joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488ce1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ch, 0x62
and dword [eax + 0x7ff83c91], ebx
cmc
aaa
pushal
push edx
xor esi, dword [ecx + edx*8]
push cs
aaa
nop
insd dword es:[edi], dx
fsub qword [eax + 0x3e]
or eax, 0x8ed56e9c
or eax, 0x8ed56e9c
movups xmm7, xmm3
add eax, 0x899f857f
movsb byte es:[edi], byte [esi]
xor byte [edi - 0x2a01128b], bl
sub al, 0xc7
arpl word [ecx + ebp - 0x55], bx
adc eax, 0xfd1119f4
and byte [eax + 0x5c528982], bl
dec esi
fsubr qword [esp + 0x5d]
inc esp
lcall 0x3889, 0xbb7ca64c
aad 0x43
nop
jb 0x488cfc
aad 0xeb
sbb al, 0x61
mov edi, 0x2d550528
cdq
cmp byte [esi - 0x3c], ch
daa
int1
mov eax, dword [0xfaaa4c4b]
lahf
lds ebx, [ebp + 0x710bb06e]
mov dh, 0xd5
pop edi
fstp dword [ecx + ebp]
jnp 0x488cf6
push ebx
mov byte [0x2d39467e], al
and al, 0xdc
les ebp, [ecx + 0x45]
sub dword [ebx], ebp
invalid

Function at 0x4ebbd9
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
pushal
and ch, byte [edx + 0x7f185572]
xchg dword [edi - 0x63], ecx
popfd
pop ebx
in eax, dx
xchg ebx, eax
dec ebx
push ds
xor esp, dword [esi]
xchg ecx, eax
aas
dec dword [esi]
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x69aac754]
push edi
xor dword [ebx + 0x4331c039], 0xd65b63ac
lodsb al, byte [esi]
arpl word [ebx - 0x2a], bx
jo 0x4ebbe3
jo 0x4ebbfc
mov ecx, 0x1f519b01
xchg edx, eax
cmpsb byte [esi], byte es:[edi]
xor al, 0x35
xchg ebx, eax
scasd eax, dword es:[edi]
xor ch, bl
mov byte [0xffd240], al
xchg ebx, eax
mov byte [0xc289138a], al
cmpsb byte [esi], byte es:[edi]
and cl, byte [ebp + 0x4dc2904b]
into
jg 0x4ebc38
jnp 0x4ebc3a
sbb edx, esi
or al, 0x72
xor esp, dword [edx - 0x70]
jecxz 0x4ebca0
mov edi, ecx
adc cl, byte [edi]
push esi
call 0x8a635b5d
lahf
adc al, 0x8a
mov al, byte [edi]
pop es
iretd
sal dword [edx], 0x77
invalid
div byte [esi]
cmp esi, ebx
xor edi, dword [esi + 0x41c60b13]
inc esi
pushal
jecxz 0x4ebc5e
ficom word [ebx - 0x6d]
jl 0x4ebcbe
fdivrp st(7)
js 0x4ebd13
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
jbe 0x4ebcd5
invalid
sbb ah, byte [edi - 0x3d5488bd]
jmp 0x4ebc89
xchg edx, eax
loopne 0x4ebc96
mov ss, word [edx]
retf 0x9906
adc byte [ecx + 0x47], 0xd
je 0x4ebca7
xor al, byte [eax + edx*2]
scasb al, byte es:[edi]
salc
mov eax, dword [0xbe71e3d3]
mov ebx, 0x1da3cf4b
mov esi, 0xe7fb040d
imul esp, dword [eax - 0x7e1caf0d], 0xffffffd3
xor bl, al
mov dword [0x92bfee0f], eax
xchg esi, eax
cld
popfd
mov dh, 0x9f
arpl word [0xd33ffe57], cx
ret 0x5833

Function at 0x5b41f8
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [edi - 0x17], 0x74ddef23
sub dword [ebp - 0x53], esi
jmp 0x5b4375d4
cdq
xchg esi, eax
je 0x5b41e7
dec esp
sbb dword [ecx + 0x77], ecx
test eax, 0x99dfae04
invalid
Function at 0x5fec88
Capabilities:
Encode data using xor

Disassembly:
cdq
xchg esp, esp
pushfd
cmp eax, dword [esi + 0x5af3ca63]
xor edi, esi
pop ebx
mov al, byte [0x2668e09a]
push 0x9157aa26
push 0x9157aa26
bnd jecxz 0x5fece6
or dl, dl
inc edx
push edx
out dx, al
xchg ecx, eax
loope 0x5fec78
xor ch, byte [esi - 0x4bcba5b5]
mov eax, 0xc6031229
pop es
popal
leave
wait
lodsd eax, dword [esi]
sal eax, cl
ror bl, cl
mov ebx, 0x36f7d8b
pop ebp
mul byte [edi + 0x2d]
pop edi
dec ebp
push ebx
mov dl, 0x45
std
cld
fst qword ss:[ebx - 0x14fca88c]
out 0xf, eax
sbb esp, ebx
aam 0x71
retf
sbb eax, 0x9fdf2bf7
test eax, 0xdc116852
pop ecx
jae 0x5fed20
mov dh, 0x43
int 0x8f
inc ecx
popal
pop ebp
xchg esi, eax
jae 0x5fed32
imul esp, edi, 0x1fe978a7
invalid
jmp 0x8971b326
cwde
pop edx
pushfd
jne 0x5fed02
and dh, byte [ecx + 0x33504ef0]
or eax, 0xe0b1d3bc
mov esp, 0x73e0b1d3
invalid
and esp, dword [esi + 0x27]
lcall 0x9350, 0xb0ed626c
test al, 0xb1
invalid

Function at 0x60ab19
Capabilities:
Encode data using xor

Disassembly:
add dword [ebp + 0x65], esi
pop edi
dec esi
cmp edx, dword [ebx - 0x39]
and ah, byte [ebx]
lds esp, [ebx - 0x48]
push 0x3f02e6ea
sbb al, 0x62
add dword [edx - 0x6e], 0x1c
mov al, byte [0x596a188a]
test al, 0x75
mov ch, 0x5c
cmpsb byte [esi], byte es:[edi]
test dword [eax + 0x3ef7c33d], esp
cdq
push esp
stosb byte es:[edi], al
cmc
imul ch
jge 0x60ab16
lds eax, [edi]
mov ecx, 0xf0d54da1
mov eax, dword [0x3f0d54d]
out 0x56, al

Function at 0x65795d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65f398
cmp edx, dword [eax]
je 0x65797f
add eax, 8
inc ecx
cmp eax, 0x65f428
jl 0x657970
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65f398]
jne 0x657aad
mov eax, dword [0xa5bcf4]
cmp eax, 1
je 0x657a87
test eax, eax
jne 0x6579b0
cmp dword [0x65f2c4], 1
je 0x657a87
cmp edx, 0xfc
je 0x657aad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6579e7
lea eax, [ebp - 0x1a4]
push 0x65c9f0
push eax
call fcn.00658340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006587d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.006587d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65c9ec
push edi
call fcn.0065a6a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65c9d0
push eax
call fcn.00658340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658350
lea eax, [ebp - 0xa0]
push 0x65c9cc
push eax
call fcn.00658350
push dword [esi + 0x65f39c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658350
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65c9a4
push eax
call fcn.0065a614
add esp, 0x2c
pop edi
jmp 0x657aad
lea eax, [ebp + 8]
lea esi, [esi + 0x65f39c]
push 0
push eax
push dword [esi]
call fcn.006587d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x48]
mov edx, dword [ebp - 4]

Function at 0x42f0af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
jne 0x42f0ad
jmp 0x42f2ed

Function at 0x42f0c7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
dec ebp
cld
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
in al, 2
add al, 0xa
and al, 0xff
mov edx, dword [ebp - 4]
cld
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]

Function at 0x42f0e7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
add al, 0xa
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]

Function at 0x42f0f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
jne 0x42f0ad
jmp 0x42f2ed
Function at 0x446490
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x48]
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0x40]
mov al, byte [eax]
dec al
je 0x4464ca
dec al
je 0x446537
dec al
je 0x44659e
dec al
je 0x44664b
jmp 0x446726
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x24]
inc eax
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
sub edx, eax
jb 0x446726
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x4464e6
jmp 0x446726
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
test eax, eax
jbe 0x446726
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x48]
xor al, 1
and eax, 0x7f
mov edx, dword [ebp - 4]
mov eax, dword [edx + eax*4 + 0x40]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
add byte [eax], al
add byte [ebx - 0x48d77af4], cl
pop ebx
add byte [edi], cl
mov esp, 0xb10c8dc9
adc byte [edx + 0x5bb718], ah
sub byte [edi - 0x43f0ffa5], dh
enter 0xffffffffffffd089, 0xffffffffffffffc1
loopne 0x446737
or ecx, eax
jmp 0x44676b
mov ecx, dword [0x5bb720]
sub ecx, ebx
jb 0x44675b
mov eax, dword [0x5bb71c]
sub eax, ebx
mov dword [0x5bb71c], eax
mov dword [0x5bb720], ecx
or ebx, 2
mov dword [eax - 4], ebx
jmp 0x446762
mov eax, ebx
call fcn.0044632b
mov byte [0x5bb718], 0
pop ebx
ret
push esi
push edi
lea edi, [ecx*8 + 0x5bb7a8]
mov esi, dword [edi + 4]
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov dword [eax], edi
cmp edi, eax
jne 0x44679a
mov eax, 0xfffffffe
rol eax, cl
and dword [edx*4 + 0x5bb728], eax
jne 0x44679a
btr dword [0x5bb724], edx
mov edi, 0xfffffff0
and edi, dword [esi - 4]
mov edx, edi
sub edx, ebx
je 0x4467c7
lea eax, [ebx + esi]
lea ecx, [edx + 3]
mov dword [eax - 4], ecx
mov dword [edx + eax - 8], edx
cmp edx, 0xb30
jb 0x4467cc
call fcn.0044625f
jmp 0x4467cc
and byte [edi + esi - 4], 0xf7
lea ecx, [ebx + 2]
mov dword [esi - 4], ecx
mov byte [0x5bb718], 0
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x45cef3
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
js 0x45ce9c
pop ebx
hlt
lodsd eax, dword [esi]
pop ebx
inc eax
test eax, 0x3916d2cb
push ss
sbb ah, byte [ecx]
add edi, edx
dec esi
mov ebx, 0x8f5ea02a
adc dword [0x54180b22], ebx
int 0x25
outsb dx, byte [esi]
in eax, dx
call 0x33562843
adc byte [ecx + 0x3b], ah
cmp eax, 0xcdde8408
mov ah, 0x93
add edi, 0x52aa3a18
aam 0xbb
add dword [ebx + edx*4 + 0x30b5b86], edi
pop eax
les eax, [eax - 0x301c23f6]
salc
mov al, 0x2d
jl 0x45ce93
lea ecx, [eax + 0x29]
dec ecx
scasb al, byte es:[edi]
js 0x45cf57
pop edx
in eax, dx
mov bl, 0x24
xchg esi, eax
outsd dx, dword [esi]
and eax, 0xa7d48d63
pop esp
sbb edx, ecx
test al, 0xe7
cmp byte [ebp - 0x11f7b1c8], dl
xchg ebp, eax
cmp byte [esi + 8], cl
out dx, al
push esi
mov esp, 0x1a1a7d2f
sub eax, dword [eax]
out dx, al
pop eax
sal dword [esi + 0x14f567ad], 1
fimul dword [ecx + 0x79]
xor al, 0xfa
test dword [esi - 0x3e], 0x50569266
sub byte [eax + 0x16], 0xde
xor byte [ecx], cl
sub edi, dword [esi]
inc esi
xor byte [edi - 0xa], cl
cmp ebp, dword [ebx + 0x5f]
sbb dword [ebx], esi
test al, 0x5e
and esp, dword [esi]
dec edx
mov dword [0xec47e0d8], eax
salc
salc
xor eax, 0x68389a4b
fstp qword [edx - 0xe]
loopne 0x45cf1e
invalid
jmp 0xfc355deb
Function at 0x45d0bf
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov esp, 0x12def60a
ficomp word [ebx + 0x6e]
invalid
mov cl, 0xd
sbb al, 0x7c
mov al, byte [0x9dfd6107]
std
popfd
std
popfd
push es
mov eax, 0x6d0e99fc
push ecx
lcall 0x1e9d, 0xbd83c3ce
loope 0x45d102
or byte [ecx + 0x7d9cf15f], cl
sub dword [eax + 0x86e9839], 0x1b
salc
neg byte [0xeefc292c]
dec edi
enter 0xffffffffffffca53, 0xffffffffffffffe8
or dword [eax + ebx - 8], edx
test edi, esp
dec ebp
jecxz 0x45d12b
leave
lodsd eax, dword [esi]
test al, 0x9f
jmp 0x45d0b8
dec esi
dec esp
jns 0x45d09c
mov ebp, 0x366533d8
daa
adc dword [edi], eax
dec ebx
invalid
jb 0x45d144
push es
push cs
pop eax
mov edi, 0xd7f0e7f0
int3
xor al, 0x19
mov al, 0x84
add byte [eax], 0
add dh, bh
enter 0xffffffffffff840f, 0xffffffffffffffe1
add byte [eax], al
add dh, bh
enter 0xffffffffffff840f, 0xffffffffffffff86
add dword [eax], eax
add cl, ch
pop esp
add al, byte [eax]
add byte [ebx + 0x408bfc45], cl
and al, 0x40
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x20]
sub edx, eax
jb 0x45d3bd
inc edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
push edx
dec eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x45d17d
jmp 0x45d3bd
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x24]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov al, byte [edx + eax]
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
add al, byte [edx + ecx]
and al, 0xff
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 0x48]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + edx*4 + 0x40]
mov ecx, dword [ebp - 0x1c]
mov byte [edx + ecx], al
inc dword [ebp - 0x1c]
dec dword [ebp - 0x20]
jne 0x45d386
jmp 0x45d5c6
pop ebx
add byte [eax], al
pop ebx
ret
Function at 0x4bb771
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33c8
cmp edx, dword [eax]
je 0x4bb793
add eax, 8
inc ecx
cmp eax, 0x4c3458
jl 0x4bb784
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33c8]
jne 0x4bb8c1
mov eax, dword [0x4c8df0]
cmp eax, 1
je 0x4bb89b
test eax, eax
jne 0x4bb7c4
cmp dword [0x4c32f4], 1
je 0x4bb89b
cmp edx, 0xfc
je 0x4bb8c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb7fb
lea eax, [ebp - 0x1a4]
push 0x4c09b8
push eax
call fcn.004bc150
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc5e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb83e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc5e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09b4
push edi
call fcn.004be4b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0998
push eax
call fcn.004bc150
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc160
lea eax, [ebp - 0xa0]
push 0x4c0994
push eax
call fcn.004bc160
push dword [esi + 0x4c33cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc160
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c096c
push eax
call fcn.004be424
add esp, 0x2c
pop edi
jmp 0x4bb8c1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33cc]
push 0
push eax
push dword [esi]
call fcn.004bc5e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x4bcbd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
or ebp, 0xffffffff
jmp 0x4bcbf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4bcbf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bcbe8
mov eax, 1
add ebx, ebx
jne 0x4bcc0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4bcc1c
jne 0x4bcc3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bcc3b
dec eax
add ebx, ebx
jne 0x4bcc28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4bcc00
add ebx, ebx
jne 0x4bcc37
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4bcc8d
xor ecx, ecx
sub eax, 3
jb 0x4bcc53
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bccc2
sar eax, 1
mov ebp, eax
jmp 0x4bcc5e
add ebx, ebx
jne 0x4bcc5e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bcc2c
inc ecx
add ebx, ebx
jne 0x4bcc6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4bcc2c
add ebx, ebx
jne 0x4bcc79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4bcc6e
jne 0x4bcc8a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4bcc6e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bccac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bcc9e
jmp 0x4bcbee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bccac
add edi, ecx
jmp 0x4bcbee
pop esi
mov edi, esi
mov ecx, 0x2f97
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bccca
cmp byte [edi], 0x13
jne 0x4bccca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bcccf
lea edi, [esi + 0xb9000]
mov eax, dword [edi]
or eax, eax
je 0x4bcd47
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc489c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc49b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bccfc
mov ecx, edi
jns 0x4bcd2b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc49b8]
or eax, eax
je 0x4bcd41
mov dword [ebx], eax
add ebx, 4
jmp 0x4bcd19
call dword [esi + 0xc49c8]
mov ebp, dword [esi + 0xc49bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bcd7b
sub esp, 0xffffff80
jmp 0x45984d
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push str.Printers
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000118a
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011b5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x10001208
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10