joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002bef9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059fb1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c040
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x5f8b
mov dword [ebp - 0x38], str.gnx_bxcqao_wmhsh_ztmd
cmp dword [ebp - 0x28], 0x6169
jle 0x1002bfd1
and dword [ebp - 0x14], 0
jmp 0x1002bf5b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2d0b
jge 0x1002bfd1
and dword [ebp - 0x18], 0
jmp 0x1002bf71
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3bea
jge 0x1002bfcf
and dword [ebp - 0x1c], 0
jmp 0x1002bf87
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x100c
jge 0x1002bfcd
and dword [ebp - 0x20], 0
jmp 0x1002bf9d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5d17
jge 0x1002bfcb
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10074f78
call fcn.10009792
jmp 0x1002bf96
jmp 0x1002bf80
jmp 0x1002bf6a
jmp 0x1002bf54
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002bff4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x1002bffe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x5cae
jge 0x1002c018
mov edx, dword [ebp - 0x38]
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x1002c034
or dword [ebp - 4], 0xffffffff
jmp 0x1002c03e
jmp 0x1002c048
push 1
call fcn.10029113
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002debe
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002df7f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002df0a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002df08
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1002df7d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002df44
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jg 0x1002df7d
mov dword [ebp - 0x28], 0xffffffff
lea eax, [ebp - 0x28]
push eax
push 0x5b1d
push 0x1467
push dword [ebp - 0x2c]
push 0
push dword [ebp - 8]
push dword [ebp - 0x30]
push 0x950
push 1
call fcn.1002c246
add esp, 0x24
jmp 0x1002df39
jmp 0x1002dfb3
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002df9f
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
jmp 0x1002dfb3
mov byte [ebp - 2], 0
push 0
push 0
lea eax, [ebp - 2]
push eax
call fcn.1002a5e8
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x100313bb
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031402
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100313f3
mov byte [ebp - 1], 0
push 1
push 1
lea eax, [ebp - 1]
push eax
push 0xa19
call fcn.1002c535
add esp, 0x10
jmp 0x10031400
push 0x240
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1003141b
push 0x2c52
push 0x4c5d
push 0x6139
push 0
call fcn.1002be9f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10037dcd
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test dl, dl
je 0x10037e27
cmp byte [ebp + 0xc], 0
je 0x10037e00
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10037e4c
sub esp, 0xc
mov edx, 0x1a67
mov ecx, 0x6110
push 0
call fcn.1003768f
add esp, 0x10
jmp 0x10037e4c
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10037e4c
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 4
jl 0x10037e12
pop esi
jmp 0x10037e4c
xor eax, eax
test cl, cl
je 0x10037e37
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10037e4c
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10037e4c
push eax
push eax
push 0xc1e
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov esp, ebp
pop ebp
ret
Function at 0xdae058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00dae1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xdae07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae06a
add dl, dl
jne 0xdae089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae0dc
xor eax, eax
add dl, dl
jne 0xdae096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdae17d
add dl, dl
jne 0xdae0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdae0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdae075
mov eax, 1
add dl, dl
jne 0xdae0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdae0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae0e1
sub eax, ebx
mov ebx, 1
jne 0xdae128
mov ecx, 1
add dl, dl
jne 0xdae10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdae119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdae13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdae14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdae136
cmp eax, 0x7d00
jae 0xdae16d
cmp eax, 0x500
jb 0xdae168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae075
cmp eax, 0x7f
ja 0xdae170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdae075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdae19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdae075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0xc098f0
Capabilities:
Encode data using xor

Disassembly:
add cl, 0x18
xor bl, cl
call fcn.00eba950
aas
invalid
ror cl, 1
jmp 0xbf124e

Function at 0xe74afa
Capabilities:
Encode data using xor

Disassembly:
mov ebp, esi
rol eax, 0x67
lea ebx, [eax*8 + 0x6335319c]
mov ebx, edx
lea eax, [eax*2 - 0x11d3aff2]
mov edx, ebx
not dword [esp]
shl edx, 2
bswap eax
mov eax, ebp
xor dword [esp], 0x152b7ba1
jbe 0xe72090
adc eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
jmp 0xe73c3a
call fcn.00be5ee5
mov ecx, 0x8ba7fea3
mov ecx, dword ss:[edx]
push 0x1f314807
mov dword [esi], ecx
lea esp, [esp + 4]
jmp fcn.00bf67b0
not byte [esp]
lea esp, [esp + 4]
je 0xe73c6c
mov eax, 0x52a832bc
mov eax, dword [ebp + ebx*4]
push 0x399649a9
mov dword [esp], eax
push 0x88903e12
sal dword [esp], 0xfe
dec ebx
lea esp, [esp + 4]
jne 0xe73c47
push 0x102128a6
push 0x196a1b7
mov byte [esp], 0x10
mov eax, dword [ebp]
lea esp, [esp + 8]
call eax
and word [esp + 8], bp
xor bl, dl
mov dword [esp + 8], edi
ror ebp, 0xda
mov dword [esp + ebp*2 - 0x65ad3140], ebp
sub bp, bp
mov dword [esp + ebp*2 - 0x65abfffc], ebx
jp 0xbec567
inc ebp
and ebp, ebp
inc cx
adc esi, 0xc149839b
std
pop edi
inc ebp
xor ch, ch
inc cx
rol esi, 1
inc cx
shl ebp, 0x6d
inc bp
xor edi, esi
inc cx
xor ebp, 0xd0412b20
in eax, dx
call fcn.00eac1ee
enter 0xffffffffffffdafc, 0x53
popal
test al, 0x69
push 0xffffffffffffffa5
mov al, 0x68
invalid

Function at 0xea5b6b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0xea1a22
mov esi, dword [ebp + 0xc]
cmp ebx, 0x45b19794
cmc
test esi, esi
jmp 0x107460e
je 0x1067901
push ebp
add bp, 0x29a9
mov ebp, esp
inc dx
cdq
mov edx, dword [ebp + 8]
test edx, esi
lea esp, [esp - 0x114]
cmp esp, edi
test di, dx
push esi
test edx, edx
jmp 0xc168e2
jne 0xea1a22
mov ecx, dword [eax + 0x78]
cmp bx, bp
cmp cx, 0xf931
cmc
mov dword [ebp - 4], ecx
stc
clc
cmc
test ecx, ecx
jmp 0x104199c
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jmp 0xef4b66
je 0xea1a22
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0xea1a1c
Function at 0xeba690
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [esi]
mov edx, dword [edi]
push 0xad847bbc
not dword [esp]
not dword [esp]
mov dword [esi], edx
lea esp, [esp + 4]
jmp fcn.00bf67b0
not al
call fcn.00e99922
xor eax, 0xb977492f
push es
push 0xad0e01a7
xchg ebp, eax
adc eax, edx
scasb al, byte es:[edi]
in al, dx
xchg byte [eax + 0x42d3d356], cl
xchg esi, eax
mov eax, dword [0x860ce06a]
push es
mov cl, byte [edi]
sbb dl, byte [esi + 0x67b5a743]
stosb byte es:[edi], al
jle 0xe95ed1
daa
out 0x36, al
lahf
ja 0xe95eb0
dec edx
in eax, 0xf
dec edx
push es
fstp xword [edi]
cld
xor ah, bl
add edi, dword [ecx]
daa
push ebp
and eax, 0x72d50129
adc al, 0xc7
push es
rol ebx, 1
sub esp, edx
xchg byte [esi - 0x6fd5f26], ah
jmp 0xe95f63
adc byte [edi - 0x44], ch
cmp esp, ebx
popal
rcr al, 0x3e
pop esi
dec ebp
movsd dword es:[edi], dword [esi]
push esp
dec ebp
aas
fcom qword [esi + 0x494d67e5]
loop 0xe95f99
loopne 0xe95f9d
sbb eax, 0x6089f718
fist dword [ecx]
js 0xe95fc4
sub ebp, 0x387a6142
test byte [edi + 0x4e], dl
push edi
dec esi
lsl ebp, word [ecx + 0x5f]
mov dl, 0xfc
cmp bl, bl
mov es, word [ebx + ebx*8 + 0x733d5382]
adc byte [ebx + 0x3d], 0x73
jb 0xe95f8c
loope 0xe95f7c
inc eax
fcmovnb st(0), st(4)
fsub dword [ebp - 0x26]
cmp dword [ecx - 0x70], edi
ret
xchg ebx, esi
mov ch, 0xd3
xchg ebp, eax
push ebx
or ch, dh
invalid
jmp 0xe95ecf

Function at 0xf2571d
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esi]
mov eax, 0xa62d8f11
add al, ah
sub eax, eax
xor al, byte [ebp + eax]
call fcn.00e73ff8
mov ebp, dword [esi]
mov ecx, 0xa809a4a4
mov edx, ecx
rol ecx, 0xcf
mov edx, dword [esi + 4]
mov cl, byte [esi + 8]
call fcn.00e88603
mov ebp, 0xeb0bb55e
jns 0xbdf5eb
inc edx
dec ecx
shr ah, 1
mov bh, dl
out dx, eax
in eax, 0x15
mov dword [ecx + 0x61ed9cb7], ecx
salc
mov byte [eax - 0x5845cf40], bh
push edi
mov dword [eax + 0x68], esi
hlt
aad 0x88
shr dword [ebp + 0x5d], 1
mov byte [edx + 0x46], dh
pop eax
sahf
mov edx, 0xfb2d1ec1
inc esi
add byte [eax], al
add byte [eax], al
int 0x4a
sbb dh, byte [eax]
sub byte [esi - 0x606fa054], bh
fsubp st(4)
adc dl, byte [esi + 0xf5df650]
out dx, eax
jmp dword [edx + 0x50]
cli
das
sbb dword [edx], edx
aam 0x64
cdq
and esi, dword [ebp + 0x1dc3cf7e]
mov ebp, 0x94828b0e
into
jmp 0xbdf596
mov dword [esp], ebx
push 0xe1021125
movzx ebx, byte [edx]
xor ebx, ecx
and ebx, 0xff
mov ebx, dword [ebx*4 + 0xee4014]
shr ecx, 8
xor ecx, ebx
inc edx
xor ecx, 0x25297d21
inc dword [esp]
dec eax
not dword [esp]
not byte [esp]
lea esp, [esp + 4]
jne 0xf25720
call fcn.00bdeb99
call fcn.00f2d1a5
jmp 0xbdf545

Function at 0xf36156
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi], ecx
jmp 0xeeda37
lea esp, [esp + 4]
jmp fcn.00c1fdae
mov esi, dword [edi]
mov eax, dword [edi + 4]
add edi, 4
xor ecx, ecx
test eax, eax
lea esp, [esp + 0xc]
je 0xf361ae
mov edx, 0xe83b5716
add dl, dl
movzx edx, byte [esi]
xor edx, ecx
and edx, 0xff
mov edx, dword [edx*4 + 0xf30120]
push 0xcdad0099
shr ecx, 8
xor ecx, edx
inc esi
xor ecx, 0xfc9c7e91
dec eax
push 0x65023080
push 0xe725919e
lea esp, [esp + 0xc]
jne 0xf3616f
push 0x4637b827
not ecx
jmp 0xeaaa5a
Function at 0x1044b53
Capabilities:
Encode data using xor

Disassembly:
pop edi
push 0xc003958c
not edx
not byte [esp]
call fcn.01066a9d
syscall
call int.010662b9
mov dword [esp], edi
push 0x6299e11d
mov edi, dword [esp]
lea edi, [edi + edi + 0x13839a2f]
movzx edi, byte [esi]
add dword [esp], 0xf1985125
xor edi, edx
and edi, 0xff
mov edi, dword [edi*4 + 0xeb9d70]
push 0x95978380
shr edx, 8
shl dword [esp + 2], 0xf2
xor edx, edi
inc esi
sal dword [esp + 4], 0x66
xor edx, 0x11b68fb0
dec eax
lea esp, [esp + 8]
jne 0x1044b56
mov edi, 0xe02c0693
not di
jmp 0xbdc22b

Function at 0x104ee0b
Capabilities:
Encode data using xor

Disassembly:
not cx
mov dword [esp], 0x84b8ae18
or dx, cx
push 0xf00690ad
mov word [edi], dx
call fcn.00e92473
add edi, 2
not dx
jmp 0xc1e9f7

Function at 0x106dc69
Capabilities:
Encode data using xor

Disassembly:
ret 0x948b
pop eax
call fcn.00f5c370
je 0x106dc51
lodsb al, byte [esi]
lea edi, [edx + 0x6f]
lodsb al, byte gs:[esi]
invalid

Function at 0x107b863
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x6894aaa3
mov di, word [esi]
mov dx, word [esi + 2]
add word [esp + 1], 0x488e
push 0x61b01794
mov cl, byte [esi + 4]
adc esi, 4
call fcn.0107bf0a
sti
mov es, esp
sbb al, bl
xor ebp, dword [esi + 0x14]
in al, 0xc5
xchg edx, eax
invalid
Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4db67e2a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x63a063c8
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x414ac0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc dword [0xa996538e], 0x1069acec
add al, 0x86
out dx, al
adc eax, dword [edi + 0x7d]
out dx, al
frndint
xor byte [eax - 0x14], dl
inc esp
push esp
salc
adc dl, byte [ebx - 0x14]
rcr dword [eax - 0x4c1a7e57], 1
push ebx
xchg esi, eax
fsubr dword [esi]
mov al, byte [0x49654469]
inc esp
dec ecx
inc esp
dec ecx
scasd eax, dword es:[edi]
adc al, 0x3c
std
sub byte [ecx], dl
in eax, dx
les edi, [ecx + 0x3acaed3]
out 4, eax
salc
lodsb al, byte [esi]
out dx, eax
adc edi, esp
xor dword [ebp - 0x5769add6], 0x112b4cec
push esi
test al, 0x89
push ebx
in al, dx
adc al, 0x59
jno 0x414a97
lodsb al, byte [esi]
add dword [ecx + 0x13], 0xb7f99653
push ebx
xchg esi, eax
out dx, al
push esp
mov esp, 0x44ec5009
mov eax, 0xa0531397
shr ah, cl
lodsb al, byte [esi]
imul edx, dword [ecx], 0x1169acec
in al, dx
lodsb al, byte [esi]
imul edx, dword [ecx], 0xee69acec
adc edx, dword [ebx - 0x6a]
adc esp, ebp
lodsb al, byte [esi]
imul ebp, esi, 0x11965313
in al, dx
lodsb al, byte [esi]
imul edx, dword [ecx], 0x1169acec
in al, dx
lodsb al, byte [esi]
imul edx, dword [ecx], 0x15852fec
sub ebp, dword [eax - 0x11bb02b3]
imul ebx, dword [eax], 0x1101e317
pushfd
in eax, dx
imul ebx, dword [edi - 0x55], 0xd693b114
sub dl, dl
fidivr word [ebp + 0x13382ccc]
ljmp 0x9069
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10001048
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push 0
xor eax, eax
call dword [0x11702613]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001094
push 0
push 0x40100dc
push 6
call fcn.10004372
add esp, 0xc
mov dword [ebp - 4], 0
push 0
mov ebx, 0x104
call fcn.10004a60
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push dword [ebp - 0x10]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x100010dc
push 0x4b
push 0x40100dc
push 6
call fcn.10004372
add esp, 0xc
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x100010ec
push ebx
call fcn.1000437e
add esp, 4
call fcn.100012a3
call fcn.10001389
and eax, 1
xor eax, 1
test eax, eax
je 0x1000125c
push 1
push 0
call fcn.1000165b
call fcn.10001778
and eax, 1
xor eax, 1
test eax, eax
je 0x1000122e
mov eax, 0x10013245
test eax, eax
je 0x1000113f
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1000436c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x117025ff]
test ebx, ebx
je 0x10001153
push ebx
call fcn.1000437e
add esp, 4
pop eax
mov dword [0x117025ff], eax
mov eax, 0x116b3f4d
test eax, eax
je 0x10001175
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.1000436c
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x11702603]
test ebx, ebx
je 0x10001189
push ebx
call fcn.1000437e
add esp, 4
pop eax
mov dword [0x11702603], eax
call fcn.10001e03
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x100011ab
push ebx
call fcn.1000437e
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0x11702607
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000122e
push 8
call fcn.1000436c
add esp, 4
mov dword [ebp - 0x10], eax
mov edi, eax
mov esi, 0x116b5c0b
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, 0x116b5c13
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x11702607
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x14]
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1000121b
push ebx
call fcn.1000437e
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.1000437e
add esp, 4
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], esp
xor eax, eax
call dword [0x11702617]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x10001257
push 0x232
push 0x40100dc
push 6
call fcn.10004372
add esp, 0xc
call fcn.10002b35
call fcn.10002b70
mov dword [ebp - 0x10], esp
xor eax, eax
call dword [0x11702617]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000128a
push 0x26d
push 0x40100dc
push 6
call fcn.10004372
add esp, 0xc
jmp 0x1000128f
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1000129f
push ebx
call fcn.1000437e
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x10002b7f
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.10002ba4

Function at 0x10006720
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x1000673e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x10006733
pop esi
ret
Function at 0x406ef0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4785db
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0046d67a
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x406f72
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0046b560
mov eax, dword [eax]
push 0x492c68
push eax
call fcn.0045e274
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0046d905
test bl, bl
je 0x406f72
push 0x492c68
lea ecx, [esp + 0xc]
call fcn.0046dc95
push 0x492c74
lea ecx, [esp + 0xc]
call fcn.0046dc95
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x406fae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0046d905
jmp 0x407079
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x407032
lea edx, [esp + 0x7c]
push 0x492c70
push edx
call fcn.0045e274
add esp, 8
test eax, eax
je 0x407032
lea eax, [esp + 0x7c]
push 0x492c6c
push eax
call fcn.0045e274
add esp, 8
test eax, eax
je 0x407032
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406fc2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0046d905
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x407880
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4078e2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc