joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423b14
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x45da54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
push 0x230
xor edi, edi
push edi
push esi
call fcn.0042bbd0
push 0xffffffffffffffff
push dword [ebx + 0xc]
lea eax, [esi + 0x24]
push 0x104
push eax
call fcn.00432c8f
push eax
call fcn.00401734
mov eax, dword [ebx + 4]
add esp, 0x20
cmp eax, dword [0x450280]
je 0x423c7e
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x40]
push ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x423c92
lea eax, [ebp - 0x30]
push eax
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x423c92
mov eax, dword [ebp - 0x30]
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x1c], eax
mov eax, dword [ebx + 0xc]
cmp dword [eax - 0xc], edi
jne 0x423bad
mov eax, edi
jmp 0x423bdc
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x423bca
lea edx, [ebp - 0x28]
push edx
push edi
push eax
call fcn.0042390f
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, dword [ebp - 0x28]
jmp 0x423bd3
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
lea eax, [ecx + 1]
neg eax
sbb eax, eax
and eax, ecx
mov dword [esi + 0x20], eax
lea eax, [ebp - 0x38]
push eax
call fcn.00423dd5
test eax, eax
je 0x423c01
push 0xffffffffffffffff
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042379b
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x423c05
mov ecx, edi
mov eax, edi
mov dword [esi], ecx
mov dword [esi + 4], eax
lea eax, [ebp - 0x40]
push eax
call fcn.00423dd5
test eax, eax
je 0x423c2c
push 0xffffffffffffffff
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042379b
mov ecx, dword [eax]
mov eax, dword [eax + 4]
jmp 0x423c30
mov ecx, edi
mov eax, edi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x48]
push eax
call fcn.00423dd5
test eax, eax
je 0x423c58
push 0xffffffffffffffff
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x50]
call fcn.0042379b
mov edi, dword [eax]
mov ecx, dword [eax + 4]
jmp 0x423c5a
mov ecx, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], ecx
mov eax, dword [esi]
or eax, dword [esi + 4]
jne 0x423c6c
mov dword [esi], edi
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x10]
or eax, dword [esi + 0x14]
jne 0x423c7e
mov eax, edi
mov dword [esi + 0x10], eax
mov eax, ecx
mov dword [esi + 0x14], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004293b7
leave
ret 4
xor eax, eax
jmp 0x423c81
Function at 0x424024
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x424077
push esi
push dword [ebp + 8]
call fcn.00424213
mov edi, eax
test edi, edi
je 0x424072
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x424072
mov eax, dword [ebp - 8]
jmp 0x424089
mov eax, dword [ebp + 0x10]
jmp 0x424089
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc

Function at 0x42408f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x444814
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.00429b20
mov eax, dword [0x45da54]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 0x58], 0
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 0x2024], eax
je 0x4241c6
push 0
push edx
call fcn.00424213
mov ebx, eax
test ebx, ebx
jne 0x4240f7
push esi
jmp 0x4241ee
call fcn.00411f18
push eax
lea ecx, [ebp - 0x2014]
call fcn.004116ff
xor ecx, ecx
lea eax, [ebp - 0x2018]
push eax
push ecx
lea eax, [ebp - 0x2020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x2024]
mov dword [ebp - 0x2020], ecx
push ebx
mov dword [ebp - 0x2018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x424185
mov eax, dword [ebp - 0x2018]
lea ecx, [ebp - 0x2014]
shr eax, 1
push eax
call fcn.00401af0
lea ecx, [ebp - 0x2018]
push ecx
push eax
lea eax, [ebp - 0x2020]
push eax
push 0
push dword [ebp - 0x2024]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x2014]
mov dword [ebp - 0x201c], eax
call fcn.0040b352
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x201c], 0
jne 0x4241b3
mov esi, dword [ebp - 0x2014]
add esi, 0xfffffff0
push esi
call fcn.004022e8
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00401b78
jmp 0x4241f5
push esi
mov ecx, edi
call fcn.00401621
mov ecx, dword [ebp - 0x2014]
lea ecx, [ecx - 0x10]
jmp 0x4241ac
test esi, esi
jne 0x4241cf
mov esi, 0x44581c
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x2010]
push 0x1000
push ecx
push esi
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x2010]
push eax
mov ecx, edi
call fcn.00401621
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004293b7
leave
ret 0x10

Function at 0x4390b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00438f2b
Function at 0x43bcc9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043b81c
Function at 0x1003b014
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1003b023
pop dword [ebp - 8]
mov eax, 0x7be90b05
add eax, 0x941aa51e
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd9b6c03a
sub dword [ebp - 0x18], 0x8b647aef
mov dword [ebp - 0x14], 0xda5adabf
sub dword [ebp - 0x14], 0xa8278e7a
mov dword [ebp - 0x10], 0x81254313
sub dword [ebp - 0x10], 0x34d8fee5
mov dword [ebp - 0xc], 0x670552be
add dword [ebp - 0xc], 0x98faad42
lea eax, [ebp - 0x18]
push eax
mov eax, 0x666367e5
sub eax, 0x565f8769
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x1190047f
add dword [ebp - 0x18], 0x62e264d7
mov dword [ebp - 0x14], 0xf20ba4f2
add dword [ebp - 0x14], 0x4f60bc83
mov dword [ebp - 0x10], 0x21ade8dc
add dword [ebp - 0x10], 0x41c18390
mov dword [ebp - 0xc], 0xa344ebd7
sub dword [ebp - 0xc], 0xa344ebd7
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3f048
push 0
call eax
mov ecx, 0x4b09fc8a
add ecx, 0xb4f650d9
mov edi, eax
mov ebx, 0xc2a2fae8
sub ebx, 0xb29be8e8
add ebx, dword [ebp - 8]
mov esi, 0x605285d9
add esi, 0xa9fc15cf
add dword [ebp - 4], edx
mov edx, dword [ebx]
sub dword [ebp - 4], 0xb3685f1
add edx, esi
mov dword [ebp - 4], 0x88482fab
mov dword [edi], edx
xor dword [ebp - 4], esi
add edi, 0x531b56d2
add edi, 0xace4a932
add ebx, 0x2d66ab81
sub ebx, 0x2d66ab7d
loop 0x1003b140
add eax, 0x5db31547
add eax, 0xa24e1318
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x43534b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.0042708b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x435383
xor eax, eax
jmp 0x4353af
cmp esi, dword [ebp - 4]
je 0x4353ac
cmp dword [ebp + 0xc], 0
je 0x4353ac
push dword [edi + 0x9c]
call fcn.00434f59
push dword [edi + 0x9c]
mov esi, eax
call fcn.00424fcd
pop ecx
pop ecx
cmp esi, eax
je 0x43537f
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x62ab90
Capabilities:
Encode data using xor

Disassembly:
push edx
mov dh, 0x9b
stosb byte es:[edi], al
aaa
pop edx
pop ebp
sbb byte [eax + 0x3f6b0f5b], 0x23
fiadd dword [edx + 0x28]
loop 0x62abdb
mov byte [edi], 0x21
xor edi, dword [edi - 0x850d1f]
push ds
add al, 0x70
sal dword [edi - 0x67c55368], 1
ror dword ss:[ebx - 0x1a], 0x52
lahf
test dword ds:[edx - 0x6b], esp
invalid
clc
and edx, dword [esi + 0x14]
xchg dword [ebp - 0x77f8a88], eax
test byte [ecx - 0x47], 0xc2
xchg edi, eax
and ebx, ecx
inc ebx
and eax, 0xb1765322
add esp, dword [esi - 0x7f6f0c7d]
jb 0x62abdb
invalid

Function at 0x408ea7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x408ea7
lcall 0x5de5, 0x8b10c483
jmp loc.0080d95c
Function at 0x547889
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
xchg esp, eax
inc esi
aad 0x99
jle 0x547896
mov ch, 0xae
scasb al, byte es:[edi]
push ebx
fnstsw word [edi]
aas
push esp
push cs
mov edi, 0x5e9c334
mov dh, 0x15
or al, cl
inc esp
dec esp
jbe 0x547867
xchg edx, eax
cli
inc esi
retf
jge 0x54785a
cmp byte [edi], cl
adc eax, 0xfa6e8931
out dx, eax
push ss
ja 0x54789b
xchg edx, eax
aad 0xcd
in eax, 0xe0
inc ebp
sbb al, 0x95
fiadd word [0x864b3254]
inc ecx
fdivr qword [ebx - 0x4a45a4a2]
cmp eax, 0xb01ae995
push es
xor eax, 0x1e635514
add eax, 0xa6cb15f4
insd dword es:[edi], dx
push eax
test byte [edi + 0x51ee713a], 0xe3
mov ch, 0x7c
movsd dword es:[edi], dword [esi]
mov cl, 0x65
jle 0x5478a6
push ebx
sbb eax, 0x4f294a03
mov byte [ebx], 0x61
into
aam 0x13
in al, 0xf3
pop ebx
mov esi, 0x3c94e42
scasd eax, dword es:[edi]
jle 0x5478e7
movsd dword es:[edi], dword ds:[esi]
movsd dword es:[edi], dword [esi]
jp 0x547958
push ebp
out dx, al
sub edi, dword [edx + 0x1c0df670]
invalid
xor cl, byte [eax]
adc dword [ecx + 0x57ddb8e0], edi
mov eax, ebp
xchg ebx, eax
retf 0x8577
mov dword [0x507bcd25], eax
cmp eax, 0x77201533
fidivr word [ecx - 0x4f]
wait
fdivr dword [esi]
rcr byte [0x170e444e], 1
scasd eax, dword es:[edi]
sub al, byte [esi + edi - 0x129911a1]
mov esp, 0x7bafc8d7
mov edi, 0x9052641a
outsd dx, dword [esi]
push 0x35
sub dh, byte [esi + 0x4c]
cmp al, byte [esi + 3]
test byte [ecx], dh
cmc
xor al, bh
ja 0x547948
sal dword [edx + 0x2faf55e9], 0x7e
xor al, 0x4a
mov ebx, 0x6702a5f9
mov ecx, 0xf2255f18
dec ecx
pop edi
mov ds, edx
fisttp word [eax - 0x68e5746a]
psubb mm0, qword [esi - 0x4508928c]
fistp qword [ecx + ebx*4 - 0xd]
jg 0x547990
jmp 0x7e8428ec
sar byte [edi], cl
xor al, 0xff
cli
into
ja 0x547992
dec edx
sub eax, 0xe1ba2394
jecxz 0x5479ce
mov bh, 0x9f
out 0x8f, eax
xchg byte [edx + 0xf74b104], ah
fcomp qword [esi - 0x22ab77cb]
pop dword [esi + 0x74b104a2]
paddusb mm3, qword [esi - 0x22ab77cb]
mov bh, 0x1d
mov edi, 0x7256cfb3
or bl, 0xa6
pop es
lodsb al, byte [esi]
lds edi, [ebp + 0x5c6d1e20]
movsb byte es:[edi], byte [esi]
push ecx
or esi, dword [ebx + 0x667c45ce]
aam 0x9d
add dword [esi], eax
test byte [eax], dh
outsd dx, dword [esi]
fisub word [ebx + ebp - 0x3c]
adc esi, dword [eax]
test eax, 0x903f449b
invalid
Function at 0x570789
Capabilities:
Encode data using xor

Disassembly:
aad 0xdd
adc bl, bh
adc dl, byte [ebp - 0x604b5e49]
arpl word [esi + ebx*8], bp
aas
pop ss
mov dl, byte [ebx]
xor dword [ecx - 0x66], ecx
cmc
add al, 0xd5
xchg ecx, eax
ret 0xf2de
popal
jne 0x5707f0
adc ecx, edi
pushal
outsd dx, dword [esi]
cmc
push 0xb9b303e3
mov al, 0xbc
fsub dword [eax]
stosd dword es:[edi], eax
jno 0x5707d2
cli
dec ebp
dec edx
je 0x570759
sub al, 0x26
fidiv dword [eax]
mov eax, dword [0x6da33703]
mov al, ch
add edx, ebx
xor bh, ch
cmpsd dword [esi], dword es:[edi]
push eax
call 0xd49b3e78
pop edi
push esp
mov ch, 0x76
or dword [ebx], eax
xor bh, byte [esi + 0x51]
or bh, dh
loop 0x570833
test dl, cl
fisttp qword [eax]
inc ebp
and byte [eax], dl
inc ebx
invalid
in eax, dx
cmc
movsb byte es:[edi], byte [esi]
arpl bx, sp
jmp 0x5707d0
invalid
add eax, 0xcedad931
sub eax, 0x1eb74ba3
pop eax
cmp al, 0xbd
cld
add eax, 0x357f6569
push es
sbb eax, 0xb35077e3
scasd eax, dword es:[edi]
invalid

Function at 0x5ccea9
Capabilities:
Encode data using xor

Disassembly:
mov es, word [edi - 0x3832ddfd]
and ebp, edx
push cs
adc al, byte [esi]
mov eax, dword [0x9345ecd6]
mov byte [0x90e34463], al
std
push ss
pop eax
or al, bl
pop ebx
pop esp
stosd dword es:[edi], eax
jae 0x5cceb1
popfd
mov ah, 0x89
push edi
ror dword [eax], 1
and dword [0xa7637c90], ebp
popfd
push cs
ror esp, cl
aas
xchg ecx, eax
adc eax, 0x35c6e6
jae 0x5cced2
jb 0x5ccec6
pop es
push eax
add al, 0x6e
scasd eax, dword es:[edi]
and al, 0x75
rol bh, 1
push edi
xchg dword [edi + 0x3153c797], ebp
mov eax, 0xb2d74218
in eax, dx
sbb byte [edx - 0x29], al
mov dl, 0x67
in eax, dx
arpl word [edi - 0x41], ax
jb 0x5cce96
push ebx
ja 0x5ccee7
aaa
shl dword [edi - 0x442c58b7], 1
sar dword [ebx + 0x6734ca80], cl
out dx, eax
sar dword [ebx + 0x6734ca80], cl
out dx, eax
xchg edi, eax
aam 0xef
shr esp, 0xee
fcmovb st(0), st(1)
test dword [eax + 0x77], edi
lea edx, [ebp + 0x49d897ce]
and byte [ecx - 0x2b9e39aa], cl
sbb byte [esi - 0x35dbd82d], dl
ja 0x5cce49
xchg ebp, eax
into
xchg edi, eax
fmul dword [ecx + 0x20]
mov dword [esi - 0x3a], edx
popal
aam 0x18
xchg esi, eax
shl dword [edi], cl
and al, 0xca
aam 0x15
pop ds
or eax, 0xef383341
xor edi, dword [eax]
out dx, eax
test byte [eax + 0x7421ae30], 0x9d
cmpsb byte [esi], byte es:[edi]
test esi, esp
xchg ebx, eax
popal
jge 0x5cceba
dec edi
test dword [ecx + 0x1104e07b], 0xb38d7e36
add eax, 0x689e960
add al, 0xe0
not byte [ecx - 0x58939991]
xlatb
mov dword [0x67e29770], eax
xor bh, byte [eax + 0x7a]
add dword [esi], edx
pop es
cdq
mov dl, 0x10
movsd dword es:[edi], dword [esi]
sbb dword [edx], edx
add ah, byte [ebx - 0x782b012d]
shr byte [esi], cl
sbb ah, byte [eax - 0x2d]
pop edx
push eax
cmc
invalid
loopne 0x5cceed
adc dword [esi], esi
jle 0x5cce7a
mov bl, 5
pushal
jmp 0xe060d57e
Function at 0x62c0b9
Capabilities:
Encode data using xor

Disassembly:
rcr esp, cl
jmp 0x9669d7ac
and byte [esi - 0xe], dh
ret
sub eax, dword [ebx - 0x70]
adc esp, dword [ebx - 0x42]
mov bl, 0xbd
dec ebp
sbb byte [edx + 0x2d], bl
sub eax, 0x4313c612
shl eax, cl
inc ebp
sub eax, 0x4313c612
shl eax, cl
inc ebp
mov dl, 0xc8
xor byte [eax + 0x47f497b2], al
mov ecx, 0xb20fd720
sahf
dec eax
aam 0x17
js 0x62c0ac
and byte [eax + 0x5a], dh
loopne 0x62c0a8
test cl, ah
shr ah, 1
out dx, eax
mov ch, 0xa9
xchg byte [edi], dh
mov edi, 0x86374a08
mov bh, al
and al, byte [ebx]
push edx
test eax, 0x8bf3786
dec edx
aaa
xchg byte [eax + 0x520322c7], cl
dec edi
push ds
and byte [eax + 0x26d86629], ch
or eax, esi
pop eax
stosb byte es:[edi], al
mov dl, byte [edx - 0xc]
mov fs, word [eax - 0x16c76ce]
push ss
adc dword [edx], edi
xor esp, esp
jno 0x62c09b
in al, 0x71
xchg edx, eax
mov ebx, 0x53534c1b
inc ebx
in eax, dx
rcl esp, cl
sub eax, 0x5e5ac6ab
insd dword es:[edi], dx
jae 0x62c0e0
mov dl, dl
push ebx
adc bl, ch
hlt

Function at 0x650b69
Capabilities:
Encode data using xor

Disassembly:
jbe 0x650be2
push cs
lcall 0x92b6, 0x80f19c92
push ds
adc al, 0xbc
pop eax
aas
xchg esi, eax
popfd
sar bl, cl
loop 0x650bd0
jne 0x650ba9
jmp 0xb6bedfa7
jo 0x650bcf
adc edx, dword [ebx]
xor bh, byte [edx]
jb 0x650c2d
test byte [ecx + 0x22], dh
mov eax, dword [0xb9beec98]
adc byte [edx - 0x5bf7051], al
push esp
pop eax
fcmovbe st(0), st(7)
push es
and eax, esi
je 0x650b6b
popal
ror dword [0x12f301c8], cl
and esi, 0xda91647f
xchg ebx, eax
fnstsw word [edx - 0x1f]
int 0xdc
xchg edi, eax
xchg esp, eax
and ecx, ecx
int1
out 0x7f, al
xchg ecx, eax
ficom dword [ebx - 0x321e8523]
fcom qword [edi - 0xe36de6c]
das
int3
bound edx, qword [esp + 4]
invalid
jl 0x650c9d
dec ebx
cmpsb byte [esi], byte es:[edi]
imul eax, dword [edx - 0x6c522e43], 0xfffffff4
add dword [ecx], 0xffffffda
sub esi, 0x77b615f0
push ecx
cmc
xor ah, byte [edx + edx]
bound edi, qword [bp + di + 0x55]
inc esp
ja 0x650c7f
ret 0xce62
bnd ret 0xb20e
mov byte [0x121bb41c], al
and dword [ebp + eax - 0x15f94b94], ecx
inc edx
pop edi
inc edx
push ecx
invalid
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x43eb65ba
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42f314
nop
mov ecx, 0x67795127
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x40560d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40561c
pop dword [ebp - 0x2c]
mov eax, 0xc9865063
add eax, 0x36ba05b9
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xa3f55c70
sub dword [ebp - 0x3c], 0x55a31725
mov dword [ebp - 0x38], 0x11ffad2d
add dword [ebp - 0x38], 0x20339f18
mov dword [ebp - 0x34], 0xdf7b8116
add dword [ebp - 0x34], 0x6cd0c318
mov dword [ebp - 0x30], 0x9f1f1fd8
sub dword [ebp - 0x30], 0x9f1f1fd8
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x15f991cb
sub dword [ebp - 0x3c], 0xa1872875
mov dword [ebp - 0x38], 0x706d93b
sub dword [ebp - 0x38], 0xc59a77c6
mov dword [ebp - 0x34], 0x7358b71f
sub dword [ebp - 0x34], 0xfe94ab3
mov dword [ebp - 0x30], 0x5b2c0aea
add dword [ebp - 0x30], 0xa4d3f516
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x1ab95387
add eax, 0xe5877cc5
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3bbe3
push 0
call eax
mov ecx, 0x50e5
xor edi, edi
add edi, eax
mov ebx, 0x41b000
add ebx, dword [ebp - 0x2c]
mov edx, 0x120b7335
mov esi, dword [ebx]
xor dword [ebp - 0x18], 0x4388851f
sub esi, edx
sub dword [ebp - 0x28], edx
mov dword [edi], esi
add dword [ebp - 0x18], eax
add edi, 0x485f0d12
sub edi, 0x485f0d0e
add ebx, 0xc4f961a3
add ebx, 0x3b069e61
loop 0x405729
add eax, 0x13667
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x10003110
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000b4b5
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10010400]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0xc], 1
jne 0x10003234
push str.e55843b9_71bf_4923_a5fe_fddd093a3702_0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10003170
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10002d30
push 0
push 0
call esi
push 4
call fcn.10009d8f
mov dword [ebp - 0x1c], eax
mov dword [eax], 0x10003010
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
push ecx
push 0
push eax
push 0x100036e0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x1c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x10003225
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1000321d
push ecx
push eax
call dword [sym.imp.MSVCP140.dll__Thrd_detach]
add esp, 8
test eax, eax
jne 0x1000321d
push eax
push eax
push eax
push 0x10002970
push eax
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x18], xmm0
call esi
push 0
push 0
push 0
push 0x10002c70
push 0
push 0
call esi
push 0
push 0
push 0
push 0x100018a0
push 0
push 0
call esi
cmp dword [ebp - 0x14], 0
je 0x10003234
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
push 1
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
push 6
mov dword [ebp - 0x14], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10009d81
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10003740
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x3c
mov eax, dword [0x10010400]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 4]
xorps xmm0, xmm0
push eax
push 0x28
xor esi, esi
movaps xmmword [esp + 0x18], xmm0
push 0xffffffffffffffff
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100037d3
lea eax, [esp + 8]
push eax
push str.SeDebugPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x100037c9
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x30]
mov dword [esp + 0x14], 1
push eax
push 0x10
lea eax, [esp + 0x1c]
mov dword [esp + 0x24], ecx
push eax
push esi
push dword [esp + 0x18]
mov dword [esp + 0x34], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, eax
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.10009d81
mov esp, ebp
pop ebp
ret
Function at 0x10005010
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push 0x1000d320
push 0x64
call fcn.1000a637
mov esi, eax
add esp, 8
test esi, esi
je 0x1000517f
push 0x63
lea ecx, [esi + 1]
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea eax, [esi + 4]
mov byte [esi], 1
push 2
push eax
call sub.MSVCP140.dll__Mtx_init_in_situ
lea eax, [esi + 0x34]
push eax
call sub.MSVCP140.dll__Cnd_init_in_situ
xorps xmm0, xmm0
mov dword [0x10035be0], esi
add esp, 0x18
movq qword [esi + 0x5c], xmm0
cmp dword [esp + 0x18], 0
mov esi, dword [esp + 0x10]
je 0x1000508e
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10005083
cmp byte [eax], 0
je 0x10005083
push eax
push esi
call fcn.10005600
jmp 0x1000508b
push 0
push esi
call fcn.10005570
add esp, 8
call sub.KERNEL32.dll_GetCurrentProcessId
push 0x100104f0
mov dword [0x100359dc], eax
call sub.MSVCP140.dll__Mtx_lock
add esp, 4
test eax, eax
jne 0x1000518e
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100050c6
movups xmm0, xmmword [eax]
movups xmmword [0x10031594], xmm0
movq xmm0, qword [eax + 0x10]
jmp 0x100050d0
xorps xmm0, xmm0
movups xmmword [0x10031594], xmm0
movq qword [0x100315a4], xmm0
xorps xmm0, xmm0
push 0x100104f0
movups xmmword [0x100315ac], xmm0
movq qword [0x100315bc], xmm0
call sub.MSVCP140.dll__Mtx_unlock
add esp, 4
cmp dword [0x10031590], 0
jne 0x10005189
push esi
call fcn.10009390
mov dword [0x10031590], eax
mov dword [eax + 8], 0x100039d0
mov eax, dword [0x10031590]
mov dword [eax + 0xc], 0x10003980
mov al, 1
mov esi, dword [0x10035be0]
xchg byte [esi], al
push 4
call fcn.10009d8f
add esp, 8
test eax, eax
je 0x1000513e
mov dword [eax], esi
jmp 0x10005140
xor eax, eax
lea ecx, [esp + 8]
push ecx
push 0
push eax
push 0x100039e0
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
mov dword [esp + 4], ecx
test ecx, ecx
je 0x10005194
cmp dword [esi + 0x60], 0
je 0x10005170
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, dword [esp + 8]
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
pop esi
add esp, 8
ret
mov dword [0x10035be0], 0
pop esi
add esp, 8
ret
push eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
push 6
mov dword [esp + 0xc], 0
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3