joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6851b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00685140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00685140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00685140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00685140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x685bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x685c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x69787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x685c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x685c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x405b50
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x405bc0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405c27
xor ecx, ecx
xor edx, edx
jmp 0x405c09
cmp ax, 0x5c
jne 0x405c98
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x405c27
cmp ax, 9
je 0x405c15
cmp ax, 0x20
jne 0x405bf0
test ecx, ecx
je 0x405c83
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x405c09
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x405cb8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404470
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405c80
cmp ax, 0x20
je 0x405c80
jmp 0x405c27
cmp ax, 0x22
jne 0x405c19
and edx, 1
jne 0x405c19
xor ecx, 1
jmp 0x405bfd
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x405c40
Function at 0x405bc0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x405bc0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x405c27
xor ecx, ecx
xor edx, edx
jmp 0x405c09
cmp ax, 0x5c
jne 0x405c98
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x405c27
cmp ax, 9
je 0x405c15
cmp ax, 0x20
jne 0x405bf0
test ecx, ecx
je 0x405c83
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x405c09
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x405cb8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404470
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x405c80
cmp ax, 0x20
je 0x405c80
jmp 0x405c27
cmp ax, 0x22
jne 0x405c19
and edx, 1
jne 0x405c19
xor ecx, 1
jmp 0x405bfd
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x405c40
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x771e7c34
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x7dfd31a2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x25f8224
Capabilities:
Encode data using xor

Disassembly:
jmp 0x25f822e
pushal
call 0x25f8234
pop ebp
sub ebp, 0x10
sub ebp, 0x21f8224
jmp 0x25f824a
mov eax, 0x21f8224
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c9
mov edx, 0xa01933aa
xor byte [eax], dl
inc eax
dec ecx
jne 0x25f8261
jmp 0x25f8274
and dword [edi + 0x21], esp
and edx, dword [esi + 0x2baaaaaa]
imul edx, dword [edx - 0x56], 0xffffffaa
stosb byte es:[edi], al
test eax, 0xaaae1267
stosb byte es:[edi], al
stosb byte es:[edi], al
adc byte [edx + 0x5daaaaaa], al
dec eax
test eax, 0xa62b2162
stosb byte es:[edi], al
stosb byte es:[edi], al
stosb byte es:[edi], al
test eax, 0x8ece276f
push esi
and ebp, dword [esi - 0x7131d872]
push esi
and ebp, dword [esi + 0x26c2c28e]
std
stosb byte es:[edi], al
ret 0x5f16
Function at 0x70d823a0
Capabilities:
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x3c
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x70d95018], 8
jne 0x70d82428
test ebx, ebx
je 0x70d824e3
test esi, esi
jne 0x70d82460
mov eax, dword [ebx + 8]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteObject]
mov eax, dword [ebx + 4]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_DeleteDC]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
xor eax, eax
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__d__n
mov dword [esp + 8], str.EndBufferedPaint
mov dword [esp + 4], 0x70d95018
mov dword [esp], 3
call fcn.70d81e60
jmp 0x70d823c1
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x10]
mov dword [esp + 0x20], 0xcc0020
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
mov ecx, dword [ebx + 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebx + 0x18]
sub ecx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [ebx + 0x14]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
sub ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.gdi32.dll_BitBlt]
sub esp, 0x24
test eax, eax
jne 0x70d823d1
test byte [0x70d95018], 4
je 0x70d823d1
mov dword [esp + 0xc], str.BitBlt___failed_n
mov dword [esp + 8], str.EndBufferedPaint
mov dword [esp + 4], 0x70d95018
mov dword [esp], 2
call fcn.70d81e60
jmp 0x70d823d1
mov eax, 0x80070057
jmp 0x70d82415
Function at 0x70d8d640
Capabilities:
Get process heap flags

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x70d8d653
lock sub dword [eax], 1
jne 0x70d8d653
jmp fcn.70d8bb20
ret
Function at 0x70d904f0
Capabilities:
Set registry value

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0xec
lea eax, [esp + 0x44]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0xf003f
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Control_PanelColors
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegCreateKeyExW]
sub esp, 0x24
test eax, eax
jne 0x70d905e8
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExW]
lea ebx, [esp + 0x4a]
mov ebp, eax
lea esi, [esi]
mov eax, dword [esi + ebp*4]
mov dword [esp + 8], str._d__d__d
mov dword [esp + 4], 0xd
mov dword [esp], ebx
mov ecx, eax
shr ecx, 0x10
movzx ecx, cl
mov dword [esp + 0x14], ecx
movzx ecx, ah
movzx eax, al
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
call fcn.70d904a0
mov dword [esp + 0x10], ebx
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp*4 + 0x70dac220]
add ebp, 1
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call edi
sub esp, 0x18
cmp ebp, 0x1f
jne 0x70d90568
mov eax, dword [esp + 0x44]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x70d90629
lea ecx, [esp + 0x64]
mov eax, 1
mov dword [ecx], 0
nop
mov dword [ecx + eax*4], eax
lea edx, [eax + 1]
add eax, 2
mov dword [ecx + edx*4], edx
cmp eax, 0x1f
jne 0x70d90600
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
mov dword [esp], 0x1f
call dword [sym.imp.user32.dll_SetSysColors]
sub esp, 0xc
mov ebp, dword [sym.imp.user32.dll_SetThreadDpiAwarenessContext]
mov dword [esp], 0xffffffff
call ebp
mov ebx, dword [sym.imp.user32.dll_SystemParametersInfoW]
sub esp, 4
mov edi, eax
lea eax, [esi + 0x7c]
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x1f8
mov dword [esp], 0x2a
call ebx
lea eax, [esi + 0x274]
sub esp, 0x10
mov dword [esp + 0xc], 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5c
mov dword [esp], 0x22
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 1
mov eax, dword [esi + 0x2d0]
mov dword [esp + 4], 0
mov dword [esp], 0x1009
mov dword [esp + 8], eax
call ebx
sub esp, 0x10
mov dword [esp + 0xc], 3
mov eax, dword [esi + 0x2d4]
mov dword [esp + 4], 0
mov dword [esp], 0x1023
mov dword [esp + 8], eax
call ebx
sub esp, 0x10
mov dword [esp], edi
call ebp
sub esp, 4
add esp, 0xec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x70d91ce0
Capabilities:
Enumerate gui resources
Set registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x30
mov ebx, dword [ecx]
test byte [0x70d9508c], 8
jne 0x70d91d20
mov eax, dword [0x70dae348]
test eax, eax
je 0x70d91d0a
test ebx, ebx
je 0x70d91d50
lea esp, [ebp - 8]
xor eax, eax
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__n
mov dword [esp + 8], str.EnableTheming
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d91cfd
mov dword [0x70dae348], 0
lea eax, [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionThemeManager
mov dword [esp], 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
test eax, eax
je 0x70d91da8
mov dword [esp + 4], 0x31a
mov dword [esp], 0x70d90050
call dword [sym.imp.user32.dll_EnumWindows]
xor eax, eax
sub esp, 8
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 4
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], 0x70dabb2a
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.ThemeActive
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov eax, dword [ebp - 0xc]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x70d91d7d

Function at 0x70d9274a
Capabilities:
Enumerate gui resources

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x20
mov ebx, dword [ecx]
mov eax, dword [ecx + 4]
mov edx, dword [ecx + 8]
test byte [0x70d9508c], 8
jne 0x70d92798
mov dword [esp], ebx
call fcn.70d90a20
mov dword [esp + 4], 0x31a
mov ebx, eax
mov dword [esp], 0x70d90050
call dword [sym.imp.user32.dll_EnumWindows]
mov eax, ebx
sub esp, 8
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret 0xc
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__s__p__n
mov dword [esp + 8], str.ApplyTheme
mov dword [esp + 4], 0x70d9508c
mov dword [esp], 3
call fcn.70d90750
jmp 0x70d92763
Function at 0x70d93690
Capabilities:
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [esp + 0x50]
mov ebp, dword [esp + 0x54]
test byte [0x70d9509c], 8
jne 0x70d93750
mov dword [esp + 8], str.TEXTFILE
mov dword [esp + 4], ebp
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x70d93788
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x70d93790
movd xmm0, ebx
mov dword [esp + 4], esi
punpckldq xmm0, xmm0
mov dword [esp], edi
movq qword [esp + 0x28], xmm0
call dword [sym.imp.kernel32.dll_SizeofResource]
sub esp, 8
mov esi, eax
mov dword [esp + 8], 0xc
and esi, 0xfffffffe
mov dword [esp + 4], 0
add ebx, esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov dword [eax + 8], ebx
movq xmm0, qword [esp + 0x28]
movq qword [eax], xmm0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebp
call fcn.70d93250
mov dword [esp + 0xc], str.Loading_resource_INI__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x70dac38c
mov dword [esp + 4], 0x70d9509c
mov dword [esp], 3
call fcn.70d934f0
jmp 0x70d936ac
xor ebx, ebx
jmp 0x70d936e8
test byte [0x70d9509c], 8
jne 0x70d937a0
xor eax, eax
jmp 0x70d93742
mov eax, ebp
call fcn.70d93250
mov dword [esp + 0xc], str._s_resource_not_found_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0x70dac38c
mov dword [esp + 4], 0x70d9509c
mov dword [esp], 3
call fcn.70d934f0
xor eax, eax
jmp 0x70d93742

Function at 0x70d937e0
Capabilities:
Get process heap flags

Disassembly:
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
add esp, 0x1c
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x67b31aa0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x66872ac9
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x410288
Capabilities:
Encode data using xor

Disassembly:
clc
dec eax
daa
inc ebp
adc al, 0xbf
iretd
in eax, dx
insb byte es:[edi], dx
sub eax, 0x79155086
jns 0x410269
js 0x410293
jns 0x410269
js 0x410293
push esi
cld
jns 0x4102c3
dec edi
movsd dword es:[edi], dword [esi]
sbb byte ds:[ebp - 0xd1f3ed4], ah
sbb byte [ebp - 0xd1f3ed4], ah
xor dword [ebp + 0x49], 0xe7a58829
cmp ebx, dword [ebx]
sub ebx, dword [edi]
out 0x3b, eax
sbb ebp, dword [ebx]
pop ds
inc esp
psubusw mm0, mm7
pop es
adc dh, ah
and ecx, ebp
xor byte [edx + 7], al
adc al, 0xd0
movd mm6, ebp
pop esi
neg dword [edi + 0x1f4fdea1]
sub ecx, esi
jg 0x41029f
js 0x41030e
lodsb al, byte [esi]
push eax
cmp ebx, ebp
ror byte [eax - 0x4a], cl
jno 0x410282
aaa
or al, 0xff
dec ebp
pushfd
xchg ebx, eax
or byte [eax + ebp + 0x13848d99], ch
int1
mov eax, 0x253eeb2b
sub byte [edi], bh
std
cdq
das
cmpsb byte [esi], byte es:[edi]
int1
inc esp
dec esi
mov dword [esi], edx
add al, 0x7e
aaa
aad 0x67
outsb dx, byte [esi]
sub al, 0xaa
test eax, 0x88af0c51
lahf
into
jne 0x4102f3
push ecx
or al, 0xaf
mov byte [edi + 0x5bf875ce], bl
pop ebx
daa
stosd dword es:[edi], eax
dec byte [ebp + 0x47]
and byte [ebp + 0x6611f460], ah
test byte [edi - 2], cl
insd dword es:[edi], dx
test eax, 0xc6fc1610
stosb byte es:[edi], al
push es
jecxz 0x41037e
push ss
cld
invalid
mov eax, 0xc0ae10d
pop esi
jmp 0x41032a
iretd
nop
test eax, 0xaee64676
scasb al, byte es:[edi]
imul edx, edx, 0x5a792188
jns 0x4102da
mov eax, es
wait
fcmovbe st(0), st(0)
pop edi
int 0xba
call 0x9107c00
pop ss
pop edx
loop 0x4103ce
lahf
mov al, 0xa5
pop es
scasd eax, dword es:[edi]
iretd
pop edi
salc
clc
invalid
out 8, eax
push edi
push ecx
jbe 0x410348
mov byte [esi - 0x1e], ah
imul edx, dword [edi], 0x5c7f0651
mov bh, 0xcd
fisttp word [edi]
wait
dec eax
loop 0x41034d
in al, 0x88
mov bh, 0xaa
movsb byte es:[edi], byte [esi]
sbb ecx, ebx
frstor dword [edx - 0x25af2623]
and byte [ecx], ch
ret
lahf
fidivr dword [ecx - 0x234c0b3f]
sbb dh, dl
cmc
aam 0x8f
push ds
pop esi
adc al, 0xef
sbb byte [eax + ebx*8], cl
inc edx
jecxz 0x410417
adc al, 0x61
adc edi, ebp
cmc
jecxz 0x410379
jmp [ebx + esi]
dec edi
pop eax
mov edi, 0xc3feafa8
lcall 0xe389, 0x6174a3d8
sbb edx, ecx
lds esp, [ebx + 0x21]
rol dword [edi - 0x4e], 1
ret
or dword [ebx + 0x20ec0ffe], ebp
xor al, 0xf4
mov esp, 0xd6e3df09
xchg edi, eax
sahf
pop es
ficom dword [ecx]
inc ecx
in eax, dx
add al, 8
enter 0xffffffffffffba5b, 0xffffffffffffffe8
dec edi
or byte [ebp - 0x4056fd65], ch
nop
pop edx
jmp 0x4103ee
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x537f48
Capabilities:
Encode data using xor

Disassembly:
test byte [ebp - 0x45], al
sti
push edx
cmp byte [eax + 0x18], dh
salc
cmp al, 6
invalid
psrlw mm2, qword [ecx - 0x451b982c]
inc edx
or byte [ecx + 0x505e4dba], ch
dec ebx
clc
add dword [ebp + 0x6c806183], edx
out dx, al
jo 0x537fc0
and dword [edi], edx
xchg byte [edx - 0x54], al
arpl word [edx], sp
jl 0x537f17
invalid
inc eax
sti
fsubp st(1)
jg 0x537f63
xchg ebx, eax
mov esp, 0x8fe1bec7
mov ebp, dword [ebx + 0x20b45fa3]
xor edx, dword [edi + eax]
mov al, byte [0x1a062637]
add eax, 0x58e382bb
ljmp 0x8d32

Function at 0x578576
Capabilities:
Encode data using xor

Disassembly:
mov ebp, eax
xor dh, byte [ebp - 0x6671e05b]
rcr ebp, 0x16
test byte [esi - 0x77], ah
sub al, 0xa1
or byte [ebx], cl
sar byte [ebx], cl
shl byte es:[ebp + 0x32], cl
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x715712b0
nop
nop
nop
test eax, eax
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x42f314
nop
mov ecx, 0x5f7f1839
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219