joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73041f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov ebx, ecx
push edi
lea ebp, [ebx + 0x104]
lea eax, [esp + 0x10]
mov ecx, 0x41
mov esi, ebx
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
push eax
xor esi, esi
call dword [0x1046407c]
test eax, eax
je 0x73047f
mov edi, dword [0x10464080]
lea ecx, [esp + 0x10]
push ecx
call edi
test eax, eax
je 0x730475
xor eax, eax
mov edi, edi
cmp esi, 0x104
jae 0x7304a0
mov dl, byte [esp + eax + 0x10]
mov byte [esi + ebx], dl
inc eax
inc esi
cmp eax, 8
jl 0x73045f
cmp esi, 0x104
jb 0x730450
jmp 0x7304a0
push 0
call fcn.00777fea
push eax
call fcn.0077a3a4
add esp, 8
call fcn.0077a3b6
mov byte [esi + ebx], al
inc esi
cmp esi, 0x104
jb 0x73048f
xor eax, eax
jmp 0x7304af
movzx ecx, byte [eax + ebp]
movzx edx, byte [eax + ebx + 0x105]
not cl
xor byte [eax + ebx], cl
movzx ecx, byte [eax + ebx + 0x106]
not dl
xor byte [eax + ebx + 1], dl
movzx edx, byte [eax + ebx + 0x107]
not cl
xor byte [eax + ebx + 2], cl
movzx ecx, byte [eax + ebx + 0x108]
not dl
xor byte [eax + ebx + 3], dl
not cl
xor byte [eax + ebx + 4], cl
add eax, 5
cmp eax, 0x104
jl 0x7304af
push ebx
mov ecx, ebx
call fcn.0073034f
push ebp
mov ecx, ebx
call fcn.0073034f
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x730adf
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 4], 0
mov dword [ecx], 0
mov dword [ecx + 8], 0x67452301
mov dword [ecx + 0xc], 0xefcdab89
mov dword [ecx + 0x10], 0x98badcfe
mov dword [ecx + 0x14], 0x10325476
mov dword [ecx + 0x18], 0xc3d2e1f0
ret

Function at 0x7336bf
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ba378
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esp + 0x38]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
mov dword [esi + 0x1c], edi
call fcn.00732d9f
push 0xffffffffffffffff
push 0
push eax
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0040826f
cmp dword [esp + 0x24], 8
mov dword [esp + 0x30], 0xffffffff
jb 0x733729
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00776c58
add esp, 4
xor edx, edx
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], dx
cmp dword [esi + 0x14], edx
je 0x733758
cmp dword [edi + 0x118], edx
jne 0x733758
lea ecx, [edi + 0x160]
call fcn.007387cf
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x28
ret 4

Function at 0x73376f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103ba378
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
mov al, byte [esi + 0x98]
not al
and al, 1
jne 0x733812
cmp dword [esi + 0x118], 0
jne 0x733812
mov eax, dword [esp + 0x38]
test eax, eax
je 0x733807
push eax
lea ecx, [esp + 0x10]
call fcn.005779bf
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x14]
add esi, 0x124
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.0040826f
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.004d43ff
push esi
call fcn.0072feef
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
lea ecx, [esi + 0x124]
call fcn.0057791f
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret 4
Function at 0x73aa7f
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x103ba488
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x14]
mov edi, dword [eax + 0x40]
mov eax, dword [eax + 0x60]
shr eax, 4
test al, 1
je 0x73aaf5
mov ecx, dword [esi + 0x14]
mov edx, dword [ecx + 0x60]
and edx, 0x70
push 0
cmp dl, 0x70
jne 0x73aad1
push 1
call fcn.00745dcf
xor edi, edi
jmp 0x73aaf5
push 0x38
call fcn.00745dcf
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x40]
cmp edi, eax
je 0x73aaf5
mov edi, eax
mov eax, dword [esi + 0x24]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
push 0
push 0x38
lea ecx, [esp + 0x14]
call fcn.0073891f
mov ecx, dword [esp + 0x10]
mov edx, dword [0x105600d8]
mov dword [ecx], edx
mov eax, dword [esp + 0x10]
add eax, 4
xor edx, edx
mov ecx, 0x2c
mov dword [eax], ecx
mov dword [eax + 4], edx
mov ecx, dword [esp + 0x10]
mov eax, 0x2d
mov word [ecx + 0xc], ax
mov edx, eax
mov eax, dword [esp + 0x10]
mov word [eax + 0xe], dx
mov ecx, dword [esi + 0x24]
mov dword [ecx + 0x30], edi
mov edx, dword [esi + 0x24]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x10], eax
mov ecx, dword [esi + 0x14]
mov dword [esp + 0x20], 0
call fcn.0073526f
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov edx, dword [esi + 0x24]
mov eax, dword [edx + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x14], eax
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x18], edx
add eax, 0x10
mov eax, dword [eax + 4]
mov dword [ecx + 0x1c], eax
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x18]
add ecx, 0x18
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x20], edx
add eax, 0x18
mov eax, dword [eax + 4]
mov dword [ecx + 0x24], eax
mov eax, dword [esi + 0x24]
mov edx, dword [eax + 0x20]
add ecx, 0x20
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x28], edx
add eax, 0x20
mov eax, dword [eax + 4]
add ecx, 0x28
mov dword [ecx + 4], eax
mov eax, dword [esi + 0x24]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x28]
add eax, 0x28
add ecx, 0x30
mov dword [ecx], edx
mov eax, dword [eax + 4]
push 1
mov dword [ecx + 4], eax
mov ecx, dword [esp + 0x14]
push 0x38
push ecx
mov ecx, dword [esi + 0x14]
call fcn.00745e2f
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0073894f
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret
Function at 0x73ae7f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103babb8
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x105623f8]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, ecx
mov ecx, dword [esp + 0x5c]
push 1
mov dword [esp + 0x1c], ecx
call fcn.0073f45f
push eax
lea ecx, [esp + 0x30]
call fcn.0072ff2f
mov eax, dword [ebp + 0x20]
mov ebx, dword [eax + 0x10]
sub ebx, dword [eax + 0xc]
xor esi, esi
sar ebx, 2
mov dword [esp + 0x54], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], ebx
cmp ebx, esi
jbe 0x73af6d
nop
mov eax, dword [esp + 0x1c]
lea edi, [eax + esi]
shr edi, 1
cmp dword [esp + 0x44], 8
jb 0x73af09
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
jmp 0x73af11
lea edx, [esp + 0x30]
mov dword [esp + 0x24], edx
mov esi, dword [ebp + 0x20]
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
sar eax, 2
cmp edi, eax
jb 0x73af26
call fcn.00776e71
mov ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x24]
mov esi, dword [ebp + 0x24]
lea eax, [ecx + edi*4]
mov eax, dword [eax]
mov ecx, dword [eax]
push edx
push 1
add esi, 0x50
call fcn.0073f45f
mov edx, dword [esi]
mov ecx, eax
call edx
test eax, eax
jle 0x73af52
mov dword [esp + 0x1c], edi
jmp 0x73af59
jge 0x73af67
inc edi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
cmp esi, eax
jb 0x73aeef
jmp 0x73af6d
mov dword [esp + 0x14], edi
mov esi, edi
push 0x10
call fcn.00776c63
add esp, 4
test eax, eax
je 0x73afac
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov edi, edx
and edi, ecx
cmp edi, 0xffffffff
jne 0x73af9c
mov edx, dword [esp + 0x18]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
jmp 0x73afae
mov ebx, edx
mov edx, dword [esp + 0x18]
mov dword [eax], edx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ecx
jmp 0x73afae
xor eax, eax
mov ebp, dword [ebp + 0x20]
mov dword [esp + 0x18], eax
push esi
lea eax, [esp + 0x28]
push eax
mov ecx, ebp
call fcn.007398ef
mov edx, dword [eax + 4]
mov eax, dword [eax]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, ebp
call fcn.0047928f
xor edi, edi
cmp dword [esp + 0x44], 8
jb 0x73aff0
mov edx, dword [esp + 0x30]
push edx
call fcn.00776c58
add esp, 4
mov edx, edi
mov eax, esi
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.00777267
add esp, 0x44
ret 0xc
Function at 0x73b3af
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103bae4b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0073a50f
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
xor ebp, ebp
mov dword [esp + 0x14], ebp
test eax, 0xfffffffc
jle 0x73b4a0
push 0x10
call fcn.00776c63
mov edi, eax
add esp, 4
mov dword [esp + 0x30], edi
xor eax, eax
mov dword [esp + 0x28], eax
cmp edi, eax
je 0x73b424
push ebp
mov ecx, ebx
call fcn.0052d01f
mov eax, dword [eax]
push eax
mov ecx, edi
call fcn.00738cff
mov edx, dword [esi + 0xc]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x30], eax
test edx, edx
jne 0x73b43b
xor ecx, ecx
jmp 0x73b443
mov ecx, dword [esi + 0x14]
sub ecx, edx
sar ecx, 2
mov edi, dword [esi + 0x10]
mov ebp, edi
sub ebp, edx
sar ebp, 2
cmp ebp, ecx
jae 0x73b45b
mov dword [edi], eax
add edi, 4
mov dword [esi + 0x10], edi
jmp 0x73b479
cmp edx, edi
jbe 0x73b464
call fcn.00776e71
mov eax, dword [esi]
lea ecx, [esp + 0x30]
push ecx
push edi
push eax
lea edx, [esp + 0x24]
push edx
mov ecx, esi
call fcn.0047928f
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
test eax, 0xfffffffc
je 0x73b4b8
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov ebp, dword [esp + 0x14]
inc ebp
sar ecx, 2
cmp ebp, ecx
mov dword [esp + 0x14], ebp
jl 0x73b3f8
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
push 0
push 0xe3
call fcn.0072e76f
int3
Function at 0x73c5d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
call fcn.0074e30f
movsx ecx, byte [esp + 0x10]
xor ecx, edi
and ecx, 0xff
mov eax, dword [eax + ecx*4]
shr edi, 8
xor eax, edi
mov edi, dword [esi + 0xc]
movzx ebx, al
add ebx, dword [esi + 8]
mov dword [esi + 4], eax
imul ebx, ebx, 0x8088405
inc ebx
mov dword [esi + 8], ebx
shr ebx, 0x18
call fcn.0074e30f
movsx edx, bl
xor edx, edi
shr edi, 8
and edx, 0xff
xor edi, dword [eax + edx*4]
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x73ea8f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x24
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp byte [esp + 0x34], bl
je 0x73eaaf
mov ecx, dword [eax]
mov dword [esi + 0x78], ecx
mov edx, dword [eax + 4]
mov dword [esi + 0x7c], edx
jmp 0x73eacd
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
push eax
cmp byte [esp + 0x3c], bl
je 0x73eae0
lea eax, [esp + 0xc]
push eax
call fcn.0077d662
jmp 0x73eaea
lea ecx, [esp + 0xc]
push ecx
call fcn.0077d8a5
mov edx, dword [esp + 0x24]
add edx, 0x76c
movzx eax, dx
mov ecx, 0x7bc
add esp, 8
cmp ax, cx
ja 0x73eb08
xor eax, eax
jmp 0x73eb0d
add eax, 0xf844
mov edx, dword [esp + 0x18]
shl eax, 4
inc edx
movzx ecx, dx
add eax, ecx
mov cx, word [esp + 8]
shl eax, 5
add eax, dword [esp + 0x14]
shr cx, 1
mov word [esi + 0x12], ax
mov eax, dword [esp + 0x10]
shl eax, 6
add eax, dword [esp + 0xc]
shl eax, 5
add ax, cx
mov word [esi + 0x10], ax
pop esi
pop ebx
add esp, 0x24
ret 0xc
Function at 0x73ed6f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103bb3a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov al, byte [ebx + 0xc]
shr al, 3
test al, 1
jne 0x73eda9
mov al, 1
jmp 0x73eea0
cmp dword [ebx + 0x1c], 0
ja 0x73edcc
jb 0x73edb7
cmp dword [ebx + 0x18], 0xffffffff
jae 0x73edcc
cmp dword [ebx + 0x24], 0
ja 0x73edcc
jb 0x73edc5
cmp dword [ebx + 0x20], 0xffffffff
jae 0x73edcc
mov ebp, 4
jmp 0x73edd1
mov ebp, 8
lea edi, [ebp + ebp + 4]
push 0
lea ecx, [edi + 4]
push ecx
lea ecx, [esp + 0x2c]
call fcn.0073891f
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x40]
push 0
push edi
push edx
mov ecx, esi
mov dword [esp + 0x44], 0
call fcn.007462cf
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
cmp ecx, dword [0x105601dc]
jne 0x73ee24
push 0
push 4
add eax, edi
push eax
mov ecx, esi
call fcn.007462cf
mov esi, dword [esp + 0x28]
add esi, 4
jmp 0x73ee26
mov esi, eax
mov edi, dword [esi]
xor eax, eax
push ebp
lea edx, [esi + 4]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0077a03f
push ebp
lea ecx, [esi + ebp + 4]
xor eax, eax
push ecx
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
call fcn.0077a03f
add esp, 0x18
cmp edi, dword [ebx + 0x14]
jne 0x73ee8b
mov eax, dword [esp + 0x14]
cmp eax, dword [ebx + 0x18]
jne 0x73ee8b
mov ecx, dword [esp + 0x18]
cmp ecx, dword [ebx + 0x1c]
jne 0x73ee8b
mov edx, dword [esp + 0x1c]
cmp edx, dword [ebx + 0x20]
jne 0x73ee8b
mov eax, dword [esp + 0x20]
cmp eax, dword [ebx + 0x24]
jne 0x73ee8b
mov bl, 1
jmp 0x73ee8d
xor bl, bl
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0xffffffff
call fcn.0073894f
mov al, bl
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
Function at 0x7410ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
mov al, byte [edi + 8]
mov byte [esi + 8], al
movzx ecx, word [edi + 0xa]
mov word [esi + 0xa], cx
mov dl, byte [edi + 0xc4]
mov byte [esi + 0xc4], dl
movzx eax, word [edi + 0xc]
mov word [esi + 0xc], ax
movzx ecx, word [edi + 0xe]
mov word [esi + 0xe], cx
movzx edx, word [edi + 0x10]
mov word [esi + 0x10], dx
movzx eax, word [edi + 0x12]
mov word [esi + 0x12], ax
mov ecx, dword [edi + 0x78]
mov dword [esi + 0x78], ecx
mov edx, dword [edi + 0x7c]
mov dword [esi + 0x7c], edx
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
mov ecx, dword [edi + 0x84]
mov dword [esi + 0x84], ecx
mov edx, dword [edi + 0x88]
mov dword [esi + 0x88], edx
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x8c], eax
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov edx, dword [edi + 0x18]
mov dword [esi + 0x18], edx
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [edi + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [edi + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
movzx ecx, word [edi + 0x2c]
mov word [esi + 0x2c], cx
mov edx, dword [edi + 0x30]
mov dword [esi + 0x30], edx
mov eax, dword [edi + 0x34]
mov dword [esi + 0x34], eax
mov ecx, dword [edi + 0x98]
mov dword [esi + 0x98], ecx
mov edx, dword [edi + 0x38]
mov dword [esi + 0x38], edx
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
mov ecx, dword [edi + 0x90]
mov dword [esi + 0x90], ecx
movzx edx, word [edi + 0x94]
mov word [esi + 0x94], dx
mov eax, dword [edi + 0x40]
mov dword [esi + 0x40], eax
mov ecx, dword [edi + 0x44]
lea edx, [edi + 0x48]
mov dword [esi + 0x44], ecx
push edx
lea ecx, [esi + 0x48]
call fcn.0073b3af
lea eax, [edi + 0x60]
push eax
lea ecx, [esi + 0x60]
call fcn.0073b3af
mov cl, byte [edi + 0x96]
lea edx, [edi + 0xa4]
mov byte [esi + 0x96], cl
push edx
lea ecx, [esi + 0xa4]
call fcn.0073a13f
lea eax, [edi + 0xb4]
push eax
lea ecx, [esi + 0xb4]
call fcn.0073a13f
mov ecx, dword [edi + 0xa0]
mov dword [esi + 0xa0], ecx
mov edx, dword [edi + 0x9c]
pop edi
mov dword [esi + 0x9c], edx
mov eax, esi
pop esi
ret 4
Function at 0x76142f
Capabilities:
Parse credit card information

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
cmp byte [eax], 0x5b
jne 0x76146f
inc eax
push 3
mov dword [ebx + 4], eax
call fcn.0075e76f
add esp, 4
mov dword [ebx + 0x1c], eax
test eax, eax
je 0x761464
push ebx
call fcn.0076137f
mov eax, dword [ebx + 4]
add esp, 4
cmp byte [eax], 0x5d
jne 0x761466
inc eax
mov dword [ebx + 4], eax
pop ebx
ret
mov dword [ebx + 8], 0x5aa
pop ebx
ret
mov eax, ebx
pop ebx
jmp fcn.00760d7f

Function at 0x76446f
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x103bcb38
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x105623f8]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
push eax
lea ecx, [esp + 0x10]
call fcn.00405a8f
lea ecx, [esp + 0xc]
push ecx
xor edi, edi
mov ecx, esi
mov dword [esp + 0x30], edi
call fcn.005d1dff
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x7644c7
push eax
call fcn.00776c58
add esp, 4
mov edx, dword [esp + 0xc]
push edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.00776c58
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x24
ret 4

Function at 0x7677d9
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x103bcc33
call fcn.00780ae3
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x7678eb
cmp byte [esi + 0x42], bl
je 0x7678eb
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x767815
xor al, al
jmp 0x7678ed
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.004333bf
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0057580f
mov ecx, eax
call fcn.0042f1ef
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0057580f
mov ecx, eax
call fcn.0042f1ef
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x767885
dec eax
je 0x767889
dec eax
dec eax
je 0x7678e7
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00404d5f
mov al, bl
jmp 0x7678ed
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0057580f
mov ecx, eax
call fcn.0042f1ef
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x7678c9
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0057580f
mov ecx, eax
call fcn.0042f1ef
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00778a6f
add esp, 0x10
cmp edi, eax
jne 0x767873
cmp byte [esi + 0x42], 0
je 0x7678e7
test edi, edi
jne 0x767823
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.0040845f
jmp 0x767823
mov bl, 1
jmp 0x767875
mov al, 1
call fcn.00780b2d
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x39a50dd
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1f2166f5
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x402730
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
mov dword [esp + 0x10], eax
lea eax, [ebp - 8]
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
lea eax, [ebp - 0x10]
mov dword [esp], eax
mov dword [esp + 0xc], 0
call sub.msvcrt.dll___getmainargs
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.msvcrt.dll___set_app_type
mov eax, dword [ebp - 8]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.004027f0
mov dword [esp], eax
call sub.msvcrt.dll_exit
nop
nop
nop
nop
push ebp
mov ebp, esp
call sub.msvcrt.dll___iob_func
mov edx, dword [ebp + 8]
pop ebp
shl edx, 5
add eax, edx
ret
Function at 0x8ef1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.008ef140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.008ef140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.008ef140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.008ef140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x8efbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8efc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x90187c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x8efc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x8efc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5a605e52
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7d382198
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x9a5ddc
Capabilities:
Encode data using xor

Disassembly:
jmp 0x9a5de6
pushal
call 0x9a5dec
pop ebp
sub ebp, 0x10
sub ebp, 0x5a5ddc
jmp 0x9a5e02
mov eax, 0x5a5ddc
add eax, ebp
add eax, 0x4c
mov ecx, 0x602
mov edx, 0x35eadba3
xor byte [eax], dl
inc eax
dec ecx
jne 0x9a5e19
jmp 0x9a5e2c
sub byte [esi + 0x28], ch
sub bl, byte [edi + 0x22a3a3a3]
bound ebx, qword [ebx - 0x5d]
mov dword [0x1b6ea0a3], eax
cmpsb byte [esi], byte es:[edi]
mov dword [0x8b19a3a3], eax
mov dword [0x4154a3a3], eax
mov al, byte [0xaf22286b]
mov dword [0x66a0a3a3], eax
retf