joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449618
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x44963e
mov eax, esp
push eax
push 0x4495e0
call sub.user32.dll_EnumWindows
jmp 0x449651
mov eax, esp
push eax
push 0x4495c0
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4496dc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x449730]
test si, 4
je 0x4496f1
or bl, 1
test si, 8
je 0x4496fb
or bl, 4
test si, 1
je 0x449705
or bl, 8
test si, 2
je 0x44970f
or bl, 0x10
test si, 0x10
je 0x449719
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x449728
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x449734
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x449770]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44974e
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44975d
or bl, 4
test esi, 0x20000000
je 0x449768
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x4517dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x4517ee
add esp, 0xfffffff0
call fcn.00403d2c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a004
mov eax, dword [0x4597d0]
mov dword [eax + 4], ebx
mov dword [eax], 0x451b80
mov eax, dword [0x4597dc]
mov dword [eax + 4], ebx
mov dword [eax], 0x451b8c
mov eax, ebx
call fcn.00451b98
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44d040
push eax
push 0
push 0
mov eax, dword [0x45991c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41db98]
call fcn.0041f0b8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41db98]
call fcn.0041f0b8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41db98]
call fcn.0041f0b8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.00452010
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451ee0
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451ee0
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x451ee0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45192b
call fcn.00403d84
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x451cc4
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451e6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x451e50
mov dl, 1
mov eax, dword [0x4121d8]
call fcn.004039f0
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404834
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x451e3f
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0044345c
test al, al
je 0x451e32
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x451e80
lea eax, [ebp - 0x254]
call fcn.00409294
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x451e32
xor eax, eax
push ebp
push 0x451e2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x451eb8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x451e14
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aa4
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x451e14
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451e32
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x451d35
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.00415eb0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451e76
lea eax, [ebp - 0x260]
call fcn.00404834
ret

Function at 0x4527e8
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45ec94]
cmp byte [eax + 0xad], 0
jne 0x452859
cmp dword [0x45ecb0], 0
jne 0x45281a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4527a4
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45ecb0], eax
cmp dword [0x45ecac], 0
jne 0x452835
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45ecac], eax
cmp dword [0x45ecb4], 0
jne 0x452859
push esp
push 0
push 0
push 0x452748
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45ecb4], eax
pop edx
ret
Function at 0x452a5c
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x452a73
add esp, 0xfffffff0
call fcn.00403d2c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a004
mov eax, dword [0x459908]
cmp word [eax + 2], 0
jne 0x452a9b
mov eax, dword [0x459908]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045474c
mov eax, dword [0x4599ac]
cmp word [eax + 2], 0
jne 0x452ab5
mov eax, dword [0x4599ac]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00454958
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x411db4]
call fcn.004039f0
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x41e374]
call fcn.00424308
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x452c6c
mov eax, dword [0x459834]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004246dc
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45501c
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x459834]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c9d0
test eax, eax
je 0x452bbc
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408c4c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ca04
test eax, eax
je 0x452bd0
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404aa4
mov byte [ebx + 0xd4], 0
push ebx
push 0x4541d8
call fcn.0041b180
mov dword [ebx + 0xc8], eax
mov eax, dword [0x459740]
cmp byte [eax], 0
jne 0x452c21
mov eax, ebx
call fcn.00452db0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.00455230
mov eax, ebx
call fcn.00455d94
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x452c61
call fcn.00403d84
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x453030
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x30]
test eax, eax
je 0x4530cf
cmp dword [ebx + 0x94], 0
jne 0x4530c9
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x452fb8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4530c9
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45308f
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4530c9
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414158
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45309e
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4532e8
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x45ec94]
cmp dword [eax + 0x30], 0
je 0x453445
test bl, bl
jne 0x453396
cmp dword [esi + 0x9c], 0
jne 0x45338b
mov eax, esi
call fcn.00455c10
push eax
push 0x453214
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x45335c
mov eax, dword [0x45ec94]
call fcn.00456200
test al, al
je 0x45335c
mov eax, dword [0x45ecb8]
call fcn.004056f0
mov edi, eax
cmp edi, 0
jl 0x45335c
push 0
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x453346
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x45338b
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414158
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x45336b
inc dword [esi + 0x9c]
jmp 0x453445
cmp dword [esi + 0x9c], 0
jle 0x453445
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x453445
cmp dword [esi + 0x44], 0
je 0x4533f1
mov eax, dword [0x45ec94]
call fcn.00456200
test al, al
je 0x4533f1
mov eax, dword [0x45ecb8]
call fcn.004056f0
mov edi, eax
cmp edi, 0
jl 0x4533f1
push 5
mov eax, dword [0x45ecb8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4533db
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x453420
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00414158
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x453400
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
mov eax, 0x45ecb8
mov ecx, 1
mov edx, dword [0x4531f4]
call fcn.004058a4
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x453f2c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x453f96
mov eax, ebx
call fcn.00456200
test al, al
jne 0x453f96
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404924
mov eax, dword [esi]
mov dword [esp + 0x100], eax
mov eax, dword [esp + 0x100]
test eax, eax
je 0x453f83
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x453fa3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404888
jmp 0x453fa3
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404888
add esp, 0x104
pop esi
pop ebx
ret

Function at 0x455414
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x455482
mov eax, esi
call fcn.0043e294
test al, al
je 0x455482
mov eax, dword [ebx + 0x84]
call fcn.0043df20
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x455482
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x455476
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043df20
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00435eec
jmp 0x455482
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.00455250
pop esi
pop ebx
ret
Function at 0x411052
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x42e070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor ecx, ecx
push esi
mov dword [ebp - 0x208], ecx
lea eax, [ebp - 0x214]
mov dword [ebp - 0x20c], 0x100
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jne 0x41112d
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call fcn.00411052
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x208], 0
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x411142
jmp 0x411135
cmp esi, 0x80070103
je 0x411140
test esi, esi
jne 0x411142
xor ecx, ecx
jmp 0x411072
xor esi, esi
cmp dword [ebp - 0x208], 0
je 0x411157
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411786
mov esp, ebp
pop ebp
ret 4

Function at 0x41116b
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 0x2001f
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x411195
xor esi, esi
inc esi
jmp 0x4111dc
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call fcn.00411052
mov esi, eax
test esi, esi
js 0x4111dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0xc]
and dword [ebp - 4], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x4111eb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x432004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x15a07f97
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x411b52b4
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x7ad7e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7ad7f2
pushal
call 0x7ad7f8
pop ebp
sub ebp, 0x10
sub ebp, 0x3ad7e8
jmp 0x7ad80e
mov eax, 0x3ad7e8
add eax, ebp
add eax, 0x4c
mov ecx, 0x603
mov edx, 0xdfceaa9a
xor byte [eax], dl
inc eax
dec ecx
jne 0x7ad825
jmp 0x7ad838
adc dword [edi + 0x11], edx
adc esp, dword [esi + 0x1b9a9a9a]
pop ebx
bound ebx, qword [edx + 0x57999a9a]
and bl, byte [esi + 0x209a9a9a]
mov dl, 0x9a
lcall 0x1152, 0x99786d9a
sbb edx, dword [esi - 0x66656566]
pop edi
pop ss
invalid
Function at 0x404c76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
clc
nop
nop
nop
nop
jae 0x4060fb
out dx, eax
add bl, ah
and byte [eax], al
add byte [eax], al
add byte [eax], al
add bl, ah
imul dword es:[ebx - 0x37]
sub al, bh
push ebx
clc
nop
nop
nop
nop
jae 0x406f32
sub byte [ebx], 0
sub dword [eax], eax
add byte [0x9a000080], ch
mov ebx, 0x58c1709e
add ecx, dword [ebx + 0x3c]
clc
nop
nop
nop
nop
jae 0x407441
add byte [esi], bl
ror byte [edx + ecx - 0x10], cl
invalid
pop ecx
nop
push ebp
mov ebp, esp
leave
nop
jmp 0x406984
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4a579eb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x11725bf7
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4330c0
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x63af4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp]
and eax, 0x3c
call fcn.0063ace0
jmp 0x63ad35
push eax
push dword [esp]
lea esp, [esp + 6]
lea esp, [esp + 2]
xchg dword [esp], eax
jmp 0x63ae3b
pushfd
lea esp, [esp]
and al, 0x24
push ebp
lea eax, [eax + 0x3f]
push dx
call fcn.0063bb9f
je 0x63ae3d
popal
add bl, dh
test dword [esi - 0xe], esi
pushal
pop es
bnd jne 0x63aeca
push 0xffffffffffffff85
xor al, 0x27
dec esi
dec al
not ebx
lea edx, [ecx + 0x1b]
neg dx
jl 0x63adb0
mov ebx, dword [esp]
jmp 0x63ad38
mov al, dl
jmp 0x63aef5
lodsd eax, dword [esi]
sub dword [ecx - 0x37e9d428], edi
imul eax, dword [edx + 0x7e9f0c3d], 0xffffffc6
bswap edx
setnp bh
jmp 0x63aec0
lea eax, [eax + ebp]
jmp 0x63af32
lea edi, [esp]
bsr bp, bx
jge 0x63aedf
lea eax, [eax + ebp]
jmp 0x63af32
bts dx, dx
je 0x63af42
bswap ebx
jmp 0x63af44
sub esp, 0xc0
mov ebp, esp
mov dx, 0xdb9
rdtsc
jmp 0x63af1c
bswap ebx
mov ecx, esi
xchg bh, dl
call 0x63af4e
and cl, ch
call 0x5a63af54
xchg dx, bx
lea esp, [esp + 1]
jmp 0x63af8a
lea esp, [esp + 4]
xor esi, 0x56c0f4fb
rdtsc
mov ax, 0xbec2
jmp 0x63afde
not eax
mov ebx, 0x5da92a9a
rdtsc
mov ax, si
jmp 0x63b015
bsf edx, edi
call fcn.0063b069
bound eax, qword [eax]
add byte [eax], al
jg 0x63b003
push 0x5b7dfa0f
fisttp word [edi + 0x2a]
fldcw word [edx + esi*4 + 0x14f681ad]
and esi, ecx
inc esp
xor esi, 0x44f12314
btr ax, dx
jns 0x63afff
bsf edx, edi
dec ax
bswap eax
jmp 0x63b6e4
sub esi, 0x1be06aef
push si
add esp, 0
jmp 0x63b296
seto dh
lea esp, [esp + 4]
jmp 0x63b100
stc
jge 0x63b116
seto dh
jmp 0x63b119
lea esp, [esp + 1]
jmp 0x63b2d7
jo 0x63b2ce
rdtsc
sub esp, 0xf
jmp 0x63b20e
rdtsc
sub esp, 0xf
lea esp, [esp + 1]
lea esp, [esp + 0x10]
dec esi
mov bh, 0xb3
mov ebx, dword [esp]
call fcn.0063b14e
setbe dl
setle dh
dec dx
call fcn.0063b2fe
jb 0x63b2e9
push 0xd
cld
ret
ror esi, 0
rdtsc
setnp dl
pushfd
xchg bx, dx
jmp 0x63b130
Function at 0x64ee37
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x64ee9d
jmp 0x64ee7b
lea ecx, [esi*4]
bsr ax, di
lea ecx, [eax + ebx]
mov dx, di
jmp 0x64ee65
mov ecx, 0xe9f17a42
mov dh, byte [esp]
mov al, 0x5a
jmp 0x64ee3b
mov word [esp + 1], cx
mov cx, di
rdtsc
rol edi, 0
jp 0x64ee39
mov ecx, 0xe9f17a42
mov dh, byte [esp]
mov al, 0x5a
lea ecx, [esi*4]
bsr ax, di
jmp 0x64ee46

Function at 0x653522
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp], sp
lea esp, [esp + 1]
lea esp, [esp + 1]
mov dword [esp], esi
call fcn.00653559
jp 0x653577
mov word [esp], di
mov byte [esp], dh
mov dword [esp + 4], ebp
push bx
jmp 0x65350c
lea ebx, [edx*4]
mov eax, esp
jmp 0x653581
push esp
mov al, 0x40
mov esi, 0xdda9358f
jmp 0x653562
mov esi, dword [esp + 0x2c]
mov bh, byte [esp]
mov edi, 0x6f2d0ad8
mov ecx, 0xfbc7bb87
setae bl
jmp 0x6535c9
sub esp, 0xc0
jmp 0x6535f2
lea ebp, [esp]
cpuid
mov edi, 0x515d16eb
mov di, word [esp]
setle dh
jmp 0x6535b3
xchg ebx, eax
call fcn.0065368e
jmp fcn.00653658
mov edi, esp
neg dl
jl 0x6535dc
xchg ebx, eax
jmp 0x65365b
mov eax, dword [esp]
pushal

Function at 0x653531
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 1], cl
jmp 0x65353b
lea esp, [esp + 1]

Function at 0x653559
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 3]
call fcn.00653531

Function at 0x6535aa
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf063efec
jmp 0x653578
push eax
mov dword [esp], ecx
mov dword [esp], eax
jmp 0x65346a
push edx
mov byte [esp], cl
mov dword [esp], ecx
push si
lea esp, [esp + 1]
lea esp, [esp]
jmp 0x65349f
lea esp, [esp + 1]
push edx
call fcn.00653489
test dword [0x6f0ffc95], eax
xor eax, 0xbe4324b6
test eax, 0x8da5eb27
and al, 2
jmp 0x6534df
mov dword [esp + 4], ebx
call 0x6535aa
dec ebx
rol dword [ebx + 0x26], cl
aad 0xcf
rcl dword [edx + ecx*8 - 0x53], cl
pop esp
jae 0x653536
ret
add al, 0xc4
ja 0x653598
test eax, 0x124648d
mov dword [esp], edi
pushfd
jmp 0x651fe4
dec ebx
fstp xword [esi - 0x139133b3]
bound eax, qword [0xf97896f4]
imul ecx, dword [eax], 0x8958eefb
and al, 4
call fcn.00653522