joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414035
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x414055
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00415422
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x414076
test byte [esp + 8], 2
je 0x414076
mov dword [0x422398], 0xd
mov dword [0x42239c], 5
jmp 0x414051
xor eax, eax
ret

Function at 0x414557
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x422720], ebx
push esi
push edi
jne 0x4145d7
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x414612
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x422720], eax
je 0x414612
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x422724], eax
call esi
cmp dword [0x4223a4], 2
mov dword [0x422728], eax
jne 0x4145d7
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x422730], eax
je 0x4145d7
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x42272c], eax
mov eax, dword [0x42272c]
test eax, eax
je 0x41461c
call eax
test eax, eax
je 0x414603
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x422730]
test eax, eax
je 0x414603
test byte [ebp - 8], 1
jne 0x41461c
cmp dword [0x4223b0], 4
jb 0x414616
or byte [ebp + 0x12], 0x20
jmp 0x41463b
xor eax, eax
jmp 0x41464b
or byte [ebp + 0x12], 4
jmp 0x41463b
mov eax, dword [0x422724]
test eax, eax
je 0x41463b
call eax
mov ebx, eax
test ebx, ebx
je 0x41463b
mov eax, dword [0x422728]
test eax, eax
je 0x41463b
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x422720]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4146dc
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x42139c]
mov ecx, dword [ebp + 0x3ac]
push ebx
push esi
xor eax, ebp
cmp ecx, dword [0x423acc]
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x78], edi
jae 0x41487e
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x423ae0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x41487e
and dword [ebp - 0x70], 0
and dword [ebp - 0x7c], 0
cmp dword [ebp + 0x3b4], 0
jne 0x414752
xor eax, eax
jmp 0x414892
test al, 0x20
je 0x414765
push 2
push 0
push 0
push ecx
call fcn.00415ee3
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4147fa
and dword [ebp - 0x68], 0
cmp dword [ebp + 0x3b4], 0
mov dword [ebp - 0x6c], edi
jbe 0x41485b
mov ecx, dword [ebp - 0x6c]
xor edi, edi
sub ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x4147bf
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4147b0
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x414792
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41481f
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x70], eax
cmp eax, edi
jl 0x414828
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x3b4]
jb 0x414787
jmp 0x414828
push 0
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41481f
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x70], eax
jmp 0x414828
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x414879
cmp dword [ebp - 0x68], eax
je 0x414858
push 5
pop eax
cmp dword [ebp - 0x68], eax
jne 0x41484d
mov dword [0x422398], 9
mov dword [0x42239c], eax
jmp 0x41488f
push dword [ebp - 0x68]
call fcn.00415422
pop ecx
jmp 0x41488f
mov edi, dword [ebp - 0x78]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x41486d
cmp byte [edi], 0x1a
je 0x41474b
mov dword [0x422398], 0x1c
jmp 0x414888
sub eax, dword [ebp - 0x7c]
jmp 0x414892
mov dword [0x422398], 9
and dword [0x42239c], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d4a6
add ebp, 0x3a4
leave
ret
Function at 0x4151e2
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.0040f130
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41527d
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4223a4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41527d
cmp eax, 1
je 0x41529e
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x41527d
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41524a
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x415279
xor eax, eax
inc eax
jmp 0x4152bd
cmp edi, eax
jae 0x415281
xor eax, eax
jmp 0x4152bd
cmp eax, esi
jae 0x415288
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4223a4]
jmp 0x4152a1
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41636f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41fb68
call fcn.0040f4f0
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x422784], edi
jne 0x4163b3
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41639e
mov dword [0x422784], ebx
jmp 0x4163b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4163b3
mov dword [0x422784], 2
mov eax, dword [0x422784]
cmp eax, ebx
jne 0x4163d3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x416496
cmp eax, 2
je 0x4163dc
cmp eax, edi
jne 0x416404
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x4163ef
mov eax, dword [0x4226a8]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x41640b
xor eax, eax
jmp 0x416496
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.0040f130
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x41643e
cmp esi, edi
jne 0x416454
push dword [ebp - 0x20]
call fcn.0040e3d2
pop ecx
mov esi, eax
cmp esi, edi
je 0x416404
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x416487
cmp dword [ebp + 0x14], edi
jne 0x416471
push edi
push edi
jmp 0x416477
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x416493
push esi
call fcn.0040d925
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0040f52b
ret
Function at 0x41649f
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x41fb78
call fcn.0040f4f0
xor esi, esi
cmp dword [0x422788], esi
jne 0x4164e3
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4164ce
mov dword [0x422788], edi
jmp 0x4164e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x4164e3
mov dword [0x422788], 2
mov eax, dword [0x422788]
cmp eax, 2
je 0x4165c4
cmp eax, esi
je 0x4165c4
cmp eax, 1
jne 0x416528
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x416511
mov eax, dword [0x4226a8]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x41652f
xor eax, eax
jmp 0x4165d6
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.0040f130
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x416565
cmp edi, esi
jne 0x416580
lea eax, [ebx + ebx]
push eax
call fcn.0040e3d2
pop ecx
mov edi, eax
cmp edi, esi
je 0x416528
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4165b3
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x41659d
push esi
push esi
jmp 0x4165a3
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x4165bf
push edi
call fcn.0040d925
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x4165d6
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.0040f52b
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x403203
pop dword [ebp - 4]
mov eax, 0x5d32a99a
add eax, 0xa30d8869
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xfb26c65
sub dword [ebp - 0x14], 0xc160271a
mov dword [ebp - 0x10], 0xead7f55f
sub dword [ebp - 0x10], 0xb8a4a91a
mov dword [ebp - 0xc], 0x409fd144
add dword [ebp - 0xc], 0xbac72ea
mov dword [ebp - 8], 0x195989e0
sub dword [ebp - 8], 0x195989e0
lea eax, [ebp - 0x14]
push eax
mov eax, 0xd25215c6
sub eax, 0xd211953a
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xd29591c3
sub dword [ebp - 0x14], 0x5e23286d
mov dword [ebp - 0x10], 0x8f14cf89
add dword [ebp - 0x10], 0xb25791ec
mov dword [ebp - 0xc], 0x8c7fe78c
add dword [ebp - 0xc], 0xd6ef84e0
mov dword [ebp - 8], 0x3087efba
add dword [ebp - 8], 0xcf781046
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0x4c16a80f
sub eax, 0x4bd6273b
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3597d
push 0
call eax
mov ecx, 0x1419f243
add ecx, 0xebe651bc
mov edx, eax
mov edi, 0x4569dab7
sub edi, 0x4528cab7
add edi, dword [ebp - 4]
mov esi, 0xf3740c4e
mov ebx, dword [edi]
xor ebx, esi
mov dword [edx], ebx
add edx, 0x78f158fa
sub edx, 0x78f158f6
add edi, 0xf9621e6b
sub edi, 0xf9621e67
loop 0x40331f
add eax, 0xe46045ee
add eax, 0x1ba0bce1
xor ebx, ebx
add ebx, eax
add eax, 0xf2922321
add eax, 0xd6ddce4
mov ecx, 0xf43ddab1
sub ecx, 0xf3fddab1
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4280f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x18000]
push edi
or ebp, 0xffffffff
jmp 0x428112
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x428119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x428108
mov eax, 1
add ebx, ebx
jne 0x42812b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x428120
jne 0x42813c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x428120
xor ecx, ecx
sub eax, 3
jb 0x428150
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4281c2
mov ebp, eax
add ebx, ebx
jne 0x42815b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x428168
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42818c
inc ecx
add ebx, ebx
jne 0x428178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42816d
jne 0x428189
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42816d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4281ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42819d
jmp 0x42810e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4281ac
add edi, ecx
jmp 0x42810e
pop esi
mov edi, esi
mov ecx, 0xdb9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4281ca
cmp byte [edi], 9
jne 0x4281ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4281cf
lea edi, [esi + 0x26000]
mov eax, dword [edi]
or eax, eax
je 0x428247
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x29cd8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x29d8c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4281fc
mov ecx, edi
jns 0x42822b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x29d90]
or eax, eax
je 0x428241
mov dword [ebx], eax
add ebx, 4
jmp 0x428219
call dword [esi + 0x29d94]
popal
jmp 0x4042f0
Function at 0x7448437c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
cmp edx, 0x40
mov eax, dword [0x7676810c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14c], eax
ja 0x74487705
push esi
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, ebx
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
mov esi, ebx
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
xor dword [ebp + eax - 0x44], 0x36363636
xor dword [ebp + eax - 0x84], 0x5c5c5c5c
add eax, 4
cmp eax, 0x40
jb 0x744843fb
lea eax, [ebp - 0x140]
push eax
call fcn.744840a0
push 0x40
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.744844d8
cmp dword [ebp + 0xc], 0
je 0x7448444f
push dword [ebp + 0xc]
lea eax, [ebp - 0x140]
push dword [ebp - 0x144]
push eax
call fcn.744844d8
cmp dword [ebp + 0x14], 0
jne 0x74486ca7
lea eax, [ebp - 0x140]
push eax
call fcn.74484095
push 0x10
pop ecx
lea esi, [ebp - 0x84]
lea edi, [ebp - 0xd4]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0xe8]
lea edi, [ebp - 0x94]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x140]
push eax
movsd dword es:[edi], dword [esi]
call fcn.744840a0
push 0x50
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.744844d8
lea eax, [ebp - 0x140]
push eax
call fcn.74484095
mov edi, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
lea esi, [ebp - 0xe8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov al, 1
pop esi
call fcn.74483f77
leave
ret 0x14
add ah, bh
int3

Function at 0x74484915
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov eax, dword [ebp + 8]
lea edx, [esi + eax]
mov bl, byte [edx]
and bl, 0xfe
mov al, bl
shr al, 4
xor al, bl
and al, 0xf
mov cl, al
shr cl, 2
xor cl, al
and cl, 3
mov al, cl
shr al, 1
not al
xor al, cl
and al, 1
or al, bl
inc esi
cmp esi, 8
mov byte [edx], al
jb 0x7448491e
pop esi
pop ebx
pop ebp
ret 4

Function at 0x744e593e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0x71cb43d0
push dword [ebp + 8]
call fcn.744e51e0
test al, al
jne 0x744e5b0d
pop ebp
ret 4
pop ebp
jmp fcn.744e54ea
Function at 0x744f2a2c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor eax, eax
push esi
mov esi, dword [ebp + 0xc]
cmp esi, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [edi + 4], eax
mov word [edi + 2], ax
mov word [edi], ax
je 0x744f2a56
cmp dword [esi + 4], eax
jne 0x744f90b3
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x16a59f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.FKP1
lea edi, [esi - 0x1272000]
push edi
or ebp, 0xffffffff
jmp 0x16a5a12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a5a19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a08
mov eax, 1
add ebx, ebx
jne 0x16a5a2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a5a3c
jne 0x16a5a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a5b
dec eax
add ebx, ebx
jne 0x16a5a48
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a5a20
add ebx, ebx
jne 0x16a5a57
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x16a5aad
xor ecx, ecx
sub eax, 3
jb 0x16a5a73
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a5ae2
sar eax, 1
mov ebp, eax
jmp 0x16a5a7e
add ebx, ebx
jne 0x16a5a7e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a4c
inc ecx
add ebx, ebx
jne 0x16a5a8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a5a4c
add ebx, ebx
jne 0x16a5a99
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a5a8e
jne 0x16a5aaa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a5a8e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x16a5acc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a5abe
jmp 0x16a5a0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a5acc
add edi, ecx
jmp 0x16a5a0e
pop esi
mov edi, esi
mov ecx, 0x34f3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a5aea
cmp byte [edi], 0x16
jne 0x16a5aea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x16a5aef
lea edi, [esi + 0x12a2000]
mov eax, dword [edi]
or eax, eax
je 0x16a5b5e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a67a0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a6890]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a5b1c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a6894]
or eax, eax
je 0x16a5b58
mov dword [ebx], eax
add ebx, 4
jmp 0x16a5b39
call dword [esi + 0x12a68a4]
mov ebp, dword [esi + 0x12a6898]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x16a5b92
sub esp, 0xffffff80
jmp 0x46c1ac
Function at 0x401fc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x401fc9
xor ecx, ecx
jne 0x401fc9
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x401fea
mov eax, 0xd
jmp 0x402045
xor eax, eax
jne 0x401fd1
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x401ffb
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8