joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4630b0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403870
ret

Function at 0x46349c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbe8
push ebx
xor edx, edx
mov dword [ebp - 0x418], edx
mov dword [ebp - 0x414], edx
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x40c], edx
mov dword [ebp - 0x408], edx
mov dword [ebp - 0x3f0], edx
mov dword [ebp - 0x3f4], edx
mov dword [ebp - 0x3f8], eax
xor eax, eax
push ebp
push 0x463713
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3f4]
mov eax, 0x463728
call fcn.00463304
lea eax, [ebp - 0x3f0]
call fcn.0040508c
lea eax, [ebp - 0x3fc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x3f4]
call fcn.0040551c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4636d4
xor eax, eax
push ebp
push 0x4636cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x3e9
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 7
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x408]
mov eax, 0x463768
call fcn.00463304
mov eax, dword [ebp - 0x408]
call fcn.0040551c
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x46359f
push ebp
mov eax, 0x463794
call fcn.004633f4
pop ecx
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x40c]
mov eax, 0x4637a0
call fcn.00463304
mov eax, dword [ebp - 0x40c]
call fcn.0040551c
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x463629
push dword [ebp - 0x3f0]
push 0x4637c8
lea eax, [ebp - 0x410]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004052fc
push dword [ebp - 0x410]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00405420
mov dword [ebp - 0x404], ebx
mov dword [ebp - 0x400], 1
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x3e9]
push eax
lea eax, [ebp - 0x400]
push eax
push 0
lea edx, [ebp - 0x414]
mov eax, 0x4637d4
call fcn.00463304
mov eax, dword [ebp - 0x414]
call fcn.0040551c
push eax
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4636b3
push dword [ebp - 0x3f0]
push 0x4637c8
lea eax, [ebp - 0x418]
lea edx, [ebp - 0x3e9]
mov ecx, 0x3e9
call fcn.004052fc
push dword [ebp - 0x418]
lea eax, [ebp - 0x3f0]
mov edx, 3
call fcn.00405420
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4636d4
mov eax, dword [ebp - 0x3fc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x3f8]
mov edx, dword [ebp - 0x3f0]
call fcn.004050e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46371a
lea eax, [ebp - 0x418]
mov edx, 5
call fcn.004050b0
lea eax, [ebp - 0x3f4]
mov edx, 2
call fcn.004050b0
ret
Function at 0x463ce0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040550c
mov eax, dword [ebp - 8]
call fcn.0040550c
mov ebx, 0x472d9c
xor eax, eax
push ebp
push 0x463ee4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx]
call fcn.0040938c
add eax, dword [0x472e20]
lea edx, [ebp - 0x1c]
call fcn.00409250
mov edx, dword [ebp - 0x1c]
mov eax, ebx
call fcn.004050e0
xor edx, edx
push ebp
push 0x463eac
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4137cc]
call fcn.00417904
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.004096fc
test al, al
je 0x463d72
mov eax, dword [ebp - 8]
call fcn.0040551c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.0040551c
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4137cc]
call fcn.00417904
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x463e9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov cx, 2
mov edx, 0xfffffffc
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041767c
mov eax, dword [ebx]
call fcn.0040938c
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 8
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, dword [ebx]
call fcn.0040938c
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004176ec
mov eax, dword [ebx]
call fcn.0040938c
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
lea edx, [ebp - 0x18]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.0041767c
mov eax, dword [ebx]
call fcn.0040938c
mov edx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xc
add edx, eax
add edx, dword [ebp - 0x18]
neg edx
mov cx, 2
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 0x18]
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004176ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x463ea2
mov eax, dword [ebp - 0x10]
call fcn.00404260
mov eax, dword [ebp - 0xc]
call fcn.00404260
ret
Function at 0x463ef4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x140], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], edx
mov dword [ebp - 0x130], edx
mov dword [ebp - 0x13c], edx
mov dword [ebp - 0x134], edx
mov dword [ebp - 0x138], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040550c
lea edi, [ebp - 0x12c]
xor eax, eax
push ebp
push 0x46405c
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.00461b70
mov esi, eax
mov dword [edi], 0x128
mov edx, edi
mov eax, esi
call fcn.00461b90
mov ebx, eax
jmp 0x46402e
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004052fc
mov eax, dword [ebp - 0x138]
lea edx, [ebp - 0x134]
call fcn.00409a10
mov eax, dword [ebp - 0x134]
lea edx, [ebp - 0x130]
call fcn.00408bcc
mov eax, dword [ebp - 0x130]
push eax
lea edx, [ebp - 0x13c]
mov eax, dword [ebp - 4]
call fcn.00408bcc
mov edx, dword [ebp - 0x13c]
pop eax
call fcn.004054b4
je 0x46400e
lea eax, [ebp - 0x144]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.004052fc
mov eax, dword [ebp - 0x144]
lea edx, [ebp - 0x140]
call fcn.00408bcc
mov eax, dword [ebp - 0x140]
push eax
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 4]
call fcn.00408bcc
mov edx, dword [ebp - 0x148]
pop eax
call fcn.004054b4
jne 0x464023
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov edx, edi
mov eax, esi
call fcn.00461bb0
mov ebx, eax
test ebx, ebx
jne 0x463f6f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464063
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.004050b0
lea eax, [ebp - 4]
call fcn.0040508c
ret
Function at 0x46406c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x464074
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x464294
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4642ac
call fcn.00462004
test al, al
jne 0x4640a4
mov eax, 0x4642ac
call fcn.00409bac
mov eax, dword [0x472da4]
mov edx, 0x4642c4
call fcn.004054b4
jne 0x464279
lea eax, [ebp - 4]
call fcn.00464df4
push dword [ebp - 4]
lea edx, [ebp - 0xc]
mov eax, dword [0x46db1c]
mov eax, dword [eax]
call fcn.00460188
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00463c38
push dword [ebp - 8]
push dword [0x472dac]
mov eax, 0x472dec
mov edx, 3
call fcn.00405420
lea edx, [ebp - 0x10]
mov eax, dword [0x472dac]
call fcn.00408c54
mov eax, dword [ebp - 0x10]
mov edx, 0x4642d0
call fcn.004054b4
jne 0x464161
mov eax, 0x4642e0
call fcn.00462004
test al, al
jne 0x46412a
mov eax, 0x4642e0
call fcn.00409bac
push 0x4642fc
lea edx, [ebp - 0x18]
mov eax, dword [0x46db1c]
mov eax, dword [eax]
call fcn.00460188
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00463c38
push dword [ebp - 0x14]
push dword [0x472dac]
mov eax, 0x472dec
mov edx, 3
call fcn.00405420
mov edx, dword [0x472dec]
mov eax, dword [0x472dc4]
call fcn.00463ce0
mov eax, dword [0x472da4]
mov edx, 0x4642c4
call fcn.004054b4
jne 0x464279
mov eax, dword [0x472dec]
call fcn.004096fc
test al, al
je 0x464279
mov eax, 0x464318
call fcn.00463ef4
push 1
lea edx, [ebp - 0x20]
mov eax, dword [0x46db1c]
mov eax, dword [eax]
call fcn.00460188
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004099dc
mov eax, dword [ebp - 0x1c]
call fcn.0040551c
push eax
push 0x46432c
push dword [0x472dec]
push 0x46432c
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405420
mov eax, dword [ebp - 0x24]
call fcn.0040551c
push eax
push 0x464330
push 0x46433c
push 0
call sub.shell32.dll_ShellExecuteA
lea edx, [ebp - 0x28]
mov eax, dword [0x472dec]
call fcn.0046a090
mov edx, dword [ebp - 0x28]
mov eax, 0x472e18
call fcn.004050e0
mov eax, dword [0x472d74]
mov eax, dword [eax + 0x380]
mov dl, 1
call fcn.004320c4
mov eax, dword [0x472d74]
mov eax, dword [eax + 0x37c]
mov dl, 1
call fcn.004320c4
mov eax, dword [0x472e2c]
mov edx, 0x46434c
call fcn.004054b4
jne 0x464279
xor eax, eax
push ebp
push 0x46426f
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00434524
mov edx, dword [eax]
call dword [edx + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x464279
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46429b
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.004050b0
ret
Function at 0x464df4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x464ec5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x104]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x104]
call fcn.00409e08
lea ecx, [ebp - 0x108]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0042f198
mov eax, dword [ebp - 0x108]
mov edx, 0x464edc
call fcn.004054b4
je 0x464e95
lea ecx, [ebp - 0x10c]
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0042f198
mov eax, dword [ebp - 0x10c]
mov edx, 0x464ee8
call fcn.004054b4
je 0x464e95
lea eax, [ebp - 4]
mov edx, 0x464ee8
call fcn.00405358
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.004050e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x464ecc
lea eax, [ebp - 0x10c]
mov edx, 2
call fcn.004050b0
lea eax, [ebp - 4]
call fcn.0040508c
ret

Function at 0x4653a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040550c
mov eax, dword [ebp - 8]
call fcn.0040550c
xor eax, eax
push ebp
push 0x4654e1
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [0x472e24]
add ebx, 0x64
xor edx, edx
push ebp
push 0x4654b1
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x40
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x4137cc]
call fcn.00417904
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
call fcn.004096fc
test al, al
je 0x465412
mov eax, dword [ebp - 8]
call fcn.0040551c
push eax
call sub.kernel32.dll_DeleteFileA
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 8]
call fcn.0040551c
push eax
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
push 1
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x4137cc]
call fcn.00417904
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4654a0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
mov esi, dword [eax]
call dword [esi + 0x14]
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov esi, dword [eax]
call dword [esi + 0x14]
mov eax, ebx
cdq
push edx
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
call fcn.004176ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4654a7
mov eax, dword [ebp - 0x10]
call fcn.00404260
mov eax, dword [ebp - 0xc]
call fcn.00404260
ret
Function at 0x469f38
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe28
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040550c
xor eax, eax
push ebp
push 0x46a073
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x46a043
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.0040551c
mov ebx, eax
push ebx
call sub.kernel32.dll_DeleteFileA
mov eax, dword [ebp - 4]
call fcn.004096fc
test al, al
jne 0x469fb3
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push ebx
call sub.kernel32.dll_CreateFileA_1
push eax
call sub.kernel32.dll_CloseHandle_1
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00403608
lea eax, [ebp - 0x1d0]
call fcn.004033a4
call fcn.00402fec
push dword [0x472d78]
push 0x46a08c
push dword [0x472d7c]
push 0x46a08c
push dword [0x472d80]
lea eax, [ebp - 0x1d8]
mov edx, 5
call fcn.00405420
mov eax, dword [ebp - 0x1d8]
lea edx, [ebp - 0x1d4]
call fcn.00463a90
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1d0]
call fcn.0040583c
call fcn.00403cc4
call fcn.00402fec
lea eax, [ebp - 0x1d0]
call fcn.004036d0
call fcn.00402fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x46a04d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46a07a
lea eax, [ebp - 0x1d8]
mov edx, 2
call fcn.004050b0
lea eax, [ebp - 4]
call fcn.0040508c
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x40101b
cmp dword [ebp - 8], 0
jne 0x401025
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x401187
xor dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc], 8
jb 0x40114c

Function at 0x44ba10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x66103c]
push ebx
push esi
mov esi, ecx
lea ecx, [eax*4]
mov eax, dword [0x661038]
or ecx, eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], ecx
push 0x664c3c
fild qword [esp + 0x14]
fstp qword [0x661058]
call fcn.006583b8
add esp, 4
test eax, eax
je 0x44ba59
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
lea edx, [esp + 8]
mov ebx, 1
push edx
push ebx
push 0
push 0x661064
push 0x80000000
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa5bf5c], eax
jne 0x44bad5
mov edx, dword [esp + 8]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
push 0x664c3c
push ecx
push 0
push 0
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa5bf5c], eax
jne 0x44babc
cmp dword [esp + 0xc], ebx
je 0x44babe
xor bl, bl
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44bad5
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa5bf5c]
test ecx, ecx
jne 0x44baf8
test eax, eax
jle 0x44baf3
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa5bf5c], eax
pop esi
mov eax, 0x80004006
pop ebx
add esp, 0x10
ret

Function at 0x4dfe0c
Capabilities:
Encode data using xor

Disassembly:
popal
popal
sal byte [eax], cl
imul ecx, esi, 0x3a8fb784
xlatb
aas
movsd dword es:[edi], dword [esi]
rol ah, cl
pop ebp
test byte [ebx + 0x67], bh
push esi
inc edi
out dx, eax
push esp
push esp
dec esp
pushal
insb byte es:[edi], dx
xchg dword [ebx], eax
mov ah, 0xb1
xor bl, ch
cmp ah, 0xa4
popal
jb 0x4dfe2a
xchg ecx, eax
sbb ch, byte [edx + eax*8]
out dx, eax
out dx, al
mov al, byte [0x69544184]
cli
loopne 0x4dfe10
mov dl, 0x40
inc eax
popal
xor al, 0xb0
jge 0x4dfeb2
xchg esp, eax
push ebp
sub bl, bh
cmc
sbb edx, edi
pushfd
loopne 0x4dfe29
test al, 0xa7
mov ch, 0x42
loop 0x4dfea3
xchg esp, eax
or ecx, dword [ebp + 0x4b]
xor eax, dword [ebp + 0x69b45fbf]
in eax, 0xc8
shr byte [eax + 0x664ebb3f], 1
retf
jb 0x4dfe47
outsb dx, byte [esi]
adc eax, 0xf664a173
adc bh, ah
inc esp
mov ebp, 0x2b4c332
and dh, byte [ecx]
retf 0x213b
add ah, byte [edx]
xor edx, ecx
cmp esp, dword [ecx]
int3

Function at 0x4e1420
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], 0
je 0x4e143b
cmp dword [ebp - 8], 0
jne 0x4e1445
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4e15a7
xor dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0xc], 8
jb 0x4e156c
Function at 0x569a20
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4ea17cb6
je 0x569a4f
ror byte [edi - 0x5c], 1
and dword [ebx + 0x20e2f110], ebp
invalid
inc ebx
xor byte [ecx], dh
out dx, al
adc dword cs:[edx], 0xc7714432
in al, 0x60
mov byte [0x7400c017], al
syscall
or dword [edi - 5], esi
scasd eax, dword es:[edi]
mov eax, dword [0x6eca598d]
cmp eax, 0xf2a0bcd0
push ebp
mov bl, 0x43
cmp bh, 0xf3
push edx
dec esi
sub eax, 0xa0dbf431
fld qword [esi + 0x1c]
inc ebx
invalid

Function at 0x60c0ac
Capabilities:
Encode data using xor

Disassembly:
jge 0x60c0e5
adc edi, dword [esi - 0x7b]
lahf
lcall 0xaab2, 0xde145a8e
xor dword [edi - 0x51753caf], ebp
mov eax, 0xd75dc062
jle 0x60c0b1
int 0x6d
das
fist dword [ecx]
pop esp
or byte [edx + 0xc], bh
dec edx
invalid
cmc
xchg byte [edi - 0x41a633f], bh
test dword [eax + 0x79], edx
pop ss
invalid

Function at 0x6597ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661418
cmp edx, dword [eax]
je 0x6597cf
add eax, 8
inc ecx
cmp eax, 0x6614a8
jl 0x6597c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661418]
jne 0x6598fd
mov eax, dword [0xa5bf78]
cmp eax, 1
je 0x6598d7
test eax, eax
jne 0x659800
cmp dword [0x661344], 1
je 0x6598d7
cmp edx, 0xfc
je 0x6598fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659837
lea eax, [ebp - 0x1a4]
push 0x65e978
push eax
call fcn.0065a190
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a620
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65987a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a620
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e974
push edi
call fcn.0065c4f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e958
push eax
call fcn.0065a190
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a1a0
lea eax, [ebp - 0xa0]
push 0x65e954
push eax
call fcn.0065a1a0
push dword [esi + 0x66141c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a1a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e92c
push eax
call fcn.0065c464
add esp, 0x2c
pop edi
jmp 0x6598fd
lea eax, [ebp + 8]
lea esi, [esi + 0x66141c]
push 0
push eax
push dword [esi]
call fcn.0065a620
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f008]
jne 0x40100a
repz ret
jmp fcn.004016f5

Function at 0x40496a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402d68
and dword [ebp - 4], 0
cmp dword [0x4209f0], 0
mov ebx, eax
jne 0x404a1b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x404acc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x404acc
push eax
call fcn.00402cf6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4209f0], eax
call esi
push eax
call fcn.00402cf6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4209f4], eax
call esi
push eax
call fcn.00402cf6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4209f8], eax
call esi
push eax
call fcn.00402cf6
pop ecx
mov dword [0x420a00], eax
test eax, eax
je 0x404a1b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402cf6
pop ecx
mov dword [0x4209fc], eax
mov eax, dword [0x4209fc]
cmp eax, ebx
je 0x404a73
cmp dword [0x420a00], ebx
je 0x404a73
push eax
call fcn.00402d71
push dword [0x420a00]
mov esi, eax
call fcn.00402d71
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x404a73
test edi, edi
je 0x404a73
call esi
test eax, eax
je 0x404a6a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x404a6a
test byte [ebp - 0xc], 1
jne 0x404a73
or dword [ebp + 0x10], 0x200000
jmp 0x404aac
mov eax, dword [0x4209f4]
cmp eax, ebx
je 0x404aac
push eax
call fcn.00402d71
pop ecx
test eax, eax
je 0x404aac
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x404aac
mov eax, dword [0x4209f8]
cmp eax, ebx
je 0x404aac
push eax
call fcn.00402d71
pop ecx
test eax, eax
je 0x404aac
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4209f0]
call fcn.00402d71
pop ecx
test eax, eax
je 0x404acc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x404ace
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41bd90
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x41f008]
xor eax, esp
mov dword [esp + 0x800], eax
cmp dword [0x80651c], 0x114e
mov eax, dword [esp + 0x808]
mov dword [0x806360], eax
jne 0x41bdd1
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
lea ecx, [esp + 4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.00401000
add esp, 0x804
ret
Function at 0x41beb0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc04
mov eax, dword [0x41f008]
xor eax, esp
mov dword [esp + 0xc00], eax
mov eax, dword [0x41fc60]
push ebx
mov ebx, dword [0x806364]
push esi
mov esi, dword [0x80651c]
push eax
call fcn.0041bd90
add esp, 4
cmp dword [0x80651c], 0x2f
jne 0x41beef
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push esi
call fcn.0041be00
add esp, 4
cmp dword [0x80651c], 0x568
pop esi
pop ebx
jne 0x41bf27
push 0
push 0
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
lea edx, [esp + 0x404]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov ecx, dword [esp + 0xc00]
xor ecx, esp
call fcn.00401000
add esp, 0xc04
ret