joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ecc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4579c8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
lea ebp, [edi + 0x1c]
mov edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push ebp
mov dword [esp + 0x14], ebp
call esi
mov ebx, ebp
mov dword [esp + 0x20], 0
push ebx
mov dword [esp + 0x18], ebx
call esi
lea ecx, [edi + 0x3c]
mov byte [esp + 0x20], 1
call fcn.00433480
cmp dword [edi + 0x44], 0
mov esi, eax
jne 0x42ed1d
mov eax, dword [edi + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [esp + 0x20], 0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call ebx
push ebp
test esi, esi
je 0x42ed91
inc dword [edi + 0x74]
mov dword [esp + 0x24], 0xffffffff
call ebx
call fcn.0042e560
lea ebp, [edi + 0x1c]
push ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
lea ecx, [edi + 0x54]
mov dword [esp + 0x24], 2
call fcn.00433330
test eax, eax
je 0x42ed6f
mov ecx, dword [edi + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
add dword [edi + 0x74], 0xffffffff
jne 0x42ed85
cmp byte [edi + 0x39], 0
je 0x42ed85
mov edx, dword [edi + 0x78]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x42ece0
call ebx
mov ecx, dword [esp + 0x18]
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret

Function at 0x42ee10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x457d98
push eax
mov dword fs:[0], esp
sub esp, 0x34
push ebx
push ebp
push esi
mov esi, edx
mov ebx, ecx
mov ecx, dword [esi + 0x34]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov ebp, dword [esp + 0x50]
dec eax
test ebp, eax
jne 0x42ee89
mov ecx, dword [esi + 0x34]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
dec eax
test edi, eax
jne 0x42ee89
mov ecx, dword [esi + 0x34]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
dec eax
test ebx, eax
jne 0x42ee89
mov ecx, dword [esp + 0x54]
push 0
lea eax, [esp + 0x54]
push eax
push edi
push ecx
push ebp
mov ecx, esi
call fcn.0042e8f0
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 8
mov dword [esp + 0xc], vtable.CCS::CAsyncRequest.0
xor eax, eax
mov dword [esp + 0x48], eax
mov edx, dword [esi + 0x34]
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x14], esi
lea esi, [esp + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], edi
mov byte [esp + 0x24], al
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0x8004022e
call fcn.0042e560
mov ecx, dword [esp + 0x40]
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x40
ret 8
Function at 0x436fa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
cmp byte [0x47c67d], 0
jne 0x436fec
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 1
test eax, eax
je 0x436fdf
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x436fdb
jne 0x436fdf
cmp dword [esp + 8], ecx
jb 0x436fdf
mov al, cl
jmp 0x436fe1
xor al, al
mov byte [0x47c67c], al
mov byte [0x47c67d], cl
cmp byte [0x47c67c], 0
je 0x437000
or dword [esp + 0xa8], 0x100
mov ecx, dword [esp + 0xa8]
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0xa0]
push edx
mov edx, dword [esp + 0xa0]
push eax
push ecx
push edx
call dword [sym.imp.WINMM.dll_timeSetEvent]
add esp, 0x94
ret

Function at 0x4371a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x45715e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
push eax
lea ebx, [esi + 0x7c]
push ebx
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x20], esi
call fcn.00436870
mov ebp, dword [esp + 0x30]
xor edi, edi
push ebp
push edi
lea ecx, [esi + 0x54]
mov dword [esp + 0x24], edi
mov dword [esi], vtable.CBaseRenderer.2.0
mov dword [esi + 0xc], vtable.CBaseRenderer.1.0
mov dword [esi + 0x10], vtable.CBaseRenderer.0
mov dword [esi + 0x50], edi
call fcn.00436c80
push ebp
push 1
lea ecx, [esi + 0x58]
mov byte [esp + 0x24], 1
call fcn.00436c80
push ebp
lea ecx, [esi + 0x5c]
push 1
mov byte [esp + 0x24], 2
call fcn.00436c80
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
call ebx
lea eax, [esi + 0x94]
push eax
call ebx
lea ecx, [esi + 0xc4]
mov dword [esi + 0xac], edi
mov dword [esi + 0xb0], 1
push ecx
mov dword [esi + 0xb4], edi
mov dword [esi + 0xb8], edi
mov dword [esi + 0xbc], edi
mov dword [esi + 0xc0], edi
call ebx
cmp dword [ebp], edi
jl 0x43728c
mov edx, dword [esi + 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10

Function at 0x43c781
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479548]
jne 0x43c78b
repz ret
jmp fcn.00442e55
Function at 0x44a5d0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00443708
and dword [ebp - 4], 0
cmp dword [0x47d07c], 0
mov ebx, eax
jne 0x44a681
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44a732
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45f410
push edi
call esi
test eax, eax
je 0x44a732
push eax
call fcn.00443696
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47d07c], eax
call esi
push eax
call fcn.00443696
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47d080], eax
call esi
push eax
call fcn.00443696
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47d084], eax
call esi
push eax
call fcn.00443696
pop ecx
mov dword [0x47d08c], eax
test eax, eax
je 0x44a681
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00443696
pop ecx
mov dword [0x47d088], eax
mov eax, dword [0x47d088]
cmp eax, ebx
je 0x44a6d9
cmp dword [0x47d08c], ebx
je 0x44a6d9
push eax
call fcn.00443711
push dword [0x47d08c]
mov esi, eax
call fcn.00443711
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x44a6d9
test edi, edi
je 0x44a6d9
call esi
test eax, eax
je 0x44a6d0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44a6d0
test byte [ebp - 0xc], 1
jne 0x44a6d9
or dword [ebp + 0x10], 0x200000
jmp 0x44a712
mov eax, dword [0x47d080]
cmp eax, ebx
je 0x44a712
push eax
call fcn.00443711
pop ecx
test eax, eax
je 0x44a712
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x44a712
mov eax, dword [0x47d084]
cmp eax, ebx
je 0x44a712
push eax
call fcn.00443711
pop ecx
test eax, eax
je 0x44a712
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47d07c]
call fcn.00443711
pop ecx
test eax, eax
je 0x44a732
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44a734
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x451710
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push edi
call fcn.00451540
mov ebx, dword [esp + 0x24]
mov edi, eax
call fcn.00451540
mov ebp, eax
cmp edi, ebp
jge 0x45175b
mov eax, edi
push esi
mov esi, dword [esp + 0x2c]
mov edi, ebp
mov ebp, eax
lea ecx, [esp + 0x10]
xor eax, eax
sub esi, ecx
lea ecx, [esp + eax + 0x10]
mov dl, byte [esi + ecx]
xor dl, 1
and dl, 3
inc eax
cmp eax, 0x10
mov byte [ecx], dl
jl 0x451743
pop esi
jmp 0x451790
jne 0x451771
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
jmp 0x451790
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x2c]
push edi
lea eax, [esp + 0x10]
mov edx, ebp
call fcn.004515f0
add esp, 4
pop edi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4184e8
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x418515
call fcn.0040609e
mov dword [eax], esi
call fcn.0040608b
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040b9a4
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x418533
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004060b1
pop ecx
jmp 0x418510
test byte [esp + 0xc], 0x80
je 0x41853f
and eax, 0xfffffffe
jmp 0x418542
or eax, 1
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x418524
xor eax, eax
pop esi
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x23cd30ef
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x64fd01f1
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 0xffffff90
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1470960
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xdb2000]
push edi
or ebp, 0xffffffff
jmp 0x1470982
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1470989
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1470978
mov eax, 1
add ebx, ebx
jne 0x147099b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1470990
jne 0x14709ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1470990
xor ecx, ecx
sub eax, 3
jb 0x14709c0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1470a32
mov ebp, eax
add ebx, ebx
jne 0x14709cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x14709d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x14709fc
inc ecx
add ebx, ebx
jne 0x14709e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x14709dd
jne 0x14709f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x14709dd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1470a1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1470a0d
jmp 0x147097e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1470a1c
add edi, ecx
jmp 0x147097e
pop esi
mov edi, esi
mov ecx, 0x1beba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1470a3a
cmp byte [edi], 0xb2
jne 0x1470a3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1470a3f
lea edi, [esi + 0x104b000]
mov eax, dword [edi]
or eax, eax
je 0x1470ab7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1075074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x107523c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1470a6c
mov ecx, edi
jns 0x1470a9b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1075244]
or eax, eax
je 0x1470ab1
mov dword [ebx], eax
add ebx, 4
jmp 0x1470a89
call dword [esi + 0x1075240]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
invalid
je 0x1470ae8
cmp al, 0xef
ja 0x1470adb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1470abd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1470aca
mov ebp, dword [esi + 0x1075248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x277]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1470b1c
sub esp, 0xffffff80
jmp 0x817d7f
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2d5a19b7
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x46387579
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4066c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UriUvQCq
lea edi, [esi - 0x5000]
push edi
or ebp, 0xffffffff
jmp 0x4066e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4066e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4066d8
mov eax, 1
add ebx, ebx
jne 0x4066fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4066f0
jne 0x40670c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4066f0
xor ecx, ecx
sub eax, 3
jb 0x406720
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x406792
mov ebp, eax
add ebx, ebx
jne 0x40672b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x406738
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40675c
inc ecx
add ebx, ebx
jne 0x406748
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40673d
jne 0x406759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40673d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40677c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40676d
jmp 0x4066de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40677c
add edi, ecx
jmp 0x4066de
pop esi
lea edi, [esi + 0x4000]
mov eax, dword [edi]
or eax, eax
je 0x4067db
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x406799
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x606c]
or eax, eax
je 0x4067d5
mov dword [ebx], eax
add ebx, 4
jmp 0x4067b6
call dword [esi + 0x6068]
mov ebp, dword [esi + 0x6070]
lea edi, [esi - 0x1000]
mov ebx, pe_overlay
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40680f
sub esp, 0xffffff80
jmp section.DBsumPAo

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x20ee5f19
nop
nop
nop
nop
nop
test eax, eax
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x66b378c4
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x40dfe6
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x906058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009061a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x90607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90606a
add dl, dl
jne 0x906089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9060dc
xor eax, eax
add dl, dl
jne 0x906096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x90617d
add dl, dl
jne 0x9060a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9060d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x906075
mov eax, 1
add dl, dl
jne 0x9060ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9060f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9060e1
sub eax, ebx
mov ebx, 1
jne 0x906128
mov ecx, 1
add dl, dl
jne 0x90610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x906119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x90613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x90614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x906136
cmp eax, 0x7d00
jae 0x90616d
cmp eax, 0x500
jb 0x906168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
cmp eax, 0x7f
ja 0x906170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x906075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x90619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x906075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004c2fa
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x1004c30b
lcall 0x5de5, 0x8b10c483
jmp fcn.10ddc7cc

Function at 0x1004c30b
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x1004c30b
lcall 0x5de5, 0x8b10c483
jmp fcn.10ddc7cc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1786e70
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
mov ecx, dword [esp + 0x114]
lea eax, [esp]
push ebp
mov ebp, dword [esp + 0x11c]
push esi
push edi
push eax
push 0xf003f
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1786f28
lea edx, [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
push eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push edx
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
jne 0x1786f0e
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.01786e70
mov esi, eax
add esp, 8
test esi, esi
jne 0x1786f32
lea edx, [esp + 0x14]
lea ecx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x10]
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
je 0x1786ed0
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x120]
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebp
add esp, 0x110
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x110
ret