joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102c8b9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push ebx
push 0x1029144
push 0x1029050
push 0x80000001
mov dword [ebp - 4], ecx
call dword [sym.imp.SHLWAPI.dll_SHOpenRegStream2W]
mov esi, eax
cmp esi, ebx
je 0x102c948
push edi
xor eax, eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_IStream_Read]
test eax, eax
jl 0x102c941
cmp dword [ebp - 0x18], 0x14
jne 0x102c941
mov edi, dword [ebp - 4]
push dword [ebp - 0x14]
mov ecx, edi
call fcn.01029b32
test eax, eax
je 0x102c941
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
jne 0x102c941
cmp dword [ebp - 0xc], ebx
jbe 0x102c941
mov eax, dword [ebp - 8]
mov ecx, dword [esi]
push ebx
push ebx
push ebx
push eax
push esi
call dword [ecx + 0x14]
test eax, eax
jne 0x102c941
push esi
call dword [fcn.0102c95c]
mov dword [edi + 0x10], eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx + 0x10], ebx
pop esi
setne al
pop ebx
leave
ret 4

Function at 0x102ca81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10b00dc], 0
jne 0x102cad5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x102cae4
push dword [0x10b116c]
mov dword [0x10b00dc], 1
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102cad5
cmp dword [ebp - 8], 4
jne 0x102cad5
cmp dword [ebp - 0xc], eax
je 0x1051a61
xor eax, eax
cmp dword [0x10b00dc], 1
sete al
leave
ret
mov dword [0x10b00dc], 2
jmp 0x102cad5

Function at 0x102cc1a
Capabilities:
Identify system language via api
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cc64
push 0x102cc80
push 0x80000001
mov dword [ebp - 8], 2
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1051a7e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp word [ebp - 4], ax
jne 0x1051a7e
leave
ret
push esi
push 0x1065ac8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1051aa9
push 0x1051ab0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1051aa2
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
jmp 0x102cc5f
Function at 0x102ce8d
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10b0090]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetArgsW]
mov edx, eax
test edx, edx
je 0x102cebe
cmp word [edx], 0
jne 0x1051ea4
call fcn.010295c5
test eax, eax
je 0x1051ee7
call fcn.01029441
test eax, eax
jne 0x102cef0
call fcn.0102cefc
test eax, eax
jne 0x102cef0
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100204d
leave
ret
push 5
jmp 0x1051ee9
push 2
pop ebx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push edx
call fcn.0106a2af
test eax, eax
je 0x102cee0
push esi
push 4
pop ecx
mov edi, 0x100ef44
lea esi, [ebp - 0x14]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
pop esi
je 0x1051ed9
push 4
pop ebx
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x102cee0
push 2
pop ebx
jmp 0x102cee0

Function at 0x102cfa5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x102cff0
mov edi, 0x100f4a0
push edi
mov esi, 0x80000001
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, 2
je 0x1051f8f
cmp eax, 3
je 0x1051f8f
pop edi
pop esi
pop ebx
leave
ret
call fcn.01013129
test eax, eax
je 0x105200d
push 0x220
push 0
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x225
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x227
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
push 0x22c
push eax
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x1052004
and dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.0102efc5
test eax, eax
jne 0x1052011
mov eax, dword [ebp - 0xc]
xor ecx, ecx
inc ecx
test eax, eax
je 0x1051fff
cmp eax, ecx
je 0x1051fff
cmp eax, 0x10
je 0x1051fff
cmp eax, 0x11
jne 0x1052011
mov dword [ebp - 4], ecx
jmp 0x1052011
mov dword [ebp - 4], 1
jmp 0x1052011
and dword [ebp - 4], 0
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0x102cff0
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 4], 0
je 0x102cfe9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1043b20
push edi
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 2
pop ecx
cmp eax, ecx
je 0x1052058
cmp eax, 3
jne 0x102cfe9
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push 0x1043b20
push edi
push esi
mov dword [ebp - 0xc], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x102cfe9
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x1f5518ec
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x67983388
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x49b20b
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
pop ebx
leave
sub al, 0
int3
pop eax
add byte [ebx + 0x8bc8], cl
adc eax, 0x5e3248
sub byte [eax], al
xor dh, byte [ebx + 0xc]
cmp esi, dword [0x324c]
jne 0x49b1ac
mov al, 1
jmp 0x49b1c8
add al, al
mov dword [0x5e324c], esi
add byte [eax], al
dec eax
xor bl, byte [esi]
sub eax, 0
ja 0x49b229
je 0x49b205
sub esi, 0xb
add byte [eax], al
sub esi, 1
je 0x49b1ef
add dword [esp + 0x38], esi
add byte [ecx], al
je 0x49b1e4
cmp byte [eax], al
add dword [esp + edx - 0x7d], esi
out dx, al
add dword [ebp], esi
sub esi, 1
jne 0x49b1d5
add byte [eax], al
ror byte [edi], 0x85
test byte [eax], al
xchg ebp, eax
add al, ch
stosd dword es:[edi], eax
and dword [edx], 0xffffffe5
add al, al
jne 0xdeb261
call 0xe56c358d
and ch, 0xee
out dx, al
jg 0x49b177
inc ebp
pop ebp
test dword [eax - 0x4b], ebx
sbb bl, byte ds:[eax - 0x7b]
jecxz 0x49b1f7
test ebx, esp
add eax, 0x15fe127f
dec esi
jg 0x49b206
invalid
adc dword [esi], ebx
sub al, 0xdf
mov esi, 0x6d1b51cc
fistp qword [esi + 0x6d1b51cc]
insd dword es:[edi], dx
std
jl 0x49b1f9
dec ebx
and dword [ebp - 0x44], ebx
or eax, 0x7f3bddf3
cmp edi, dword [edi - 0x7f]
fist dword [edi - 0x7e369d1b]
cmc
inc ebp
jnp 0x49b1d4
invalid
jne 0x49b237
pop ebp
mov esp, 0x3bddf30d
cmp edi, dword [edi - 0x7f]
cmp edi, dword [edi - 0x7f]
fist dword [edi - 0x7e369d1b]
cmc
inc ebp
jnp 0x49b1d4
invalid
enter 0x1c75, 0x4a
dec edx
aas
dec esp
sbb ch, dl
jnp 0x49b211
test eax, 0xf05e4d8d
inc esp
and dword [ebx - 0x4e06e2d3], edi
mov ebx, 0xb1f91d2d
dec esi
adc cl, bh
and edx, dword [ecx - 9]
arpl word [edx + 0x64ac5f89], sp
mov dword [0x9d3df6d4], eax
pop edi
lodsb al, byte [esi]
mov dword fs:[0x9d3df6d4], eax
mov cl, 0x4a
dec esi
test byte [ebx + 3], al
inc ebp
pop es
mov dword [ecx], ebp
scasd eax, dword es:[edi]
je 0x49b1fa
adc eax, 0x8990b1f2
mov byte [0x54dc743c], al
int3
Function at 0x5278e8
Capabilities:
Encode data using xor

Disassembly:
sub byte [esi + 0x4b206899], 0xf6
xor bl, cl
xlatb
insb byte es:[edi], dx
jb 0x5278ef
inc esi
mov ecx, 0x8ee7288d
and byte [eax], cl
sub eax, 0xe439e771
jmp 0x527940
pop edi
mov eax, dword [0xf0552683]
sub eax, 0xaabb05a5
stosb byte es:[edi], al
test dword [ebx - 0x1c44e9e2], ebp
mov ah, dl
mov ebx, 0x4abddfe
jl 0x52794a
clc
out dx, al
popfd
stosb byte es:[edi], al
adc byte [ecx], al
sbb dword [eax + eax + 0x7371d7b3], ebx
pop eax
and al, 0x47
xchg ebp, eax
add al, 0x32
ror byte [ebx], 0xe4
out 0xcf, eax
clc
daa
jnp 0x52797f
lodsb al, byte [esi]
scasd eax, dword es:[edi]
clc
invalid
out dx, eax
xchg ebx, eax
sub al, 0xe4
ret

Function at 0x5815bd
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
inc edi
pushfd
loopne 0x5815df
aad 0x1e
hlt
mov cl, ah
scasb al, byte es:[edi]
mov byte [0x4359d47a], al
jp 0x581650
push 0x98f1e1c8
rcl ebp, cl
push ebx
xchg ebp, eax
inc edi
sbb ecx, dword [ebx]
imul ecx, dword [ebx - 0x1598ecdc], 0x2f41ce4f
ret 0xb5c6
js 0x58166a
xor dword [edx + eax], ecx
adc edx, esi
inc ebp
and dword [ebx + 0x47bf2e55], ecx
invalid
add byte [esi], ch
int3
Function at 0x5c27db
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx], al
je 0x5c27b4
sub esi, 1
jne 0x5c27a5
add al, al
jne 0xf12831
call fcn.0062ab5d
jmp 0x5c2831
add byte [eax], al
jne 0x5c2831
mov ecx, 0x89f08c
jmp 0x5c282c
xchg edx, eax
aaa
inc edi
dec esp
mov bh, 0x27
and eax, 0xbb07f70c
pop ss
stc
push edi
inc edi
jno 0x5c280f
and ch, byte [ebx - 0x40]
pop ecx
imul eax, eax, 0x59
sbb dword [edi - 0x789c6a39], esi
jne 0x5c283b
ja 0x5c279c
stosd dword es:[edi], eax
idiv byte [edx - 0x6b]
inc ecx
cdq
fild dword [0x679d3dad]
pop es
outsd dx, dword [esi]
fistp qword [eax - 0x3b]
mov dword [bx + 0x6e], 0x2d2724cd
or ebx, esp
xchg ebp, eax
mov edi, 0x28d27126
mov ebx, 0x1fc98605
xchg byte [esi - 0x6d], ah
and dword [edi + 0x44], 0xffffffd7
push es
invalid
int 0x24
daa
sub eax, 0xbf95e309
jno 0x5c27ec
sub bh, al
ret
test dword [ebp + 0x3f], 0xe63f27af
idiv byte [esi + eax*8 + 0x797c9d47]
aas
out 0xf6, al
mov esp, 0x7c9d47c6
jns 0x5c283a
push edi
inc ebx
fild word [esi]
jae 0x5c2866
test dword [ebx - 0x21], 0x97257306
xchg edi, eax
ja 0x5c28bf
adc eax, 0xd6e740b4
pop ds
adc edx, dword ss:[ebx + 5]
add eax, 0x7d6d8716
fist dword [ecx + 0x26]
sub ch, bh
pop ebp
imul byte [edx]
cmp eax, 0xa3c30d38
xor al, 3
mov al, byte es:[ebx - 0x2e]
sar byte [ecx + 0x127bf26b], 1
rcl al, cl
mov ecx, 0x127bf26b
sub bh, byte [edx + 0x267c676c]
jno 0x5c28c4
dec edi
mov dword [0xa66b3a67], eax
cmp edi, edi
xchg ecx, eax
ror byte [ebp + 0x20], 1
mov dword [0x961a574e], eax
and byte [ebx - 0x69e5a8b2], ah
push edi
sbb dl, byte [esi - 0x76986ca2]
sbb ah, bh
loope 0x5c2874
pop esi
xchg ebx, eax
mov dword [bp + si], ebx
out 0xe1, eax
out 0x41, eax
inc ecx
cmp bh, byte [esi + 0x19]
in eax, 0x6f
not dword [ecx - 0x6a]
push ss
xchg byte [esi + 0x3e], dh
jbe 0x5c2882
inc esi
shl dword [edi + 0x65257697], cl
xacquire xchg byte [esi], dl
and eax, 0x1686f265
lds ebx, [ebx - 0x1d]
jae 0x5c28a1
imul eax, esi, 0x63
out 0x7b, eax
inc edx
mov dword [0x9606a665], eax
push ebx
aad 0xf5
mov edx, 0xc68df552
cdq
movzx ebp, ch
mov dh, 0x56
xchg ebp, eax
sbb ecx, dword [ebx - 0x345d0abb]
mov edx, ebx
add eax, 0xb6251da3
jg 0x5c287f
sub dword [ecx + 0x13], esi
xchg ebp, eax
xor eax, 0x19f9a670
shl dword [ebp - 0x3d], cl
mov ebx, 0x9c726575
test dword [esi - 8], esp
salc
push es
xor bh, byte [ebx - 0x61]
rcl edx, cl
jge 0x5c28de
ret
outsb dx, byte [esi]
cmpsb byte [esi], byte es:[edi]
push es
shl dword [edx], cl
pop eax
sbb esp, dword [esp + edx*2 - 0x7a33f4a3]
aad 5
retf 0xf3c9
Function at 0x6154bd
Capabilities:
Encode data using xor

Disassembly:
cmp al, byte [ebp - 0x72]
aam 0xcb
sub dword [ebx + 0x3b], esi
aaa
adc al, dl
mov eax, 0xebfae940
mov ah, 0xa
dec eax
dec edi
mov ah, 0x75
fdivr qword [eax + 0x64]
xchg ecx, eax
dec ecx
cdq
xchg ecx, eax
jb 0x615483
salc
aam 0x14
test dword [esp + ecx - 0x1e5ed09f], ebp
sbb byte [ebx + 0x646479e2], ch
dec eax
dec eax
inc ebp
wait
mov ch, 0x10
mov bl, 0x2e
mov esi, 0x39dbaf42
inc edx
scasd eax, dword es:[edi]
fstp xword [ecx]
add edi, eax
aam 0xdd
movsb byte es:[edi], byte [esi]
pushfd
xchg ebx, eax
aad 0x3f
and al, 0xef
push ebp
cmp al, byte [eax + ecx]
out 0x76, al
mov esp, esp
sub dword [0x947344be], ebp
je 0x61544b
push esi
ficom word [ebx + eax*4 + 0x24e41a86]
lodsd eax, dword [esi]
adc al, 0x79
push eax
mov dword [ecx + edi*2 - 0xd982496], eax
cmp ecx, ebx
push ecx
jns 0x61545f
popal
xor byte [ebx], al
add ebx, dword [eax]
dec edx
mov ah, 0xdf
add ebx, dword [eax]
dec edx
mov ah, 0xdf
aam 0x64
out 0xd7, al
loopne 0x61545b
jbe 0x61552b
mov dl, 0x2a
test byte [eax + 0x14b55dd2], dh
xor al, byte [ebx]
or byte [edi + 0x208865a3], cl
les edi, [esi + 0x12]
add al, 0x7e
les esp, es:[esi - 0x2fe5ec58]
adc al, 0x43
or esp, dword [esp - 0x2a180d8d]
movsb byte es:[edi], byte [esi]
add byte [edi + 0x3f], al
dec eax
xor byte [edx - 0x554da41b], 0x76
sub byte [ecx], al
retf
mov ch, 0x94
cmc
aam 0xc6
mov ecx, 0x357966a1
fnstenv [ecx]
mov ah, 0x76
push esp
pop ecx
pop esi
or al, 0x45
inc ebp
xor esp, ebp
pop ecx
mov esp, 0x7cc24274
jge 0x61553e
hlt
Function at 0x63327d
Capabilities:
Encode data using xor

Disassembly:
pop edi
cli
xchg esp, eax
mov byte [eax], dl
je 0x6331e3
adc byte [ecx + edx*2 + 0x48], dh
dec eax
push 0x7a
fcom qword [0x110209e5]
pop ebx
js 0x6331a6
stc
cdq
movsb byte es:[edi], byte [esi]
mov ch, 0x44
add al, 0xbb
xchg ebx, eax
pop es
invalid
sbb ch, al
mov ebp, 0x9ae7785d
or al, 0x42
add bl, byte [0x858af05b]
aam 0x86
stc
jle 0x63318f
mov dword [esi + ecx*2], esi
test ch, cl
dec eax
and byte fs:[ebp - 0x33], dl
mov esp, 0xa0ad0952
mov al, byte [0x4148c25b]
sar byte [ebx + 0x5060e985], 0x14
add byte [eax - 0x67d8414c], 0x94
rol esi, 1
sub byte [esi], dh
push es
xor ch, 0x10
adc al, 0x66
scasb al, byte es:[edi]
jle 0x63318b
jmp 0x82778248
int3
jns 0x6331b7
xor dword [eax - 0x5f], edx
jle 0x63327c
adc eax, 0x44ab4768
pop ebp
push ebp
test ah, ah
ret
inc byte [ebx - 0x79b69c25]
or dword [ecx - 0x2bc84a9a], eax
mov eax, dword [0x4fd16c4]
and eax, 0x3b3ee573
mov edx, 0xb4588886
push edi
push esp
lahf
popfd
jmp 0x633293
rcl dword [esi], cl
jecxz 0x633211
je 0x633222
stosd dword es:[edi], eax
dec ebx
js 0x63326d
retf 0x19f0
movsd dword es:[edi], dword [esi]
test al, 0x26
or edi, dword [ecx + 0x59]
aam 0x69
mov ecx, 0x655a7b82
jmp 0x633249
lds esi, [ebx - 0x17]
aas
pop ebx
pop ebx
adc dword [ebx + 0x2c], ebx
invalid
aam 0xa6
cmpsb byte [esi], byte es:[edi]
loope 0x63325c
movsd dword es:[edi], dword [esi]
pop ecx
mov bl, 0xd1
sub esp, eax
rol dword [esi - 0x660a161d], 1
jecxz 0x633273
cmc
cdq
sbb ebx, edx
leave
pop ss
mov eax, 0x58e28234
loop 0x6332ed
adc al, 0x73
imul esp, dword [esi], 0xba738892
test dword [edx], ecx
dec edx
pop esp
push ebx
test al, 0x60
mov byte [0xe7842988], al
call 0xfa1b55b0
cmpsb byte [esi], byte es:[edi]
sub eax, eax
xor al, 0x58
and eax, 0x7f5a7a04
and eax, 0xc4764571
sahf
pop eax
mov eax, 0xc109214b
xchg ecx, eax
mov ch, 0x91
sahf
inc ecx
pop edx
adc eax, 0xcb327914
xor esi, dword [esi]
and al, 0x7e
mov al, 0x1d
add al, 0x1e
je 0x633281
salc
push ecx
int1
jnp 0x633288
out 0x43, eax
scasb al, byte es:[edi]
or al, 0xa5
shl esp, 0x51
hlt
sahf
invalid
Function at 0x42b2bb
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042ae0e

Function at 0x42fdfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042faad

Function at 0x42fe07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042fc37

Function at 0x430002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp int.00401219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x4b2d3e7d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data_1
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2c955b32
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x402a7b
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.0040ccc0
mov eax, dword [0x2a9f420]
mov ecx, dword [0x2a9e374]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x402b58
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x2a9f420], 0x959
jne 0x402b46
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
lea eax, [ebp - 0xc00]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push esi
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.0040288d
add edi, 8
dec ebx
jne 0x402aa7
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4060f4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a510]
jne 0x4060fe
repz ret
jmp fcn.004093bf

Function at 0x4089bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040449e
and dword [ebp - 4], 0
cmp dword [0x42bcf4], 0
mov ebx, eax
jne 0x408a70
push 0x401afc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408b21
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401af0
push edi
call esi
test eax, eax
je 0x408b21
push eax
call fcn.0040442c
mov dword [esp], 0x401ae0
push edi
mov dword [0x42bcf4], eax
call esi
push eax
call fcn.0040442c
mov dword [esp], 0x401acc
push edi
mov dword [0x42bcf8], eax
call esi
push eax
call fcn.0040442c
mov dword [esp], 0x401ab0
push edi
mov dword [0x42bcfc], eax
call esi
push eax
call fcn.0040442c
pop ecx
mov dword [0x42bd04], eax
test eax, eax
je 0x408a70
push 0x401a98
push edi
call esi
push eax
call fcn.0040442c
pop ecx
mov dword [0x42bd00], eax
mov eax, dword [0x42bd00]
cmp eax, ebx
je 0x408ac8
cmp dword [0x42bd04], ebx
je 0x408ac8
push eax
call fcn.004044a7
push dword [0x42bd04]
mov esi, eax
call fcn.004044a7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408ac8
test edi, edi
je 0x408ac8
call esi
test eax, eax
je 0x408abf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408abf
test byte [ebp - 0xc], 1
jne 0x408ac8
or dword [ebp + 0x10], 0x200000
jmp 0x408b01
mov eax, dword [0x42bcf8]
cmp eax, ebx
je 0x408b01
push eax
call fcn.004044a7
pop ecx
test eax, eax
je 0x408b01
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408b01
mov eax, dword [0x42bcfc]
cmp eax, ebx
je 0x408b01
push eax
call fcn.004044a7
pop ecx
test eax, eax
je 0x408b01
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42bcf4]
call fcn.004044a7
pop ecx
test eax, eax
je 0x408b21
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408b23
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403701
Capabilities:
Terminate process

Disassembly:
jmp 0x45aab3
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x45aac4
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405b4b
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x403832
Capabilities:
Query environment variable

Disassembly:
jmp 0x497b0d
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x497b1e
pop esi
ret
push ebx
push edi
push esi
call fcn.004979f4
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0040412e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x497b46
push ebx
push esi
push edi
call fcn.00405925
add esp, 0xc
push 0
call fcn.00406514
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x4059f7
Capabilities:
Parse pe header

Disassembly:
jmp 0x41cbc8
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41cc07
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41cc07
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41cc07
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41cc07
cmp dword [ecx + 0x74], 0xe
jbe 0x41cc07
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret