joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472c7c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x472e27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x472e08
mov dl, 1
mov eax, dword [0x416d50]
call fcn.00403608
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004043d0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x472df7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0045ff1c
test al, al
je 0x472dea
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x472e38
lea eax, [ebp - 0x254]
call fcn.004095c0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x472dea
xor eax, eax
push ebp
push 0x472de3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x472e70
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x472dcc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404640
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x472dcc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404640
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472dea
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x472ced
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041b56c
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472e2e
lea eax, [ebp - 0x260]
call fcn.004043d0
ret

Function at 0x47375c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x496c10]
cmp byte [eax + 0xa5], 0
jne 0x4737cd
cmp dword [0x496c28], 0
jne 0x47378e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x473718
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x496c28], eax
cmp dword [0x496c24], 0
jne 0x4737a9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x496c24], eax
cmp dword [0x496c2c], 0
jne 0x4737cd
push esp
push 0
push 0
push 0x4736bc
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x496c2c], eax
pop edx
ret
Function at 0x473920
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x473937
add esp, 0xfffffff0
call fcn.0040399c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004215bc
mov eax, dword [0x4953a4]
cmp word [eax + 2], 0
jne 0x47395f
mov eax, dword [0x4953a4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00475010
mov eax, dword [0x495470]
cmp word [eax + 2], 0
jne 0x473979
mov eax, dword [0x495470]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00475208
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x416698]
call fcn.00403608
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x416698]
call fcn.00403608
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x423c98]
call fcn.0042b464
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x473b00
mov eax, dword [0x4952b4]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042b834
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x4757a8
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4952b4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce78
test eax, eax
je 0x473a6e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f74
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cea0
test eax, eax
je 0x473a82
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404640
mov eax, dword [0x495150]
cmp byte [eax], 0
jne 0x473ab6
mov eax, ebx
call fcn.00473c28
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00475984
mov eax, ebx
call fcn.00476348
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x473af6
call fcn.004039f4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473ea8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x496c10]
cmp dword [eax + 0x30], 0
je 0x473f52
cmp dword [ebx + 0x94], 0
jne 0x473f4c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x473e38
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x473f4c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x473f12
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x473f4c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00418f34
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x473f21
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x474ab4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x474ae9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004044c0
jmp 0x474af6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404424
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x475b60
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x475ba1
mov eax, esi
call fcn.0045b4d8
test al, al
je 0x475ba1
mov eax, dword [ebx + 0x84]
call fcn.0045b1d4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x475ba1
push 0
mov eax, dword [ebx + 0x84]
call fcn.0045b1d4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x476998
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x476b64
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.004043d0
cmp byte [ebx + 0x48], 0
je 0x4769e1
cmp byte [ebx + 0x58], 0
je 0x476b46
mov eax, 0x476b7c
call fcn.004338f0
jmp 0x476b46
cmp dword [ebx + 0x44], 0xffffffff
jne 0x4769ee
mov eax, ebx
call fcn.004767f0
cmp dword [ebx + 0x44], 0xffffffff
je 0x476b46
mov byte [ebx + 0x48], 1
mov eax, dword [ebx + 0x40]
call fcn.00404690
test eax, eax
jne 0x476a49
mov eax, ebx
call fcn.004767c0
mov esi, eax
test esi, esi
jbe 0x476b42
mov eax, edi
mov edx, esi
call fcn.00404a1c
push 0
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [edi]
call fcn.00404890
push eax
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_ReadFile_1
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404a1c
jmp 0x476b42
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetTickCount
add eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
mov byte [ebx + 0x59], 0
mov eax, ebx
call fcn.004767c0
mov esi, eax
test esi, esi
jbe 0x476ab3
mov eax, dword [ebp - 0xc]
call fcn.00404690
cmp esi, eax
jb 0x476a7f
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00404a1c
push 0
lea eax, [ebp - 4]
push eax
push esi
mov eax, dword [ebp - 0xc]
call fcn.00404890
push eax
mov eax, dword [ebx + 0x44]
push eax
call sub.kernel32.dll_ReadFile_1
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004048f0
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00404698
mov edx, dword [edi]
mov eax, dword [ebx + 0x40]
call fcn.004049d4
test eax, eax
je 0x476ac7
mov byte [ebp - 5], 1
jmp 0x476ae7
call sub.kernel32.dll_GetTickCount
cmp eax, dword [ebp - 0x10]
jbe 0x476ad5
mov byte [ebx + 0x59], 1
cmp byte [ebx + 0x30], 0
je 0x476ae7
mov eax, dword [0x49544c]
mov eax, dword [eax]
call fcn.00474d64
mov al, byte [ebx + 0x59]
test al, al
jne 0x476af8
cmp byte [ebp - 5], 0
je 0x476a5c
test al, al
je 0x476b32
mov eax, ebx
call fcn.00476dd8
cmp byte [ebx + 0x58], 0
je 0x476b32
push 0
mov cx, word [0x476ba0]
xor edx, edx
mov eax, 0x476bac
call fcn.004337f8
cmp eax, 4
jne 0x476b32
mov byte [ebx + 0x59], 0
call sub.kernel32.dll_GetTickCount
add eax, dword [ebx + 0x54]
mov dword [ebp - 0x10], eax
cmp byte [ebp - 5], 0
jne 0x476b42
cmp byte [ebx + 0x59], 0
je 0x476a58
mov byte [ebx + 0x48], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476b6b
lea eax, [ebp - 0x14]
call fcn.004043d0
lea eax, [ebp - 0xc]
call fcn.004043d0
ret

Function at 0x48dffc
Capabilities:
Log keystrokes via polling

Disassembly:
push 2
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x48e01d
push 1
call sub.user32.dll_GetAsyncKeyState
movsx eax, ax
test ah, 0x80
jne 0x48e01d
xor eax, eax
ret
mov al, 1
ret
Function at 0x401e1e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4fec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4800b8
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x40], eax
mov eax, 0x47fd28
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebp + 8]
push eax
push 0x4a93b8
push 0x47fce4
lea eax, [ebp - 0xcc]
push 0x18
push eax
mov dword [ebp - 0xcc], 0x4800ac
mov dword [ebp - 0xc8], 0x480094
mov dword [ebp - 0xc4], 0x48008c
mov dword [ebp - 0xc0], 0x480078
mov dword [ebp - 0xbc], str._r_TA
mov dword [ebp - 0xb8], 0x48005c
mov dword [ebp - 0xb4], 0x480054
mov dword [ebp - 0xb0], 0x48003c
mov dword [ebp - 0xac], 0x480038
mov dword [ebp - 0xa8], 0x480028
mov dword [ebp - 0xa4], 0x48001c
mov dword [ebp - 0xa0], 0x480004
mov dword [ebp - 0x9c], 0x47fff8
mov dword [ebp - 0x98], 0x47ffe0
mov dword [ebp - 0x94], 0x47ffd4
mov dword [ebp - 0x90], 0x47ffb8
mov dword [ebp - 0x8c], 0x47ffac
mov dword [ebp - 0x88], 0x47ff94
mov dword [ebp - 0x84], 0x47ff84
mov dword [ebp - 0x80], 0x47ff68
mov dword [ebp - 0x7c], 0x47ff54
mov dword [ebp - 0x78], 0x47ff3c
mov dword [ebp - 0x74], 0x47ff2c
mov dword [ebp - 0x70], 0x47ff10
mov dword [ebp - 0x6c], 0x47ff00
mov dword [ebp - 0x68], 0x47fee4
mov dword [ebp - 0x64], 0x47fed0
mov dword [ebp - 0x60], 0x47feb0
mov dword [ebp - 0x5c], 0x47fea4
mov dword [ebp - 0x58], 0x47fe8c
mov dword [ebp - 0x54], 0x47fe74
mov dword [ebp - 0x50], 0x47fe50
mov dword [ebp - 0x4c], 0x47fe40
mov dword [ebp - 0x44], 0x47fe2c
mov dword [ebp - 0x3c], 0x47fe20
mov dword [ebp - 0x38], 0x47fe08
mov dword [ebp - 0x34], 0x47fdf8
mov dword [ebp - 0x30], 0x47fddc
mov dword [ebp - 0x2c], 0x47fdcc
mov dword [ebp - 0x28], 0x47fdb0
mov dword [ebp - 0x24], 0x47fda4
mov dword [ebp - 0x20], 0x47fd8c
mov dword [ebp - 0x1c], 0x47fd80
mov dword [ebp - 0x18], 0x47fd68
mov dword [ebp - 0x14], 0x47fd5c
mov dword [ebp - 0x10], 0x47fd44
call fcn.00401da4
mov ecx, dword [ebp - 4]
add esp, 0x14
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.0043cac0
leave
ret
Function at 0x1001a45
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x1001258
call fcn.01001c48
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1001a82
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a82
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001a9a
cmp eax, 0x20b
je 0x1001a87
mov dword [ebp - 0x1c], ebx
jmp 0x1001aae
cmp dword [ecx + 0x84], 0xe
jbe 0x1001a82
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1001aa8
cmp dword [ecx + 0x74], 0xe
jbe 0x1001a82
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1003078], 0xffffffff
or dword [0x100307c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1003070]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100306c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1003080], eax
call fcn.01001c3e
cmp dword [0x1003050], ebx
jne 0x1001b09
push fcn.01001c3e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01001c27
push 0x1003010
push 0x100300c
call sub.msvcrt.dll__initterm
mov eax, dword [0x1003068]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1003064]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x38], eax
push 0x1003008
push section..data
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
cmp byte [esi], 0x22
jne 0x1001b9f
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1001b73
cmp al, 0x22
jne 0x1001b65
cmp byte [esi], 0x22
jne 0x1001b7c
inc esi
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, bl
je 0x1001b86
cmp al, 0x20
jbe 0x1001b78
mov dword [ebp - 0x54], ebx
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x54], 1
je 0x1001baa
movzx eax, word [ebp - 0x50]
jmp 0x1001bad
cmp byte [esi], 0x20
jbe 0x1001b7c
inc esi
mov dword [ebp - 0x20], esi
jmp 0x1001b9f
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1001bca
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1001bff
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01001c83
ret

Function at 0x406e74
Capabilities:
Encode data using xor

Disassembly:
sbb al, byte [edx - 0x4da4c5d3]
mov ebp, 0x41a51ed9
xor dl, byte [eax + 0x79]
test byte [edx + edx*4], ch
scasd eax, dword es:[edi]
in al, dx
cli
push eax
stosd dword es:[edi], eax
test byte [edx - 0x24be4eb1], ah
cmp bl, byte [ebx + 0x1dededaf]
jne 0x406e7f
mov dh, 1
adc eax, 0xcc87b86d
retf 0x5d66
Function at 0x480370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x40000]
push edi
or ebp, 0xffffffff
jmp 0x480392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x480399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x480388
mov eax, 1
add ebx, ebx
jne 0x4803ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4803bc
jne 0x4803cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4803cc
dec eax
add ebx, ebx
jne 0x4803c8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4803a0
xor ecx, ecx
sub eax, 3
jb 0x4803e4
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x480456
sar eax, 1
mov ebp, eax
jmp 0x4803ef
add ebx, ebx
jne 0x4803ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4803fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x480420
inc ecx
add ebx, ebx
jne 0x48040c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x480401
jne 0x48041d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x480401
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x480440
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x480431
jmp 0x48038e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x480440
add edi, ecx
jmp 0x48038e
pop esi
mov edi, esi
mov ecx, 0x15ca
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48045e
cmp byte [edi], 0xb
jne 0x48045e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x480463
lea edi, [esi + 0x7e000]
mov eax, dword [edi]
or eax, eax
je 0x4804db
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x834bc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x835ac]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x480490
mov ecx, edi
jns 0x4804bf
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x835b0]
or eax, eax
je 0x4804d5
mov dword [ebx], eax
add ebx, 4
jmp 0x4804ad
call dword [esi + 0x835b4]
popal
jmp 0x420125

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4064a0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x409a50]
jne 0x407826
repz ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x40a2b8], eax
mov dword [0x40a2b4], ecx
mov dword [0x40a2b0], edx
mov dword [0x40a2ac], ebx
mov dword [0x40a2a8], esi
mov dword [0x40a2a4], edi
mov word [0x40a2d0], ss
mov word [0x40a2c4], cs
mov word [0x40a2a0], ds
mov word [0x40a29c], es
mov word [0x40a298], fs
mov word [0x40a294], gs
pushfd
pop dword [0x40a2c8]
mov eax, dword [ebp]
mov dword [0x40a2bc], eax
mov eax, dword [ebp + 4]
mov dword [0x40a2c0], eax
lea eax, [ebp + 8]
mov dword [0x40a2cc], eax
mov eax, dword [ebp - 0x320]
mov dword [0x40a208], 0x10001
mov eax, dword [0x40a2c0]
mov dword [0x40a1bc], eax
mov dword [0x40a1b0], 0xc0000409
mov dword [0x40a1b4], 1
mov eax, dword [0x409a50]
mov dword [ebp - 0x328], eax
mov eax, dword [0x409a54]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x40a200], eax
push 1
call fcn.004068ed
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x4021d8
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x40a200], 0
jne 0x407916
push 1
call fcn.004068ed
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x4065e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4065f4
pop dword [ebp - 0x40]
mov eax, 0x21cedc40
sub eax, 0x218e764c
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x35035
push 0
mov eax, 0xd718bef6
add eax, 0x292751ce
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x40c0
mov ebx, eax
mov edi, 0x2cc2e618
add edi, 0xd37de1e8
add edi, dword [ebp - 0x40]
mov edx, 0x1e8499f3
sub dword [ebp - 0x3c], edx
mov esi, dword [edi]
xor dword [ebp - 0x3c], edx
xor esi, edx
xor dword [ebp - 0x20], eax
mov dword [ebx], esi
xor dword [ebp - 0x14], edx
add ebx, 0x10fbcfdc
add ebx, 0xef043028
add edi, 0xb0e1e9d2
sub edi, 0xb0e1e9ce
loop 0x406647
add eax, 0x4f748241
sub eax, 0x4f738c6e
xor ebx, ebx
add ebx, eax
add eax, 0x42d7c4df
sub eax, 0x42d7c4da
mov ecx, 0xeb84a0ab
sub ecx, 0xeb44a0ab
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x404e70
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x14
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], edx
test eax, eax
je 0x404e9d
xor ebx, ebx
lea esi, cs:[esi]
nop
mov eax, dword [eax]
mov esi, ebx
inc ebx
test eax, eax
jne 0x404e90
test ebx, ebx
jne 0x404ea8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edx, [ebx*4]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, eax
mov eax, dword [edi + 4]
sub esp, 0xc
mov edx, ecx
test eax, eax
je 0x404eeb
nop
mov dword [edx], eax
mov eax, dword [eax]
add edx, 4
test eax, eax
jne 0x404ee0
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], ebx
mov dword [esp], ecx
mov eax, dword [eax*4 + 0x415d20]
mov dword [ebp - 0x10], ecx
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
call dword [sym.imp.ucrtbase.dll_qsort]
mov ecx, dword [ebp - 0x10]
mov edx, esi
mov ebx, dword [ecx]
mov eax, ecx
mov dword [edi + 4], ebx
test esi, esi
jne 0x404f2a
jmp 0x404f38
mov ebx, dword [eax]
mov edi, dword [eax + 4]
add eax, 4
mov dword [ebx], edi
dec edx
jne 0x404f28
mov ebx, dword [ecx + esi*4]
mov dword [ebx], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret