joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464270
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x4781d0]
test ecx, ecx
push ebx
push esi
push edi
je 0x4642ab
cmp word [ecx], 1
jne 0x4642ab
mov edx, dword [ecx + 0x14]
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
xor eax, eax
mov al, byte [0x4781d8]
mov esi, eax
mov eax, dword [ecx + 0x10]
sub esi, edx
cmp esi, eax
jb 0x4642a6
call ebx
mov ecx, dword [0x4781d0]
lea eax, [esi + esi]
jmp 0x4642b9
mov ebx, dword [sym.imp.MSVBVM60.DLL___vbaGenerateBoundsError]
call ebx
mov ecx, dword [0x4781d0]
mov ecx, dword [ecx + 0xc]
mov cx, word [ecx + eax]
mov edi, dword [sym.imp.MSVBVM60.DLL___vbaUI1I2]
call edi
mov edx, dword [esp + 0x10]
mov byte [edx], al
mov ecx, dword [0x4781d4]
test ecx, ecx
je 0x464300
cmp word [ecx], 1
jne 0x464300
mov edx, dword [ecx + 0x14]
xor eax, eax
mov al, byte [0x4781d8]
mov esi, eax
mov eax, dword [ecx + 0x10]
sub esi, edx
cmp esi, eax
jb 0x4642fb
call ebx
mov ecx, dword [0x4781d4]
lea eax, [esi + esi]
jmp 0x464308
call ebx
mov ecx, dword [0x4781d4]
mov ecx, dword [ecx + 0xc]
mov cx, word [ecx + eax]
call edi
mov edx, dword [esp + 0x14]
mov byte [edx], al
movzx cx, byte [0x4781d8]
add cx, 1
jo 0x464332
call edi
pop edi
pop esi
mov byte [0x4781d8], al
pop ebx
ret 8
call dword [sym.imp.MSVBVM60.DLL___vbaErrorOverflow]
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x413578
Capabilities:
Encode data using xor

Disassembly:
jae 0x4135ad
xchg edx, eax
dec esp
mov edx, 0xe3fe66b5
clc
mov word [ecx + edi*8], ss
invalid
xchg ebp, eax
invalid

Function at 0x4180f0
Capabilities:
Encode data using xor

Disassembly:
fstp qword [ecx - 0x69]
fimul word [ebx - 0x14cbea80]
or byte [eax - 0x3f], 0x96
aad 0xbb
dec esi
adc bh, byte [edi - 0x16]
invalid
cmp dword [esi - 0x637970e6], 0xe4a02aae
sub al, 0x67
lodsb al, byte [esi]
test dword [esi - 0x2fee95d5], 0x606b8335
xor ebx, esi
imul esp, dword [eax + 0x33], 0xffffffde
mov edi, 0xe35d0826
sub eax, 0x9425062e
jae 0x4180f6
shr byte [edi], 1
shl byte [ebx], 0
push 0x6e4cb47f
dec esp
outsb dx, byte [esi]
mov edi, 0x4ed6dc36
in al, 0xb7
and al, 0x50
mov bh, 0x24
push eax
sub byte [esi], ch
xlatb
adc al, 0xf7
jo 0x41815d
jnp 0x418094
pop esi
xchg esp, eax
sub esp, dword [edi - 0x23434b90]
xlatb
push ebp
xor dword [edi], 0x47
add bh, byte [edx + ecx*2]
dec edx
push ebx
loopne 0x4180b3
xchg ecx, eax
mov ebx, 0xe28bcd07
fnstsw word [ecx + ebp*8 - 0x4c87e50b]
sbb al, 1
jp 0x4180c8
fnop
pop ecx
sbb cl, byte [esi - 0x49]
dec ebp
retf 0x2c86
mov bh, 0xff
int 0xca
xchg byte [eax + ebp*2], ch
adc al, 0x33
mov esi, 0x3c3c70d4
out dx, eax
mov dl, 0xa7
adc ecx, dword [ebp + 0x823d90f]
pop ebp
imul edx, dword [eax - 0x25], 0x67
sbb dword [ebx], esp
sar dword [ebp + 0x7f6a7e32], 1
cwde
leave
xor bl, byte [eax - 0x32]
jg 0x418197
push es
sub byte [edx + ecx + 0xa8955a1], 0xac
push ebp
mov dword [edx], ecx
lodsb al, byte [esi]
aad 0x28
bnd je 0x41812d
je 0x41812d
invalid
inc bl
in al, dx
lahf
inc esi
rol dl, 0x1a
push es
sub eax, 0xb2dfd408
enter 0x6140, 0x24
add al, dl
xor eax, 0xb6798696
stosb byte es:[edi], al
js 0x418165
and byte [eax], cl
je 0x418134
das
outsb dx, byte [esi]
lodsd eax, dword [esi]
xchg esi, eax
add dh, byte [edx + 0x23f33fe]
ret
adc al, 0xad
div byte [ecx + 0x4d12a2fc]
outsb dx, byte [esi]
jg 0x418164
lodsb al, byte [esi]
inc edx
xor eax, 0xea6fa8a2
xor eax, 0xd5de9157
sbb esp, dword [edi + 0x7e]
bnd jecxz 0x418224
div ecx
xchg ebp, eax
pop ds
or eax, 0xced8a25d
pushal
ret
test al, 0x78
test byte [ecx], 0x56
push es
retf 0x4be0
mov dword [0xb13fdfd0], eax
je 0x4181e0
fdiv qword [eax + 0x600032c0]
rcl byte [ecx + 0x1d], cl
jg 0x8934fd29
invalid

Function at 0x447180
Capabilities:
Encode data using xor

Disassembly:
rcl ebx, 1
cmpsd dword gs:[esi], dword es:[edi]
das
aas
mov esp, 0xad91cea
lcall 0xf996, 0xa079b2e2
sbb al, 0xd9
or bl, byte [edx - 0x5f864d1e]
xchg esi, eax
stc
mov ebx, dword [esi + 0xd7cb0b7]
sahf
out 0x14, al
test al, 0xa9
xchg edx, eax
mov esp, 0xeb09d195
xor dword [edi + 0x3c55742d], 0xbc86b0a7
neg dword [edi - 0x59200fd3]
jns 0x447188
test byte [edx - 0x35904b27], cl
fadd dword [edi - 0xf]
push ebp
or ebx, dword [esi - 0x1c]
dec edx
jno 0x4471e6
invalid
test eax, 0xa191ae48
Function at 0x4533b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push eax
test eax, 0x422dbd43
fisub word [eax - 0x2e]
pop ebx
into
mov ecx, fs
push cs
and eax, 0x7f42ef
inc edx
jg 0x4533b3
mov edi, 0xcc62093c
aaa
mov bh, 0xb
xor eax, 0xe3dae0e
imul ebx, dword [ebx], 0x688c6887
in eax, dx
push ebx
stosb byte es:[edi], al
mov ebx, 0x590f8286
mov al, byte [0xf08e766a]
scasb al, byte es:[edi]
xor eax, 0x9a820e88
inc ebp
adc eax, 0xe9bf5b88
shl ah, cl
or esp, dword [edi]
out dx, al
xor al, 0x4b
dec ebx
xchg ecx, eax
cmp dl, ch
imul byte [edi]
xor byte [ebp - 0xe], 0xe8
add eax, 0x4d527e87
pop edx
dec ecx
inc eax
pop eax
inc eax
cmp eax, 0x4736388c
and byte [ecx + 0x148dfa53], ch
sub dl, bl
fimul word [ebp - 0x4e076b63]
rol byte [ecx + edx*2 + 0x223249e7], cl
jl 0x4533e5
xchg byte [ebp*4 - 0x50635be9], dh
xor al, 0x47
inc esp
dec eax
push ds
adc dword [ecx - 0x18], eax
xor al, 0x92
or ebp, dword [esi + 0x39]
push ss
aaa
out 0x2d, al
imul esi, ecx, 0xb9db0a47
dec ebx
inc edx
scasd eax, dword es:[edi]
mov dh, 0xbf
cmp dword [edi - 0x1ca7da4], eax
mov eax, dword [0x5c52b4]
retf 0x3b3

Function at 0x456ac8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebx
invalid
xchg esp, eax
add al, 0x52
mov ch, 0x38
xor ah, dl
push ecx
jno 0x456a81
into
in al, 0x12
add bh, ch
fsubr qword [eax - 0x80]
fdivr dword [edx - 0x7ab840b2]
add eax, 0xe6f0818e
int 0xa
movsb byte es:[edi], byte es:[esi]
outsb dx, byte es:[esi]
and al, 0x9c
xor byte [ebx - 0x44f6b6e6], ah
or eax, 0x33d1c19a
int3

Function at 0x457290
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x8d
imul ecx, edi, 0xd2c0c345
rol byte [edx + 0x4f], 1
rcl al, cl
inc edx
dec edi
call 0x8d585e7f
mov al, byte [0xec6e8fb9]
sbb ch, byte [edx + ebx*2 - 0x38]
mov al, 0x69
out dx, al
outsb dx, byte [esi]
rcr dword [eax - 0x4718acc4], cl
or dh, dh
cmpsd dword [esi], dword es:[edi]
push 0x93d55ce1
xor al, 0xc2
push ss
fmul qword [edi - 0x39]
mov es, word [ebp - 0x25]
pop ds
neg ch
sub dword [ebx - 0xcff6759], esi
out 0x68, eax
sbb ebp, dword [ecx - 0x549b1521]
stosd dword es:[edi], eax
mov dword [eax + 0x5d], esi
fdivr dword [eax + 0x6ded0de2]
xchg ecx, eax
cmp al, byte es:[eax - 0x1315d8b]
js 0x457297
stosb byte es:[edi], al
Function at 0x466d5c
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x89
dec ebx
pushal
shl byte [ebx - 0x742cb2c5], cl
xchg byte [eax], ah
movsd dword es:[edi], dword [esi]
sub ah, dh
push 0x22d27340
dec edi
push ebp
dec ecx
push esi
mov ah, 0x96
cmp byte [edi], cl
dec esp
stosd dword es:[edi], eax
je 0x466dbb
and al, 0xce
jecxz 0x466df8
aaa
dec edi
pop eax
test byte [ebx + 0x3105a5d5], ch
pop esi
mov ah, 0x55
daa
jg 0x466e00
xchg ebp, eax
in al, 0xfb
mov edx, ebx
lodsb al, byte [esi]
xor ch, byte [edx]
inc edx
or bh, byte [ebx + 0x5beaab9]
fcmove st(0), st(3)
jno 0x466d94
sbb al, 0x61
scasd eax, dword es:[edi]
shr byte [edi + 0x445b057f], cl
clc
out 0x6c, eax
push ebx
push edx
mov ebp, dword [esi + 0x7ed0a3f5]
dec ecx
pop ebp
sbb ah, byte [edx + 0x67755b67]
aas
inc edi
pop ecx
invalid
mov cl, 0x13
loop 0x466e32
dec ecx
invalid
sal eax, cl
das
invalid
in al, 0xe
xchg edi, edx
shl byte [ebx], cl
pop es
and edx, esi
invalid
Function at 0x473fe0
Capabilities:
Encode data using xor

Disassembly:
sub ah, bl
push eax
loop 0x47404b
push es
scasd eax, dword es:[edi]
jl 0x474004
and eax, 0x335cb1ce
cmpsd dword [esi], dword es:[edi]
push ecx
and ecx, ebp
xor esp, dword [edi - 0x16dec9af]
loope 0x47405d
add cl, cl
mov ch, 0xfa
sbb eax, 0x6a6e419
loope 0x473fed
sbb ebx, dword [ecx - 2]
sub edx, 0xfffffff0
aad 0x68
test eax, ebp
pop esp
test byte [edx - 0x5d], cl
dec edx
lodsb al, byte [esi]
sub al, 0xc3
or esp, edx
lahf
xor eax, 0x963cfbbb
sti
cmp al, 0x96
pop edi
ret 0xc6b0
test al, 0xf0
cli
sub bl, byte [ecx + 0x10553bc3]
xor eax, 0xbb6f7134
scasb al, byte es:[edi]
mov al, 0x27
scasd eax, dword es:[edi]
in eax, dx
fld xword [eax - 0x4f]
push edx
imul ebx, dword [edx + esi*4 - 0x1fc917b8], 0xffffffc8
imul edi, dword [edx], 0x13be4807
xor edx, dword [edi + 0x1fd4ff94]
loop 0x474018
daa
les edx, gs:[ecx]
push ebx
cwde
or byte [ecx + 0x90b1619], dh
sbb dl, al
fld xword [edi - 0x47bbbf93]
cmp eax, 0x6dd8ff92
retf 0x7695

Function at 0x477bf0
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xbb0bd299
xchg ebx, eax
push ebx
int 0x2e
cdq
aas
xor byte [edx + 0x3e3c637], ch
invalid

Function at 0x4784d8
Capabilities:
Encode data using xor

Disassembly:
push esi
int 0x8e
sbb dword [ebp + ebp - 0x748c86fe], ecx
push cs
inc ebx
mov dword [0xe54cb7dc], eax
bndldx bnd2, [esi + 0x7586bf21]
mov dh, 0xa7
out 0xf4, eax
dec esi
stosd dword es:[edi], eax
insb byte es:[edi], dx
salc
mov ecx, 0x40d5d688
std
adc byte [esi + 0x22], bh
jbe 0x47852a
add ah, bl
xor al, 0x79
push ecx
xor dword [ebx], 0xc65969ff
cdq
arpl word [esi - 0x762a104c], bx
jle 0x478477
mov al, bh
popal
test al, 0x73
dec esi
xor cl, byte [edi]
mov dword [eax], edi
jae 0x4784db
mov edi, 0xbb61f36b
ret
dec eax
fld qword [ebp - 0x3334d578]
cli
cdq
inc esi
invalid

Function at 0x478da8
Capabilities:
Encode data using add xor sub operations

Disassembly:
movsd dword es:[edi], dword [esi]
xor dword [0xfe88ed6], esi
into
invalid

Function at 0x478e00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
arpl word [edx + 0x66], cx
sub byte [eax + 0x19], dl
xchg ebx, eax
clc
mov edi, 0x2151c94e
sbb ah, ah
adc byte [edx - 0x43aa7e68], cl
add dword [ecx - 0x8693711], ebp
nop
xor ch, cl
push ss
inc esi
mov al, byte [0x400a416a]
pushal
mov dword [0x1b55b215], eax
sar dword [esi - 0x2fb3fdb2], 1
in eax, dx
pop ds
jne 0x478df1
invalid
invalid
Function at 0x47dd70
Capabilities:
Encode data using xor

Disassembly:
mov cl, al
push ss
dec eax
inc ebx
out 0x1a, eax
pop edx
mov ebx, 0xf753125b
mov esp, 0x142d3e3c
inc edi
and ah, 0x55
push ebp
outsb dx, byte [esi]
nop
test dword [edx - 0x1f4775e1], ebx
iretd
sub ebp, dword [ebp + 0x1f]
inc ecx
in al, 0x3f
stc
or ecx, dword [ebp - 0x5f]
xor al, byte [ecx + 0x4755df66]
jmp 0x47dcfa
movsd dword es:[edi], dword [esi]
jo 0x47dcf6
leave
or eax, 0xe10e74b9
adc bl, byte [edx - 0x57]
jg 0x47dd7a
test eax, 0x6e13287f
pop ebp
adc ebp, dword [esi + 0x5d]
sahf
mov al, byte [ecx + 0x7933fa4d]
test al, 0x67
loop 0x47dd44
or dword [ebp - 0x1b8c3657], 0x21579939
aaa
cmp dword [ecx - 0x54c8dea9], ebx
push edi
and dword [edi], esi
stosd dword es:[edi], eax
stosb byte es:[edi], al
arpl word [ebp + 0x720fa2bd], bx
mov byte [0xd103720f], al
jl 0x47dd44
xor ebp, eax
mov ch, 0x5a
pop edx
dec esp
jb 0x47dd66
out dx, eax
xchg edi, eax
cmc
fadd qword [eax - 0x4e]
leave
jge 0x47dd4f
out dx, eax
or al, 0x5a
push ebx
adc dword [eax + ebx*8], esp
sub dword [ebx - 2], esi
jno 0x47dd17
out dx, eax
outsd dx, dword [esi]
inc ebx
inc ebx
in eax, dx
popfd
int3

Function at 0x47e6f0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
add edx, dword [eax - 0x36]
cmp dword [ebp + esi + 0x5a], edx
dec ecx
imul ebp, dword [eax], 0x74
push cs
push eax
dec ebx
xor byte [ecx + 0x1c], ah
push 0xffffffffffffffc7
cmp eax, 0x78f695d5
pop esp
fld dword [0xdebab25c]
fcmovb st(0), st(1)
xor eax, 0xdaab02e
xchg dword [ebx*2 + 0x5a3f95c7], ebp
invalid

Function at 0x47ee38
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
stosd dword es:[edi], eax
xlatb
dec edx
adc dword [0xcff0c167], esp
inc dword [ebx - 0x287edeb0]
xor dword [ebx + 0x56ea950a], esp
lcall 0x6943, 0x10da159e
in eax, 0x84
fld qword [ecx]
stosd dword es:[edi], eax
jbe 0x47ee0f
invalid
Function at 0x480288
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
jbe 0x48024d
xor al, 0x25
in al, 0xfb
sbb al, 0xe3
sbb byte [eax], al
sub eax, 0x40f87be4
xor byte [esi], cl
or esp, esp
or eax, 0x84d9de8
lds ebp, [edi + 0x5b]
shr byte [edi - 0x2966c62e], cl
aaa
adc dword [eax + 0x4b], 0xf261bf21
mov eax, dword [0x5ba5084b]
sti
adc esi, dword [esi - 0x5aff5653]
add al, 0x81
cmp dword [esp + edi*2 + 0x33], ebp
mov edx, 0x539b06b1
je 0x480329
xchg ecx, eax
adc dword ss:[esp + ecx*8 - 0x1d87fc26], 0x3a
xchg edx, eax
add al, 0xc7
and ah, 0x73
stosb byte es:[edi], al
fiadd dword [ebx]
js 0x4802a8
cmp dl, byte [edx - 0x1b7f38fc]
jae 0x480278
outsd dx, dword [esi]
popal
in eax, dx
push 0x5b
xor dword [esi + eax - 0x5b9727c6], ebx
xor al, 0xb3
mov ah, 0xf
aad 0xc5
xchg edi, eax
mov ebp, 0x53b8b1e1
pop ecx
lodsb al, byte [esi]
std
lahf
mov byte [0xb43bc5db], al
nop
mov esp, 0xa9598b54
rcr dword [edi - 0x55aa0fa7], 0x95
push esp
or al, 0x70
sbb dword [ebx], eax
cmp eax, 0x83af580e
cmpsb byte ds:[esi], byte es:[edi]
cvttps2pi mm6, qword [0x30510c4a]
and bh, bh
jge 0x4802c2
mov bp, word [eax]
push ecx
or byte [ecx], 0x47
mov esi, ds
jp 0x480367
push es
add cl, byte [0xa39df695]
mov ebx, 0xc1fd1d8c
add eax, dword [edx]
rol dword [ebx], 2
sbb byte [ecx + ecx*2 - 0x6bf6b7e7], al
mov al, 0x5f
inc edx
inc esp
invalid
xchg dword fs:[edi], esp
hlt

Function at 0x48281c
Capabilities:
Encode data using xor

Disassembly:
mov ecx, esp
sar bl, cl
xor eax, 0xfadc734d
mov esi, 0xbcc4885f
cmc
xlatb
movsd dword es:[edi], dword [esi]
aas
mov ebp, dword [esi + 0x4e]
mov cl, 0x4d
sub esi, edx
sbb byte [ecx + ebx*2 + 0x2c6e0ef2], 0xc7
dec ebx
cdq
fucomp st(7)
push 0xffffffffffffff99
out 0x8c, eax
invalid

Function at 0x482a0c
Capabilities:
Encode data using xor

Disassembly:
sbb bh, dh
and edx, dword [edi - 0x2f]
push ecx
jle 0x4829cd

Function at 0x484afc
Capabilities:
Encode data using xor

Disassembly:
and dword [ebx + 0x69], 0x9114e887
push edi
pop esp
sub eax, 0xd01f4a4d
dec edx
pop ds
rcl bh, 1
dec edx
pop ds
rcl bh, 1
mov dword [ebp - 0x21bb25ff], edx
adc eax, 0x738d055d
je 0x484aca
push eax
mov edi, 0x53f2477a
cdq
xor eax, 0x146c2385
and esp, dword [ebx - 0x29bb2599]
xchg edx, eax
fld st(5)
rol dword [ebx + 0x1c67e1c5], 1
mov edx, dword [edx]
dec ebp
sub byte [edx], ah
and edx, dword [ecx + esi]
mov ah, 0x16
sal bl, cl
and ebp, dword [edx + esi*4 + 0x3dec287c]
sbb bh, dl
sub eax, 0x166b3053
xor al, 0xe
lcall 0xaee4, 0xbde3b7c0
jle 0x484af1
jmp 0x484bc9
xor al, 0xe5
jb 0x484bd0
std
int1
sahf
and dword [edx - 0x6adf374b], esp
js 0x484c3c
add edx, dword [edx - 0x1f2e3cf8]
mov ebp, 0x9247845b
test eax, 0xa2692a35
invalid
test dword [ebx], edx
invalid

Function at 0x485104
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
sbb al, 0xb8
push es
xor dword [edi], esp
dec ebp
add eax, dword [edi + eax*2 + 0x6c]
Function at 0x486cf8
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xe0
jle 0x486d63
inc eax
lcall 0x9ad3, 0x5abd5073
mov cl, 0xb8
mov eax, 0xf425e960
lodsd eax, dword [esi]
jb 0x486d09
jmp 0x72f66133
imul byte [ebx]
add al, 0x99
jge 0x486d35
in eax, 0x19
popal
sbb eax, 0xcc02f5a3
mov byte [0x15f1ca34], al
pop ebx
cmp dh, byte [edi + 0x577edcaf]
stosb byte es:[edi], al
out 0xd0, eax
cmp dword [ebp + 0x7e], edi
lds esi, es:[edx]
jge 0x486d90
xor ebx, edx
and dl, 0xd4
adc ecx, dword [ebx + esi]
push ecx
xchg byte [edi + 0x58e79b0d], al
push ds
fcmovnb st(0), st(1)
aas
popfd
inc esp
dec edx
lodsd eax, dword [esi]
cmp al, 0x33
fiadd word [ebx - 0x253c0207]
add esi, dword [edi - 0x3a37f98c]
insd dword es:[edi], dx
aad 0xf4
mov byte [edx - 0x2e], bl
jne 0x486d37
and eax, 0x97c35e29
sub dword [esi - 0x3d], ebx
xchg edi, eax
adc eax, 0xd44d2482
mov ch, 0x47
fld qword [ebx]
dec ebp
popfd
xor byte [esp + edx*4 - 0x70], ch
invalid
invalid

Function at 0x48e3e4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edi*4 - 0x6445917e], ah
and eax, 0x25343c56
mov edx, 0x3c56259b
xor al, 0x25
sbb ebp, dword [ecx - 0x54]
rep lodsb al, byte [esi]
xor byte [edx + 4], ah
mul byte [eax]
or ch, byte [edi + eax + 0x4b]
add dword [ebx + 0x65cb2c15], edi
stosb byte es:[edi], al
pop edi
or dword [edi + 0x1d202279], edi
daa
scasd eax, dword es:[edi]
jg 0x48e3e9
hlt

Function at 0x491594
Capabilities:
Encode data using xor

Disassembly:
adc byte [ebp - 0x32e5adb], ah
popfd
and eax, 0x9dfcd1a5
test byte [esi + 0x2f462dbb], dh
adc dh, bl
add eax, 0x78c637bb
xor al, 6
stosb byte es:[edi], al
xchg ebx, eax
jbe 0x49151e
pop ss
mov cl, 0x83
movsb byte es:[edi], byte [esi]
int3
fcom qword [eax]
xor ebp, ebp
jge 0x49154a
jmp 0x491520
Function at 0x7c5058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x7c51a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x7c507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c506a
add dl, dl
jne 0x7c5089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c50dc
xor eax, eax
add dl, dl
jne 0x7c5096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x7c517d
add dl, dl
jne 0x7c50a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x7c50d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x7c5075
mov eax, 1
add dl, dl
jne 0x7c50ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x7c50f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c50e1
sub eax, ebx
mov ebx, 1
jne 0x7c5128
mov ecx, 1
add dl, dl
jne 0x7c510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c5119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x7c513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x7c514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x7c5136
cmp eax, 0x7d00
jae 0x7c516d
cmp eax, 0x500
jb 0x7c5168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
cmp eax, 0x7f
ja 0x7c5170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x7c5075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x7c519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x7c5075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4297e0
Capabilities:
Encode data using xor

Disassembly:
add al, 0x8d
xor eax, 0xa7ba66b6
adc esp, dword [eax]
mov dword [0xe6429906], eax
sub cl, byte [0x5923e8f9]
mov dh, 0xe
mov esi, gs
int1
in al, dx
in al, 0x84
and dword [edi], eax
sub dh, byte [esi - 0x77]
cmp dh, byte [ebx + 0x1eeb3082]
daa
mov dword [0xf534a74f], eax
int 0x7c
xchg edx, eax
pop ss
adc dword [eax + edx*8], 0x3bbb2f60
and edx, eax
rcl dword [0x31ad4b5a], cl
sbb al, 0x66
pop es
lds esp, [ecx + 0x20fa3250]
invalid
mov eax, dword [0x20fa3250]
and bl, cl
cmp al, bl
inc eax
xchg edx, eax
mov al, 0xda
inc ecx
inc eax
cld
cmc
xor al, 0xf6
mov ch, 0xb6
xlatb
jnp 0x4297dc
retf
inc ebp
fmulp st(6)
leave
mov dword [eax], edx
mov al, byte [0x94420d4d]
and dword [edi + 0x59159b4f], ecx
xchg ecx, eax
pop edi
stosd dword es:[edi], eax
cmp al, 0x9f
jnp 0x429798
lea esp, [eax + 0x63b56694]
fimul dword [eax]
lodsb al, byte [esi]
pop ebp
out 0x3d, eax
mov esi, 0x3aad186e
scasd eax, dword es:[edi]
mov edi, 0x6d469431
wait
xor ebx, dword [ebp + ebx*8 - 0x5d2c7915]
and bh, bl
sbb eax, dword [ebx + 0x5cbd069]
dec edx
pop edi
int3
Function at 0x408910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b7260
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4dc1c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi + 0x30]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x408950
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, esi
call fcn.004087e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409740
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b73a6
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x4dc1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], 0
xor eax, eax
mov dword [ebp - 4], 0
cmp dword [ecx + 0x2c], eax
lea ecx, [ebp - 0x230]
push 0x2001f
setne al
push str.SoftwareMicrosoftWindowsCurrentVersionRun
add eax, 0x80000001
push eax
call fcn.0040cca0
mov edi, dword [ebp - 0x230]
test eax, eax
jne 0x4098d7
call fcn.0040c7b0
mov ecx, eax
test ecx, ecx
je 0x409904
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push dword [esi + 8]
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 1
push dword [esi]
push str.__s___s
push eax
call fcn.0040c6c0
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00492fb0
add esp, 0x1c
mov dword [ebp - 0x21c], 0x208
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409866
mov eax, dword [ebp - 0x224]
cmp eax, 1
je 0x409854
cmp eax, 2
jne 0x409866
cmp dword [ebp - 0x21c], 0
jne 0x409866
xor eax, eax
mov word [ebp - 0x218], ax
mov esi, dword [ebp - 0x220]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00496796
add esp, 8
test eax, eax
je 0x4098b4
test esi, esi
je 0x4098b4
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x409890
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4098d0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, 1
jmp 0x4098d9
xor esi, esi
test edi, edi
je 0x4098e4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00470c70
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.0040be90
int3
Function at 0x40c890
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b78b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4dc1c4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp word [0x504168], 0
jne 0x40c8d4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
push 0x504168
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
call fcn.0040c7b0
mov ecx, eax
test ecx, ecx
je 0x40c940
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
push 0x504168
mov ecx, esi
mov dword [ebp - 4], 0
call fcn.0040beb0
test al, al
jne 0x40c92c
mov ecx, 0x504168
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40c910
sub ecx, edx
sar ecx, 1
push ecx
push 0x504168
mov ecx, esi
call fcn.0040d1b0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.0040be90
int3