joyce8/EMBER2024-capa huggingface dataset:
Function at 0x546ff2
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005470e0
add esp, 8
mov dword [ebp - 4], 1
jmp 0x54701a
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xa
jge 0x547086
mov dword [ebp - 8], 0
jmp 0x547032
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x547052
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov cl, byte [edx + str.cw]
mov byte [eax], cl
jmp 0x547029
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.00547121
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00547189
add esp, 4
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ebp + 8]
add edx, ecx
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.005470e0
add esp, 8
jmp 0x547011
mov dword [ebp - 0xc], 0
jmp 0x547098
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x10
jge 0x5470b8
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [eax + str.cw]
mov byte [ecx], dl
jmp 0x54708f
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.00547121
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 0xa0
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.005470e0
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x5472e3
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xa0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.005470e0
add esp, 8
mov dword [ebp - 8], 0
jmp 0x547310
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x10
jge 0x547330
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov al, byte [ecx + 0x5aeaac]
mov byte [edx], al
jmp 0x547307
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00547121
add esp, 8
mov dword [ebp - 4], 9
jmp 0x547350
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jle 0x5473bc
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.005470e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.005473d0
add esp, 4
mov dword [ebp - 0xc], 0
jmp 0x54738c
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x10
jge 0x5473ac
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [eax + 0x5aeaac]
mov byte [ecx], dl
jmp 0x547383
push 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.00547121
add esp, 8
jmp 0x547347
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.005470e0
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x54ab53
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
je 0x54ab72
cmp dword [ebp + 0x10], 0
jne 0x54ab7c
mov eax, 0x10d
jmp 0x54ad34
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x54ab8a
cmp dword [ebp + 0xc], 0
jne 0x54ab94
mov eax, 0x103
jmp 0x54ad34
mov eax, dword [ebp + 0xc]
shl eax, 2
xor edx, edx
mov ecx, 3
div ecx
add eax, 0x10
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfa000
jbe 0x54abbc
mov eax, 0x103
jmp 0x54ad34
mov edx, dword [ebp - 0x54]
push edx
push eax
call 0x6b99ce
add esp, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
jne 0x54abe0
mov eax, 0x122
jmp 0x54ad34
lea eax, [ebp - 0x48]
push eax
call fcn.0054aa80
add esp, 4
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x58]
cmp ecx, dword [ebp + 0xc]
jae 0x54ad26
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
jmp 0x54ac1f
mov edx, dword [ebp - 0x4c]
add edx, 1
mov dword [ebp - 0x4c], edx
cmp dword [ebp - 0x4c], 3
jae 0x54ac53
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp + 0xc]
jae 0x54ac53
mov ecx, dword [ebp - 4]
shl ecx, 8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x58]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp - 4]
add ecx, eax
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x58]
add edx, 1
mov dword [ebp - 0x58], edx
jmp 0x54ac16
cmp dword [ebp - 0x4c], 3
jae 0x54ac6c
mov ecx, 3
sub ecx, dword [ebp - 0x4c]
shl ecx, 3
mov eax, dword [ebp - 4]
shl eax, cl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
shr ecx, 0x12
and ecx, 0x3f
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov edx, dword [ebp - 0x50]
mov cl, byte [ebp + ecx - 0x48]
mov byte [eax + edx], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 4]
shr eax, 0xc
and eax, 0x3f
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x50]
mov al, byte [ebp + eax - 0x48]
mov byte [edx + ecx], al
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x50], ecx
cmp dword [ebp - 0x4c], 1
jne 0x54acbd
mov dword [ebp - 0x5c], 0x3d
jmp 0x54accf
mov edx, dword [ebp - 4]
shr edx, 6
and edx, 0x3f
xor eax, eax
mov al, byte [ebp + edx - 0x48]
mov dword [ebp - 0x5c], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x50]
mov cl, byte [ebp - 0x5c]
mov byte [edx + eax], cl
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x4c], 1
je 0x54ad03
cmp dword [ebp - 0x4c], 2
je 0x54ad03
mov eax, dword [ebp - 4]
and eax, 0x3f
xor ecx, ecx
mov cl, byte [ebp + eax - 0x48]
mov dword [ebp - 0x60], ecx
jmp 0x54ad0a
mov dword [ebp - 0x60], 0x3d
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x50]
mov dl, byte [ebp - 0x60]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x50]
add eax, 1
mov dword [ebp - 0x50], eax
jmp 0x54abfa
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x50]
mov byte [edx + eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x56831b
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
push 0x40
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
call fcn.0045c936
add esp, 0xc
pop ebp
ret 4
Function at 0x584495
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x5844c6
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00575391
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x5844d3
xor eax, eax
jmp 0x58464e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x5844ed
mov eax, dword [ebp - 4]
jmp 0x58464e
jmp 0x584501
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x58457c
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x584549
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x58456e
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x584540
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x5844ef
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x58464b
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x5845a5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x5845ca
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x58459c
jmp 0x5845d5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x5845e6
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x5845cc
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x5845fa
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x58461f
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x5845f1
mov dword [ebp - 8], 3
jmp 0x584631
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x584644
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x584628
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x5d1560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5d166c
test eax, eax
je 0x5d166c
push esi
push edi
mov ecx, 0x10
mov esi, 0x5ed008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x5d1653
lea edi, [eax + 4]
jmp 0x5d15b7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x5d15cc
mov dword [ebp - 4], 2
jmp 0x5d15ed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x5d15e3
mov dword [ebp - 4], 1
jmp 0x5d15ed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x5d1663
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x5d1626
mov byte [ecx], 0x3d
jmp 0x5d1632
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x5d163d
mov byte [ecx], 0x3d
jmp 0x5d1643
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x5d15b4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d1590
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x5d166c
test eax, eax
je 0x5d166c
push esi
push edi
mov ecx, 0x10
mov esi, 0x5ed008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x5d1653
lea edi, [eax + 4]
jmp 0x5d15b7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x5d15cc
mov dword [ebp - 4], 2
jmp 0x5d15ed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x5d15e3
mov dword [ebp - 4], 1
jmp 0x5d15ed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x5d1663
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x5d1626
mov byte [ecx], 0x3d
jmp 0x5d1632
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x5d163d
mov byte [ecx], 0x3d
jmp 0x5d1643
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x5d15b4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d5350
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x5d536f
mov ebx, dword [ebp + 8]
push eax
call fcn.005d4920
test al, al
je 0x5d53a9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5d5377
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.005dbd64
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.005d1680
add esp, 0x14
test al, al
jne 0x5d53b4
push edi
call fcn.005dc454
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.005d1790
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x5d5407
call fcn.005d1d10
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x5d5410
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.005d1560
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.005dc454
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x5ed438
test bl, bl
jne 0x5d545a
mov eax, 0x5ed450
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.005d4e30
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.005d4e30
test bl, bl
je 0x5d547c
call fcn.005d4f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10cb30b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1012fbc
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10cb363
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1009aca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10cb356
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10cb365
xor eax, eax
pop esi
leave
ret 4

Function at 0x4324b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23000]
push edi
jmp 0x4324ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4324d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4324c0
mov eax, 1
add ebx, ebx
jne 0x4324e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4324d8
jne 0x4324f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4324d8
xor ecx, ecx
sub eax, 3
jb 0x432508
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43257a
mov ebp, eax
add ebx, ebx
jne 0x432513
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x432520
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x432544
inc ecx
add ebx, ebx
jne 0x432530
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x432525
jne 0x432541
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x432525
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x432564
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x432555
jmp 0x4324c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x432564
add edi, ecx
jmp 0x4324c6
pop esi
lea edi, [esi + 0x30000]
mov eax, dword [edi]
or eax, eax
je 0x4325cc
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x32fcc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x33008]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x432581
mov ecx, edi
jns 0x4325b0
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x33010]
or eax, eax
je 0x4325c6
mov dword [ebx], eax
add ebx, 4
jmp 0x43259e
call dword [esi + 0x3300c]
mov ebp, dword [esi + 0x33014]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x432600
sub esp, 0xffffff80
jmp 0x403670
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x708dfc
lea esi, [eax]
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
mov ecx, 0xd4e4027f
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
mov ebx, 0xa4e81020
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [edi], edx
stosd dword es:[edi], eax
loop 0x4010a6
shr byte [edx - 0x45d61c4d], 1
arpl word [edi - 0x278de9a], dx
sub dword [edx + 0x21669763], edi
xchg ebp, edi
jo 0x4010b7
adc byte [ebx - 0x7b], dh
jae 0x40102e
xlatb
in al, dx
scasd eax, dword es:[edi]
rol dword [0xffffd0cf], 1
fisub dword [edx + 0x3d]
xchg edi, eax
xchg ebp, eax
push 0xa7e35ce0
iretd
loopne 0x401115
jecxz 0x401062
jmp 0x4010fb
inc edi
inc ebp
invalid
test byte [edi + 0x73], al
fsub dword [edx + 0x3d]
enter 0x419d, 0xffffffffffffff8b
pop es
mov eax, dword [edi]
jmp 0x4010de
push es
aas
dec esp
sbb al, 0xb2
or ecx, esi
pushal
jp 0x40110e
xchg dword [edi], edi
push ebp
arpl word [edx], bx
xchg ebp, eax
and dword [ecx + 0x73], 0x27
push esi
leave
adc bh, byte [0xf1cfcb47]
mov ecx, dword [esi + 0x2afe0d5e]
push ebx
lcall 0x58e9, 0xe192ed67
pop eax
outsb dx, byte [esi]
sub byte [eax + 0x15], ah
mov ecx, 0x775fedc3
test byte [eax + 0x35], ch
setb byte [ebx + ecx*8 + 0x4f]
jne 0x4010f2
and eax, 0x92ec4218
mov byte [edi - 0x59], 3
pop ss
shl byte [esi - 0x1d838009], 1
mov ah, byte [edx]
mov ch, 0xee
leave
or byte [esi], bh
or ch, ah
inc esp
or dword [esi - 0x672e35e7], eax
popal
pop ds
xlatb
invalid
Function at 0x1001587
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001150
call fcn.010017b0
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
or edi, 0xffffffff
mov dword [ebp - 4], edi
cmp word [0x1000000], 0x5a4d
jne 0x10015db
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x10015db
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x10015f3
cmp ecx, 0x20b
je 0x10015e0
mov dword [ebp - 0x1c], ebx
jmp 0x100160a
cmp dword [eax + 0x1000084], 0xe
jbe 0x10015db
xor ecx, ecx
cmp dword [eax + 0x10000f8], ebx
jmp 0x1001604
cmp dword [eax + 0x1000074], 0xe
jbe 0x10015db
xor ecx, ecx
cmp dword [eax + 0x10000e8], ebx
setne cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
mov dword [0x1002340], edi
mov dword [0x1002344], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1002338]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1002334]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1002348], eax
call fcn.010017a8
cmp dword [0x1002008], ebx
jne 0x1001667
push fcn.010017a8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001791
push 0x10010a4
push 0x10010a0
call sub.msvcrt.dll__initterm
mov eax, dword [0x1002330]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100232c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x100109c
push 0x1001094
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
cmp byte [eax], 0x22
jne 0x10016f2
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x10016d2
cmp cl, 0x22
jne 0x10016c3
cmp byte [eax], 0x22
jne 0x10016db
inc eax
mov dword [ebp - 0x20], eax
mov cl, byte [eax]
cmp cl, bl
je 0x10016e6
cmp cl, 0x20
jbe 0x10016d7
test byte [ebp - 0x54], 1
je 0x10016fd
movzx ecx, word [ebp - 0x50]
jmp 0x1001700
cmp byte [eax], 0x20
jbe 0x10016db
inc eax
mov dword [ebp - 0x20], eax
jmp 0x10016f2
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call fcn.01001356
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x100171e
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x100175a
mov eax, esi
jmp 0x100176e
call fcn.010017eb
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx