joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7c3e00
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x7d98f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x24]
lea eax, [esp + 4]
push edi
xor edi, edi
push eax
push 0x20019
push edi
push esi
push ecx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x7c3ed2
lea edx, [esp + 0x24]
push eax
push edx
call fcn.007c07a0
add esp, 8
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edi
cmp eax, edi
je 0x7c3e61
mov edx, dword [eax]
jmp 0x7c3e63
xor edx, edx
xor ecx, ecx
push edi
xor eax, eax
push edx
push ecx
mov ecx, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov edx, dword [ecx + 4]
push eax
push esi
push 2
push edx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
call fcn.007c2050
mov eax, dword [esp + 0x44]
add esp, 0x20
cmp eax, edi
mov dword [esp + 0x1c], 0xffffffff
je 0x7c3ebf
mov esi, eax
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x7c3ebf
cmp esi, edi
je 0x7c3ebf
mov ecx, esi
call fcn.007bba00
push esi
call fcn.007c91c8
add esp, 4
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
lea eax, [esp + 0x2c]
push edi
push eax
call fcn.007c0990
add esp, 0xc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], 1
cmp eax, edi
je 0x7c3ef5
mov eax, dword [eax]
jmp 0x7c3ef7
xor eax, eax
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x2c]
push ebx
push esi
push eax
push ecx
push edx
call fcn.007bf640
add esp, 0x10
mov bl, al
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
cmp eax, edi
je 0x7c3f25
mov eax, dword [eax]
jmp 0x7c3f27
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
cmp esi, edi
je 0x7c3f76
lea ecx, [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x7c3f76
cmp esi, edi
je 0x7c3f76
mov eax, dword [esi]
cmp eax, edi
je 0x7c3f5d
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, edi
je 0x7c3f6d
push eax
call fcn.007c91c8
add esp, 4
push esi
call fcn.007c91c8
add esp, 4
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7c3f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x7c3ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7c4035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.007c3e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x7c3fc5
mov edi, 0x7de8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x7c4035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.007c3e00
add edi, 4
add esp, 0xc
cmp edi, 0x7de8c0
jb 0x7c4000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x7c4070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.007ca082
mov esi, eax
add esp, 8
test esi, esi
je 0x7c4107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x7c4102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.007c9946
add esp, 8
test eax, eax
je 0x7c40e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x7c40e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.007c9946
add esp, 8
test eax, eax
jne 0x7c40c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x7c4102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x7c4f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7d99fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7c5002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007c8dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7c5002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007c06e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007c920b
push 0x10
call fcn.007c91d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7c4fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007b51c0
jmp 0x7c4fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007c4b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7c4ff0
mov ecx, edi
call fcn.007b52c0
push edi
call fcn.007c91c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7c5021
inc ebx
cmp ebx, 0x20
jb 0x7c4f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7c6250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7da808
push 0x7ca288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7c6329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7c6329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007c91d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7c6329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7c6329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7c632c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007c6351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7c6d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7c6d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x7c7000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7c7131
push esi
call fcn.007ca145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.007b9080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7c7131
push 0
push ebp
call fcn.007b93a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.007b9260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7c708b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.007b92f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7c7121
push 0x7df918
push edi
call fcn.007c83f0
push eax
push ebx
push esi
call fcn.007c6f60
push 0x7df8f8
push edi
call fcn.007c83f0
push eax
push ebx
push esi
call fcn.007c6f60
push 0x7df8d8
push edi
call fcn.007c83f0
push eax
push ebx
push esi
call fcn.007c6f60
push 0x7df8c0
push edi
call fcn.007c83f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007c6f60
push 0x7df8a0
push edi
call fcn.007c83f0
push eax
push ebx
push esi
call fcn.007c6f60
push 0x7df888
push edi
call fcn.007c83f0
push eax
push ebx
push esi
call fcn.007c6f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7c81b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007c8140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007c8140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007c8140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007c8140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7c8bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7c8c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7da87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7c8c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7c8c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x410728
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410750
add dword [ebp - 4], 2
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x410767
inc dword [ebp - 4]
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx eax, ax
test ah, 0x80
je 0x41077f
add dword [ebp - 4], 8
mov ax, word [ebp - 4]
jmp 0x410788
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41cc1a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x41cc29
pop dword [ebp - 0x20]
mov eax, 0xbc5346f5
add eax, 0x43ee8534
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x4d1d2
push 0
mov eax, 0xbc4f4f0f
sub eax, 0xbc08e737
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0xe788ff7b
sub ecx, 0xe788b9cb
mov esi, eax
mov edi, 0x8c7ec686
add edi, 0x73ca197a
add edi, dword [ebp - 0x20]
mov ebx, 0x6c77d2d
mov edx, dword [edi]
xor dword [ebp - 0xc], 0x755e1e3d
sub edx, ebx
add dword [ebp - 0x1c], 0xf6f87f73
mov dword [esi], edx
add dword [ebp - 0x18], 0x7b36746c
add esi, 0x2cf88139
add esi, 0xd3077ecb
add edi, 0x397277b9
sub edi, 0x397277b5
loop 0x41cc82
add eax, 0x10993
mov ebx, eax
add eax, 0xa473139c
add eax, 0x5b8cec69
mov ecx, 0x54da3b4d
add ecx, 0xab65c4b3
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x4087d5
Capabilities:
Encode data using xor

Disassembly:
lahf
cmc
test al, 0x65
and dh, byte [ebx - 0x7f]
xchg dl, ch
or dword [ebx + 0x75], eax
invalid

Function at 0x44a210
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
push 0x859c40
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x14
push 0x40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
test edi, edi
je 0x44a280
mov edx, dword [0x659a70]
push 0x659788
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
push str.GlobalDDiskDoctor
push 0
lea eax, [esp + 0x18]
push 1
push eax
mov dword [esp + 0x20], 0xc
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
pop edi
mov dword [0x659a6c], eax
pop esi
add esp, 0x14
ret

Function at 0x49ac55
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xe1d57ae4]
invalid
dec edx
inc eax
in al, 0x78
jo 0x49ac0b
js 0x49ac78
add dh, cl
int1
invalid
in eax, dx
adc dword [ecx + edi*2 + 0x35], esi
inc esp
mov cl, 0xa2
xor dword [esi + 0x6dd76331], 0xd74a9c04
adc dl, byte [edi + 0x6bb8549]
cwde
jge 0x49abe1
pop ss
mov dword [ebx], edi
xor al, 0x97
cmp ch, byte [edi + 0x462d5609]
inc edi
test al, ah
invalid
inc edi
pushfd
add edi, dword [ebx + edi*4 - 0x67]
sbb esi, eax
in eax, dx
loope 0x49ac66
sbb esi, dword [ebx + 0x21]
adc esi, 0xd6c16a95
push 0xffffffffffffffc1
salc
cmp al, 0x8b
movsb byte es:[edi], byte [esi]
xor cl, bl
sub dword [edi], esi
outsb dx, byte [esi]
out dx, al
dec ebp
xor dh, bh
or eax, 0x8ed248db
jge 0x49ac06
ror byte [esi - 0x7a817583], cl
jle 0x49ac03
cwde
mov cl, 0x5f
sahf
jns 0x49acec
jbe 0x49accd
add al, 0x91
xchg ecx, eax
popal
lodsd eax, dword [esi]
salc
xchg dword [ecx + edi*8 - 0x14822077], ebp
loop 0x49ac82
mov dl, 0x77
mov bl, 0x7a
test byte [ebx + ebp*4], ch
sub ebp, dword [ebx - 0x7b]
stc
aad 0x67
cdq
mov ch, 0x33
clc
push edi
pop eax
push esp
xor dword [edx + 0x1d], edx
jecxz 0x49acb9
out dx, al
call 0x3d2a725e
test ch, 0xbf
cmpsd dword [esi], dword es:[edi]
mov dh, 4
and bh, byte [edi + 0x29]
in eax, dx
bound edi, qword [edx + 0x26]
jnp 0x49ad3d
ljmp 0x3c18:0xd8c929c2
sbb edi, edx
push edi
in al, 0x4c
hlt
mov cl, 0x77
or dword [ecx], edx
jge 0x49aca2
jnp 0x49ac88
lahf
jp 0x49ad38
mov ecx, 0xefad8b53
cmp eax, 0x931eb184
invalid
test dword [esi - 0x2e6ca398], ecx
inc edx
mov eax, ecx
imul ecx, ebx, 0x98d2a109
cmpsd dword [esi], dword es:[edi]
mov ch, 0x3d
push edi
xor byte [eax + 9], dh
rol dword [edx - 0x75], 1
shr dword [ecx - 0x35], 9
mov eax, dword [0xb5a798d2]
cmp eax, 0x9703057
retf 0xe0d4
Function at 0x602b35
Capabilities:
Encode data using xor

Disassembly:
pop ebx
dec ebp
outsb dx, byte [esi]
xor dh, byte [eax - 0x3d]
push eax
or eax, 0xa3d5fd20
mov ebx, 0xf46c5bf3
mov dl, dl
mov cl, 0x95
push esp
mov edi, 0x1da7bbf7
add dword [ebx], esp
rol dword [ecx], 0xab
push ebx
jno 0x602b7e
rol dword [ebx - 0x73], cl
adc edx, dword [ebx]
pop eax
mov ebx, 0xfea306d4
xchg edx, eax
mov ecx, 0xd2302b11
aaa
cmc
enter 0x2fdb, 0xffffffffffffff92
insd dword es:[edi], dx
je 0x602bc0
lodsb al, byte [esi]
pop ds
add eax, 0x56161f89
add al, 0xf
mov ah, 0x31
xchg ebx, eax
test eax, 0x71ca508c
push 0x2cc4d9af
adc bl, ah
cmpsb byte [esi], byte es:[edi]
arpl sp, dx
mov cl, 0x73
in al, dx
jae 0x602bca
in al, dx
adc dword [edi], eax
mov dh, 0x6d
jo 0x602bf8
adc ch, cl
push eax
int1
rol cl, cl
inc ecx
int 0x4b
ror dh, cl
mov dword [0xbdff49de], eax
add edx, dword [esi - 0x4b]
lds esp, [ebx - 0x48d6dc4b]
sub byte [eax], al
xchg edx, eax
invalid
push edi
sub edi, esi
popal
insd dword es:[edi], dx
rol ebx, 1
loopne 0x602b86
int1
das
push ss
cvtps2pi mm7, qword [eax + 0x4f7091d7]
or al, byte [ebx - 0xabfcad8]
loop 0x602b92
push 0x2e693133
aam 0xb0
inc edi
push ebp
invalid

Function at 0x621ff5
Capabilities:
Encode data using xor

Disassembly:
inc edi
cmp dword [esi + 0xd93beff], 0x45cb8fe1
leave
invalid

Function at 0x630825
Capabilities:
Encode data using xor

Disassembly:
xor esi, dword [ecx - 0x7fe11648]
add edx, dword [ecx + edx]
test al, 0xec
mov eax, dword [0x4fe7048d]
sbb byte [esi + 0x2082f13f], bl
inc esp
mov edi, 0x3bed08d8
jg 0x630864
cmp edi, dword [edi + 0x21]
pop ds
out 0x7c, al
test eax, 0xeafc0eb5
push ecx
lodsb al, byte [esi]
add eax, 0x2ca4fb56
adc al, byte [ebx]
out dx, al
xor dword [ecx + 0x2f], 0x9be0a4f3
pop edx
mov esi, 0x84217f68
cmp dl, byte [ecx + eax - 0x614e08e0]
rcr byte [esi - 0x46669772], cl
call dword [eax + 0x790f5519]
das
add dword [eax], esp
div dword [ecx - 0x71612d62]
push 0x90ffb999
sbb dword [ebp + 0xf], edx
jns 0x6308a5
jno 0x630840
ror dword [0xd026d1ed], 0x3d
jle 0x630899
add ebp, ebx
cwde
adc byte [ebp - 0x33cbd47f], 0x61
scasb al, byte es:[edi]
sub ch, byte [ebx - 0x4a]
sbb eax, dword [esi + 0x50da3eee]
sbb eax, 0x32b0ac2f
iretd
xor cl, bh
adc ebp, dword [esi + 0x10533888]
lcall 0x8ac, 0xdfcf2a5b
push edi
invalid
fild qword [eax + ecx - 0x302f9da9]
cld
mov dl, 0xec
cmc
and eax, 0x43ef032f
out dx, eax
dec edx
pop esi
fcom qword [ecx - 0x67]
aad 0x93
test eax, 0xd0073e2
and dword [esi + 0x3d0b8f6b], edx
jb 0x6308d0
das
std
push ecx
cmp dword [ebp + 0x40], eax
invalid

Function at 0x63ded7
Capabilities:
Encode data using xor

Disassembly:
push ebx
aam 0xa
call 0xc9f68375
sbb al, 0x2d
xchg ebp, eax
cmpsb byte [esi], byte es:[edi]
mov bh, 0xf1
jne 0x63df38
cdq
insb byte es:[edi], dx
iretd
add ecx, 0xffffff93
invalid
Function at 0x64db3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656358
cmp edx, dword [eax]
je 0x64db5f
add eax, 8
inc ecx
cmp eax, 0x6563e8
jl 0x64db50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656358]
jne 0x64dc8d
mov eax, dword [0xa59cc0]
cmp eax, 1
je 0x64dc67
test eax, eax
jne 0x64db90
cmp dword [0x656284], 1
je 0x64dc67
cmp edx, 0xfc
je 0x64dc8d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64dbc7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064e520
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e9b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64dc0a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e9b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652bbc
push edi
call fcn.00650880
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064e520
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064e530
lea eax, [ebp - 0xa0]
push 0x652b9c
push eax
call fcn.0064e530
push dword [esi + 0x65635c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064e530
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006507f4
add esp, 0x2c
pop edi
jmp 0x64dc8d
lea eax, [ebp + 8]
lea esi, [esi + 0x65635c]
push 0
push eax
push dword [esi]
call fcn.0064e9b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6d1f1a40
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x6d1f1a8e
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x6d1f1a9f
push 0xd
pop eax
jmp 0x6d1f1ac9
push edi
xor edi, edi
push esi
call dword [sym.imp.kernel32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x6d1f1aa2
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x6d1f1fbb
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b0]
sub esp, 0x830
mov eax, dword [0x6d22e258]
xor eax, ebp
mov dword [ebp + 0x7ac], eax
push esi
xor esi, esi
push 0x20019
push 0x6d21f894
push SysReAllocString
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
call fcn.6d21d181
test eax, eax
je 0x6d1f202f
lea ecx, [ebp - 0x64]
call fcn.6d1f196e
lea ecx, [ebp - 0x7c]
call fcn.6d1f196e
lea ecx, [ebp - 0x70]
call fcn.6d1f196e
jmp 0x6d1f2120
push edi
mov edi, str.CAFEEFAC_DEC7_0000_0001_ABCDEFFEDCBA
push edi
lea ecx, [ebp - 0x70]
call fcn.6d1f23c7
push esi
push esi
push 0x2001f
push esi
push esi
push edi
push dword [ebp - 0x70]
lea ecx, [ebp - 0x7c]
call fcn.6d21d181
test eax, eax
je 0x6d1f2074
lea ecx, [ebp - 0x64]
call fcn.6d1f196e
lea ecx, [ebp - 0x7c]
call fcn.6d1f196e
lea ecx, [ebp - 0x70]
call fcn.6d1f196e
jmp 0x6d1f211f
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
push 4
pop ebx
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
push 0x6d22c078
push dword [ebp - 0x7c]
mov dword [ebp - 0x58], esi
call edi
lea ecx, [ebp - 0x64]
test eax, eax
jne 0x6d1f2109
push esi
push esi
push 0x2001f
push esi
push esi
push str.InprocServer32
push dword [ebp - 0x7c]
call fcn.6d21d181
test eax, eax
jne 0x6d1f2106
push 0x800
lea eax, [ebp - 0x54]
push eax
push dword [0x6d233750]
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x6d1f2106
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x64]
mov dword [ebp - 0x58], esi
call edi
test eax, eax
jne 0x6d1f2106
push ebx
lea eax, [ebp - 0x58]
push eax
push ebx
push esi
push str.Apartment
push dword [ebp - 0x64]
mov dword [ebp - 0x58], str.ThreadingModel
call edi
test eax, eax
jne 0x6d1f2106
mov dword [ebp - 0x80], 1
lea ecx, [ebp - 0x64]
call fcn.6d1f196e
lea ecx, [ebp - 0x7c]
call fcn.6d1f196e
lea ecx, [ebp - 0x70]
call fcn.6d1f196e
pop ebx
pop edi
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp + 0x7ac]
neg eax
sbb eax, eax
and eax, 0x7ffbfdff
xor ecx, ebp
add eax, 0x80040201
pop esi
call fcn.6d20a065
add ebp, 0x7b0
leave
ret