joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e98f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45e9b6
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x45e9ce
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
mov edx, dword [esp + 0x4c]
movzx edx, word [edx + edi*2]
cmp esi, 0x1000000
jae 0x45e9f1
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45ea18
mov ebx, 0x800
mov esi, ecx
sub ebx, edx
mov ecx, dword [esp + 0x4c]
shr ebx, 5
add bx, dx
mov word [ecx + edi*2], bx
add edi, edi
jmp 0x45ea30
sub esi, ecx
sub eax, ecx
mov ecx, edx
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + edi*2], dx
lea edi, [edi + edi + 1]
sub edi, 0x40
cmp edi, 4
Function at 0x45ea36
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jb 0x45ede0
mov edx, edi
mov dword [esp + 0x70], edi
shr edx, 1
and edi, 1
dec edx
or edi, 2
mov dword [esp + 0x74], edx
cmp dword [esp + 0x70], 0xe
jae 0x45eb21
add edi, 0
add byte [eax], al
mov ecx, dword [esp + 0x74]
shl edi, cl
mov edx, edi
xlatb
mov ecx, dword [esp + 0x70]
add edx, edx
add ecx, ecx
add edx, dword [esp + 0xc]
add edx, 0x560
sub edx, ecx
add edx, 0xfffffffe
dec byte [ecx - 0x38b3dbac]
inc esp
and al, 0x78
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x7c], 1
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x7c]
movzx edx, word [edx + ecx*2]
cmp esi, 0x1000000
jae 0x45eab4
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45eae5
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x7c]
add bp, dx
mov word [ecx + ebx*2], bp
mov edx, dword [esp + 0x7c]
add dword [esp + 0x7c], edx
jmp 0x45eb0e
sub esi, ecx
sub eax, ecx
mov ecx, edx
mov ebx, dword [esp + 0x7c]
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + ebx*2], dx
mov edx, dword [esp + 0x7c]
add edx, dword [esp + 0x7c]
inc edx
mov dword [esp + 0x7c], edx
or edi, dword [esp + 0x78]
shl dword [esp + 0x78], 1
dec dword [esp + 0x74]
jne 0x45ea8d
jmp 0x4bcb8d
sub dword [esp + 0x74], 4
cmp esi, 0x1000000
jae 0x45eb42
mov ecx, dword [esp + 0x48]
xor edx, edx
shl eax, 8
shl esi, 8
mov dl, byte [ecx]
or eax, edx
inc dword [esp + 0x48]
shr esi, 1
sub eax, esi
xor edx, edx
mov ecx, eax
add edi, edi
shr ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x80], edx
add edi, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
and ecx, esi
inc edi
add eax, ecx
dec dword [esp + 0x74]
jne 0x45eb26
mov edx, dword [esp + 0xc]
add edx, 0x644
shl edi, 4
mov dword [esp + 0x4c], edx
mov dword [esp + 0x84], 1
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x84]
movzx edx, word [ecx + edx*2]
cmp esi, 0x1000000
jae 0x45ebb7
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45ebf1
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x84]
sub esi, ecx
sub eax, ecx
mov ecx, edx
invalid
pushfd
Function at 0x45eba7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jb 0x45ede0
mov edx, edi
mov dword [esp + 0x70], edi
shr edx, 1
and edi, 1
dec edx
or edi, 2
mov dword [esp + 0x74], edx
cmp dword [esp + 0x70], 0xe
jae 0x45eb21
add edi, 0
add byte [eax], al
mov ecx, dword [esp + 0x74]
shl edi, cl
mov edx, edi
xlatb
mov ecx, dword [esp + 0x70]
add edx, edx
add ecx, ecx
add edx, dword [esp + 0xc]
add edx, 0x560
sub edx, ecx
add edx, 0xfffffffe
dec byte [ecx - 0x38b3dbac]
inc esp
and al, 0x78
add dword [eax], eax
add byte [eax], al
mov dword [esp + 0x7c], 1
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x7c]
movzx edx, word [edx + ecx*2]
cmp esi, 0x1000000
jae 0x45eab4
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45eae5
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x7c]
add bp, dx
mov word [ecx + ebx*2], bp
mov edx, dword [esp + 0x7c]
add dword [esp + 0x7c], edx
jmp 0x45eb0e
sub esi, ecx
sub eax, ecx
mov ecx, edx
mov ebx, dword [esp + 0x7c]
shr ecx, 5
sub dx, cx
mov ecx, dword [esp + 0x4c]
mov word [ecx + ebx*2], dx
mov edx, dword [esp + 0x7c]
add edx, dword [esp + 0x7c]
inc edx
mov dword [esp + 0x7c], edx
or edi, dword [esp + 0x78]
shl dword [esp + 0x78], 1
dec dword [esp + 0x74]
jne 0x45ea8d
jmp 0x4bcb8d
sub dword [esp + 0x74], 4
cmp esi, 0x1000000
jae 0x45eb42
mov ecx, dword [esp + 0x48]
xor edx, edx
shl eax, 8
shl esi, 8
mov dl, byte [ecx]
or eax, edx
inc dword [esp + 0x48]
shr esi, 1
sub eax, esi
xor edx, edx
mov ecx, eax
add edi, edi
shr ecx, 0x1f
sub edx, ecx
mov dword [esp + 0x80], edx
add edi, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
and ecx, esi
inc edi
add eax, ecx
dec dword [esp + 0x74]
jne 0x45eb26
mov edx, dword [esp + 0xc]
add edx, 0x644
shl edi, 4
mov dword [esp + 0x4c], edx
mov dword [esp + 0x84], 1
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x84]
movzx edx, word [ecx + edx*2]
cmp esi, 0x1000000
jae 0x45ebb7
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45ebf1
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x84]
sub esi, ecx
sub eax, ecx
mov ecx, edx
invalid
pushfd

Function at 0x45ecca
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, 0x51
cmp esi, 0x1000000
jae 0x45ece7
mov ecx, dword [esp + 0x48]
shl eax, 8
movzx ecx, byte [ecx]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi

Function at 0x45ece9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45ed21
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x84]
add bp, dx
mov word [ecx + ebx*2], bp
mov edx, dword [esp + 0x84]
add byte [eax], al
add byte [ecx], al
xchg esp, eax
and al, 0x84
add byte [eax], al
add bl, ch
invalid
sub esi, ecx
sub eax, ecx
Function at 0x45ed15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45ed21
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
mov ebx, dword [esp + 0x84]
add bp, dx
mov word [ecx + ebx*2], bp
mov edx, dword [esp + 0x84]
add byte [eax], al
add byte [ecx], al
xchg esp, eax
and al, 0x84
add byte [eax], al
add bl, ch
invalid
sub esi, ecx
sub eax, ecx

Function at 0x45ed25
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, edx
mov ebx, dword [esp + 0x84]
shr ecx, 5
jmp 0xd1715339
mov ecx, dword [esp + 0x4c]
mov word [ecx + ebx*2], dx
mov edx, dword [esp + 0x84]
add edx, dword [esp + 0x84]
inc edx
or edi, 4
mov dword [esp + 0x84], edx
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x84]
movzx edx, word [ecx + edx*2]
cmp esi, 0x1000000
jae 0x45ed7f
mov ecx, dword [esp + 0x48]
shl eax, 8
cmovs eax, dword [ebx + 0x9b65652]
shl esi, 8
or eax, ecx
inc dword [esp + 0x48]
mov ecx, esi
shr ecx, 0xb
imul ecx, edx
cmp ecx, eax
jbe 0x45edaf
mov ebp, 0x800
mov esi, ecx
sub ebp, edx
mov ecx, dword [esp + 0x4c]
shr ebp, 5
invalid
pushfd
and al, 0x84

Function at 0x45ef0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and edx, dword [esp + 0x24]
mov dword [esp + 0x50], edx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x50]
shl ecx, 4
add edx, edx
add ecx, ecx
add ecx, dword [esp + 0xc]
add ecx, edx
cmp esi, 0x1000000
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x4c]
movzx edx, word [ecx]
mov edx, dword [esp + 0x38]
cmp edx, dword [esp + 4]
jae 0x45ef24
mov edx, dword [esp + 0x48]
cmp edx, dword [esp + 8]
jb 0x45e084
cmp esi, 0x1000000
jae 0x45ef40
mov ecx, dword [esp + 0x48]
xor edx, edx
shl eax, 8
shl esi, 8
mov dl, byte [ecx]
invalid
Function at 0x461b39
Capabilities:
Packed with generic packer

Disassembly:
jl 0x461b7c
add al, ch
add byte [ecx], 0x10
pop edi
inc ecx
add byte [esi + 0x41], al
add ah, ch
pop ds
inc esi
add byte [eax + 0x65], dl
inc ecx
add byte [eax - 0x6d], dh
inc edx
add ah, ch
inc ecx
add byte [eax], ah
xchg esp, eax
inc edx
add byte [ebp + ebp*2 + 0x41], dl
add byte [eax], ah
jg 0x461ba4
add byte [ecx + eax*4 + 0x540d0041], al
push eax
popal
jae 0x461be1
ja 0x461bdf
jb 0x461bd6
inc ebp
imul esi, dword fs:[ebx + ecx*4 - 0x40], 0x50540d07
popal
jae 0x461bf2
ja 0x461bf0
jb 0x461be7
inc ebp
imul esi, dword fs:[esp + ebp*2 + 0x19], 0x55fc0046
inc edx
add byte [ecx], dh
add byte [eax + edx*2], cl
popal
jae 0x461c09
ja 0x461c07
jb 0x461bfe
inc ebp
imul esi, dword fs:[eax + ebp], section.CODE
add al, 1
add bh, bh
inc dword [ecx + eax]
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
or eax, dword [eax]
or byte [ecx + 0x75], al
je 0x461c53
jne 0x461c57
outsd dx, dword [esi]
push ebx
imul edi, dword [edx + 0x65], 0x41e220
add byte [ecx], al
add bh, bh
and dl, ah
inc ecx
add byte [eax], al
add dword [eax], eax
inc dword [eax]
pop dword [edx]
add dword [eax], eax
add byte [edi + 0x10042], cl
inc edx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
add byte [eax], al
push ebx
inc eax
add ch, al
add byte [eax], al
jmp [edx + eax*4]
Function at 0x461cac
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
adc dword [eax], eax
or byte [edx + esi*2 + 0x61], al
dec ebp
outsd dx, dword [esi]
add byte gs:[eax], dl
inc eax
add byte [eax], bh
add byte [eax], al
inc dword [eax + 0x100414a]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
adc al, byte [eax]
pop es
inc ebp
outsb dx, byte [esi]
popal
bound ebp, qword [ebp + 0x64]

Function at 0x461eb2
Capabilities:
Packed with generic packer

Disassembly:
popal
bound ecx, qword [edi + 0x72]
jb 0x461eba
adc byte [eax], al
les eax, [eax]
add bh, bh
sbb byte [ebx + 0x10041], al
add dword [ecx], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
or dword [eax], eax
pop es
push esp
popal
bound edx, qword [ebx + 0x74]
outsd dx, dword [esi]
jo 0x461edc
sub al, 0x41
add al, ch
dec edx
inc ecx
add byte [eax], bl
dec ebx
inc ecx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x54040020], al
js 0x461f6e
add byte [eax], dl
inc eax
add byte [edi], dh
add byte [eax], al
inc dword [edx + ecx*2 + 0x41]
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
and dword [eax], eax
pop es
push esi
imul esi, dword [ebx + 0x69], 0x64656c62
lahf
inc eax
add byte [ecx + eax], cl
add bh, bh
or al, 1
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
and al, byte [eax]
or byte [edi + 0x6e], cl
outsb dx, byte [esi]

Function at 0x461ec2
Capabilities:
Packed with generic packer

Disassembly:
popal
bound ecx, qword [edi + 0x72]
jb 0x461eba
adc byte [eax], al
les eax, [eax]
add bh, bh
sbb byte [ebx + 0x10041], al
add dword [ecx], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
or dword [eax], eax
pop es
push esp
popal
bound edx, qword [ebx + 0x74]
outsd dx, dword [esi]
jo 0x461edc
sub al, 0x41
add al, ch
dec edx
inc ecx
add byte [eax], bl
dec ebx
inc ecx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x54040020], al
js 0x461f6e
add byte [eax], dl
inc eax
add byte [edi], dh
add byte [eax], al
inc dword [edx + ecx*2 + 0x41]
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], 0
add byte [eax], al
and dword [eax], eax
pop es
push esi
imul esi, dword [ebx + 0x69], 0x64656c62
lahf
inc eax
add byte [ecx + eax], cl
add bh, bh
or al, 1
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
and al, byte [eax]
or byte [edi + 0x6e], cl
outsb dx, byte [esi]
Function at 0x461f38
Capabilities:
Packed with generic packer

Disassembly:
outsb dx, byte [esi]
inc ebx
push 0x65676e61
lahf
inc eax
add byte [eax - 0x67010000], bl
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f070023], al
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebx + 0x6b], 0x409f64
mov al, byte [0xa0ff0000]
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0

Function at 0x461f77
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax + 0x4f0a0024], al
outsb dx, byte [esi]
inc esp
bound ebp, qword [ebx + eax*2 + 0x6c]
imul esp, dword [ebx + 0x6b], 0x412d8c
js 0x461f8c
add bh, bh
js 0x461f90
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
and eax, 0x6e4f0a00
inc esp
jb 0x462007
inc esp
jb 0x462019
jo 0x461fcc
sub eax, 0x800041
add bh, bh
add byte [eax], 0
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0a0026], al
outsb dx, byte [esi]
inc esp
jb 0x46202c
dec edi
dec edi
jbe 0x462034
jb 0x461fe1
inc ecx
add byte [eax - 0x6f010000], dl
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f090027], al
outsb dx, byte [esi]
inc ebp
add byte [eax], 0
add byte [eax + 0x4f070028], al
pop es
dec edi

Function at 0x4701f2
Capabilities:
Packed with generic packer

Disassembly:
inc esi
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x47026a
add byte [ebx + 0x6f], dl
je 0x470274
popal
jb 0x470265
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x470267
add byte [eax + 0x1ce8c033], al
rol byte [edx], cl
add byte [ebp - 0x74c08a40], al
invalid
sbb al, 0xd2
add al, byte [eax]
Function at 0x481fa8
Capabilities:
Packed with generic packer

Disassembly:
sub dword [eax], esp
xor dword [ecx], edi
cmp dword [edi], esi
sub eax, 0x32313032
and byte [edx + 0x6f], cl
jb 0x48201c
popal
outsb dx, byte [esi]
and byte [edx + 0x75], dl
jae 0x482032
insb byte es:[edi], dx
insb byte es:[edi], dx
or eax, 0x726f500a
je 0x482032
outsd dx, dword [esi]
outsb dx, byte [esi]
jae 0x481fed
inc ebx
outsd dx, dword [esi]
jo 0x48204a
jb 0x48203c
push 0x43282074
sub dword [eax], esp
xor dh, byte [eax]
xor byte [eax], dh
sub eax, 0x32313032
and byte [ebp + 0x61], cl
jb 0x48205d
imul ebp, dword [edx + 0x6e], 0x61614c20
dec esp
popal
popal
outsb dx, byte [esi]
or eax, 0x6c6c410a
and byte [edx + 0x69], dh
push 0x72207374
popal
cmp cl, byte gs:[di]
or ch, byte [eax + 0x74]
je 0x482096
cmp ch, byte [edi]
das
ja 0x4820a2
ja 0x48205b
imul ebp, dword [esi + 0x6e], 0x7465736f
jne 0x4820a6
je 0x4820aa
jo 0x482065
arpl word cs:[edi + 0x6d], bp
arpl word [edi + 0x6d], bp
das
add bh, bh
invalid
add byte [eax], al
arpl word [ebx + esi*2 + 0x20], si
jae 0x48207f
push eax
popal
jae fcn.004820c6
popal
insb byte es:[edi], dx
and byte [ebx + 0x63], dl
jb 0x4820d3
jo 0x4820e0
and byte [eax + 0x6f], ch
insd dword es:[edi], dx
and byte gs:[eax + 0x61], dh
cmp al, byte gs:[bx + si]
add byte [0xff00000a], cl
invalid
jb 0x4820fe
insd dword es:[edi], dx
outsd dx, dword [esi]
bound ebp, qword [edx + 0x65]
arpl word [ebx + esi*2 + 0x2e], si
arpl word [edi + 0x6d], bp
das
jo 0x48211b
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, edx
xor eax, eax
push ebp
push 0x481f0c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x481f24
pop ds
dec eax
add al, ch
pushal
outsd dx, dword [esi]
add eax, 0x6a016a00
invalid
lea edx, [ebp - 4]
push ebp
cld
mov eax, dword [0x49b628]
call 0x4a575b
mov eax, dword [ebp - 4]
inc ebp
cld
call fcn.00484c1f
push eax
mov eax, ebx
invalid
Function at 0x101e47e
Capabilities:
Set registry value

Disassembly:
push pe_nt_image_headers32
mov eax, 0x107e294
call fcn.010020dc
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [eax]
mov dword [ebp - 0x30], ecx
cmp ecx, eax
je 0x101e4cd
xor ebx, ebx
lea esi, [ecx + 0x10]
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x44]
cmp esi, ebx
jne 0x1044448
lea ecx, [ebp - 0x30]
call fcn.01014a7d
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
cmp ecx, dword [eax + 4]
jne 0x101e4a6
call fcn.01002119
ret 4
push 1
push 2
lea ecx, [ebp - 0xcc]
call fcn.010682a1
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 4], ebx
call fcn.0106f585
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xcc]
call fcn.01068101
cmp dword [esi + 0x18], 8
jb 0x1044483
mov eax, dword [esi + 4]
jmp 0x1044486
lea eax, [esi + 4]
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10444de
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10444b1
lea eax, [ebp - 0x28]
cmp dword [esi + 0x34], 8
jb 0x10444bc
mov esi, dword [esi + 0x20]
jmp 0x10444bf
add esi, 0x20
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
push 1
push ebx
push esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.01012f94
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.01067e79
jmp 0x101e4ba
Function at 0x102beae
Capabilities:
Query or enumerate registry value

Disassembly:
push pe_nt_image_headers32
mov eax, 0x107e238
call fcn.0100208c
mov dword [ebp - 0x20], ecx
mov eax, dword [ecx + 4]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
cmp ecx, eax
je 0x102bef5
xor ebx, ebx
lea esi, [ecx + 0x10]
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x28]
cmp esi, ebx
jne 0x104434c
lea ecx, [ebp - 0x18]
call fcn.01014a7d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, dword [eax + 4]
jne 0x102bece
call fcn.01002061
ret 4
cmp dword [esi + 0x18], 8
jb 0x1044357
mov eax, dword [esi + 4]
jmp 0x104435a
lea eax, [esi + 4]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0x20019
push ebx
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x104443a
cmp dword [esi + 0x34], 8
jb 0x1044388
mov eax, dword [esi + 0x20]
jmp 0x104438b
lea eax, [esi + 0x20]
lea ecx, [ebp - 0x14]
push ecx
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x104443a
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.010067e4
cmp dword [esi + 0x34], 8
pop ecx
mov edi, eax
jb 0x10443cc
mov esi, dword [esi + 0x20]
jmp 0x10443cf
add esi, 0x20
lea eax, [ebp - 0x14]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push ebx
push esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1044433
push edi
lea ecx, [ebp - 0x48]
call fcn.010142c5
push 1
push 1
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], ebx
call fcn.01068229
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.01012f94
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0xcc]
push eax
call fcn.0106f598
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.01067fa6
push edi
call fcn.01006809
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102bee2
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x38c21b0d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x3c8b25a9
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa