joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8f90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp + 0xc]
push 8
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
mov dword [ebp - 0x444], ecx
mov dword [eax], 0
mov dword [ecx], 0
lea ecx, [ebp - 0x428]
push 0x80000002
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
call fcn.004a72a0
mov esi, dword [ebp - 0x428]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4a9018
xor esi, esi
jmp 0x4a91bb
push edi
xor edi, edi
jmp 0x4a9020
lea eax, [ebp - 0x44c]
mov dword [ebp - 0x418], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4a91b5
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x41c]
push eax
push 1
push 0
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x430], 0
test eax, eax
jne 0x4a9144
mov esi, dword [ebp - 0x41c]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x434], esi
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x41c], 0x208
push eax
push 0
push str.NetCfgInstanceId
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a912d
mov eax, dword [ebp - 0x438]
cmp eax, 1
je 0x4a90e5
cmp eax, 2
jne 0x4a912d
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x4a9105
test cl, 1
jne 0x4a912d
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x4a910e
jmp 0x4a912d
xor eax, eax
mov word [ebp - 0x20c], ax
push dword [ebp - 0x43c]
lea eax, [ebp - 0x20c]
shr ecx, 1
push eax
mov dword [ebp - 0x418], ecx
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4a9153
test esi, esi
je 0x4a913e
push esi
call ebx
mov dword [ebp - 0x434], 0
mov esi, dword [ebp - 0x428]
inc edi
cmp edi, 0x100
jl 0x4a9020
jmp 0x4a91b5
lea eax, [ebp - 0x418]
mov dword [ebp - 0x418], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push str.BusType
lea ecx, [ebp - 0x434]
call fcn.004a9440
test eax, eax
jne 0x4a91ae
lea eax, [ebp - 0x20c]
push eax
call fcn.004cb3c4
add esp, 4
cmp eax, 5
jne 0x4a91ae
mov eax, dword [ebp - 0x440]
push dword [ebp - 0x444]
push esi
mov dword [eax], 1
call fcn.004a9240
add esp, 8
test esi, esi
je 0x4a91b5
push esi
call ebx
mov esi, 1
pop edi
mov eax, dword [ebp - 0x428]
test eax, eax
je 0x4a91c8
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1e09
mov esp, ebp
pop ebp
ret
Function at 0x4a9240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x536364]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.DriverDesc
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x4a92c6
mov eax, dword [ebp - 0x214]
cmp eax, 1
je 0x4a92a3
cmp eax, 2
jne 0x4a92c6
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4a9370
test al, 1
jne 0x4a92c6
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x4a9379
cmp dword [edi], 0
jne 0x4a93d5
push 1
push str.NDIInterfaces
push esi
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x218], 0
call fcn.004a72a0
mov esi, dword [ebp - 0x220]
test eax, eax
jne 0x4a93ca
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.LowerRange
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a93ca
mov eax, dword [ebp - 0x214]
cmp eax, 1
je 0x4a9353
cmp eax, 2
jne 0x4a93ca
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x4a9397
test al, 1
jne 0x4a93ca
shr eax, 1
cmp word [ebp + eax*2 - 0x20e], 0
je 0x4a93a0
jmp 0x4a93ca
xor eax, eax
mov word [ebp - 0x20c], ax
push str.Wireless
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
je 0x4a92c6
mov dword [edi], 1
jmp 0x4a93d5
xor eax, eax
mov word [ebp - 0x20c], ax
push str.wlan
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
jne 0x4a93c4
push str.vwifi
lea eax, [ebp - 0x20c]
push eax
call ebx
test eax, eax
je 0x4a93ca
mov dword [edi], 1
test esi, esi
je 0x4a93d5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a1e09
mov esp, ebp
pop ebp
ret

Function at 0x4a9440
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], 0
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a94b1
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x4a947f
cmp eax, 2
jne 0x4a949b
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x4a94ab
test ecx, ecx
je 0x4a94a6
test cl, 1
jne 0x4a949b
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], 0
je 0x4a94ab
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4abc9e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x4e2c4b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e2aca

Function at 0x4e41e8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e3b56

Function at 0x4e41f3
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004e3d91
Function at 0x45f7e1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00455bb8
and dword [ebp - 4], 0
cmp dword [0x493288], 0
mov ebx, eax
jne 0x45f892
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45f943
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x473330
push edi
call esi
test eax, eax
je 0x45f943
push eax
call fcn.00455b46
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x493288], eax
call esi
push eax
call fcn.00455b46
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x49328c], eax
call esi
push eax
call fcn.00455b46
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x493290], eax
call esi
push eax
call fcn.00455b46
pop ecx
mov dword [0x493298], eax
test eax, eax
je 0x45f892
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00455b46
pop ecx
mov dword [0x493294], eax
mov eax, dword [0x493294]
cmp eax, ebx
je 0x45f8ea
cmp dword [0x493298], ebx
je 0x45f8ea
push eax
call fcn.00455bc1
push dword [0x493298]
mov esi, eax
call fcn.00455bc1
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45f8ea
test edi, edi
je 0x45f8ea
call esi
test eax, eax
je 0x45f8e1
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45f8e1
test byte [ebp - 0xc], 1
jne 0x45f8ea
or dword [ebp + 0x10], 0x200000
jmp 0x45f923
mov eax, dword [0x49328c]
cmp eax, ebx
je 0x45f923
push eax
call fcn.00455bc1
pop ecx
test eax, eax
je 0x45f923
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45f923
mov eax, dword [0x493290]
cmp eax, ebx
je 0x45f923
push eax
call fcn.00455bc1
pop ecx
test eax, eax
je 0x45f923
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x493288]
call fcn.00455bc1
pop ecx
test eax, eax
je 0x45f943
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45f945
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x7701340a
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1a370036
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1096f340
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x1096f346
pop ebp
sub ebp, 6
sub ebp, 0x96f340
jmp 0x1096f3a4
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1096f3bb
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1096f3c4
mov eax, 0x96f340
add eax, ebp
add eax, 0xaa
mov ecx, 0x5bd
mov edx, 0xd0f34f5c
xor byte [eax], dl
inc eax
dec ecx
jne 0x1096f3db
jmp 0x1096f3ee
xlatb
xchg ecx, eax
xlatb
aad 0x60
pop esp
pop esp
pop esp
fstp qword [ebp + 0x5c5c5ca4]
pop edi
xchg ecx, eax
in al, 0x5a
pop esp
pop esp
pop esp
out 0x74, al
pop esp
pop esp
pop esp
stosd dword es:[edi], eax
mov esi, 0xddd7945f
push eax
pop esp
pop esp
pop esp
pop edi
cdq
or al, 0xc
xor al, 0xd8
inc eax
push edx
pop esp
xor al, 0xe7
mov dl, ah
pop esp
pop ebp
jo 0x1096f49b
xor al, 0x10
aad 0x30
push esi
mov ah, 0x59
pop esp
pop esp
pop esp
mov ch, 0x76
pop esp
pop esp
pop esp
or ecx, edx
xor byte [eax + 0x5c], bh
xlatb
fst dword [esp + ebx*2 + 0x5c]
pop esp
xlatb
leave
push eax
pop esp
pop esp
pop esp
xlatb
ror dword [esp + ebx*2 + 0x5c], 1
pop esp
popfd
mov ch, 0x5e
insd dword es:[edi], dx
pop esi
fistp word [esi - 0x26aceaa8]
test al, 0xa3
mov dword [0x509e01a3], eax
pop esp
xlatb
sar byte [eax + 0x58], 1
pop esp
pop esp
pop esp
xor al, 0xd8
inc eax
push edx
pop esp
xor al, 0xe7
mov dl, ah
pop esp
pop ebp
jo 0x1096f4e8
or eax, 0x5c5c59b4
pop esp
mov ch, 0x63
pop esi
pop esp
pop esp
or dword [eax], ecx
add dword [ebx + 0x29a35029], esp
push esp
mov ah, 0x2e
pop esp
pop esp
pop esp
xlatb
loope 0x1096f4e0
pop esp
pop esp
pop esp
invalid
outsd dx, dword [esi]
xchg ebp, eax
outsd dx, dword [esi]
mov ds, edi
mov ah, 0x59
adc al, 0x53
fcom dword [edx]
pop esp
pop esp
pop esp
push ebx
aam 0x14
pop esp
pop esp
pop esp
cmp dl, bh
inc eax
fsub qword gs:[edi + 0x46d853b4]
pop esp
pop esp
pop esp
fsub qword [edi + 0x4dd853b5]
pop esp
pop esp
pop esp
cmp bl, ch
cmpsd dword [esi], dword es:[edi]
mov dword [0x49d85379], eax
pop esp
pop esp
pop esp
sbb eax, 0xa3a390b5
mov dword [0x5d651075], eax
fistp word [ebp + 0x58b4df59]
mov ch, 0xe1
mov dword [0x875a3a3], eax
pop esi
pop esi
fistp word [ebp + 0x58b6df5a]
fbstp tbyte [ecx + ebx*2 - 0x5c5c084b]
mov dword [0x5c509e01], eax
or edi, edx
mov al, 0xa
or ecx, dword [ecx]
xlatb
sub dword [eax - 0x29], edx
and dword [eax - 0x12], edx
invalid
Function at 0x4054c8
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, eax
test edx, edx
jne 0x4054d3
xor eax, eax
pop edi
ret
or eax, 0xffffffff
push esi
mov ecx, 0xff
cmp edi, 8
jb 0x405586
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
movzx ebx, byte [edx]
xor ebx, eax
and ebx, ecx
shr eax, 8
xor eax, dword [ebx*4 + 0x4142e0]
inc edx
sub edi, 8
dec esi
jne 0x4054eb
pop ebx
test edi, edi
je 0x40559f
movzx esi, byte [edx]
xor esi, eax
and esi, ecx
shr eax, 8
xor eax, dword [esi*4 + 0x4142e0]
inc edx
dec edi
jne 0x40558a
pop esi
not eax
pop edi
ret
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0xe5aa38
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe5aa42
pushal
call 0xe5aa48
pop ebp
sub ebp, 0x10
sub ebp, 0xa5aa38
jmp 0xe5aa5e
mov eax, 0xa5aa38
add eax, ebp
add eax, 0x4c
mov ecx, 0x5bd
mov edx, 0x4c14adf6
xor byte [eax], dl
inc eax
dec ecx
jne 0xe5aa75
jmp 0xe5aa88
jge 0xe5aac5
jge 0xe5ab0b
retf 0xf6f6
cmpsb byte [esi], byte es:[edi]
sahf
sahf
lodsd eax, dword [esi]
aam 0xf6
sahf
mov eax, 0xdaf7f675
rcr byte [esi - 0x2143f270], cl
push ds
div dh
or eax, 0xf31edebc
div dh
neg byte [edi]
invalid
idiv byte [ebp + 0x7a]
sal dl, cl
div dh
neg byte [esi - 0x92b5262]
sahf
lodsd eax, dword [esi]
aam 0xf6
sahf
mov eax, 0xdaf7f675
shl byte [edi - 0x9090ce2], cl
cmpsd dword [esi], dword es:[edi]
push ds
div dh
neg byte [edi]
mov bl, 0xf4
div dh
jnp 0xe5aab5
ror byte [edx], cl
jg 0xe5ab01
sar byte [ebp + 0x1a], cl
or dword [ebx - 0x17cf606], eax
push ds
test dh, dh
div dh
jge 0xe5ab82
invalid
ja 0xe5ab43
push edi
or esp, dword [eax]
sbb esi, dword [edi + 4]
ja 0xe5ab49
push edi
or esp, dword [eax]
sbb eax, ebp
and al, 0x75
push ds
mov esi, 0xf6b872f9
div dh
lds esp, [esi*2 - 0x6410ce2]
jb 0xe5ab0a
div dh
idiv cl
stc
jle 0xe5ab16
div dh
not byte [eax + 0x76cfea7d]
or eax, 0xec72f91e
div dh
div byte [esi + 0xd]
pop ds
stc
jb 0xe5ab55
jge 0xe5ab48
iretd
div dh
not byte [eax - 0x2cf6f289]
stc
jb 0xe5ab5c
div dh
div byte [edi + 0x9093a1f]
or edi, ebx
mov edx, 0x3775f7cf
fistp qword [edx + 0x3775f7cf]
jne 0xe5aba9
pop ds
dec ebx
or dword [ecx], ecx
or edi, ebx
mov byte [0x3775f4cf], al
invalid
sbb ah, byte [eax - 0x7c825c5f]
cli
jge 0xe5ab3d
dec byte [edx]
inc esp
jbe 0xe5ac33
invalid
hlt
Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941

Function at 0x410497
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [eax + 6]
mov al, byte [eax + 4]
xor byte [edx], al
inc edx
dec ecx
test ecx, ecx
jne 0x4104a3
ret 4

Function at 0x4104ae
Capabilities:
Access peb ldr_data

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword fs:[0x30]
mov dword [edi], eax
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov esi, dword [eax + 0x18]
push 0
lea eax, [edi + 4]
mov dword [eax], 0x3376500f
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 0
lea eax, [edi + 0xc]
mov dword [eax], 0x2dfc830f
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 0
lea eax, [edi + 0x14]
mov dword [eax], 0x552e48c2
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 0
lea eax, [edi + 0x1c]
mov dword [eax], 0xb3f819f8
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 0
lea eax, [edi + 0x24]
mov dword [eax], 0x7c76ecf5
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x2c]
mov dword [eax], 0x116893e9
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x34]
mov dword [eax], 0x529977e2
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x3c]
mov dword [eax], 0x7b62ef3
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x44]
mov dword [eax], 0xa9c5b599
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x4c]
mov dword [eax], 0x6b372c05
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x54]
mov dword [eax], 0xa9e25a1d
push eax
push esi
call fcn.004105ec
test eax, eax
je 0x4105e8
push 1
lea eax, [edi + 0x5c]
mov dword [eax], 0xf67464e4
push eax
push esi
call fcn.004105ec
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4105e3
Function at 0x4105ec
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
mov eax, dword [edi + eax + 0x78]
add eax, edi
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
mov edx, dword [eax + 0x1c]
add edx, edi
mov dword [ebp - 8], edx
mov ecx, dword [eax + 0x20]
add ecx, edi
mov dword [ebp - 0xc], ecx
mov edx, dword [eax + 0x24]
add edx, edi
mov dword [ebp - 0x10], edx
xor esi, esi
test ebx, ebx
je 0x4106bc
mov eax, dword [ecx + esi*4]
add eax, edi
mov edx, 0x811c9dc5
movzx ecx, byte [eax]
test cl, cl
je 0x4106a8
lea eax, [eax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x410632
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx ecx, word [ecx + esi*2]
mov eax, dword [eax + ecx*4]
add eax, edi
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 4], eax
mov ecx, eax
xor eax, eax
inc eax
cmp dword [ebp + 0x10], 1
jne 0x4106be
dec eax
xor edx, edx
cmp byte [ecx + edx], 0xf
jne 0x410676
cmp byte [ecx + edx + 1], 5
je 0x4106bc
cmp byte [ecx + edx], 0xc2
je 0x4106bc
cmp byte [ecx + edx], 0xc3
je 0x4106bc
cmp byte [ecx + edx], 0xb8
jne 0x4106a5
cmp byte [ecx + edx + 5], 0xba
jne 0x4106a5
mov esi, dword [ecx + edx + 1]
mov edi, dword [ecx + edx + 6]
mov dword [ebx + 5], edi
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], esi
xor eax, eax
inc eax
jmp 0x4106be
inc edx
jmp 0x410669
mov eax, dword [ebp + 0xc]
cmp edx, dword [eax]
je 0x410646
mov ecx, dword [ebp - 0xc]
inc esi
cmp esi, dword [ebp - 4]
jb 0x410628
xor eax, eax
pop edi
pop esi
add esp, 0x10
pop ebp
ret 0xc
Function at 0x4106d8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor edx, edx
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push dword [esi + 0x48]
call fcn.004106c7
push edx
push edx
push 0x60
push 1
push edx
push 0x80
push edx
lea eax, [ebp - 0x24]
push eax
push edi
push 0x80100080
lea eax, [ebp - 4]
push eax
call fcn.004106d1
add esp, 0x2c
test eax, eax
jne 0x410862
cmp dword [ebp - 0x20], 1
jne 0x410862
xor edx, edx
xorps xmm0, xmm0
mov dword [ebp - 0x2c], edx
movups xmmword [ebp - 0x1c], xmm0
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
push dword [esi + 0x40]
call fcn.004106c7
push 5
push 0x18
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call fcn.004106d1
add esp, 0x14
test eax, eax
jne 0x410862
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x410862
push dword [ebp - 0x14]
push 8
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
push eax
call dword [esi + 0x20]
mov dword [ebp - 0x2c], eax
push dword [esi + 0x58]
call fcn.004106c7
xor edx, edx
push edx
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
push edx
push edx
push edx
push dword [ebp - 4]
call fcn.004106d1
add esp, 0x24
test eax, eax
jne 0x410862
push dword [esi + 0x50]
call fcn.004106c7
push dword [ebp - 4]
call fcn.004106d1
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x5a4d
je 0x41085e
movdqu xmm0, xmmword [ebx + 9]
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
movdqu xmm1, xmmword [eax + ecx]
xorps xmm1, xmm0
movdqu xmmword [eax + ecx], xmm1
add ecx, 0x10
mov eax, edx
sub eax, ecx
cmp eax, 0x10
jge 0x4107d1
test eax, eax
je 0x410802
push edx
mov dl, byte [ebx + 9]
mov eax, dword [ebp - 0x2c]
xor byte [eax + ecx], dl
inc ecx
cmp ecx, dword [esp]
jne 0x4107f8
pop edx
push dword [esi + 0x48]
call fcn.004106c7
xor edx, edx
push edx
push edx
push 0x60
push 1
push edx
push 0x80
push edx
lea eax, [ebp - 0x24]
push eax
push edi
push 0x40100080
lea eax, [ebp - 4]
push eax
call fcn.004106d1
add esp, 0x2c
test eax, eax
jne 0x410862
push dword [esi + 0x60]
call fcn.004106c7
xor edx, edx
push edx
push edx
push dword [ebp - 0x14]
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
push eax
push edx
push edx
push edx
push dword [ebp - 4]
call fcn.004106d1
add esp, 0x24
test eax, eax
jne 0x410862
inc eax
jmp 0x410865
xor eax, eax
jmp 0x410865
xor eax, eax
dec eax
push eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41087a
push eax
xor edx, edx
push edx
mov eax, dword [esi]
mov eax, dword [eax + 0x18]
push eax
call dword [esi + 0x28]
pop eax
pop edi
pop esi
add esp, 0x30
pop ebp
ret 8
Function at 0x15da508
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [eax - 0x1bc2dcd0]
rol al, 1
aam 0x59
push ebp
pushfd
cmp sp, 0x6a38
aam 0xcf
aas
lea ebp, [esp + 4]
test ebx, 0x928bcb8d
pushal
sub esp, 0xfffffff4
sar ax, 0xa
ror ah, cl
push esi
sar al, 2
test ah, 0x25
aam 1
aad 0x15
push edi
bts ax, 7
pushfd
mov dword [esp], ebx
aaa
push edx
test cl, 0x41
xor ax, bx
aad 0x4e
and ax, 0x7a2d
mov eax, dword [ebp + 8]
pushfd
test eax, eax
pushal
jmp 0x268eda0
mul byte [eax - 0x64]
pushfd
call fcn.0292c5df
or al, cl
je 0x267c902
add al, 0xc4
jbe 0x267c86d
aad 0xd6
invalid
pop ebp
fnstenv [edx - 0x69]
push ecx
sub eax, 0x4eceb89
loopne 0x267c912
pushal
nop
sbb dword [edi + 0x7e2522a4], edi
mov edi, 0x7e2522a4
sar byte [ebx + 0xc47a2d0], 1
int1
ljmp 0x78d8
lea esp, [esp + 0x24]
je 0x292ee21
bts si, 8
adc si, 0x4568
pushfd
mov esi, dword [eax + 0x3c]
or dl, dl
btc dx, 1
add esi, eax
btc edx, eax
mov edx, dword [esi + 0x78]
clc
clc
stc
test edx, edx
jmp 0x267c8a1
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3f2d423a
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x73323a5a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219