joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a8e8
Capabilities:
Encode data using xor

Disassembly:
sub bl, byte [0xa9d0e18f]
mov ah, 0xe9
mov bh, 0x81
inc ebp
xor edx, ecx
jp 0x40a8f2
adc esp, eax
mov eax, 0xa124a292
retf 0xae7f

Function at 0x41224b
Capabilities:
Encode data using xor

Disassembly:
pop ebx
fcmovnu st(0), st(5)
sti
cdq
pushfd
fiadd word [0x9eac18c]
mov byte [0x72a4813f], al
shl byte [ebp + 0x5a], 1
xor eax, 0x73a2692c
jmp 0x4122a4
bound ecx, qword [ecx + 0x52]
cmpsb byte [esi], byte es:[edi]
mov dword [0x8da9de0c], eax
test byte [ecx - 0x3ed3ee05], 0x39
mov eax, 0xac0ea626
sbb eax, 0x1ca2dfd1
mov cl, 0x40
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
dec ecx
xor ecx, dword [edx + ebx*4 - 0x62]
inc esi
scasd eax, dword es:[edi]
rcr dword [eax + 0x3b], 1
ror dword [ecx - 0xfc41dc5], 1
in eax, dx
push ecx
les ecx, [ecx]
out 0x13, eax
ficom word [ecx + 0x6ebd1dcf]
lodsd eax, dword [esi]
and dh, byte [eax - 0x57]
pop eax
mov eax, 0xc66f9cfb
add al, 0xf8
push ebx
and dword [edi + ebx*4 - 0x74b35a38], esp
mov ch, byte ss:[eax - 0x40]
push ebp
pushal
mov bh, 0xd1
push ss
pop ss
cli
push esp
cmc
inc esi
xchg ah, bh
pop eax
inc eax
in eax, 0x70
stosd dword es:[edi], eax
add dword [ecx + eax*2 + 5], esi
jno 0x412332
fcomp qword [0x256be008]
loopne 0x412359
in eax, dx
cmp eax, eax
ret
and dword [esi], eax
sbb eax, 0x44d9340a
leave
insd dword es:[edi], dx
jl 0x4122d6
sub dword [ebp + 0x44], ecx
push edi
push esi
invalid
leave
aad 0xda
ror dword [ecx - 2], cl
sbb eax, 0x914fbb4a
invalid

Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x653f34
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDeb124705_128b_40d4_8dd8_d93ed12589a4InProcServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa54230], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x653f34
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa54230], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa54230]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa54230], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret
Function at 0x454bca
Capabilities:
Encode data using xor

Disassembly:
out 0x4a, al
xchg esi, eax
mov ch, 0x2f
lcall 0xeb73, 0x41503d48
add al, 0xb2
das
push esi
cmp ecx, esi
xlatb
stosd dword es:[edi], eax
inc esp
in al, 0xb3
lcall 0xeddb, 0x7f83472c
neg byte [ebx]
dec esi
stosd dword es:[edi], eax
aas
les esi, [edx]
xor esi, dword [ecx]
cmp edx, dword [edx + 0x6b]
scasd eax, dword es:[edi]
arpl word [esi - 0x30f064c9], di
cmc
mov edx, 0x3f3e3336
xor edi, dword ss:[esi]
aas
aaa
sbb dword [ebx - 0x40c4005f], edi
lahf
test dword [edx - 0x68], eax
dec ecx
sub esp, dword [0x84529367]
inc edi
pop ecx
test byte [edi + 0x59], al
inc ebx
sal cl, 0x8e
mov eax, dword [0x27f8fe8d]
xchg edx, eax
aas
loope 0x454bcf
push es
inc esi
add al, 0x15
sti
imul esi, dword [edi - 0x4b], 0x307b2700
mov dl, 0x8d
ficom word [edi + 5]
imul dword [esi - 0x7fc5aae9]
je 0x454c81
call 0x246b1e27
mov eax, 0xe3610462
aaa
jecxz 0x454c7e
das
loopne 0x454c98
movsb byte es:[edi], byte [esi]
cmp ebp, 0x8c6b18b1
pop eax
test al, 0x52
jle 0x454c68
push edi
xor byte [ecx], dh
bound edx, qword [eax + 0x60]
xor cl, ch
jb 0x454c45
imul esp, dword [ebp + 0x49], 0x1f
adc dl, byte [edx]
or eax, 0xd947702
mov es, word [edi]
notrack jmp ds:[esi + 0x35]
ja 0x454bfe
or eax, 0xff3e078e
outsb dx, byte [esi]
xor eax, 0x6f4a4b54
xchg esi, eax
inc edi
insd dword es:[edi], dx
mov bh, 0x1f
and eax, 0xa7fe5460
cmpsd dword [esi], dword es:[edi]
ret 0x5c3c
pop esp
jb 0x454c13
adc esi, ebx
scasd eax, dword es:[edi]
cli
inc esi
das
add dword [esi - 0x20c08009], ebp
mov cl, 0x9a
mov ebp, 0x27e94b3e
mov esi, 0xa30accfa
pop ss
loop 0x454cb5
cli
int3
jecxz 0x454cbc
sub ch, dl
sbb dword [eax], ebp
and bl, bl
cmp dh, dh
shr dh, cl
pop ss
pop ebx
call 0x9fa1d975
pop es
outsb dx, byte [esi]
retf 0xa7ef
cmp eax, 0xf7b1f746
push cs
insb byte es:[edi], dx
sub eax, edx
das
sar dword [0x5617ceb7], cl
je 0x454d45
test dword [edx], esi
cmp edx, dword [edi - 0x6b88bc91]
cmp byte [esi - 0x359cd50b], dh
cmp edx, edi
or bh, ah
not dword [edi + 0x2f]
shl byte [ecx - 0x16], 0xb2
das
stosd dword es:[edi], eax
cmp eax, 0x61a3dbe6
mov bl, 0x72
je 0x454c88
sub ah, dl
sbb dh, 6
scasb al, byte es:[edi]
invalid
mov esi, fs
out 0, eax
add bl, byte [ebx - 0x288f75b8]
xor bl, byte [eax]
cmp dl, ah
lea edx, [ecx - 0x5e]
cmp esp, edi
mov al, 7
pop es
or byte [ebp - 0x4be012d9], cl
movsb byte es:[edi], byte [esi]
adc bh, byte [esi + 0x3a6ed078]
int1
mov bl, 0x42
jbe 0x454d8d
sahf
cwde
mov ebx, 0xca9036b3
lahf
or dword [ecx + 0x57], edi
call 0x8a853023
push es
lcall 0x4d38, 0xd3b222f6
pop ebx
xor al, 0x74
xor edx, ebx
into
das
mov eax, 0x9acabf76
or dword [edx + 0x5e], ebx
scasd eax, dword es:[edi]
inc ebx
mov eax, 0x15fd4b63
add byte [edx + 0x70065a09], dl
cli
or al, ch
aas
outsb dx, byte [esi]
aas
jnp 0x454d59
xor dl, ch
stc
aas
xchg edi, eax
pop es
ljmp 0x2a33

Function at 0x4568e4
Capabilities:
Encode data using xor

Disassembly:
pop edi
call 0xfab45a21
jbe 0x4568ab
sti
invalid
Function at 0x493e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.vb_form_factory_lib_10A6329C_2A3B_3b1c_A846_7D2B5814BF5C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x493e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493e3a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
invalid
invalid

Function at 0x4ef92a
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, 0xe0b7d9e3
cmp eax, 0x8d1a8c41
imul ebx, dword [eax], 0xfffffffd
adc bl, byte [0x57eecdf6]
mov ebx, 0x3c336689
enter 0xffffffffffffb91d, 0xffffffffffffffa8
cmp dword [esi - 0x44c34cf2], ecx
pop ebp
cmp byte [edx - 0x474353d], ah
ret
retf 0xfb8b
xor dh, byte [ebp - 0x2a]
cli
mov bl, 0x92
in eax, dx
and dword [edi + edi*2], 0x18
sbb cl, byte [ebx]
xchg ebx, edx
pop edi
loope 0x4ef86f
and al, 0x7f
sbb byte [edx], bl
or eax, dword [edi - 0x1ed9a02d]
in eax, 0xa2
inc ecx
xor eax, 0x76050ee3
insb byte es:[edi], dx
or dword [edx - 0x7f], 0x4d
fmul dword [ebp + ebx*2 - 0x58]
mov byte [0xee33541], al
add eax, 0x4a836c76
or dword [ebp - 0x28], 0x24a85d4c
pop edx
and al, 0x5a
mov ebp, dword [edi + 0x66e94eae]
sbb eax, dword [edx - 0x3d]
adc al, 0xd8
pop edx
adc eax, esp
jnp 0x4ef87f
and cl, ah
mov ecx, 0xe943bf9f
retf 0xaa18
cmp eax, dword [edx + 0x55]
or ebx, edx
inc edx
push ebx
or byte cs:[edi + 0x7226024a], dl
sub dword [edx + 0x7bcdeb93], 0x3f
jbe 0x4ef93b
jb 0x4ef84c
stosb byte es:[edi], al
xchg ebx, eax
jmp 0x4ef89a
aad 0x87
xchg ebx, eax
cdq
sub eax, 0xcdab6ad9
wait
sub dword [edi - 0x76e67496], 0x3fa82f78
aad 0x31
add cl, byte [edi + edi*2 + 0x3a]
sub byte [ebp - 0x4df78fb1], ah
xor al, 0xbb
loope 0x4ef8c9
test al, 0x33
add bl, bh
adc dword [ebx + 9], edx
or dword [edx + ebx*4 + 0x22df7dfa], esi
sbb esp, dword [edi]
sub dword [ebp + 0x2115aa4], edi
inc ebx
jecxz 0x4ef96a
bound esp, qword [ebx + 0x6e]
jno 0x4ef93a
inc esp
rcr dword [ecx + 4], 0x6a
cwde
or cl, byte [esi - 0x6f]
call 0x1c2671ed
sti
jp 0x4ef983
pop edx
lahf
ljmp 0xd4ca
jl 0x4ef8ba
invalid
invalid
jl 0x4ef8ba
retf 0xe9d4
aam 0xe9
pop eax
push ss
stosb byte es:[edi], al
cdq
xor esp, ebx
jae 0x4ef8c7
imul edx, dword [esp + esi*4 + 0x6746ba9f], 7
pop ebp
lahf
mov edx, 0x5d076746
wait
pop ebx
jl 0x4ef9ae
mov ah, 0x77
pop esi
adc dword [edi + esi*4], esi
salc
or dword [ebx + 0x5d], ebp
fidivr dword [ebp - 0x45]
sub ah, ah
int1
sub bl, bh
fmulp st(2)
pop esp
fisttp word [ecx + 0x2c]
add al, 0xad
add al, 0xaa
invalid
sub byte [eax], ch
pop eax
push esi
mov edi, 0xfada081f
iretd
scasd eax, dword es:[edi]
mov byte [0xcbe5180d], al
dec ecx
pop ds
or ebx, dword [ebx + ecx*2 - 0x15]
nop
dec edx
add al, 0x5b
je 0x4ef92d
test al, 0xf8
fistp dword [esp + ecx*8 - 0x19]
mov dword [0xadde3c99], eax
cmp al, 0xde
lodsd eax, dword [esi]
fcomp dword [ebx + 0x3eceaa73]
xor eax, edx
jmp 0x4ef98e
push ss
imul ebx, ebx, 0x18e749ca
lea esi, [esp + ebx + 0x28e2befa]
popal
stosb byte es:[edi], al
push 0xffffffffffffff9a
or al, 4
dec ebx
push edi
inc edi
jns 0x4ef982
out dx, al
invalid
Function at 0x5833c9
Capabilities:
Encode data using xor

Disassembly:
dec eax
out 0xaa, eax
loop 0x5833f5
dec byte [edi - 0x539be09d]
sbb bl, byte [ecx - 0x74e70cbb]
inc ebp
invalid
xchg esi, eax
cdq
pop eax
inc ebx
mov ah, ah
daa
out 0x29, al
xor dh, byte [eax]
inc edi
mov eax, dword [0xaa127962]
xor bh, byte [edi - 0x51]
inc esp
mov ah, 0xc9
je 0x5833fb
inc edi
test al, 0x2c
or dword [esi + 0x4e], esi
xchg dword [eax + 0x49], ebp
sub esp, dword [edx - 0x61c90c90]
call 0x2d100908
xor bl, bh
mov es, edx
adc al, 0xfa
std
js 0x58344f
das
dec edx
mov edi, 0xe7a32a43
adc byte [esi], 0xc7
les edi, [eax + 4]
ror edi, 1
mov word [ebx - 7], ds
or al, byte [edx - 0x12b77cca]
stosd dword es:[edi], eax
add al, 0x17
sbb al, 0x6f
pushal
invalid
sub byte [edx - 0x49], dl
sahf
sbb eax, 0xc9e6685e
in eax, dx
inc ebx
cld
cmp eax, 0xefe1fac4
push esi
cwde
or edi, dword [eax + 0x77c6a857]
imul ebp, dword [eax + 0x74601937], 0xa
adc al, 0x84
int 0x90
sbb ah, ah
xor byte [eax + 0x12], bl
and ebp, dword [ecx]
in eax, 9
dec eax
dec ebp
adc ebx, 0x15
test eax, 0xdf8c3bdc
fst qword [eax]
std
jmp 0x397cc8dd

Function at 0x58a6e6
Capabilities:
Encode data using xor

Disassembly:
cmp dword [eax], 0xffffffcc
push ebx
sbb eax, ebp
sub eax, 0xeab740f8
dec esp
enter 0xffffffffffff9b5d, 0xffffffffffffff81
dec ebp
mov dword [0xcb2a0e19], eax
sub edx, dword [ebx]
dec esi
mov esi, 0x50381109
sti
xor esp, dword [0x698a6835]
mov al, byte [0x97ae72f6]
test dword [edx + 0x2c], edx
adc cl, byte [edx + esi*4 - 0x2d83cc88]
dec ebp
xor dword [ecx], 0xffffffe7
pop es
nop
push 0x22
cmp dword [edx + 0x39], edx
ror byte [ebx - 0x77c1f9e], 1
cld
popal
push 0x9579b008
mov eax, 0xb9b363ba
mov byte [0x8b45c951], al
clc
imul ebx, dword [ecx - 0x4b], 0xffffff99
cli
xchg edx, ecx
xchg ecx, eax
mov esi, 0xac483aa6
scasd eax, dword es:[edi]
add dword ds:[eax], esp
pushal
push 0xf59c69b4
jl 0x58a680
retf 0xd979
Function at 0x59819d
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xb04083cb
pop ecx
jno 0x598195
and byte [eax], dl
ret
jnp 0x5981f6
and byte [ecx + ecx*8 + 0x3ad49912], ch
push es
cmpsd dword [esi], dword es:[edi]
jb 0x598226
and byte [eax - 0x45c817df], ch
out dx, al
jae 0x598200
sahf
sub dword [0x524ceacd], ecx
fld qword [edi]
push edx
push esi
leave
test dh, dl
jmp 0x598190
ror dword [edi], 0xc4
sbb dword [ebx + 0x10813d0a], ebp
pop eax
mov edi, 0xc6ef598e
cmc
adc dl, byte [ebx]
xor dword [edi], 0xffffff93
jns 0x5981e7
aaa
xchg ebx, eax
dec ecx
cmp eax, 0x2b716a48
popal
iretd
sub esp, dword [ecx - 0x31]
adc dword [esi + 0x2e30f1d], esp
lahf
cmp dword cs:[0xeae074f4], edi
int1
popal
or dl, byte [ebx - 0x50]
nop
push ebx
mov al, 0x90
xlatb
mov ah, byte [ebp + 0x3fa42012]
fadd qword [edx - 0x197582d]
int3
mov ch, 0x45
cdq
adc dword [ebx - 0x78], 0xffffffab
jns 0x59827f
mov cl, 0xa3
dec eax
fistp dword [esi + 0x4a]
sub al, 0x74
out 0x6c, eax
rol byte [esi - 0x4a303d89], 0xe3
and al, 0xe6
out dx, eax
fadd dword [edx]
and ebp, dword [ebx]
loopne 0x59820a
in al, dx
jl 0x5981d8
cwde
cmp eax, 0x2dbcbe4c
mov bl, 0xb3
xchg edx, eax
sbb al, byte [edx - 0xd26d2e2]
adc eax, 0x960d4942
popfd
mov bl, 0x34
or dword [eax + 0x2c], ebx
push edi
stc
bound ecx, qword [ebx - 0x70]
xchg ebp, eax
fadd st(7), st(0)
fnstsw word [eax]
and ah, byte [ebx]
jle 0x59821b
push 0xffffffffffffffa8
jne 0x598295
xor eax, 0x676f0201
fstp xword [0xf993ad42]
cmp eax, 0xf993ad42
movsd dword es:[edi], dword [esi]
call 0xf15bf7c9
int1
xchg edx, eax
pushal
push edi
mov cl, 0xa8
jecxz 0x598297
insb byte es:[edi], dx
fdivr dword [ebp + 0x68]
mov word [esi - 0x75bb9e3], ss
push 0x461d968c
movsb byte es:[edi], byte [esi]
clc
xchg esi, eax
sbb eax, 0xcff8a446
jae 0x598263
iretd
pop edx
inc eax
xor eax, 0x12ee5756
inc esp
add cl, byte [edx + 0x58]
cmpsd dword [esi], dword es:[edi]
xchg edx, eax
invalid

Function at 0x5c6e1e
Capabilities:
Encode data using xor

Disassembly:
pop esp
pushfd
adc eax, eax
pop ss
mov dl, 0xed
xor bh, byte [edx + 0x30575d80]
sub byte [ebp + 0x49ccddfe], ah
adc dword [esi + ebx - 0x4e], esi
insb byte es:[edi], dx
push edx
fbstp tbyte [edx + 0x4739ea46]
inc edi
mov ebp, 0xf976c98b
scasb al, byte es:[edi]
or byte [edi + edx*2 - 0x18], dh
imul esp, dword [ebx], 0x1994c95a
enter 0x706, 0xfffffffffffffff6
mov ch, 0x6e
mov esi, dword [ebx]
push ebp
insb byte es:[edi], dx
xchg edx, eax
imul ebp, dword [eax + ebp], 0xffffffcf
std
in eax, dx
test ebp, ebx
stc
xchg edi, eax
push esi
cmc
fcmovnu st(0), st(4)
invalid
Function at 0x5c986b
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xef55b275
salc
sar byte [ecx + esi - 7], 0xce
mov dword [edi], esp
fisub word [ecx + ecx*2 - 0x5a]
sub dword [esi - 0x5a], edi
and dh, byte [eax]
bound ebx, qword [ebp + 0x7b50192f]
add dword [ebp - 0x5a2096e9], 0x3ceebaae
push ebp
add esi, dword [edx - 0x63]
xchg ebp, eax
lodsb al, byte [esi]
pop edi
pop esi
inc edi
pop esi
pop ecx
pop esp
mov edx, 0x129e1668
and byte [ebx + 0x30], bh
jle 0x5c98d9
mov esi, 0x15959aaa
call [ebp + 0x130e6152]
test dword [ebp + 0xd], ebp
daa
mov bh, 0x39
mov edi, 0x74d9c5c4
xor ebp, ebp
loop 0x5c9898
test dword [ebp + 0x6ef686c6], 0x4785554a
imul esi, ecx, 0xa5dd396d
xor eax, 0x23154e76
inc ecx
invalid
ljmp 0x2b15:0x20e33a95

Function at 0x617391
Capabilities:
Encode data using xor

Disassembly:
daa
or cl, byte [edi + 0x19]
and ch, byte [ebp + 0x33534ee]
cmp eax, 0xa795be9e
mov ebx, 0x22a6785d
xchg ebp, eax
invalid
jne 0x6173c8
leave
bound eax, qword [edx + 0x28]
or byte [edi - 0x78], dh
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
std
movsb byte es:[edi], byte [esi]
mov byte [0xd831d49d], al
test eax, 0xc3db5477
push ebp
xor ch, byte [edx]
xchg byte [ebx], bl
and dword [ebx], edi
jno 0x61730c
jp 0x617371
and al, 0xf9
mov ah, 0x3b
mov dh, dh
and al, 0xdf
jp 0x617302
fistp qword [edx - 0x72]
invalid
invalid
jns 0x6173f8
mov word [ebx - 0x2c06618a], ss
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
jp 0x617348
mov edx, 0x93240649
sub dword [ecx + ebx - 0x3ae3ab4c], esp
pop edx
and ecx, ecx
add al, 0x27
adc dword [ecx], eax
mov ecx, 0x84b27549
sti
lahf
jmp 0x6173e7
outsb dx, byte [esi]
cmp al, byte [esi]
inc ecx
sub eax, edi
inc ecx
push ds
movsd dword es:[edi], dword [esi]
xor byte [eax], bh
shl dword [0xd9338398], cl
cmc
jecxz 0x61737b
sti
add dword [eax + 0x11], ecx
cmp byte [esi + 0x25], dl
imul edi, dword [ebx + 0x6a], 0x7d
cmc
jge 0x6173de
imul ebx, dword [ebx], 0x5f
mov eax, 0x943a552d
or byte [ecx], bh
jne 0x61741e
xchg edx, eax
jmp 0xc5c3f61
retf
sal dword [ebp + 0x4be99c25], 1
movsb byte es:[edi], byte [esi]
cmp ah, cl
loope 0x6173cf
cmpsd dword [esi], dword es:[edi]
clc
pop esi
in al, 0x5e
adc eax, 0xa33f5a4f
add eax, 0x3baeb6de
mov bh, 0xff
adc eax, 0x85a91bfc
dec edi
pop eax
imul edi, dword [ecx], 0xfba8231a
pop es
pop es
xchg esp, eax
pop es
adc dl, byte [edx + 0x74]
std
add byte [ebp - 0x29], dh
jne 0x617427
mov bl, 0x3b
mov edi, 0xbb7b05d4
mov dl, 2
sbb ch, dl
mov ebx, 0xd51802b2
mov esp, esp
out dx, al
xor byte [ebp - 0x3b], 0x55
jne 0x617426
push ebp
or eax, 0x1f97325
sub al, 0x30
jp 0x617445
mov cl, 0x5d
popal
cmp ebp, dword [esi]
mov eax, 0x858ae9cc
wait
jge 0x617456
sub ah, byte [ebx + 0x4f]
mov edi, 0x95a869a1
jmp 0x61745f
Function at 0x61d911
Capabilities:
Encode data using xor

Disassembly:
push 0xdba1e150
mov ecx, 0x72378901
test dword [esp + esi], eax
push 0xffffffffffffff89
retf
pop esp
add eax, 0xcc381a96
xlatb
jg 0x61d949
imul ecx, dword [edi], 0x32
jmp 0x3775973a
xchg esp, eax
jmp 0x61d8fe
mov ch, 0xb4
or edx, dword [ecx + 0x2d]
add al, 0x3f
jb 0x61d8ed
enter 0xffffffffffffd9f7, 0x6d
out 0xb8, al
inc esp
jecxz 0x61d905
cmpsd dword [esi], dword es:[edi]
mov byte [edx - 0x59], dl
inc ebp
sub ebp, dword [ecx - 0x45878b65]
daa
adc eax, 0x5d9af99e
mov al, byte [0x50bb2c2d]
xor esi, ebx
ja 0x61d972
mov eax, 0x5a53bb4
dec ecx
idiv byte [edx - 0x41f94304]
cwde
dec esi
pop dx
push edi
add eax, esi
sub dword [edi], esp
sub ebp, edi
sub dword [ecx + 0x1b], ebp
fadd qword [eax + 0x29b5fb0b]
xor eax, 0x1ec8d278
fisub word [ebp - 0x5e]
adc dword [ecx - 0x1b1fa8db], ebp
add al, 0xed
or dword [ebp + 0x18a4d986], esp
inc ebp
pop esi
xchg edx, eax
std
leave
invalid
Function at 0x10cc200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6eb000]
push edi
or ebp, 0xffffffff
jmp 0x10cc222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10cc229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10cc218
mov eax, 1
add ebx, ebx
jne 0x10cc23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10cc24c
jne 0x10cc26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10cc26b
dec eax
add ebx, ebx
jne 0x10cc258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x10cc230
add ebx, ebx
jne 0x10cc267
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x10cc2bd
xor ecx, ecx
sub eax, 3
jb 0x10cc283
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x10cc2f2
sar eax, 1
mov ebp, eax
jmp 0x10cc28e
add ebx, ebx
jne 0x10cc28e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10cc25c
inc ecx
add ebx, ebx
jne 0x10cc29c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10cc25c
add ebx, ebx
jne 0x10cc2a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x10cc29e
jne 0x10cc2ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10cc29e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10cc2dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10cc2ce
jmp 0x10cc21e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10cc2dc
add edi, ecx
jmp 0x10cc21e
pop esi
mov edi, esi
mov ecx, 0xcaf2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10cc2fa
cmp byte [edi], 0x26
jne 0x10cc2fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10cc2ff
lea edi, [esi + 0xcc9000]
mov eax, dword [edi]
or eax, eax
je 0x10cc377
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd0f098]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd0f1f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10cc32c
mov ecx, edi
jns 0x10cc35b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd0f200]
or eax, eax
je 0x10cc371
mov dword [ebx], eax
add ebx, 4
jmp 0x10cc349
call dword [esi + 0xd0f1fc]
mov ebp, dword [esi + 0xd0f204]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x10cc3ab
sub esp, 0xffffff80
jmp 0x5a8cb2
Function at 0xae6370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xae638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xb0f074
push ecx
mov edi, eax
call fcn.00afa198
mov esi, eax
add esp, 8
test esi, esi
jne 0xae63cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00afa02e
push esi
call fcn.00af9fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0xae9850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0xae98ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0xb14720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xae98ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.00afa1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0xae98ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0xb14720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0xae992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.00afb082
xor esi, esi
add esp, 8
cmp eax, esi
je 0xae9957
mov word [eax], si
add eax, 2
push eax
call fcn.00afb030
add esp, 4
jmp 0xae9959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0xae98ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0xae98b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0xae9ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret