joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6624b30e
Capabilities:
Encode data using xor

Disassembly:
and byte [eax - 0x5258090d], al
pop es
stc
test esp, 0x6737a8bf
cmpsb byte [esi], byte es:[edi]
out 0xf1, eax
pop ecx
mov al, byte [0x9d687df3]
sti
out 0xb, eax
iretd
lahf
push cs
mov cl, byte [ecx + 0x11]
push eax
sub dword [ecx + ebx*2], 5
mov edx, dword [edx - 0x53]
sar byte [0x19535815], cl
jecxz 0x6624b2a8
sbb bl, dh
or edi, dword [esi + ecx*8 - 0x4a]
test dword [edx - 0x25], 0xeff73017
push ecx
xor dword fs:[eax + 0x78a57602], ecx
push esp
inc edi
pop es
xor al, dl
jnp 0x6624b33b
daa
cmp byte [ecx + 0x24], 0xf7
invalid

Function at 0x66250043
Capabilities:
Encode data using xor

Disassembly:
invalid
ja 0x6624fff5
xor edi, dword [esi + 0x4633f76]
outsd dx, dword [esi]
invalid

Function at 0x66255377
Capabilities:
Encode data using xor

Disassembly:
and edi, ebp
push ebx
in al, 0xe8
stosb byte es:[edi], al
mov al, 0xab
invalid

Function at 0x6625af6d
Capabilities:
Encode data using xor

Disassembly:
pop esp
push cs
or edi, dword [ebp + 0x4e27337]
mov esp, 0xe27337a5
add al, 0x6a
or dl, dl
in eax, dx
mov esp, 0xe27337a5
add al, 0x6a
or dl, dl
in eax, dx
ja 0x6625af6a
push edx
fild qword [ecx - 0x176dc782]
sal byte [eax + 0x69], 0x71
insd dword es:[edi], dx
inc ebx
mov eax, 0x14daac84
sub al, 0x63
pop eax
fist word [ebx - 0x44]
sbb byte [0xf917c346], bl
mov dh, 0xad
pop ebx
enter 0xffffffffffffff22, 0x6e
lcall 0x1968, 0x78a1e14
mov ebx, 0xc6470749
cwde
inc esi
push esi
cmpsd dword [esi], dword es:[edi]
adc byte [eax + 0x34], cl
push 0xc9d1501c
sahf
pop ecx
pop es
push es
add ah, bl
jecxz 0x6625b008
mov ch, 0x79
jle 0x6625b01b
stosd dword es:[edi], eax
xor dword [ecx - 8], ebp
mov byte [0x9b105708], al
xchg esi, eax
xor esi, dword [ecx + esi*2 + 0x37390923]
and ecx, dword [ecx]
cmp dword [edi], esi
ja 0x6625b028
cmp al, bl
sti
les ecx, [esi - 0x67]
push edi
sbb dword [edi], esi
pop ecx
mov byte [edx], cl
popal
pop edi
sub dword [eax], edx
clc
clc
and dword [ecx + 0x4d], ebp
in eax, 0xe4
xchg esp, eax
xor byte [ecx - 0x65], 0x3b
jbe 0x6625afd0
stosb byte es:[edi], al
and ch, ch
in al, 0xd9
mov ecx, 0xfbe4dd38
stc
push edi
dec ecx
mov bl, 0x7d
xor al, 0x15
adc cl, ch
inc edx
pushfd
jmp 0xe7c8677c
xor byte [ebx], ah
push fs
in al, 0xa6
in eax, 0xfd
pushfd
xchg dword [edi - 0x7f7e7aaa], esp
clc
clc
and dword [ebp - 0x47], ecx
mov ah, 0x70
sbb eax, 0xb8eda347
mov dl, 0x5c
add dword [eax + 0x4d21f8f8], 0x1d70b4b9
inc edi
mov dword [0x5cb2b8ed], eax
pop esp
test al, 0x80
mov ah, 0xb0
inc eax
mov ecx, dword [ecx - 0x4a]
invalid
Function at 0x6625d09a
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xaa4c240d
in al, 0x9f
mov bh, 0xa9
sbb ecx, ecx
bound eax, qword [esi - 0x3ac94214]
in eax, 0xc9
leave
push ebx
cmc
dec edx
wait
jg 0x6625d10e
pop edi
sti
and ah, byte [esi]
and eax, esp
jl 0x6625d126
mov dh, 0xe7
pop ebx
fmul qword [ebp - 0x325573f3]
mov ebx, 0xded8dec1
rcr esi, 0xd8
fcompp
sub al, 0xf6
les ebx, [ecx - 0x36576cd2]
jns 0x6625d0e7
adc ebp, dword [eax - 0x949e406]
les ecx, [esi - 0x1a7238f9]
in eax, dx
out dx, eax
mov bh, 0x40
test dword [edi + 0x32], ebx
call 0xabdca8b8
movsb byte es:[edi], byte [esi]
xchg ebp, eax
das
xchg ebp, eax
sub ah, byte [eax + 0x1dff7fc5]
out dx, al
pop ecx
push ss
mov edi, 0x5ebade5
xchg edx, eax
call [eax - 0x61]
and edx, dword [edi - 0x5a7502ac]
mov dh, 0xd9
mov esi, 0xd43c0bea
xor ch, al
retf
cmp al, 0xd4
xchg esp, eax
mov word [ebx], ss
sbb al, 0xef
xor al, 0x44
xchg edi, eax
cwde
lds edi, [ebx + 0x614deddc]
fsub st(5), st(0)
dec ebp
popal
add al, byte [eax + esi*2]
xor dword [esi + eax*4], eax
aaa
inc esi
mov ebx, 0x83020c57
adc ch, dl
ror dl, cl
mov ebp, 0x70f84ab7
sbb eax, 0xb35c2d1f
xchg ebp, eax
xor ah, byte [eax + esi - 0x69]
adc ah, bh
jg 0x6625d11b
in eax, 0xe6
jnp 0x6625d0d5
retf
Function at 0x6629abd0
Capabilities:
Encode data using xor

Disassembly:
push ds
inc esi
mov ebp, 0x865032ef
retf
xchg bl, cl
invalid
add bh, byte [ecx - 0x17976a5b]
mov eax, 0x1d690e32
pop ecx
cli
jo 0x6629ab97
retf
xor eax, edx
jmp 0x6629ab72
cld
mov dl, 0x19
push ebp
jb 0x6629ab7f
stc
dec esi
fnsave dword [ecx + edi*8 - 8]
pop ebp
xchg esi, eax
stosb byte es:[edi], al
pop eax
imul ecx, dword [edx], 0xffffff85
cmp bl, cl
test al, 0x4e
dec edx
mov al, 0xc5
mov bl, bl
fisttp dword [edi + ebx]
aas
cmc
adc al, 0x51
inc ebp
push ss
test dword [ebx + ebp + 0x13], esi
pop edi
inc edx
jge 0x6629ab78
xchg edi, eax
xchg edi, eax
push ebp
js 0x6629abb3
popfd
sub al, 0xf6
pop eax
enter 0x6c6e, 0x25
xchg byte [esi - 0x4f4918e5], dl
adc edx, dword [eax]
mov bl, 0xe1
dec esi
mov dh, dl
scasd eax, dword es:[edi]
dec ebp
cli
daa
leave
imul esp, dword [esi - 0x40], 0x85cfd255
mov eax, dword [0xa7630b7d]
dec ecx
lahf
cmp dword [esi + 0xbe1c896], esp
cmp eax, 0xa85a3196
mov dword [edx - 0xd6a472a], esi
test eax, 0xf62c1d05
add ah, byte [esi - 0x3f]
add al, 0x9a
in al, dx
sub ch, byte [ecx]
pop eax
or ch, byte [eax + ecx]
xchg edi, eax
and al, 0xb6
imul edx, dword [ebp - 0x36], 0xffffffc8
mov ch, byte [esi]
xor eax, 0x471bc405
push es
add al, 0x8d
sub al, byte [edi + 0x57]
jmp 0x6629ac84
loopne 0x6629ace6
sbb dword [eax + 0x39], ebx
insd dword es:[edi], dx
xchg ebp, eax
mov eax, 0x91402d29
in al, dx
int3
and eax, 0xea13fa7c
xchg edi, eax
jge 0x6629acf3
loope 0x6629ad35
pushfd
invalid
loope 0x6629ad85
fimul dword [ebp + 0x1655baca]
invalid
push 0x66376ca0
mov edx, 0xa453456d
push ds
rcl dword [edi]
cmpsd dword [esi], dword es:[edi]
or dh, byte [ebx - 0x64]
sub ecx, dword [ebx - 0x67c22dcf]
inc edx
test eax, 0x689d103a
wait
mov edx, 0x9f3af594
sbb dword [ebp + edx*2 + 0x734a3982], ebp
push ebp
push ss
xchg esi, eax
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
inc ecx
add ah, byte [edi]
xor eax, 0xfff34162
push ecx
inc ebp
adc al, 0x51
and ecx, 0x33ab4cbf
out 0xcf, eax
imul edi, dword [edx - 0x500b6683], 0x45
xor dword [edx + 0x6a7a9592], 0x6b
mov esi, 0xe1d03375
xchg edx, eax
mov ebx, 0x5dfd1196
hlt
Function at 0x66aa92
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x3c]
add eax, edx
add eax, 4
add eax, 0x14
lea eax, [eax + 0x60]
add eax, 8
mov eax, dword [eax]
add eax, edx
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x118], 0x49
mov byte [ebp - 0x117], 0x6d
mov byte [ebp - 0x116], 0x70
mov byte [ebp - 0x115], 0x6f
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x74
mov byte [ebp - 0x112], 0x20
mov byte [ebp - 0x111], 0x54
mov byte [ebp - 0x110], 0x61
mov byte [ebp - 0x10f], 0x62
mov byte [ebp - 0x10e], 0x6c
mov byte [ebp - 0x10d], 0x65
mov byte [ebp - 0x10c], 0x3a
mov byte [ebp - 0x10b], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x66ab67
lea esi, [ebp - 0x14]
mov ecx, 0x14
mov al, 0
mov byte [esi], al
inc esi
dec ecx
jne 0x66ab31
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov edi, ebx
mov ecx, 0x14
repe cmpsb byte [esi], byte es:[edi]
je 0x66ab5d
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0066ab71
test eax, eax
je 0x66ab67
add ebx, 0x14
jmp 0x66ab3a
popal
mov eax, 1
leave
ret 8
popal
mov eax, 0
leave
ret 8
Function at 0x66ab71
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
pushal
mov eax, 1
test eax, eax
je 0x66addd
mov byte [ebp - 0x10c], 0x50
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x6f
mov byte [ebp - 0x109], 0x63
mov byte [ebp - 0x108], 0x65
mov byte [ebp - 0x107], 0x73
mov byte [ebp - 0x106], 0x73
mov byte [ebp - 0x105], 0x69
mov byte [ebp - 0x104], 0x6e
mov byte [ebp - 0x103], 0x67
mov byte [ebp - 0x102], 0x20
mov byte [ebp - 0x101], 0x49
mov byte [ebp - 0x100], 0x6d
mov byte [ebp - 0xff], 0x70
mov byte [ebp - 0xfe], 0x6f
mov byte [ebp - 0xfd], 0x72
mov byte [ebp - 0xfc], 0x74
mov byte [ebp - 0xfb], 0x20
mov byte [ebp - 0xfa], 0x44
mov byte [ebp - 0xf9], 0x69
mov byte [ebp - 0xf8], 0x72
mov byte [ebp - 0xf7], 0x65
mov byte [ebp - 0xf6], 0x63
mov byte [ebp - 0xf5], 0x74
mov byte [ebp - 0xf4], 0x6f
mov byte [ebp - 0xf3], 0x72
mov byte [ebp - 0xf2], 0x79
mov byte [ebp - 0xf1], 0x3a
mov byte [ebp - 0xf0], 0
mov eax, 1
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, dword [ebp + 0xc]
mov ebx, eax
mov eax, 1
test eax, eax
je 0x66addd
mov eax, 1
test eax, eax
je 0x66addd
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
test eax, eax
je 0x66addd
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [edx + 0x10]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
sub ecx, ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov eax, dword [eax]
test eax, eax
je 0x66add3
mov ebx, eax
and eax, 0x80000000
jne 0x66ad4a
mov byte [ebp - 0x10c], 0x4e
mov byte [ebp - 0x10b], 0x61
mov byte [ebp - 0x10a], 0x6d
mov byte [ebp - 0x109], 0x65
mov byte [ebp - 0x108], 0x3a
mov byte [ebp - 0x107], 0x20
mov byte [ebp - 0x106], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x66addd
add ebx, dword [ebp + 0xc]
lea ebx, [ebx + 2]
mov eax, ebx
mov eax, 1
test eax, eax
je 0x66addd
mov eax, 1
test eax, eax
je 0x66addd
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x66addd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x66aca5
mov byte [ebp - 0x10c], 0x4f
mov byte [ebp - 0x10b], 0x72
mov byte [ebp - 0x10a], 0x64
mov byte [ebp - 0x109], 0x69
mov byte [ebp - 0x108], 0x6e
mov byte [ebp - 0x107], 0x61
mov byte [ebp - 0x106], 0x6c
mov byte [ebp - 0x105], 0x3a
mov byte [ebp - 0x104], 0x20
mov byte [ebp - 0x103], 0
lea eax, [ebp - 0x10c]
mov eax, 1
test eax, eax
je 0x66addd
xor ebx, 0x80000000
mov eax, ebx
mov eax, 1
test eax, eax
je 0x66ab67
push ecx
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
pop ecx
test eax, eax
je 0x66addd
mov ebx, dword [ebp - 8]
add ebx, ecx
mov dword [ebx], eax
add ecx, 4
jmp 0x66aca5
popal
mov eax, 1
leave
ret 0xc
popal
mov eax, 0
leave
ret 0xc
Function at 0x66ae9d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov edx, dword [ebp + 0xc]
sub eax, eax
mov ax, word [edx + 2]
mov dword [ebp - 0x118], eax
add edx, 0x14
mov eax, dword [edx + 0x1c]
mov dword [ebp - 0x114], eax
mov eax, dword [edx + 0x38]
mov dword [ebp - 0x110], edx
lea edx, [ebp - 0xc]
mov ebx, dword [ebp + 8]
push edx
push 4
push eax
push dword [ebp - 0x114]
call dword [ebx + 0x24]
test eax, eax
je 0x66afee
mov byte [ebp - 0x10c], 0x53
mov byte [ebp - 0x10b], 0x65
mov byte [ebp - 0x10a], 0x74
mov byte [ebp - 0x109], 0x20
mov byte [ebp - 0x108], 0x49
mov byte [ebp - 0x107], 0x6d
mov byte [ebp - 0x106], 0x61
mov byte [ebp - 0x105], 0x67
mov byte [ebp - 0x104], 0x65
mov byte [ebp - 0x103], 0x20
mov byte [ebp - 0x102], 0x77
mov byte [ebp - 0x101], 0x72
mov byte [ebp - 0x100], 0x69
mov byte [ebp - 0xff], 0x74
mov byte [ebp - 0xfe], 0x61
mov byte [ebp - 0xfd], 0x62
mov byte [ebp - 0xfc], 0x6c
mov byte [ebp - 0xfb], 0x65
mov byte [ebp - 0xfa], 0x3a
mov byte [ebp - 0xf9], 0
mov eax, 1
mov eax, 1
test eax, eax
je 0x66afee
mov edx, dword [ebp - 0x110]
lea ebx, [edx + 0x60]
mov eax, dword [edx + 0x5c]
mov edx, 8
mul edx
add eax, ebx
mov dword [ebp - 8], eax
mov eax, 0x28
mov edx, dword [ebp - 0x118]
mul edx
add eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 4], eax
mov edi, dword [ebp - 0x114]
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x118]
mov ebx, dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 0x114]
push ebx
push dword [ebp + 8]
call fcn.0066aff8
test eax, eax
je 0x66afee
add ebx, 0x28
dec ecx
jne 0x66afc7
popal
mov eax, dword [ebp - 0x114]
leave
ret 0x10
popal
mov eax, 0
leave
ret 0x10

Function at 0x66b09e
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
pushal
mov edx, dword [ebp + 0xc]
mov ebx, dword [edx + 0x24]
and ebx, 0xe0000000
cmp ebx, 0xe0000000
jne 0x66b0c9
mov eax, 0x40
mov dword [ebp - 0x108], eax
jmp 0x66b12e
mov ebx, dword [edx + 0x24]
and ebx, 0x60000000
cmp ebx, 0x60000000
jne 0x66b0e7
mov eax, 0x20
mov dword [ebp - 0x108], eax
jmp 0x66b12e
mov ebx, dword [edx + 0x24]
and ebx, 0xc0000000
cmp ebx, 0xc0000000
jne 0x66b105
mov eax, 4
mov dword [ebp - 0x108], eax
jmp 0x66b12e
mov ebx, dword [edx + 0x24]
and ebx, 0x40000000
cmp ebx, 0x40000000
jne 0x66b123
mov eax, 2
mov dword [ebp - 0x108], eax
jmp 0x66b12e
mov eax, 1
mov dword [ebp - 0x108], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov ebx, dword [edx + 8]
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x104]
push edx
push dword [ebp - 0x108]
push ebx
push eax
call dword [ecx + 0x24]
test eax, eax
je 0x66b16b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0xc]
add eax, dword [ebp + 0x10]
mov eax, 1
popal
mov eax, 1
leave
ret 0x10
popal
sub eax, eax
leave
ret 0x10
Function at 0x66b172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x66b1a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x66b1a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x66bdff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.0066bf04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.0066bf20
push edx
push dword [ebp + 0x10]
push eax
call fcn.0066beec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0066bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0066becb
push ecx
push dword [ebp + 8]
call fcn.0066bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0066bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0066becb
push ecx
push dword [ebp + 8]
call fcn.0066bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0066bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0066becb
push ecx
push dword [ebp + 8]
call fcn.0066bf04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.0066bf04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.0066becb
cmp ecx, 0x2b
jne 0x66be0f
leave
ret 0xc

Function at 0x66d4b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x66d544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x132340
push 0
call dword [eax + 0x20]
test eax, eax
je 0x66d5d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x132340
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x132340
call fcn.0066d3fa
push 0x132340
push dword [ebp + 0xc]
call fcn.0066b1a8
test eax, eax
jne 0x66d5b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x132340
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.0066d5dd
test eax, eax
je 0x66d5d6
jmp 0x66d574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x66d5d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x66d60b
Capabilities:
Terminate process

Disassembly:
call fcn.0066d618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x414172
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edx, dword [ebp + 8]
mov ax, word [edx]
cmp ax, 0x5a4d
jne 0x4141a1
mov eax, dword [edx + 0x3c]
add edx, eax
mov eax, dword [edx]
cmp eax, 0x4550
jne 0x4141a1
add edx, 4
mov dword [ebp - 4], edx
popal
mov eax, dword [ebp - 4]
leave
ret 8
popal
sub eax, eax
leave
ret 8

Function at 0x414dff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ecx, 3
mov edx, 1
push ecx
push dword [ebp + 8]
call fcn.00414f04
rol eax, 8
push dword [ebp + 0xc]
push eax
call fcn.00414f20
push edx
push dword [ebp + 0x10]
push eax
call fcn.00414eec
inc edx
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00414f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00414ecb
push ecx
push dword [ebp + 8]
call fcn.00414f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00414f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00414ecb
push ecx
push dword [ebp + 8]
call fcn.00414f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00414f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00414ecb
push ecx
push dword [ebp + 8]
call fcn.00414f04
mov ebx, eax
push ecx
sub ecx, 3
push ecx
push dword [ebp + 8]
call fcn.00414f04
pop ecx
xor eax, ebx
inc ecx
push ecx
push dword [ebp + 8]
push eax
call fcn.00414ecb
cmp ecx, 0x2b
jne 0x414e0f
leave
ret 0xc

Function at 0x4164b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
pushal
mov byte [ebp - 0x118], 0x42
mov byte [ebp - 0x117], 0x72
mov byte [ebp - 0x116], 0x75
mov byte [ebp - 0x115], 0x74
mov byte [ebp - 0x114], 0x65
mov byte [ebp - 0x113], 0x66
mov byte [ebp - 0x112], 0x6f
mov byte [ebp - 0x111], 0x72
mov byte [ebp - 0x110], 0x63
mov byte [ebp - 0x10f], 0x69
mov byte [ebp - 0x10e], 0x6e
mov byte [ebp - 0x10d], 0x67
mov byte [ebp - 0x10c], 0x20
mov byte [ebp - 0x10b], 0x4b
mov byte [ebp - 0x10a], 0x65
mov byte [ebp - 0x109], 0x79
mov byte [ebp - 0x108], 0
mov eax, 1
lea edi, [ebp - 0x14]
mov ecx, 0x10
mov al, 0
mov byte [edi], al
inc edi
dec ecx
jne 0x416544
mov eax, dword [ebp + 8]
push 4
push 0x3000
push 0x7760
push 0
call dword [eax + 0x20]
test eax, eax
je 0x4165d6
mov dword [ebp - 4], eax
mov edi, eax
mov esi, dword [ebp + 0xc]
mov ecx, 0x7760
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0xc]
push 0x7760
call fcn.004163fa
push 0x7760
push dword [ebp + 0xc]
call fcn.004141a8
test eax, eax
jne 0x4165b8
mov esi, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ecx, 0x7760
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x14]
push eax
call fcn.004165dd
test eax, eax
je 0x4165d6
jmp 0x416574
mov eax, dword [ebp + 8]
push 0x8000
push 0
push dword [ebp - 4]
call dword [eax + 0x28]
test eax, eax
je 0x4165d6
popal
mov eax, 1
leave
ret 8
popal
sub eax, eax
leave
ret 8
Function at 0x41660b
Capabilities:
Terminate process

Disassembly:
call fcn.00416618
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x41c769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x420190
cmp edx, dword [eax]
je 0x41c78b
add eax, 8
inc ecx
cmp eax, 0x420220
jl 0x41c77c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x420190]
jne 0x41c8b9
mov eax, dword [0x420bb0]
cmp eax, 1
je 0x41c893
test eax, eax
jne 0x41c7bc
cmp dword [0x4200e4], 1
je 0x41c893
cmp edx, 0xfc
je 0x41c8b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41c7f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041d670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041d490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41c836
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041d490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41f45c
push edi
call fcn.0041df00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041d670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041d680
lea eax, [ebp - 0xa0]
push 0x41f43c
push eax
call fcn.0041d680
push dword [esi + 0x420194]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041d680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041de75
add esp, 0x2c
pop edi
jmp 0x41c8b9
lea eax, [ebp + 8]
lea esi, [esi + 0x420194]
push 0
push eax
push dword [esi]
call fcn.0041d490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x431006
Capabilities:
Encode data using xor

Disassembly:
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219