joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a8ab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e2c0]
jne 0x1000a8b5
repz ret
jmp fcn.1000ca5c

Function at 0x10013cd8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001e2c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000f8dc
and dword [ebp - 0x14], 0
cmp dword [0x1002001c], 0
mov dword [ebp - 0x18], eax
jne 0x10013d8b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10013e33
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10013e33
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1002001c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10020020], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10020024], eax
call edi
push eax
call esi
mov dword [0x1002002c], eax
test eax, eax
je 0x10013d8b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10020028], eax
mov eax, dword [0x10020028]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10013de4
cmp dword [0x1002002c], ecx
je 0x10013de4
push eax
call esi
push dword [0x1002002c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10013de4
test ebx, ebx
je 0x10013de4
call edi
test eax, eax
je 0x10013ddb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10013ddb
test byte [ebp - 8], 1
jne 0x10013de4
or dword [ebp + 0x10], 0x200000
jmp 0x10013e17
mov eax, dword [0x10020020]
cmp eax, dword [ebp - 0x18]
je 0x10013e17
push eax
call esi
test eax, eax
je 0x10013e17
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10013e17
mov eax, dword [0x10020024]
cmp eax, dword [ebp - 0x18]
je 0x10013e17
push eax
call esi
test eax, eax
je 0x10013e17
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1002001c]
call esi
test eax, eax
je 0x10013e33
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10013e35
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a8ab
leave
ret
Function at 0x4123a3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040ae14
and dword [ebp - 4], 0
cmp dword [0x422444], 0
mov ebx, eax
jne 0x412454
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412505
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412505
push eax
call fcn.0040ada2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x422444], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x422448], eax
call esi
push eax
call fcn.0040ada2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42244c], eax
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422454], eax
test eax, eax
je 0x412454
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ada2
pop ecx
mov dword [0x422450], eax
mov eax, dword [0x422450]
cmp eax, ebx
je 0x4124ac
cmp dword [0x422454], ebx
je 0x4124ac
push eax
call fcn.0040ae1d
push dword [0x422454]
mov esi, eax
call fcn.0040ae1d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4124ac
test edi, edi
je 0x4124ac
call esi
test eax, eax
je 0x4124a3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4124a3
test byte [ebp - 0xc], 1
jne 0x4124ac
or dword [ebp + 0x10], 0x200000
jmp 0x4124e5
mov eax, dword [0x422448]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4124e5
mov eax, dword [0x42244c]
cmp eax, ebx
je 0x4124e5
push eax
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x4124e5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x422444]
call fcn.0040ae1d
pop ecx
test eax, eax
je 0x412505
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412507
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x427e1e
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x3c244434
xor al, 0xc7
and al, 0x3c
xor al, 0x6c
mov cl, 0x35
xor al, 0xc7
and al, 0x3c
xor al, 0xe5
and al, 0x3c
xor al, 0xac
mov cl, 0x35
xor al, 0xf4
and al, 0x3c
xor al, 0x22
and al, 0x3c
xor al, 0xbc
mov cl, 0x35
xor al, 0x22
and al, 0x3c
xor al, 0x3e
and eax, 0xb1e4343c
xor eax, 0x3c253e34
xor al, 0x5a
and eax, 0xb1f0343c
xor eax, 0x3c255a34
xor al, 0x79
and eax, 0xb1fc343c
xor eax, 0x3c258434
xor al, 0x6d
sub bh, byte [esp + esi]
or byte [ecx + 0x2a6d3435], dh
cmp al, 0x34
xchg esp, eax
sub bh, byte [esp + esi]
push esp
mov bl, 0x35
xor al, 0x94
sub bh, byte [esp + esi]
mov ebx, 0x70343c2a
mov bl, 0x35
xor al, 0xbb
sub bh, byte [esp + esi]
sbb byte [edx], ch
cmp al, 0x34
invalid
Function at 0x7f6db4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
test eax, eax
je 0x7f6e52
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x7f6e52
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x7f6e52
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x7f6e52
mov ebx, dword [eax + 0x34]
mov dword [ebp - 0xc], ebx
mov ebx, dword [eax + 0x50]
mov dword [ebp - 8], ebx
push edi
push 4
push 0x2000
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x20a72eda]
pop edi
test eax, eax
jne 0x7f6e45
push edi
push 4
push 0x2000
push dword [ebp - 8]
push 0
call dword [edi + 0x20a72eda]
pop edi
test eax, eax
je 0x7f6e52
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x14], eax
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x7f6ed7
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov eax, dword [ebp + 8]
mov ebx, dword [eax + 0x14]
mov dword [ebp - 8], ebx
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x7f6f83
push ecx
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jae 0x7f6f18
mov ecx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
push ecx
push edi
push 4
push 0x1000
push dword [ebp - 4]
push eax
call dword [edi + 0x20a72eda]
pop edi
pop ecx
test eax, eax
je 0x7f6f76
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x7f6f56
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 0xc]
lea eax, [ebx + 0x10]
cmp dword [eax + 4], 0
je 0x7f6f6b
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x7f6eff
pop ecx
mov dword [ebp - 0x10], 0
jmp 0x7f6f8a
mov dword [ebp - 0x10], 1
popal
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x7f71a4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x14], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x7f721e
push ecx
mov ecx, dword [ebx + 0xc]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebx + 0x24]
push edx
call fcn.007f7149
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [edi + 0x20bf7a51]
pop edi
test eax, eax
jne 0x7f7214
pop ecx
jmp 0x7f7225
add ebx, 0x28
pop ecx
dec ecx
jmp 0x7f71cd
mov dword [ebp - 0x18], 1
popal
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x7f73cb
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x7f751f
cmp dword [ebp + 0xc], 0
jne 0x7f751f
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x7f7412
sub eax, dword [ebp + 0x10]
js 0x7f751f
je 0x7f751f
cmp eax, dword [ebp + 0x14]
jl 0x7f751f
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x7f751f
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x7f751f
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x20a72eda]
pop edi
test eax, eax
je 0x7f751f
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x20c4d782]
push eax
call fcn.007f6433
pop edi
test eax, eax
je 0x7f751f
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x20c4d786]
push eax
call fcn.007f6433
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x7f7512
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x7f751f
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x7f74ff
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x7f74cd
push dword [ebp + 8]
call fcn.007f82c1
jmp 0x7f7526
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x7f78b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x7f79a0
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x7f79a0
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x7f794c
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x7f79a0
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x20c4d8e2]
pop edi
pop ecx
test eax, eax
jne 0x7f7905
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x7f7952
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x7f79a0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x7f79a0
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x7f79a0
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x7f79a0
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.007f77fa
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x805364
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x80537f
add esi, 0x1000
lea eax, [ebp - 0x2bc]
push edx
push 0x1c
push eax
push esi
call dword [edx + 0x20c5c5a4]
pop edx
test eax, eax
je 0x805451
cmp dword [ebp - 0x2ac], 0x1000
jne 0x805440
test dword [ebp - 0x2a8], 1
jne 0x805440
and dword [ebp - 0x2a8], 0x100
jne 0x805440
push esi
push edx
push 4
push esi
call dword [edx + 0x20a728eb]
pop edx
pop esi
test eax, eax
je 0x8053e3
jmp 0x805440
cmp word [esi], 0x5a4d
jne 0x805440
mov eax, esi
push ebx
mov ebx, dword [esi + 0x3c]
add eax, ebx
pop ebx
cmp dword [eax], 0x4550
jne 0x805440
lea eax, [ebp - 0x28c]
push edx
push 0x28a
push eax
push esi
call dword [edx + 0x20a72ab7]
pop edx
test eax, eax
je 0x805440
lea eax, [ebp - 0x28c]
push eax
call fcn.008052c0
test eax, eax
jne 0x805439
jmp 0x805440
mov eax, esi
jmp 0x805451
mov esi, dword [ebp - 0x2b0]
add esi, dword [ebp - 0x2bc]
jmp 0x80537f
pop esi
leave
ret 4
Function at 0x8ea202
Capabilities:
Encode data using xor

Disassembly:
pop edx
sti
pop edx
sub edx, 4
shr dword [esp], 2
shl dword [esp], 2
add edx, dword [esp]
neg dword [esp]
xor ebx, ebx
mov eax, dword [edx + ebx]
xor eax, 0x4faf22c6
xor eax, 0x236c9e0e
add eax, 0x24b989e9
mov dword [edx + ebx], eax
sub ebx, 4
cmp ebx, dword [esp]
invalid

Function at 0x8f5db0
Capabilities:
Encode data using xor

Disassembly:
add esi, 0x7dcda8b6
jmp 0x8f5509
mov edx, ebp
pop ebp
shl edx, 8
shr edx, 2
shr edx, 7
sub edx, 0x7dff0a3c
add edx, 0x78db7e47
add edi, 0x7fffc38e
jmp 0x8f591a
mov ecx, edx
pop edx
push 0x2c6b53c4
mov dword [esp], edi
mov edi, ecx
push edi
pop edx
jmp 0x8f58be
sub esi, 0x3c9114e0
jmp 0x8f5c47
mov edx, ebx
mov edi, edx
pop edx
push edi
jmp 0x8f585e
pop esp
push ebx
jmp 0x8f5b45
pop edi
sub ebp, 4
xchg dword [esp], ebp
mov esp, dword [esp]
mov dword [esp], esi
jmp 0x8f5c37
push edx
mov edx, esp
add edx, 4
add edx, 4
xchg dword [esp], edx
jmp 0x8f5591
mov dword [esp], esi
mov dword [esp], edx
push edi
push edx
jmp 0x8f5569
add edi, 0xffffffff
jmp 0x8f5e9c
add dword [esp], 0x7eae669c
pop edx
sub edx, 0x7eae669c
mov edi, dword [esp]
add esp, 4
jmp 0x8f54f5
mov edi, dword [esp]
jmp fcn.008f5bb2
add edi, 0x1dea86dd
push edx
push esi
mov dword [esp], ebp
push 0x7bd419b3
pop ebp
xor ebp, 0x20073857
jmp 0x8f54cb
sub edi, edx
sub edi, 0x7fffc38e
pop edx
add ebp, edi
jmp 0x8f5ada
xchg edi, ecx
not ecx
xchg edi, ecx
xor edi, 0x6d6f80df
dec edi
jmp 0x8f58ed
neg edx
add edx, 0xffffffff
push ecx
mov dword [esp], esi
jmp 0x8f5b35
pop edi
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
xor ecx, 0x320473e0
push 0x184e49f7
mov dword [esp], ecx
add dword [esp], 0x331fbf57
pop ebx
sub ebx, 0x331fbf57
mov ecx, dword [esp]
jmp 0x8f571c
push edi
not dword [esp]
pop edi
jmp 0x8f5757
mov esi, 0x77f41447
xor esi, 0x49aac818
jmp 0x8f5f3c
push edx
mov edx, 0xa74c500
mov ebx, edx
mov edx, dword [esp]
add esp, 4
push ecx
push 0x30a845de
jmp 0x8f573d
sub esp, 4
mov dword [esp], edx
mov edx, 0x391ea4ff
jmp 0x8f5a82
add edx, esi
pop esi
xor edx, 0xb98334c9
add dword [esp + 4], edx
pop edx
push dword [esp]
mov esi, dword [esp]
add esp, 4
add esp, 4
jmp 0x8f5eda
push ebp
mov ebp, esp
push edi
mov edi, 0x7d4c9e27
inc edi
jmp 0x8f5b2b
xor edi, 0x6e74f3ca
jmp 0x8f5efc
cmp esi, 0xffff9d5c
jne 0x8f5a96
sti
push 0x630ca530
mov dword [esp], ecx
push 0x7db39e25
push dword [esp]
jmp 0x8f5f49
neg edi
jmp 0x8f5f03
xor edi, 0x13386de0
add ebp, 0x713ca341
add ebp, edi
push ebx
mov ebx, 0x2e5ff66f
sub ebx, 0x59ff0b8a
not ebx
or ebx, 0x53ff9635
add ebx, 0x5e7e5a4e
shr ebx, 2
sub ebx, 0xc562d922
sub ebp, ebx
pop ebx
jmp 0x8f5656
xchg esi, eax
jmp 0x8f5f42
inc eax
xchg esi, eax
jmp 0x8f535f
pop ecx
push eax
mov dword [esp], ebp
mov ebp, esp
add ebp, 4
push edi
push esi
mov esi, 0x766fbb23
dec esi
shr esi, 7
dec esi
jmp 0x8f5f67
add esi, 0x4ede2190
mov edi, esi
pop esi
jmp 0x8f59a4
Function at 0x4092b9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00406a30
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409354
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x46d428]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x409354
cmp eax, 1
je 0x409375
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409354
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x409321
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x409350
xor eax, eax
inc eax
jmp 0x409394
cmp edi, eax
jae 0x409358
xor eax, eax
jmp 0x409394
cmp eax, esi
jae 0x40935f
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x46d428]
jmp 0x409378
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..reloc
mov ebx, 0x40de38
nop
nop
mov ecx, 0x73e769fe
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..text
mov ebx, 0x4304d8
nop
mov ecx, 0x4b0e1b20
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x408608
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xcb303e60
cld
push es
cmp ecx, dword [ecx]
dec ebx
mov dword [esi], edi
daa
mov byte [esi], 0x71
js 0x4085f8
cwde
pop ebx
and dword [edx + 3], edi
call 0x2292cdf6
fsubr st(4)
inc esi
dec eax
push edx
and bl, al
in al, dx
sub bh, byte [edi + 0x79eb254]
ret
invalid
push ds
or byte [edx - 0x2bdf8b28], dl
sti
sub dword [ebx - 0x28], ebx
cmp eax, 0xb85321bd
dec ecx
adc ecx, dword [esi - reloc.ADVAPI32.DLL_RegCloseKey]
mov gs, word [ebp + 0x668932f4]
and al, 0xa9
outsd dx, dword [esi]
jno 0x4085d2
push esp
scasd eax, dword es:[edi]
jo 0x4085bb
mov bh, 0x1c
jns 0x408594
loope 0x408640
and ecx, eax
ror edi, cl
xor byte [esi], al
enter 0xffffffffffffcfd3, 0x30
push es
out 0x5f, eax
jp 0x4085ac
or esp, dword [edx - reloc.ADVAPI32.DLL_RegCloseKey]
mov esi, 0x436ac759
imul esp, dword [ebx], reloc.ADVAPI32.DLL_RegCloseKey
adc byte [edx + edx*2 + 0x253d850e], 0x1a
cmp ebx, esi
popfd
inc esi
adc eax, 0x15788234
inc esi
or ebx, dword [edi]
xchg dl, bh
lodsd eax, dword [esi]
stc
insb byte es:[edi], dx
inc ebx
jne 0x408679
pop ss
cmpsd dword [esi], dword es:[edi]
enter 0xffffffffffffeeb0, 0x34
sti
out dx, al
xor al, 0xfb
movsd dword es:[edi], dword [esi]
adc eax, 0x2a1d3c23
lodsd eax, dword [esi]
push 0xffffffffffffffb1
push eax
fidivr dword [edi + 0x15]
jo 0x4086ba
cdq
pop es
sub dword [edi - 0x70], 0x4c09668a
imul ebx, ebx, 0x4c
or al, 0xdc
mov cl, 0xd8
fcmove st(0), st(5)
xchg dword [ebp + ecx - 0x4b430c39], ebx
movsb byte es:[edi], byte [esi]
int 0x37
adc byte [eax + eax*4], al
cmp byte [eax + 3], dh
stosd dword es:[edi], eax
jge 0x408603
or ah, ch
in eax, 0x96
xchg esi, eax
jo 0x4086b3
mov al, byte [0x1afede55]
jno 0x408660
pop eax
or dword [eax], ebp
in al, 0x74
idiv byte [edi + 0x12bda433]
mov byte [ebx + edi*2 + 0x79], bh
push esi
mov cl, byte [ebp + 0x58]
xor ah, byte [esi - 0x2f]
cmp dh, byte [ebx]
or eax, ebp
jno 0x40867a
sar word [edx], 1
xor ecx, dword [ebx]
lds esi, [ecx - 0x26]
and bl, byte [esi - 0x2d588dce]
jecxz 0x408698
inc esi
cli
inc edx
add dword [esi + ebp + 0x69], esi
invalid
rol dword [edi + 0x27], 0x8b
fbstp tbyte gs:[ebx - 0x8757e3b]
mov dword [esi + reloc.ADVAPI32.DLL_RegCloseKey], esp
clc
adc eax, 0xba746fb9
lds eax, [ecx - 0x59760876]
cmc
imul ecx, esp, 0xb915f804
outsd dx, dword [esi]
je 0x408684
invalid
Function at 0x7828d4
Capabilities:
Encode data using xor

Disassembly:
inc eax
dec ebx
sub eax, dword [esi - reloc.ADVAPI32.DLL_RegCloseKey]
jno 0x782911
mov dword [reloc.ADVAPI32.DLL_RegCloseKey], eax
jle 0x7828ab
jbe 0x782913
ja 0x782893
lodsb al, byte [esi]
or esi, esp
pop esi
mov ah, 0xe8
jae 0x7828ba
adc dword [esi - reloc.ADVAPI32.DLL_RegCloseKey], esi
invalid
push 0xfffffffffffffff8
popfd
lcall 0xe40c, 0xeff0071a
scasd eax, dword es:[edi]
pop esi
imul esp, edi, 0x39bfbbd4
int 0xfa
popfd
jle 0x782986
loope 0x78294e
std
cmpsb byte [esi], byte es:[edi]
jmp dword [edx]
test eax, 0x73ec4356
inc esi
pop edx
jbe 0x782962
dec esi
aas
mov al, byte [0x6e45f03e]
test eax, 0x253a9042
xchg edx, eax
mov ah, 0xf4
aad 0x47
and eax, 0xd5f4b492
inc edi
push cs
pop ss
inc ecx
xor edx, dword [esi + reloc.ADVAPI32.DLL_RegCloseKey]
or dh, byte [ecx - 0x1d]
invalid
or eax, 0x2243a8cc
mov al, 0x74
retf 0x42b5

Function at 0x7841d8
Capabilities:
Encode data using xor

Disassembly:
invalid
je 0x784175
inc ebx
push 0x34
stc
loopne 0x7841e7
invalid
pop ecx
jg 0x784205
rol dword [esi - reloc.ADVAPI32.DLL_RegCloseKey], cl
mov esi, dword [ebx]
cmp edi, dword [eax - 0x3b]
lodsd eax, dword [esi]
jg 0x78422a
pop esp
add byte [edx + 0xd], bl
scasb al, byte es:[edi]
xor ecx, dword [ebp - 0x31]
jnp 0x7841f9
push edi
fist word ds:[edx + 0x53]
outsd dx, dword [esi]
or ebp, dword [ebx + edx*4 - 0x52]
mov al, byte [0x67a38501]
leave
fldcw word [edx]
and dword [ecx - reloc.ADVAPI32.DLL_RegCloseKey], eax
xor dl, byte [edi]
outsb dx, byte [esi]
jae 0x784295
shr byte [ecx - 0x2419dc38], cl
mov esi, 0xc2f71755
or al, 0x8e
push eax
mov edx, 0x1cfbd0ef
js 0x78422d
test edx, 0xba508e0c
mov ss, word [eax - 0x46]
out dx, eax
sar bl, 1
sbb al, 0x78
idiv dword [edi]
aas
dec esi
xchg esp, eax
sub byte [edi + 0x1b], cl
cmp ebx, dword [ebp - reloc.ADVAPI32.DLL_RegCloseKey]
dec ecx
mov dh, 0x2e
jae 0x784231
or eax, esi
sub bh, byte [esi]
xor dword [esi + reloc.ADVAPI32.DLL_RegCloseKey], edi
int1
add dword [edi + reloc.ADVAPI32.DLL_RegCloseKey], esp
fmul st(6), st(0)
fidiv dword gs:[ebx + 0x70]
in eax, dx
or byte [ebx - 0x44fd03f6], dl
rcr byte [ecx], cl
pop edx
in eax, 0xf4
insb byte es:[edi], dx
inc edi
push ss
sub esi, dword [ebx - reloc.ADVAPI32.DLL_RegCloseKey]
or al, 0x27
daa
dec ebx
jbe 0x784276
push 0x3c6e57dd
mov cl, 0xe6
mov eax, 0x5e3d6fd2
xor byte [ebx - 0x5fbb478], dl
imul edi
lodsd eax, dword [esi]
pushfd
js 0x7842e7
bound eax, qword [edx - 0x68]
js 0x7842f7
pushal
push edx
invalid
lodsb al, byte [esi]
xor dword [ebx + reloc.ADVAPI32.DLL_RegCloseKey], esp
add eax, dword [esi]
push eax
pop esp
movsb byte es:[edi], byte [esi]
adc eax, 0x84e6d5f1
fcmovb st(0), st(3)
and ebp, dword [edi - reloc.ADVAPI32.DLL_RegCloseKey]
test al, 0xd1
fcomp dword [ebp + eax*8 - 0x4303dc85]
pop ecx
push edx
cld
mov esp, dword [esi]
jmp 0xf6610505
test dl, bl
ret