joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057360
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push esi
mov esi, dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101b4344
mov dword [ebx], 0
call esi
cmp eax, 0xfffffffe
jne 0x100573ed
push edi
push 0
push 1
push 0x101bab94
call esi
cmp eax, 1
jne 0x100573aa
mov edi, dword [sym.imp.kernel32.dll_Sleep]
push 1
call edi
push 0
push 1
push 0x101bab94
call esi
cmp eax, 1
je 0x10057396
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0x101b4344
call esi
mov edi, dword [sym.imp.kernel32.dll_InterlockedExchange]
mov esi, eax
cmp esi, 0xfffffffe
jne 0x100573d7
call dword [sym.imp.kernel32.dll_TlsAlloc]
mov esi, eax
cmp esi, 0xffffffff
je 0x100573d7
push esi
push 0x101b4344
call edi
push 0
push 0x101bab94
call edi
pop edi
cmp esi, 0xffffffff
jne 0x100573ed
mov eax, 0x8007000e
pop esi
ret
mov eax, dword [0x101b4344]
test eax, eax
jl 0x10057411
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
je 0x10057411
inc dword [eax + 0x12c]
mov dword [ebx], 1
xor eax, eax
pop esi
ret
push 0x130
call sub.msvcrt.dll_malloc
mov esi, eax
add esp, 4
test esi, esi
je 0x100573e6
push 0x130
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [esi + 0x12c], 1
mov dword [ebx], 1
mov eax, dword [0x101b4344]
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
xor eax, eax
pop esi
ret

Function at 0x1005c8c0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101b4344]
test eax, eax
jge 0x1005c8cd
xor eax, eax
jmp 0x1005c8d4
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
xor ecx, ecx
lea edx, [eax + 0x24]
lea esp, [esp]
cmp dword [ecx*4 + 0x10020564], edi
jne 0x1005c8ee
cmp dword [edx], 0
jne 0x1005c903
inc ecx
add edx, 8
cmp ecx, 0xf
jb 0x1005c8e0
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.100e0a00
ret
mov edx, dword [eax + ecx*8 + 0x24]
test edx, edx
je 0x1005c925
push esi
mov esi, dword [edx]
mov dword [eax + ecx*8 + 0x24], esi
test esi, esi
pop esi
jne 0x1005c91f
mov dword [eax + ecx*8 + 0x28], 0
mov dword [edx], 0xfefefefe
cmp ecx, 0xf
jb 0x1005c936
mov ecx, dword [eax + 0x20]
push 0x10
push edi
call fcn.100e0a00
ret
mov eax, edx
ret

Function at 0x1005d560
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x1005d5b4
mov eax, dword [0x101b4344]
push ebx
push edi
test eax, eax
jge 0x1005d573
xor ebx, ebx
jmp 0x1005d57c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov edi, dword [esi + 4]
mov eax, dword [edi*4 + 0x10020564]
push eax
push 0xfe
push esi
call sub.msvcrt.dll_memset
lea ecx, [ebx + edi*8 + 0x28]
mov dword [esi], 0
mov eax, dword [ecx]
add esp, 0xc
test eax, eax
je 0x1005d5ac
pop edi
mov dword [eax], esi
mov dword [ecx], esi
pop ebx
ret
mov dword [ebx + edi*8 + 0x24], esi
pop edi
mov dword [ecx], esi
pop ebx
ret
Function at 0x1007a6d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
push edi
mov dword [esi + 0x48], ebx
cmp byte [esi + 0x4c], bl
je 0x1007a707
mov edi, dword [esi + 0x40]
cmp edi, ebx
je 0x1007a704
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a6f2
xor eax, eax
jmp 0x1007a6f9
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x4c], bl
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x38], ebx
cmp byte [esi + 0x3c], bl
je 0x1007a73e
mov edi, dword [esi + 0x30]
cmp edi, ebx
je 0x1007a73b
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a729
xor eax, eax
jmp 0x1007a730
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x3c], bl
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov edx, dword [esi + 0x20]
mov eax, dword [esi + 0x28]
push edx
xor ecx, ecx
call fcn.100e0a00
mov dword [esi + 0x28], ebx
cmp byte [esi + 0x2c], bl
je 0x1007a783
mov edi, dword [esi + 0x20]
cmp edi, ebx
je 0x1007a780
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a76e
xor eax, eax
jmp 0x1007a775
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push ebx
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x2c], bl
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 0x18]
push ecx
xor ecx, ecx
call fcn.100e0a00
mov dword [esi + 0x18], ebx
cmp byte [esi + 0x1c], bl
je 0x1007a7c8
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x1007a7c5
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a7b3
xor eax, eax
jmp 0x1007a7ba
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push edi
push ebx
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x1c], bl
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov eax, dword [esi]
push eax
mov eax, dword [esi + 8]
xor ecx, ecx
call fcn.100e0a00
mov dword [esi + 8], ebx
cmp byte [esi + 0xc], bl
je 0x1007a80b
mov edi, dword [esi]
cmp edi, ebx
je 0x1007a808
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1007a7f6
xor eax, eax
jmp 0x1007a7fd
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], bl
pop edi
mov dword [esi + 4], ebx
mov dword [esi], ebx
pop ebx
ret
Function at 0x1009e310
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
mov dword [esi], 0x10036fb0
mov eax, dword [esi + 0x12740]
push eax
mov eax, dword [esi + 0x12748]
xor ecx, ecx
call fcn.100e0a00
xor ebx, ebx
mov dword [esi + 0x12748], ebx
cmp byte [esi + 0x1274c], bl
je 0x1009e371
push edi
mov edi, dword [esi + 0x12740]
cmp edi, ebx
je 0x1009e36a
mov eax, dword [0x101b4344]
cmp eax, ebx
jge 0x1009e358
xor eax, eax
jmp 0x1009e35f
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push edi
push ebx
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0x1274c], bl
pop edi
mov dword [esi + 0x12740], ebx
mov dword [esi + 0x12744], ebx
mov ecx, esi
pop esi
pop ebx
jmp fcn.1007a820

Function at 0x100bb460
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x1c]
push edi
xor edi, edi
cmp esi, edi
je 0x100bb48f
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb47d
xor eax, eax
jmp 0x100bb484
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x20]
mov dword [ebx + 0x1c], edi
cmp esi, edi
je 0x100bb4b8
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4a6
xor eax, eax
jmp 0x100bb4ad
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push edi
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x24]
mov dword [ebx + 0x20], edi
cmp esi, edi
je 0x100bb4e1
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4cf
xor eax, eax
jmp 0x100bb4d6
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
push esi
push edi
push edx
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0x2c]
mov dword [ebx + 0x24], edi
cmp esi, edi
je 0x100bb50a
mov eax, dword [0x101b4344]
cmp eax, edi
jge 0x100bb4f8
xor eax, eax
jmp 0x100bb4ff
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push esi
push edi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov dword [ebx + 0x2c], edi
lea edi, [ebx + 0x1ac]
call fcn.100c4f40
push 0xd4
push 0
add ebx, 0x1bc
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x100bb540
Capabilities:
Get thread local storage value

Disassembly:
mov ecx, dword [ebx + 8]
push esi
xor esi, esi
push edi
cmp ecx, esi
je 0x100bb553
mov eax, dword [ecx]
mov edx, dword [eax]
push 1
call edx
mov edi, dword [ebx + 0x1a8]
mov dword [ebx + 8], esi
cmp edi, esi
je 0x100bb578
call fcn.100d2010
lea esi, [edi + 0x24]
call fcn.100d37e0
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
xor esi, esi
mov dword [ebx + 0x1a8], esi
cmp byte [ebx + 0x1a4], 0
mov dword [ebx + 0x1a0], esi
je 0x100bb5bd
mov edi, dword [ebx + 0x198]
cmp edi, esi
je 0x100bb5b6
mov eax, dword [0x101b4344]
cmp eax, esi
jge 0x100bb5a4
xor eax, eax
jmp 0x100bb5ab
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push esi
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [ebx + 0x1a4], 0
pop edi
mov dword [ebx + 0x198], esi
mov dword [ebx + 0x19c], esi
mov eax, ebx
pop esi
jmp fcn.100bb460

Function at 0x100d1c00
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 4], ebx
jbe 0x100d1c2c
push edi
xor edi, edi
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + edi + 0x10]
test ecx, ecx
je 0x100d1c22
push 1
call fcn.100e0a00
inc ebx
add edi, 0x18
cmp ebx, dword [esi + 4]
jb 0x100d1c10
pop edi
mov esi, dword [esi + 0xc]
test esi, esi
je 0x100d1c5f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x100d1c4c
xor eax, eax
mov ecx, dword [eax]
push esi
push eax
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, dword [eax]
push esi
push 0
push ecx
call dword [sym.imp.kernel32.dll_HeapFree]
pop esi
pop ebx
ret

Function at 0x100d2200
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
test eax, eax
jne 0x100d225f
lea ecx, [ecx]
cmp dword [eax*4 + 0x10021340], edi
jae 0x100d2221
inc eax
cmp eax, 0x1c
jb 0x100d2210
jmp 0x100d2228
mov edi, dword [eax*4 + 0x10021340]
mov eax, dword [0x101b4344]
test eax, eax
jge 0x100d2235
xor eax, eax
jmp 0x100d223c
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edx, dword [eax]
lea ecx, [edi*4]
push ecx
push 0
push edx
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
jne 0x100d225c
mov eax, 0x8007000e
pop edi
pop esi
pop ecx
ret
mov dword [esi + 0x34], eax
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edi
push ecx
mov ecx, eax
add esi, 0x24
mov eax, edi
call fcn.100e0a00
pop edi
pop esi
pop ecx
ret
Function at 0x100e0a00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100e0a0f
pop dword [ebp - 0x10]
mov eax, 0xb28a9760
sub eax, 0xa27c8d51
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x6b1bb
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x4153
mov edi, eax
mov edx, 0x67a7d1da
sub edx, 0x578b57da
add edx, dword [ebp - 0x10]
mov esi, 0xb22579e
sub esi, 0x3fab4106
xor dword [ebp - 0xc], 0x1c723e61
mov ebx, dword [edx]
add dword [ebp - 4], 0xe6a92d8e
add ebx, esi
add dword [ebp - 4], 0x33c6e6bc
mov dword [edi], ebx
sub dword [ebp - 8], eax
add edi, 0x39ee93d2
add edi, 0xc6116c32
add edx, 0x3397026c
sub edx, 0x33970268
loop 0x100e0a63
add eax, 0xfeabcac3
add eax, 0x1552d5c
mov ebx, eax
add eax, 0x4b5936c5
add eax, 0xb4a6c940
mov ecx, 0x10000000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x10124420
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [esi + 0xc], 0
mov dword [esi + 8], 0
je 0x10124459
push edi
mov edi, dword [esi]
test edi, edi
je 0x10124454
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10124441
xor eax, eax
jmp 0x10124448
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov eax, dword [eax]
push edi
push 0
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov byte [esi + 0xc], 0
pop edi
push esi
mov dword [esi], 0
mov dword [esi + 4], 0
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
ret

Function at 0x10127c70
Capabilities:
Get thread local storage value

Disassembly:
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10127c7d
xor eax, eax
jmp 0x10127c84
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
cmp dword [eax + 0xc], 0
je 0x10127ca9
mov ecx, dword [eax + 0xc]
test ecx, ecx
jne 0x10127c94
xor eax, eax
ret
mov edx, dword [ecx]
mov dword [eax + 0xc], edx
test edx, edx
jne 0x10127ca0
mov dword [eax + 0x10], edx
mov dword [ecx], 0xfefefefe
mov eax, ecx
ret
mov ecx, dword [eax + 8]
push 0x10
push 0x100
call fcn.100e0a00
ret

Function at 0x10127cc0
Capabilities:
Get thread local storage value

Disassembly:
test esi, esi
je 0x10127d09
mov eax, dword [0x101b4344]
push edi
test eax, eax
jge 0x10127cd2
xor edi, edi
jmp 0x10127cdb
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov edi, eax
push 0x100
push 0xfe
push esi
call sub.msvcrt.dll_memset
mov dword [esi], 0
mov eax, dword [edi + 0x10]
add esp, 0xc
test eax, eax
je 0x10127d02
mov dword [eax], esi
mov dword [edi + 0x10], esi
pop edi
ret
mov dword [edi + 0xc], esi
mov dword [edi + 0x10], esi
pop edi
ret

Function at 0x10131f10
Capabilities:
Get thread local storage value

Disassembly:
cmp word [esi + 0x40], 0
push edi
mov edi, dword [sym.imp.kernel32.dll_TlsGetValue]
je 0x10131f5f
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10131f2b
xor eax, eax
jmp 0x10131f2e
push eax
call edi
movzx ecx, word [esi + 0x40]
cmp ecx, dword [eax + 0x128]
ja 0x10131f56
mov edx, dword [esi + 4]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10131f56
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x40], dx
mov dword [esi + 4], edx
cmp word [esi + 0x42], 0
je 0x10131fa7
mov eax, dword [0x101b4344]
test eax, eax
jge 0x10131f73
xor eax, eax
jmp 0x10131f76
push eax
call edi
movzx ecx, word [esi + 0x42]
cmp ecx, dword [eax + 0x128]
ja 0x10131f9e
mov edx, dword [esi + 0xc]
mov eax, dword [eax + 0x124]
shl ecx, 4
lea eax, [ecx + eax - 0x10]
test edx, edx
je 0x10131f9e
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov dword [eax + 4], edx
xor edx, edx
mov word [esi + 0x42], dx
mov dword [esi + 0xc], edx
pop edi
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x402bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404840], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
mov dword [0x4047cc], 0
mov dword [0x4047d0], 0
mov dword [0x4047c8], 0x402f50
jmp 0x402c23
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4047e0], 0xf
mov dword [0x4047e8], 0x404767
mov dword [0x404104], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.litform
push str.ndcls
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
xor eax, eax
jmp 0x402cc2
push eax
push dword [0x404838]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4047f0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402d08
push 0x4047f0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4047f0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402cdb
mov eax, dword [0x4047f8]
jmp 0x402d15
call 0x4022b2
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405195
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x4051a4
pop dword [ebp - 0xc]
mov eax, 0xfde5d334
sub eax, 0xfda58190
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x50682
push 0
mov eax, 0x1b19d761
sub eax, 0x1ad524a5
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x494d
mov ebx, eax
mov edi, 0x5e0b0ed4
sub edi, 0x5dc290d4
add edi, dword [ebp - 0xc]
mov edx, 0x80d23e04
sub edx, 0xf38ca217
mov esi, dword [edi]
xor dword [ebp - 8], 0xca72c25
sub esi, edx
add dword [ebp - 8], 0xa24d5e58
mov dword [ebx], esi
xor dword [ebp - 4], ebx
add ebx, 4
add edi, 4
loop 0x4051fd
add eax, 0xb21440a4
add eax, 0x4decd763
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x405d43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x405d52
pop dword [ebp - 0x20]
mov eax, 0x405d52
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xce55d17c
sub dword [ebp - 0x30], 0x80038c31
mov dword [ebp - 0x2c], 0x4239a5b1
add dword [ebp - 0x2c], 0xeff9a694
mov dword [ebp - 0x28], 0xb1456d2a
sub dword [ebp - 0x28], 0x64f928fc
mov dword [ebp - 0x24], 0xfe4ad629
add dword [ebp - 0x24], 0x1b529d7
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xf3640d28
sub dword [ebp - 0x30], 0x7ef1a3d2
mov dword [ebp - 0x2c], 0xbce2c72d
add dword [ebp - 0x2c], 0x84899a48
mov dword [ebp - 0x28], 0xb02d1f0d
add dword [ebp - 0x28], 0xb3424d5f
mov dword [ebp - 0x24], 0x1508cb84
add dword [ebp - 0x24], 0xeaf7347c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x62fd4562
add eax, 0x9d432bae
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x39edd
push 0
call eax
mov ecx, 0x53ed
xor edx, edx
add edx, eax
mov edi, 0x41b1a271
sub edi, 0x416e4271
add edi, dword [ebp - 0x20]
mov esi, 0x234a881a
mov dword [ebp - 0x10], 0xdf9da385
mov ebx, dword [edi]
xor dword [ebp - 4], 0xac2c3fac
add ebx, esi
mov dword [edx], ebx
sub dword [ebp - 0x14], edx
add edx, 0xd16424c6
sub edx, 0xd16424c2
add edi, 4
loop 0x405e60
add eax, 0xb019c6a1
add eax, 0x4fe77be6
xor ebx, ebx
add ebx, eax
add eax, 0x892bf034
add eax, 0x76d40fd1
mov ecx, 0x4cabf909
sub ecx, 0x4c6bf909
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x406120
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422af4], 0
push esi
jne 0x406157
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406131
mov dword [ecx*4 + 0x422af0], eax
inc ecx
cmp ecx, 0x100
jl 0x40612c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406188
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422af0]
xor eax, esi
inc ecx
dec edx
jne 0x40616a
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x33b016ff
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6f8a7b5d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219