joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd43530
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x70
or eax, 0xffffffff
push ebx
mov ebx, 1
push ebp
push esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x74], eax
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
call fcn.00d5631a
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0xd734e8]
fadd qword [0xd73500]
call fcn.00d59970
mov ebp, eax
xor esi, esi
xor edi, edi
test ebp, ebp
jle 0xd43650
call fcn.00d5631a
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
fmul qword [0xd734e8]
fmul qword [0xd734f8]
fadd qword [0xd734f0]
call fcn.00d59970
mov ecx, eax
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jle 0xd43638
lea esp, [esp]
add ecx, ebx
cmp ecx, 0x1a
jne 0xd43629
xor ecx, ecx
mov eax, dword [esp + ecx*4 + 0x18]
add eax, esi
cdq
xor eax, edx
sub eax, edx
cmp eax, ebx
jg 0xd43620
add esi, dword [esp + ecx*4 + 0x18]
mov eax, dword [esp + 0x84]
add ecx, 0x61
mov word [eax + edi*2], cx
add edi, ebx
cmp edi, ebp
jl 0xd435e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x70
ret
Function at 0xd45b90
Capabilities:
Hash data using sha1
Read file on windows

Disassembly:
mov eax, 0x1068
call fcn.00d5a100
mov eax, dword [0xd77c24]
xor eax, esp
mov dword [esp + 0x1064], eax
mov eax, dword [esp + 0x106c]
push ebx
push ebp
push 0xd71cf8
push eax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x14], ebx
xor ebp, ebp
call fcn.00d55a07
mov eax, dword [esp + 0x14]
add esp, 0xc
cmp eax, ebx
jne 0xd45bfb
xor eax, eax
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
pop ebp
mov dword [edi + 0xc], eax
mov dword [edi + 0x10], eax
pop ebx
mov ecx, dword [esp + 0x1064]
xor ecx, esp
call fcn.00d555fc
add esp, 0x1068
ret
push esi
push 2
push ebx
push eax
call fcn.00d55ae4
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00d55d06
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
mov dword [esp + 0x2c], eax
call fcn.00d55ae4
mov eax, dword [esp + 0x28]
push eax
push 0x1000
lea ecx, [esp + 0x94]
push 1
push ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x48], 0x67452301
mov dword [esp + 0x4c], 0xefcdab89
mov dword [esp + 0x50], 0x98badcfe
mov dword [esp + 0x54], 0x10325476
mov dword [esp + 0x58], 0xc3d2e1f0
call fcn.00d56014
mov esi, eax
add esp, 0x2c
cmp esi, ebx
jbe 0xd45ca6
lea edx, [esp + 0x70]
push esi
push edx
lea ebx, [esp + 0x1c]
call fcn.00d45a00
mov eax, dword [esp + 0x14]
push eax
push 0x1000
lea ecx, [esp + 0x80]
push 1
push ecx
add ebp, esi
call fcn.00d56014
mov esi, eax
add esp, 0x18
test esi, esi
ja 0xd45c71
xor ebx, ebx
push edi
lea esi, [esp + 0x18]
call fcn.00d45aa0
mov edx, dword [esp + 0x10]
push edx
call fcn.00d560a8
add esp, 8
pop esi
cmp ebp, dword [esp + 0xc]
jb 0xd45bd4
mov ecx, dword [esp + 0x106c]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00d555fc
add esp, 0x1068
ret

Function at 0xd464a0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.00d5a100
mov eax, dword [0xd77c24]
xor eax, esp
mov dword [esp + 0x1008], eax
mov edx, dword [ebx]
mov eax, dword [esp + 0x1010]
push ebp
mov ebp, dword [0xd6b3fc]
push edi
xor edi, edi
push edi
push 4
lea ecx, [esp + 0x10]
push ecx
push edx
mov dword [esp + 0x1c], eax
call ebp
cmp eax, 4
je 0xd464f8
pop edi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00d555fc
add esp, 0x100c
ret
cmp dword [esp + 8], edi
jbe 0xd4653d
push esi
nop
mov ecx, dword [ebx]
push 0
push 0x1000
lea eax, [esp + 0x1c]
push eax
push ecx
call ebp
mov esi, eax
test esi, esi
je 0xd4653c
mov edx, dword [esp + 0x10]
mov eax, dword [edx]
push eax
push esi
lea ecx, [esp + 0x1c]
push 1
push ecx
call fcn.00d56286
add edi, esi
add esp, 0x10
mov dword [0xd7c204], edi
cmp edi, dword [esp + 0xc]
jb 0xd46500
pop esi
mov edx, dword [esp + 0xc]
mov eax, dword [edx]
push eax
call fcn.00d560a8
mov ecx, dword [esp + 0x1014]
add esp, 4
cmp edi, dword [esp + 8]
pop edi
sbb eax, eax
pop ebp
xor ecx, esp
inc eax
call fcn.00d555fc
add esp, 0x100c
ret
Function at 0xd469e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xd77c24]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.00d57c50
add esp, 0xc
cmp edi, esi
je 0xd46ac8
mov eax, 0xd717d4
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0xd46a25
sub eax, edx
sar eax, 1
je 0xd46a4f
push 0xd716f4
lea edx, [esp + 8]
push 0xd717d4
push edx
call fcn.00d55a07
add esp, 0xc
jmp 0xd46a8a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [fcn.00d6b204]
push 0xd716fc
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.00d557f4
push 0xd71718
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00d55a07
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0xd46aad
push eax
push 1
push 0x200
push edi
call fcn.00d56286
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00d560a8
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret

Function at 0xd46ae0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xd77c24]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00d57c50
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0xd46be5
mov eax, 0xd71750
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0xd46b25
sub eax, edx
sar eax, 1
je 0xd46be5
cmp dword [0xd78f90], 3
jne 0xd46b6c
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [fcn.00d6b200]
push 0xd71720
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00d557f4
add esp, 0xc
jmp 0xd46b7c
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [fcn.00d6b204]
push 0xd71750
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.00d557f4
push 0xd71724
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00d55a07
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0xd46be5
push eax
push 1
push 0x200
push esi
call fcn.00d56014
mov edx, dword [esp + 0x14]
push edx
call fcn.00d560a8
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret
Function at 0xd46c00
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0xd77c24]
xor eax, esp
mov dword [esp + 0x210], eax
push edi
push 0x206
xor edi, edi
lea ecx, [esp + 0x12]
xor eax, eax
push edi
push ecx
mov word [esp + 0x18], ax
call fcn.00d57c50
add esp, 0xc
mov dword [esp + 4], edi
cmp esi, edi
je 0xd46ccf
mov eax, 0xd71734
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0xd46c45
sub eax, edx
sar eax, 1
je 0xd46ccf
lea edx, [esp + 0xc]
push edx
push 0x104
call dword [fcn.00d6b204]
push 0xd71734
lea eax, [esp + 0x10]
push 0x104
push eax
call fcn.00d557f4
push 0xd7172c
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x18]
push edx
call fcn.00d55a07
mov eax, dword [esp + 0x1c]
add esp, 0x18
cmp eax, edi
je 0xd46ccf
push eax
push 1
push 0x200
push esi
call fcn.00d56014
mov eax, dword [esp + 0x14]
push eax
call fcn.00d560a8
add esp, 0x14
mov eax, 1
pop edi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, edi
pop edi
xor ecx, esp
call fcn.00d555fc
add esp, 0x214
ret
Function at 0xd48d90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0xd48d97
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0xd48e74
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0xd70a48]
inc ecx
sub edx, 8
sub esi, 1
jne 0xd48db0
pop edi
test edx, edx
je 0xd48e9b
jmp 0xd48e80
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0xd70a48]
inc ecx
sub edx, 1
jne 0xd48e80
not eax
pop esi
ret

Function at 0xd48ea0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0xd70a48]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0xd70a48]
mov dword [edx + 8], ecx
ret

Function at 0xd48ef0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov ecx, dword [esi + 8]
push ebx
mov edx, ecx
and edx, 0xfffd
or edx, 2
mov ebx, edx
xor ebx, 1
imul ebx, edx
mov edx, dword [esi]
shr ebx, 8
push edi
xor al, bl
movsx edi, al
xor edi, edx
shr edx, 8
and edi, 0xff
mov ebx, dword [edi*4 + 0xd70a48]
xor ebx, edx
movzx edx, bl
add edx, dword [esi + 4]
mov dword [esi], ebx
imul edx, edx, 0x8088405
inc edx
mov dword [esi + 4], edx
shr edx, 0x18
xor edx, ecx
and edx, 0xff
shr ecx, 8
xor ecx, dword [edx*4 + 0xd70a48]
pop edi
mov dword [esi + 8], ecx
pop ebx
ret
Function at 0xd4a2f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
mov edi, eax
xor ebx, ebx
cmp edi, ebx
jne 0xd4a30e
pop edi
pop ebp
mov eax, 0xffffff9a
pop ebx
add esp, 0xc
ret
cmp dword [edi + 0x18], ebx
je 0xd4a302
cmp dword [edi + 0x7c], ebx
je 0xd4a31d
call fcn.00d4a6e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.00d4a060
add esp, 0xc
test eax, eax
je 0xd4a344
pop edi
pop ebp
mov eax, 0xffffff99
pop ebx
add esp, 0xc
ret
push esi
push 0x84
call fcn.00d5565a
mov esi, eax
add esp, 4
cmp esi, ebx
je 0xd4a385
push 0x4000
call fcn.00d5565a
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
add esp, 4
mov dword [esi], eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x48], edx
mov dword [esi + 0x4c], ebx
cmp eax, ebx
jne 0xd4a392
push esi
call fcn.00d55724
add esp, 4
pop esi
pop edi
pop ebp
mov eax, 0xffffff98
pop ebx
add esp, 0xc
ret
mov dword [esi + 0x40], ebx
mov ecx, dword [edi + 0x3c]
xor eax, eax
cmp dword [edi + 0x34], ebx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x50], ebx
mov edx, dword [edi + 0x34]
sete al
mov dword [esi + 0x64], edx
mov ecx, dword [edi]
mov dword [esi + 0x60], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x68], edx
mov dword [esi + 0x18], ebx
cmp eax, ebx
jne 0xd4a3da
lea eax, [esi + 4]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call fcn.00d491b0
test eax, eax
jne 0xd4a3da
mov dword [esi + 0x40], 1
mov eax, dword [edi + 0x40]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x44]
mov dword [esi + 0x5c], ecx
mov dl, byte [edi + 0x30]
and dl, 1
mov byte [esi + 0x6c], dl
mov eax, dword [edi + 0x30]
shr eax, 3
test al, 1
je 0xd4a404
mov cl, byte [edi + 0x39]
mov byte [esi + 0x80], cl
jmp 0xd4a40d
mov dl, byte [edi + 0x3f]
mov byte [esi + 0x80], dl
movzx eax, byte [esi + 0x6c]
neg eax
sbb eax, eax
and eax, 0xc
lea edx, [esi + 0x70]
mov dword [esi + 0x7c], eax
mov dword [edx], 0x12345678
mov dword [esi + 0x74], 0x23456789
mov dword [esi + 0x78], 0x34567890
cmp ebp, ebx
je 0xd4a447
mov cl, byte [ebp]
cmp cl, bl
je 0xd4a447
call fcn.00d48ea0
add ebp, 1
jne 0xd4a436
mov ecx, dword [edi + 0x78]
mov edx, dword [esp + 0x18]
lea eax, [ecx + edx + 0x1e]
mov dword [esi + 0x3c], eax
mov dword [esi + 8], ebx
mov dword [edi + 0x7c], esi
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x100f5ba
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
mov edi, ecx
xor esi, esi
push 0x1d
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
jne 0x100f6e8
cmp dword [edi + 0x540], esi
je 0x100f6e8
push 0x222
push esi
call sub.SHELL32.dll_SHTestTokenMembership
test eax, eax
jne 0x100f6e8
push 0x40000073
call dword [sym.imp.SHELL32.dll_SHRestricted]
test eax, eax
jne 0x100f6e8
push ebx
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
mov ebx, 0x1018384
push ebx
mov edi, 0x10182f8
push edi
mov dword [ebp - 4], 8
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
jne 0x1021a9a
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0x20019
push edi
mov dword [ebp - 0x10], esi
call dword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyW]
test eax, eax
jne 0x100f6e7
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10182e8
push dword [ebp - 0x10]
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHRegQueryUSValueW]
test eax, eax
je 0x100f6ef
push 0x3c
pop ebx
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10182bc
push edi
call dword [sym.imp.SHLWAPI.dll_SHRegGetUSValueW]
test eax, eax
je 0x100f6f6
mov ecx, dword [ebp - 0x14]
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0100f6ff
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x100f6de
mov dword [ebp - 0xc], esi
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
pop ebx
mov eax, dword [ebp - 0xc]
pop edi
pop esi
leave
ret
cmp dword [ebp - 8], esi
jne 0x100f6db
jmp 0x100f699
mov ebx, dword [ebp - 8]
cmp ebx, esi
jle 0x100f6de
jmp 0x100f6b8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x10270e8
push 0x1027070
push 0x80000002
mov dword [ebp - 4], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1021adc
cmp dword [ebp - 8], esi
je 0x1021adc
mov ecx, dword [ebp - 0x14]
push 0xffffffffffffffcb
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0100f6ff
jmp 0x1021ae8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
push 2
push 8
lea eax, [ebp - 0x20]
push eax
push esi
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
jmp 0x100f65b
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x416830
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
jmp 0x41684a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x416851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x416840
mov eax, 1
add ebx, ebx
jne 0x416863
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x416858
jne 0x416874
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x416858
xor ecx, ecx
sub eax, 3
jb 0x416888
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4168fa
mov ebp, eax
add ebx, ebx
jne 0x416893
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4168a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4168c4
inc ecx
add ebx, ebx
jne 0x4168b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4168a5
jne 0x4168c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4168a5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4168e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4168d5
jmp 0x416846
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4168e4
add edi, ecx
jmp 0x416846
pop esi
lea edi, [esi + 0x14000]
mov eax, dword [edi]
or eax, eax
je 0x41694c
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x169f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x416901
mov ecx, edi
jns 0x416930
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a7c]
or eax, eax
je 0x416946
mov dword [ebx], eax
add ebx, 4
jmp 0x41691e
call dword [esi + 0x16a78]
mov ebp, dword [esi + 0x16a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x416980
sub esp, 0xffffff80
jmp 0x404843
Function at 0x10001000
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x1000116a
push ebx
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
cmp ebx, edi
je 0x10001169
push esi
lea eax, [ebx + ebx]
xor esi, esi
cmp eax, edi
je 0x1000105f
lea edi, [eax + 0x13]
and edi, 0xfffffff0
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1000105d
push edi
push 0
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
xor edi, edi
cmp esi, edi
je 0x10001168
mov eax, dword [ebp + 0xc]
push edi
push edi
push ebx
push esi
push 0xffffffffffffffff
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call fcn.1001c240
test eax, eax
jne 0x10001168
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.name.key
push esi
call ebx
test eax, eax
je 0x100010a3
push edi
push edi
push esi
push 0x10019400
jmp 0x10001114
mov eax, dword [ebp + 8]
call fcn.1001e990
test eax, eax
je 0x100010cf
push edi
push edi
push esi
push 0x1001eae0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
je 0x10001168
lea edx, [ebp + 0xc]
push edx
jmp 0x10001126
push str._secrets.key
push esi
call ebx
test eax, eax
je 0x100010f7
push edi
push edi
push esi
push 0x100205b0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
je 0x10001168
lea eax, [ebp + 0xc]
push eax
jmp 0x10001126
push str.sign.key
push esi
call ebx
test eax, eax
je 0x10001148
call fcn.10021050
test eax, eax
je 0x10001148
push edi
push edi
push esi
push 0x100210c0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
je 0x10001168
lea ecx, [ebp + 0xc]
push ecx
push esi
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
test eax, eax
je 0x10001168
test byte [ebp + 0xc], 2
jne 0x10001168
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
pop edi
pop ebp
ret 8
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapValidate]
test eax, eax
je 0x10001168
push esi
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
pop edi
pop ebp
ret 8
Function at 0x10001720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [str.Unknown]
mov ecx, dword [0x10045d9c]
push esi
push 0xfc
lea edx, [ebp - 0x110]
push 0
push edx
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 0x104
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x101
push 0
push str.SYSTEMCurrentControlSetControlClass4D36E968_E325_11CE_BFC1_08002BE103180000
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100017ae
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0x118]
push edx
lea eax, [ebp - 0xc]
push eax
push 0
push str.DriverDesc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [str.VMware_SVGA_II]
xor esi, esi
test eax, eax
je 0x100017fb
lea esp, [esp]
lea ecx, [ebp - 0x118]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100017e6
test dl, dl
je 0x100017e2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100017e6
add eax, 2
add ecx, 2
test dl, dl
jne 0x100017c6
xor eax, eax
jmp 0x100017eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10001802
mov eax, dword [esi*4 + 0x1004f804]
inc esi
test eax, eax
jne 0x100017c0
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100028d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, dword [ebp + 0xc]
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
test eax, eax
je 0x100028fd
jmp 0x100028f0
mov ecx, dword [ebp + 8]
dec eax
mov dword [ecx + eax*4], 0
jne 0x100028f0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x3c]
mov eax, ebx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10002910
sub eax, edx
jne 0x10002924
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [esp + 0x3c], eax
fild dword [esp + 0x3c]
test eax, eax
jns 0x10002936
fadd qword [0x1004b508]
fmul qword [0x1004b510]
sub esp, 8
fstp qword [esp]
call fcn.10002860
mov esi, eax
push 1
push esi
call dword [sym.imp.MSVCRT.dll_calloc]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10002963
push 1
call dword [sym.imp.MSVCRT.dll_exit]
mov al, byte [ebx]
test al, al
je 0x100029c0
mov dword [esp + 0x3c], ebx
movsx eax, al
lea ecx, [eax - 0x30]
cmp ecx, 9
ja 0x1000297c
mov eax, ecx
jmp 0x10002994
lea edx, [eax - 0x61]
cmp edx, 5
ja 0x10002989
sub eax, 0x57
jmp 0x10002994
lea ecx, [eax - 0x41]
cmp ecx, 5
ja 0x100029b1
sub eax, 0x37
test esi, esi
je 0x100029b1
lea ecx, [edi + esi - 1]
mov edx, esi
mov edi, edi
movzx ebx, byte [ecx]
shl ebx, 4
add eax, ebx
mov byte [ecx], al
shr eax, 8
dec ecx
dec edx
jne 0x100029a0
mov eax, dword [esp + 0x3c]
inc eax
mov dword [esp + 0x3c], eax
mov al, byte [eax]
test al, al
jne 0x1000296d
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
push edx
push eax
call fcn.10002800
push edi
mov esi, eax
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc