joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45661c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4567c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4567a8
mov dl, 1
mov eax, dword [0x4188f8]
call fcn.004037d4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404570
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x456797
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00443e8c
test al, al
je 0x45678a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x4567d8
lea eax, [ebp - 0x254]
call fcn.004095e0
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x45678a
xor eax, eax
push ebp
push 0x456783
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456810
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x45676c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047d8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x45676c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004047d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45678a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x45668d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.0041ca90
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4567ce
lea eax, [ebp - 0x260]
call fcn.00404570
ret

Function at 0x4570fc
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46ec00]
cmp byte [eax + 0xa5], 0
jne 0x45716d
cmp dword [0x46ec18], 0
jne 0x45712e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4570b8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46ec18], eax
cmp dword [0x46ec14], 0
jne 0x457149
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46ec14], eax
cmp dword [0x46ec1c], 0
jne 0x45716d
push esp
push 0
push 0
push 0x45705c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46ec1c], eax
pop edx
ret
Function at 0x457264
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45727b
add esp, 0xfffffff0
call fcn.00403b68
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004225dc
mov eax, dword [0x46d14c]
cmp word [eax + 2], 0
jne 0x4572a3
mov eax, dword [0x46d14c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458898
mov eax, dword [0x46d1e8]
cmp word [eax + 2], 0
jne 0x4572bd
mov eax, dword [0x46d1e8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458a90
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x418408]
call fcn.004037d4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x418408]
call fcn.004037d4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x424a6c]
call fcn.0042c6f0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x457444
mov eax, dword [0x46d074]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042cac0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459000
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46d074]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040ce4c
test eax, eax
je 0x4573b2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f20
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040ce74
test eax, eax
je 0x4573c6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004047d8
mov eax, dword [0x46cf48]
cmp byte [eax], 0
jne 0x4573fa
mov eax, ebx
call fcn.0045756c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.004591dc
mov eax, ebx
call fcn.00459b8c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45743a
call fcn.00403bc0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4577e0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46ec00]
cmp dword [eax + 0x30], 0
je 0x45788a
cmp dword [ebx + 0x94], 0
jne 0x457884
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x457770
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457884
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45784a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457884
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041aaa8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457859
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458368
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45839d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404660
jmp 0x4583aa
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004045c4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4593b8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4593f9
mov eax, esi
call fcn.0043f754
test al, al
je 0x4593f9
mov eax, dword [ebx + 0x84]
call fcn.0043f450
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4593f9
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043f450
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45a0a4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x417ad8]
call fcn.00404f4c
xor eax, eax
push ebp
push 0x45a1e8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x46cdf8], 0
jne 0x45a0f7
mov ecx, dword [0x46cf58]
mov dl, 1
mov eax, dword [0x4079d0]
call fcn.0040c210
call fcn.00403fd0
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402fb4
mov eax, ebx
call fcn.00404dbc
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x45a1f8
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.004062cc
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404dcc
test eax, eax
jle 0x45a18f
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x45a188
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.004047f0
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.004047d8
mov eax, dword [ebp - 0x48]
pop edx
call fcn.004087d0
test eax, eax
jne 0x45a188
mov ebx, 0x15
jmp 0x45a194
mov ebx, 0x10
jmp 0x45a194
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x46cdf8]
call fcn.00459ffc
mov eax, dword [ebp - 8]
call fcn.00459ffc
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004062e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a1ef
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404594
lea eax, [ebp - 0x10]
mov edx, dword [0x417ad8]
call fcn.0040501c
ret

Function at 0x469e98
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe88
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00404a10
xor eax, eax
push ebp
push 0x469f9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x178], 0x46464952
mov dword [ebp - 0x174], 0x24
mov dword [ebp - 0x170], 0x45564157
mov dword [ebp - 0x16c], 0x20746d66
mov dword [ebp - 0x168], 0x10
mov word [ebp - 0x164], 1
mov word [ebp - 0x162], bx
mov dword [ebp - 0x160], edi
movzx edx, bx
imul edx, edi
movzx eax, si
shr eax, 3
imul edx, eax
mov dword [ebp - 0x15c], edx
imul bx
mov word [ebp - 0x158], ax
mov word [ebp - 0x156], si
mov dword [ebp - 0x154], 0x61746164
xor eax, eax
mov dword [ebp - 0x150], eax
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x14c]
call fcn.00402d84
mov edx, 0x2c
lea eax, [ebp - 0x14c]
call fcn.004030dc
call fcn.004028f8
lea edx, [ebp - 0x178]
lea eax, [ebp - 0x14c]
call fcn.004031b4
call fcn.004028f8
lea eax, [ebp - 0x14c]
call fcn.00402e4c
call fcn.004028f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469fa6
lea eax, [ebp + 8]
call fcn.00404570
ret
Function at 0x41a0d8
Capabilities:
Encode data using xor

Disassembly:
sub eax, eax
dec eax
jmp 0x41a0e0
mov ecx, 0xf1b3
inc edi
inc edi
imul ecx, edx
xor byte [edi - 2], cl
sub byte [edi - 2], dh
xchg ecx, edx
xchg dh, dl
sub eax, 0xfffffff9
dec edi
cmp eax, 0x2caa0
jbe 0x41a0e0
inc ch
add al, 0

Function at 0x41c5cc
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [ebp + 0xd277904], 0x8088405
inc edx
mov dword [ebp + 0xd277904], edx
mul edx
ret

Function at 0x41c9ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push esi
push edi
xor ecx, ecx
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x100]
lodsb al, byte [esi]
or al, al
je 0x41c9d5
inc ecx
test cl, 3
je 0x41c9d2
shl eax, 8
jmp 0x41c9c2
stosd dword es:[edi], eax
jmp 0x41c9c2
mov al, pe_nt_image_headers32
push ecx
inc ecx
test cl, 3
je 0x41c9e3
shl eax, 8
jmp 0x41c9d8
stosd dword es:[edi], eax
xor eax, eax
jmp 0x41c9ec
stosd dword es:[edi], eax
add ecx, 4
cmp ecx, 0x3c
jb 0x41c9e8
pop eax
shl eax, 3
stosd dword es:[edi], eax
sub ecx, 0xc
mov eax, dword [edi - 0x3c]
push ecx
mov ecx, eax
mov edx, eax
ror eax, 7
ror ecx, 0x12
shr edx, 3
xor eax, ecx
xor eax, edx
push eax
mov eax, dword [edi - 8]
mov ecx, eax
mov edx, eax
ror eax, 0x11
ror ecx, 0x13
shr edx, 0xa
xor eax, ecx
xor eax, edx
add dword [esp], eax
pop eax
add eax, dword [edi - 0x40]
pop ecx
add eax, dword [edi - 0x1c]
stosd dword es:[edi], eax
loop 0x41c9f9
call int.0041ca56
out 9, al
push 0xffffffffffffff85
scasb al, byte es:[edi]
mov ebx, 0x3c6ef372
cmp dh, ch
dec edi
movsd dword es:[edi], dword [esi]
jg 0x41ca9a
push cs
push ecx
mov word [eax + 5], gs
wait
stosd dword es:[edi], eax
fld dword [ebx - 0x1f32e6e1]
pop ebx
invalid
Function at 0x30030e08
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x30034158
call fcn.3003107e
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x3006bf28
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x30030bf8
cmp eax, esi
jne 0x30030beb
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x30030bfb
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x30030bd2
xor esi, esi
inc esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c0e
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x30030c49
mov eax, dword [0x3006bf24]
test eax, eax
jne 0x30030c43
mov dword [0x3006bf24], esi
push 0x30001378
push 0x3000136c
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x30030c49
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x30030d20
mov dword [0x3006bbd0], esi
mov eax, dword [0x3006bf24]
cmp eax, esi
jne 0x30030c6d
push 0x30001368
push 0x30001350
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x3006bf24], 2
cmp dword [ebp - 0x1c], ebx
jne 0x30030c7a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x3006bf34], ebx
je 0x30030c9b
push 0x3006bf34
call fcn.3003143c
pop ecx
test eax, eax
je 0x30030c9b
push ebx
push 2
push ebx
call dword [0x3006bf34]
mov eax, dword [0x3006bbb8]
mov ecx, dword [sym.imp.MSVCR80.dll___winitenv]
mov dword [ecx], eax
push dword [0x3006bbb8]
push dword [0x3006bbbc]
push dword [0x3006bbb4]
call fcn.3001c6cd
add esp, 0xc
mov dword [0x3006bbcc], eax
cmp dword [0x3006bbc0], ebx
jne 0x30030d06
push eax
call dword [sym.imp.MSVCR80.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR80.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x3006bbd0], ebx
jne 0x30030d14
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x3006bbcc]
call fcn.300310c3
ret
call fcn.300fc000
jmp 0x30030bb0

Function at 0x30031694
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push dword [ebp + 0xc]
xor esi, esi
push dword [ebp + 8]
inc esi
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x300316c2
xor eax, eax
jmp 0x300316ea
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push 0
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x300316df
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x300316ef
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret 4
Function at 0x281ec60
Capabilities:
Encode data using xor

Disassembly:
adc eax, esp
sar byte [edx + 0x18], 9
mov ch, 0x5f
test eax, 0x1128c2e
mov eax, 0x8d36b243
pop edx
add dword [ebp + 0x25679d5b], 4
sub dword [esi + 0x200ef4d9], esi
cdq
insb byte es:[edi], dx
cmc
test byte [ebx], 0xed
cdq
xor byte [edx - 0x29cfa50a], cl
invalid

Function at 0x28225d0
Capabilities:
Encode data using xor

Disassembly:
and ah, bh
sbb al, 0xc1
insd dword es:[edi], dx
and byte [edi], dh
scasd eax, dword es:[edi]
test byte [0x4efdbf2d], dh
fld qword [eax]
add cl, byte [edx]
lds ebx, [edx - 0x3a099485]
mov dword [0x3a940f7e], eax
dec esp
push ds
mov bh, 0x39
pop ds
invalid

Function at 0x2824810
Capabilities:
Encode data using xor

Disassembly:
lahf
rcr byte [eax - 0x44], 1
mov esp, dword [esi]
and eax, 0x88ec7705
adc byte [esi + 0x7ece3874], ah
cmp byte es:[edi + 0x66], ah
and bh, dl
ja 0x28247bb
js 0x2824841
clc
adc esi, ebx
out 0x72, ax
out 0x72, ax
movsb byte es:[edi], byte [esi]
mov esi, 0xc671e245
ror dword [ecx + 0x3c], 0x2a
sbb dh, byte [eax + 0x40]
xor edx, dword [ebp - 0x5084609f]
dec ecx
mov byte [0x8ed72703], al
jbe 0x282481b
dec edi
adc dword [edi + 0x4977f1bf], esp
sbb dl, byte [eax - 0x79]
int 0xff
pop esp
in al, dx
push ebp
push eax
xchg ebp, ecx
call [esp + ebp*8 + 0x55]
fist dword [ebp + 0x58]
jl 0x2824805
movsb byte es:[edi], byte [esi]
mov dl, 0xe0
and esi, dword [ebp - 0x52ce6c95]
sbb dword [edx + 0x13], ebx
xchg ebx, eax
test byte [esi - 0x1488769a], cl
sti
mov ch, 0x20
mov byte [0x38df2fa5], al
push eax
dec edx
in eax, 0xcd
dec eax
loop 0x28248ba
outsd dx, dword [esi]
ret
sub byte [edi + 0xe1a72b4], al
dec ecx
in eax, dx
int 0x92
cmp bl, byte [ebx - 0x45eceb35]
aam 0xeb
dec eax
stosb byte es:[edi], al
ffree st(4)
arpl ax, bx
wait
out dx, eax
in al, 0xfd
pextrw ebp, mm6, 0x83
mov ch, 0x11
cmp esp, ecx
sub eax, 0xfe383fb6
xchg byte [esi], bh
inc edx
cmp esi, dword [eax + eax*2]
fimul dword [edi + 0x7fdbe5e8]
invalid

Function at 0x2825080
Capabilities:
Encode data using base64

Disassembly:
ret 0x32c2
out 0xc1, eax
fldenv [eax + edx*2]
sahf
inc ebx
mov byte [0x5b8be4f], al
idiv byte [eax + 0x12]
adc eax, 0xc0be1b39
invalid
pop eax
bound ebp, qword [0xdd90f50d]
cld
sahf
pop es
jp 0x2825030
push ds
mov ebx, ss
cmpsd dword [esi], dword es:[edi]
dec ecx
inc eax
sub byte [ecx + 0x43], bh
scasb al, byte es:[edi]
mov al, byte [0x3d4fce1a]
cmp dword [eax], edx
and ch, byte [edi]
ja 0x2825029
mov ah, 0x60
scasd eax, dword es:[edi]
invalid
Function at 0x2825100
Capabilities:
Encode data using base64

Disassembly:
out 0xaa, eax
cmpsb byte [esi], byte es:[edi]
cwde
push esi
mov byte [0xeb8809c], al
stc
int 0x2c
rol dword [ecx + 0x4a], 1
push edx
cmp esi, dword [eax + 0x4b]
test eax, 0xe9f2d88e
inc ebp
in al, 1
sal eax, cl
out dx, al
xchg ecx, eax
cmp byte [eax], bl
in al, 0xbd
cli
add dword [ebp - 0x73157ece], edi
add ch, byte [edi + 0x46]
mov ecx, 0xe9853916
aas
push edi
bound ecx, qword [ebx - 0x79]
inc eax
pop esp
push ss
cmp dword [ebp + 0x62573fe9], eax
dec ebx
xchg dword [eax + 0x5c], eax
clc
jbe 0x2825140
mov fs, esi
sahf
mov ch, 0x39
dec esi
xchg dword [ebp - 0x2b], esi
dec ecx
test al, 0x9f
xor byte [edi + 0x37], 0x15
mov eax, dword [0xcd27beec]
sbb al, byte [edi]
shr dword [edx], cl
jb 0x28250d1
push eax
xchg edi, eax
push eax
fsubp st(0)
mov al, byte [0x7295336e]
adc esp, esi
fsub dword [edi - 0x72]
jbe 0x28250c6
xchg ebp, eax
jb 0x282513c
out 0xd8, al
invalid
mov esp, 0x91b64e94
leave
jae 0x28250e2
invalid
shl dword [esi - 0x72], cl
pushal
and dword [edi], esi
inc dword [ebx + 0x258dbd79]
xchg ebp, eax
sbb bh, byte [edx - 0x199534ef]
popfd
and ebx, ecx
jb 0x28250f5
lds ecx, [edi - 0x34d2f49]
sbb edi, esp
dec ebp
push ebx
imul esp, dword [edi + 0x3e5c05b3], 0xffffff9c
scasd eax, dword es:[edi]
cld
pop ebp
jb 0x28251e8
and byte [ebx - 0x2e], 0x18
loopne 0x2825126
mov dh, 0x39
mov bl, ch
salc
adc al, 0x48
cmp dword [eax + 0x14d63eeb], ecx
dec eax
out dx, eax
outsb dx, byte [esi]
jo 0x282518e
jp 0x282516f
jge 0x2825154
test al, 0x4e
movsb byte es:[edi], byte [esi]
sub eax, 0x5efae4bf
invalid
or byte [eax + ebx*2 - 0x74726393], dl
and dh, byte [ebx + 0x341b0271]
pushfd
and ch, byte [edx + esi*4 - 0x6d3e67bb]
or eax, 0xaceeac3f
lodsb al, byte [esi]
mov dl, 0x45
cwde
rcl dword [edx - 0x1153c0f3], 0xac
add dl, byte [0x6d7f037]
mov al, 0xc8
call 0xeaf590cb
enter 0x16e8, 0x3f
jae 0x282519d
loop 0x28251f0
test al, 0x54
in al, dx
pop es
in al, dx
dec esi
jecxz 0x28251f0
adc ecx, dword [eax]
fcompi st(2)
mov ebx, 0xd0227f42
adc edi, ebp
sub ecx, dword [edx + 0x42229951]
jb 0x282524b
invalid
sub byte [edi + 0x4b59851f], al
retf 0x42f7
xchg dword [ebp + 0xc3ee999], eax
jp 0x28251b5
test byte [edx + 0x71ab3f32], cl
test al, 0x14
insb byte es:[edi], dx
out dx, al
mov esp, 0xa17b13e
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
mov dh, 0xd7
in al, 0x3c
inc ecx
cmp al, 0x65
inc ecx
add ecx, edx
jp 0x2825217
jnp 0x28251d8
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
dec byte [ecx]
push ebx
daa
aam 0x52
scasb al, byte es:[edi]
fdivr st(1), st(0)
int1
fnsave dword [edx - 0x23]
loopne 0x2825204
dec ebp
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
jp 0x2825212
add eax, 0x7eb6679f
in al, 0xa3
jnp 0x28251af
mov bl, al
cmp dword [esi], esi
mov bh, 0xd7
wbinvd
movsb byte es:[edi], byte [esi]
pop ecx
add dword [edi + 0x2527c839], eax
invalid
mov dword [0x42888ad3], eax
in eax, dx
add al, 0xa2
mov bl, 0x3d
invalid
Function at 0x28273d0
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx], edi
stosb byte es:[edi], al
sbb eax, 0xc61096dd
mov ebp, dword [ecx + esi*2 + 0x49b508cf]
fidivr dword [edi]
rol edx, cl
arpl word [edi - 0x24], sp
inc ebx
push edx
push edx
push edx
mov al, byte [ecx + 0x79e414b0]
jnp 0x28273e4
inc esp
fisub dword [ebx]
jbe 0x28273b8
jnp 0x2827448
insd dword es:[edi], dx
mov dword [eax + eax*2 - 0x1b], ecx
and dword [edx], esi
invalid
in eax, 0x21
xor al, ah
aad 0x27
sub cl, bh
mov esi, 0x70943436
invalid
cmp al, 0xea
jp 0x282741f
adc al, 0xe
outsd dx, dword [esi]
test al, 2
xchg ebx, eax
dec edx
fild qword [0x42722fe6]
pop eax
invalid
insd dword es:[edi], dx
cmp al, 0xf8
std
hlt
and esi, dword [ebp + eax*8 - 7]
aaa
cdq
jle 0x2827406
sub al, dh
mov byte [0x33f4030f], al
aas
sahf
sbb al, 0x2b
mov dx, 0xb8c6
mov byte [eax + 0x12c47a27], 0xd3
invalid
Function at 0x401000
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x104
lea eax, [esp]
push edi
push str.._setup.ini
push 0x104
push eax
push 0x40a534
push str.setupexe
push str.defines
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x401065
lea ecx, [esp]
push 0x104
lea edx, [esp + 4]
push ecx
push edx
push str.._setup.ini
call fcn.00401820
add esp, 0x10
lea eax, [esp]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
xor eax, eax
add esp, 0x104
ret

Function at 0x401140
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x108
lea ecx, [esp]
push str.wh_autorun_mtx
call fcn.004017d0
lea ecx, [esp]
call fcn.00401800
test eax, eax
jne 0x4011f2
mov eax, dword [esp + 0x10c]
push 0x40a944
push str.._setup.ini
mov dword [0x40a530], eax
call fcn.00401fc0
add esp, 8
test eax, eax
je 0x4011ed
push edi
push str.._setup.ini
lea ecx, [esp + 0xc]
push 0x104
push ecx
push 0x40a534
push str.installed
push 0x408160
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x4011ed
call fcn.00401070
lea edx, [esp + 4]
push 0x104
lea eax, [esp + 8]
push edx
push eax
push str.._setup.ini
call fcn.00401820
add esp, 0x10
lea ecx, [esp + 4]
push 5
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x4011f2
call fcn.00401000
lea ecx, [esp]
call fcn.004017f0
xor eax, eax
add esp, 0x108
ret 0x10

Function at 0x401270
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
jne 0x4012a3
add esp, 0x94
ret
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x40132b
dec eax
je 0x4012ec
dec eax
je 0x4012bb
xor eax, eax
add esp, 0x94
ret
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x4012d0
mov eax, 0x4a
add esp, 0x94
ret
cmp eax, 5
jne 0x4012b2
mov edx, dword [esp + 8]
xor eax, eax
test edx, edx
setne al
add eax, 0x7d0
add esp, 0x94
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
cmp eax, 4
jb 0x40130a
cmp ecx, 0x5a
jb 0x40130a
mov eax, 0x63
add esp, 0x94
ret
cmp eax, 4
jne 0x40131f
test ecx, ecx
jbe 0x40131f
mov eax, 0x62
add esp, 0x94
ret
mov eax, 0x5f
add esp, 0x94
ret
mov eax, 0x20
add esp, 0x94
ret