joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43be0f
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ecx
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x43be87
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x18]
cmp edi, 4
jb 0x43be74
push ebp
mov ebp, edi
shr ebp, 2
push 4
lea eax, [esp + 0x14]
push esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push 4
lea eax, [esp + 0x34]
push ebx
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x3c]
xor eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x2c]
push 4
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x24
add esi, 4
add ebx, 4
sub edi, 4
sub ebp, 1
jne 0x43be2f
pop ebp
test edi, edi
je 0x43be85
sub ebx, esi
mov al, byte [ebx + esi]
xor byte [esi], al
inc esi
sub edi, 1
jne 0x43be7a
pop esi
pop ebx
pop edi
pop ecx
pop ecx
ret

Function at 0x43f1ba
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
mov edx, dword [esp + 4]
add eax, eax
push 4
lea ecx, [ecx*4 - 4]
movups xmm0, xmmword [edx + eax*8]
movups xmm1, xmmword [edx]
movups xmmword [edx], xmm0
movups xmmword [edx + eax*8], xmm1
pop eax
cmp ecx, eax
jbe 0x43f200
aesimc xmm0, xmmword [edx + ecx*4]
aesimc xmm1, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
add eax, 4
movups xmmword [edx + ecx*4], xmm1
sub ecx, 4
cmp eax, ecx
jb 0x43f1e2
aesimc xmm0, xmmword [edx + eax*4]
movups xmmword [edx + eax*4], xmm0
ret
Function at 0x43f20b
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push edi
push eax
push esi
movups xmm0, xmmword [eax + edi - 0x10]
movaps xmmword [esp + 0x2c], xmm0
call sub.VCRUNTIME140.dll_memcpy
movaps xmm1, xmmword [esp + 0x2c]
mov eax, edi
shr eax, 2
add esp, 0xc
mov edx, eax
mov dword [esp + 0x14], eax
aeskeygenassist xmm0, xmm1, 0
shl edx, 2
lea ecx, [eax + 7]
mov dword [esp + 0x18], 0x44c6d4
shl ecx, 4
add ecx, esi
mov dword [esp + 0x1c], ecx
pextrd ecx, xmm0, 3
xor ecx, dword [esi]
xor ecx, 1
mov dword [edx + esi], ecx
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [esi + 0x10]
add eax, edx
jmp 0x43f347
cmp edi, 0x18
jne 0x43f2ba
mov eax, dword [esi + 0x24]
xor eax, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
xor ecx, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ecx
pinsrd xmm1, ecx, 3
jmp 0x43f2ff
cmp edi, 0x20
jne 0x43f2f8
pinsrd xmm1, dword [esi + 0x2c], 3
mov eax, dword [esi + 0x14]
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 2
xor ecx, dword [esi + 0x10]
xor eax, ecx
mov dword [esi + 0x30], ecx
mov ecx, dword [esi + 0x18]
xor ecx, eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x1c]
xor eax, ecx
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pinsrd xmm1, eax, 3
jmp 0x43f2ff
pinsrd xmm1, dword [esi + 0x1c], 3
mov eax, dword [esp + 0x18]
add esi, edx
aeskeygenassist xmm0, xmm1, 0
pextrd ecx, xmm0, 3
xor ecx, dword [eax]
add eax, 4
xor ecx, dword [esi]
mov dword [edx + esi], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
xor eax, ecx
mov dword [edx + esi + 4], eax
mov ecx, dword [esi + 8]
xor ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esi + eax*4 + 8], ecx
mov eax, dword [esi + 0xc]
xor eax, ecx
mov ecx, dword [esp + 0x14]
mov dword [esi + ecx*4 + 0xc], eax
lea eax, [edx + 0x10]
add eax, esi
cmp eax, dword [esp + 0x1c]
jne 0x43f29c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43f568
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0043f544
pop esi
leave
ret 8
Function at 0x440e1f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x440e5e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x440e5e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x440e5e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x440e5e
cmp dword [ecx + 0x74], 0xe
jbe 0x440e5e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4030b2
Capabilities:
Delete directory
Get common file path
Get file attributes
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov dword [ebp - 0x10], eax
mov eax, dword [edi + 4]
xor esi, esi
cmp dword [0x980120], 0x594
mov dword [ebp - 0xc], eax
jne 0x4030fa
push 0x402e40
push 0x402e50
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceA]
mov eax, dword [0x80c4c8]
push ebx
mov ebx, dword [0x80c4cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.004030ab
mov eax, dword [0x80c4d0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x2c], eax
mov eax, dword [0x80c4d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, dword [ebp - 0x10]
mov ecx, eax
shl ecx, 4
cmp dword [0x980120], 0xc
mov dword [ebp - 4], ecx
jne 0x4031a4
push esi
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
mov word [ebp - 0x1c], ax
lea edi, [ebp - 0x1a]
stosw word es:[edi], ax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x84c]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
lea eax, [ebp - 0x38]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0x2c]
add dword [ebp - 4], ecx
mov ecx, dword [0x980120]
cmp ecx, 0xfa9
jne 0x4031c2
mov dword [0x97f6bc], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4031d0
mov dword [0x97f070], esi
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
shr eax, cl
mov dword [0x97f6b8], 0xf4ea3dee
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x980120], 0x213
mov dword [ebp - 0x18], ecx
jne 0x40320b
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
mov eax, dword [ebp - 0xc]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x14]
shr eax, cl
add eax, ebx
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x20]
jne 0x403139
cmp dword [0x980120], 0xa6d
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
pop ebx
jne 0x40326c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceA]
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
leave
ret 4
Function at 0x403346
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Execute shellcode via windows callback function
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.0040ccf0
push esi
xor esi, esi
cmp dword [0x980120], 0x5b1
push edi
jne 0x4033e2
push esi
lea eax, [ebp - 0x80c]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
call dword [sym.imp.USER32.dll_ChangeDisplaySettingsA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0x402e90
push esi
call fcn.00403eaf
push esi
push esi
push esi
push esi
call fcn.00404166
push esi
call fcn.00403c97
push esi
push esi
call fcn.0040420a
push esi
push esi
call fcn.00403ca2
call fcn.00403659
push esi
call fcn.00403dd4
add esp, 0x2c
mov dword [esp], esi
call fcn.00402ff0
fstp st(0)
push esi
call fcn.00404818
add dword [0x980120], 0x1134b
push dword [0x980120]
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea ecx, [ebp - 8]
push ecx
push 0x40
push dword [0x980120]
mov dword [0x97f074], eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x980120]
xor ecx, ecx
cmp eax, esi
jbe 0x403437
mov edx, dword [0x980124]
mov dl, byte [edx + ecx + 0x1134b]
mov edi, dword [0x97f074]
mov byte [edi + ecx], dl
inc ecx
cmp ecx, eax
jb 0x40341c
xor edi, edi
lea ecx, [eax + edi]
cmp ecx, 0xe
jne 0x403471
lea eax, [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
call dword [sym.imp.KERNEL32.dll_GetACP]
push esi
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0x402e98
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov eax, dword [0x980120]
inc edi
cmp edi, 0x39621
jl 0x403439
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
xor ebx, ebx
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetCommMask]
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp ebx, 0x206d47
jg 0x4034a5
inc ebx
cmp ebx, 0x4f6a4
jl 0x403483
mov ebx, 0x4e320c
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_CharToOemBuffW]
call dword [sym.imp.USER32.dll_GetMessagePos]
dec ebx
jne 0x4034aa
call fcn.00403278
push esi
call edi
cmp ebx, 0x26
jne 0x4034d6
call fcn.0040332c
inc ebx
cmp ebx, 0x6753f
jl 0x4034c9
push 0x7b
pop edi
pop ebx
cmp dword [0x980120], 0x86
jne 0x403524
push esi
lea eax, [ebp - 0x40c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextVolumeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push esi
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push esi
lea eax, [ebp - 0x100c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
dec edi
jne 0x4034e3
call fcn.00403034
pop edi
pop esi
leave
ret
Function at 0x403530
Capabilities:
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
xor esi, esi
cmp dword [0x980120], 0x400
push edi
jne 0x40359d
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll__hwrite]
push esi
push esi
call fcn.00403a42
push esi
push esi
call fcn.00403a42
push esi
call fcn.00403c0c
push esi
push esi
push esi
call fcn.004044e3
add esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], esi
call fcn.0040300f
fstp st(0)
push esi
call fcn.00404568
push esi
call fcn.004042fa
push esi
push esi
call fcn.00403936
add esp, 0x10
mov eax, dword [0x80cb54]
mov dword [0x980120], eax
mov eax, dword [0x80cb2c]
mov dword [0x980124], eax
call fcn.00403346
mov dword [ebp - 4], esi
mov ebx, 0x2b259d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
cmp dword [ebp - 4], ebx
jle 0x4035ff
cmp dword [ebp - 8], 0x785074d5
jne 0x40360b
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c1b
jl 0x4035be
xor edi, edi
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push 0x402eb8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
push 0x402f04
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, ebx
jle 0x40363b
cmp dword [ebp - 8], 0x785074d5
jne 0x403644
inc edi
cmp edi, 0x11915
jl 0x40360d
mov eax, dword [0x97f074]
mov dword [0x97f6b4], eax
call eax
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10

Function at 0x404ee0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x80b0e8]
jne 0x404eea
repz ret
jmp fcn.0040ad12
Function at 0x40aa35
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004076f2
and dword [ebp - 4], 0
cmp dword [0x80d420], 0
mov ebx, eax
jne 0x40aae6
push 0x401bb4
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je HeapFree
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401ba8
push edi
call esi
test eax, eax
je 0x40ab97
push eax
call fcn.00407680
mov dword [esp], 0x401b98
push edi
mov dword [0x80d420], eax
call esi
push eax
call fcn.00407680
mov dword [esp], 0x401b84
push edi
mov dword [0x80d424], eax
call esi
push eax
call fcn.00407680
mov dword [esp], 0x401b68
push edi
mov dword [0x80d428], eax
call esi
push eax
call fcn.00407680
pop ecx
mov dword [0x80d430], eax
test eax, eax
je 0x40aae6
push 0x401b50
push edi
call esi
push eax
call fcn.00407680
pop ecx
mov dword [0x80d42c], eax
mov eax, dword [0x80d42c]
cmp eax, ebx
je reloc.KERNEL32.dll_TlsGetValue
cmp dword [0x80d430], ebx
je reloc.KERNEL32.dll_TlsGetValue
push eax
call fcn.004076fb
push dword [0x80d430]
mov esi, eax
call fcn.004076fb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je reloc.KERNEL32.dll_TlsGetValue
test edi, edi
je reloc.KERNEL32.dll_TlsGetValue
call esi
test eax, eax
je 0x40ab35
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ab35
test byte [ebp - 0xc], 1
jne reloc.KERNEL32.dll_TlsGetValue
or dword [ebp + 0x10], 0x200000
jmp 0x40ab77
mov eax, dword [0x80d424]
cmp eax, ebx
je 0x40ab77
push eax
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab77
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40ab77
mov eax, dword [0x80d428]
cmp eax, ebx
je 0x40ab77
push eax
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab77
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x80d420]
call fcn.004076fb
pop ecx
test eax, eax
je 0x40ab97
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40ab99
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x402ed4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4041a0
sub eax, eax
test esi, esi
je 0x402fac
sub eax, 1
test ecx, ecx
je 0x402faa
test esi, 3
je 0x402f12
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402ef7
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x402f91
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402f1c
mov ecx, edx
test ecx, ecx
je 0x402faa
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x402f97
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2ce6492e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x432060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2a83246b
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x4320c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219