joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3633700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0363378f
jae 0x363370e
xor ecx, ecx
call fcn.0363378f
jae 0x363373d
xor eax, eax
call fcn.0363378f
jae 0x363374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0363378f
adc al, al
jae 0x363372f
jne 0x3633779
stosb byte es:[edi], al
jmp 0x3633711
call fcn.0363379b
sub ecx, ebx
jne 0x3633756
call fcn.03633799
jmp 0x3633775
lodsb al, byte [esi]
shr eax, 1
je 0x3633783
adc ecx, ecx
jmp 0x3633772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03633799
cmp eax, 0x7d00
jae 0x3633772
cmp ah, 5
jae 0x3633773
cmp eax, 0x7f
ja 0x3633774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3633711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8

Function at 0x3679b18
Capabilities:
Encode data using xor

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
mov eax, 0x5818
call fcn.0367a1ec
call fcn.03679fe0
lea ebx, [ebp - 0x580c]
mov esi, 0x403040
mov ecx, 0x15fd
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
call fcn.03679bdc
mov esi, dword [ebp - 0x618]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x1000
mov dword [esp + 4], 0x57f4
mov dword [esp], 0
call fcn.03679be4
sub esp, 0x10
mov edi, eax
xor ecx, ecx
nop
mov edx, edi
mov al, byte [ebx + ecx]
mov byte [edi + ecx], al
inc ecx
cmp ecx, 0x57f4
jne 0x3679b84
lea ecx, [edi + 0x51f4]
nop
xor dword [edx], esi
add esi, 0x499602d2
add edx, 4
cmp edx, ecx
jne 0x3679b9c
call edi
xor eax, eax
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
leave
lea esp, [ecx - 4]
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xa448a7
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0xa448ed
jbe 0xa11bb2
mov ch, bh
mov ch, byte [esp]
lea edi, reloc.SHLWAPI.dll_PathAddBackslashA
jmp 0xa448d7
mov esi, dword [esp]
lea ecx, [esi + ebp]
mov esi, dword [esp]
jmp 0xa44943
lea esp, [esp + 0x28]
test edx, edx
jmp 0xa448a9
push ecx
jmp 0xa44972
mov cl, ah
mov ecx, dword [esp]
bswap ecx
sub ebx, eax
dec ecx
jmp 0xa4490e
lea esi, reloc.SHLWAPI.dll_PathAddBackslashA
sub esp, 0x18
mov eax, edi
lea ecx, reloc.SHLWAPI.dll_PathAddBackslashA
jmp 0xa44924
lea esp, [esp + 0x18]
jmp 0xa11b90
mov ecx, ebp
add ecx, 0xfffffffc
mov dword [ecx], edx
pop ecx
jmp 0xa44957

Function at 0xace8ba
Capabilities:
Access peb ldr_data

Disassembly:
mov dword [esp], esi
push dword [esp + 4]
lea esp, [esp + 2]
Function at 0x100011f0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a282
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1005c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], edx
mov ebx, ecx
cmp dword [0x1005d704], 0
jne 0x1000126a
push 0x1005d704
push 0x10030b0c
push 0
call dword [sym.imp.DWrite.dll_DWriteCreateFactory]
test eax, eax
js 0x100012ed
mov eax, dword [0x1005d704]
push 0x1005d654
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
js 0x100012ed
push 0x55
push 0x1005d658
push 0x5c
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp ebx, 4
ja 0x10001408
lea esi, [ebx + ebx*4]
mov ecx, dword [esi*4 + 0x1005e7a8]
lea edi, [esi*4 + 0x1005e7a8]
test ecx, ecx
je 0x10001339
cmp dword [esi*4 + 0x1005e7ac], 0
je 0x10001339
cmp dword [esi*4 + 0x1005e7b0], 0
je 0x10001339
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cmp dword [esi*4 + 0x1005e7b4], ebx
jne 0x100012c0
cmp dword [esi*4 + 0x1005e7b8], edi
je 0x100012d6
mov eax, dword [ecx]
push edi
push ebx
push ecx
call dword [eax + 0x28]
mov dword [esi*4 + 0x1005e7b4], ebx
mov dword [esi*4 + 0x1005e7b8], edi
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x1005d704]
test ecx, ecx
je 0x10001307
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1005d704], 0
mov ecx, dword [0x1005d654]
test ecx, ecx
je 0x10001408
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1005d654], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
call fcn.100016e0
mov eax, dword [0x1005d654]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [eax]
push dword [ebp - 0x10]
push eax
call dword [ecx + 0x1c]
test eax, eax
js 0x10001408
mov eax, dword [edi]
mov ecx, dword [eax]
push ecx
mov dword [esp], 0x3f800000
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp + 8]
lea edx, [esi*4 + 0x1005e7ac]
mov dword [esi*4 + 0x1005e7b4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi*4 + 0x1005e7b8], eax
mov eax, dword [0x1005d704]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
test eax, eax
js 0x10001401
push 0x1002b362
push 0x10
call fcn.1001844d
mov edi, eax
add esp, 8
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x100013e9
mov edx, dword [esi*4 + 0x1005e7a8]
mov ecx, dword [esi*4 + 0x1005e7ac]
mov dword [edi], vtable.GdiTextRenderer.0
mov dword [edi + 4], 0
mov dword [edi + 8], edx
mov dword [edi + 0xc], ecx
mov eax, dword [edx]
push edx
call dword [eax + 4]
mov eax, dword [edi + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
jmp 0x100013eb
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov dword [esi*4 + 0x1005e7b0], edi
test edi, edi
jne 0x100012d6
mov ecx, ebx
call fcn.100016e0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100037d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a37b
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1005c00c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi + 0x20], 0
lea esi, [edi + 0xd8]
mov dword [edi + 0x1c], 0
xorps xmm0, xmm0
mov dword [edi + 0x28], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x5c], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x60], 0
mov dword [edi + 0x70], 0
mov dword [edi + 0x6c], 0
mov dword [edi + 0x68], 0
mov dword [edi + 0x64], 0
mov dword [edi + 0x74], 0
mov dword [edi + 0x84], 0
mov dword [edi + 0x80], 0
mov dword [edi + 0x7c], 0
mov dword [edi + 0x78], 0
mov dword [edi + 0x88], 0
mov dword [edi + 0x98], 0
mov dword [edi + 0x94], 0
mov dword [edi + 0x90], 0
mov dword [edi + 0x8c], 0
mov dword [edi + 0x9c], 0
mov dword [edi + 0xac], 0
mov dword [edi + 0xa8], 0
mov dword [edi + 0xa4], 0
mov dword [edi + 0xa0], 0
mov dword [edi + 0xb0], 0
mov dword [edi + 0xc0], 0
mov dword [edi + 0xbc], 0
mov dword [edi + 0xb8], 0
mov dword [edi + 0xb4], 0
mov dword [edi + 0xc4], 0
mov dword [edi + 0xcc], 0
mov dword [edi + 0xc8], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0xd4], 0
mov dword [edi + 0xd0], 0
mov dword [ebp - 0x10], esi
movups xmmword [esi + 0x14], xmm0
movups xmmword [esi + 0x24], xmm0
movups xmmword [esi + 0x34], xmm0
movups xmmword [esi + 0x44], xmm0
movups xmmword [esi + 0x54], xmm0
movups xmmword [esi + 0x64], xmm0
movups xmmword [esi + 0x74], xmm0
movups xmmword [esi + 0x84], xmm0
mov dword [esi + 0x94], 0
push fcn.10001c50
push 0x10008da0
push 0x18
push 4
lea eax, [esi + 0x12c]
mov dword [ebp - 4], 0
push eax
call fcn.10018ad1
mov dword [esi + 4], 0xffffffff
mov dword [esi], 0xffffffff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 3
mov dword [esi + 0x10], 0xbf800000
mov dword [esi + 0x98], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0xac], 0
mov dword [esi + 0xb0], 0
mov dword [esi + 0xb4], 0
mov dword [esi + 0xb8], 0
xorps xmm0, xmm0
mov dword [esi + 0xbc], 0
mov eax, edi
mov dword [esi + 0xc0], 0
mov dword [esi + 0xc4], 0
mov dword [esi + 0xc8], 0
movups xmmword [esi + 0xcc], xmm0
movups xmmword [esi + 0xdc], xmm0
movups xmmword [esi + 0xec], xmm0
movups xmmword [esi + 0xfc], xmm0
movups xmmword [esi + 0x10c], xmm0
movups xmmword [esi + 0x11c], xmm0
mov dword [esi + 0x18c], 0
mov dword [esi + 0x190], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100041b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov eax, dword [0x1005c00c]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, dword [0x1005d708]
mov eax, dword [esi + 0xe4]
test eax, eax
jne 0x100041e3
push 1
mov ecx, esi
call fcn.10008200
jmp 0x100042d0
cmp eax, 2
jne 0x10004283
mov eax, dword [esi + 0x170]
xor ecx, ecx
mov edx, dword [esi + 0x268]
add eax, 0xffffffb5
cmovns ecx, eax
mov dword [esi + 0x170], ecx
test edx, edx
je 0x1000425e
mov eax, dword [esi + 4]
push 2
mov dword [esp + 0x18], eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x18]
mov word [esp + 0x14], 0
push eax
push edx
lea eax, [esp + 0x28]
mov byte [esp + 0x1e], cl
push eax
push 0
push 0
push dword [esi]
mov byte [esp + 0x2f], 1
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.USER32.dll_UpdateLayeredWindow]
mov ecx, dword [esi + 0x170]
mov eax, 1
test ecx, ecx
jg 0x100042d5
mov dword [esi + 0xe4], 3
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.1001843c
mov esp, ebp
pop ebp
ret 8
cmp eax, 3
jne 0x100042d0
lea ecx, [esi + 0xec]
call fcn.10017710
mov eax, dword [esi + 0x268]
test eax, eax
je 0x100042ae
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [esi + 0x268], 0
mov ecx, esi
call fcn.10007430
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push dword [esi]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [esi + 0x18], 0
mov eax, 1
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
call fcn.1001843c
mov esp, ebp
pop ebp
ret 8
Function at 0x10008e30
Capabilities:
Parse pe header

Disassembly:
add ecx, 0xffffffdc
cmp ecx, 0x13e
ja case.0x10008e46.38
movzx eax, byte [ecx + 0x10009464]
jmp dword [eax*4 + 0x100091f4]
mov eax, 5
ret
mov eax, 6
ret
mov eax, 7
ret
mov eax, 8
ret
mov eax, 0xa
ret
mov eax, 9
ret
mov eax, 0xb
ret
mov eax, 0xc
ret
mov eax, 0xd
ret
mov eax, 0xe
ret
mov eax, 0xf
ret
mov eax, 0x10
ret
mov eax, 0x11
ret
mov eax, 0x12
ret
mov eax, 4
ret
mov eax, 2
ret
mov eax, 1
ret
mov eax, 3
ret
mov eax, 0x13
ret
mov eax, 0x14
ret
mov eax, 0x15
ret
mov eax, 0x16
ret
mov eax, 0x17
ret
mov eax, 0x1a
ret
mov eax, 0x1b
ret
mov eax, 0x18
ret
mov eax, 0x19
ret
mov eax, 0x21
ret
mov eax, 0x2d
ret
mov eax, 0x2e
ret
mov eax, 0x2f
ret
mov eax, 0x30
ret
mov eax, 0x31
ret
mov eax, 0x32
ret
mov eax, 0x33
ret
mov eax, 0x34
ret
mov eax, 0x35
ret
mov eax, 0x36
ret
mov eax, 0x37
ret
mov eax, 0x38
ret
mov eax, 0x39
ret
mov eax, 0x3a
ret
mov eax, 0x3b
ret
mov eax, 0x3c
ret
mov eax, 0x3d
ret
mov eax, 0x3e
ret
mov eax, 0x3f
ret
mov eax, 0x40
ret
mov eax, 0x41
ret
mov eax, 0x42
ret
mov eax, 0x43
ret
mov eax, 0x44
ret
mov eax, 0x45
ret
mov eax, 0x46
ret
mov eax, 0x47
ret
mov eax, 0x48
ret
mov eax, 0x49
ret
mov eax, 0x4a
ret
mov eax, 0x4b
ret
mov eax, 0x4c
ret
mov eax, 0x4d
ret
mov eax, 0x4e
ret
mov eax, 0x20
ret
mov eax, 0x22
ret
mov eax, 0x23
ret
mov eax, 0x4f
ret
mov eax, 0x53
ret
mov eax, 0x54
ret
mov eax, 0x55
ret
mov eax, 0x56
ret
mov eax, 0x57
ret
mov eax, 0x58
ret
mov eax, 0x59
ret
mov eax, 0x50
ret
mov eax, 0x51
ret
mov eax, 0x5a
ret
mov eax, 0x5b
ret
mov eax, 0x5c
ret
mov eax, 0x52
ret
mov eax, 0x5d
ret
mov eax, 0x5e
ret
mov eax, 0x63
ret
mov eax, 0x64
ret
mov eax, 0x65
ret
mov eax, 0x66
ret
mov eax, 0x79
ret
mov eax, 0x7a
ret
mov eax, 0x74
ret
mov eax, 0x75
ret
mov eax, 0x77
ret
mov eax, 0x78
ret
mov eax, 0x76
ret
mov eax, 0x73
ret
mov eax, 0x71
ret
mov eax, 0x72
ret
mov eax, 0x68
ret
mov eax, 0x69
ret
mov eax, 0x83
ret
mov eax, 0x84
ret
mov eax, 0x6c
ret
mov eax, 0x6d
ret
mov eax, 0x6e
ret
mov eax, 0x6f
ret
mov eax, 0x85
ret
mov eax, 0x86
ret
mov eax, 0x87
ret
mov eax, 0x88
ret
mov eax, 0x89
ret
mov eax, 0x8a
ret
mov eax, 0x8b
ret
mov eax, 0x8c
ret
mov eax, 0x8d
ret
mov eax, 0x8e
ret
mov eax, 0x8f
ret
mov eax, 0x90
ret
mov eax, 0x91
ret
mov eax, 0x92
ret
mov eax, 0x93
ret
mov eax, 0x94
ret
mov eax, 0x95
ret
mov eax, 0x96
ret
mov eax, 0x97
ret
mov eax, 0x98
ret
mov eax, 0x99
ret
mov eax, 0x9a
ret
mov eax, 0x9b
ret
mov eax, 0x9c
ret
mov eax, 0x9d
ret
mov eax, 0x9e
ret
mov eax, 0x9f
ret
mov eax, 0x5f
ret
mov eax, 0x60
ret
mov eax, 0x61
ret
mov eax, 0x62
ret
mov eax, 0x67
ret
mov eax, 0x6a
ret
mov eax, 0x6b
ret
mov eax, 0x7b
ret
mov eax, 0x7c
ret
mov eax, 0x7e
ret
mov eax, 0x7d
ret
mov eax, 0x7f
ret
mov eax, 0x80
ret
mov eax, 0x81
ret
mov eax, 0x82
ret
mov eax, 0x2a
ret
mov eax, 0x2b
ret
mov eax, 0x2c
ret
mov eax, 0xa0
ret
mov eax, 0xa1
ret
mov eax, 0xa2
ret
mov eax, 0xa3
ret
mov eax, 0xa4
ret
mov eax, 0xa5
ret
mov eax, 0xa6
ret
xor eax, eax
ret
Function at 0x402c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.004027e9
aaa
sar byte [ecx + 0x50], cl
lea eax, [ebp - 0x84]
push eax
call fcn.004027f9
push eax
push esi
push dword [ebp + 8]
call fcn.004027ae
add esp, 0x10
mov dword [ebp - 0xc0], eax
push 0x40
push 0x1000
push dword [ebp + 0xc]
push ebx
call dword [ebp - 0x88]
mov esi, eax
cmp esi, ebx
je 0x402fe2
push dword [ebp - 0xb4]
push dword [ebp + 0x10]
push esi
call fcn.0040275a
add esp, 0xc
cmp word [edi + 6], bx
push es

Function at 0x402df0
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x402d8e
cmp dword [eax + 0xc], ebx
je 0x402e31
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.004027e9
dec ebx
xor cl, al
in al, 0x39
pop ebp
or al, 0x75
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, ebx
je 0x402e1f
test eax, 0x80000000
lea ecx, [eax + esi]
je 0x402dfa
and eax, 0xffff
push eax
jmp 0x402dfe
add ecx, 2
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004027ae
add esp, 0xc
cmp edi, ebx
mov dword [edi], eax
je 0x402fd8
add edi, 4
add dword [ebp + 0x10], 4
jmp 0x402ddf
add dword [ebp - 0x44], 0x14
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp - 0x44]
jmp 0x402d80
call fcn.004027e9
or al, 0x88
in eax, 0x8c
mov eax, dword [edi + 0xa0]
cmp eax, ebx
je 0x402e9d
add eax, esi
Function at 0x402e80
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402e9d
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402e98
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402e82
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402e8a
cmp edx, ebx
jne 0x402fd8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402e59
add eax, dword [eax + 4]
jmp 0x402e46
mov dword [ebp + 0xc], ebx
jmp 0x402ea8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402ec0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x402ede
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x402f3c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402f23
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x402f2c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402f36
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402f18
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402ea2
invalid
invalid
invalid
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x402f89
dec eax
je 0x402f80
sub eax, 3
je 0x402f77
mov dword [ebp - 4], 0x40
jmp 0x402fa6
mov dword [ebp - 4], 4
jmp 0x402f8c
mov dword [ebp - 4], 0x20
jmp 0x402f8c
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x402fd8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402f58
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004027e9
add byte [esi], dh
dec esp
push 0x6a1475ff
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x402fe4
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4019c3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov dword [0x4040d0], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x4019d6
push esp
mov dword [ebp - 0x24], 0x4016fe
mov eax, dword [0x4040d0]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.solienty
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4040d0]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.absent
push str.solienty
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4040d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401a75
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x401a56
pop ebp
ret 0x10

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4083c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
call fcn.004084a0
mov ebx, eax
test ebx, ebx
jne 0x4083e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
test edi, edi
je 0x408414
mov eax, dword [ebp + 0xc]
sub eax, esi
mov dword [ebp + 0xc], eax
add eax, esi
mov cl, byte [esi]
xor edx, edx
rol cl, 4
div dword [ebp - 4]
mov eax, dword [ebp + 0xc]
xor cl, byte [edx + ebx]
not cl
mov byte [esi], cl
inc esi
sub edi, 1
jne 0x4083f8
push ebx
call fcn.004996db
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408430
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edx
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push edi
push edi
push 4
push edi
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
je 0x408492
push ebx
push edi
push edi
push edi
push 2
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x40848a
mov edx, dword [ebp - 8]
mov ecx, ebx
push edi
push dword [ebp - 4]
call fcn.004083c0
add esp, 8
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4084a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], 0x7863513
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
call fcn.004996e0
mov esi, eax
add esp, 4
test esi, esi
je 0x4084e8
xor edx, edx
test ebx, ebx
je 0x4084e8
sub edi, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 3
inc edx
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
mov byte [ecx], al
cmp edx, ebx
jb 0x4084d0
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret