push 0xffffffffffffffff
push esi
call ebx
push esi
call ebp
push dword [0x439008]
push 0
push 0x100000
call edi
mov esi, eax
test esi, esi
jne 0x40ca80
mov ebx, dword [esp + 0x10]
pop ebp
pop edi
pop esi
mov ecx, ebx
pop ebx
add esp, 4
jmp fcn.0040d0a0
Function at 0x40eaaa
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40eacb
jl 0x40eac2
test edi, edi
jne 0x40eacb
xor eax, eax
xor edx, edx
jmp 0x40eb8c
cmp dword [ebx + 0x38], 0
je 0x40eae0
push eax
push edi
push dword [ebp + 8]
call fcn.00409750
jmp 0x40eb8c
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40eb27
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40eb27
cmp eax, edi
jb 0x40eb01
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00410640
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40eb2d
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40eb81
mov ecx, ebx
call fcn.0040e430
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40eb6c
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00418250
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40eb81
jmp 0x40eb3f
test edx, edx
je 0x40eb81
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00418250
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40fd25
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40fd64
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40fd64
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40fd64
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40fd64
cmp dword [ecx + 0x74], 0xe
jbe 0x40fd64
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret