joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
invalid
invalid

Function at 0x4d0020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [edx - 0x56], ch
loop 0x4d008f
inc ebx
invalid
cld
retf

Function at 0x56a32b
Capabilities:
Encode data using xor

Disassembly:
sub ebp, dword [ebx + 0x4aaac912]
mov byte [0xfa236d02], al
cli
sahf
add byte [edi - 0x4fc892e6], al
leave
invalid
xor bl, byte [edi - 0x5c9cccef]
jle 0x56a29a
int1
jae 0x56a2a4
ljmp 0x7dee:0xb4af07b4
pop esi
pop eax
dec ebp
ror esi, cl
into
dec ebp
ja 0x56a303
cmpsd dword [esi], dword es:[edi]
add al, 0xd2
pop esi
inc ebp
and ah, ch
mov eax, dword [0x90539754]
push ebx
nop
push es
ja 0x56a2e2
sub byte [eax], ah
jb 0x56a383
add dword [ebx - 0x7b], edi
cli
inc esp
and bl, bl
cld
arpl word [esi + 0x28162cb6], bp
and edx, dword [edx]
sar byte [edi], 1
push esp
jecxz 0x56a30d
jnp 0x56a2fa
pushal
fild dword [ebx + 0x6a]
xor eax, 0xca33e87c
mov word [ebx], ss
mov ch, 0xa5
insd dword es:[edi], dx
loopne 0x56a398
ret
loopne 0x56a3ad
fimul dword [ebp - 0x730c906e]
or edx, dword [esi - 9]
ret
xor edx, esi
adc dword [ebx - 0x3ca47df1], ebx
loop 0x56a362
adc al, 0x73
and byte [edx - 0x6d], 0xc
fcom qword [0x6fd3eb19]
outsd dx, dword [esi]
les esi, [ecx + eax*2 - 0x3c4f7f92]
dec ebx
rcl byte [eax], cl
and edx, dword [ecx - 0x50355c14]
adc ebx, dword [ebx - 0x9c21d]
idiv bh
inc ebx
push esp
fisubr dword [eax - 0x4d]
invalid

Function at 0x5a7e2a
Capabilities:
Encode data using xor

Disassembly:
sar dword [edi + 0x295f148c], cl
dec edi
stc
mov esp, ebx
rol ch, 0xe9
in al, 0xec
inc eax
adc dword [ebx], ebp
or dword [edi - 0x521046e7], edx
ljmp 0xabb
cmp eax, 0xc5b97f81
movsb byte es:[edi], byte [esi]
dec ecx
xchg esi, eax
lahf
inc ebx
stc
cmp ebx, dword [ebx + eax + 0x668e089b]
jnp 0x5a7e1b
mov dword [0x6caa8dd3], eax
std
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
lea ebp, [edx - 0x595b0294]
mov dl, cl
wait
rcr byte [eax], 0x52
cmp dh, bl
out 0x86, al
popal
jne 0x5a7d7a
test byte [esi], bh
cld
dec esi
inc eax
fbstp tbyte [esi - 0x24]
sti
and dword [ebp + eax*2 + 0xecd1794], eax
test byte [ebp - 0x6c], al
pop ss
int 0xe
jge 0x5a7dfc
pop esp
shr dword [esi], cl
cmpsd dword [esi], dword es:[edi]
arpl word [ebx], si
loop 0x5a7e67
sub dword [edx], eax
add bl, dh
xor cl, ah
mov dword [0xc56be113], eax
pop ebp
inc esp
inc esp
mov cl, byte es:[ecx]
scasb al, byte es:[edi]
xchg esi, eax
dec ebp
or ecx, ecx
jmp 0x5a7dc8
adc bh, byte [esi - 0x4e]
jle 0x5a7dde
mov eax, 0xa91044cb
outsb dx, byte [esi]
js 0x5a7e29
xor byte [ebx + ecx*8], ah
add ch, 0x26
push ecx
push ebx
test dword [0x466bf9c9], edi
push cs
int1
xchg ebx, eax
iretd
sti
div dword [0x755319c3]
cmp dword [esi], edi
mov ch, 0x9a
cmc
mov byte [0x43f601f], al
mov dl, 0x65
xor al, byte [ecx + 0x2d]
popal
push ebx
mov ah, byte [ebx - 0x62347bbf]
sub eax, 0xa38a5361
inc ecx
test bl, cl
popfd
push 0x1661cc2e
jp 0x5a7e52
sar dword [eax + 0x49876311], cl
push ebx
mov bh, 0x17
retf 0x7161
Function at 0x5affd5
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
adc eax, 0xb21f38b
jbe 0x5b0044
xchg esi, eax
xchg ebx, eax
adc dword [esi - 0x34d404dd], ebp
mov bh, 0xd6
sub byte [ebp + 0x177ed382], ah
mov ebp, 0xe8921768
adc al, 0x18
stosd dword es:[edi], eax
invalid
mov ebx, 0x832a0bff
ror byte [eax + 0x2b171b10], cl
mov eax, dword [0xd34bf1f8]
sbb edx, dword [edi]
sub esp, dword [ecx - 0x2cb40e08]
and esp, edi
sub edx, edi
mov ecx, 0x4f1423b6
mov esi, dword [ecx + 0x10]
cdq
rcl edi, 0x5f
or ah, byte [esi - 0x780d0b04]
jbe 0x5b0029
inc edx
outsd dx, dword [esi]
mov esi, 0x8123fefb
pop es
push ecx
dec esp
jbe 0x5afff6
mov byte [0x721d5e99], al
mov dh, 0xa6
sbb cl, byte [esi]
pop esi
xchg ebp, eax
push edx
inc esp
aad 0xda
and bl, byte [ebp - 0x15e7cede]
cmc
mov ebx, 0x6e836c4b
sbb dword [ebp + 0x54], edi
push esi
fcom dword [edx]
cmp byte [edx + 0x51], 0x32
jbe 0x5afffe
inc esi
dec esp
fstp xword [ebx]
sub dword [ebx - 0x66], 0x52
sub al, 0x65
invalid

Function at 0x5e038b
Capabilities:
Encode data using xor

Disassembly:
push 0x5f
pop esi
rol byte [eax + 0x5c], 0x2b
xor dh, dh
mov esi, dword [ebx - 0x59d5f300]
xor eax, 0x19f4a5ed
mov dword es:[0x476f635], eax
adc edi, dword [edx]
cmpsb byte [esi], byte es:[edi]
invalid

Function at 0x5ea3ef
Capabilities:
Encode data using xor

Disassembly:
sub bh, byte [ebp + 0x11616054]
out 0xd2, al
in al, 0x6d
leave
bound esi, qword [edx + eax*4]
into
cmp al, 0x1a
sbb bh, byte [ecx + 0x20bf5b56]
leave
mov edi, 0x7579140f
div byte [ecx]
inc ebp
adc ah, dl
add eax, 0xb19814c0
mov ebx, dword [esi - 0x4d995612]
imul ecx, dword [eax - 7], 0xffffff94
mov dl, 0x6b
dec eax
stc
xchg esp, eax
aaa
nop
or ch, 0x55
or al, 0xc8
popal
dec eax
mov bh, 0x71
xchg ebp, eax
add esi, edi
mov cl, ah
or bh, dh
mov bl, 0xe5
jp 0x5ea422
dec ebp
aaa
and dword [0x327e8165], 0x67
xor dword [edi + 0x78], 0xfffffff3
ja 0x5ea469
fsub dword [0xbd1d91ac]
ja 0x5ea469
fsub dword [0xbd1d91ac]
jb 0x5ea39c
push ebp
in eax, dx
xlatb
mov al, byte [eax]
cmpsb byte [esi], byte es:[edi]
pop ss
jbe 0x5ea45b
ja 0x5ea3c7
jo 0x5ea3a7
inc ecx
dec ecx
loopne 0x5ea3a7
sahf
int1
mov eax, 0x369fc708
loop 0x5ea452
push edx
aaa
push edi
out 0x18, al
jmp 0xada1b6ae
add esp, dword [eax]
dec eax
invalid
inc esi
xchg ecx, eax
call 0x67cb6ca8
inc ecx
mov bh, 0x53
push ebx
cmpsb byte [esi], byte es:[edi]
and byte [ebx - 0x152fe053], al
mov ecx, 0xd924c822
push es
sbb bl, byte [esi + 0x6a881eff]
xor al, byte [esi]
inc bp
jno 0x5ea431
imul edi, ecx, 0x32ce8cfa
loop 0x5ea43a
fidiv word [edi]
aaa
xchg esi, eax
sbb dword [ecx], edx
mov dword [edi], ebx
or ecx, ebp
adc bh, ch
sbb byte [eax], ah
mov dword [0x3598eca8], eax
invalid
Function at 0x60055b
Capabilities:
Encode data using xor

Disassembly:
pushal
sbb edi, esp
outsb dx, byte [esi]
mov cl, 0x56
jp 0x600599
into
ja 0x60058f
sbb esi, eax
dec esi
jno 0x60057c
pop ss
salc
xor edx, dword [ecx - 0x6b089938]
add ecx, dword [ebx]
int 8
lock sub ecx, dword [esi + 0x3a36b5c1]
stosd dword es:[edi], eax
invalid
dec eax
mov dword [0x2f281827], eax
aaa
xchg byte [eax - 0x30], dh
rcl dh, cl
aaa
lodsb al, byte [esi]
jp 0x60052e
test dl, 0x79
adc dword [esi + 0x52], edi
invalid
and eax, 0x8ca4e11f
xor eax, dword [esi + eax*8]
loop 0x6005f0
fild word [esi - 1]
push ds
pop esi
cdq
mov ebx, 0x35469fc2
xor al, 0x6d
inc esi
xor eax, 0x406d343e
xor al, 0x6d
inc eax
push ecx
jp 0x600592
xor dword [ebx - 0x259389e8], esi
push esp
loope 0x6005a8
mov bl, 0x18
jbe 0x600609
ficom dword [ecx + 7]
leave
sbb dword [0x52d2337b], esp
sub eax, 0x81d680db
push ebx
mov byte [0x52ee19f6], al
dec esp
outsd dx, dword [esi]
xchg byte [ebx - 0x14], dh
push edx
invalid
push ds
ret 0xaf1a
xor al, byte [ebx - 0x48]
invalid

Function at 0x62b9cc
Capabilities:
Encode data using xor

Disassembly:
or ebp, edx
xchg dword [ebx - 0x79b4c74e], esp
cwde
or cl, byte [esi]
scasb al, byte es:[edi]
jb 0x62b977
retf

Function at 0x44305f
Capabilities:
Packed with generic packer

Disassembly:
pushal
push 0x2bd46
push section.packerBY
push 0x4434e3
call fcn.004434a8
cld
mov esi, 0x414000
mov ecx, 4
sub ecx, esi
cmp esi, 0x440290
ja 0x4430a7
lodsb al, byte [esi]
add al, 0x18
sub al, 2
jb 0x44309d
cmp al, 0x25
jne 0x443081
mov al, byte [esi]
and al, 0xf0
cmp al, 0x80
jne 0x443081
inc esi
lea edi, [esi + ecx]
sub dword [esi], edi
add esi, 4
jmp 0x443081
mov edx, 0x400000
lea esi, [edx + 0x4120c]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x44310a
add eax, edx
mov edi, dword [esi + 0x10]
mov ebx, dword [esi]
test ebx, ebx
jne 0x4430c6
mov ebx, edi
add ebx, edx
add edi, edx
push edx
push edi
push eax
call dword [sym.imp.kernel32.dll_LoadLibraryA]
pop edi
pop edx
test eax, eax
je 0x443108
mov ecx, eax
mov eax, dword [ebx]
test eax, eax
je 0x443103
btr eax, 0x1f
jb 0x4430eb
lea eax, [eax + edx + 2]
push ecx
push edx
push edi
push eax
push ecx
call dword [sym.imp.kernel32.dll_GetProcAddress]
pop edi
pop edx
pop ecx
test eax, eax
je 0x443108
stosd dword es:[edi], eax
add ebx, 4
jmp 0x4430db
add esi, 0x14
jmp 0x4430b2
popal
ret
popal
jmp 0x440130
Function at 0x402387
Capabilities:
Access the windows event log
Clear file content
Clear windows event logs
Get common file path
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x45bc085
jg 0x4023b0
inc edi
cmp edi, 0x323bbf1
jl 0x402396
cmp dword [0x283743c], 0x400
jne 0x4023f0
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
call dword [sym.imp.USER32.dll_ShowCursor]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call fcn.004027f1
push esi
call fcn.00402993
push esi
call fcn.004029a2
add esp, 0xc
xor edi, edi
cmp edi, 0xd036
jge 0x40240f
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCharABCWidthsI]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_LocalCompact]
cmp edi, 0xd2ced2
jg 0x402435
inc edi
cmp edi, 0x263ff
jl 0x4023f2
mov eax, dword [0x449574]
mov dword [0x283743c], eax
call fcn.00402118
mov edi, 0x3078f
cmp dword [0x283743c], 0x51f
jne 0x402463
push esi
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec edi
jne 0x402449
pop edi
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x404adb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42f310]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403a93
and dword [ebp - 0x14], 0
cmp dword [0x4540e4], 0
mov dword [ebp - 0x18], eax
jne 0x404b8e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404c36
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404c36
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4540e4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4540e8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4540ec], eax
call edi
push eax
call esi
mov dword [0x4540f4], eax
test eax, eax
je 0x404b8e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4540f0], eax
mov eax, dword [0x4540f0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404be7
cmp dword [0x4540f4], ecx
je 0x404be7
push eax
call esi
push dword [0x4540f4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404be7
test ebx, ebx
je 0x404be7
call edi
test eax, eax
je 0x404bde
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404bde
test byte [ebp - 8], 1
jne 0x404be7
or dword [ebp + 0x10], 0x200000
jmp 0x404c1a
mov eax, dword [0x4540e8]
cmp eax, dword [ebp - 0x18]
je 0x404c1a
push eax
call esi
test eax, eax
je 0x404c1a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404c1a
mov eax, dword [0x4540ec]
cmp eax, dword [ebp - 0x18]
je 0x404c1a
push eax
call esi
test eax, eax
je 0x404c1a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4540e4]
call esi
test eax, eax
je 0x404c36
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404c38
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404e46
leave
ret

Function at 0x404e46
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f310]
jne 0x404e50
repz ret
jmp fcn.00405d16
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x401443
pop dword [ebp - 0x34]
mov eax, 0x401443
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x3e7745cd
add dword [ebp - 0x44], 0xfdaff7e
mov dword [ebp - 0x40], 0x1749b325
add dword [ebp - 0x40], 0x1ae99920
mov dword [ebp - 0x3c], 0x7a26f29a
add dword [ebp - 0x3c], 0xd2255194
mov dword [ebp - 0x38], 0x3b82029b
sub dword [ebp - 0x38], 0x3b82029b
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe1884ad3
sub eax, 0xe147c9cf
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x4854e595
sub dword [ebp - 0x44], 0xd3e27c3f
mov dword [ebp - 0x40], 0x1d0abcb1
sub dword [ebp - 0x40], 0xdb9e5b3c
mov dword [ebp - 0x3c], 0x491de00f
add dword [ebp - 0x3c], 0x1a518c5d
mov dword [ebp - 0x38], 0xbb9f1a89
add dword [ebp - 0x38], 0x4460e577
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe3aa60c
sub eax, 0xdfa250c
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3a9ce
push 0
call eax
mov ecx, 0xd1c32e4b
add ecx, 0x2e3d22ff
xor ebx, ebx
add ebx, eax
mov edx, 0x97f5003b
add edx, 0x6851e3c5
add edx, dword [ebp - 0x34]
mov edi, 0x79c84bc4
sub edi, 0x1a07f6ac
xor dword [ebp - 0x30], ecx
mov esi, dword [edx]
xor dword [ebp - 0x20], edi
sub esi, edi
xor dword [ebp - 0xc], edx
mov dword [ebx], esi
xor dword [ebp - 0x14], eax
add ebx, 0xb9470ec4
sub ebx, 0xb9470ec0
add edx, 0x4cf2adfc
sub edx, 0x4cf2adf8
loop 0x401562
add eax, 0xc3b9a67
sub eax, 0xc3a626c
mov ebx, eax
add eax, 0xf9276e1d
sub eax, 0xf9276e18
mov ecx, 0x1a170e2a
add ecx, 0xe628f1d6
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x414b70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10000]
push edi
jmp 0x414b8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b80
mov eax, 1
add ebx, ebx
jne 0x414ba3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b98
jne 0x414bb4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b98
xor ecx, ecx
sub eax, 3
jb 0x414bc8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c3a
mov ebp, eax
add ebx, ebx
jne 0x414bd3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414be0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414c04
inc ecx
add ebx, ebx
jne 0x414bf0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414be5
jne 0x414c01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414be5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414c24
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414c15
jmp 0x414b86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414c24
add edi, ecx
jmp 0x414b86
pop esi
mov edi, esi
mov ecx, 4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c42
cmp byte [edi], 5
jne 0x414c42
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c47
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414cbf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19be8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414c74
mov ecx, edi
jns 0x414ca3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19c2c]
or eax, eax
je 0x414cb9
mov dword [ebx], eax
add ebx, 4
jmp 0x414c91
call dword [esi + 0x19c28]
mov ebp, dword [esi + 0x19c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414cf3
sub esp, 0xffffff80
jmp 0x401150

Function at 0x430000
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x410bf3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x410c02
pop dword [ebp - 0x3c]
mov eax, 0xd7701206
add eax, 0x28d0f9fc
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x54faea9
sub dword [ebp - 0x4c], 0xb6fd695e
mov dword [ebp - 0x48], 0x48853017
sub dword [ebp - 0x48], 0x1651e3d2
mov dword [ebp - 0x44], 0x8d8cd22f
add dword [ebp - 0x44], 0xbebf71ff
mov dword [ebp - 0x40], 0x17124653
add dword [ebp - 0x40], 0xe8edb9ad
lea eax, [ebp - 0x4c]
push eax
mov eax, 0xfe6e55d7
sub eax, 0xfe2cd587
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8da26c88
add dword [ebp - 0x4c], 0xe6cffcce
mov dword [ebp - 0x48], 0x8dd14254
sub dword [ebp - 0x48], 0x4c64e0df
mov dword [ebp - 0x44], 0x2bddd05e
sub dword [ebp - 0x44], 0xc86e63f2
mov dword [ebp - 0x40], 0xa54395bc
add dword [ebp - 0x40], 0x5abc6a44
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x40f7b91f
sub eax, 0x40b638d3
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3e536
push 0
call eax
mov ecx, 0xeb0439b1
sub ecx, 0xeb03e61a
xor esi, esi
add esi, eax
mov edx, 0x556124a3
sub edx, 0x551e3ca3
add edx, dword [ebp - 0x3c]
mov edi, 0xfd109f68
sub edi, 0xc91a2af3
sub dword [ebp - 0x28], 0xa95cdacb
mov ebx, dword [edx]
add dword [ebp - 0x10], 0xc27a9ce6
add ebx, edi
sub dword [ebp - 0x1c], ecx
mov dword [esi], ebx
xor dword [ebp - 0x38], esi
add esi, 0x5bc223e3
add esi, 0xa43ddc21
add edx, 0xcec52a60
add edx, 0x313ad5a4
loop 0x410d26
add eax, 0xa45c37ca
add eax, 0x5ba50965
mov ebx, eax
add eax, 0x7d71eddf
sub eax, 0x7d71edda
mov ecx, 0xb581a6ca
add ecx, 0x4abe5936
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x161be80
Capabilities:
Encode data using xor

Disassembly:
jmp 0x161be8a
pushal
call 0x161be90
pop ebp
sub ebp, 0x10
sub ebp, 0x121be80
jmp 0x161bea6
mov eax, 0x121be80
add eax, ebp
add eax, 0x4c
mov ecx, 0x613
mov edx, 0xe72bc251
xor byte [eax], dl
inc eax
dec ecx
jne 0x161bebd
jmp 0x161bed0
ficomp dword [edx + ebx*8 + 0x51516dd8]
push ecx
rcl byte [eax + 0x515151a9]
push edx
pushfd
jmp 0x52b3103a
Function at 0x5a5370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x5a538e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x5ce074
push ecx
mov edi, eax
call fcn.005b9198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5a53cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.005b902e
push esi
call fcn.005b8fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x5a8850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x5a88ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x5d3720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5a88ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.005b91e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x5a88ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x5d3720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x5a892a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.005ba082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x5a8957
mov word [eax], si
add eax, 2
push eax
call fcn.005ba030
add esp, 4
jmp 0x5a8959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x5a88ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x5a88b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x5a8ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret