joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6169c0
Capabilities:
Terminate process

Disassembly:
mov dword [esp], edx
call eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
test eax, eax
je 0x616b36
mov eax, dword [ebp - 0xc0]
mov ecx, eax
call fcn.006167c7
invalid
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 4
mov eax, 0x20a
add eax, dword [ebp - 0xc0]
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], 0
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x9f7b], cl
dec dword [ecx - 0xa77b]
dec dword [ebx - 0xf77b]
dec dword [ebx - 0x7a76cfc0]
invalid
invalid
invalid
invalid

Function at 0x616a10
Capabilities:
Terminate process

Disassembly:
test dword [edi + edi*8 - 1], edx
dec dword [ebx - 0xab7b]
dec dword [eax - 0xfb7b]

Function at 0x616a30
Capabilities:
Terminate process

Disassembly:
dec dword [edi]
mov dh, 0x12
movzx edx, dl
cmp eax, edx
je 0x616aa0
movzx eax, byte [ebp - 0xfc]
movzx eax, al
mov edx, 1
add edx, dword [ebp - 0xb0]

Function at 0x616a50
Capabilities:
Terminate process

Disassembly:
movzx edx, byte [edx]
movzx edx, dl
cmp eax, edx
je 0x616aa0
mov eax, dword [ebp - 0xf8]

Function at 0x616a60
Capabilities:
Terminate process

Disassembly:
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x74], eax
add esp, 0xfffffff0
mov dword [esp], 0
mov eax, dword [ebp - 0x74]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
mov dword [ebp - 0x70], eax
push eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
mov eax, dword [ebp - 0xc0]
mov ecx, eax
call fcn.006167fc
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x6c], eax
mov eax, 4
add eax, dword [ebp - 0xb0]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x6c]
mov edx, dword [ebp - 0xb0]
mov edx, dword [edx]
cmp eax, edx
je 0x616b36
mov eax, dword [ebp - 0x6c]
mov edx, 4
add edx, dword [ebp - 0xb0]
mov edx, dword [edx]
cmp eax, edx
je 0x616b36
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x44], eax
add esp, 0xfffffff0
mov dword [esp], 0
mov eax, dword [ebp - 0x44]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x89d0ff00
inc ebp
rcl byte [eax - 0x39], 4
and al, 0
add byte [eax], al
add byte [ecx + sym.imp.KERNEL32.dll_ExitProcess], ah
call eax

Function at 0x616b20
Capabilities:
Terminate process

Disassembly:
push 0x89d0ff00
inc ebp
rcl byte [eax - 0x39], 4
and al, 0
add byte [eax], al
add byte [ecx + sym.imp.KERNEL32.dll_ExitProcess], ah

Function at 0x616b80
Capabilities:
Terminate process

Disassembly:
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x9f7b], cl
dec dword [ecx - 0xa77b]
dec dword [ebx - 0xf77b]
dec dword [ebx - 0x7a76cfc0]
push 0x50ffffff
push eax
Function at 0x616e10
Capabilities:
Terminate process

Disassembly:
lea edx, [ebp - 0xd0]
mov dword [esp], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
call eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xf8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x3c], eax
add esp, 0xfffffff0
mov dword [esp], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x10
mov eax, dword [sym.imp.USER32.dll_MessageBoxA]
call eax
mov dword [ebp - 0x38], eax
push eax
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_ExitProcess]
call eax
nop
nop
or eax, 0
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x621f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6669c8
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x6898b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movsx eax, byte [0x6a0748]
test eax, eax
jne 0x621fb5
call fcn.00621e70
movzx ecx, byte [0x6a0741]
test ecx, ecx
jne 0x62206f
movzx edx, byte [0x6a0740]
test edx, edx
jne 0x62206f
cmp dword [0x6a084c], 0
je 0x622018
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x6a084c]
push ecx
call fcn.0060dd50
add esp, 8
mov dword [ebp - 0x10], eax
push 0
mov edx, dword [ebp - 0x10]
push edx
push 0x186
mov eax, dword [0x6a084c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x6a084c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x62206f
push 0x6a0748
lea ecx, [ebp - 0x74]
call fcn.00609880
mov dword [ebp - 4], 0
push 0x10001
lea edx, [ebp - 0x74]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0060db60
add esp, 0x10
xor edx, edx
cmp eax, 2
sete dl
mov byte [ebp - 0x11], dl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.005c76c0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x62206f
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x62d600
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x62d60f
mov eax, dword [eax + 4]
jmp 0x62d612
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x62d69b
push esi
mov esi, dword [0x6a0c08]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x62d680
cmp eax, 3
je 0x62d680
cmp eax, 0x7b
je 0x62d680
cmp eax, 0x57
je 0x62d680
cmp eax, 0xa1
je 0x62d680
cmp eax, 0x35
je 0x62d680
cmp eax, 0x20
jne 0x62d675
mov eax, dword [0x6a0c0c]
mov dword [ecx], eax
mov edx, dword [0x6a0c10]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x6a0c0c]
mov dword [ecx], eax
mov edx, dword [0x6a0c10]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x6a0c0c]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x6a0c10]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x62d6c8
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x62d6e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x62d6ef
mov eax, dword [eax + 4]
jmp 0x62d6f2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x62d77b
push esi
mov esi, dword [0x6a0c08]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x62d760
cmp eax, 3
je 0x62d760
cmp eax, 0x7b
je 0x62d760
cmp eax, 0x57
je 0x62d760
cmp eax, 0xa1
je 0x62d760
cmp eax, 0x35
je 0x62d760
cmp eax, 0x20
jne 0x62d755
mov eax, dword [0x6a0c0c]
mov dword [ecx], eax
mov edx, dword [0x6a0c10]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x6a0c0c]
mov dword [ecx], eax
mov edx, dword [0x6a0c10]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x6a0c0c]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x6a0c10]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x62d7a8
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x6341b2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6898b0]
jne 0x6341bc
repz ret
jmp fcn.0063fa1c
Function at 0x6391b7
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0x34]
mov edx, dword [0x68ba6c]
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], esi
call eax
sub esp, 0x10
test eax, eax
je 0x6391c7
mov eax, dword [esp + 0x30]
test eax, eax
je 0x6391c7
add ebx, eax
jmp 0x639199
cmp ebx, ebp
je 0x639277
mov ecx, dword [ebp]
mov eax, 0
mov edx, dword [0x68ba4c]
mov edi, ecx
add edi, dword [edx + eax]
mov dword [ebx + eax], edi
add eax, 4
cmp eax, 0x20
jne 0x6391d7
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub esp, 8
test eax, eax
je 0x639277
mov ecx, dword [0x68ba9c]
mov edx, dword [0x68ba6c]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0x1000
mov dword [esp + 4], edx
mov dword [esp], 0
call eax
sub esp, 0x10
mov ebx, dword [0x68ba60]
mov edx, dword [0x68ba80]
add ebx, edx
mov esi, dword [ebx + 4]
mov edx, 8

Function at 0x639248
Capabilities:
Terminate process

Disassembly:
mov ecx, esi
add ecx, dword [ebx + edx]
mov dword [eax + edx], ecx
add edx, 4
cmp edx, 0x8000
jne 0x639243
mov edx, dword [0x68ba64]
mov dword [eax + 8], edx
mov edx, dword [0x68baa0]
mov ecx, dword [0x68baa0]
add edx, dword [eax + 0xc]
add edx, eax
add eax, ecx
mov dword [esp], eax
call edx
mov eax, dword [0x68ba54]
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x64007f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x68a230]
je 0x64009a
inc edi
cmp edi, 0x17
jb 0x64008b
cmp edi, 0x17
jae 0x64021a
push ebp
push 3
call fcn.0064d48e
cmp eax, 1
pop ecx
je 0x6401e6
push 3
call fcn.0064d48e
test eax, eax
pop ecx
jne 0x6400ce
cmp dword [0x689970], 1
je 0x6401e6
cmp ebx, 0xfc
je 0x640219
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x6a1098
push ebp
call fcn.0063335a
add esp, 0xc
test eax, eax
je 0x640104
push esi
push esi
push esi
push esi
push esi
call fcn.00634a8c
add esp, 0x14
push 0x104
mov esi, 0x6a10b1
push esi
push 0
mov byte [0x6a11b5], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x640148
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0063335a
add esp, 0xc
test eax, eax
je 0x640148
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00634a8c
add esp, 0x14
push esi
call fcn.00633b80
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x64018d
push esi
call fcn.00633b80
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x6a13ac
push 0x68e0f0
sub ecx, eax
push ecx
push eax
call fcn.006341c1
add esp, 0x14
test eax, eax
je 0x64018d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00634a8c
add esp, 0x14
jmp 0x64018f
xor esi, esi
push 0x68c964
push ebx
push ebp
call fcn.006332e9
add esp, 0xc
test eax, eax
je 0x6401af
push esi
push esi
push esi
push esi
push esi
call fcn.00634a8c
add esp, 0x14
push dword [edi*8 + 0x68a234]
push ebx
push ebp
call fcn.006332e9
add esp, 0xc
test eax, eax
je 0x6401d1
push esi
push esi
push esi
push esi
push esi
call fcn.00634a8c
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0064d2d1
add esp, 0xc
jmp 0x640219
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x640219
cmp ebp, 0xffffffff
je 0x640219
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x68a234]
push dword [esi]
call fcn.00633b80
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x64d2d1
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0063f260
xor ebx, ebx
cmp dword [0x6a1744], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x64d3a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x64d487
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x68f8ec
push edi
call esi
cmp eax, ebx
je 0x64d487
push eax
call fcn.0063f1f2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6a1744], eax
call esi
push eax
call fcn.0063f1f2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6a1748], eax
call esi
push eax
call fcn.0063f1f2
mov dword [0x6a174c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.006388cf
test eax, eax
pop ecx
pop ecx
je 0x64d375
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00634a8c
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x64d3a7
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0063f1f2
cmp eax, ebx
pop ecx
mov dword [0x6a1754], eax
je 0x64d3a7
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0063f1f2
pop ecx
mov dword [0x6a1750], eax
mov eax, dword [0x6a1750]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x64d42c
cmp dword [0x6a1754], ecx
je 0x64d42c
push eax
call fcn.0063f269
push dword [0x6a1754]
mov esi, eax
call fcn.0063f269
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x64d42c
cmp edi, ebx
je 0x64d42c
call esi
cmp eax, ebx
je 0x64d3f9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x64d3f9
test byte [ebp - 0x18], 1
jne 0x64d42c
lea eax, [ebp - 0x10]
push eax
call fcn.0063897e
test eax, eax
pop ecx
je 0x64d414
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00634a8c
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x64d423
or dword [ebp + 0x10], 0x200000
jmp 0x64d467
or dword [ebp + 0x10], 0x40000
jmp 0x64d467
mov eax, dword [0x6a1748]
cmp eax, dword [ebp - 8]
je 0x64d467
push eax
call fcn.0063f269
cmp eax, ebx
pop ecx
je 0x64d467
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x64d467
mov eax, dword [0x6a174c]
cmp eax, dword [ebp - 8]
je 0x64d467
push eax
call fcn.0063f269
cmp eax, ebx
pop ecx
je 0x64d467
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6a1744]
call fcn.0063f269
cmp eax, ebx
pop ecx
je 0x64d487
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x64d489
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x65a05b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x65a0e0
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00635140
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x65a0a3
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x65a0c5
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x65a13b
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.00659dab
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
cmp esi, 3
pop ecx
pop ecx
jb 0x65a127
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x65a13b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x65a064
pop esi
pop ebx
leave
ret
Function at 0x4b9860
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x84000]
mov dword [edi + 0x9403c], 0x5508dddd
push edi
jmp 0x4b988a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b9891
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b9880
mov eax, 1
add ebx, ebx
jne 0x4b98a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b98b4
jne 0x4b98d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b98d3
dec eax
add ebx, ebx
jne 0x4b98c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b9898
add ebx, ebx
jne 0x4b98cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b9925
xor ecx, ecx
sub eax, 3
jb 0x4b98eb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b995a
sar eax, 1
mov ebp, eax
jmp 0x4b98f6
add ebx, ebx
jne 0x4b98f6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b98c4
inc ecx
add ebx, ebx
jne 0x4b9904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b98c4
add ebx, ebx
jne 0x4b9911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b9906
jne 0x4b9922
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b9906
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b9944
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b9936
jmp 0x4b9886
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b9944
add edi, ecx
jmp 0x4b9886
pop esi
mov edi, esi
mov ecx, 0x2e38
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b9962
cmp byte [edi], 0x12
jne 0x4b9962
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b9967
lea edi, [esi + 0xb7000]
mov eax, dword [edi]
or eax, eax
je 0x4b99df
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd853c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd85f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b9994
mov ecx, edi
jns 0x4b99c3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd85f4]
or eax, eax
je 0x4b99d9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b99b1
call dword [esi + 0xd8604]
mov ebp, dword [esi + 0xd85f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b9a13
sub esp, 0xffffff80
jmp 0x43517b
Function at 0xd521b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d52140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d52140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d52140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d52140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd52bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd52c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd6487c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd52c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd52c52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
nop
nop
nop
nop
nop
pushal
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431fd9
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x100c251e
Capabilities:
Encode data using xor

Disassembly:
call 0x100c2497
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x100c24c7
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x100c24e3
xor edx, 0
jmp 0x100c24ee
xor edx, edx
jmp 0x100c2505
jmp 0x100c2511
xor eax, eax
push 0x8427d7c0
call 0x100c251e
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x100c255a
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x100c2533
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100c2571
add eax, 0
jno 0x100c2576
add esi, 0
ret 0x10

Function at 0x100c32df
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x100c3301
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x100c34a3
cmp edi, dword [ebp + 0x10]
jb 0x100c34a3
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.100c2dcb
inc edi
jmp 0x100c338a
jmp 0x100c3397
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.100c2dcb
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.100c2dcb
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x100c33eb
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x100c33cf
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.100c3419
add dword [eax], 0x39
jle 0x100c33f5
sub al, 0xf5
mov ch, al
call fcn.100c342e
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10