joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458e3c
Capabilities:
Terminate process

Disassembly:
or edx, edx
jns 0x458df6
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.004558fd
jb 0x458e30
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045bc48
call fcn.00456343
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.0045bc48
jmp 0x458e22
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044ea4b
push eax
call fcn.00458eb0
jb 0x458e28
cmp ecx, edx
ja 0x458e28
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x458df0
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x458df0
mov ecx, ebx
mov edi, ebp
jmp 0x458e52

Function at 0x459109
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045596c
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.00455959
pop edi
call fcn.0045596c
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x45913d
jne 0x459190
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.004558fd
jb 0x459175
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045bc48
call fcn.0045bc48
call fcn.00456343
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.0045bc48
call fcn.0045bc48
call fcn.0045bc48
call fcn.0045b702
jmp fcn.0044ea56
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x45913d
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.0045924c
jb 0x4591b9
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x4591a6
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x45913d
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x4591d2
jmp 0x459173
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x4591d0
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.004558fd
jb 0x459175
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.0045924c
jb 0x45922f
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x4591ef
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x459157
Function at 0x4592f4
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.00459351
pop ecx
jb 0x45934c
ret
jmp fcn.0044ea4b

Function at 0x4598fe
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045596c
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
jecxz 0x459939
test ebx, ebx
jns 0x459932
push edx
push edi
push ebx
call fcn.00459536
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.00459a36
jmp 0x45998f
test ebx, ebx
jns 0x45994d
push ecx
push edi
push ebx
call fcn.004598d4
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.004599d6
jmp 0x45998f
call fcn.004558fd
jb 0x4599c6
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045bc48
call fcn.00456343
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.0045bc48
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044ea4b

Function at 0x459d49
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045596c
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
jecxz 0x459d93
push ebx
push ecx
push esi
push edi
call fcn.0045955f
pop eax
pop esi
pop ecx
pop ebx
add edi, ecx
sub edx, ecx
jae 0x459d85
xor edx, edx
push edx
push edi
push ecx
push esi
sub edi, ecx
mov ecx, edi
sub ecx, eax
mov esi, eax
jmp 0x459d9d
call fcn.0045981d
push edx
push edi
push 0
push esi
mov edx, dword [ebx + 0x14]
mov edi, dword [ebp - 0x6c]
add dword [ebp - 0x6c], edx
mov al, byte [ebx + 6]
cmp al, 0x2c
je 0x459dcb
cmp al, 0x2e
je 0x459df3
ja 0x459dfc
dec edx
cmp ecx, edx
jb 0x459dba
mov ecx, edx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edi], cl
jmp 0x459e03
cmp ecx, edx
jb 0x459dd1
mov ecx, edx
sub edx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov eax, 0x20202020
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
jmp 0x459e03
call fcn.00459ca7
jae 0x459e03
jmp 0x459e1d
call fcn.00459cc7
jb 0x459e1d
pop esi
pop ecx
pop edi
pop edx
dec dword [ebp - 0x68]
jne 0x459d6e
call fcn.0045bc48
call fcn.0045bc48
pop edi
pop esi
ret
pop esi
pop ecx
pop edi
pop edx
call fcn.0045bc48
call fcn.0045bc48
pop edi
pop esi
jmp fcn.0044ea56
Function at 0x45a37c
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.0045596c
je 0x45a44e
mov esi, dword [ebp + esi - 0x6c]
call fcn.00455959
je 0x45a44e
cmp edx, ecx
jb 0x45a44e
push edx
push edi
call fcn.00459536
pop edi
pop edx
mov ebx, eax
test ebx, ebx
je 0x45a44e
push edx
mov dword [ebp - 0x60], edx
mov eax, ecx
mul ebx
mov ebx, ecx
pop ecx
sub ecx, eax
push edi
push dword [ebp - 0x60]
call fcn.004558fd
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x68], edx
pop edx
pop edi
jb 0x45a459
mov dword [ebp - 0x64], edi
mov ecx, ebx
push ebx
push esi
push edi
call fcn.0045955f
pop eax
pop esi
pop ebx
jae 0x45a3fc
mov edx, dword [ebp - 0x64]
add edx, dword [ebp - 0x60]
sub edx, eax
jmp 0x45a422
push esi
push edi
mov esi, eax
mov ecx, edi
sub ecx, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x6c], edi
pop edi
pop esi
add edi, ebx
sub edx, ebx
cmp edx, ebx
jae 0x45a3e3
mov eax, edi
mov ecx, edx
mov esi, eax
mov edi, dword [ebp - 0x6c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x68]
call fcn.0045bc48
call fcn.00456343
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
jmp 0x45a453
call fcn.0045bc48
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
call fcn.0045bc48
call fcn.0045bc48
call fcn.0045b702
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0044ea4b

Function at 0x45a80c
Capabilities:
Terminate process

Disassembly:
pop esi
jmp fcn.0044ea56
push esi
call fcn.004559d1
jb 0x45a806
cmp word [esi + 0xa], 1
mov al, 0x36
jne 0x45a830
fild qword [esi + 0x14]
test word [esi + 0xc], 1
je 0x45a82b
fiadd dword [esi + 0x24]
fiadd word [esi + 0x2e]
pop esi
ret
fldz
jmp 0x45a806

Function at 0x45a876
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x45a896
and esi, 0xfffffffe
jne 0x45a8a0
xchg dword [ebx], esi
call fcn.00455931
pop edi
pop esi
ret
call fcn.00455959
mov edi, dword [ebx]
or edi, edi
je 0x45a8b0
cmp ecx, dword [edi - 4]
je 0x45a8d0
call fcn.004558fd
jb 0x45a8e0
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00455931
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00455931
pop edi
pop esi
jmp fcn.0044ea56
Function at 0x45a8f0
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x45a90d
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.00455959
call fcn.004558fd
jb 0x45a92f
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.0044ea56

Function at 0x45a938
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x45a958
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00455959
call fcn.004558fd
jb 0x45a97d
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.0044ea56

Function at 0x45ab3a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.00455959
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.00455959
jecxz 0x45abb0
test ebx, ebx
je 0x45abb8
add ebx, ecx
xchg ecx, ebx
call fcn.004558fd
jb 0x45abc5
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00455931
mov esi, dword [ebp + edi - 0x6c]
call fcn.00455931
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0044ea56

Function at 0x45adec
Capabilities:
Terminate process

Disassembly:
mov edx, eax
call fcn.0044eb1e
jb 0x45adf9
mov eax, dword [eax + edx]
ret
jmp fcn.0044ea56

Function at 0x45b4f9
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x45b526
je 0x45b522
shr esi, 1
jae 0x45b547
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00455931
jmp 0x45b505
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x45b558
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.0044f462
pop ebx
jae 0x45b505
pop esi
pop edx
pop eax
jmp fcn.0044ea56
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x45b505
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x45b505
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x45b505
Function at 0x45bd54
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x180
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x6c], edi
call fcn.0045c6b7
jb 0x45bda9
call fcn.0045be71
jb 0x45bda9
call fcn.0045beaa
mov eax, dword [ebp - 0xc]
cmp eax, 0x80000
ja 0x45bd9d
call fcn.00458d2b
mov dword [ebp - 0x180], esp
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0x1c]
dec edx
imul edx, dword [ebp - 0xc]
add edx, ecx
call fcn.0045bdbc
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
ret 0x3c
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x6c]
mov esp, ebp
pop ebp
pop edx
add esp, 0x3c
push edx
jmp fcn.0044ea56

Function at 0x45c876
Capabilities:
Terminate process

Disassembly:
mov edx, 5
jmp fcn.0044ea4b
push esi
push edi
mov edi, dword [ebp - 0x88]
mov edi, dword [ebp + edi - 0x6c]
call fcn.0045596c
push ebp
mov ebp, esp
cmp edx, 0x1f
jb 0x45c894
mov edx, 0x1f
push edx
push edi
xor eax, eax
mov ecx, 0xf
push eax
loop 0x45c89d
cld
mov ecx, dword [ebp - 4]
mov esi, dword [ebp - 8]
lea edi, [ebp - 0x28]
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x29], al
mov eax, dword [ebp + 0x18]
mov byte [ebp - 0x2d], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
test eax, eax
jne 0x45c8d0
mov eax, 0x41000000
mov dword [ebp + 0x20], eax
mov dword [ebp - 0x34], 0x190
mov edx, dword [ebp + 0x1c]
test edx, 1
je 0x45c8ec
mov dword [ebp - 0x34], 0x2bc
test edx, 2
je 0x45c8f8
mov byte [ebp - 0x30], 1
test edx, 4
je 0x45c904
mov byte [ebp - 0x2f], 1
test edx, 8
je 0x45c910
mov byte [ebp - 0x2e], 1
call fcn.0045605d
jb 0x45c940
mov edi, eax
inc dword [edi + 4]
mov edx, dword [ebp + 0x20]
mov dword [edi + 0x18], edx
cld
mov ecx, 0xf
lea esi, [ebp - 0x44]
lea edi, [edi + 0x1c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xc]
mov esp, ebp
pop ebp
call fcn.0045bc48
pop edi
pop esi
ret 0x14
mov esp, ebp
pop ebp
call fcn.0045bc48
pop edi
pop esi
pop eax
add esp, 0x14
push eax
xor eax, eax
jmp 0x44ea38
Function at 0x49fee1
Capabilities:
Encode data using xor

Disassembly:
adc dword [ecx], edi
fcomp st(0)
bound edi, qword [esi + 0x53b46067]
in eax, dx
sub al, byte [ecx - 0x5f]
inc esp
sbb dh, byte [eax + ecx*8 - 0x7c]
enter 0xffffffffffffac0d, 0x67
sbb dword [edx + 0x18], ebx
sbb byte [edx], dh
fmul qword [ebp - 1]
sbb dword [edx + 0xf538945], ebp
sbb byte [edx], dh
fmul qword [ebp - 1]
sbb dword [edx + 0xf538945], ebp
cmp esi, dword gs:[0x119e5e8]
mov esi, 0x592172b7
lahf
adc byte [esi - 0x5a862cf7], al
sub eax, 0x39359851
cmp byte [eax + 0xa], dl
in al, dx
test eax, 0xc4cc0199
fild qword [edx]
test eax, 0x138182c9
shl byte [edi], 1
jo 0x49fec8
scasd eax, dword es:[edi]
or byte [edi], dl
or al, 0x3d
xor dword [esi], edi
int1
pop esi
mov ecx, 0xa97d9bb5
popal
imul edx, dword [ecx], 0xffffffbc
or eax, 0x3d463329
test al, 0x18
push 0x48ac8cdd
lds ebp, [eax - 0xd]
ret

Function at 0x4a3a75
Capabilities:
Encode data using xor

Disassembly:
push es
test dword [edi - 0x57], esi
and bh, byte [ecx - 0x62e129f]
not dword [ecx + 0x59a13909]
imul esp, dword [edi + 0x2736572b], 0xd79b9dda
adc eax, 0x60406189
pop ebx
push eax
mov byte [edi + 0x6bff97a9], bh
cmp byte [ecx - 0xc7013e5], al
arpl word [ecx + 0x6c88aa47], di
enter 0x1984, 0xffffffffffffffb0
cmp byte [eax], ch
salc
arpl word [eax], cx
and ah, bh
xor ebx, esi
xchg dword [esp + ebx*4], ecx
sbb dword [eax + 0x63d62838], esi
or byte [edx], ah
out 0x31, eax
xrelease xchg dword [esp + ebx*4], ecx
push eax
jno 0x4a3a2a
fldcw word [eax]
invalid
jb 0x4a3a5f
pop ebp
clc
pop ds
or dword [edi + 0x4f], ebx
leave
cmp byte ds:[edi], ah
enter 0xffffffffffffb540, 0xffffffffffffffee
cmp al, 0xa2
ret 0x4256

Function at 0x4eec71
Capabilities:
Encode data using xor

Disassembly:
invalid
fst qword [esi]
sbb eax, 0x2a20bf54
call 0x3127563c
cmp dh, al
test eax, 0xeb1db950
pop es
call 0x41f5f13e
arpl word [edi - 0x272c5366], ax
fistp dword [ebp + 0xcc511ce]
xchg dword [eax + 0x26], esi
lahf
inc edx
fcmovbe st(0), st(3)
sbb eax, 0x1cdc2d56
sub dword [esi + 0x50], eax
in eax, dx
push cs
cmp esi, edx
adc eax, 0x62f6402
imul al
inc esp
adc bl, byte [esi + 0x38]
loop 0x4eebf0
xchg ebx, eax
pop ecx
lea esp, [edx - 0x42]
pop eax
inc ebx
dec ebx
ja 0x4eecc6
push 0xffffffffffffffc9
leave
sal byte [ecx + 0x39], 0x8c
jp 0x4eec13
or ch, byte [ebp + edx + 0x27]
clc
imul edi, dword [ecx - 0x14], 2
jns 0x4eec5f
add ch, byte [ebx - 0x1683f3b2]
sbb al, 0xb7
invalid
inc edx
jns 0x4eec5f
add ch, byte [ebx - 0x1683f3b2]
sbb al, 0xb7
sub byte [edx + 0x3f], al
sub byte [0x8e168ae7], bh
mov bh, 0xfd
lds ecx, [edi]
popfd
add dword [esi - 0x5ed183e6], eax
ffree st(1)
invalid
jle 0x4eec63
daa
invalid
Function at 0x555053
Capabilities:
Encode data using xor

Disassembly:
in al, dx
push dword [0x8d645c51]
invalid
invalid
lea ecx, fs:[esi - 0x104da5e0]
mov fs, word [eax]
pop edx
mov dl, 0xef
out dx, eax
xor byte [esi + edi + 0x7d], ah
insd dword es:[edi], dx
enter 0xffffffffffffd433, 0x1d
sbb eax, 0x3dbcc74b
in eax, 0xf9
xor dword [edx - 0x1813d938], eax
adc dword [ebp - 0x10], 0x2b
dec eax
sbb byte [esi + edx*2], bh
dec dword [edi + 0x290aa078]
sub dword [ebp + 0xec1183], esi
mul dword [eax - 4]
sbb ah, dh
dec esi
mov esp, 0xac50974
and eax, ebx
mov ch, 0xbc
sub al, 0xc6
cdq
in al, dx
test al, 0xb6
jne 0x555024
fcmovnbe st(0), st(4)
invalid
pop esp
adc esi, esp

Function at 0x61bc1d
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edi + 0x298828fb], 0x9b
sbb byte [0x36ed7d01], ch
sbb dword [eax], ebp
jmp 0x61bcab
fisttp qword [edx + 0x487e0ea4]
add eax, 0xa9c876e4
stosb byte es:[edi], al
xor al, byte [ebp + 0x7a80d897]
arpl word [edx - 0x51], bp
push ds
popfd
test dh, cl
push ds
xor ebp, dword [esi + 0x39]
sub edx, dword [edx - 0x620ae11e]
invalid

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x4052c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4052e7
xor eax, eax
jmp 0x405367
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4052fe
xor eax, eax
jmp 0x405367
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40534a
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x40534a
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov edx, dword [ebp - 4]
lea eax, [edx + ecx*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
jmp 0x405321
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x405356
xor eax, eax
jmp 0x405367
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
test ecx, ecx
jne 0x405364
xor eax, eax
jmp 0x405367
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406000
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0044fcd0
add esp, 4
add eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x407b80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
mov dword [0x4a543c], 0
mov dword [ebp - 4], 0
jmp 0x407ba5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x18
jge 0x407bd0
push 0
push 0x407a30
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x4a543c], 0
je 0x407bce
jmp 0x407bd0
jmp 0x407b9c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408342
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4a3e54]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x11c], eax
mov esi, ecx
lea eax, [ebp - 0x120]
jne 0x4083e0
push 0x4857bc
push 4
push eax
call fcn.00451768
push eax
call fcn.00408230
add esp, 0x10
push ebx
push edi
call fcn.00451812
mov edi, dword [eax]
call fcn.00451812
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0044b55b
add esp, 0x18
mov dword [ebp - 0x11c], eax
call fcn.00451812
cmp dword [eax], ebx
je 0x4083f7
call fcn.00451812
push dword [eax]
call fcn.00408268
pop ecx
jmp 0x4083fe
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x408388
jmp 0x408485
call fcn.00451812
mov dword [eax], edi
cmp dword [ebp - 0x11c], 0xffffffff
je 0x408481
cmp dword [ebp - 0x11c], esi
jae 0x408481
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x15c]
push ebx
push eax
mov dword [ebp - 0x160], 0x40
call fcn.0044bc50
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x408470
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x408470
lea ecx, [ebp - 0x160]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x408470
push ebx
push ebx
push esi
jmp 0x408479
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x408483
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0044b637
leave
ret

Function at 0x40bb29
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x40bb4d
cmp dword [edi + 0x54], 0
jne 0x40bb4d
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.0041b350
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.0040baea
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8