joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410d70
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x460480
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0x1c]
mov eax, edx
mov ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 1
jb 0x410dc7
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x18], eax
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
mov word [eax + ecx], 0
jmp 0x410ddc
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 8]
push dword [ebp - 0x34]
push 1
call fcn.004255b0
mov edx, dword [ebp + 0x34]
mov eax, edx
mov ecx, dword [ebp + 0x30]
sub eax, ecx
cmp eax, 1
jb 0x410e03
lea eax, [ecx + 1]
cmp edx, 0x10
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov word [eax + ecx], 0
jmp 0x410e18
push 0
push 1
mov byte [ebp - 0x34], 0
lea ecx, [ebp + 0x20]
push dword [ebp - 0x34]
push 1
call fcn.004255b0
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x16], 0
cmovae eax, dword [ebp + 8]
cmp dword [ebp + 0x34], 0x10
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, 0x610
mov word [ebp - 0x20], ax
lea eax, [ebp - 0x30]
push eax
movlpd qword [ebp - 0x1e], xmm0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov edx, dword [ebp + 0x1c]
mov esi, eax
cmp edx, 0x10
jb 0x410e96
mov ecx, dword [ebp + 8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410e8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410ef4
push edx
push ecx
call fcn.0042aa8a
add esp, 8
mov edx, dword [ebp + 0x34]
mov dword [ebp + 0x18], 0
mov dword [ebp + 0x1c], 0xf
mov byte [ebp + 8], 0
cmp edx, 0x10
jb 0x410ed8
mov ecx, dword [ebp + 0x20]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x410ece
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x410ef4
push edx
push ecx
call fcn.0042aa8a
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
call fcn.004458bc
int3
Function at 0x412020
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x488b4c
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], ecx
call fcn.00429534
add esp, 4
test eax, eax
jne 0x41212b
mov ecx, dword [0x488ac0]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_send]
push esi
push edi
mov dword [ebp - 0xc], ecx
xor esi, esi
mov edi, 4
push 0
push edi
lea eax, [ebp - 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x412081
mov ecx, dword [ebp - 0xc]
add esi, eax
sub edi, eax
cmp esi, 4
jl 0x412064
xor ecx, ecx
mov edi, 8
cmp eax, 0xffffffff
setne cl
dec ecx
xor esi, esi
mov dword [ebp - 0xc], ecx
mov ecx, dword [0x488ac0]
mov dword [ebp - 0x10], ecx
nop dword [eax]
push 0
push edi
lea eax, [ebp + 8]
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x4120bd
mov ecx, dword [ebp - 0x10]
add esi, eax
sub edi, eax
cmp esi, 8
jl 0x4120a0
mov edi, dword [ebp - 0xc]
or ecx, 0xffffffff
cmp eax, ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
cmove edi, ecx
mov ecx, dword [0x488ac0]
xor esi, esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], ecx
test eax, eax
jle 0x412107
mov edi, eax
mov eax, dword [ebp - 0x14]
push 0
push edi
add eax, esi
push eax
push ecx
call ebx
cmp eax, 0xffffffff
je 0x412104
mov ecx, dword [ebp - 0x18]
add esi, eax
sub edi, eax
cmp esi, dword [ebp - 0x10]
jl 0x4120e2
mov edi, dword [ebp - 0xc]
jmp 0x412107
or edi, 0xffffffff
push 0x488b4c
call fcn.00429559
add esp, 4
test eax, eax
jne 0x412131
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a413
mov esp, ebp
pop ebp
ret
push eax
call fcn.0042902c
push eax
call fcn.0042902c
int3
Function at 0x4127a0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Convert ip address from string
Create tcp socket
Create udp socket
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
mov eax, 0x20f8
call fcn.0042b620
mov eax, dword [0x482024]
xor eax, esp
mov dword [esp + 0x20f4], eax
push esi
push edi
call fcn.00447a91
cmp dword [0x483198], 0x10
mov edi, eax
push 0xa
lea eax, [esp + 0x10]
mov esi, 0x483184
cmovae esi, dword [0x483184]
push eax
push esi
mov dword [edi], 0
call fcn.00448374
add esp, 0xc
cmp esi, dword [esp + 0xc]
je 0x412934
cmp dword [edi], 0x22
je 0x41292a
movzx edi, ax
lea eax, [esp + 0x28]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x412913
cmp dword [0x4834c8], 0x10
xorps xmm0, xmm0
mov eax, 2
movaps xmmword [esp + 0x10], xmm0
mov esi, 0x4834b4
mov word [esp + 0x10], ax
cmovae esi, dword [0x4834b4]
push edi
call dword [sym.imp.WS2_32.dll_htons]
mov word [esp + 0x12], ax
lea eax, [esp + 0x14]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x488ac0], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
cmp eax, 0xffffffff
jne 0x4128c3
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
push 0xbb8
call edi
push dword [0x488ac0]
call esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
push 0x10
lea ecx, [esp + 0x14]
mov dword [0x488ac0], eax
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x412890
lea ecx, [esp + 0x1b8]
call fcn.00412500
cmp eax, 0xffffffff
je 0x412913
cmp byte [0x486a04], 1
je 0x412904
lea ecx, [esp + 0x1b8]
call fcn.00412500
cmp eax, 0xffffffff
jne 0x4128d4
or eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x20f4]
xor ecx, esp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
push dword [0x488ac0]
call esi
mov byte [0x486a04], 0
mov ecx, dword [esp + 0x20fc]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, esp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
push str.stoi_argument_out_of_range
call fcn.00428b0c
push str.invalid_stoi_argument
call fcn.00428acc
int3
Function at 0x417e00
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4614b5
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
Function at 0x420a40
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 0
push 0x420980
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop dword [eax]
push 0x7530
call esi
jmp 0x420a30
push ebp
mov ebp, esp
and esp, 0xfffffff8
call fcn.0040c7f0
mov ecx, 1
call fcn.004112d0
call fcn.00411ba0
call fcn.0041f190
call fcn.00406a10
jmp 0x420a10

Function at 0x420d50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x420e36
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x420e25
jg 0x420d90
test edx, edx
je 0x420e25
nop dword [eax]
call fcn.00423ca0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x420de4
jg 0x420da7
test esi, esi
je 0x420de4
cmp ebx, eax
jg 0x420db7
jl 0x420db1
cmp edi, esi
jae 0x420db7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00441020
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x420e09
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x420e1f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x420d90
jl 0x420e1f
test edi, edi
jne 0x420d90
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x420e58
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x420e5a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x420ed8
jg 0x420e6d
test esi, esi
je 0x420ed8
test eax, eax
jl 0x420eb2
jg 0x420e77
test ebx, ebx
je 0x420eb2
cmp edi, eax
jg 0x420e87
jl 0x420e81
cmp esi, ebx
jae 0x420e87
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00441020
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x420eb5
mov edx, dword [ebp + 8]
test edi, edi
jl 0x420ed8
jg 0x420ebf
test esi, esi
je 0x420ed8
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x420ed8
push eax
push esi
push 1
push edx
call fcn.004479b5
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x421450
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x421480
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4214bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4214bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x4215a3
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4214e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x421517
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00444b58
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x4215a3
cmp eax, 1
jle 0x421576
cmp eax, 3
jne 0x4215a3
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00444b58
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x421593
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004479b5
add esp, 0x10
cmp edi, eax
jne 0x4215a3
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4214a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a413
mov esp, ebp
pop ebp
ret 4
Function at 0x423880
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x482024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x42393a
cmp byte [esi + 0x3d], 0
je 0x42393a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x423928
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4238f0
sub eax, 1
je 0x4238f4
sub eax, 2
jne 0x423928
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x423911
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.004479b5
add esp, 0x10
cmp edi, eax
jne 0x423928
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042a413
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0042a413
mov esp, ebp
pop ebp
ret

Function at 0x4241f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x462820
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x482024]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0042a809
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.00428cbe
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42d03f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x44f472
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0044f2e8
Function at 0x54ca60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x54ca91
lfence
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x54ca80
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x555822
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x58408b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00583ec6

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x100032a0
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edx]
xor eax, eax
test cl, cl
je 0x100032cd
push esi
lea esp, [esp]
movzx ecx, cl
movzx ecx, byte [ecx + 0x1005c828]
lea esi, [eax*8]
xor ecx, esi
inc edx
xor eax, ecx
mov cl, byte [edx]
test cl, cl
jne 0x100032b0
pop esi
ret

Function at 0x1000e7f0
Capabilities:
Create thread

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0xc]
push esi
push 0
push 0x14
mov dword [ebp], 0
call fcn.1000dee0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000e81b
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
cmp dword [0x10066004], 0
je 0x1000e849
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10001fe0
push 0
push 0
mov dword [esi + 8], ebx
mov dword [esi + 0xc], edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x1000e859
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
cmp dword [esi + 8], 0
jne 0x1000e871
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push edi
mov dword [esi + 4], eax
call ebx
add esp, 4
mov dword [esi + 0x10], eax
mov dword [ebp], esi
pop esi
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x10010090
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [edi + 0x88]
test esi, esi
je 0x100100e0
mov dword [ebx], esi
mov eax, dword [esi + 0xc]
mov dword [edi + 0x88], eax
mov edx, dword [esi + 8]
mov dword [esi + 0xc], 0
movzx ecx, word [edi + 0x8c]
push ecx
push 0
push edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi + 4], ebp
mov dword [esi + 0x14], edx
inc dword [edi + 0x78]
pop esi
pop ebp
xor eax, eax
pop ebx
ret
movzx eax, word [edi + 0x8c]
add eax, 0x28
push 0
push eax
call fcn.1000e280
mov esi, eax
add esp, 8
mov dword [ebx], esi
test esi, esi
jne 0x10010128
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 0x98]
push esi
cdq
dec ecx
push ecx
push edx
push eax
call fcn.10059ae0
push edx
push eax
mov eax, dword [edi + 0x3c]
mov edx, ebp
call fcn.10001910
add esp, 8
lea eax, [esi + 7]
pop esi
pop ebp
pop ebx
ret
lea edx, [esi + 0x28]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x10]
mov eax, 0x40
mov word [esi + 0x18], ax
mov dword [esi + 0x10], edi
mov ecx, 1
mov word [esi + 0x1a], cx
mov dword [esi + 4], ebp
mov dword [esi + 0x14], edx
inc dword [edi + 0x78]
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x10012b30
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, eax
test ebp, ebp
jne 0x10012b43
pop esi
xor eax, eax
pop ebp
pop ecx
ret
push ebx
push 0
push 8
call fcn.1000e2b0
mov ebx, eax
add esp, 8
mov dword [esp + 0xc], ebx
test ebx, ebx
jne 0x10012b5f
pop ebx
pop esi
pop ebp
pop ecx
ret
test byte [esp + 0x18], 1
mov eax, dword [ebp]
mov dword [ebx], eax
jne 0x10012b7d
mov ecx, dword [ebp]
mov eax, 1
cmp ecx, eax
jle 0x10012b7d
add eax, eax
cmp eax, ecx
jl 0x10012b77
lea eax, [eax + eax*2]
add eax, eax
push edi
add eax, eax
add eax, eax
push 0
push eax
call fcn.1000e2b0
mov edi, eax
add esp, 8
mov dword [ebx + 4], edi
test edi, edi
jne 0x10012bac
mov edx, ebx
mov ecx, esi
call fcn.10001ed0
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
mov ebp, dword [ebp + 4]
xor ebx, ebx
cmp dword [ecx], ebx
jle 0x10012c1d
lea esp, [esp]
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp]
push edx
push eax
push esi
call fcn.10019dd0
mov dword [edi], eax
mov eax, dword [ebp + 4]
push eax
push esi
call fcn.1000e430
mov dword [edi + 4], eax
mov ecx, dword [ebp + 8]
push ecx
push esi
call fcn.1000e430
mov dword [edi + 8], eax
mov dl, byte [ebp + 0xc]
and dword [edi + 0x10], 0xfffffffe
mov eax, dword [edi + 0x10]
mov byte [edi + 0xc], dl
mov ecx, dword [ebp + 0x10]
xor ecx, eax
and ecx, 2
xor ecx, eax
mov eax, dword [esp + 0x34]
mov dword [edi + 0x10], ecx
mov edx, dword [ebp + 0x14]
mov dword [edi + 0x14], edx
inc ebx
add esp, 0x1c
add edi, 0x18
add ebp, 0x18
cmp ebx, dword [eax]
jl 0x10012bc0
mov eax, dword [esp + 0x10]
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret