joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424b18
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x424c18
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00409e64
lea eax, [ebp - 4]
call fcn.00409f78
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a4bc
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x424c02
mov eax, ebx
call fcn.00406e04
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x424bfb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a4bc
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x424be5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x424c2c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x424be5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x10]
shr eax, 0x10
movzx eax, ax
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax + 0x10]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x14]
shr eax, 0x10
movzx eax, ax
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424c02
mov eax, dword [ebp - 0x10]
call fcn.00406e20
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424c1f
lea eax, [ebp - 4]
call fcn.00409a3c
ret

Function at 0x4259c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00409f0c
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ea44
mov edi, eax
cmp edi, 0x104
jbe 0x42596b
mov eax, edi
add eax, eax
call fcn.00406e04
mov esi, eax
jmp 0x42596d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040ea44
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x4259a6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x425990
mov eax, esp
cmp esi, eax
je 0x4259b3
mov eax, esi
call fcn.00406e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4259ec
cmp bl, 0
je 0x4259e8
cmp bl, 0x41
jl 0x4259e3
cmp bl, 0x5a
jg 0x4259e3
or bl, 0x20
xor al, bl
inc esi
jmp 0x4259c7
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x42592c

Function at 0x426248
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a560
add esp, 0x800
pop ebx
ret
Function at 0x47d528
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x47d530
mov eax, edx
pop esi
pop ebx
ret

Function at 0x4afd48
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4afde6
push dword fs:[eax]
mov dword fs:[eax], esp
or dl, byte [ebx + 0xd]
je 0x4afdaa
cmp byte [ebx + 0x11], 0
jne 0x4afdaa
cmp byte [ebx + 0x24], 0
jne 0x4afdaa
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4afdcb
lea edx, [ebp - 4]
mov eax, dword [0x4d7914]
call fcn.0040e9b0
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x48aa1c]
call fcn.00423aa4
call fcn.004090b8
jmp 0x4afdcb
lea edx, [ebp - 8]
mov eax, dword [0x4d7914]
call fcn.0040e9b0
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x48aa1c]
call fcn.00423aa4
call fcn.004090b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afded
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409a9c
ret

Function at 0x4b0600
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4b064e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004afbc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b0667
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4b0670
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004afbc8
dec esi
jne 0x4b0692
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4019c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4350c0], 0x24e1
mov eax, dword [0x4350c0]
sub eax, 0x24e1
mov dword [0x4350c0], eax
mov ecx, 1
test ecx, ecx
je 0x401a6b
mov edx, dword [0x4350c0]
cmp edx, dword [ebp + 0xc]
jb 0x4019f7
jmp 0x401a6b
cmp dword [0x4350c0], 0
jne 0x401a15
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401a15
xor eax, eax
jmp 0x401a6b
mov eax, dword [ebp + 8]
add eax, dword [0x4350c0]
mov ecx, dword [eax]
add ecx, dword [0x4350c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4350c0]
mov dword [edx], ecx
mov dword [ebp - 4], 9
mov eax, dword [0x4350c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4350c0]
push eax
call fcn.004011d0
add esp, 8
mov ecx, dword [0x4350c0]
add ecx, 4
mov dword [0x4350c0], ecx
jmp 0x4019dd
mov esp, ebp
pop ebp
ret

Function at 0x401a70
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str._ffffffffffffffff
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x401aea
cmp dword [ebp - 0x118], 0
je 0x401aea
jmp 0x401b4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401b4c
mov dword [ebp - 0x120], 0x3c41
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4350b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4350d0], edx
mov dword [ebp - 0x120], 0x3c41
mov dword [ebp - 0x120], 0x3c41
call fcn.004011c0
mov eax, dword [ebp + 8]
mov dword [0x4350cc], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401980
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x401aea
mov esp, ebp
pop ebp
ret

Function at 0x40a940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
and byte [eax - 0x1f1ff115], dl
test eax, 0x82c79173
mov ah, 0xab
or dword [ecx - 0x23], ecx
add al, 0x6c

Function at 0x40ad90
Capabilities:
Encode data using xor

Disassembly:
call fcn.0040ac6b
xor ecx, ecx
sub ecx, 0xffffff81
call 0x40ad90
rcr byte [esi - 0x7f], 0x76
push cs
adc al, 0x4a
retf 0x8334
Function at 0x401ed0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa0
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 0x18]
mov dl, byte [ebp + 0x14]
movsd xmm0, qword [ebp + 0xc]
mov al, byte [ebp + 8]
mov edi, esp
mov dword [esi + 0x8c], edi
mov dword [esi + 0x98], 0xffffffff
lea edi, [esi + 0x90]
mov dword [esi + 0x94], 0x405f10
mov ebx, dword fs:[0]
mov dword [esi + 0x90], ebx
mov dword fs:[0], edi
and dl, 1
mov byte [esi + 0x8b], dl
movsd qword [esi + 0x80], xmm0
and al, 1
mov byte [esi + 0x7f], al
mov dword [esi + 0x78], ecx
mov dword [esi + 0x74], 0x1ed8
mov dword [esi + 0x6c], 0x40e8fd20
mov dword [esi + 0x68], 0
mov byte [esi + 0x67], 0
mov dword [esi + 0x60], 0xbad
mov eax, esp
mov dword [eax], str.ixmvkfokpbeltqlztkocxftbwragqqdjfikxn
lea ecx, [esi + 0x48]
call fcn.00406010
sub esp, 4
mov dword [esi + 0x98], 0
mov eax, esp
mov dword [eax], str.ixmvkfokpbeltqlztkocxftbwragqqdjfikxn
lea ecx, [esi + 0x30]
call fcn.00406010
sub esp, 4
jmp 0x401f96
mov dword [esi + 0x98], 1
mov eax, esp
mov dword [eax], str.ixmvkfokpbeltqlztkocxftbwragqqdjfikxn
lea ecx, [esi + 0x18]
call fcn.00406010
sub esp, 4
jmp 0x401fb8
lea ecx, [esi + 0x18]
lea eax, [esi + 0x30]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00406100
mov byte [esi + 0x13], al
lea ecx, [esi + 0x18]
call fcn.004060d0
lea ecx, [esi + 0x30]
call fcn.004060d0
mov al, byte [esi + 0x13]
test al, 1
jne 0x401fed
jmp 0x402011
mov dword [esi + 0x14], 1
cmp dword [esi + 0x14], 0
jle 0x40200c
mov eax, dword [esi + 0x14]
add eax, 0xffffffff
mov dword [esi + 0x14], eax
jmp 0x401ff4
jmp 0x402011
lea ecx, [esi + 0x48]
call fcn.004060d0
mov eax, dword [esi + 0x90]
mov dword fs:[0], eax
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x14
Function at 0x4026b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x78
mov esi, esp
mov dword [esi + 8], ebp
lea eax, [ebp + 8]
mov edx, esp
mov dword [esi + 0x64], edx
mov dword [esi + 0x70], 0xffffffff
lea edx, [esi + 0x68]
mov dword [esi + 0x6c], 0x405f90
mov edi, dword fs:[0]
mov dword [esi + 0x68], edi
mov dword fs:[0], edx
add eax, 0x18
mov dword [esi + 0xc], eax
mov dword [esi + 0x60], ecx
mov dword [esi + 0x5c], 0x3e7
mov dword [esi + 0x54], 0x40e448a0
mov dword [esi + 0x50], 0
mov dword [esi + 0x4c], 0x40bb5000
mov dword [esi + 0x48], 0
mov dword [esi + 0x70], 0
mov eax, esp
mov dword [eax], str.zazixinpdcocwrghjjpsozftbcpfkrvsebjyfakplmualn
lea ecx, [esi + 0x30]
call fcn.00406010
sub esp, 4
jmp 0x402736
mov dword [esi + 0x70], 1
mov eax, esp
mov dword [eax], str.yhaqkeixrnqichkrkamtlspzfdgamk
lea ecx, [esi + 0x18]
call fcn.00406010
sub esp, 4
jmp 0x402755
mov dword [esi + 0x14], 0x5d
cmp dword [esi + 0x14], 0
jle 0x402774
mov eax, dword [esi + 0x14]
add eax, 0xffffffff
mov dword [esi + 0x14], eax
jmp 0x40275c
mov dword [esi + 0x10], 0x41
cmp dword [esi + 0x10], 0
jle 0x402793
mov eax, dword [esi + 0x10]
add eax, 0xffffffff
mov dword [esi + 0x10], eax
jmp 0x40277b
lea ecx, [esi + 0x18]
call fcn.004060d0
lea ecx, [esi + 0x30]
call fcn.004060d0
mov ecx, dword [esi + 0xc]
call fcn.004060d0
mov eax, dword [esi + 0x68]
mov dword fs:[0], eax
xor eax, eax
and al, 1
movzx eax, al
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x3c
Function at 0x403510
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
dec eax
sub ebx, 0x18
or esi, 0xc1
imul eax
neg esi
imul ebx
rcl edx, 0xe
bswap eax
ror edi, 0x8f
sbb ebx, 0x5d
sub edi, 0xb6
rcl edi, 0x70
bswap esi
dec edi
imul esi
rcr ebx, 0x42
add edx, 0x3b
bswap edi
and ebx, 0x83
rcr edx, 0x5c
not edi
neg edi
dec edx
rol edi, 0x15
or edx, 0xf7
neg ebx
rol edi, 0xb7
add eax, 0xc5
dec esi
rcr esi, 0xc7
mov eax, 0xe2
not esi
not edi
dec eax
not ebx
ror edi, 0xcc
inc edi
rol ebx, 0x48
dec edi
dec ebx
mov edi, 0xf6
ror ebx, 0x46
and eax, 0xdb
sub edi, 0xb7
sbb eax, 0x68
neg edx
add esi, 0x4e
ror edx, 0xe9
dec ebx
imul edx
xor ecx, ecx
xor edi, edi
add edx, 0x7f
dec esi
neg edi
mov esi, 0xe7
inc edx
inc esi
add edi, 0x3e
rcr ebx, 0x73
inc eax
inc edx
neg ebx
inc ebx
and ebx, 0xa7
or ebx, 0xca
not edx
imul edi
and esi, 0x62
rol edx, 0x6d
bswap edi
neg edi
rcr edi, 0xc
rcr eax, 0xb
mov esi, 0xe8
or edi, 0xca
neg ebx
and eax, 0xcf
neg eax
and ebx, 0x45
not edx
add edx, 0x68
rcl ebx, 0xa9
imul edx
not esi
not eax
dec esi
not esi
neg eax
sbb edx, 0xce
rol edx, 0x11
inc eax
or esi, 0xba
add edx, 0xd8
mov edi, 0xeb
sbb ebx, 0x9d
rcl ebx, 0xd
neg edx
sub ebx, 0x26
sub edi, 0x96
bswap esi
neg esi
mov ecx, dword [ebp + 0xc]
rcl esi, 0x47
rol ebx, 0x85
neg eax
inc edx
imul esi
imul edx
inc esi
imul edi
not ebx
and edx, 0xb
mov edi, 0x23
neg eax
rcl eax, 0x19
mov ebx, 0xc1
not eax
not eax
or ebx, 0x69
bswap edx
sub edx, 0xa7
not ebx
inc edx
ror edi, 0xab
and eax, 0xa9
bswap edi
not edi
add ebx, 0xb9
rol esi, 0x50
or edi, 0xf4
sub ebx, 0x14
dec edx
neg edi
inc edx
sub edi, 0x6f
ror esi, 0x54
mov edi, 0xca
bswap edx
bswap eax
not esi
sub edi, 0x1c
neg edi
dec edx
dec edi
imul edx
dec edx
imul esi
mov edi, 0x2f
rcl esi, 0x37
add ebx, 0xf5
sub esi, 0x98
rol ebx, 0xeb
mov edi, dword [ebp + 8]
xor eax, eax
xor esi, eax
xor ebx, ebx
mov esi, esi
xor esi, ebx
xor esi, eax
xor esi, eax
xor esi, eax
mov esi, esi
xor ebx, eax
mov esi, ebx
xor eax, ebx
not byte [edi]
mov esi, esi
mov ebx, eax
mov esi, ebx
xor esi, eax
mov ebx, eax
mov esi, ebx
xor esi, eax
mov esi, ebx
xor esi, eax
sub byte [edi], 0x76
xor esi, esi
xor esi, ebx
mov esi, eax
xor ebx, esi
xor esi, eax
xor esi, eax
xor esi, eax
xor ebx, ebx
mov eax, ebx
add byte [edi], 0x63
xor ebx, ebx
xor ebx, esi
xor eax, ebx
xor esi, eax
mov ebx, ebx
xor eax, esi
mov eax, eax
xor ebx, eax
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4036d9
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40789e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4078dd
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4078dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4078dd
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4078dd
cmp dword [ecx + 0x74], 0xe
jbe 0x4078dd
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40ec8b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40ed28
push ebx
push esi
call fcn.0040ec54
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040eb9d
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40ecd5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ed27
push edi
push eax
call fcn.0040d66b
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40ecf5
call fcn.0040d6b9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40ed26
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040eb9d
add esp, 0x20
test eax, eax
jne 0x40ed14
push edi
call fcn.0040d6b9
jmp 0x40ed1c
push ebx
call fcn.0040d6b9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40ff20
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441ac8
push 0x441ac0
push str.FlsAlloc
push 0x1e
call fcn.0040fde1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ff54
push dword [ebp + 8]
mov ecx, esi
call dword [0x41612c]
call esi
jmp 0x40ff5a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40ff9e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x441ad8
push 0x441ad0
push str.FlsGetValue
push 0x20
call fcn.0040fde1
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40ffd5
push dword [ebp + 8]
mov ecx, esi
call dword [0x41612c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x4153c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4153ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4153ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x914612
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x914618
pop ebp
sub ebp, 0x10
sub ebp, 0x514608
jmp 0x91462e
mov eax, 0x514608
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ec
mov edx, 0x558f9fd1
xor byte [eax], dl
inc eax
dec ecx
jne 0x914645
jmp 0x914658
pop edx
sbb al, 0x5a
pop eax
in eax, dx
rcl ecx, 1
rcl dword [eax + 0x10]
sub ecx, edx
rcl ecx, 1
rcr byte [ecx + ebp*2], cl
xlatb
rcl ecx, 1
shr dword [ebx - 7], 1
rcl ecx, 1
shl dword [esi], 1
xor edx, edx
sbb dword [edx + 0x50], ebx
fst st(1)
rcl ecx, 1
rcl byte [ecx + eax*4], cl
cmp dword [ecx - 0x2e209e4b], 0x934470b9
rcl eax, 1
std
cmc
mov ecx, 0xda7b4d9d
cmp esp, edx
rcl ecx, 1
sar dword [eax], 1
in eax, 0xd1
rcl ecx, 1
pop esp
mov ch, 0xf5
sub eax, 0x85f5fd58
mov word [edx + 0x54], ds
invalid

Function at 0x401000
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
enter 0x84, 0
sub ebp, 0x82
mov dword [ebp - 2], 0
call fcn.00401533
mov ebx, eax
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, ebx
or al, 0x40
push eax
mov eax, 0x401dc7
sub eax, fcn.00401592
push eax
push fcn.00401592
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x40107a
mov eax, ebx
lea edx, [ebp - 2]
call fcn.00401461
mov eax, ebx
lea ecx, [ebx + 0x1b600]
call fcn.004014b3
mov esi, ecx
mov eax, ebx
or si, 1
cdq
idiv esi
lea edx, [eax + ecx]
mov eax, ebx
lea ebx, [ebp - 2]
or eax, 0x402054
call fcn.00401592
xor eax, eax
lea esp, [ebp + 0x82]
pop ebp
pop esi
pop edx
pop ecx
pop ebx
ret

Function at 0x401533
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ecx
push edx
enter 0x11c, 0
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.DLL_GetCursorPos]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 4], 0xa
mov byte [ebp - 0x11c], 0
call dword [sym.imp.CRYPT32.DLL_CryptBinaryToStringA]
movzx eax, byte [ebp - 0x18]
sub eax, 0x41
leave
pop edx
pop ecx
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6a680d52
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6fdf10a5
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40212b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x402184
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x402175
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x402171
cmp esi, ecx
jae 0x402175
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec edx
jne 0x402161
cmp esi, ecx
jb 0x402179
xor eax, eax
jmp 0x402183
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret