joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42e900
sub eax, 4
mov eax, dword [eax]
lea ebx, [edi + esi]
cmp eax, ebx
jg 0x42e91a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
test eax, eax
je 0x42e915
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x42e91f
add edi, esi
mov dword [ebp - 8], edi
movzx eax, word [ebp + 0x14]
cmp ax, word [ebp + 0x10]
je 0x42e98d
xor eax, eax
mov dword [ebp - 0xc], eax
cmp esi, dword [ebp - 8]
jge 0x42e9d6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42e94b
inc dword [ebp - 0xc]
jmp 0x42e963
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x10]
jne 0x42e963
cmp dword [ebp - 0xc], 0
jle 0x42e963
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0
jne 0x42e985
xor eax, eax
jmp 0x42e981
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42e980
mov eax, esi
jmp 0x42e9d9
inc eax
cmp eax, ecx
jle 0x42e96d
inc esi
cmp esi, dword [ebp - 8]
jl 0x42e937
jmp 0x42e9d6
mov byte [ebp - 0xd], 0
cmp esi, dword [ebp - 8]
jge 0x42e9d6
mov eax, dword [ebp - 4]
mov eax, dword [eax]
movzx eax, word [eax + esi*2]
cmp ax, word [ebp + 0x14]
jne 0x42e9ae
movzx eax, byte [ebp - 0xd]
xor al, 1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
jne 0x42e9d0
xor eax, eax
jmp 0x42e9cc
movzx edi, word [edx + eax*2]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp di, word [ebx + esi*2]
jne 0x42e9cb
mov eax, esi
jmp 0x42e9d9
inc eax
cmp eax, ecx
jle 0x42e9b8
inc esi
cmp esi, dword [ebp - 8]
jl 0x42e996
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x47e73c
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x47e78a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.0047dc20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47e7a3
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x47e7ac
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0047dc20
dec esi
jne 0x47e7ce
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret

Function at 0x496b78
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
add edx, eax
cmp edx, eax
jbe 0x496b8f
movzx ebx, byte [eax]
xor ecx, ebx
imul ecx, ecx, 0x1000193
inc eax
cmp edx, eax
ja 0x496b7f
mov eax, ecx
pop ebx
ret
Function at 0x4e49f8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
xor eax, eax
push ebp
push 0x4e4ac3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, ecx
test eax, eax
je 0x4e4a1f
sub eax, 4
mov eax, dword [eax]
mov edx, eax
test edx, edx
jns 0x4e4a2a
call fcn.00408a54
mov eax, ecx
mov ecx, edx
add ecx, ecx
add ecx, eax
cmp ecx, eax
jbe 0x4e4a48
movzx ebx, word [eax]
xor edx, ebx
imul edx, edx, 0x1000193
add eax, 2
cmp ecx, eax
ja 0x4e4a36
mov ebx, edx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.004e9eb0
test al, al
je 0x4e4a93
lea ecx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.004e9204
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx]
call fcn.0040ba94
jne 0x4e4aab
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.0040afcc
jmp 0x4e4aab
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 4]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax + 0x20]
mov edx, ebx
call fcn.004e9abc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e4aca
lea eax, [ebp - 4]
call fcn.0040abdc
pop eax
jmp eax
Function at 0x515be8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x515da7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040b014
mov eax, dword [ebp - 4]
call fcn.00515534
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
jne 0x515c3a
lea eax, [ebp - 4]
mov ecx, 1
mov edx, 1
call fcn.0040bb14
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0051683c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x515d1b
xor eax, eax
push ebp
push 0x515d14
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.005157d4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 0xc]
call fcn.00515ddc
test al, al
je 0x515cf0
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 8]
xor edx, edx
call fcn.0040ad74
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x515cf0
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
call fcn.0040b6f8
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00515734
test al, al
je 0x515cea
mov eax, dword [ebp - 8]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.0040b758
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0xc]
call fcn.00515be8
dec ebx
cmp ebx, 0xffffffff
jne 0x515c99
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515d1b
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
call fcn.005157d4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
cmp byte [0x59da70], 0
je 0x515d5b
push 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x18]
and eax, 0x300
push eax
mov eax, dword [ebp - 4]
call fcn.0040b6f8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005157c0
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00515734
mov ebx, eax
jmp 0x515d82
mov eax, dword [ebp - 4]
call fcn.0040b6f8
push eax
movzx edx, byte [ebp - 0x11]
mov eax, dword [ebp - 0xc]
call fcn.005157c0
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.00515734
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515dae
lea eax, [ebp - 0x3c]
call fcn.0040abdc
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040ac3c
pop eax
jmp eax
Function at 0x515e4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x515f06
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x48]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.00515ddc
test al, al
je 0x515ee6
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040ad74
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x515ee6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b6f8
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov eax, dword [ebp - 4]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.0040b758
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x3c]
inc esi
dec ebx
jne 0x515e9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x515f0d
lea eax, [ebp - 0x2c]
call fcn.0040abdc
lea eax, [ebp - 4]
call fcn.0040abdc
pop eax
jmp eax

Function at 0x516718
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
movzx eax, byte [ebp + 8]
call fcn.0051554c
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040b6f8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edx, eax
mov eax, ebx
call fcn.00515734
test al, al
jne 0x516780
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x5966d8]
mov dl, 1
mov eax, dword [0x514318]
call fcn.004291e0
call fcn.0040a2d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x51678c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040b6f8
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edx, eax
mov eax, ebx
call fcn.00515734
test al, al
jne 0x5167ed
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0x11
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x596c50]
mov dl, 1
mov eax, dword [0x514318]
call fcn.004291e0
call fcn.0040a2d4
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0051557c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x516e04
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x516f30
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.005157d4
xor eax, eax
push ebp
push 0x516f09
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00515ddc
test al, al
je 0x516eeb
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00516cdc
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040ad74
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x516eeb
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b6f8
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00515734
test al, al
je 0x516ee7
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.0040b758
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00516cdc
pop ecx
inc edi
dec ebx
jne 0x516e8f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x516f10
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.005157d4
pop eax
jmp eax
Function at 0x516f40
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x517198
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.005157d4
xor eax, eax
push ebp
push 0x51716c
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00515ddc
test al, al
je 0x51714e
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040ad74
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x51714e
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b6f8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00515734
test al, al
je 0x517142
mov eax, dword [ebp - 4]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b758
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0051683c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x517142
xor eax, eax
push ebp
push 0x51713b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.005157d4
xor eax, eax
push ebp
push 0x51711b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b758
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.005157d8
mov eax, dword [ebp - 4]
call fcn.0040b6f8
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b758
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0051683c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x5170f6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00516e04
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00516f40
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5170fd
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x516fcb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x517173
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.005157d4
pop eax
jmp eax
Function at 0x52581c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040abdc
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x52584d
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040ad74
add esp, 0x24
pop ebx
ret

Function at 0x52bf5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, dword [0x52a28c]
call fcn.0040912c
test al, al
je 0x52c075
mov edx, dword [ebx + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [eax]
call dword [ecx + 8]
mov edx, dword [ebx + 0x54]
mov eax, dword [esi + 0x54]
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esi + 8]
mov edx, dword [ebx + 8]
call fcn.0040afcc
lea eax, [esi + 0x10]
mov edx, dword [ebx + 0x10]
call fcn.0040afcc
lea eax, [esi + 0x14]
mov edx, dword [ebx + 0x14]
call fcn.0040afcc
lea eax, [esi + 0x18]
mov edx, dword [ebx + 0x18]
call fcn.0040afcc
lea eax, [esi + 0x1c]
mov edx, dword [ebx + 0x1c]
call fcn.0040afcc
lea eax, [esi + 0x20]
mov edx, dword [ebx + 0x20]
call fcn.0040afcc
lea eax, [esi + 0x4c]
mov edx, dword [ebx + 0x4c]
call fcn.0040afcc
lea eax, [esi + 0x50]
mov edx, dword [ebx + 0x50]
call fcn.0040afcc
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebx + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [ebx + 0x30]
mov dword [esi + 0x30], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x34], eax
mov eax, dword [ebx + 0x38]
mov dword [esi + 0x38], eax
mov eax, dword [ebx + 0x3c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 0x40], eax
mov eax, dword [ebx + 0x44]
mov dword [esi + 0x44], eax
lea eax, [esi + 0x48]
mov edx, dword [ebx + 0x48]
call fcn.0040afcc
mov eax, dword [ebx + 0x58]
mov dword [esi + 0x58], eax
mov eax, dword [ebx + 0x5c]
mov dword [esi + 0x5c], eax
lea eax, [esi + 0x68]
mov edx, dword [ebx + 0x68]
call fcn.0040afcc
mov eax, dword [ebx + 0x60]
mov dword [esi + 0x60], eax
mov eax, dword [ebx + 0x64]
mov dword [esi + 0x64], eax
mov eax, dword [ebx + 0x70]
mov dword [esi + 0x70], eax
mov eax, dword [ebx + 0x74]
mov dword [esi + 0x74], eax
lea eax, [esi + 0x78]
mov edx, dword [ebx + 0x78]
call fcn.0040afcc
movzx eax, byte [ebx + 0x7c]
mov byte [esi + 0x7c], al
lea eax, [esi + 0x80]
mov edx, dword [ebx + 0x80]
call fcn.0040afcc
pop esi
pop ebx
ret
mov edx, esi
mov eax, ebx
call fcn.0046a54c
pop esi
pop ebx
ret
Function at 0x54fc84
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x54fc8c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54fe43
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x54fe5c
call fcn.0040b95c
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0054d844
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x54fe70
call fcn.004f468c
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x54fd07
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54fd48
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0054d844
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x54fed8
call fcn.004f468c
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b904
mov eax, esi
mov edx, 0x54ff04
call fcn.0040b904
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x54fd60
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54fdce
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x54ff18
call fcn.004f468c
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b904
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x54fd97
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54fdc2
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x54ff48
call fcn.004f468c
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b904
mov eax, esi
mov edx, 0x54ff04
call fcn.0040b904
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x54fdda
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x54fe05
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x54ff74
call fcn.004f468c
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b904
mov eax, esi
mov edx, 0x54ff04
call fcn.0040b904
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54fe4a
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040ac3c
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040ac3c
lea eax, [ebp - 4]
call fcn.0040abdc
pop eax
jmp eax
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x7c5e4ae0
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x78a07d92
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219