joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4284a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46d148
push eax
mov eax, dword [ebp + 0xc]
mov dword fs:[0], esp
push ebx
push esi
test eax, eax
push edi
je 0x4284f6
lea ecx, [ebp + 0x14]
mov ebx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp + 0x14]
lea edx, [ebp + 0xc]
or ecx, 0x20006
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [ebp + 0xc]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x4284fb
mov esi, dword [ebp + 8]
mov ebx, esi
test esi, esi
je 0x4285ea
call fcn.0041e820
test eax, eax
je 0x42854a
mov edi, dword [ebp + 0x18]
push edi
call fcn.0040cf4b
add esp, 4
lea edx, [eax + eax + 2]
mov eax, dword [ebp + 0x10]
push edx
push edi
push 1
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4285df
cmp esi, ebx
je 0x428540
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4285ec
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x428555
xor edi, edi
jmp 0x42858a
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + eax + 2]
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.0040d1d0
mov ecx, dword [ebp + 0x10]
mov edi, esp
push 0
push 0
push ebx
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [ebp + 8]
mov edx, dword [ebp + 0x18]
lea ecx, [ebp + 0xc]
push edx
call fcn.0043a2b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4285d0
cmp esi, ebx
je 0x4285ba
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.0043aac0
mov eax, 1
jmp 0x4285ec
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
call fcn.0043aac0
cmp esi, ebx
je 0x4285ea
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429260
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4293dd
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4293bc
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x4292b6
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call fcn.00453d1c
mov esi, eax
add esp, 4
test esi, esi
je 0x4293dd
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4293d4
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4293d4
mov edi, dword [esp + 0x20]
test edi, edi
je 0x4293d4
push ebp
push edi
call fcn.00429260
add esp, 8
test eax, eax
je 0x4293c9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x486a98]
test eax, eax
je 0x429365
test ebp, ebp
je 0x429365
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x4293d4
jmp 0x429371
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x4293d4
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x4293b3
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x4293d4
mov eax, dword [esp + 0x14]
jmp 0x42930e
push esi
call fcn.00453d45
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x4293d4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00453d45
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x42db50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, eax
shr eax, 4
and esi, 0xf
inc eax
push edi
mov edi, dword [esp + 0xc]
and eax, 0xffff
push ecx
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x42db9e
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x42db9e
xor edx, edx
xor ecx, ecx
mov cx, word [eax]
add eax, 2
cmp esi, edx
je 0x42dba3
inc edx
lea eax, [eax + ecx*2]
cmp edx, 0x10
jl 0x42db89
pop edi
xor eax, eax
pop esi
ret
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
test edi, edi
jne 0x42dbb3
test esi, esi
jne 0x42dbd1
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x42dbcf
mov byte [eax + esi - 1], 0
jne 0x42dbd8
mov byte [esi + edi - 1], 0
mov eax, edi
pop edi
dec eax
pop esi
ret

Function at 0x4332c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x433310
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x433310
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x433315
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x4332fb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x433322
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret
Function at 0x43e740
Capabilities:
Extract resource via kernel32 functions
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, eax
push esi
mov esi, dword [esp + 0x10]
and ebp, 0xf
shr eax, 4
inc eax
push edi
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x43e799
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x43e799
xor edi, edi
xor ebx, ebx
mov bx, word [esi]
add esi, 2
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp ebp, edi
je 0x43e7a0
inc edi
lea esi, [esi + ebx*2]
cmp edi, 0x10
jl 0x43e77d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov edx, ecx
xor eax, eax
mov edi, ebp
push 0
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
dec eax
push eax
push ebp
push ebx
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x43e79b
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
pop edi
dec ecx
pop esi
pop ebp
mov eax, ecx
pop ebx
ret

Function at 0x444270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x4442c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4442c0
xor ecx, ecx
xor eax, eax
mov ax, word [esi]
add esi, 2
cmp edi, ecx
je 0x4442c5
inc ecx
lea esi, [esi + eax*2]
cmp ecx, 0x10
jl 0x4442ab
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea ecx, [edx - 1]
cmp eax, ecx
jle 0x4442d2
mov eax, ecx
lea edx, [eax + eax]
push ebx
mov ebx, dword [esp + 0x1c]
mov ecx, edx
push ebp
mov ebp, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
pop ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov word [edx + ebx], 0
pop ebx
pop edi
pop esi
ret

Function at 0x455690
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4556c8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00459365
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045933c
jmp 0x4556d4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x457495
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4574d7
call fcn.004643a9
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4574d7
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4574ce
xor eax, eax
jmp 0x4574df
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004574e5
pop edi
pop esi
pop ebx
ret 4
Function at 0x403bf5
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1804
call fcn.0040fc60
mov eax, dword [0x2872804]
mov ecx, dword [0x2872290]
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x403cc9
mov edi, ecx
mov ebx, eax
cmp dword [0x2872804], 0x959
jne 0x403cb9
push esi
lea eax, [ebp - 0x1000]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
push esi
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403768
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x40378c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x4037a8
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1800]
push eax
push esi
push 0x4037c0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.00403a87
add edi, 8
dec ebx
jne 0x403c21
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403f6f
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1400
call fcn.0040fc60
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 0x986
jge 0x403fad
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp edi, 0x4f4c8ec
jg 0x403fc8
inc edi
cmp edi, 0x3455969
jl 0x403f85
cmp dword [0x2872804], 0x400
jne 0x4040c7
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x40c]
push eax
push esi
push 0x403940
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push esi
lea eax, [esp + 0xc0c]
push eax
push 0x40391c
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0x403984
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
call fcn.00404489
pop ecx
push esi
push esi
call fcn.00404e3e
push esi
push esi
call fcn.00404746
push esi
call fcn.00404dd9
add esp, 0x14
push esi
call fcn.004050a7
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404120
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404140
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404620
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404270
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404ad0
fstp st(0)
push esi
push esi
call fcn.00404c24
push esi
call fcn.0040511b
add esp, 0x14
push esi
push esi
call fcn.0040438d
push esi
call fcn.00404eeb
add esp, 0xc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x4040e7
inc edi
cmp edi, 0x3011b
jl 0x4040c9
mov eax, dword [0x47ac64]
mov dword [0x2872804], eax
call fcn.00403cce
mov edi, 0x2ec37
cmp dword [0x2872804], 0x51f
jne 0x404113
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
dec edi
jne 0x4040fb
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40c45e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x477470]
jne 0x40c468
repz ret
jmp fcn.0040fc8b
Function at 0x40c75e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x477470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409c53
and dword [ebp - 0x14], 0
cmp dword [0x48f49c], 0
mov dword [ebp - 0x18], eax
jne 0x40c811
push 0x402a74
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40c8b9
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402a68
push ebx
call edi
test eax, eax
je 0x40c8b9
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x402a58
push ebx
mov dword [0x48f49c], eax
call edi
push eax
call esi
push 0x402a44
push ebx
mov dword [0x48f4a0], eax
call edi
push eax
call esi
push 0x402a28
push ebx
mov dword [0x48f4a4], eax
call edi
push eax
call esi
mov dword [0x48f4ac], eax
test eax, eax
je 0x40c811
push 0x402a10
push ebx
call edi
push eax
call esi
mov dword [0x48f4a8], eax
mov eax, dword [0x48f4a8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40c86a
cmp dword [0x48f4ac], ecx
je 0x40c86a
push eax
call esi
push dword [0x48f4ac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40c86a
test ebx, ebx
je 0x40c86a
call edi
test eax, eax
je 0x40c861
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40c861
test byte [ebp - 8], 1
jne 0x40c86a
or dword [ebp + 0x10], 0x200000
jmp 0x40c89d
mov eax, dword [0x48f4a0]
cmp eax, dword [ebp - 0x18]
je 0x40c89d
push eax
call esi
test eax, eax
je 0x40c89d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40c89d
mov eax, dword [0x48f4a4]
cmp eax, dword [ebp - 0x18]
je 0x40c89d
push eax
call esi
test eax, eax
je 0x40c89d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x48f49c]
call esi
test eax, eax
je 0x40c8b9
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40c8bb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040c45e
leave
ret
Function at 0x502129
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
cmp edx, dword [edx + 0x523814bf]
sbb al, 0xa1
fsubr qword [ebx + edx - 0x1d2bae10]
xchg byte [0x3192eb44], dl
add esi, 0x44
lodsd eax, dword [esi]
mov bl, byte [edx]
mov byte [edi + 0x5dd8553a], ch
invalid
Function at 0x58c459
Capabilities:
Encode data using xor

Disassembly:
add edi, edx
pop ss
push edi
cwde
sub byte [ebx], ch
movsb byte es:[edi], byte gs:[esi]
xlatb
adc dword [edi + 0x1e1e17b1], 0x13
aaa
mov ebx, 0x6383f327
mov bh, 0x26
xchg bh, ah
pop ds
add esi, dword [edi + 0x23507b01]
out dx, eax
pushfd
in eax, 0xdf
aaa
cmp esi, dword [ebx - 0x2325841e]
in eax, 0x2f
jns 0x58c40e
xchg dword [eax + 0x7cb8a4c7], edi
stc
add byte ds:[ebx], 0x95
sub dword [edx + 0xc5fd209], 0x5c
jne 0x58c404
mov dword [edx + 0x51], 0xc1778944
adc dl, dh
lds esi, [edi + 0x3b576382]
xchg ecx, eax
inc edi
mov ecx, 0x3ea59787
push eax
cmp edx, dword [ecx - 0x687846b9]
movsd dword es:[edi], dword [esi]
push eax
jnp 0x58c3b2
adc eax, 0x4c2f8942
xor byte [edi - 0x698132d9], dh
inc ecx
jns 0x58c3d7
sub al, 0xba
arpl word [eax], si
loop 0x58c383
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
stosd dword es:[edi], eax
mov eax, dword [0xe39ed270]
adc al, 0xf3
rol dword [ecx], 0x87
cmp eax, dword [esi + 0x11bc7226]
inc edi
div byte [ebx - 0x65]
xchg dword [ebx], edi
xchg byte [esi], ah
jb 0x58c3c6
jb 0x58c3c6
adc dword [edi - 0xa], eax
jae 0x58c3aa
wait
inc edx
pushal
xchg edi, eax
cld
add dl, 0xb3
sub eax, 0xb7f259cd
push edi
insd dword es:[edi], dx
jmp 0x3c407e7f
mul dword [edx]
jne 0x58c4b4
js 0x58c4a4
mov bl, 0x65
cmc
xor ah, byte [ebx - 0x1875f095]
fsub dword [ecx + 0x106bae5e]
jge 0x58c444
pop esi
mov edi, 0x6e6e5363
or al, byte [edx]
into
lahf
cmp dh, byte [edx + ecx - 0x38147cd2]
cmp dword [ecx - 1], 0xf2f9a29
mov byte [eax - 0x5cdda336], bl
add esp, dword [edi - 0x78343d1a]
lodsd eax, dword [esi]
loope 0x58c407
retf 0x225c
fisttp qword [esi + 0x31]
sbb eax, 0xa3b5dba7
jne 0x58c48c
loopne 0x58c475
adc ecx, dword [ebp + 0x601450f4]
invalid
push es
add bl, ah
pop esp
and al, byte [edi]
in eax, dx
add ebx, dword [esi - 0x11]
mov bh, 0xc3
jl 0x58c531
pop ss
xchg dword [ebx + 0x53d37592], esi
out dx, al
push ebx
test dh, ah
sahf
cmp dword [eax + 0x18d07642], edx
dec edi
add eax, esi
push 0x2a9333c5
test eax, 0xc79d8872
cmpsb byte [esi], byte es:[edi]
push es
pushfd
xchg edx, eax
inc edx
cmpsd dword [esi], dword es:[edi]
and dword [edi + 0x74f914fc], edi
and ebp, dword [eax + 0x76232ed7]
mov al, byte [0xdde8039b]
jae 0x58c4de
je 0x58c503
test al, 0xd7
and esi, dword cs:[esi - 0x60]
wait
add ebp, eax
fnsave dword [ebx - 0xe]
fsub st(0)
sub ah, byte [esi]
fst dword [ebx - 0x3f330900]
push 0xa7ce77d6
pop ebx
dec eax
fadd qword [edx - 0x381e261e]
xchg ebx, eax
inc ebp
xor edx, dword [esi + 0x20]
xor eax, 0x42eea44a
inc edx
out 0xb6, al
jg 0x58c505
test dword [ebx + 0x9fe4053], esp
mov esp, 0x82b913e5
xchg ebp, ebx
iretd
jns 0x58c50c
jnp 0x58c546
cmc
shl dword [ebx - 0x69cd1cda], cl
invalid
push ebp
inc ebx
pop edx
push ecx
dec esi
inc eax
push 0x13
or dword [edx - 0x5f], edi
xchg esp, eax
xchg edx, eax
popfd
add byte [esi + edx*8 - 0x87c6996], dh
xor edi, 0x77
dec ebp
inc eax
xor eax, 0xbeda768e
cwde
and edi, dword [edi - 0x5c]
ret 0x1db
Function at 0x618ae9
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x42278707
cmc
xor eax, 0x896e83b7
mov byte [ecx + 0x74], bh
retf
rcr byte es:[edi], 0xdc
pop es
dec dword [esp + edi*8 + 0x75]
jle 0x618a6b
pushfd
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
mov dword [0x674efb43], eax
push ebp
lodsb al, byte [esi]
lodsb al, byte [esi]
lahf
dec ebp
div dword [edi + edx*2 - 0x78c23e6c]
lodsb al, byte [esi]
xor eax, 0x5ccfbe66
sbb al, 0x8f
pop edx
neg dl
mov dh, 0xac
adc eax, 0xe69b48e3
enter 0x422, 0x48
xchg edi, eax
cmp al, 0x34
xor al, 0x16
dec esp
rol dl, cl
jae 0x618a95
insd dword es:[edi], dx
xor eax, 0xc05e74af
pop esp
add al, 0xef
in eax, dx
dec edx
push 0x2c
pop edi
sti
push esp
out 0x41, al
into
aad 0xc6
jl 0x618b2e
add ah, bh
lock and dword [edx], ebp
inc ecx
in al, dx
invalid
or al, 0x96
pop ds
inc ecx
jmp 0x618a80
pop ecx
cmp eax, 0x540b5d64
out 0xfc, eax
mul byte [ebp + 0x6d]
daa
lcall 0x9633, 0x5a33160d
mov al, byte [0x6689dc26]
add eax, 0x5197b686
invalid

Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10001000
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3c
lea ecx, [ebp - 0x40]
push 0
push ecx
mov dword [ebp - 0x84], 0x3a0043
mov dword [ebp - 0x80], 0x55005c
mov dword [ebp - 0x7c], 0x650073
mov dword [ebp - 0x78], 0x730072
mov dword [ebp - 0x74], 0x50005c
mov dword [ebp - 0x70], 0x620075
mov dword [ebp - 0x6c], 0x69006c
mov dword [ebp - 0x68], 0x5c0063
mov dword [ebp - 0x64], 0x54004e
mov dword [ebp - 0x60], 0x530055
mov dword [ebp - 0x5c], 0x520045
mov dword [ebp - 0x58], 0x44002e
mov dword [ebp - 0x54], 0x540041
mov dword [ebp - 0x50], 0x54002e
mov dword [ebp - 0x4c], 0x2e004d
mov dword [ebp - 0x48], 0x6c0062
mov dword [ebp - 0x44], 0x66
call fcn.10004770
add esp, 0xc
push 0
push 0x80
push 4
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x84]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x40
push 0x1000
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
push 0
lea eax, [ebp - 0x88]
push eax
push esi
push ebx
push edi
mov dword [ebp - 0x8c], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov cl, 0x26
test esi, esi
je 0x10001110
xor byte [eax + ebx], cl
inc eax
add cl, 2
cmp eax, esi
jb 0x10001105
mov eax, dword [ebp - 0x8c]
push eax
ret

Function at 0x10001147
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001151
repz ret
jmp fcn.100013d3