joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44924c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x4492e8
push 0
mov eax, ebx
call fcn.00407ba8
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x4492c3
mov ebx, esi
test ebx, ebx
je 0x449295
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00407ba8
push eax
push 1
push 0
mov eax, edi
call fcn.00407ba8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x4492de
mov ecx, dword [0x457a2c]
mov dl, 1
mov eax, dword [0x447590]
call fcn.0041ecd4
call fcn.0040674c
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x44bc18
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040a29c
xor eax, eax
push ebp
push 0x44bd52
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
call fcn.004491b4
xor eax, eax
push ebp
push 0x44bd22
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
movzx ebx, word [eax + 0x30]
dec ebx
test ebx, ebx
jl 0x44bd07
inc ebx
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
call fcn.004491b4
mov eax, dword [ebp - 0x1c]
and eax, 2
cmp eax, 2
jne 0x44bcff
mov eax, dword [ebp - 0x1c]
and eax, 1
dec eax
jne 0x44bcff
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x20]
call fcn.004491b4
lea eax, [ebp - 8]
call fcn.0040a228
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x38]
call fcn.004491b4
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.004491b4
lea eax, [edi + 4]
mov edx, dword [ebp - 8]
call fcn.0040a240
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0044bb80
inc esi
dec ebx
jne 0x44bc7a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bd29
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x4c]
ret
Function at 0x44f1f0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040702c
xor eax, eax
push ebp
push 0x44f2df
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
call fcn.00407ba8
mov edi, eax
push edi
call sub.version.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x44f2c9
mov eax, esi
call fcn.004044cc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x44f2c2
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
push esi
push 0
push edi
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x44f2f4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp - 8]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xc]
mov edx, eax
shr edx, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edx
and eax, 0xffff
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f2c9
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.004044e8
mov bl, 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44f2e6
lea eax, [ebp - 4]
call fcn.00406f48
ret

Function at 0x44fcc8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffe4
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x44fd10
push 1
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
call sub.user32.dll_PeekMessageW
test eax, eax
je 0x44fd02
push esp
call sub.user32.dll_TranslateMessage
push esp
call sub.user32.dll_DispatchMessageW
push 1
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, esi
cmp edi, ebx
jg 0x44fce0
add esp, 0x1c
pop edi
pop esi
pop ebx
ret

Function at 0x450c48
Capabilities:
Encrypt data using rc6

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
lea edx, [esp + 4]
mov eax, dword [0x45d0bc]
mov ecx, 0x40
call fcn.00404670
mov dword [0x45d008], 0xb7e15163
mov ebx, 0x2b
mov eax, 0x45d008
mov edx, dword [eax]
add edx, 0x9e3779b9
mov dword [eax + 4], edx
add eax, 4
dec ebx
jne 0x450c76
xor ebx, ebx
xor edi, edi
xor esi, esi
xor ebp, ebp
mov dword [esp], 0x84
mov eax, dword [ebx*4 + 0x45d008]
add eax, esi
add eax, ebp
mov edx, 3
call fcn.00450af4
mov esi, eax
mov dword [ebx*4 + 0x45d008], esi
lea edx, [ebp + esi]
mov eax, dword [esp + edi*4 + 4]
add eax, esi
add eax, ebp
call fcn.00450af4
mov ebp, eax
mov dword [esp + edi*4 + 4], ebp
lea eax, [ebx + 1]
mov ecx, 0x2c
cdq
idiv ecx
mov ebx, edx
inc edi
and edi, 0x8000000f
jns 0x450ce6
dec edi
or edi, 0xfffffff0
inc edi
dec dword [esp]
jne 0x450c96
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x450d70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov eax, dword [0x45d0b4]
sub dword [ebx + 8], eax
mov eax, dword [0x45d0b0]
sub dword [ebx], eax
mov esi, 0x14
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 8]
mov dword [ebx + 0xc], edx
mov edx, dword [ebx + 4]
mov dword [ebx + 8], edx
mov edx, dword [ebx]
mov dword [ebx + 4], edx
mov dword [ebx], eax
mov eax, dword [ebx + 0xc]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00450af4
mov ebp, eax
mov eax, dword [ebx + 4]
mov edx, eax
add eax, eax
inc eax
imul edx, eax
mov eax, edx
mov edx, 5
call fcn.00450af4
mov edi, eax
mov eax, dword [ebx + 8]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x45d00c]
mov edx, edi
call fcn.00450b14
xor eax, ebp
mov dword [ebx + 8], eax
mov eax, dword [ebx]
mov edx, esi
add edx, edx
sub eax, dword [edx*4 + 0x45d008]
mov edx, ebp
call fcn.00450b14
xor edi, eax
mov dword [ebx], edi
dec esi
test esi, esi
jne 0x450d8a
mov eax, dword [0x45d00c]
sub dword [ebx + 0xc], eax
mov eax, dword [0x45d008]
sub dword [ebx + 4], eax
mov al, 1
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100046cb
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000470a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000470a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000470a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000470a
cmp dword [ecx + 0x74], 0xe
jbe 0x1000470a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10007469
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10007506
push ebx
push esi
call fcn.10007432
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100073c6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100074b3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007505
push edi
push eax
call fcn.10008424
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100074d3
call fcn.10005f90
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10007504
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100073c6
add esp, 0x20
test eax, eax
jne 0x100074f2
push edi
call fcn.10005f90
jmp 0x100074fa
push ebx
call fcn.10005f90
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10007773
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f9d8
push 0x1000f9d0
push str.FlsAlloc
push 0x1f
call fcn.1000768f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100077a7
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e128]
call esi
jmp 0x100077ad
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x100077f1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f9e8
push 0x1000f9e0
push str.FlsGetValue
push 0x21
call fcn.1000768f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10007828
push dword [ebp + 8]
mov ecx, esi
call dword [0x1000e128]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10007830
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1000f9f0
push 0x1000f9e8
push str.FlsSetValue
push 0x22
call fcn.1000768f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000786a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1000e128]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1000d2a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000d2cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000d2cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x414ddb
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [edx], eax
sub edi, 1
dec ebx
add edx, 4
cmp edx, ecx
jne fcn.00414ddb
add ebx, 0xa34c4204
add edi, ebx
ret

Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748
Function at 0x402ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
inc edi
rol edx, 0xf6
not esi
rcl eax, 0x74
mov edi, 0xd
sub edx, 0x2c
dec edi
inc ebx
sbb edi, 0xf1
rcl edx, 0x37
imul eax
and edx, 0xdf
not edx
inc esi
inc edi
imul ebx
imul esi
imul edx
ror esi, 0xc4
inc ebx
inc edx
sbb esi, 0x35
mov ebx, 0x8e
bswap eax
bswap esi
rcl esi, 0xe1
rcl ebx, 0xf2
not esi
dec edi
bswap esi
rol esi, 0x4e
rcl ebx, 0xa7
bswap esi
bswap eax
imul ebx
mov ebx, 0x3f
inc edx
inc esi
add eax, 0x75
or ebx, 0xcd
rcl eax, 0x34
ror eax, 0xeb
inc eax
mov edi, 0x43
rol esi, 0x9f
rol esi, 0xaa
neg edi
rol edi, 5
inc ebx
imul edx
xor ecx, ecx
xor edi, edi
and edi, 0x63
and edi, 1
ror edi, 0x6f
rol edi, 0x7a
imul edx
ror edx, 0xa6
or esi, 0xd2
sub ebx, 0x8a
inc eax
or edx, 0x8f
rcr eax, 0x27
inc edi
sub esi, 0xe0
or edi, 0x42
sub ebx, 0x9d
ror edx, 0xbc
neg ebx
or eax, 0x89
rol edx, 0xa3
add ebx, 0x7b
sub eax, 0x6c
or eax, 0x37
not edx
imul edi
not ebx
dec eax
or eax, 0x55
not eax
and ebx, 0x86
and edi, 0xa
rcr edx, 0xa4
rcr ebx, 0x4c
and ebx, 0x34
imul edi
imul eax
sbb edi, 0x56
sbb edx, 0x26
bswap eax
sub esi, 0x8f
rol edi, 0x17
or eax, 0xb0
rol edi, 0xa9
bswap edi
inc eax
mov edx, 0xdc
rcr edi, 0x36
imul esi
inc edi
rcl esi, 0x1c
and edi, 0x5d
mov ecx, dword [ebp + 0xc]
sbb edx, 0x50
rcl eax, 0xf7
rcl eax, 0x84
sbb ebx, 0xa9
neg edx
rcr ebx, 0xd3
sub esi, 0x5a
dec ebx
not eax
inc eax
dec esi
ror edi, 0xb8
bswap ebx
and esi, 0x3b
add esi, 0x4b
dec ebx
add edi, 0x23
inc edi
sbb esi, 0x43
rcl esi, 0x64
rol esi, 0x2a
sbb edx, 0xaa
ror edi, 0x34
inc edx
not edx
rcl edi, 0x3d
and edi, 0x9e
add esi, 0xa6
dec ebx
add edi, 0x76
sbb edx, 0x77
add edx, 0xc9
ror edx, 0xb6
bswap ebx
bswap edx
sbb edx, 0x23
not eax
bswap edx
dec edx
bswap esi
imul ebx
rcl ebx, 0x2c
add esi, 0x24
neg eax
bswap esi
dec eax
bswap edi
not edx
neg edx
sbb ebx, 0x65
mov edi, dword [ebp + 8]
mov eax, eax
mov esi, ebx
xor eax, ebx
mov esi, ebx
xor eax, ebx
mov eax, eax
xor eax, esi
mov esi, ebx
mov ebx, ebx
xor eax, esi
xor esi, esi
mov esi, eax
not byte [edi]
mov esi, ebx
mov esi, ebx
xor esi, eax
mov ebx, esi
xor esi, eax
mov esi, ebx
xor ebx, esi
mov eax, ebx
xor eax, eax
sub byte [edi], 0x89
xor eax, esi
mov esi, eax
xor ebx, ebx
mov eax, eax
xor ebx, ebx
mov esi, ebx
mov ebx, esi
xor esi, eax
xor ebx, eax
add byte [edi], 0x57
xor eax, esi
mov eax, esi
xor esi, esi
mov ebx, esi
xor ebx, eax
xor ebx, ebx
mov ebx, eax
mov esi, esi
mov ebx, esi
imul byte [edi]
inc edi
loop 0x402d5c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x406de0
Capabilities:
Hide graphical window

Disassembly:
push 0
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_GetWindowLongA
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x40a930]
push eax
call sub.user32.dll_ShowWindow
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4065f1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406615
xor eax, eax
test eax, eax
je 0x406627
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406627
xor ecx, ecx
jmp 0x40662a
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406716
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422eb4], 0
push esi
jne 0x40674d
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406727
mov dword [ecx*4 + 0x422eb0], eax
inc ecx
cmp ecx, 0x100
jl 0x406722
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40677e
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422eb0]
xor eax, esi
inc ecx
dec edx
jne 0x406760
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x41c34f33
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x1807407b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x41dad0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
or eax, 0x13b92
pop eax
push ecx
sub ecx, 0x5482
add ecx, 0x154c3
and ecx, 0x6b32
add ecx, 0x11fa7
pop ecx
mov byte [ebp - 0x4c0], 0x4c
mov byte [ebp - 0x4bf], 0x6f
mov byte [ebp - 0x4be], 0x61
mov byte [ebp - 0x4bd], 0x64
mov byte [ebp - 0x4bc], 0x4c
mov byte [ebp - 0x4bb], 0x69
mov byte [ebp - 0x4ba], 0x62
mov byte [ebp - 0x4b9], 0x72
mov byte [ebp - 0x4b8], 0x61
mov byte [ebp - 0x4b7], 0x72
mov byte [ebp - 0x4b6], 0x79
mov byte [ebp - 0x4b5], 0x57
mov byte [ebp - 0x4b4], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push eax
jmp 0x41db7d
call 0x41db8c
add byte [eax], bh
xor edi, dword [esi]
xor al, 0x4c
inc ebp
inc ecx
dec esp
inc esp
add esp, 4
xor eax, 0x5f84
call 0x41dba2
add byte [esi], bh
cmp byte ss:[edx], bh
inc eax
dec ecx
add esp, 4
pop eax
cmp dword [ebp - 0xb60], 0
jne 0x41dbbe
mov dword [ebp - 0x3cc], 0
jmp 0x41de65
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edi
or edi, 0x15e89
and edi, 0x9905
xor edi, 0x17873
pop edi
push esi
sub esi, 0x1cc9
or esi, 0x95b3
jmp 0x41dbf9
jmp 0x41dc01
pop esi
cmp dword [ebp - 0x6bc], 0
jne 0x41dc1a
mov dword [ebp - 0x3cc], 0
jmp 0x41de65
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx
push edi
sub edi, 0x1699
and edi, 0x170e3
pop edi
push esi
xor esi, 0x2e9c
pop esi
push esi
or esi, 0x10f35
and esi, 0xbc29
pop esi
push edi
sub edi, 0x15e0e
sub edi, 0x1055a
pop edi
lea eax, [ebp - 0xca8]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6b4], edx
xor eax, eax
mov word [ebp - 0x118], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push eax
push edx
add esp, 4
jmp 0x41dc8f
add eax, 0x15a8
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x27ac
xor ecx, 0xb350
and ecx, 0x12a58
xor ecx, 0xecef
pop ecx
mov edx, dword [ebp - 0x6b4]
mov ax, word [edx]
mov word [ebp - 0x876], ax
mov ecx, dword [ebp - 0x6b4]
add ecx, 2
mov dword [ebp - 0x6b4], ecx
mov dx, word [ebp - 0x876]
mov word [ebp - 0x118], dx
mov eax, dword [ebp - 0x6b8]
mov cx, word [eax]
mov word [ebp - 0x878], cx
mov edx, dword [ebp - 0x6b8]
add edx, 2
mov dword [ebp - 0x6b8], edx
mov ax, word [ebp - 0x878]
mov word [ebp - 0x2c], ax
push eax
push edx
add esp, 4
xor eax, 0x78bf
add eax, 0x16374
jmp 0x41dd22
pop eax
push ebx
push esi
add esp, 4
or ebx, 0x152b6
pop ebx
push edx
add edx, 0x7f09
or edx, 0xa605
pop edx
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x41dd5a
invalid
invalid
Function at 0x41dba2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0x13b92
pop eax
push ecx
sub ecx, 0x5482
add ecx, 0x154c3
and ecx, 0x6b32
add ecx, 0x11fa7
pop ecx
mov byte [ebp - 0x4c0], 0x4c
mov byte [ebp - 0x4bf], 0x6f
mov byte [ebp - 0x4be], 0x61
mov byte [ebp - 0x4bd], 0x64
mov byte [ebp - 0x4bc], 0x4c
mov byte [ebp - 0x4bb], 0x69
mov byte [ebp - 0x4ba], 0x62
mov byte [ebp - 0x4b9], 0x72
mov byte [ebp - 0x4b8], 0x61
mov byte [ebp - 0x4b7], 0x72
mov byte [ebp - 0x4b6], 0x79
mov byte [ebp - 0x4b5], 0x57
mov byte [ebp - 0x4b4], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0xe30], ecx
mov edx, dword [ebp - 0xe30]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0xe34], eax
mov ecx, dword [ebp - 0xe34]
mov dword [ebp - 0xb60], ecx
push eax
jmp 0x41db7d
call 0x41db8c
add byte [eax], bh
xor edi, dword [esi]
xor al, 0x4c
inc ebp
inc ecx
dec esp
inc esp
add esp, 4
xor eax, 0x5f84
call 0x41dba2
add byte [esi], bh
cmp byte ss:[edx], bh
inc eax
dec ecx
add esp, 4
pop eax
cmp dword [ebp - 0xb60], 0
jne 0x41dbbe
mov dword [ebp - 0x3cc], 0
jmp 0x41de65
mov edx, dword [ebp - 0xb60]
mov eax, dword [edx + 0xc]
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x6bc], ecx
push edi
or edi, 0x15e89
and edi, 0x9905
xor edi, 0x17873
pop edi
push esi
sub esi, 0x1cc9
or esi, 0x95b3
jmp 0x41dbf9
jmp 0x41dc01
pop esi
cmp dword [ebp - 0x6bc], 0
jne 0x41dc1a
mov dword [ebp - 0x3cc], 0
jmp 0x41de65
mov edx, dword [ebp - 0x6bc]
mov dword [ebp - 0x258], edx
push edi
sub edi, 0x1699
and edi, 0x170e3
pop edi
push esi
xor esi, 0x2e9c
pop esi
push esi
or esi, 0x10f35
and esi, 0xbc29
pop esi
push edi
sub edi, 0x15e0e
sub edi, 0x1055a
pop edi
lea eax, [ebp - 0xca8]
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x258]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x6b4], edx
xor eax, eax
mov word [ebp - 0x118], ax
xor ecx, ecx
mov word [ebp - 0x2c], cx
push eax
push edx
add esp, 4
jmp 0x41dc8f
add eax, 0x15a8
pop eax
push ecx
push ecx
add esp, 4
add ecx, 0x27ac
xor ecx, 0xb350
and ecx, 0x12a58
xor ecx, 0xecef
pop ecx
mov edx, dword [ebp - 0x6b4]
mov ax, word [edx]
mov word [ebp - 0x876], ax
mov ecx, dword [ebp - 0x6b4]
add ecx, 2
mov dword [ebp - 0x6b4], ecx
mov dx, word [ebp - 0x876]
mov word [ebp - 0x118], dx
mov eax, dword [ebp - 0x6b8]
mov cx, word [eax]
mov word [ebp - 0x878], cx
mov edx, dword [ebp - 0x6b8]
add edx, 2
mov dword [ebp - 0x6b8], edx
mov ax, word [ebp - 0x878]
mov word [ebp - 0x2c], ax
push eax
push edx
add esp, 4
xor eax, 0x78bf
add eax, 0x16374
jmp 0x41dd22
pop eax
push ebx
push esi
add esp, 4
or ebx, 0x152b6
pop ebx
push edx
add edx, 0x7f09
or edx, 0xa605
pop edx
movzx ecx, word [ebp - 0x2c]
test ecx, ecx
jne 0x41dd5a
invalid
invalid