joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ce40
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x404
push esi
push edi
mov esi, ecx
push 1
call fcn.0045ce10
push 0
mov ecx, esi
call fcn.0045ce10
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
stosb byte es:[edi], al
call fcn.0045cec0
test eax, eax
jbe 0x45ceb2
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 0x400
mov dword [esp + 8], 0
jbe 0x45ce94
mov eax, 0x400
lea ecx, [esp + 8]
push 0
push ecx
push eax
mov eax, dword [esi + 0x2c]
lea edx, [esp + 0x18]
push edx
push eax
call edi
mov ecx, esi
call fcn.0045cec0
test eax, eax
ja 0x45ce80
pop edi
pop esi
add esp, 0x404
ret

Function at 0x45d640
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
test edi, edi
je 0x45d67d
mov esi, dword [esp + 0x10]
test esi, esi
jbe 0x45d67d
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x45d67d
xor eax, eax
mov byte [ecx], 0
test esi, esi
jbe 0x45d673
push ebx
mov dl, byte [eax + edi]
mov bl, byte [ecx]
xor bl, dl
inc eax
cmp eax, esi
mov byte [ecx], bl
jb 0x45d664
pop ebx
pop edi
mov eax, 1
pop esi
ret 0xc
pop edi
xor eax, eax
pop esi
ret 0xc
Function at 0x45e0c0
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
push edi
jne 0x45e0dc
push str.pToDecodeNull
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
mov edi, dword [esp + 0x10]
cmp edi, 0xe
ja 0x45e106
call fcn.00452210
push edi
push esi
push str.pToDecode:
mov ecx, eax
mov dword [eax + 4], 1
call fcn.004523f0
pop edi
xor eax, eax
pop esi
ret 0x10
mov edx, dword [esp + 0x18]
test edx, edx
jne 0x45e120
push str.pulDecodedLenNull
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
cmp byte [esi], 0x6f
jne 0x45e1f9
cmp byte [esi + 1], 0x6b
jne 0x45e1f9
cmp byte [esi + 2], 0xa5
je 0x45e14b
push str.A5Err
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
cmp byte [esi + 5], 0x52
je 0x45e163
push str.52Err
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
cmp byte [esi + 6], 0x5f
je 0x45e17b
push str.5FErr
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
mov al, byte [esi + 7]
xor ecx, ecx
mov cl, byte [esi + 8]
and eax, 3
shl eax, 8
add eax, ecx
cmp eax, 3
jbe 0x45e1e7
lea ecx, [eax + 0xb]
cmp ecx, edi
ja 0x45e1e7
mov edi, dword [esp + 0x14]
sub eax, 3
test edi, edi
jne 0x45e1ae
mov dword [edx], eax
pop edi
mov eax, 1
pop esi
ret 0x10
cmp dword [edx], eax
jae 0x45e1c6
push str.LenErr
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
mov ecx, eax
push ebx
mov ebx, ecx
add esi, 0xb
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
pop ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [edx], eax
pop edi
mov eax, 1
pop esi
ret 0x10
push str.3Err
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
push str.okErr
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x460850
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x48356a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x198
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
call fcn.00450360
xor eax, eax
mov dword [esp + 0x1b0], eax
lea esi, [ebx + 0x14]
mov dword [esp + 0x10], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov edi, dword [esp + 0x1b8]
mov byte [esp + 0x1b0], 2
push edi
call fcn.00439fb7
lea ebp, [edi + eax*2]
add esp, 4
mov eax, ebp
mov ecx, esi
sub eax, edi
sar eax, 1
inc eax
push eax
call fcn.00450260
mov eax, dword [esi]
push eax
push ebp
push edi
call fcn.0044e9a0
xor edi, edi
mov dword [esi + 4], eax
mov word [eax], di
lea esi, [ebx + 0x20]
mov dword [esp + 0x1c], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
push 0x10
mov byte [esp + 0x1c0], 5
call fcn.00418106
lea ecx, [eax + 0x10]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov word [eax], di
mov word [esp + 0x28], di
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x2a]
add esp, 0x10
rep stosd dword es:[edi], eax
lea edx, [esp + 0x18]
mov dword [ebx], 0x48cc4c
push edx
push 0x102
stosw word es:[edi], ax
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x1a8]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1a4
ret 4

Function at 0x460c60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4837d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00450360
mov ecx, dword [esp + 0x2c]
mov dx, word [esp + 0x30]
mov edi, dword [sym.imp.ole32.dll_IIDFromString]
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esi + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], eax
push ecx
push str.00001101_0000_1000_8000_00805f9b34fb
mov word [esi + 0x18], dx
mov dword [esi], 0x48cc5c
mov dword [esp + 0x20], eax
call edi
lea edx, [esp + 0xc]
push edx
push str.0850302A_B344_4fda_9BE9_90576B8D46F0
call edi
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.004514c0
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret 8

Function at 0x463470
Capabilities:
Encode data using xor

Disassembly:
push edi
mov di, word [esp + 0x10]
xor cl, cl
test di, di
jbe 0x46349f
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
mov dl, byte [esi]
mov bl, byte [eax]
xor bl, dl
inc cl
xor dx, dx
mov byte [eax], bl
inc eax
mov dl, cl
inc esi
cmp dx, di
jb 0x463487
pop esi
pop ebx
pop edi
ret
Function at 0x466bb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 8
mov ecx, eax
and ecx, reloc.OLEAUT32.dll_VariantInit
jns 0x466bc6
dec ecx
or ecx, 0xfffffff8
inc ecx
je 0x466bd1
mov eax, 0xfffff400
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push ebx
push ebp
push esi
cmp ecx, 1
push edi
jne 0x466c4e
test eax, eax
jle 0x466cb7
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x2c]
add eax, 7
shr eax, 3
mov dword [esp + 0x24], eax
mov ebp, esi
sub ecx, edi
mov eax, edi
sub ebp, edi
mov edx, 8
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec edx
mov byte [eax + ebp - 1], bl
jne 0x466c09
mov edx, dword [esp + 0x1c]
push esi
push esi
push edx
call fcn.004668e0
mov ecx, dword [esp + 0x34]
mov eax, dword [esi]
add esp, 0xc
add edi, 8
mov dword [ecx], eax
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x24]
add esi, 8
dec eax
mov dword [ecx + 4], edx
mov dword [esp + 0x24], eax
jne 0x466bfc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
test eax, eax
jle 0x466cb7
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
add eax, 7
shr eax, 3
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push edi
push esi
push edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ecx
call fcn.004668e0
mov ecx, ebp
add esp, 0xc
mov eax, edi
sub ecx, edi
mov edx, 8
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x466c8f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [ebp], eax
mov eax, dword [esp + 0x24]
add esi, 8
add edi, 8
dec eax
mov dword [ebp + 4], ecx
mov dword [esp + 0x24], eax
jne 0x466c68
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x46b760
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0043c870
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x46b7c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x46b7c5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00441ae5
add eax, 0x40
push eax
call fcn.00480636
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00436738
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004801ae
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x46b854
call fcn.0046b680
test eax, eax
je 0x46b854
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00436738
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00436738
add esp, 0x108
ret
Function at 0x46f340
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0043c870
mov eax, dword [0x4a55d0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov ebx, dword [esp + 0x3c]
push ebp
mov ebp, dword [esp + 0x38]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ecx
jle 0x46f3a5
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.0046ae90
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00436738
add esp, 0x28
ret
cmp ebp, 0x29
jge 0x46f3d3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.0046ae90
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00436738
add esp, 0x28
ret
push 0x37
lea eax, [ebp - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x18], eax
call fcn.0046ac60
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x46f41b
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.0046ae90
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00436738
add esp, 0x28
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.00474f10
mov ecx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x58]
push 0
push edi
push eax
push ecx
call fcn.00474e20
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.0043abc0
mov edx, dword [esp + 0x3c]
mov ecx, edi
sub ecx, ebx
add ebp, ecx
push ebx
mov byte [ebp - 0x15], 1
push edx
add ebp, 0xffffffec
push ebp
call fcn.0043ca30
push 0x14
push esi
call fcn.0046d6c0
add esp, 0x38
test eax, eax
jg 0x46f48f
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.00436738
add esp, 0x28
ret
call fcn.00474f10
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push eax
push 0x14
push esi
push ebx
push ebp
call fcn.0046f200
add esp, 0x14
test ebx, ebx
jle 0x46f4bf
mov eax, edi
sub ebp, edi
mov ecx, ebx
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x46f4b4
call fcn.00474f10
push eax
push ebx
push edi
lea eax, [esp + 0x2c]
push 0x14
push eax
call fcn.0046f200
lea ecx, [esp + 0x34]
lea edi, [esp + 0x35]
lea ebp, [esp + 0x36]
lea edx, [esp + 0x37]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x38]
add esp, 0x14
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x46f500
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0046ae10
mov ecx, dword [esp + 0x38]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00436738
add esp, 0x28
ret
Function at 0x46fb50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x46fc1c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x46fb71
cmp al, 0x6b
jne 0x46fc1c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x46fbdd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x46fb91
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x46fb91
cmp al, 0xbb
jne 0x46fbba
inc ecx
cmp ecx, esi
jl 0x46fb81
sub esi, ecx
test ecx, ecx
jne 0x46fbe0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0046ae90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0046ae90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x46fc09
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0046ae90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0043ca30
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0046ae90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x4058d5
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.00405ba0
test bl, 8
mov dword [ebp - 8], eax
je 0x405914
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434f68], eax
jmp 0x405a91
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
je 0x40592e
test eax, eax
je 0x405a3f
test bl, 2
je 0x405a3f
mov esi, 0x42f250
push edi
push esi
call fcn.004060e4
cmp dword [ebp + 8], 0
je 0x40594d
push 0x40a544
push esi
call sub.KERNEL32.dll_lstrcatW
jmp 0x405953
push edi
call fcn.00405ae4
cmp word [edi], 0
jne 0x405963
cmp word [0x42f250], 0x5c
jne 0x40596e
push 0x40a014
push edi
call sub.KERNEL32.dll_lstrcatW
push edi
call sub.KERNEL32.dll_lstrlenW
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405a34
cmp word [ebp - 0x22c], 0x2e
jne 0x4059b8
cmp word [ebp - 0x22a], 0
je 0x405a17
cmp word [ebp - 0x22a], 0x2e
jne 0x4059b8
cmp word [ebp - 0x228], 0
je 0x405a17
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004060e4
test byte [ebp - 0x258], 0x10
je 0x4059e3
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405a17
push dword [ebp + 0xc]
push edi
call fcn.004058d5
jmp 0x405a17
push dword [ebp - 4]
push edi
call fcn.0040588d
test eax, eax
jne 0x405a0f
cmp dword [ebp - 4], eax
je 0x405a07
push edi
push 0xfffffffffffffff1
call fcn.00405243
push 0
push edi
call fcn.00405f85
jmp 0x405a17
inc dword [0x434f68]
jmp 0x405a17
push edi
push 0xfffffffffffffff2
call fcn.00405243
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x405990
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405a3f
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405a91
cmp dword [ebp - 8], esi
jne 0x405a53
inc dword [0x434f68]
jmp 0x405a91
push edi
call fcn.00406427
test eax, eax
je 0x405a91
push edi
call fcn.00405a98
mov eax, dword [ebp - 4]
or al, 1
push eax
push edi
call fcn.0040588d
test eax, eax
jne 0x405a89
cmp dword [ebp - 4], esi
je 0x405a4b
push edi
push 0xfffffffffffffff1
call fcn.00405243
push esi
push edi
call fcn.00405f85
jmp 0x405a91
push edi
push 0xffffffffffffffe5
call fcn.00405243
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4941b0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 4]
push eax
push 1
push 0
push str.SOFTWAREBorlandDelphiRTL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49422e
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 4]
mov esi, eax
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push 0
push str.FPUMaskValue
push ecx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
je 0x494223
mov edx, dword [0x653d94]
push 0x653ac8
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [esp + 0xc]
xor ax, ax
and cl, 0x3f
pop esi
mov al, cl
or eax, 0xffffffc0
add esp, 0x10
ret

Function at 0x4ede83
Capabilities:
Encode data using xor

Disassembly:
rcr dword [esi], 1
ror dword [esi - 0x76], 1
dec edi
jb 0x4edec5
outsb dx, byte [esi]
out dx, al
sahf
and bh, dh
sar byte [ebx - 0xf], cl
jnp 0x4ede4f
in eax, dx
stosd dword es:[edi], eax
pop esi
mov ebp, 0x53af408e
mov dl, 0x7f
xchg edi, eax
push cs
stosd dword es:[edi], eax
cmp byte [ecx], ch
mov al, 0xcd
sbb dword ss:[edx + 0xcbfd107], eax
and ch, byte [ebx + 0x18]
imul ecx, dword [edx], 0x3142484
mov edi, 0x7c8cdd1b
jl 0x4ede5c
jl 0x4ede5c
inc ecx
xor byte [ecx - 0x55], 0x12
jg 0x4ede5e
push eax
push cs
and dword [eax], esp
and edx, edi
jle 0x4ede56
push ds
pop es
push cs
je 0x4edee4
mov edi, 0x8c8bfc4f
fidivr word [edi - 0x80]
shr eax, cl
stosb byte es:[edi], al
arpl word [edx + 0x24], si
mov bh, 0xbe
in al, dx
invalid
stc
outsb dx, byte [esi]
mov ebp, 0xfca37210
sal dword [esp], 1
adc bh, cl
rcl byte [ebx - 0x3e]
inc dword [ecx + 0x2c]
jb 0x4edf1f
test dword [esi + 0x5c], 0x8067457c
pop ds
pushfd
push 0xfffffffffffffff5
out dx, al
pushal
fnsave dword [ecx + 0x134e7218]
xor ecx, dword [esi]
ret 0x360
rol esp, 1
mov eax, 0xb966de42
les edi, [eax - 0x469921be]
jg 0x4edf40
push esi
pop edi
pop ebx
pop esi
push cs
invalid
jmp 0x4edf82
mov dword fs:[edi - 0x32255f59], edi
scasd eax, dword es:[edi]
or dl, byte [eax]
cld
push eax
push es
cli
jg 0x4edf1e
test dword [edx + 0xa], edi
xor al, 0x1e
pop esp
hlt
Function at 0x5cbbb3
Capabilities:
Encode data using xor

Disassembly:
dec edx
jp 0x5cbbdd
xchg edx, eax
xchg ecx, eax
pop edi
adc al, bl
sub ebp, dword [eax + 0x6f]
js 0x5cbc17
mov dl, 0x7b
add edi, ebx
sar bl, 1
lodsd eax, dword [esi]
andps xmm3, xmmword [ebx + eax*2 + 0x28]
jae 0x5cbbf3
invalid
sbb byte [eax + edx + 0x11], bl
and esi, dword [esi + 0x72728b2b]
invalid
or ah, byte [edi + 0x4d2b6462]
push es
shl byte [ebp - 0x4d], cl
or al, 0xe5
out 0xfb, al
out dx, eax
sub ah, ah
fisttp word [edi]
mov edi, ebp
scasd eax, dword es:[edi]
jecxz 0x5cbc6c
ret
fdivr dword [esi + 0x2c]
adc byte [esp + eax*2], bh
imul ebx, ecx, 0xf
movsb byte es:[edi], byte [esi]
sbb ebp, ecx
retf
rcl byte [esi], cl
aas
mov ebx, 0x6504de97
pop edx
cmp dword [edi], esp
call 0x8b5dabb3
mov ebx, esi
in al, 0x2a
mov fs, word [edi]
inc ebp
inc dword [eax]
mov ebx, 0xdb9e1173
mov byte [0x49aa528b], al
stosb byte es:[edi], al
jbe 0x5cbd09
ja 0x5cbccf
cmp al, 0x1a
dec esi
mov eax, dword [esi + 0x78]
push ss
sbb cl, byte [esi - 0x75]
inc esi
js 0x5cbcaf
adc eax, 0x2c72bb02
jno 0x5cbc91
test eax, 0x7f20525a
mul byte [edx - 0x34]
inc edi
xchg dword [edi + 0x124b9e06], ecx
scasd eax, dword es:[edi]
pop esp
cdq
mov cl, 0x52
mov gs, word [ebx + 0x23f2895b]
dec dword [edi]
and ebp, dword [ebx]
invalid
invalid
scasd eax, dword es:[edi]
sbb byte [edx], 0xd
movsd dword es:[edi], dword [esi]
mov ecx, 0x7be72f6d
mov ebp, 0xb44ede8f
xor bl, byte [ebx + 0x7fedb20a]
cld
sub dword [edi + 0x1b], esp
out dx, al
leave
loop 0x5cbd4f
mov dword [ebx + 0x78bb6c5a], ebx
wait
mov edx, 0x5ba490cd
invalid
wait
daa
sub eax, 0x409caf51
mov ebx, 0x2f3f10f6
sub al, 0x1c
add esi, dword [0xa039a1fe]
sbb al, 0xc8
cli
pushal
cmp dl, al
mov gs, ebx
pushal
cmpsd dword [esi], dword es:[edi]
cmp edx, dword [edx - 0x61]
lcall 0x4ef9, 0x499d5141
imul ecx, dword [edx + 0x16f30eab], 0xffffffdf
adc ah, byte [esi*2 + 0x32accd73]
xlatb
push ebp
shr dword [edi + ecx*4 + 0x40], cl
sbb cl, byte [ecx + 0x24]
ror byte [ebp + 0x4b797851], 1
fistp qword [eax + 0x56]
lodsb al, byte [esi]
push edx
add ebx, dword [ecx]
xchg byte [edi + 0x192dfd3d], bl
lcall 0x19cc, 0xfae9db63
invalid
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x431030
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219

Function at 0x401010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
add eax, 2
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 3
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 5
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 6
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 7
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
add ecx, 9
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0xa
mov dword [ebp - 4], edx
push 0x4e20
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x406070
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42d84b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404174
call fcn.00406d8c
push 4
mov dword [esp + 0x18], 0
call fcn.00407f43
mov edi, eax
add esp, 4
test edi, edi
je 0x4060e4
push ebx
call fcn.00406b87
mov dword [edi], eax
call fcn.00406946
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406d4d
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4060d8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406d75
pop ebx
jmp 0x4060e6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x4085bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x430510]
jne 0x4085c7
repz ret
jmp fcn.0040c7ec