joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b750
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423d60
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42c520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
lea eax, [ebp - 0x18]
push 0x462140
xor edi, edi
push eax
xor esi, esi
mov dword [ebp - 4], edi
call fcn.00409ac0
mov ecx, dword [ebp - 0x18]
add esp, 8
cmp dword [ecx - 0xc], edi
je 0x40b825
cmp edi, 2
jge 0x40b825
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x14]
push edx
push 0
xor eax, eax
push 2
test edi, edi
push 0
setne al
push 0
push 0
push ecx
mov dword [ebp - 0x14], 0
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b81c
mov esi, dword [ebp - 0x14]
mov ecx, esi
mov dword [ebp - 0x28], ecx
test ebx, ebx
jne 0x40b7e8
lea eax, [ebx + 0xd]
jmp 0x40b808
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
push 0x428dc0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x28]
xor edx, edx
test eax, eax
sete dl
mov esi, edx
test ecx, ecx
je 0x40b81c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x18]
inc edi
jmp 0x40b7a1
lea eax, [ecx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b865
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c910
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42ad28
push 0x418270
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x84f0
call fcn.004225f0
mov eax, dword [0x42c520]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [ebp + 0x10]
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
push 6
push 0x428c68
push esi
call fcn.00413534
add esp, 0xc
test eax, eax
je 0x40cb2e
call fcn.00409a50
xor eax, eax
mov word [ebp - 0x4b0], ax
push 0x206
push ebx
lea ecx, [ebp - 0x4ae]
push ecx
call fcn.00414260
add esp, 0xc
push 0x104
lea edx, [ebp - 0x4b0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40cb4d
xor eax, eax
mov word [ebp - 0x2a8], ax
push 0x206
push ebx
lea ecx, [ebp - 0x2a6]
push ecx
call fcn.00414260
add esp, 0xc
lea edx, [ebp - 0x2a8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x40cb4d
lea eax, [ebp - 0x2a8]
push eax
push ebx
push ebx
mov ecx, eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40cb4d
call fcn.00407cd0
test eax, eax
je 0x40cb4d
mov byte [ebp - 0xa0], bl
push 0x80
push ebx
lea edx, [ebp - 0x9f]
push edx
call fcn.00414260
add esp, 0xc
mov dword [ebp - 0x84b4], 0x81
lea edx, [ebp - 0x84b4]
lea eax, [ebp - 0xa0]
call fcn.0040a610
test eax, eax
je 0x40cb4d
lea ecx, [ebp - 0x2a8]
lea edx, [ebp - 0x4b0]
call fcn.0040c4c0
test eax, eax
je 0x40cb4d
xor eax, eax
mov word [ebp - 0x84b0], ax
push 0x7ffe
push ebx
lea ecx, [ebp - 0x84ae]
push ecx
call fcn.00414260
lea edx, [ebp - 0xa0]
push edx
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x2a8]
push ecx
push str.__s____help_s_t_S
push 0x4000
lea edx, [ebp - 0x84b0]
push edx
call fcn.0041300d
mov dword [ebp - 0x8508], ebx
push 0x40
push ebx
lea eax, [ebp - 0x8504]
push eax
call fcn.00414260
add esp, 0x30
mov dword [ebp - 0x8508], 0x44
xor ecx, ecx
mov word [ebp - 0x84d8], cx
mov dword [ebp - 0x84dc], 1
mov dword [ebp - 0x84c4], ebx
xor eax, eax
mov dword [ebp - 0x84c0], eax
mov dword [ebp - 0x84bc], eax
mov dword [ebp - 0x84b8], eax
lea edx, [ebp - 0x84c4]
push edx
lea eax, [ebp - 0x8508]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x84b0]
push ecx
lea edx, [ebp - 0x2a8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
jmp 0x40cb4d
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040c540
add esp, 4
jmp 0x40cb4d
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00412123
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40d970
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423e07
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42c520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x428d54
mov dword [ebx + 0x60], 0x428cd0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], 0x428d10
mov edx, dword [ebx]
mov esi, dword [edx + 4]
add esi, ebx
mov dword [ebp - 0x10], 1
call fcn.0040a4e0
lea edi, [ebx + 4]
push esi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], 0
call fcn.0040f3e0
cmp dword [esi + 0x38], 0
mov byte [esi + 0x40], al
jne 0x40d9fb
mov eax, dword [esi + 0xc]
or eax, 4
or eax, 4
push 0
mov ecx, esi
call fcn.0040a3a0
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
push edi
mov dword [ebx + ecx], 0x428d50
call fcn.0040f000
lea edx, [edi + 8]
mov dword [edi + 0x10], edx
lea ecx, [edi + 0x18]
mov dword [edi + 0x20], ecx
lea edx, [edi + 0x1c]
mov dword [edi + 0x24], edx
mov dword [edi], 0x428d14
mov byte [edi + 0x50], 0
mov byte [edi + 0x49], 0
lea ecx, [edi + 0x28]
mov dword [edi + 0x30], ecx
xor ecx, ecx
lea eax, [edi + 0xc]
mov dword [edi + 0x14], eax
lea edx, [edi + 0x2c]
mov dword [edi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [edi + 0x24]
mov dword [eax], ecx
mov edx, dword [edi + 0x34]
mov dword [edx], ecx
mov eax, dword [edi + 0x10]
mov dword [eax], ecx
mov edx, dword [edi + 0x20]
mov dword [edx], ecx
mov eax, dword [edi + 0x30]
mov edx, dword [0x46347c]
mov dword [eax], ecx
mov dword [edi + 0x54], ecx
mov dword [edi + 0x4c], edx
mov dword [edi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40eb40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423988
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42c520]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebx + 0x44], 0
je 0x40ecd1
cmp byte [ebx + 0x49], 0
je 0x40ecd1
mov eax, dword [ebx]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, ebx
call edx
cmp eax, 0xffffffff
je 0x40ecc5
lea esi, [ebp - 0x2c]
call fcn.0040e650
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x40ebb3
lea edx, [ebp - 0x2c]
mov eax, edx
mov ecx, dword [ebx + 0x44]
mov esi, dword [ecx]
lea edi, [ebp - 0x30]
push edi
mov edi, dword [ebp - 0x1c]
add edi, edx
push edi
push eax
lea eax, [ebx + 0x4c]
push eax
mov eax, dword [esi + 0x18]
call eax
sub eax, 0
je 0x40ebec
dec eax
je 0x40ebf0
sub eax, 2
lea ecx, [ebp - 0x2c]
je 0x40eccc
call fcn.0040d210
xor al, al
jmp 0x40ecd3
mov byte [ebx + 0x49], 0
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov edx, eax
cmp edi, 0x10
jae 0x40ec00
lea edx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, edx
je 0x40ec2d
cmp edi, 0x10
jae 0x40ec0f
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x54]
push ecx
push esi
push 1
push eax
call fcn.00413287
add esp, 0x10
cmp esi, eax
jne 0x40ecbd
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [ebx + 0x49], 0
je 0x40ecc9
test esi, esi
jne 0x40eba7
mov ecx, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, ecx
cmp edx, 8
jbe 0x40ecee
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x40ecee
cmp edi, esi
jae 0x40eca6
push ecx
push esi
lea ecx, [ebp - 0x2c]
call fcn.0040f270
mov edi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x40eba7
mov ecx, eax
cmp edi, 0x10
jae 0x40ec82
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
jae 0x40ec9d
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x40eba1
test esi, esi
jne 0x40ec78
mov dword [ebp - 0x1c], esi
cmp edi, 0x10
jae 0x40ecb5
lea eax, [ebp - 0x2c]
mov byte [eax], 0
jmp 0x40eba1
lea ecx, [ebp - 0x2c]
call fcn.0040d210
xor al, al
jmp 0x40ecd3
lea ecx, [ebp - 0x2c]
call fcn.0040d210
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412123
mov esp, ebp
pop ebp
ret
push str.string_too_long
call fcn.00411371
int3
Function at 0x40f000
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42395b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x42c520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], 0x428cd4
call fcn.00411dc1
push 4
mov dword [ebp - 4], 0
call fcn.00412602
mov edi, eax
add esp, 4
test edi, edi
je 0x40f07c
call fcn.00411792
mov dword [edi], eax
call fcn.00411551
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00411486
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x40f072
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.004114ae
jmp 0x40f07e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fb70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x423db8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x42c520]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x1c]
push 0x42d540
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00409ac0
add esp, 8
lea ecx, [ebp - 0x18]
push 0x42d5b4
push ecx
mov byte [ebp - 4], 1
call fcn.00409ac0
add esp, 8
mov byte [ebp - 4], 2
mov edx, dword [section..data]
mov eax, dword [edx + 0xc]
mov ecx, section..data
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
push 0x6a
mov byte [ebp - 4], 3
call fcn.00407040
add esp, 4
cmp eax, ebx
je 0x40fc01
push eax
lea eax, [ebx + 0x6a]
lea edi, [ebp - 0x14]
call fcn.00406b20
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx - 0xc], ebx
je 0x40fc8d
mov edx, dword [ebp - 0x18]
cmp dword [edx - 0xc], ebx
je 0x40fc8d
cmp dword [esi - 0xc], ebx
je 0x40fc8d
xor eax, eax
mov dword [ebp - 0x14], eax
nop
cmp eax, 2
jge 0x40fc8d
xor ecx, ecx
cmp eax, ebx
setne cl
push 2
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
add ecx, 0x80000001
mov dword [ebp - 0x20], ebx
call fcn.0040faf0
test eax, eax
jne 0x40fc71
mov edi, dword [ebp - 0x18]
cmp esi, ebx
je 0x40fc71
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push ebx
push edi
mov edi, dword [ebp - 0x28]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40fc74
mov edi, dword [ebp - 0x28]
cmp edi, ebx
je 0x40fc82
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
jmp 0x40fc20
lea eax, [esi - 0x10]
mov byte [ebp - 4], 2
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40fcad
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fcd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40fcf2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412123
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c520]
jne 0x41212d
repz ret
jmp fcn.0041849a

Function at 0x420a8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00417cd2
and dword [ebp - 0x14], 0
cmp dword [0x463350], 0
mov dword [ebp - 0x18], eax
jne 0x420b3f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x420be7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x420be7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x463350], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x463354], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x463358], eax
call edi
push eax
call esi
mov dword [0x463360], eax
test eax, eax
je 0x420b3f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46335c], eax
mov eax, dword [0x46335c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x420b98
cmp dword [0x463360], ecx
je 0x420b98
push eax
call esi
push dword [0x463360]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x420b98
test ebx, ebx
je 0x420b98
call edi
test eax, eax
je 0x420b8f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x420b8f
test byte [ebp - 8], 1
jne 0x420b98
or dword [ebp + 0x10], 0x200000
jmp 0x420bcb
mov eax, dword [0x463354]
cmp eax, dword [ebp - 0x18]
je 0x420bcb
push eax
call esi
test eax, eax
je 0x420bcb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x420bcb
mov eax, dword [0x463358]
cmp eax, dword [ebp - 0x18]
je 0x420bcb
push eax
call esi
test eax, eax
je 0x420bcb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x463350]
call esi
test eax, eax
je 0x420be7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x420be9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412123
leave
ret
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baaa0]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx

Function at 0x417a37
Capabilities:
Get common file path

Disassembly:
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baaa0], eax
test eax, eax
pop ebx
je 0x417ad1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4ba05c
push eax
call esi
mov ecx, dword [0x4baaa0]
push 0x4ba044
dec ebx
add byte [ecx - 0x5d], dl
pushfd
stosb byte es:[edi], al
dec ebx
add bh, bh
salc
Function at 0x42e5ad
Capabilities:
Encode data using xor

Disassembly:
out dx, al
les ebp, [esi + 0x5f]
aaa
stosb byte es:[edi], al
mov esi, ebp
fisttp qword [esi + ecx + 0xc]
xor eax, 0xc7f8fc7
aas
sbb al, 0x5c
mov dh, byte [eax + 0x20]
or eax, 0x1bbde5b6
sub eax, ebp
mov eax, dword [0x4abda8f4]
cmp al, 0xe4
inc edi
nop
mov esp, 0xdc89025f
jge 0x42e62a
invalid
Function at 0x43d7bc
Capabilities:
Encode data using xor

Disassembly:
pop ecx
sbb al, 0xa9
invalid
and dword [eax], edi
int1
shr dh, 0x31
mov ch, cl
stosd dword es:[edi], eax
out dx, al
sub ebp, dword [ebx + 0x1cfd63aa]
out dx, eax
salc
mov ebp, 0x5b130237
test byte [edi], dl
sal dword [ebx + edx*8], cl
push ebx
lock add eax, dword [0x571f5d43]
xor eax, 0xf881e390
xor ah, bh
mov edx, 0x54765f65
fsub dword [0x23f9bbc3]
cmpsb byte [esi], byte es:[edi]
push ecx
clc
push edx
jb 0x43d7ad
cmpsd dword [esi], dword es:[edi]
mov dl, 0xbc
mov ah, byte [esi - 0x47d8ef74]
xor al, byte es:[eax + 0x67]
jo 0x43d81e
push cs
imul esp, dword [edx], 0x4c
ror byte [ecx + 0x77], 1
std
xchg ecx, eax
movsd dword es:[edi], dword [esi]
mov edx, 0x82b35ca3
int 0xba
ror byte [edx - 0x1d], 0xd6
push ss
outsd dx, dword [esi]
pop ebp
sub dword [edx + edi*2], edi
push 0x40
insb byte es:[edi], dx
out 0xdf, eax
pop es
out dx, eax
jo 0x43d7a2
add eax, 0xc4c56e9a
pop ss
pop esp
inc edi
jle 0x43d866
xchg ebp, eax
and edi, ebx
popfd
inc ebx
fild qword [0xcfb54605]
lds edx, [edi + 0x3b]
jne 0x43d7f5
cdq
push cs
das
fild qword [ecx]
cmp bl, 0xbe
ljmp 0xaaf2
fistp qword [eax]
sti
mov esp, 0xa7f41d1d
mov edi, 0x215fcac0
aas
dec ecx
fcompi st(0)
mov esp, es
dec edx
sbb byte [ecx - 0x76], 0xc5
test dword [edi - 0x60db7b0d], ebp
inc esp
xor al, 0x5f
rcl dword [0xed7d695c], 0xcd
mov dl, 0x45
not dword [ebp + 0xc]
jae 0x43d880
ja 0x43d8b1
insb byte es:[edi], dx
pop esp
out dx, eax
sbb byte [edx + 0x416f709f], bh
iretd
push cs
fbstp tbyte [edx - 0x4840e9fa]
mov ss, word [edx + 0x2cb56f0c]
inc byte [edi + edi*8 - 0x4023e76d]
inc ebp
jmp 0xb131ac15
Function at 0x468c66
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xfb0af6e9
cmp al, 0x7e
push eax
pop ecx
mov dl, 0x6b
or esi, ebp
Function at 0x475600
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004757f3
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00480348
xor ebx, ebx
cmp eax, ebx
jne 0x4757ae
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004757f3
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0047d027
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4ce91c
add esp, 0x10
test eax, eax
jne 0x4756c9
push esi
call fcn.00472cb2
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4756c9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4756b4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4756c9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4756c2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0048185b
cmp byte [esp + 0x13], bl
je 0x4756f9
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00475830
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x475769
push 0x14
call 0x4cdb89
cmp eax, ebx
pop ecx
je 0x475723
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x475725
xor edi, edi
cmp edi, ebx
je 0x475769
push esi
push edi
call fcn.00474d56
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.00474e1e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f47
add esp, 0x18
call fcn.004757f3
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0047fa15
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x475780
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x475792
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4757d5
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4757d5
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.00474e1e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00474f47
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4803f5
Capabilities:
Encode data using xor

Disassembly:
pop eax
pop eax
in al, 0xc2
sbb eax, 0xffffff90
lcall 0xf160, 0x91f35323
sbb byte [ebp + 0x12], dh
pop eax
dec esp
cmp al, 0x87
shl byte [ebp - 0x575f853c], 1
adc eax, 0xe29f143c
or byte [ecx - 0x22], ch
mov edi, 0x2a4b186b
mov dword [edi + ebx*8 - 0x4f], edx
and bh, dh
mov ch, 0xc4
inc esp
pop eax
inc ecx
and edx, edx
pop eax
cdq
les edx, [edi - 0x5c]
out dx, eax
xor eax, 0x4f6d2f4a
aad 0xa
in al, 0x3b
push 0xffffffffffffff8d
inc edx
pushfd
out dx, eax
inc esi
xor ebx, ecx
enter 0xffffffffffffbe9a, 0x2d
inc edi
adc dword [edx], ebx
mov ecx, 0xcab18ae0
xor dword [esi - 0x5a], 0x44
cmp edi, esp
xor eax, 0x56242371
insd dword es:[edi], dx
loopne 0x480446
inc ecx
retf 0x9359

Function at 0x4898a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmc
cmp eax, ebp
dec edx
in eax, 0xbc
xor dword [esi], esp
adc eax, 0x892f3d32
mov eax, dword [0x2ca3be19]
mov al, 0xcb
mov edi, 0x66bdbc88
push 0xffffffffffffffe3
pushfd
or al, dh
xlatb
jno 0x4898a8
salc
adc al, 0xa1
lea edx, [ebp + 0x65]
xor bl, bh
sahf
fbld tbyte [ebp + 0x79]
jge 0x489879
xchg ebp, eax
xchg esp, eax
pop ss
xchg esi, eax
cmp dword [eax], esi
and dh, byte [0x99e558f2]
and ah, byte [ecx]
cmpsb byte [esi], byte es:[edi]
fsub st(4), st(0)
add ebx, dword [esi + 0x1f]
pop esi
pop ds