joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd970
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x800ffc]
xor edx, edx
cmp eax, edx
jne 0x4bd996
xor eax, eax
mov byte [eax + 0x800efc], al
inc eax
cmp eax, 0x100
jl 0x4bd97e
mov dword [0x800ffc], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x800efc
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x4bda27
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x4bd9fa
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4bd9c8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4bda30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x4bda83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4bda6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c4410
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f29de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004c4d30
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x7aadec
call fcn.004e3c26
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4c44a3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004e3c26
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4c449c
push 0
mov ecx, eax
call fcn.004bb5b0
mov dword [esi + 0xc], eax
jmp 0x4c44a5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4c44a5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4e6289
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4e62c1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004e4340
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004e4318
jmp 0x4e62cd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4e797c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4e79be
call fcn.004ed6f4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4e79be
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4e79b5
xor eax, eax
jmp 0x4e79c6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004e79cc
pop edi
pop esi
pop ebx
ret 4

Function at 0x4edc24
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4edc52
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4edc70
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004edb8a
jmp 0x4edc70
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4edc70
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004edb8a
test edi, edi
mov eax, edi
jne 0x4edc5a
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x84cd50
Capabilities:
Packed with generic packer

Disassembly:
je 0x941706
push ebx
jmp 0x9416f6
je 0x9aacba
push eax
mov eax, dword [eax + 4]
add eax, 8
jmp 0x9aac9a
mov eax, 1
stc
bts si, cx
sub si, bp
mov eax, 2
and ax, bp
rol ah, 0x29
mov eax, 4
ror al, cl
mov eax, 2
rcr ah, 0xcb
xadd ax, cx
mov eax, 5
adc edi, esp
mov eax, 4
add dh, 2
mov eax, 2
clc
rcr ax, cl
mov eax, 5
mov eax, 6
btr edi, ebx
jmp 0x94e4ff
pushal
jmp 0x847724
push ebp
cmc
rcr ebp, 0xa1
add ebp, ecx
mov ebp, esp
test ecx, ebx
sub esp, 0x1c
jmp 0xa6496f
jmp 0x84780d
mov dword [ebp - 0x10], 0
jmp 0xa14725
mov dword [ebp - 0x10], 0
jmp 0x41966e
call fcn.004526c6
add esp, 4
cmc
mov ax, 0x22c1
bt eax, edx
pop eax
clc
cmc
mov dword [ebp - 4], eax
ror al, cl
push reloc.WS2_32.dll_getpeername
push 0
sal ax, cl
mov eax, dword [ebp - 4]
test dh, bh
test eax, eax
jmp 0xa053bc
popal
xchg bh, ah
clc
bsf bx, cx
push edx
mov edx, 1
mov edx, 2
sub edx, edi
btc ax, bx
mov edx, 4
mov edx, 2
cwd
xor edx, edi
mov edx, 5
bt ebx, eax
mov edx, 4
shld dx, dx, 0x6b
add ax, 0x4384
mov edx, 2
stc
btr edx, 0x87
test bp, 0x2fb3
mov edx, 5
movzx eax, di
bt bx, 0x1b
mov edx, 5
rcr ebx, 0x15
setbe bl
not ebx
pop edx
mov ebx, dword [ebp + 8]
add ax, sp
bsr ax, di
rcr ah, cl
mov eax, dword [ebx]
test eax, eax
jmp 0x839288
push eax
call fcn.004526cc
pop ecx
mov di, bp
not si
cmovge esi, esp
pop esi
mov edi, eax
not ebx
movzx ebx, di
movsx ebx, bx
rep movsb byte es:[edi], byte [esi]
shl ebx, cl
dec ebx
push eax
cmp ebp, esp
ror bh, 0xd7
rcl bl, 0xe4
mov ebx, dword [ebp - 4]
clc
cmp edx, 0x32431831
test ebx, ebx
jmp 0x829229
call fcn.00402580
mov dword [ebp - 0xc], eax
jmp 0x8d9423
jne 0xa053c7
mov eax, 0x5efec7
push eax
mov bh, 0xa3
movsx ebx, dx
cmovge bx, bp
push 1
movzx bx, ch
bswap ebx
mov ebx, 0x452d80
jmp 0xa61625
mov dword [ebp - 0x14], 0
jmp 0x88f288
push eax
jmp 0x9bbfec
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x8c4d82
call fcn.004526d2
add esp, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
jmp 0xa39651
mov dword [ebp - 4], 0
jmp 0xa4d98e
Function at 0x895226
Capabilities:
Packed with generic packer

Disassembly:
pop eax
jmp 0x89cecd
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jmp 0x99585f
call fcn.004526d2
lea esp, [esp + 0x10]
test ecx, ebp
mov dword [ebp - 0x10], eax
cmp bh, 0x18
test edx, 0x114a1676
stc
cmp dword [ebp - 0x10], 0
jmp 0x8e43c7
mov dword [ebp - 4], eax
jmp 0x8b6b94
mov eax, dword [eax]
call dword [eax + 0x18]
mov dword [ebp - 0xc], eax
shr ax, 0x3b
xchg ebx, eax
neg eax
mov eax, dword [ebp - 0xc]
cmp cl, bh
clc
push eax
mov ebx, dword [ebp - 8]
cmp edi, eax
test ebx, ebx
jmp 0x9df1fa
je 0x82c243
push ebx
call fcn.004526c6
add esp, 4
movzx eax, bx
cmovge ax, cx
pop eax
jmp 0x826c64
jne 0x8705b8
mov eax, 0x5efec7
mov bx, 0x2ff5
movzx bx, al
push eax
push 1
cmova bx, di
movzx ebx, ax
mov ebx, 0x452d80
jmp 0x913690
je 0x9a8e6c
push ebx
jmp 0x9a8e61
pushal
bts bp, bx
rcr si, 0xa
mov eax, 1
ror eax, 0x78
mov eax, 2
mov eax, 4
mov eax, 2
cmp cx, 0x60e1
mov eax, 5
mov eax, 4
mov eax, 2
cmovo edx, ebx
cmc
mov eax, 5
test ebp, 0xf403109
rol al, 0x37
cmova bx, cx
mov eax, 6
sar edi, 0x90
sar ch, cl
popal
inc bx
xor bx, si
push reloc.WS2_32.dll_getpeername
rol ebx, cl
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
jmp 0x8705a5
push ebp
mov ebp, esp
cmc
cmp bx, si
sub esp, 0x20
jmp 0xa09dc3
jmp 0x9e311a
push eax
cmp bh, 0xf3
and bl, ch
mov ebx, dword [ebp - 4]
test edi, ebx
test di, 0xb5
test ebx, ebx
jmp 0xa50cd7
jne 0x8ed60a
mov eax, 0x5efec7
jmp 0x8bc499
lea eax, [ebp - 4]
push eax
cwde
push dword [ebp + 8]
movzx ax, bl
push 0x7d1b3c
movzx eax, di
movzx ax, dh
not ax
mov eax, dword [esp]
jmp 0x9149ba
call fcn.004526d2
lea esp, [esp + 0x10]
stc
clc
cmp ebp, ecx
mov dword [ebp - 0x10], eax
stc
cmp dword [ebp - 0x10], 0
jmp 0xa42e09
mov eax, dword [eax]
jmp 0x829fad
call fcn.004526cc
pop ecx
cmovns di, cx
pop esi
cmovbe ebx, esi
movzx ebx, bx
mov edi, eax
not bx
rep movsb byte es:[edi], byte [esi]
btc ebx, ebp
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
jmp 0x82c22d
je 0x92d7b3
push eax
test si, 0x4f08
cmc
mov eax, dword [eax + 4]
stc
cmp si, sp
add eax, 8
jmp 0x98625f
call fcn.004526c6
add esp, 4
ror bx, cl
btc ebx, 0xd6
sar bl, cl
mov ebx, dword [ebp - 8]
clc
test ebx, ebx
jmp 0x8730e9
jne 0x96c813
mov eax, 0x5efec7
push eax
mov ebx, eax
xchg bx, bx
push 1
mov ebx, 0x452d80
jmp 0x81b51b
push eax
jmp 0x92d798
call fcn.004526c6
add esp, 4
bswap ax
pop eax
jmp 0x9d746d
ret 0xc
mov esp, ebp
pop ebp
jmp 0x9bbcac
test eax, eax
jmp 0x93ee4b
je 0x42033e
push ebx
jmp 0x420334
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
shl ah, 0x48
add al, 0x3e
xadd ah, ah
mov eax, dword [ebx]
clc
test bp, bp
test ebx, 0x2f0b31bc
test eax, eax
jmp 0x96c808
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x87be0c
jne 0x420344
mov eax, 0x5f39f5
test sp, bp
cmc
jmp 0x9dcf7b
je 0x965cd3
push ebx
jmp 0x965cc2
Function at 0x8c2dd1
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 0x10], 0
jmp 0x8a9544
nop
jmp 0xa20b5f
nop
jmp 0xa24846
nop
jmp 0x82bf3b
fild dword [ebp - 0x10]
jmp 0x98f802
nop
jmp 0x414bdb
dec dword [ebp - 0xc]
jmp 0x844b2b
pushal
sal di, 0x95
rdtsc
mov eax, 1
cwd
mov eax, 2
mov eax, 4
shl eax, 0xb3
rcr di, 0xa0
mov eax, 2
lahf
bts bx, si
btc bp, 0xf0
mov eax, 5
mov eax, 4
shld ebx, ecx, 0xc6
rcr ebp, 0xfe
mov eax, 2
sar cl, cl
btr eax, 0xcf
mov eax, 5
shrd cx, ax, 0x48
mov eax, 6
rcr eax, 0xe2
popal
test ebx, 0x6f442431
cmp bp, 0x773b
cmp dword [ebp - 4], 0xfffffb9e
je 0x984451
inc dword [ebp - 8]
jmp 0x86cb9e
nop
jmp 0x9233e2
mov dword [ebp - 0x14], 0
jmp 0x8c5ed8
call fcn.0040100c
mov dword [ebp - 0x14], eax
jmp 0x941f80
nop
jmp 0xa49a90
push 0
push dword [ebp - 0x18]
jmp 0x92ac33
push ebp
rcr ebp, 0x8a
movsx ebp, cx
dec bp
mov ebp, esp
sub esp, 0x24
jmp 0x9098a8
jmp 0x87e763
nop
jmp 0x9a2b7a
nop
jmp 0x83e5a0
nop
jmp 0xa59a38
nop
jmp 0x8ce848
nop
jmp 0xa374f3
mov dword [ebp - 4], 0
jmp 0xa3d626
nop
jmp 0x83681c
nop
jmp 0x8b1c95
nop
jmp 0x8f464b
fdiv qword [0x5efecf]
fstp qword [ebp - 0x24]
fld qword [ebp - 0x24]
jmp 0x8ac981
call fcn.0041dbee
nop
nop
jmp 0x99c8d6
nop
nop
jmp 0xa72ea7
nop
jmp 0xa5572a
fld qword [ebp - 0x24]
jmp 0xa184eb
jmp 0x87e7cb
fild dword [ebp - 0x14]
jmp 0xa42559
nop
nop
jmp 0xa6b708
call fcn.00426394
mov dword [ebp - 0x18], 0
jmp 0x8b8e91
fstp qword [ebp - 0x1c]
fld qword [ebp - 0x1c]
fmul qword [0x5efecf]
jmp 0x9f8183
nop
jmp 0x99d0a7
nop
jmp 0x9792a2
nop
jmp 0x86ae1c
fstp qword [ebp - 0x24]
jmp 0x939446
nop
jmp 0x8e6a2a
call fcn.0040100c
mov dword [ebp - 0x10], eax
jmp 0x95818c
nop
jmp 0x91a16b
nop
nop
jmp 0x8ed32d
nop
jmp 0x917db7
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x81fff3
fstp qword [ebp - 0x1c]
jmp 0xa5991b
nop
nop
jmp 0xa5c1ca
nop
jmp 0x8f47dc
fld qword [ebp - 0x1c]
jmp 0x924411
nop
jmp 0x92acf5
nop
jmp 0xa62e0d
nop
jmp 0x886728
nop
jmp 0x939436
nop
jmp 0xa124c5
Function at 0x8e02fe
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
push ebp
cmp ebx, eax
mov ebp, esp
sub esp, 0x84
jmp 0x984f0b
mov dword [ebp - 8], 0
jmp 0x9c1a2a
mov dword [ebp - 4], 0
jmp 0x924334
mov dword [ebp - 0xc], 0
jmp 0xa39a3b
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp loc.00453a80

Function at 0x8e4e59
Capabilities:
Packed with generic packer

Disassembly:
call fcn.004526d8
add esp, 0xc
not bl
mov ebx, dword [ebp - 4]
cbw
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x14]
cmovge ax, ax
mov dword [ebx], 0x10007
not ah
mov dword [ebp - 0x14], esp
mov eax, dword [ebp - 4]
jmp 0xa0cee4
rep stosd dword es:[edi], eax
movzx bx, al
bswap ebx
pop ebx
jmp 0x935d57
mov eax, 4
xchg esi, ebp
movzx ecx, bx
not ax
mov eax, 2
not dl
mov eax, 5
movzx edi, ax
mov eax, 4
mov eax, 2
cbw
movsx dx, bl
mov eax, 5
not di
movzx eax, bx
mov eax, 6
cwd
popal
jmp 0xa628ef
push ebp
add bp, bx
test ebx, esp
mov ebp, esp
stc
sub esp, 0x1c
jmp 0x98368c
rep stosd dword es:[edi], eax
add ebx, 0x1c
push ebx
jmp 0x90c842
push 0x58
jmp 0xa1f7b8
mov dword [ebp - 0xc], 0
jmp 0x9eac15
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
jmp 0x928af1
call fcn.004526cc
lea esp, [esp + 4]
rcr ch, cl
pop ebx
push ebx
xor di, 0x3c0
sal cx, 4
mov dword [ebx], eax
mov ebx, eax
not cx
mov edi, eax
sub eax, eax
movzx cx, dh
mov ecx, 9
jmp 0x8e9ab1
push 0x60
jmp 0xa12140
pop ebx
rol ecx, 0x11
push eax
shl ecx, cl
not si
mov dword [ebp - 0x1c], ebx
btr si, 0xe3
cmp cx, cx
mov dword [ebp - 0x18], eax
mov eax, dword [ebx]
test sp, 0x57e8
movzx ecx, dx
lea ebx, [ebx + 4]
xchg cx, si
shrd ecx, edi, 0x76
mov dword [edi], eax
btr cx, dx
bswap eax
bsf si, bp
lea edi, [edi + 4]
shr al, cl
sub ch, 0xc5
mov eax, dword [ebx]
sar ecx, cl
shld esi, edi, 0x31
lea ebx, [ebx + 4]
bts cx, si
mov dword [edi], eax
or cx, cx
add edi, 4
movzx ecx, dx
sar ch, cl
bsr si, bx
mov eax, dword [ebx]
add ebx, 4
mov dword [edi], eax
lea edi, [edi + 4]
mov eax, dword [ebx]
jmp 0x439a1c
push 0xcc
jmp 0xa24bd9
push ebx
push 0x24
jmp 0x94553b
pushal
mov eax, 1
bswap cx
mov ebp, edx
mov eax, 2
lahf
jmp 0x8cb01c
push eax
jmp 0x9dd842
push 6
jmp 0x84a18d
call fcn.004526cc
add esp, 4
ror di, 0xe5
rol bh, 0x85
xadd ch, cl
mov dword [ebp - 4], eax
movzx ecx, dx
mov ebx, eax
or di, dx
xor di, bp
mov edi, eax
sal cx, cl
movsx cx, cl
sub eax, eax
mov cx, bp
mov ecx, 0x18
rep stosd dword es:[edi], eax
cmp di, 0x67ac
add ebx, 0x1c
jmp 0x9e3f45
call fcn.004526cc
add esp, 4
movsx edi, ax
pop ebx
bswap di
mov dword [ebx], eax
mov edi, eax
movsx ecx, bx
mov esi, 0x5efedf
lodsd eax, dword [esi]
bswap bx
xchg cx, bx
not cx
stosd dword es:[edi], eax
mov bh, 0x3e
cbw
xchg bh, cl
lodsd eax, dword [esi]
cmovl ebx, edx
stosd dword es:[edi], eax
and ch, ah
rcl cl, 0xb4
bt bx, cx
xor eax, eax
bswap cx
movzx bx, bh
mov ch, bl
mov ecx, 0x14
xchg bx, bx
jmp 0x86184a
call fcn.004526cc
add esp, 4
mov edi, eax
cmp cl, 0xea
jmp 0x9d0a5e
call fcn.004526de
cmp dword [ebp - 0x14], esp
je 0x84a197
push 0x6a
jmp 0xa7682d
fninit
mov dword [ebp - 0x14], esp
push 0
movsx eax, ax
push 0xffffffff
cmovo eax, esp
mov eax, 0xa
jmp 0xa477cd
push 0x40479d4
jmp 0xa0cf36
Function at 0x9637ac
Capabilities:
Packed with generic packer

Disassembly:
pop eax
stc
mov dword [ebp - 4], eax
rol ax, cl
rcl ax, cl
xadd ah, al
push reloc.WS2_32.dll_getpeername
bswap ax
push 0
rcl al, cl
mov eax, dword [ebp - 4]
test ebp, edi
clc
test eax, eax
jmp 0xa61f9f
mov dword [ebp - 8], 0
jmp 0x9caeca
push ebp
mov ebp, esp
test dl, 0x82
clc
sub esp, 0x1c
mov dword [ebp - 4], 0
jmp 0x864e9d
je 0xa3e936
push eax
mov eax, dword [eax + 4]
cmp al, 0xbe
clc
add eax, 8
push eax
jmp 0xa3e913
mov dword [ebp - 0x14], 0
jmp 0xa3a937
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jmp 0x9952b5
pushal
mov eax, 1
mov eax, 2
movzx edi, bx
rol cx, 0x78
mov eax, 4
adc cl, bl
sub ebp, 0x7ab02583
mov eax, 2
sar ch, cl
mov eax, 5
cmc
xadd dx, bp
bt ebp, 0x8f
mov eax, 4
sbb bp, 0x3864
cmovo dx, si
adc bp, si
mov eax, 2
not si
btr edi, eax
movsx ebp, bp
mov eax, 5
cmovo ecx, edx
mov eax, 6
popal
sub eax, edi
movsx bx, bh
push edx
ror al, cl
bt edx, edi
cdq
mov edx, 1
cmp sp, 0x6f7e
sub dl, cl
test cl, al
mov edx, 2
add bh, 0x90
adc edx, esi
bt ebx, 0xee
mov edx, 4
mov edx, 2
rcl ax, cl
mov edx, 5
shl ebx, 0xbc
or al, 0x8c
mov edx, 4
mov edx, 2
mov edx, 5
mov edx, 5
add bx, di
dec ah
pop edx
mov ebx, dword [ebp + 8]
shr ah, 0xa6
sbb ax, sp
mov eax, dword [ebx]
cmc
cmp ecx, 0x68ca2d12
clc
test eax, eax
jmp 0x981f05
call fcn.004526cc
pop ecx
xchg edi, ebx
seto bl
pop esi
movzx ebx, si
xchg di, bx
mov edi, eax
mov ebx, eax
cmove bx, ax
not bl
rep movsb byte es:[edi], byte [esi]
not bl
rcl ebx, 0x85
push eax
mov ebx, dword [ebp - 4]
test dx, bx
test ch, 0x7f
test ebx, ebx
je 0x43994a
push ebx
jmp 0x43993f
Function at 0x9c1e8f
Capabilities:
Encrypt data using rc4 prga
Execute anti-debugging instructions

Disassembly:
call dword [ebp - 4]
pop edi
pop esi
mov dword [ebp - 0xc], ebx
shr dl, 0x33
and dh, 0xb5
mov dword [ebp - 8], eax
mov edx, ebp
adc dl, cl
test cl, 0x8a
mov edx, dword [ebp - 0x18]
cmc
clc
mov dword [edx + 0x1e4], 0
clc
cmp dword [ebp - 0xc], 0
jmp 0x861482
je 0x8614ac
mov eax, dword [ebp + 8]
mov si, 0x2949
bswap esi
mov dword [eax + 0x24], 1
cwd
not di
cmovge eax, ecx
mov ecx, dword [ebp + 8]
movzx eax, si
mov edx, dword [ebp - 8]
mov dword [ecx + 0x28], edx
mov eax, 1
jmp 0x91dbc6
jne 0x9529b4
sub eax, eax
jmp 0x8fc18c
mov dword [ebp - 0x14], eax
jmp 0x9cc559
call fcn.00464230
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jmp 0x88f430
cmp dword [ebp - 0x14], 0
jl 0x81c896
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + edx*4 + 0x10]
jmp 0xa3d0dc
jmp 0x91dbc6
mov ecx, dword [ebp - 0x18]
jmp 0x8bf553
push edx
jmp 0x9a0881
pop edi
pop esi
pop ebx
mov esp, ebp
mov ebp, 0x418735f8
bswap bp
pop ebp
ret 4
push esi
push edi
mov dword [ebp - 0x18], ecx
rdtsc
not ah
mov eax, dword [ebp + 8]
movsx edx, bx
bswap dx
seta ch
mov ecx, dword [eax + 0xc]
movsx ax, ch
cmovne ax, di
push ecx
rdtsc
movzx eax, si
jmp 0x928934
mov edx, dword [ebp + 8]
not cl
nop
mov eax, dword [edx + 8]
cwd
xchg dx, cx
bswap cx
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
cbw
jmp 0x909568
push esi
xor ax, 0x3987
movzx ax, dl
push edi
add ax, 0x6604
mov edx, dword [ebp + 8]
sal ax, cl
shl eax, 0x78
bts ax, dx
mov eax, dword [edx + 0xc]
sub eax, 1
jmp 0x8bda71
mov eax, dword [ebp + 8]
cmove ecx, ecx
mov ecx, dword [eax]
push ecx
mov cl, 0xab
movzx ecx, cx
jmp 0x8fdf6e
push ebp
mov ebp, esp
shld ax, si, 0xe9
sub esp, 0x18
push ebx
jmp 0x91fef7
jmp 0x8e4e96
mov dword [ebp - 0x10], ecx
jmp 0x413150

Function at 0x9fef88
Capabilities:
Packed with generic packer

Disassembly:
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp loc.0041ff46
push ebp
mov ebp, esp
cmp edx, 0x5c8a5de0
cmc
sub esp, 0x30
jmp 0x8e54fd
Function at 0xa32585
Capabilities:
Execute anti-debugging instructions
Packed with generic packer

Disassembly:
mov dword [ebp - 0xc], 0
jmp 0x9233a4
pushal
mov eax, 1
mov ebp, edi
rdtsc
mov eax, 2
mov edi, 0x1a5165fd
mov eax, 4
mov ebp, 0x65357134
cdq
mov eax, 2
rdtsc
mov eax, 5
mov ebp, 0x67113e52
xchg di, cx
lahf
mov eax, 4
movzx ebx, di
mov eax, 2
bswap ecx
cdq
mov eax, 5
setbe ah
jmp 0x99d802
mov dword [ebp - 0x10], 0
jmp 0x9a7d5a
call fcn.004526de
cmp dword [ebp - 0x14], esp
jmp 0x9b5674
push 0x40
cwde
push 0x1000
push 0x64
setle ah
lahf
push 0
mov eax, 0x5e
jmp 0x94f945
mov eax, 6
cbw
setnp bh
bswap cx
popal
mov ah, 0xad
bswap ax
cmovno ax, dx
push edx
cdq
mov edx, 1
cwd
bswap ax
mov edx, 2
cmovae eax, ebp
cwd
lahf
mov edx, 4
mov edx, 0x4a3f2527
setne ah
mov edx, 2
not edx
cwde
mov edx, 5
movsx edx, bx
cwde
mov edx, 4
xchg edx, edx
rdtsc
mov edx, 2
cwd
mov edx, 5
cbw
mov edx, 0x3a861ed4
mov edx, 5
pop edx
mov dword [ebp - 0x14], esp
mov ax, 0x25d0
bswap eax
jmp 0x97b072
jmp 0x8938b6
je fcn.008726c5
push 0x74
jmp 0xa0293c
mov dword [ebp - 4], 0
jmp 0xa02c76
push 0x40479b6
jmp loc.0042bbb0
mov dword [ebp - 8], 0
jmp 0x868eaf
push ebp
bt ebp, 0xc0
shrd ebp, esi, 0x80
sub ebp, esp
mov ebp, esp
clc
cmc
cmp bp, 0x6969
sub esp, 0x24
jmp 0x9ed6ea

Function at 0xa4898a
Capabilities:
Packed with generic packer

Disassembly:
nop
jmp 0x89c891
jmp 0x860ab9
pushal
mov dx, 0x4fff
mov eax, 1
movzx dx, cl
mov eax, 2
cwde
bswap cx
mov eax, 4
lahf
cbw
rdtsc
mov eax, 2
xchg bx, si
mov eax, 5
jmp 0x948f56
je 0x87e721
push ebx
call fcn.004526c6
add esp, 4
pop eax
jmp 0x8cbfe1
nop
jmp 0xa01593
call fcn.0040158c
inc eax
push eax
jmp 0x94aaee
nop
jmp 0x9d1d90
mov dword [0x7d1a78], eax
jmp 0x9a4df0
nop
jmp 0xa71c8e
nop
nop
jmp 0x91f139
nop
jmp 0xa26634
nop
jmp 0x95a473
mov eax, 4
cdq
cwd
mov eax, 2
seta ah
cwde
movzx edx, dx
mov eax, 5
cwd
mov eax, 6
seto bh
popal
jmp 0xa35c22
call fcn.004526cc
pop ecx
not si
cmovb edi, edi
movsx edi, dx
pop esi
xchg di, bx
movzx bx, ah
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
bsr bx, bx
mov ebx, dword [0x7d1a78]
cmp ecx, eax
test dl, 0x53
test ebx, ebx
jmp 0x87e712
nop
nop
jmp 0x8ec9e4
nop
jmp 0x820982
mov dword [0x7d1a7c], 1
jmp 0xa4bbc5
nop
jmp 0x94f55e
nop
jmp 0x415e26
nop
jmp 0x9d5c64
nop
nop
nop
jmp 0x887c9f
nop
jmp 0x91106e
fninit
mov eax, dword [ebp + 8]
btc bx, di
mov dword [0x7d1a74], eax
mov ebx, dword [ebp + 0xc]
xor ah, dl
shl eax, 0xc8
mov eax, dword [ebx]
test ah, ch
test eax, eax
je 0x94ab09
push eax
mov ebx, eax
jmp 0x89a947
push ebp
mov bp, dx
mov ebp, esp
jmp 0x84f299
nop
nop
nop
nop
nop
nop
jmp 0x9365da
nop
nop
nop
nop
jmp 0xa30b79

Function at 0x40892d
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
add ecx, ecx
mov edi, edi
call fcn.0040895f
sub ecx, edi
xor dword [eax], ebx
sub esp, 4
mov dword [esp], 0xff99cda8
pop edi
add eax, 1
and ecx, edi
mov edi, 0x1c55d115
cmp eax, esi
jne fcn.0040892d
mov ecx, ecx
inc edi
ret
Function at 0x401650
Capabilities:
Enumerate services

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x18], esi
cmp eax, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
je 0x40167a
push eax
call fcn.00419ce1
add esp, 4
mov dword [esi + 0x1c], edi
push 5
push edi
push edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
cmp esi, edi
je 0x401721
push edi
lea eax, [esp + 0x14]
push edi
lea ecx, [esp + 0x1c]
push eax
push ecx
push edi
push edi
push 3
push 0x30
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_EnumServicesStatusExA]
push esi
call edi
mov ebx, dword [esp + 0x14]
cmp ebx, 1
jb 0x40171a
add ebx, 0x10
push ebx
call fcn.0040b50b
add esp, 4
mov ebp, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push 0
push 0
push edx
push eax
push ebx
push ebp
push 3
push 0x30
push 0
push esi
call edi
mov eax, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x401711
mov ebx, ebp
mov edx, dword [ebx]
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push edx
call fcn.00419904
mov ecx, dword [esp + 0x1c]
push esi
call fcn.00401730
mov eax, dword [esp + 0x10]
inc edi
add ebx, 0x2c
cmp edi, eax
jb 0x4016ec
push ebp
call fcn.0040b422
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret