joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401870
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
cmp dword [0x8c8678], 0x400
push esi
push edi
jne 0x4018af
push 0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
lea esi, [ebp - 0x24]
call fcn.004019a0
mov ecx, esi
call fcn.004019c0
mov edi, dword [ebp - 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffA]
xor esi, esi
jmp 0x4018c0
cmp esi, 0xa50
jge 0x4018d3
push 0
lea ecx, [ebp - 0x424]
push ecx
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, 0x2af68b
jle 0x4018e9
cmp edi, 0x78d9a205
jne 0x4018f2
inc esi
cmp esi, 0x1c5d
jl 0x4018c0
mov edi, dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor esi, esi
push 0
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp esi, 0x206d47
jg 0x40191d
inc esi
cmp esi, 0x4f6a4
jl 0x401900
mov ebx, dword [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
xor esi, esi
push 0
call edi
cmp esi, 0x2b259d
jle 0x40193c
cmp ebx, 0x785074d5
jne 0x401945
inc esi
cmp esi, 0x11915
jl 0x401928
mov edx, dword [0x4a94dc]
mov dword [0x8c8678], edx
call fcn.00401600
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov edi, 0x3078f
pop ebx
cmp dword [0x8c8678], 0x51f
jne 0x40197e
push 0
lea eax, [ebp - 0x824]
push eax
push 0x4a5da4
call esi
sub edi, 1
jne 0x401962
mov eax, dword [0x8c75c8]
mov dword [0x8c7c0c], eax
call eax
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4045bb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a87a8]
jne 0x4045c5
repz ret
jmp fcn.0040a02c
Function at 0x40cf2a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405266
and dword [ebp - 4], 0
cmp dword [0x4aa374], 0
mov ebx, eax
jne 0x40cfdb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40d08c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40d08c
push eax
call fcn.004051f4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4aa374], eax
call esi
push eax
call fcn.004051f4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4aa378], eax
call esi
push eax
call fcn.004051f4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4aa37c], eax
call esi
push eax
call fcn.004051f4
pop ecx
mov dword [0x4aa384], eax
test eax, eax
je 0x40cfdb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004051f4
pop ecx
mov dword [0x4aa380], eax
mov eax, dword [0x4aa380]
cmp eax, ebx
je 0x40d033
cmp dword [0x4aa384], ebx
je 0x40d033
push eax
call fcn.0040526f
push dword [0x4aa384]
mov esi, eax
call fcn.0040526f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40d033
test edi, edi
je 0x40d033
call esi
test eax, eax
je 0x40d02a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40d02a
test byte [ebp - 0xc], 1
jne 0x40d033
or dword [ebp + 0x10], 0x200000
jmp 0x40d06c
mov eax, dword [0x4aa378]
cmp eax, ebx
je 0x40d06c
push eax
call fcn.0040526f
pop ecx
test eax, eax
je 0x40d06c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40d06c
mov eax, dword [0x4aa37c]
cmp eax, ebx
je 0x40d06c
push eax
call fcn.0040526f
pop ecx
test eax, eax
je 0x40d06c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4aa374]
call fcn.0040526f
pop ecx
test eax, eax
je 0x40d08c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40d08e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x56c7b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x10f000]
push edi
jmp 0x56c7ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x56c7d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56c7c0
mov eax, 1
add ebx, ebx
jne 0x56c7e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x56c7f4
jne 0x56c813
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56c813
dec eax
add ebx, ebx
jne 0x56c800
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x56c7d8
add ebx, ebx
jne 0x56c80f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x56c865
xor ecx, ecx
sub eax, 3
jb 0x56c82b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x56c89a
sar eax, 1
mov ebp, eax
jmp 0x56c836
add ebx, ebx
jne 0x56c836
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56c804
inc ecx
add ebx, ebx
jne 0x56c844
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x56c804
add ebx, ebx
jne 0x56c851
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x56c846
jne 0x56c862
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x56c846
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x56c884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x56c876
jmp 0x56c7c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x56c884
add edi, ecx
jmp 0x56c7c6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x56c8a2
cmp byte [edi], 0x11
jne 0x56c8a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x56c8a7
lea edi, [esi + 0x165000]
mov eax, dword [edi]
or eax, eax
je 0x56c91f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f31f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f336c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x56c8d4
mov ecx, edi
jns 0x56c903
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f3370]
or eax, eax
je 0x56c919
mov dword [ebx], eax
add ebx, 4
jmp 0x56c8f1
call dword [esi + 0x1f3380]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x56c950
cmp al, 0xef
ja 0x56c943
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x56c925
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x56c932
mov ebp, dword [esi + 0x1f3374]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x56c984
sub esp, 0xffffff80
jmp 0x420577
Function at 0x78c69c
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x78c6e1
mov ebx, ebp
lea edx, [edx + ebx]
xchg ah, al
bsr cx, si
jmp 0x78c70a
sub esp, 0xac
mov esi, esp
setno ah
not cx
bswap ecx
jmp 0x78c6cb

Function at 0x84a365
Capabilities:
Check for peb beingdebugged flag
Packed with generic packer

Disassembly:
mov dword [esp], edx
pushfd
pop word [esp + 2]
jmp 0x84a3bb
pushal
lea esp, [esp + 2]
mov dword [esp + 0x60], edi
lea esp, [esp + 0x60]
mov eax, dword fs:[0x30]
jmp 0x84a3a5

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x40c1a4
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4122e4], 0
jne 0x40c225
cmp dword [0x412304], 0
jne 0x40c1d4
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x412304], eax
test eax, eax
jne 0x40c1d4
push str.GetEnvironmentStrings_failed
call fcn.0040b214
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x412304]
jmp 0x40c1e8
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c1e0
lea edi, [ebp + 1]
push edi
call fcn.00404260
pop ecx
mov ebx, eax
mov dword [0x4122e8], ebx
test ebx, ebx
jne 0x40c212
xor eax, eax
jmp 0x40c2e8
push edi
mov edx, dword [0x412304]
push edx
push ebx
call fcn.00404fdc
add esp, 0xc
jmp 0x40c245
xor esi, esi
mov ebx, dword [0x4122e4]
jmp 0x40c23f
push eax
call fcn.0040512c
pop ecx
test eax, eax
jne 0x40c23b
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c22f
lea ebx, [esi + 4]
push 4
mov dword [0x4122ec], ebx
inc ebx
push ebx
call fcn.00404060
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c268
xor eax, eax
jmp 0x40c2e8
cmp dword [0x4122e4], 0
jne 0x40c299
xor esi, esi
mov ebx, dword [0x4122e8]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c28a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.0040512c
pop ecx
mov edi, eax
test eax, eax
jne 0x40c280
jmp 0x40c2ca
xor esi, esi
mov ebx, dword [0x4122e4]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c2c4
push eax
call fcn.0040512c
pop ecx
test eax, eax
je 0x40c2b9
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c2bd
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c2a8
mov eax, dword [0x4122e4]
test eax, eax
je 0x40c2da
push eax
call fcn.00404270
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4122e4], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x17686dbf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x17056b22
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40c501
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4186f8
cmp edx, dword [eax]
je 0x40c523
add eax, 8
inc ecx
cmp eax, 0x418788
jl 0x40c514
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4186f8]
jne 0x40c651
mov eax, dword [0x41934c]
cmp eax, 1
je 0x40c62b
test eax, eax
jne 0x40c554
cmp dword [0x4162e4], 1
je 0x40c62b
cmp edx, 0xfc
je 0x40c651
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40c58b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004076f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40c5ce
lea eax, [ebp - 0x1a4]
push eax
call fcn.004076f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x414780
push edi
call fcn.0040d860
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407fb0
lea eax, [ebp - 0xa0]
push 0x4161cc
push eax
call fcn.00407fb0
push dword [esi + 0x4186fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407fb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d7cd
add esp, 0x2c
pop edi
jmp 0x40c651
lea eax, [ebp + 8]
lea esi, [esi + 0x4186fc]
push 0
push eax
push dword [esi]
call fcn.004076f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40fd06
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x40fd41
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x40fd1e
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x40fd5d
dec esi
je 0x40fd56
dec esi
jne 0x40fd62
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp fcn.00431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x785e47b8
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..rsrc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x547f570f
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x653f04
call dword [sym.imp.MSVCRT.dll_wcslen]

Function at 0x493e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.Tag_Mixer_0A635E9C_5AAB_4b1c_A846_7D2B8581BF5C
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x493e44
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x493e3a
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x67
call fcn.0044a610
jmp 0x493e47
mov esi, dword [ebp - 4]
call fcn.0044a610
jmp 0x493e47
mov esi, dword [ebp - 4]
jmp 0xbe9034

Function at 0x4f8421
Capabilities:
Authenticate hmac

Disassembly:
movsb byte es:[edi], byte [esi]
out dx, eax
adc ch, byte [esi + ebx*8]
inc ecx
push eax
adc ah, byte [eax - 0x69159919]
loope 0x4f8368
out 0xa3, al
retf
in al, 0xc3
jecxz 0x4f836a
cwde
mov al, 0xe2
std
mov bh, 0x48
lahf
les eax, ss:[ebx + 0x70]
lodsd eax, dword [esi]
sbb dword [ebp + 0x29], ecx
cmp byte [eax + ecx*2 - 0x34], bl
dec eax
int3
sub dword [edx], ecx
push 0x8deffede
xchg edi, eax
mov byte [0x8d318103], al
rcl dword [edi + 0x4cff51c4]
hlt
and eax, 0x5e987e8c
mov eax, dword [0xb23122c4]
xchg ebx, eax
in eax, dx
jecxz 0x4f83d3
pop ds
jecxz 0x4f844d
invalid
mov bl, 0x95

Function at 0x526ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
and ebx, 0xff
and edx, 0xff
and edx, 0xfffffffc
shl edx, 0x18
sar edx, 0x16
or edx, ebx
mov dword [esp + 0xc], edx
mov edx, 3
jmp 0x526cbc
fild dword [esp + 0xc]
add edi, 4
dec esi
fmul qword [0x41e400]
fstp dword [edi - 4]
jne 0xcd1f38db
int3
fsubr dword [eax + 0x61]
mov bh, byte [edi + 0x6fa8472]
mov cs, word [esi + eax*4 - 0x28]
test ch, bl
sbb byte [esi + edi*4], al
jns 0x526c76
push es
add ah, ah
push ebx
fcom dword [edi + 0x74bd122b]
push esi
pop edx
loope 0x526d6c
invalid
dec ecx
leave
xor ebx, esi
sti
imul ebx, esp, 0xa2d8d707
rcl cl, 0xd3
xchg ecx, eax
out dx, al
invalid
Function at 0x53161a
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
movsb byte es:[edi], byte [esi]
dec esi
pop ss
sbb dword [edi - 0x4c3866c9], 0x8ab0f3d1
mov fs, word [edx - 0x54]
mov cl, 0xa0
inc ecx
pop eax
xchg edx, eax
daa
jl 0x5315f6
sub al, 0x17
adc dword [esi], edx
add dword [eax], ecx
sub eax, 0x3cc6d3d
hlt
push eax
jbe 0x531604
loop 0x5315e6
pop edi
jl 0x5315db
pop ebx
adc al, 0x17
idiv ebp
mov eax, dword [0xd3c9e394]
xchg ecx, eax
mov esp, 0xebe0be81
insd dword es:[edi], dx
mov word [ebx], ds
sub edi, 0xffffffb3
adc dword [ebx + 0x2e], edx
xchg ch, al
nop
push esp
fld qword cs:[eax + 0x7b]
lds edx, [eax + 0x40dd2e54]
jnp 0x53158d
fld qword [eax + 0x7b]
mov dword [0xa1c3201d], eax
bound esi, qword [edi]
sbb eax, 0x62a1c320
aaa
test dword [edi - 0x195d0a2a], ebx
shl dword [edi - 0x3c7e1c2f], 1
shl dword [ebx], 0xe1
xor byte [eax], 0x63
cmp al, 0x34
push ecx
xor al, 0x51
mov eax, dword [0x431b1b9e]
jle 0x53164a
adc bh, byte [edx + 0x41d65282]
adc dword [esi + 0x342998f], esi
lahf
cmc
dec esp
popfd
nop
pushal
out dx, eax
stc
sub eax, 0x40fc5283
lodsd eax, dword [esi]
outsd dx, dword [esi]
loope 0x5315c0
adc eax, 0xfd7235a1
sub ecx, ebp
out dx, eax
or eax, 0xd5ed3082
ja 0x53168d
invalid
and dl, byte [ecx]
das
push eax
cmc
xor ebx, dword [eax - 0x79]
dec esi
out dx, eax
jne 0x5315e2
lds edi, [ebx + edi]
ja 0x531654
mov cl, 4
shr ah, 1
mov dh, 0xff
jecxz 0x5316a1
pop ecx
push ebx
ja 0x5316de
dec ebx
push eax
call 0x68aca5
loopne 0x5316a1
scasd eax, dword es:[edi]
xor cl, byte [ebp + 0x67]
leave
xor dh, byte [0xd4bfefe3]
stc
add dword [ebx - 0x5899cfd2], 0x8fa17362
mov al, byte [0x20719262]
mov eax, dword [0x9262a08f]
jno 0x5316a9
xchg edx, eax
pushal
mov bl, 0x92
jnp 0x531704
sbb cl, byte [edi + ecx*2]
rol dword [ecx], 1
shl dword [esi - 0x646e8ca0], 0x89
xchg esp, eax
pop edx
mov ecx, 0x7763cae
wait
mov dword [edx + ebx*2 + 0x763caeb9], edx
pop es
mov edi, 0x1174dc95
push ebx
mov eax, dword [0x615173d2]
sal byte [ebx + 0x51], cl
push ecx
popal
xor bh, byte [ecx + 0x2d3bf020]
loopne 0x531647
jecxz 0x531699
mov byte [0x1346d5b0], al
sal byte [ebp - 0x50], cl
inc edx
xchg ecx, eax
adc ebx, ebx
dec ebp
push esp
xor esp, dword [ebx]
arpl word [eax + 0x51], bp
sub eax, 0x8bf21d41
loope 0x531682
rol dword [ebp - 0x3f], 1
fstp qword [ecx + 0x33]
and dl, byte [eax - 0x6f]
add dword [ecx + 0x71], ecx
jae 0x5316c0
loope 0x531703
and ebx, dword [edi + edi*4 + 0x71bc8e6d]
pushfd
mov edi, 0x71bc8e6d
xor cl, byte [edi - 0x32]
sbb eax, dword [ecx]
js 0x5316ab
inc eax
in eax, dx
das
fucom st(5)
rol al, cl
int1
in eax, dx
cmp ebx, dword [edi - 0x19390e0e]
and esi, dword [esi - 0x6c399e7f]
inc edx
pushal
ret

Function at 0x532d1e
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
test eax, 0x134e4701
and ebx, ebx
imul esp, dword [ebp - 0x381f6dd0], 0x6a
pop es
xor byte [edx + 0x76ac7e0], dl
dec ecx
xlatb
lar edx, word [eax]
mov dword [0x8cf5f9a1], eax
adc al, 0x87
adc eax, 0xce3bf782
cmpsd dword [esi], dword es:[edi]
js 0x532d28
retf
Function at 0x57a84d
Capabilities:
Encode data using xor

Disassembly:
std
mov dl, 0x57
mov word [edx], cs
lcall 0x80cb, 0x2d6e02c7
add eax, 0x34f81f1a
outsd dx, dword [esi]
sub cl, byte [ecx + 0x20af8992]
push 0x48a45a35
idiv ebp
popal
mov edx, 0x5a80d330
invalid
fidiv dword [ecx]
arpl word [edi - 0xb94c4e5], si
out dx, al
or byte [edx - 0x7cc8140], cl
push edx
pop ebx
rol byte [esi + 0x76], 1
popal
jl 0x57a7ce
push ecx
clc
rol byte [edx + 0x38], cl
sub dword [ebx], ebp
sar ch, 0x3c
mov eax, 0x964a9f73
push ecx
or al, 0x4d
xor byte [esp + edi + 0x40599fc7], ah
fiadd word [ebx - 0x4f5e73e2]
mov word [ecx - 0x227ea750], fs
jge 0x57a876
int 0xa0
sbb dword [esi], 0xffffff8c
mov eax, dword [0xdd8158b0]
mov word [ecx - 0x227ea750], fs
jge 0x57a876
int 0xa0
jae 0x57a8ce
pushal
jb 0x57a84b
rcl byte [eax + ecx*2 + 0x42], cl
pop edi
mov esi, 0xfbaa017
bound edi, qword [edi + 0x72]
pushal
loope 0x57a82e
mov ss, word [eax - 0x26]
sbb byte [ebx + 0x647a5ec1], 0x3e
jecxz 0x57a81a
leave
and al, 0x58
rcl ah, 1
loopne 0x57a8f6
mov ecx, 0x318f1b55
pop ecx
into
cld
invalid
sbb eax, 0xa75282b7
lcall 0xdf66, 0x106f8a08
or byte [edx - 0x2099ef91], cl
arpl word [ecx - 6], di
cmc
mov bh, 0xb9
retf 0x7f83
nop
jb 0x57a8c8
ret 0xed2a

Function at 0x57bb8d
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [ebp + 0x454fbb12]
sbb al, 0xe2
pop ebp
and byte fs:[ebx], dh
xor ebx, dword [ecx - 0x4e]
add edi, ecx
lodsb al, byte [esi]
jmp 0x77a1f7
clc
inc ecx
pushfd
jo 0x57baa3
and byte [edx], dl
shl byte [eax + 0x49], 1
imul esp, ecx, 0x24
pushal
popf
outsb dx, byte [esi]
add byte [edx + 0x51], cl
pushal
mov dh, 0x72
jl 0x57bb03
cld
sbb ah, 0x2c
and ebx, dword [eax]
adc byte [esi - 0x6d13a0f4], dl
in al, dx
xchg edx, eax
pop eax
mov esi, 0x44a7fc0
push ss
push esp
dec esp
or eax, 0x7a8a1f95
and dh, byte [edi + 0x44ba649d]
push ds
jbe 0x57bbae
pop ds
mov bh, byte [edx + 0x22]
mov bh, 0x9d
mov edx, 0x70761e44
jge 0x57bb32
sti
sti
jne 0x57bb02
in al, dx
lcall 0x7252, 0x575e7afc
dec ebx
or dh, byte [0xe6083344]
sti
loope 0x57bb89
test eax, 0xf47ea03a
adc al, 0xc8
dec edx
push ebx
mov eax, 0x9490d340
pop ebx
aad 0xd9
adc dword [ecx], esi
clc
sbb byte [edi - 0x35], dl
sub esi, dword [ebp + 0x76]
clc
or byte [eax], dl
adc dword [eax], eax
stosb byte es:[edi], al
push cs
out dx, eax
inc ecx
xor cl, byte [eax]
out dx, eax
bound ecx, qword [ecx + ebp*8 + 0x13148153]
movsd dword es:[edi], dword [esi]
jno 0x57bb64
sbb dword [edx], edx
fdivp st(6)
call 0x66ca84df
jb 0x57bbf5
invalid
jb 0x57bbf5
push eax
inc edi
sahf
inc ebp
in eax, dx
sub eax, eax
js 0x57bb3f
int 0x40
inc eax
jae 0x57bb33
js 0x57bb99
aaa
outsb dx, byte [esi]
aaa
jno 0x57bb25
out dx, al
daa
lodsd eax, dword [esi]
loope 0x57bba8
inc dword [ecx - 0x46]
jmp 0xbbb32652
inc ecx
mov edx, 0x6aa1e9f3
pop ebx
push 0x5b
mov ebx, 0x28c73b50
mov word [edi - 0x16d0c5ff], cs
xchg bl, ah
invalid
xchg esp, eax
mov ebp, 0x9b7affb8
fsub st(3)
inc ecx
invalid