joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ca26e
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x5ca2bc
mov bl, 0xf2
sub edx, dword [eax + 0x47]
sub dword [esi + edx*2 - 0x6f], 0xed8b9193
je 0x5ca2ab
cmp al, 0x2d
aad 0x2d
call 0x47531611
out 0x2a, al
pop edi
xor byte [0x8c62ed01], cl
invalid
ljmp 0x64c7:0x78af2241
fsubr dword [edi]
mov ebx, 0x4accc7e1
pop edx
inc eax
cmp eax, 0x40e68fdd
div esp
adc al, 0x8c
and al, 0xf4
or al, 0x52
pop esp
fiadd word cs:[esp + edi*2 - 0x423636cc]
insd dword es:[edi], dx
or eax, 0xb4d72465
out dx, al
fucomp st(0)
inc esp
rcl dword [esi + 0x51], 0x5d
push ebx
in al, dx
insd dword es:[edi], dx
cmc
mov eax, 0x28416eba
loope 0x5ca359
sub cl, ah
and al, 0x95
and al, 0x95
push es
das
mov ah, 9
imul ebx, dword [ebp + 0x30], 0x14bc3be4
int3
inc ebx
aam 0xf6
dec esp
push 0x75ed8807
xor al, 0xb3
jae 0x5ca2f2
rcl dword [ecx - 0x18]
int 0x9d
mov ecx, 0xc7083e90
push ecx
call 0x91164102
or bh, al
imul eax, dword [eax + ecx - 0x14], 0x80ecdbc9
int1
lcall 0xd5ec, 0xbfc44bfc
jo 0x5ca2e6
pop edi
jp 0x5ca321
in eax, dx
sbb eax, dword [edi + eax - 0x1d5634a8]
xor esp, esp
mov ss, word [edi]
cdq
pop ebx
test dword [eax], 0xbd64265f
kxnorb k1, k2, k0
sahf
push ecx
jno 0x5ca39e
xor eax, 0xfecd6044
outsd dx, dword [esi]
loopne 0x5ca32f
aad 0xda
test byte [edi], 0xbc
pop ebx
push es
enter 0x249d, 0xfffffffffffffff2
push es
dec edi
jg 0x5ca3cb
dec esp
fadd qword [ebx]
jo 0x5ca3ed
pop esp
pop ds
cli
fisttp qword [ecx + eax + 0x462d71d3]
sal byte [ecx + 0x66], 0x32
mov dword [0x8c727b43], eax
jnp 0x5ca417
mov byte [edx + ecx*8], cl
imul edi, dword [ebx], 0x62
invalid
retf 0x3b6b
invalid
outsd dx, dword [esi]
dec eax
wait
invalid
pushfd
mov ch, 0x9c
jno 0x5ca48d
inc esp
insd dword es:[edi], dx
test al, 0xb3
popal
invalid
hlt

Function at 0x5ca8a3
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
sar dword [eax], cl
mov dword [edi - 0x2c], edi
sbb eax, 0x17ff6df4
mov al, bh
cmpsd dword [esi], dword es:[edi]
enter 0xfffffffffffffd34, 0xffffffffffffffda
das
adc ch, byte [eax - 0xc153661]
invalid
sub dword [edi + 0x1f], 0x2060b334
mov byte [0x5ba2640d], al
stosb byte es:[edi], al
sbb dword [ecx], ebx
mov cl, 0x62
inc esp
add eax, 0x7702086b
mov esp, 0x7878cf40
in eax, 0x36
mov byte [esi + edx*2 + 0x248e0fdc], dl
jle 0x468cecd
jle 0x468cecd
xchg esi, eax
mov dword [0x6334186a], eax
lahf
mov esp, 0xa94cad4c
out 0x7d, eax
dec edi
bound ebx, qword [edi + 0x5c]
xor al, 0x3d
jno 0x5ca880
ja 0x5ca842
or eax, 0x276cb598
pop ss
inc dword [eax]
invalid
Function at 0x5fb16d
Capabilities:
Encode data using xor

Disassembly:
int 4
pop eax
mov cl, 0x6d
movsd dword es:[edi], dword [esi]
push edx
arpl word [ebx + 0x4b465f77], cx
insb byte es:[edi], dx
imul edx, dword [ebp + 0x31b85504], 0xf471ffcb
cdq
and eax, 0x528228bc
daa
pop es
iretd
mov dh, 7
inc ebx
aad 0x87
loope 0x5fb1c3
jecxz 0x5fb1a3
int3
dec esi
movsb byte es:[edi], byte [esi]
mov dl, 0xdd
jl 0x5fb114
mov ah, 8
or al, byte [esi - 0x57db4cba]
inc ecx
int 0xce
fstp qword [ebx - 0x6f46fbb3]
pop ebp
bnd jg 0x5fb1de
fist dword [esp + edi*2 - 0x7c]
clc
shr byte [esi - 0xb], cl
test esp, eax
arpl word [edi + ecx*2 - 0x45], si
leave
pop ss
lodsd eax, dword [esi]
jg 0x5fb212
adc al, 0xc3
jo 0x5fb174
aas
test al, 0xa5
mov word [edx + 0x5b], ss
cmpsb byte [esi], byte es:[edi]
in al, dx
fistp dword [edx - 0x314d2a3c]
mov dl, 0xce
adc ebx, dword [ecx]
dec esp
jl 0x5fb166
push ss
test eax, 0xedae6bed
push 0x2831d446
aam 0x31
sub byte [edx], cl
lds edi, [edx + 0x1d48dac0]
xor dword [eax], ebp
or al, ch
mov edx, 0x1d48dac0
or ecx, dword [ebx - 0x26972b04]
xor eax, 0x1c83c382
stosd dword es:[edi], eax
jg 0x5fb1c2
xor eax, 0xde7587fb
aad 0x5c
inc ebp
mov esi, 0xf08f5715
jae 0x5fb1b3
invalid
xchg ebp, eax
or al, 0xf5
sbb ebx, dword [ebp + 0x4f]
add dword [eax - 0x57], eax
xor byte [ecx + esi*2 - 0x52], 0x6d
shr byte [eax - 4], 0x85
xchg byte [eax + ecx*8], bh
cmp al, 0xf2
invalid
lodsd eax, dword [esi]
invalid
Function at 0x656477
Capabilities:
Encode data using xor

Disassembly:
pop ebp
sub al, 0x84
xchg esi, eax
leave
mov byte [0x5caa8a0a], al
mov ecx, 0xb634ada0
mov ebx, 0x71f9f82c
stosd dword es:[edi], eax
xchg edx, eax
mov bh, 0x61
jmp 0xcb29b1e9
sbb byte [di + 0x46], cl
dec ebx
js 0x656497
and dword ss:[eax + 0x77], edi
cmp dword [edi - 0x1799a4d5], edx
shr byte [ebp + 0x7ecf1bd6], 0xaf
je 0x656427
call 0x1c3c124c
iretd
push 0x5836e175
or byte [edi + 0x39c26e18], bh
mov edi, 0x39c26e18
ja 0x6564f7
xchg esp, eax
fdivr dword [ecx]
enter 0x32ed, 0x11
fadd qword [esi]
call [ecx]
stosb byte es:[edi], al
sar byte [eax - 0x79bb213d], cl
clc
outsd dx, dword [esi]
pshufw mm3, qword [ecx + 0x725d8c64], 0x7c
dec edx
jns 0x656506
idiv byte [eax]
in al, 0x99
push ebp
sbb eax, 0xa8e46734
mov cl, dl
cmpsd dword [esi], dword es:[edi]
movsd dword es:[edi], dword [esi]
hlt
aas
jl 0x656487
sbb dword [edx - 0x45], esi
popfd
sbb dword [ebp + 0x79f12554], ebx
xchg byte [edx - 0x1f28e3c5], ch
add bl, dl
cmp byte [edx], cl
cmp dword [eax], ebp
leave
rol edx, cl
adc eax, 0xd49de6f8
xchg edx, eax
lodsd eax, dword [esi]
js 0x6564d4
xchg edi, edi
mov ah, 0x9a
and al, 0x7a
jg 0x656563
jp 0x656537
jg 0x656563
dec ecx
cld
pop ebx
stc
mov esi, 0xa6f8b6c9
aas
add dword [esp + ebx*4], 0xffffffc8
std
ja 0x656505
add al, 0x9c
enter 0xfffffffffffffd67, 0x77
clc
cdq
stosb byte es:[edi], al
add dl, bl
dec eax
invalid
or dword [eax - 0x38], edi
jle 0x6564cd
cmp eax, 0xaa052a25
xlatb
dec esi
invalid
push esi
push 0x791b6a5f
push esi
loopne 0x65659a
das
cmp eax, 0x9f0932e6
sub esp, esp
xor dl, dl
inc esi
dec eax
js 0x656538
int3
lodsb al, byte [esi]
mov ebx, 0xc4257f79
das
into
js 0x656529
pop eax
mov esp, ebp
cdq
mov ecx, 0xb99cae8d
xchg edi, eax
jge 0x65655b
and al, 0x38
mov ebx, ebx
imul ebx, dword [ecx + ebp*2 + 0x292d16d4], 0xffffffeb
push ecx
sahf
sub eax, edi
dec ebp
dec eax
pop ds
dec eax
pop eax
sti
sbb byte [ebx], dl
inc esi
push esp
sub dword [ecx - 0x77a6dd50], ecx
or byte [edi - 0x6d], dl
lodsb al, byte [esi]
cwde
mov ecx, 0x8d69a873
inc edx
into
lea eax, [edx - 0x32]
invalid
Function at 0x65a330
Capabilities:
Read file via mapping

Disassembly:
push edi
push esi
sub esp, 0x14
call sub.KERNEL32.DLL_GetCurrentProcessId
mov ecx, eax
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b96], cl
mov ecx, eax
shr ecx, 4
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b95], cl
mov ecx, eax
shr ecx, 8
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b94], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b93], cl
mov ecx, eax
shr ecx, 0x10
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b92], cl
mov ecx, eax
shr ecx, 0x14
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b91], cl
mov ecx, eax
shr ecx, 0x18
and ecx, 0xf
mov cl, byte [ecx + str.0123456789ABCDEF]
mov byte [0x665b90], cl
shr eax, 0x1c
mov al, byte [eax + str.0123456789ABCDEF]
mov byte [0x665b8f], al
mov dword [esp + 8], str.LocalFastMM_PID________
mov dword [esp + 4], 0
mov dword [esp], 4
call sub.KERNEL32.DLL_OpenFileMappingA
sub esp, 0xc
mov esi, eax
test esi, esi
je 0x65a43b
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 4
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov edi, dword [eax]
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
jmp 0x65a43d
xor edi, edi
mov eax, edi
add esp, 0x14
pop esi
pop edi
ret

Function at 0x65a450
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x18
xor eax, eax
mov ecx, fcn.0065ad1a
cmp dword [0x66542c], ecx
jne 0x65a555
mov ecx, fcn.0065b09e
cmp dword [0x665430], ecx
jne 0x65a555
mov ecx, fcn.0065b296
cmp dword [0x665434], ecx
jne 0x65a555
mov ecx, fcn.0065b5b0
cmp dword [0x665438], ecx
jne 0x65a555
mov ecx, 0x659650
cmp dword [0x66543c], ecx
jne 0x65a555
xor eax, eax
mov ecx, 0x659660
cmp dword [0x665440], ecx
jne 0x65a555
mov ecx, dword [0xa6860c]
test ecx, ecx
jne 0x65a555
call fcn.0065a330
mov ecx, eax
xor eax, eax
test ecx, ecx
jne 0x65a555
mov dword [esp + 0x14], str.LocalFastMM_PID________
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], 0xffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
sub esp, 0x18
mov dword [0xa6860c], eax
mov dword [esp], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 2
call sub.KERNEL32.DLL_MapViewOfFile
sub esp, 0x14
mov dword [eax], fcn.0065ad1a
mov dword [esp], eax
call sub.KERNEL32.DLL_UnmapViewOfFile
sub esp, 4
mov eax, 1
add esp, 0x18
ret
Function at 0x660d68
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [esp + 0x50]
mov dword [esp], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x80
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc0000000
call sub.KERNEL32.DLL_CreateFileA
sub esp, 0x1c
mov esi, eax
test esi, esi
je 0x660e8b
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetLocalTime
sub esp, 4
movzx eax, word [esp + 0x2e]
mov dword [esp + 0x24], eax
movzx ecx, word [esp + 0x32]
movzx edx, word [esp + 0x2c]
movzx ebx, word [esp + 0x34]
movzx ebp, word [esp + 0x36]
movzx edi, word [esp + 0x38]
movzx eax, word [esp + 0x3a]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str._02d__02d__04d__02d:_02d:_02d._03d
mov dword [esp], 0xa6ab8c
call sub.USER32.DLL_wsprintfA
mov dword [esp], 0xa6ab8c
call fcn.0065ba2c
lea ebx, [esp + 0x28]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0xa6ab8c
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov edi, dword [esp + 0x54]
mov dword [esp], edi
call fcn.0065ba2c
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], esi
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x660e9c
Capabilities:
Write file on windows

Disassembly:
push ebx
push edi
push esi
sub esp, 0x9c
mov ecx, dword [0xa6abac]
mov eax, dword [0xa6abb0]
mov edi, dword [esp + 0xac]
test eax, eax
jne 0x660f91
test ecx, ecx
jne 0x660f91
cmp dword [0x667260], 0
je 0x660fd3
lea esi, [esp + 0x18]
mov dword [esp + 4], esi
mov dword [esp + 8], 0x80
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], 0x5c
call fcn.00660c30
test eax, eax
jne 0x660f1e
mov dword [esp], esi
mov dword [esp + 4], 0x3a
call fcn.00660c30
test eax, eax
je 0x660f21
inc eax
mov esi, eax
mov dword [esp + 0x98], 0
call sub.KERNEL32.DLL_GetVersion
mov ecx, 0x12010
test eax, eax
jns 0x660f71
call sub.KERNEL32.DLL_GetCurrentThreadId
lea ecx, [esp + 0x98]
mov dword [esp + 8], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x66109c
call sub.USER32.DLL_EnumThreadWindows
sub esp, 0xc
mov ecx, 0x12010
cmp dword [esp + 0x98], 0
jne 0x660f71
mov ecx, 0x11010
mov dword [esp + 0xc], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], 0
call sub.USER32.DLL_MessageBoxA
sub esp, 0x10
jmp 0x66105d
test ecx, ecx
je 0x660fa8
cmp ecx, 0xffffffff
je 0x66105d
mov dword [esp], edi
call ecx
mov eax, dword [0xa6abb0]
test eax, eax
je 0x66105d
cmp eax, 0xffffffff
je 0x66105d
cmp byte [eax], 0
je 0x66105d
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.00660d68
jmp 0x66105d
mov dword [esp], 0xfffffff4
call sub.KERNEL32.DLL_GetStdHandle
sub esp, 4
mov esi, eax
lea ebx, [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp], edi
call fcn.0065ba2c
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 0x10], 0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
mov dword [esp + 0xc], ebx
mov dword [esp], esi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6670b0
call sub.KERNEL32.DLL_WriteFile
sub esp, 0x14
add esp, 0x9c
pop esi
pop edi
pop ebx
ret
Function at 0x401290
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x40], str.CodeBlocksWindowsApp
mov dword [ebp - 0x60], sym.__Z15WindowProcedureP6HWND__jjl_16
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x68], 0x30
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x50], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadIconA
sub esp, 8
mov dword [ebp - 0x3c], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call sub.USER32.dll_LoadCursorA
sub esp, 8
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x48], 1
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.USER32.dll_RegisterClassExA
sub esp, 4
test ax, ax
jne 0x401344
mov dword [ebp - 0x70], 0
jmp 0x40147a
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x177
mov dword [esp + 0x18], 0x220
mov eax, 0x80000000
mov dword [esp + 0x14], eax
mov eax, 0x80000000
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xcf0000
mov dword [esp + 8], str.Unlock_Computer
mov dword [esp + 4], str.CodeBlocksWindowsApp
mov dword [esp], 0
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0x6c], eax
mov dword [esp + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0x64
mov dword [esp + 0x18], 0xc8
mov dword [esp + 0x14], 0xa
mov dword [esp + 0x10], 0xa
mov dword [esp + 0xc], 0x500000c4
mov dword [esp + 8], 0x403010
mov dword [esp + 4], str.EDIT
mov dword [esp], 0x200
call sub.USER32.dll_CreateWindowExA
sub esp, 0x30
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x6c]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_GetMessageA
sub esp, 0x10
test eax, eax
je 0x401474
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_TranslateMessage
sub esp, 4
lea eax, [ebp - 0x38]
mov dword [esp], eax
call sub.USER32.dll_DispatchMessageA
sub esp, 4
jmp 0x40142c
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
leave
ret 0x10
Function at 0x4014e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00401a40
call sym.___main
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401518
jmp 0x4015b6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401517
cmp cl, 0x22
je 0x401570
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401590
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401590
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401550
jmp 0x401590
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401570
cmp cl, 0x22
je 0x4015f2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4015b0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x4015a0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4015d4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401590

Function at 0x401ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x4330e0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
jmp 0x4330f8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jae 0x4331d6
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00433a50
add esp, 8
sar eax, 0xc
cmp eax, 3
jne 0x4331d1
mov dword [ebp - 0x10], 0xfff
mov dword [ebp - 0xc], 0x9922c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00433a50
add esp, 8
and eax, dword [ebp - 0x10]
add eax, 0x8702
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
mov dword [ebp - 0xc], 0x9922c
cmp dword [ebp - 4], 0
jne 0x4331aa
push 0x154b
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4331aa
xor eax, eax
jmp 0x4331d6
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [ecx + edx - 0x8702]
add eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov dword [edx + ecx - 0x8702], eax
jmp 0x4330ef
mov esp, ebp
pop ebp
ret

Function at 0x433a50
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x240be8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x240be8
push 0x15b9
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x433a85
xor eax, eax
jmp 0x433a8f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx eax, word [eax + edx*2]
mov esp, ebp
pop ebp
ret

Function at 0x7ffab4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ffabe
pushal
call 0x7ffac4
pop ebp
sub ebp, 0x10
sub ebp, 0x3ffab4
jmp 0x7ffada
mov eax, 0x3ffab4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5fd
mov edx, 0xd8647167
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ffaf1
jmp 0x7ffb04
in al, dx
stosb byte es:[edi], al
in al, dx
out dx, al
pop ebx
out 0xa6, al
lahf
stosb byte es:[di], al
fbld tbyte [ecx + 0x67]
fisttp qword [bx + 0x67]
nop
test dword [edi + ebp*4 - 0x14], esp
out 0x6b, al
mov byte fs:[0x3ea], al
inc ebx
wait
out dx, al
arpl word [ebx - 0x16], ax
add eax, dword [ebx - 0x65]
out dx, al
arpl word [ebx + 0xf], ax
enter 0x6769, 0xf
js 0x7ffb6c
push esi
dec bx
inc ebx
setg dh
scasd eax, dword es:[edi]
pushal
invalid
cmpsb byte [si], byte es:[di]
mov fs, word [ebp + 0x56]
in al, 0xa5
arpl word [esi], bp
push 0x989893e2
cwde
cmp ah, byte [ebp - 0x14139895]
inc ebx
arpl word [edi + 0x67], sp
psllq mm1, mm0
imul esp, dword [edi + 0xf], 0x67562c78
dec bx
inc ebx
invalid
Function at 0x401a82
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43114c]
jne 0x401a8c
repz ret
jmp fcn.0040252b

Function at 0x40b0be
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43114c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404144
and dword [ebp - 0x14], 0
cmp dword [0x433bf8], 0
mov dword [ebp - 0x18], eax
jne 0x40b171
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b219
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b219
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x433bf8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x433bfc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x433c00], eax
call edi
push eax
call esi
mov dword [0x433c08], eax
test eax, eax
je 0x40b171
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x433c04], eax
mov eax, dword [0x433c04]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b1ca
cmp dword [0x433c08], ecx
je 0x40b1ca
push eax
call esi
push dword [0x433c08]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b1ca
test ebx, ebx
je 0x40b1ca
call edi
test eax, eax
je 0x40b1c1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b1c1
test byte [ebp - 8], 1
jne 0x40b1ca
or dword [ebp + 0x10], 0x200000
jmp 0x40b1fd
mov eax, dword [0x433bfc]
cmp eax, dword [ebp - 0x18]
je 0x40b1fd
push eax
call esi
test eax, eax
je 0x40b1fd
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b1fd
mov eax, dword [0x433c00]
cmp eax, dword [ebp - 0x18]
je 0x40b1fd
push eax
call esi
test eax, eax
je 0x40b1fd
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x433bf8]
call esi
test eax, eax
je 0x40b219
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b21b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401a82
leave
ret
Function at 0x422e90
Capabilities:
Get geographical location

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 0xc], esi
jle 0x422f1e
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
cmp dword [esp + 0x18], 0x2d
jne 0x422edc
push 0
push str.vepamanal_tulesizoxe_yabadodopa_zokorubonoxesiticohub_foyidufumobowebacaxosububonobo
call edi
push str.wuviyakox
push str.yekukefocudovizene
push str.kaluravujokiziduyux
push str.vixuboxituja
call ebx
push 0
call ebp
call fcn.00422de0
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], al
cmp dword [esp + 0x18], 0xf
jne 0x422f14
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push str.tigegisipawupesavumefozoj
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthA]
inc esi
cmp esi, dword [esp + 0x18]
jl 0x422eb2
pop edi
pop ebp
pop ebx
cmp dword [esp + 0xc], 0x2d
pop esi
jne 0x422f3a
mov dword [0x434cf0], 0xa62e7790
mov dword [0x434cf4], 0xffffffff
ret
Function at 0x423300
Capabilities:
Access the windows event log
Set file attributes

Disassembly:
mov eax, dword [0x434ce4]
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov ebp, 0x1519a5
lea esp, [esp]
mov dword [0x43494c], 0x8e46a7b8
cmp eax, 0x3dc
jne 0x42334a
push 0
push str.lujawidolo
call esi
push str.rusokuj
push 0
push 0
call edi
mov eax, dword [0x434ce4]
dec ebp
jne 0x423320
mov edi, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
xor esi, esi
mov ebp, 0xec58acac
lea ebx, [ebx]
cmp eax, 0x997
jne 0x423372
push 0
push 0
call edi
mov eax, dword [0x434ce4]
cmp esi, 0x846373
jne 0x423389
mov eax, dword [0x432ad0]
add eax, 0xa231
mov dword [0x434ce4], eax
cmp eax, 0x141
jne 0x4233a0
mov dword [0x434138], ebp
mov dword [0x43413c], 0xffffffff
inc esi
cmp esi, 0x123c962
jl 0x423360
call fcn.00422f80
pop edi
pop esi
xor eax, eax
pop ebp
ret 0x10