joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053f00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x10053f35
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x10053f6a
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x10053f6a
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_wchar_t____thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void_]
mov word [eax], di
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push ebx
je 0x10054077
mov ebx, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [ebx], eax
jne 0x10053f95
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [ebx], ecx
mov eax, dword [esi + 0x1c]
sar edx, 1
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10053fcf
push dword [esi + 0x4c]
push edi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x1005407c
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
movzx eax, di
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
sub eax, 0
je 0x10054037
sub eax, 1
je 0x10054037
sub eax, 2
jne 0x10054077
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
mov ecx, 0xffff
add esp, 8
cmp ax, cx
movzx eax, di
jne 0x1005407c
pop ebx
pop edi
mov eax, ecx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub ebx, eax
je 0x10054055
push dword [esi + 0x4c]
push ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp ebx, eax
jne 0x10054077
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
je 0x10054077
pop ebx
mov ax, di
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
mov eax, 0xffff
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
pop esi
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
Function at 0x10054190
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x100b400c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10054254
cmp byte [esi + 0x3e], 0
je 0x10054254
mov eax, dword [esi]
push edi
push 0xffff
call dword [eax + 0xc]
mov ecx, 0xffff
cmp cx, ax
je 0x10054242
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10054209
sub eax, 1
je 0x1005420d
sub eax, 2
jne 0x10054242
mov byte [esi + 0x3e], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3e], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1005422b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10054242
cmp byte [esi + 0x3e], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1007fac0
mov esp, ebp
pop ebp
ret
Function at 0x10054ae0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c254
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x100b400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable._OUTPUT_AV_PARAMETER_ITEM.0
xor eax, eax
mov dword [edi + 8], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 7
mov word [edi + 8], ax
mov dword [ebp - 4], eax
mov dword [edi + 0x20], eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], 7
mov word [edi + 0x20], ax
mov dword [edi + 0x38], eax
mov dword [edi + 0x48], eax
mov dword [edi + 0x4c], 7
mov word [edi + 0x38], ax
mov dword [edi + 0x50], eax
mov dword [edi + 0x60], eax
mov dword [edi + 0x64], 7
mov word [edi + 0x50], ax
mov dword [edi + 0x68], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x7c], 7
mov word [edi + 0x68], ax
mov dword [edi + 0x80], eax
mov dword [edi + 0x90], eax
mov dword [edi + 0x94], 7
mov word [edi + 0x80], ax
mov dword [edi + 0x98], eax
mov dword [edi + 0x9c], eax
mov dword [edi + 0xa0], eax
mov dword [edi + 0xa8], eax
mov dword [edi + 0xb8], eax
mov dword [edi + 0xbc], 7
mov word [edi + 0xa8], ax
mov dword [edi + 0xc0], eax
mov dword [edi + 0xd0], eax
mov dword [edi + 0xd4], 7
mov word [edi + 0xc0], ax
lea esi, [edi + 0xdc]
mov byte [ebp - 4], 8
push 0x40
mov dword [ebp - 0x14], esi
mov dword [esi], eax
mov dword [esi + 4], eax
call fcn.1007faf4
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [esi], eax
xor eax, eax
mov dword [edi + 0xe8], 0
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], 7
mov word [edi + 0xe8], ax
mov dword [edi + 0x104], eax
mov dword [edi + 0x108], eax
mov dword [edi + 0x10c], eax
mov dword [edi + 0x114], eax
mov dword [edi + 0x124], eax
mov dword [edi + 0x128], 7
mov word [edi + 0x114], ax
mov dword [edi + 0x12c], eax
mov dword [edi + 0x13c], eax
mov dword [edi + 0x140], 7
mov word [edi + 0x12c], ax
mov dword [edi + 0x144], eax
mov dword [edi + 0x154], eax
mov dword [edi + 0x158], 7
mov dword [edi + 0x164], eax
mov dword [edi + 0x16c], eax
mov dword [edi + 0x15c], eax
mov dword [edi + 0x160], 0xffffffff
mov dword [edi + 0x168], eax
mov dword [edi + 0x170], eax
mov dword [edi + 0x174], eax
mov dword [edi + 0x178], eax
mov dword [edi + 0x17c], eax
mov dword [edi + 0x18c], eax
mov word [edi + 0x17c], ax
mov dword [edi + 0x190], 7
mov dword [edi + 4], eax
mov dword [edi + 0xd8], eax
mov dword [edi + 0xa4], eax
mov dword [edi + 0x110], eax
mov dword [edi + 0x100], eax
mov eax, edi
mov dword [edi + 0xe4], 0x4d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10059930
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008c950
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100b400c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.10007640
lea eax, [esi + 0x18]
mov dword [ebp - 4], 0
push eax
lea ecx, [edi + 0x18]
call fcn.10007640
mov byte [ebp - 4], 1
lea ebx, [edi + 0x38]
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov eax, dword [esi + 0x34]
mov dword [edi + 0x34], eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov eax, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp + 8], ecx
cmp eax, ecx
je 0x100599ef
sub ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 4
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
call fcn.1006ee80
imul ecx, esi, 0x58
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebp - 0x18], ebx
add ecx, eax
mov dword [ebx + 8], ecx
mov byte [ebp - 4], 2
mov ecx, ebx
push dword [ebx]
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.1006f740
mov dword [ebx + 4], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1006e970
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x811c9dc5
sub edx, edi
sar edx, 1
add edx, edx
je 0x1006e9a1
nop dword [eax]
movzx eax, byte [ecx + edi]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, edx
jb 0x1006e990
pop edi
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x10077c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008e6cb
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x100b400c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
lea esi, [edx + 2]
nop dword [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10077c70
sub edx, esi
lea esi, [ebx + 0x50]
sar edx, 1
mov ecx, esi
push edx
push edi
call fcn.100052a0
cmp dword [esi + 0x14], 8
mov edx, esi
jb 0x10077c95
mov edx, dword [esi]
push str.Snapshot
lea ecx, [ebp - 0x220]
call fcn.10004610
add esp, 4
mov dword [ebp - 4], 0
mov edx, dword [eax]
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10077cb6
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebx + 0x68]
call fcn.100052a0
mov dword [ebp - 4], 0xffffffff
or edi, 0xffffffff
mov edx, dword [ebp - 0x220]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10077cf6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x10077d77
cmp dword [esi + 0x14], 8
jb 0x10077d14
mov esi, dword [esi]
push str.Temp
mov edx, esi
lea ecx, [ebp - 0x224]
call fcn.10004610
add esp, 4
mov dword [ebp - 4], 1
mov edx, dword [eax]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10077d37
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebx + 0x80]
call fcn.100052a0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x10077da2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10077da2
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10077d80
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebx + 0x80]
call fcn.100052a0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1007fac0
mov esp, ebp
pop ebp
ret 4
Function at 0x1007ec90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], edx
push esi
mov esi, ecx
test eax, eax
jne 0x1007ecb6
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
mov dword [esi], 1
pop esi
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 4]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.1007ec10
test eax, eax
je 0x1007ece2
mov dword [esi], eax
mov eax, esi
mov dword [esi + 8], 0
mov dword [esi + 4], 0
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp - 4]
lea eax, [edi + 2]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x1007ed0f
pop edi
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov eax, esi
pop ebx
mov dword [esi], 3
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 8]
push edi
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
cmp eax, edi
je 0x1007ed4a
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov dword [esi + 8], 0
mov dword [esi], 2
mov eax, esi
mov dword [esi + 4], 0
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov edx, edi
mov ecx, ebx
call fcn.1007d6c0
mov ecx, eax
cmp ecx, 2
je 0x1007ed5f
cmp ecx, 3
jne 0x1007ed6d
shr edi, 1
xor edx, edx
lea eax, [edi + edi]
mov word [eax + ebx], dx
lea edi, [eax + 2]
push dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov edx, eax
sub esp, 8
push ecx
push ecx
push edi
push ebx
push eax
mov ecx, esi
call fcn.1007e9e0
add esp, 0x20
mov eax, esi
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
mov ecx, 0x6099669c
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0xc4909b7
nop
nop
nop
nop
test eax, eax
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x414755
Capabilities:
Read file on windows

Disassembly:
test dword [ebx + 0x75], ebp
and al, 0xbe
push cs
add byte [edi], al
adc byte [esi + 0x68], 0xbe
add al, byte [eax]
add byte [eax + 0x2c], ch
inc esp
inc ebp
daa
call 0xff7438f5
push 0x45f534
push esi
call fcn.00440657
pop ecx
sub byte [ecx], 0x48
push 4
lea eax, [ebp + 8]
push eax
adc dword [edi - 0x10a5d18], edx
push 4
lea eax, [ebp - 0x1e]
pushfd
lea eax, [edi - 4]
inc edi
cld
xor dword [esi], ebx
inc ebx
add al, 0x50
call 0x3e3cb3
add esp, 0x20
cmp dword [ebp + 0x10], esi
je 0x414713
push dword [ecx + 0x10]
lea eax, [edi - 8]
push dword [ebp + 0xc]
push eax
lea eax, [ebx + 8]
push edx
call fcn.00403cb3
or esp, eax
adc byte [ebx + 0x39898c4d], cl
mov ecx, dword [ebp + 0x14]
mov dword [ecx], ebx
pop edi
mov eax, esi
pop esi
pop ebx
push ecx
adc al, 0
push ebp
mov ebp, esp
add dword [eax + ebx + 0x53], 0x33
or eax, 0x5d8957c3
cld
mov eax, eax
cmp al, 0x89
push ss
push es
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, dword [ebp + 8]
push ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
shr byte [edx + 4], 0x8d
mov edx, 0xec5d89f8
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push eax
push edi
call ebx
test eax, eax
jne 0x4147cb
push dword [ebx]
xchg edx, eax
mov al, 0x44
add byte [ebx + 0x7ef685f0], cl
or edx, dword [ecx - 0x317e0949]
add byte [eax], al
pop es
add byte [edi], al
add byte [ebp + 0x550578f6], 5
and eax, 0x68568000
inc edi
add eax, dword [eax]
add byte [eax + 0x2c], ch
pop esp
inc ebp
jecxz 0x4147a5
add byte [eax], al
push 0xe3455c2c
call fcn.004038f5
push 0x2e457106
jmp 0x1334939
xor al, 0xf1
invalid
mov eax, dword [ebp - 8]
shr eax, 1
cmp eax, 0x8000ff
jbe 0x4147f9
sbb dword [0x57800700], ecx
dec ebp
add eax, dword [eax]
add byte [eax + 0x2c], ch
mov dword [0xf78bfd0c], eax
pop es
int1
cmp edi, 0x68
enter 0x45a9, 0
clc
jmp 0x414906
or dl, byte [eax - 0x7e]
pop ss
cld
push eax
call fcn.00402005
mov esi, eax
xor dh, dh
jns 0x414814
sal esp, 1
dec ecx
inc ebp
add cl, ch
and eax, 0x6a00007b
push 0
lea eax, [ebp - 0xc]
invalid
add byte [ebp - 0x250bbb], cl
jl 0x414815
clc
scasb al, byte es:[edi]
jne 0x41481c
push edi
call dword [ecx - 0x38a3f95]
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec ebp
jmp 0x4147b5
call dword [0xee29dbe8]

Function at 0x41a34d
Capabilities:
Encode data using xor

Disassembly:
test byte [eax - 0x23827c01], bl
retf
jge 0x41a31c
add byte [esp + ebp - 1], dh
jne 0x41a322
out dx, al
push edx
cdq
invalid
je 0x41a357
cmp byte [ebp - 0x28], dh
call fcn.0040278d
cmp dword [ebp - 0x2c], 0
je 0x41a365
jge 0x41a32e
add byte [eax + ecx - 1], dh
jne 0x41a334
push dword [ebp - 0x2c]
call 0x3278d
mov esp, dword [edi + 0x5fc68bfc]
pop esi
xor ecx, ebp
jge 0x41a358
mov esp, 0xc963013a
int1
push ecx
add byte [ebx + 0x74e97184], cl
invalid

Function at 0x42a839
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebp + 8]
out 0x8b, al
pop ebp
adc al, 0x88
mov esi, dword [ebp + 0xc]
xor dword [eax + edi*4 + 0x5700c77b], edi
xor ebx, dword [eax - 0x76defe77]
loope 0x42a851
mov edx, dword [esi + 8]
invalid
Function at 0x430010
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx edi, al
movzx ebp, byte [ebp - 0x5107d41d]
sbb byte [edi], cl
mov dh, 0x7e
lahf
movzx eax, byte [edx - 0x80]
sub edi, eax
jne 0x43001a
sub al, 0xc1
jle 0x42fff7
mov eax, dword [0x2be542b6]
clc
je 0x43002a
xor ebp, ecx
test edi, edi
setg byte [eax - 0x73]
or al, 0x4d
invalid
movzx ecx, byte [esi - 0x1a]
std
mov dh, 0xbd
out 0x2b, al
enter 0x1274, 0x33
xchg esp, eax
iretd

Function at 0x438666
Capabilities:
Encode data using xor

Disassembly:
in eax, 9
push 0x10
push 0xbe468620
call fcn.0042e8d0
cmp dword [ebp + 8], 0x2000
jb 0x43864a
call fcn.00433b05
push 0xffffffffffffffb2
pop esi
mov dword [eax - 0xaa418c], edi
mov eax, esi
invalid
invalid
invalid

Function at 0x43a53d
Capabilities:
Encode data using xor

Disassembly:
push cs
invalid
sub al, byte [eax]
add byte [eax], al
or eax, 0x2c
pop ebp
jp 0x43a4c9
call dword [ebp - 0x75]
in al, dx
mov edx, dword [ebp + 0x1e]
push esi
inc edx
sal byte [ebp + 0x16], cl
call fcn.00433b05
push 0x16
mov ebx, 0xef633089
xchg esp, eax
adc dword [eax - 0x75], edx
invalid
xor ecx, dword [eax + eax*2 + 0x39]
fimul word [edi + esi*2]
or eax, ebp
test byte [ebp + 0x226a1870], dl
sbb cl, ah
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x43a54a
push ebx
lea edi, [esi + 0x57c38b01]
add dword [ebx - 0x74a83d], ecx
mov eax, ebx
push edi
mov edi, edi
or dh, al
add dh, byte [eax]
test ecx, ecx
jle 0x43a5b3
mov bl, byte [edi]
test bl, bl
je 0x43a534
jbe 0x43a590
add dh, byte [ebx - 0x47e79c84]
cdq
test dword [0xec6fed7f], edi
add esi, eax
add byte [eax], al
mov byte [eax], 0
test ecx, ecx
js 0x43a5d0
cmp byte [edi], 0x35
jl 0x43a58f
jmp 0x43a5c4
jg 0x43a5c3
xor byte [eax - 0x76], cl
or byte [eax - 0xa8bc607], al
dec eax
mov cl, byte [eax]
cmp cl, 0x39
je 0x43a5c1
invalid
in al, dx
cmp dh, byte [ecx]
jne 0x43a62c
inc dword [esi + 4]
jmp 0x43a5f6
pop edi
or eax, eax
mov dword [0xccc35d5e], eax
int3
js 0x43a6a8
lea ecx, [esi - 1]
mov dword [ebp - 8], ecx
jge 0x43a635
invalid
jle 0x43a5bd
sub eax, dword [ecx]
add byte fs:[edx + 0x52], bl
invalid
retf 0xeb73
Function at 0x443d96
Capabilities:
Packed with generic packer

Disassembly:
mov esi, dword [edi - 0x3e]
test esi, esi
je 0x443cc8
mov eax, dword [esi]
push esi
dec esp
push eax
or byte [ebx + 0x5b235fc7], cl
leave
mov eax, edi
pop edi
and ebx, dword [ebx - 0x37]
sbb cl, byte [eax + eax]
retf
add byte [eax], al
mov edi, eax
insb byte es:[edi], dx
push ss
js 0x443cbb
dec ecx
dec ebp
popal
mov eax, dword [ebp - 4]
mov dword [ebp + 0x72], esi
mov dword [ecx], eax
jmp 0x443cbe
push esi
xor esi, esi
das
cli
jge 0x443ce0
mov dword [ebp - 4], esi
mov dword [eax], esi
test dword [ebp + 0x74], ecx
sub eax, 0x29eb3789
mov eax, dword [ebx + 0x10558dfc]
push edx
push eax
mov ecx, dword [eax]
sti
push ecx
sub byte [ebx + 0x780185d8], cl
pop esp
cmp dword [ebp + 0x10], 1
je 0x443d4d
mov edi, dword [esi - 4]
xchg esi, eax
leave
je 0x443d3a
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp + 0x1d], esi
mov ecx, dword [ebp + 8]
lea esp, [ecx - 4]
push edx
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ebx, eax
test ebx, ebx
je 0x443d11
test ebx, ebx
js 0x443d80
ret 0xfc4d
adc al, 0x8b
mov ebx, es
mov eax, dword [ebp + 0x50]
xor bl, bl
cmp ecx, esi
mov dword [esp + edi*8], esp
sete bl
mov dword [ebp - 0x15], esp
add ecx, dword [ebx - 0x97a038b]
mov esi, dword [ebp - 4]
test esi, esi
je 0x443d8d
mov eax, dword [esi]
push esi
call dword [eax + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
push 0xc
add byte [eax - 0x29], dh
jo 0x443d6f
in al, dx
push esi
mov word [0x457d8508], ds
sbb dword [edi + edi*8 + 0x508083ff], ebx
mov eax, dword [0x350e]
push str.c:_agent_work138_s_srclibsdutilxmlutil.cpp
mov esi, eax
call 0xd44038f5
adc byte [ebx - 0x7d], bl
jge 0x443e11
add byte [ebp + 0xd], dh
mov eax, 0x8000ff1a
push eax
push 0x200f
xor bl, bh
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x443d6b
mov eax, 0x84e424
push edi
push eax
out 0x15, al
and al, 0x67
dec esp
add byte [ebx + 0x75ff85f8], cl
pop ss
mov esi, 0x808a290e
push esi
dec eax
adc al, byte [esp]
add byte [eax + 0x68], ch
outsd dx, dword [esi]
jp 0x443df7
call 0xff8a38f5
jmp 0x443de6
push edi
inc esp
add byte [edi - 0x75], bl
invalid
Function at 0x4073a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4073b9
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
or esi, esi
je 0x4073f4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4073f0
lea ebx, [ebx]
cmp esi, edx
jae 0x4073f4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x4073e0
cmp esi, edx
jb 0x4073fb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
sub eax, eax
cmp word [esi], ax
cmove esi, eax
push esi
pop eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40a070
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42a6b8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x43581c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov edx, 0x436c28
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.0040a6a0
mov eax, dword [ebp - 0x18]
cmp dword [eax - 0xc], ebx
je 0x40a17d
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
push ecx
push eax
push ecx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040a2d0
mov edi, dword [ebp - 0x28]
or eax, eax
jne 0x40a16d
or edi, edi
je 0x40a17d
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x14]
push str.__s_
push eax
mov byte [ebp - 4], 3
call fcn.004071c0
mov esi, dword [ebp - 0x14]
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a120
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 2
push 0
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb ebx, ebx
lea edx, [esi - 0x10]
or esi, 0xffffffff
inc ebx
mov byte [ebp - 4], 2
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x40a170
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x40a170
or esi, 0xffffffff
test edi, edi
je 0x40a180
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a180
or esi, 0xffffffff
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x40a1c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
pop eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret