joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x408924
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4085d8
mov edx, eax
call fcn.0040894a
xor dword [ecx], edi
add eax, 1
inc ecx
add edx, eax
sub eax, 0x12f8856
cmp ecx, esi
jne fcn.00408924
and eax, edx
ret
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..reloc
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x3a941b19
nop
nop
nop
nop
test eax, eax
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
mov eax, section..rdata
nop
mov ebx, 0x42f314
nop
mov ecx, 0x281d45e4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x446fa8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x446fdd
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403c40
jmp 0x446fe7
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.00403bf4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x447900
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
div ecx
test edx, edx
je 0x44790e
invalid
invalid
je 0x44790b
Function at 0x447924
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ret

Function at 0x447ce4
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc edi
push es
inc edi
push es
jne 0x447cf7
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x447d15
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x447d73
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x447d5a
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x447d63
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x447d6d
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x447d4f
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x447cd9
mov dword [ebp + 8], esi
xor edi, edi

Function at 0x45f157
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x47f87e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45f1af
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x47f89f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45f1a5
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x45f1b3
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x4718f4
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f8c
xor eax, eax
push ebp
push 0x47198f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.00408b5c
test al, al
je 0x471979
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00408a24
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x471965
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47196c
mov eax, dword [ebp - 0xc]
call fcn.00408aec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471996
lea eax, [ebp - 4]
call fcn.00403b5c
ret
Function at 0x643c2140
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x643c219b
cmp byte [esi + ebx - 1], 0xa
je 0x643c216f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x643c3118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40a9bf
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push fcn.004359f0
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x44a1ac]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x44a1ac]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [eax + 4]
mov ebx, dword [eax]
push 0xf
mov dword [esp + 0x20], ecx
pop ecx
xor esi, esi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], esi
mov byte [esp + 0x20], 0
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], esi
mov byte [esp + 0x3c], 0
and al, 0x3c
add byte [ecx + 0xa024b4], cl
add byte [eax], al
Function at 0x41aea8
Capabilities:
Hash data with md5

Disassembly:
push 0xb8
mov eax, 0x434a44
call fcn.00425f04
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 2
push 0x68
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x94]
push ebx
push eax
call dword [0x438324]
mov edi, dword [ebp + 8]
add esp, 0xc
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x8c], 0x67452301
mov dword [ebp - 0x88], 0xefcdab89
mov dword [ebp - 0x84], 0x98badcfe
mov dword [ebp - 0x80], 0x10325476
mov eax, edi
jae 0x41af4b
lea eax, [ebp + 8]
add eax, dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0xc4], eax
jae 0x41af5d
lea edi, [ebp + 8]
cmp edi, eax
je 0x41af8e
mov al, byte [edi]
mov byte [ebp - 0x95], al
lea eax, [ebp - 0x95]
push 1
push eax
lea esi, [ebp - 0x94]
call fcn.0042070a
inc edi
pop ecx
pop ecx
cmp edi, dword [ebp - 0xc4]
jne 0x41af61
mov esi, dword [ebp - 0xc0]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x94]
call fcn.0041b06b
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
lea eax, [ebp - 0xbc]
push eax
mov byte [ebp - 4], 3
push dword [ebp - 0xa8]
lea edi, [ebp - 0x9c]
push dword [ebp - 0xac]
call fcn.0041b134
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xbc]
add esp, 0xc
push dword [ebp - 0x9c]
mov dword [esi + 0x14], 0xf
push eax
push ecx
mov dword [esi + 0x10], ebx
push esi
mov byte [esi], bl
call fcn.0041b326
mov edi, dword [fcn.00438334]
cmp dword [ebp - 0xbc], ebx
je 0x41b018
push dword [ebp - 0xbc]
call edi
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
call fcn.0040be38
cmp dword [ebp - 0xac], ebx
je 0x41b046
push dword [ebp - 0xac]
call edi
pop ecx
push ebx
push 1
lea ecx, [ebp + 8]
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call fcn.0040be38
mov eax, esi
call fcn.00425f87
ret
Function at 0x422bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [edi + 0x2c]
push ebp
push esi
mov ebp, dword [edi + 0x3c]
sub ebp, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea edx, [ebx + ecx - 0x106]
sub ebp, eax
cmp eax, edx
jb 0x422c3e
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00425a84
mov edx, dword [edi + 0x4c]
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x422c11
sub eax, ebx
jmp 0x422c13
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x422c02
mov ecx, dword [edi + 0x40]
mov edx, ebx
lea ecx, [ecx + ebx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, ebx
jb 0x422c32
sub eax, ebx
jmp 0x422c34
xor eax, eax
sub edx, 1
mov word [ecx], ax
jne 0x422c23
add ebp, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x422c99
mov edx, dword [edi + 0x74]
add edx, dword [edi + 0x6c]
mov ecx, ebp
add edx, dword [edi + 0x38]
push edx
call fcn.00422870
add dword [edi + 0x74], eax
mov edx, dword [edi + 0x74]
add esp, 4
cmp edx, 3
jb 0x422c85
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea esi, [eax + ecx]
movzx eax, byte [esi]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [esi + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp edx, 0x106
jae 0x422c99
mov edx, dword [edi]
cmp dword [edx + 4], 0
jne 0x422bc6
pop esi
pop ebp
pop ebx
ret
Function at 0x4283b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
xor ecx, ecx
cmp eax, edx
je 0x4283df
push esi
push edi
mov esi, ecx
mov edi, ecx
shl esi, 6
shr edi, 2
add esi, edi
movsx edi, byte [eax]
lea esi, [esi + edi - 0x61c88647]
inc eax
xor ecx, esi
cmp eax, edx
jne 0x4283c0
pop edi
pop esi
mov eax, 0x4e25
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add edx, eax
shr edx, 0x1e
imul edx, edx, 0x7fffd8ee
mov eax, ecx
sub eax, edx
add eax, 0x2710
ret
Function at 0x43a970
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf0
mov eax, 0x43d991
mov dword [esp], eax
mov dword [esp + 4], 0x43d4c4
mov dword [esp + 8], 0x43d4c0
mov dword [esp + 0xc], 0x43d4bc
mov dword [esp + 0x10], 0x43d4b8
mov dword [esp + 0x14], 0x43d4b4
mov dword [esp + 0x18], 0x43d968
mov dword [esp + 0x1c], 0x43d4b0
mov dword [esp + 0x20], 0x43d4ac
mov dword [esp + 0x24], 0x43d9a0
mov dword [esp + 0x28], 0x43d99c
mov dword [esp + 0x2c], 0x43dcc8
mov dword [esp + 0x30], 0x43e61c
mov dword [esp + 0x34], 0x43d4a8
mov dword [esp + 0x38], 0x43d4a4
mov dword [esp + 0x3c], 0x43d4a0
mov dword [esp + 0x40], 0x43d49c
mov dword [esp + 0x44], 0x43d490
mov dword [esp + 0x48], 0x43d19c
mov dword [esp + 0x4c], 0x43dac4
mov dword [esp + 0x50], 0x43e614
mov dword [esp + 0x54], 0x43e618
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], 0x43d48c
mov dword [esp + 0x64], 0x43d488
mov dword [esp + 0x68], 0x43d998
mov dword [esp + 0x6c], 0x43d484
mov dword [esp + 0x70], 0x43d1a0
mov dword [esp + 0x74], 0x43d18c
mov dword [esp + 0x78], 0x43d16c
mov dword [esp + 0x7c], 0x43d15c
mov dword [esp + 0x80], 0x43d154
mov dword [esp + 0x84], 0x43d14c
mov dword [esp + 0x88], 0x43d144
mov dword [esp + 0x8c], 0x43d198
mov dword [esp + 0x90], 0x43d480
mov dword [esp + 0x94], 0x43d9a4
mov dword [esp + 0x98], 0x43d190
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], 0x43dacc
mov dword [esp + 0xc0], 0x43d228
mov dword [esp + 0xc4], 0x43d20c
mov dword [esp + 0xc8], 0x43dab4
mov dword [esp + 0xcc], 0x43d204
mov dword [esp + 0xd0], 0x43d250
mov dword [esp + 0xd4], 0x43d47c
mov dword [esp + 0xd8], 0x43d164
mov dword [esp + 0xdc], 0x43d22c
mov dword [esp + 0xe0], 0x43d234
mov dword [esp + 0xe4], 0x43d478
mov dword [esp + 0xe8], 0x43d240
mov dword [esp + 0xec], 0x43d224
cmp cl, 0x3c
jae 0x43ab8d
movzx eax, cl
mov eax, dword [esp + eax*4]
add esp, 0xf0
ret

Function at 0x402364
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [fcn.00404070]
push ebx
call edi
test eax, eax
jl 0x40239a
push esi
mov esi, dword [ebp + 0xc]
sub ebx, esi
mov al, byte [ebx + esi]
push dword [ebp + 8]
xor al, 0xb1
inc dword [ebp - 4]
mov byte [esi], al
inc esi
call edi
cmp dword [ebp - 4], eax
jle 0x402384
pop esi
pop edi
pop ebx
leave
ret

Function at 0x40239e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
cmp dword [edx + 4], ecx
jle 0x4023b6
mov eax, dword [edx]
add eax, ecx
xor byte [eax], 0xb1
inc ecx
cmp ecx, dword [edx + 4]
jl 0x4023a9
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x69b51b81
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x115972b3
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x50ce50
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.QNhjSkbP
lea edi, [esi - 0x9000]
push edi
or ebp, 0xffffffff
jmp 0x50ce72
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x50ce79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x50ce68
mov eax, 1
add ebx, ebx
jne 0x50ce8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x50ce80
jne 0x50ce9c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50ce80
xor ecx, ecx
sub eax, 3
jb 0x50ceb0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x50cf22
mov ebp, eax
add ebx, ebx
jne 0x50cebb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x50cec8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x50ceec
inc ecx
add ebx, ebx
jne 0x50ced8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x50cecd
jne 0x50cee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x50cecd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x50cf0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x50cefd
jmp 0x50ce6e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x50cf0c
add edi, ecx
jmp 0x50ce6e
pop esi
lea edi, [esi + 0xa000]
mov eax, dword [edi]
or eax, eax
je 0x50cf6b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeacc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x50cf29
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb2c]
or eax, eax
je 0x50cf65
mov dword [ebx], eax
add ebx, 4
jmp 0x50cf46
call dword [esi + 0xeb28]
mov ebp, dword [esi + 0xeb30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x50cf9f
sub esp, 0xffffff80
jmp section.bUItIFMf
Function at 0xed8370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xed838e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xf01074
push ecx
mov edi, eax
call fcn.00eec198
mov esi, eax
add esp, 8
test esi, esi
jne 0xed83cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00eec02e
push esi
call fcn.00eebfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xedb850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xedb8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xf06720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xedb8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00eec1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xedb8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xf06720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xedb92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00eed082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xedb957
mov word [eax], si
add eax, 2
push eax
call fcn.00eed030
add esp, 4
jmp 0xedb959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xedb8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xedb8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xedbff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret