joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015b90
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10021cf0
push 0x10017e80
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x10024008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x10015bf9
xor eax, eax
jmp 0x10015d6f
mov dword [ebp - 4], ebx
push 0x1001e384
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d3a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x10015d3a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d3a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x10015d3a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d3a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x10015d3a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d3a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x10015d3a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10015d3a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x10015d3a
push 0x1001e3c8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x10015d3a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10015d23
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x10015d10
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x10015d20
jmp 0x10015d3a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.10015d96
test ebx, ebx
jne 0x10015d6d
test esi, esi
je 0x10015d5f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10015d6d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016050
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x10024008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x100160b5
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10016090
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100160b5
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.10017527
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.10017527
add esp, 8
ret 4

Function at 0x10016f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
test esi, esi
je 0x1001709f
cmp byte [esi + 0x54], 0
je 0x1001709f
add esi, 0x1c
xor bl, bl
mov dword [ebp - 0x40], esi
mov byte [ebp - 0x3c], bl
test esi, esi
je 0x10016fe0
mov eax, dword [esi]
test eax, eax
je 0x10016fdd
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10016fd4
cmp eax, 0x80
je 0x10016fd4
xor bl, bl
jmp 0x10016fda
mov byte [esi + 4], 1
mov bl, 1
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 0x3c], bl
push ecx
mov edx, ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.10012890
add esp, 4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], 0x10
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
cmp dword [eax + 0x14], 8
jb 0x10017017
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10017065
push 2
push 0
push 0
push edi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call fcn.10005260
mov dword [ebp - 4], 2
test esi, esi
je 0x10017091
test bl, bl
je 0x10017091
mov eax, dword [esi]
test eax, eax
je 0x1001708d
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [esi + 4], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 4
Function at 0x10017390
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001aa88
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10024008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x100173d3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.100159d0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x100173fc
lea eax, [esi + 8]
jmp 0x100173fe
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x1001740e
cmp dword [ebx + 0x14], 8
jb 0x10017410
mov ebx, dword [ebx]
jmp 0x10017410
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x10017431
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10017431
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x1001745a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1001746f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.10017568
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017527
mov esp, ebp
pop ebp
ret 4
Function at 0x4035a8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x420450]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x20
mov eax, 0x41a245
call fcn.0040e847
mov edi, dword [ebp + 0x12c]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0x1c]
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
call fcn.0040df00
add esp, 0xc
push ebx
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
mov dword [ebp + 0x18], 0xf
call fcn.0040249e
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], ebx
jmp 0x403686
cmp byte [ebp - 0xd], bl
je 0x403640
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040336c
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x40366b
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.0040336c
inc dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x403620
mov eax, dword [ebp - 0x14]
cmp dword [0x42176c], eax
jne 0x4036ad
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x4036a3
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push 1
lea ecx, [ebp]
call fcn.00402e87
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0040df7a
add ebp, 0x124
leave
ret 4
Function at 0x40624b
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x406299
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x4062aa
push 0xd
pop eax
jmp 0x4062d4
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x4062ad
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x406619
Capabilities:
Create thread

Disassembly:
cmp byte [0x4217c2], 1
jne 0x406666
push edi
xor edi, edi
cmp dword [0x4217c4], edi
jne 0x406665
push esi
push 0x4217c4
push edi
push edi
push 0x40645e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
jne 0x406650
mov dword [0x4217c4], edi
jmp 0x406664
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x406664
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
ret

Function at 0x406d8f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 1
push esi
push str.SoftwareIntelDisplayigfxcuiigfxcfg
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406dea
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.DCRotationCaps
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0xc], 1
pop esi
sete al
leave
ret
Function at 0x407198
Capabilities:
Get geographical location
Identify system language via api
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
movzx eax, ax
push esi
push 3
push eax
mov dword [ebp - 0xc], eax
call edi
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0040c1e9
pop ecx
push ebx
push eax
push 3
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareIntelDisplayigfxcuihkcmd_resources
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40721d
push ebx
push dword [ebp - 8]
push 1
push esi
push str.UserLangID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
pop edi
pop esi
pop ebx
je 0x40722e
push dword [ebp - 8]
call fcn.0040c450
pop ecx
leave
ret

Function at 0x4076a9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420450]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.0040620a
mov ebx, eax
cmp ebx, esi
je 0x407719
lea ecx, [ebp - 0x70]
call fcn.00406195
mov eax, ebx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040df7a
add ebp, 0x9c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x407731
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.004076a9
cmp eax, esi
jne 0x407763
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x407721
lea ecx, [ebp - 0x70]
call fcn.00406195
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0040613a
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00406195
mov eax, esi
jmp 0x4076ff
Function at 0x40aba3
Capabilities:
Check os version

Disassembly:
push 0xa0
mov eax, 0x41a72b
call fcn.0040e8b0
mov ebx, dword [ebp + 8]
and dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], ebx
xor edi, edi
lea eax, [ebp + 0xc]
inc edi
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00403329
push 0x94
lea eax, [ebp - 0xa4]
push 0
push eax
mov dword [ebp - 0xa8], edi
call fcn.0040df00
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x40ac33
cmp dword [ebp - 0xa0], 5
jne 0x40ac33
push str.Global_
mov ecx, ebx
call fcn.0040336c
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.0040306f
push 0
push edi
lea ecx, [ebp + 0xc]
call fcn.00402e87
mov eax, ebx
call fcn.0040e8fa
ret

Function at 0x40aeb9
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov byte [ebp - 1], 1
cmp dword [0x4217d0], ebx
jne 0x40aef6
push 0x4217d0
push ebx
push ebx
push 0x40ac46
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x40aeef
mov dword [0x4217d0], ebx
mov byte [ebp - 1], bl
jmp 0x40aef6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x40df7a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420450]
jne 0x40df84
repz ret
jmp fcn.0040ff01

Function at 0x415880
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410e9c
and dword [ebp - 4], 0
cmp dword [0x4222c0], 0
mov ebx, eax
jne 0x415931
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4159e2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4159e2
push eax
call fcn.00410e2a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4222c0], eax
call esi
push eax
call fcn.00410e2a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4222c4], eax
call esi
push eax
call fcn.00410e2a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4222c8], eax
call esi
push eax
call fcn.00410e2a
pop ecx
mov dword [0x4222d0], eax
test eax, eax
je 0x415931
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410e2a
pop ecx
mov dword [0x4222cc], eax
mov eax, dword [0x4222cc]
cmp eax, ebx
je 0x415989
cmp dword [0x4222d0], ebx
je 0x415989
push eax
call fcn.00410ea5
push dword [0x4222d0]
mov esi, eax
call fcn.00410ea5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415989
test edi, edi
je 0x415989
call esi
test eax, eax
je 0x415980
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415980
test byte [ebp - 0xc], 1
jne 0x415989
or dword [ebp + 0x10], 0x200000
jmp 0x4159c2
mov eax, dword [0x4222c4]
cmp eax, ebx
je 0x4159c2
push eax
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159c2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4159c2
mov eax, dword [0x4222c8]
cmp eax, ebx
je 0x4159c2
push eax
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159c2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4222c0]
call fcn.00410ea5
pop ecx
test eax, eax
je 0x4159e2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4159e4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x404d1d77
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x76fd24d9
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x438cad
Capabilities:
Encode data using xor

Disassembly:
push 0x438a14
pop ebx
sub esi, 0x79365dd1
call fcn.00438ce6
push eax
pop esi
xor dword [edi], ebx
add esi, esi
inc eax
inc edi
or esi, eax
push esi
mov eax, dword [esp]
add esp, 4
add esi, 0x7c6af5d8
cmp edi, edx
jne fcn.00438cad
sub esi, 0x92f05692
dec esi
ret
Function at 0x404637
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor ebx, ebx
mov word [esi + 0x1a], bx
push 0x7e
push esi
call fcn.00403291
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
jmp 0x4046bd
cmp ebx, dword [esi]
jne 0x404663
cmp ebx, edi
jge 0x404663
mov edi, ebx
mov eax, ebx
sub eax, edi
je 0x404680
dec eax
je 0x40467b
dec eax
je 0x404676
add ebx, dword [ebp + 0xc]
mov bl, byte [ebx]
jmp 0x40468f
mov bl, byte [esi + 0x1a]
jmp 0x404699
mov bl, byte [esi + 0x1b]
jmp 0x404699
mov bl, byte [esi + 0x18]
test edi, edi
je 0x40468f
cmp edi, dword [ebp + 0x10]
jne 0x40468f
or bl, 8
movzx eax, bl
push eax
push esi
call fcn.00404610
movzx eax, bl
bt dword [0x405190], eax
jae 0x4046b0
push 0x7d
push esi
call fcn.00403291
xor bl, 0x20
movzx eax, bl
push eax
push esi
call fcn.00403291
inc dword [ebp - 8]
lea eax, [edi + 3]
cmp dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
jl 0x404659
push 0x7e
push esi
call fcn.00403291
push esi
call fcn.004031a1
movzx ecx, byte [esi + 0x18]
shr ecx, 4
and cl, 7
mov edi, ecx
lea eax, [esi + 0x18]
push eax
call fcn.00404a48
mov eax, dword [ebp + 0xc]
mov dword [esi + edi*4 + 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + edi*4 + 0x3c], eax
lea eax, [ebx - 3]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x8e0dd4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e0dda
pop ebp
sub ebp, 6
sub ebp, 0x4e0dd4
jmp 0x8e0e38
jmp 0x8e0e41
add al, 0
add byte [eax], al
or eax, 0xb87bf552
aam 0xd
dec esi
add byte [ebx], al
lds eax, [ecx + 0x93c0]
add byte [ecx + 0x61f], bh
mov eax, 0x4e0dd4
add eax, ebp
add eax, 0x93
mov ecx, 0x61f
mov edx, 0x6f55b763
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e0e58
jmp 0x8e0e6b
or dword [ebx], esp
or esp, dword [ebx + 0x73]
arpl word [ebx + 0xb], sp
arpl word [edi - 0x6c1d9cb1], bp
mov dl, 0x2c
and edi, dword [edi + 0x2cb293e2]
and edi, dword [edi - 0x63cc5cb0]
neg byte [edi + 0x32]
daa
arpl word [ebx], si
call 0x6078f740
arpl word [ebx + 0x63], sp
loop 0x8e0e39
wait
arpl word [ebx + 0x63], sp
pushal
scasb al, byte es:[edi]
invalid