joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450258
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4503f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
push 0xc8
push edi
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 0xc]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 0xc]
mov edx, 0x450408
call fcn.00403ecc
jne 0x4503c9
xor ebx, ebx
push 0
push 0x450414
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4503c9
push 0
push 0x450424
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
je 0x4503c9
push 0
push 0x450430
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov dword [ebp - 8], eax
push 0
push 0x45043c
mov eax, dword [ebp - 8]
push eax
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
cmp dword [ebp - 8], 0
jle 0x4503c9
test ebx, ebx
jle 0x4503c9
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x45044c
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428700
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x45045c
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
mov eax, edi
call fcn.00402714
mov eax, esi
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4503f9
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00403b60
ret

Function at 0x450530
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x4505b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00407d7c
mov edx, dword [ebp - 4]
mov eax, 0x4505d0
call fcn.004040a8
dec eax
jle 0x450597
push 0
push 0
push 0x10
push esi
call sub.user32.dll_PostMessageA
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4505c0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret
Function at 0x4505d4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x450756
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
push 0x450764
push 0x450774
call sub.user32.dll_FindWindowA
mov esi, eax
test esi, esi
je 0x450734
push 0
push 0x45077c
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
test edi, edi
je 0x45063c
push 0
push 0x450788
push edi
push esi
call sub.user32.dll_FindWindowExA
mov dword [ebp - 4], eax
mov esi, ebx
push esi
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x450798
call fcn.00403e08
mov edx, dword [ebp - 8]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428700
mov eax, dword [0x455d40]
mov eax, dword [eax]
mov edx, 0x4507ac
call fcn.00403ecc
jne 0x4506d0
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x4507b8
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
jmp 0x450734
push 0
push 0
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x1c]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4507b8
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45075d
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00403b60
ret
Function at 0x45091c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x450924
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450b4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov edi, eax
mov eax, 0xc8
call fcn.004026fc
mov esi, eax
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
push 0xc8
push edi
push ebx
call sub.user32.dll_GetClassNameA
lea eax, [ebp - 8]
mov edx, edi
call fcn.00403cf4
mov eax, dword [ebp - 8]
mov edx, 0x450b64
call fcn.00403ecc
jne 0x450b24
xor eax, eax
push 0x450b6c
push 0x450b78
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x450b24
push 0x450b80
push 0x450b78
push eax
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
je 0x450b24
push 0
push 0x450b8c
push 0
push ebx
call sub.user32.dll_FindWindowExA
test eax, eax
jle 0x450a5e
push esi
push 0xc8
push 0xd
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00403cf4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00450e30
test al, al
je 0x450a2b
lea eax, [ebp - 0x14]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov edx, 0x450ba0
call fcn.00403e08
mov edx, dword [ebp - 0x10]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428700
jmp 0x450a5e
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov edx, 0x450ba0
call fcn.00428700
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
mov edx, 0x450bb0
call fcn.00428700
jmp 0x450b24
push 0
push 0x450bb8
push 0
push ebx
call sub.user32.dll_FindWindowExA
mov ebx, eax
test ebx, ebx
jle 0x450b24
mov eax, dword [0x455d40]
mov eax, dword [eax]
mov edx, 0x450bc8
call fcn.00403ecc
jne 0x450ac9
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x1c]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x450bb0
call fcn.00403e08
mov edx, dword [ebp - 0x18]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
jmp 0x450b24
push 0
push 0
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
push esi
push 0xc8
push 0xd
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push ebx
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x24]
mov edx, esi
call fcn.00403cf4
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x450bb0
call fcn.00403e08
mov edx, dword [ebp - 0x20]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
mov eax, edi
call fcn.00402714
mov eax, esi
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450b54
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.00403b60
ret
Function at 0x450bcc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450dca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xc8
call fcn.004026fc
mov ebx, eax
call sub.user32.dll_GetForegroundWindow
mov esi, eax
push 0xc8
push ebx
push esi
call sub.user32.dll_GetWindowTextA
push 0
push 0x450dd8
push 0
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test esi, esi
je 0x450da8
push 0x450de0
push 0x450df4
push 0
push esi
call sub.user32.dll_FindWindowExA
test eax, eax
jle 0x450da8
push 0
push 0x450dfc
push 0
push esi
call sub.user32.dll_FindWindowExA
mov edi, eax
push 0
push 0x450dfc
push edi
push esi
call sub.user32.dll_FindWindowExA
mov esi, eax
test edi, edi
je 0x450da8
test esi, esi
je 0x450da8
push ebx
push 0xc8
push 0xd
push edi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403cf4
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00450e30
test al, al
je 0x450cc8
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x450e0c
call fcn.00403e08
mov edx, dword [ebp - 0xc]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
call fcn.00428700
jmp 0x450cfb
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d0]
mov edx, 0x450e0c
call fcn.00428700
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
mov edx, 0x450e1c
call fcn.00428700
jmp 0x450da8
mov eax, dword [0x455d40]
mov eax, dword [eax]
mov edx, 0x450e2c
call fcn.00403ecc
jne 0x450d4d
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x450e1c
call fcn.00403e08
mov edx, dword [ebp - 0x14]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
jmp 0x450da8
push 0
push 0
push 0xcc
push esi
call sub.user32.dll_PostMessageA
push ebx
push 0xc8
push 0xd
push esi
call sub.user32.dll_SendMessageA
push 0
push 0x2a
push 0xcc
push esi
call sub.user32.dll_PostMessageA
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00403cf4
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x450e1c
call fcn.00403e08
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x455f00]
mov eax, dword [eax]
mov eax, dword [eax + 0x2d4]
call fcn.00428700
mov eax, ebx
call fcn.00402714
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450dd1
lea eax, [ebp - 0x20]
mov edx, 7
call fcn.00403b60
ret
Function at 0x451440
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451527
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4514f1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, dword [ebp - 4]
call fcn.00403b3c
push 0x65
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x6d]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
jne 0x4514b3
pop dword fs:[0]
add esp, 8
jmp 0x451506
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x4514db
push dword [edi]
call sub.wsock32.dll_inet_ntoa
lea edx, [ebp - 0x204]
call fcn.004085f0
mov edx, dword [ebp - 0x204]
lea eax, [ebp - 8]
call fcn.00403dc4
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x4514ba
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4514fb
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00403b90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45152e
lea eax, [ebp - 0x204]
call fcn.00403b3c
lea eax, [ebp - 8]
call fcn.00403b3c
ret

Function at 0x452644
Capabilities:
Terminate process

Disassembly:
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
test eax, eax
je 0x45265a
push 0
push eax
call sub.KERNEL32.DLL_TerminateProcess
ret
Function at 0x4540e4
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f70
xor eax, eax
push ebp
push 0x45425e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x449fa8]
call fcn.00402e00
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00403bd4
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00449ffc
mov eax, dword [ebp - 0x14c]
mov edx, 0x454274
call fcn.00403ecc
je 0x45418e
push dword [ebp - 4]
push 0x454274
push 0x454280
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e7c
lea eax, [ebp - 8]
mov ecx, 0x454274
mov edx, dword [ebp - 4]
call fcn.00403e08
jmp 0x45419b
lea eax, [ebp - 4]
mov edx, 0x454280
call fcn.00403dc4
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.00403f80
push eax
call sub.KERNEL32.DLL_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x454233
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x4541cd
add eax, 0xffffffe8
sub eax, 8
jae 0x45421c
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x45421c
lea eax, [ebp - 0x11c]
cmp eax, 0x454284
je 0x45421c
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00403d6c
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.00403e08
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x4541b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454265
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.00403b60
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret

Function at 0x454288
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x4542fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x43
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00403ce4
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, 0x454314
call fcn.00403e08
mov eax, dword [ebp - 4]
call fcn.00403f80
push eax
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 3
jne 0x4542dd
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.004540e4
inc ebx
cmp ebx, 0x57
jne 0x4542a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454305
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403b60
ret
Function at 0x444bfd
Capabilities:
Encode data using xor

Disassembly:
xchg byte [esi - 0xc], al
xor eax, 0x87a33a4f
pop ecx
mov ah, 0xe5
pop es
shl dword [ecx - 0x72730105], 0x27
leave
or esp, esi
sal dword [esi - 0x6f], 0x72
cmp dl, byte [0xf2f4b74a]
loope 0x444b76
scasb al, byte es:[edi]
call dword [edi]
or dword [ebp - 0x80], 0x44d96ad7
call [ebp + ecx*4 + 0x21]
fld dword [edi + edi*8 + 0x5c]
lea esp, [ecx]
pop eax
bound edi, qword [esi - 0x5c]
in al, 0x5f
adc dh, byte [ebx]
ja 0x444bb8
cmpsb byte [esi], byte es:[edi]
xor eax, 0x3f8cffc5
and dword [0xb600882], 0x8cf45696
jb 0x444bbc
pushal
or edx, dword [esi + 0x728cf456]
cld
hlt
dec ebp
popfd
jl 0x444c1a
lds ebp, [ebp + 0x24987ccc]
or ebx, ebp
cmp ecx, dword [esi]
jl 0x444c1c
popal
and eax, dword [edi]
sbb al, 0x4c
xor eax, 0x53314db0
rcr dword [ebp + 0x2b], cl
sbb byte [ecx - 0x34111f72], 0xb9
loop 0x444b73
fild word [ebx - 0x54bbc592]
mov bl, 0xf9
mov esp, 0xa1902473
mov byte [0xe007b0ea], al
dec edx
stosd dword es:[edi], eax
das
push edx
int1
aad 0x9e
lea ebp, [esi + ecx*4 + 0x18]
jo 0x444b9e
je 0x444c29
das
dec edi
mov bh, 0x60
adc dword [ebx + ebp*8], edx
add dl, byte [ecx + 0x583a000f]
pop ecx
xchg dword [esi + 0x7b], eax
adc esp, dword [ecx]
mov esp, 0x99e03dcf
clc
and dword [edi + ecx*8 - 0x7661fc3], edi
iretd
xchg esi, eax
jmp 0x89f5c94e
mov esp, dword [edx + 0x63]
out 0x6d, eax
mov edi, 0xcd385776
aam 0x7e
stc
sub eax, 0xa6d9dd26
fstp st(1)
cmpsb byte [esi], byte es:[edi]
inc ebp
jp 0x444c37
invalid

Function at 0x46dce0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
movsb byte es:[edi], byte [esi]
lodsb al, byte [esi]
invalid
dec edx
push ebx
les ebx, [edx + esi*2 - 0x7da35483]
fild dword [ebp - 0x32effb27]
adc ah, al
nop
jb 0x46dc89
test byte [eax + ebx*4], ah
nop
or byte [esi*2 + 0x692ebc17], cl
leave
nop
mov esp, dword [edx - 0x46]
mov al, 0x79
jo 0x46dcda
dec edx
cld
push edx
invalid
xor byte [eax - 0x34884b87], bl
out dx, eax
lodsb al, byte [esi]
jo 0x46dce4
test eax, 0xa9d2a372
jae 0x46dca7
adc al, 0x80
jbe 0x46dd65
push 0xffffffffffffffc9
ret
invalid
daa
pop edx
and esi, esi
out dx, al
out dx, eax
fcmovb st(0), st(0)
xor ch, byte [edi - 0x4b]
dec ebp
loopne 0x46dd02
xor ebx, dword [ebp + 0x55]
add dword [ebx - 0x28], 0x3c2969aa
jmp 0x46dd90
xchg esp, eax
sal byte [esi + edi - 0x14be9cfb], 0xec
and dl, dl
fdivr dword [edi + 0x793a24f2]
sbb esp, dword [ebx]
cmp dword [esi + 0x2d02548f], esp
invalid

Function at 0x4a365a
Capabilities:
Accept command line arguments
Check for time delay via gettickcount

Disassembly:
push cs
mov byte [0x4956eba8], al
pop ecx
inc esp
xor byte [esi], bh
jbe 0x4a36b7
out dx, al
cmp byte [edi - 0x2c], bh
invalid
Function at 0x628da5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632378
cmp edx, dword [eax]
je 0x628dc7
add eax, 8
inc ecx
cmp eax, 0x632408
or byte [ebx], ah
invalid
jl 0x628db8
push esi
Function at 0x40c340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040c357

Function at 0x40f640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.0040f657

Function at 0x435160
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xb4
mov edi, dword [ebp + 0xc]
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x1e
push 0x6bf6d0
call fcn.004f2450
add esp, 8
cmp eax, 2
jl 0x4351c3
lea esi, [ebp - 0xb0]
mov ecx, esi
push 0xfffffffffffffffe
push 0xb8
push 0x6bf6d0
call fcn.00494bc0
lea eax, [ebp - 0xa8]
push 0x10
push 0x6bf81d
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, esi
call fcn.004950a0
mov ebx, dword [ebp + 8]
pcmpeqd xmm0, xmm0
lea esi, [ebp - 0xb0]
movdqu xmmword [esi], xmm0
push edi
push esi
call fcn.00582670
add esp, 8
cmp byte [esi + 0xc], 1
jne 0x4351f1
push esi
call fcn.0048f560
add esp, 4
test al, al
jne 0x435231
mov dword [ebx], 0
cmp byte [ebp - 0xa4], 1
jne 0x43520b
lea ecx, [ebp - 0xb0]
call fcn.004f2fc0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xb4
pop esi
pop edi
pop ebx
pop ebp
ret
push 0
call fcn.00424180
add esp, 4
jmp 0x4352d2
push 0x2c
call fcn.00540349
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.004a1680
test edi, edi
je 0x43524b
inc dword [edi + 4]
push edi
call fcn.0049f1e0
add esp, 4
lea ecx, [ebp - 0xb3]
mov byte [ecx + 2], 9
mov edx, 0x6bf728
lea eax, [ebp - 0xbc]
cmp eax, edx
seta bl
cmp ecx, edx
setbe cl
or cl, bl
je 0x4353a7
mov dword [ebp - 0xb8], 0x65696669
mov dword [ebp - 0xbc], 0x6c617571
mov word [ebp - 0xb4], 0x64
xor edx, edx
mov ecx, edi
push edx
push edx
push eax
call fcn.004a16a0
cmp byte [ebp - 0xb1], 0
jns 0x4352bb
push dword [ebp - 0xbc]
call fcn.00540380
add esp, 4
test edi, edi
je 0x435222
inc dword [edi + 4]
push edi
call fcn.00424180
add esp, 4
inc dword [edi + 4]
mov dword [ebp - 0xc0], 0xffffffff
cmp byte [ebp - 0xa4], 0
je 0x435398
lea ebx, [ebp - 0xc0]
lea edx, [ebp - 0xb0]
mov ecx, ebx
push 0x6bf7d0
push edi
call fcn.00434e40
add esp, 8
mov esi, dword [ebx]
test esi, esi
je 0x435364
cmp byte [ebp - 0xa4], 0
je 0x435398
push 0x30
call fcn.00540349
add esp, 4
mov ebx, eax
mov dword [ebp - 0xbc], esi
xor eax, eax
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0xbc]
mov ecx, ebx
push 1
push edx
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.00434120
test ebx, ebx
je 0x435366
mov eax, dword [ebx + 4]
mov eax, dword [eax + 4]
xor ecx, ecx
inc ecx
lock xadd dword [ebx + eax + 8], ecx
cmp ecx, 0x7fffffff
jne 0x435366
jmp 0x4353ae
xor ebx, ebx
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ebx, eax
test edi, edi
je 0x4351f7
dec dword [edi + 4]
jne 0x4351f7
mov eax, dword [edi]
mov ebx, dword [eax]
mov ecx, ebx
call dword [0x73c768]
mov ecx, edi
push 1
call ebx
mov ebx, dword [ebp + 8]
jmp 0x4351f7
push 0x6bd975
push 0x6bd0bf
call fcn.0057cbd0
push 0x6bd32f
jmp 0x43539d
int3
Function at 0x4706f0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xa0
mov eax, dword [0x742040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x2d
push 0x6c33b0
call fcn.004f2450
add esp, 8
test eax, eax
jle 0x47074f
lea esi, [ebp - 0xac]
mov ecx, esi
push 0xffffffffffffffff
push 0x274
push 0x6c33b0
call fcn.00494bc0
lea eax, [ebp - 0xa4]
push 0x1a
push 0x6c3c50
push eax
call fcn.004d1fe0
add esp, 0xc
mov ecx, esi
call fcn.004950a0
push 0x60
call fcn.00540349
add esp, 4
mov esi, eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa4], 0x80000030
mov dword [ebp - 0xa8], 0x2d
add eax, 0x5a
mov ecx, 0x6c1dd2
cmp esi, ecx
seta dl
cmp eax, ecx
setbe al
or al, dl
je 0x4707e8
mov edi, dword [ebp + 8]
push 0x5a
push 0x6c1dd2
push esi
call fcn.00543ce0
add esp, 0xc
mov word [esi + 0x5a], 0
lea esi, [ebp - 0xac]
push edi
push 0
push esi
push SysReAllocStringLen
call fcn.0059eb00
add esp, 0x10
mov ebx, eax
cmp byte [esi + 0xb], 0
jns 0x4707d1
push dword [ebp - 0xac]
call fcn.00540380
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005412b6
mov eax, ebx
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x6bebbc
push 0x6bd0bf
call fcn.0057cbd0
int3

Function at 0x473be0
Capabilities:
Self delete

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.00472a70