joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10049f25
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1005e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x10049f68
call fcn.1002e82b
mov dword [eax], 0xf
call fcn.1002e83e
mov dword [eax], 0xd
call fcn.1002b1ff
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10026726
leave
ret
test eax, eax
jne 0x10049f6f
inc eax
jmp 0x10049f5c
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x10049f5a
xor eax, eax
cmp ecx, 1
setne al
jmp 0x10049f5c
Function at 0x1004c8e1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1004c85d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004ca50
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004ca50
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004ca05
jg 0x1004c93d
test eax, eax
je 0x1004c9fb
push 1
push 0x1000
call fcn.1003c7e2
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004c960
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004c9f2
push 0x8000
push ebx
call fcn.1004c78e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004c989
jg 0x1004c984
cmp ecx, 0x1000
jb 0x1004c989
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1003e332
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004c9ce
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004c984
jl 0x1004c9b5
test ecx, ecx
jne 0x1004c976
push dword [ebp - 0xc]
push ebx
call fcn.1004c78e
push esi
call fcn.1003c83f
add esp, 0xc
xor ebx, ebx
jmp 0x1004ca5e
cmp byte [edi + 0x24], 0
je 0x1004c9e5
cmp dword [edi + 0x20], 5
jne 0x1004c9e5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004c9f0
mov ebx, dword [edi + 0x18]
jmp 0x1004c9f2
xor ebx, ebx
push esi
call fcn.1003c83f
pop ecx
jmp 0x1004ca5e
test ecx, ecx
jg 0x1004c9c7
jl 0x1004ca05
test eax, eax
jae 0x1004c9c7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1003fcd7
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004ca25
cmp byte [edi + 0x1c], 0
je 0x1004c9c7
jmp 0x1004ca56
push ebx
call fcn.10041821
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004c9c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1004ca5e
cmp byte [edi + 0x1c], 0
je 0x1004ca5b
mov ebx, dword [edi + 0x18]
jmp 0x1004ca5e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1003fcd7
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004d920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004d94d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004d94d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x78139847
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x781c19c8]
jne 0x78139851
repz ret
jmp sym.MSVCR80.dll___report_gsfailure

Function at 0x78144ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x78144cef
pop dword [ebp - 0x40]
mov eax, 0x372125d0
add eax, 0x40f3271f
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x46d3a
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x5a21
mov edx, eax
mov ebx, 0x425645c1
sub ebx, 0xca3995c1
add ebx, dword [ebp - 0x40]
mov edi, 0x700e0402
xor dword [ebp - 0x18], 0x5303d52b
mov esi, dword [ebx]
add esi, edi
mov dword [edx], esi
sub dword [ebp - 0x34], 0x845c7e5a
add edx, 0x51bcaf4e
add edx, 0xae4350b6
add ebx, 4
loop 0x78144d3d
add eax, 0xee6bafcc
add eax, 0x1195ab8b
mov ebx, eax
add eax, 0xdcd19916
add eax, 0x232e66ef
mov ecx, 0x5949ac63
sub ecx, 0xe136ac63
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x7815472c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154759
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x78154735
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154788
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
call sym.MSVCR80.dll__errno
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x781547af
test al, 1
je 0x781547af
test byte [esp + 0xc], 2
je 0x781547af
call sym.MSVCR80.dll___doserrno
mov dword [eax], 5
call sym.MSVCR80.dll__errno
mov dword [eax], 0xd
jmp 0x7815477f
xor eax, eax
pop esi
ret

Function at 0x78154a51
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x78154a7e
call sym.MSVCR80.dll___doserrno
mov dword [eax], esi
call sym.MSVCR80.dll__errno
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call sym.MSVCR80.dll_memcpy
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x78154a9c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
call sym.MSVCR80.dll__dosmaperr
pop ecx
jmp 0x78154a79
test byte [esp + 0xc], 0x80
je 0x78154aa8
and eax, 0xfffffffe
jmp 0x78154aab
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test eax, eax
je 0x78154a8d
xor eax, eax
pop esi
ret
Function at 0x10008a45
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10008a54
pop dword [ebp - 0x28]
mov eax, 0x90347587
add eax, 0x7fcc14cd
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x404de
push 0
mov eax, 0x46d97aec
sub eax, 0x36d68990
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x7e9a68e3
sub ecx, 0x7e9a209e
xor edx, edx
add edx, eax
mov esi, 0x4510b6c4
add esi, 0xcaf3f53c
add esi, dword [ebp - 0x28]
mov ebx, 0xfcf1974d
xor dword [ebp - 0xc], 0xd5df1da1
mov edi, dword [esi]
xor edi, ebx
mov dword [ebp - 0xc], 0x3b94f829
mov dword [edx], edi
xor dword [ebp - 0x14], esi
add edx, 0xb24cedae
sub edx, 0xb24cedaa
add esi, 4
loop 0x10008aaf
add eax, 0xb14bd9fe
add eax, 0x4eb539e9
xor ebx, ebx
add ebx, eax
add eax, 0x7e135a7b
add eax, 0x81eca58a
mov ecx, 0x10000000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1000cd31
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x1002cd97
call fcn.10017073
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x1000cdae
push 2
push esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x1000cdae
call fcn.10005a99
mov esi, eax
jmp 0x1000ce85
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.kernel32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x1000cdd1
call fcn.10005a99
jmp 0x1000ce78
push ebx
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x1000cdc7
push ebx
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x1000ce01
mov esi, 0x8007000e
jmp 0x1000ce7a
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.10008a45
jmp 0x1000ce27
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x1000cdfa
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x1000cdc7
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.10008a45
mov esi, eax
test edi, edi
je 0x1000ce85
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x1000ce9e
lea ecx, [ebp - 0x418]
call fcn.1000c4af
mov eax, esi
call fcn.10016fc0
ret 0x10
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10008a45
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax - 0x6f6f6fb0], edx
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4d1d64b0
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x5fd21d19
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x404f30
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x443d09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x514
push ebx
push ebp
push esi
push edi
mov ebp, ecx
or esi, 0xffffffff
mov dword [esp + 0x14], ebp
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp], 0x447530
mov dword [esp + 0x52c], ebx
mov dword [ebp + 0x20], esi
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
lea ecx, [ebp + 0x28]
mov byte [esp + 0x544], 1
call fcn.0043eae4
mov dword [ebp + 0x60], esi
push ebx
push ebx
push 1
push ebx
mov byte [ebp + 0x40], bl
mov byte [ebp + 0x41], bl
mov byte [ebp + 0x25], bl
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x1c], ebx
mov byte [ebp + 0x866], bl
mov dword [ebp + 0xc], ebx
mov byte [ebp + 0x864], bl
mov byte [ebp + 0x865], bl
mov byte [ebp + 0x24], bl
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [ebp + 0x20], eax
push 0x447520
mov byte [ebp + 0x874], bl
mov ecx, 7
mov esi, str.shaiya_kami.com
mov edi, 0x45b9c0
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x104
mov ecx, 0x41
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
push eax
push 0x447068
push str.TEST_IP
push str.LOGIN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4050eb
mov edi, str.GERMANY
lea esi, [esp + 0x18]
mov ecx, 8
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x4050eb
push 0x44743c
push str.UpdaterURL.txt
call fcn.00420e8c
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40506d
push ebx
push str.Error
push str.Cant_Find_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420c7b
xor eax, eax
mov ecx, 0x80
lea edi, [esp + 0x120]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x120]
push eax
push 0x4470ac
push esi
call fcn.00420e9f
lea eax, [esp + 0x12c]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4050a0
sub eax, edx
cmp eax, 1
jae 0x4050c6
push ebx
push str.Error
push str.Cant_Read_UpdaterURL.txt
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00420c7b
xor eax, eax
jmp 0x4050d0
mov cl, byte [esp + eax + 0x120]
mov byte [eax + 0x45b9c0], cl
inc eax
cmp cl, bl
jne 0x4050d0
push esi
call fcn.00420ddf
add esp, 4
mov ecx, dword [esp + 0x524]
pop edi
mov eax, ebp
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4498ea
Capabilities:
Encode data using xor

Disassembly:
adc dword [esi + 0x69], ebp
add byte [edi], bh
popal
pop ds
xchg ebx, eax
aaa
and al, 0xff
popal
cmp ah, bl
adc eax, 0x6d0c15a1
mov dword [ecx], esi
fisub word [edx - 0x5770ebfd]
js 0x44986a
pushal
add byte [ecx - 0x45646e60], 0x5d
mov al, byte [0xcadca5ee]
in eax, 0
stosb byte es:[edi], al
fbstp tbyte [edi + 0xc]
adc bh, byte [edx + esi + 0x46]
aaa
xor byte [ecx - 0x3c], al
push ebx
mov eax, dword [0xa0feb1f6]
xchg dword cs:[ebx], ecx
pop esp
aam 0xb0
das
movsd dword es:[edi], dword [esi]
jg 0x4498ba
xchg ecx, eax
dec edx
stosd dword es:[edi], eax
add byte [eax - 0xec47e1], ch
movsd dword es:[edi], dword [esi]
rcl al, cl
shl byte [ebx], 0x50
ror eax, 1
xchg esp, eax
adc dh, ah
aas
lodsb al, byte [esi]
mov esp, 0x8e90ff81
inc ecx
and al, al
inc esi
xchg edi, eax
insd dword es:[edi], dx
push edx
dec ebp
pop edi
test byte [esi + 0x70], 0x1e
adc byte [edi], dl
xor dl, byte [ebx]
inc ecx
pop esi
mov eax, 0xbe755712
mov edx, 0xac7317b1
dec eax
lcall 0x1f94, 0xe240401e
adc dword [ecx + edx*8 + 0xb], 0x30778f11
je 0x449919
movsb byte es:[edi], byte [esi]
xor dword [ecx + 0x27], 0x6d
mov esp, 0x7cf09667
rcl bl, 1
lodsd eax, dword [esi]
loope 0x449948
aad 0xa6
movsb byte es:[edi], byte [esi]
mov cl, 0xcf
xor eax, 0x1606c92
arpl bx, sp
les esp, [ecx]
lodsb al, byte [esi]
pop esi
jne 0x44998a
rcr dword [ecx - 0x3a], cl
popal
add byte [0xd0f09710], 0xa3
push eax
imul ecx, dword [esi], 0xc
and dword [ecx - 0xfee8548], esi
inc eax
bndstx [eax + edx], bnd2
loope 0x4499c0
shl byte [ecx], 1
aad 0x4a
test dh, 0x2f
into
das
movsb byte es:[edi], byte [esi]
xchg ebx, eax
pop eax
ja 0x44999f
cmp cl, byte [edi - 9]
adc ebx, eax
pop esi
inc esi
test al, 0xc5
fmul dword [esi - 0x1f]
push eax
out 0x93, eax
xchg ebx, eax
imul esi, dword [edx], 0xc0ee3737
pop esi
xlatb
mov al, 0x59
push ecx
cli
aad 0x23
sub al, 0xfc
imul ecx, dword [eax - 0x5b5a79a9], 1
rcl ch, 0xa1

Function at 0x50d8ee
Capabilities:
Authenticate hmac

Disassembly:
sbb dword [esi], eax
jo fcn.0050d92e
sal byte [ebx + 0x7e], 0xe1
loope fcn.0050d96e
dec eax
call ecx
scasd eax, dword es:[edi]
invalid
sahf

Function at 0x50d90e
Capabilities:
Authenticate hmac

Disassembly:
insd dword es:[edi], dx
adc ebx, dword [eax]
adc dword [edi - 0x422ca6cc], 0x35
xchg ebx, eax
mov dl, 0x36
bound ebp, qword [esi + 0x27efd88f]
fsubr st(7)
daa
out dx, al
jmp 0x50d946
pop ebp
Function at 0x52b66a
Capabilities:
Encode data using xor

Disassembly:
test dword [ecx - 0x4c], edi
insd dword es:[edi], dx
jg 0x52b681
pop ds
daa
ror dword cs:[ebp + 0x52], cl
cmp dword gs:[ebp + 0x76], ecx
xchg edi, eax
clc
mov ecx, 0x10c06aa1
rcl byte [eax], 0xdc
sbb dword [eax - 0x84641dd], 0xffffffef
fadd qword [ebx - 0x4641dc68]
imul edi
salc
xor eax, 0x92129638
sbb dword [ebp + 0x42e630fa], edi
jnp 0x52b67f
pop edx
out dx, eax
xor cl, ch
mov dword [ecx - 0x25], ebp
dec esi
xchg dl, al
push es
mov edx, dword [ecx]
mov ecx, 0xcfbbb2c7
xor ebx, ebp
imul edi, dword [ebp + 0x5d], 0xfe70961c
jno 0x52b6e8
cmp esi, ebp
sbb byte [ebp + esi*2 + 0x29], bh
cmp eax, 0x36ee6ab7
sub ecx, dword [ebp + 0x7e9f5477]
push edi
cmp eax, dword [esi + ecx + 0x4a]
dec ebp
mul byte [eax + 0xb384019]
out 0x8d, al
in eax, dx
insb byte es:[edi], dx
fcomp st(4)
int 0xa5
mov dh, 0xc3
push edi
test eax, 0x86d2a38d
jb fcn.0052b66a
and eax, 0x16b5523f
retf

Function at 0x55eac2
Capabilities:
Encode data using xor

Disassembly:
xlatb
and dword [esi + edx*4], esp
ret
sbb byte [esi - 0x1f], cl
popfd
aad 0xaa
stosb byte es:[edi], al
xchg edi, eax
xor eax, 0x55964481
pop edi
insb byte es:[edi], dx
je 0x55eab4
into
mov edi, edx
pop ebp
ja 0x55ea8a
jge 0x55eaaf
adc eax, ebp
ja 0x55ea6e
mov ebx, 0x55bc31e6
invalid

Function at 0x63c2e4
Capabilities:
Encode data using xor

Disassembly:
shl dword [ebp + ebx*2 + 0x2b09feb4], 0x91
test byte [edi + ebx + 0xbf7dea3], ch
sar dword [ebp - 0x28047813], 0x69
add dword [edi], eax
invalid
jge 0x63c2c2
push esp
dec eax
imul edi, dword [eax + 0x76b1acfc], 0x52
pop esp
test eax, 0xeb7027e8
and eax, 0xfe04db60
add al, 0xfe
xor dword [esi + 0x3a], esp
frstor dword [ebp - 0x53af605]
jae 0x63c2f8
sub byte [eax + 0x27859b6d], 0xad
sub ebp, esp
mov al, 0xbf
dec ecx
leave
push ebx
insb byte es:[edi], dx
retf
Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
mov ecx, 0x5ccf60e2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x716c4cce
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x1001b070
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x20]
xor eax, eax
mov dword [esp + 0x10], eax
test ecx, ecx
jle 0x1001b166
movsd xmm2, qword [0x10072248]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mov ecx, dword [esp + 0x18]
push esi
push edi
divsd xmm2, xmm0
movsd qword [esp + 0x10], xmm2
movd xmm0, eax
xor esi, esi
cvtdq2pd xmm0, xmm0
mov edi, ecx
mulsd xmm0, qword [0x10072258]
addsd xmm0, qword [0x10072250]
movsd qword [esp + 8], xmm0
nop word [eax + eax]
lea eax, [esi - 6]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm0
mulsd xmm1, xmm2
movaps xmm0, xmm1
call fcn.1006af30
mov eax, dword [esp + 0x24]
lea edi, [edi + 8]
movaps xmm3, xmm0
movaps xmm2, xmm3
shufpd xmm2, xmm3, 1
movss xmm1, dword [eax + esi*4]
cvtps2pd xmm1, xmm1
mulsd xmm2, xmm1
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm2
movsd xmm2, qword [esp + 0x10]
movss dword [edi - 8], xmm1
movss xmm0, dword [eax + esi*4]
inc esi
cvtps2pd xmm0, xmm0
mulsd xmm3, xmm0
xorps xmm0, xmm0
xorps xmm3, xmmword [0x100722a0]
cvtsd2ss xmm0, xmm3
movss dword [edi - 4], xmm0
movsd xmm0, qword [esp + 8]
cmp esi, 7
jl 0x1001b0d0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
inc eax
add ecx, 0x40
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ecx
cmp eax, dword [esp + 0x28]
jl 0x1001b0a5
pop edi
pop esi
add esp, 0x14
ret