joyce8/EMBER2024-capa huggingface dataset:
Function at 0x791227a5
Capabilities:
Contain obfuscated stackstrings
Packed with generic packer

Disassembly:
lea ecx, [edx - 0x7d7d212]
mov byte [ebp - 0x34], 0x35
cwde
push 0x47e621a3
mov byte [ebp - 0x33], 0x31
movzx cx, dl
mov byte [ebp - 0x32], 0x20
lea esp, [esp + 4]
jle 0x79099b8e
mov byte [ebp - 0x31], 0x35
not ah
mov byte [ebp - 0x30], 0x30
pushal
lahf
mov byte [ebp - 0x2f], 0x20
bswap ax
mov byte [ebp - 0x2e], 0x38
mov eax, 0xd4bb2391
cwde
mov byte [ebp - 0x2d], 0x42
movzx cx, cl
mov byte [ebp - 0x2c], 0x20
setg ah
mov byte [esp], al
lea esp, [esp + 0x20]
jno 0x790a9ff9
mov ah, 0x5d
mov byte [ebp - 0x2b], 0x43
cwde
mov byte [ebp - 0x2a], 0x45
bswap eax
pushfd
jmp 0x790a7ddf
pushal
not al
mov byte [ebp - 0x31], 0x35
pushal
cwde
movsx eax, cl
mov byte [ebp - 0x30], 0x30
mov byte [esp], 0x25
not ax
mov byte [ebp - 0x2f], 0x20
movzx eax, bl
bswap cx
lahf
setge cl
mov byte [ebp - 0x2e], 0x38
lea eax, [eax*8 - 0x4276c087]
jmp 0x790d808c
stc
test eax, eax
pushal
mov byte [esp + 8], 0xb7
push dword [esp]
push ecx
lea esp, [esp + 0x2c]
je 0x791498c7
movsx ecx, cl
cwde
jmp 0x79095fae
cwde
mov byte [ebp - 0x29], 0x20
lea ecx, [edx*8 + 0x391bf336]
not ax
movsx cx, al
mov ecx, 0x51c287ec
mov byte [ebp - 0x28], 0x45
mov word [esp], bx
pop eax
jmp fcn.79031a88
jmp 0x790cd4a3
push 0x70941970
mov byte [ebp - 0x2a], 0x45
bswap cx
not ecx
movsx cx, bl
movzx ax, cl
mov byte [ebp - 0x29], 0x20
pop ecx
pop eax
bswap ecx
mov byte [ebp - 0x28], 0x45
call fcn.790f7e06
bswap cx
bswap eax
xchg ch, al
mov byte [ebp - 0x2b], 0x43
movsx ax, al
mov byte [ebp - 0x2a], 0x45
xchg cl, al
mov byte [ebp - 0x29], 0x20
cwde
xchg al, cl
pushfd
push ecx
mov byte [ebp - 0x28], 0x45
lahf
jmp loc.7900e401
lea ecx, [edx + 0xdab2e94]
lahf
mov byte [ebp - 0x2d], 0x42
not ch
setae ch
mov byte [ebp - 0x2c], 0x20
pushfd
mov byte [esp + 0xc], bh
mov byte [ebp - 0x2b], 0x43
pushfd
jmp 0x790b7bb1
jmp 0x7909f056
not si
xor al, al

Function at 0x7912bd66
Capabilities:
Packed with generic packer

Disassembly:
push 0xb14daa43
mov byte [esp], al
lea esp, [esp + 0xc]
je 0x7907ddc4
bt ax, 0xf
cmp dword [ebp - 0x28], 0x111
pushfd
pushfd
pushfd
lea esp, [esp + 0xc]
jne 0x79080caf
cmp ax, 0xf9d8
stc
pushal
push esi
cmp dword [ebp - 0x24], 0
pushfd
pushfd
call fcn.790af1db
movsb byte es:[edi], byte [esi]
sub eax, 0x7122e71d
stc
sbb esi, dword [ebx]
fnstcw word [esp + ebp - 0x43a13115]
test byte [esi + 0x2a750b2], al
sbb bh, bl
xchg esi, eax
fcom qword [ebx]
or edi, ebx
invalid

Function at 0x7912cd26
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 8]
call fcn.7903f230
pushal
pushfd
add esp, 0x30
stc
pushfd
cmp dword [ebp - 0x50], 0
pushfd
pushfd
jmp loc.79022205
Function at 0x7912e567
Capabilities:
Execute anti-debugging instructions

Disassembly:
movsx dx, cl
not ecx
mov dword [ebp - 4], eax
xchg ecx, eax
push ebx
push esi
call fcn.790d3635
push ebp
mov word [esp], 0xdd0e
mov dword [ebp - 0xdc], 0x2710
mov byte [esp], dl
pushfd
lea esp, [esp + 8]
jmp fcn.79138276
aaa
cwde
btc ax, 1
push ebp
cmc
mov ebp, esp
shld ax, bp, 2
bts ax, 5
sub esp, 0x464
movzx cx, cl
movsx ax, cl
mov eax, dword [0x7906c390]
push 0x90c02788
xor eax, ebp
lea esp, [esp + 4]
jo 0x79124f9f
xchg cx, dx
mov dword [ebp - 4], eax
pushal
rdtsc
mov word [esp], dx
bswap ax
mov dword [esp + 0x1c], ebx
bswap cx
bswap cx
mov dword [esp + 0x18], esi
lahf
rdtsc
pushfd
mov byte [esp], dl
mov dword [esp + 0x18], edi
pushfd
mov byte [esp], 0x86
mov eax, dword [0x79074904]
movsx edx, cl
xchg ch, dl
movsx dx, al
mov dword [esp + 0x18], eax
push ecx
call fcn.790e7698

Function at 0x7912f51e
Capabilities:
Check http status code

Disassembly:
bsr cx, si
bsr cx, ax
pushal
mov dword [ebp - 0xbc], 0
add esp, 0x20
pushal
pushfd
lea esp, [esp + 0x28]
jne 0x790e9692
push edi
mov dword [esp], edi
mov dword [ebp - 0xbc], 1
push dword [esp]
push dword [esp + 4]
pushal
mov byte [esp + 4], dh
lea esp, [esp + 0x2c]
jmp 0x790e96a8
jmp 0x7911f43d

Function at 0x791319ef
Capabilities:
Execute anti-debugging instructions

Disassembly:
lahf
mov eax, dword [ebp - 0x14]
pushal
push ecx
lea esp, [esp + 0x24]
jmp 0x79115cad
cmp cx, dx
test eax, eax
pushfd
push dword [esp + 4]
pushfd
lea esp, [esp + 0x14]
je 0x79133aea
pushfd
lea esp, [esp + 4]
jmp 0x79147495
jmp 0x790cee93
Function at 0x79131d45
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
jb 0x790ae479
call fcn.79003170
jmp 0x79118371
xchg ah, ch
not edx
mov dword [ebp - 4], 0
lahf
push edi
rdtsc
mov eax, dword [ebp - 0x18]
mov dword [esp], ebx
not edx
mov dword [esp], eax
push esp
call fcn.7910eb0d
call fcn.7908a236
push es
int1
xor byte [ebx - 0x3e], dl
rcl dword [ecx - 0x55], 0x9b
stosb byte es:[edi], al
insb byte es:[edi], dx
aam 0xa9
outsd dx, dword [esi]
or dword [ebx + 0x4e], esp
mov byte [0xeaa75861], al
dec esi
mov esp, 0x75657e8c
fnstcw word [ebx]
or ecx, dword [ecx]
and eax, 0x793943e7
wait
jae 0x790ae50e
fiadd dword [ecx + 0x3d]
sbb dword [ebx - 0x15fb778a], esp
mov dl, 0x96
jno 0x790ae4fb
fiadd word [ebp - 0x80]
push esi
test al, 0x16
mov ch, 0x8d
xchg edi, eax
scasd eax, dword es:[edi]
and byte [esi + edx*8], ch
leave
adc dword [0x476d028], ecx
sahf
pop es
mov esi, 0xae83b680
mov ah, 0x81
xchg esi, eax
invalid
jl 0x790ae552
mov ecx, 0x1f38df43
pop ecx
sub eax, 0x59fdbe57
jecxz 0x790ae511
imul ebx, dword [ebp - 9], 0x8b35276f
daa
xor eax, 0xb369d98b
fldcw word [ecx - 0x4d]
invalid
movzx ecx, al
mov byte [ebp - 0xf], 0x75
bswap eax
mov byte [ebp - 0xe], 0x6e
xchg cx, ax
xchg ch, al
pop eax
mov byte [ebp - 0xd], 0x74
jmp 0x79131d27
lds ebx, [eax - 0x3a]
inc ebp
je 0x790ae542
retf 0x837
pushfd
movzx si, dl
mov dword [ebp - 0x10], eax
pushfd
cdq
lea esp, [esp + 8]
popal
not ax
mov eax, dword [ebp - 0x10]
push edi
push dword [esp]
mov dword [esp], ebp
push edx
lea esp, [esp + 0xc]
jmp fcn.79121280
jmp 0x79099edf
movsx ax, bl
mov byte [ebp - 0xc], 0
call fcn.790965c9
mov byte [esp], bl
mov dword [esp], 0x86f7d1da
pushfd
pushal
call fcn.7912750b
jmp 0x790c6e33

Function at 0x79131db3
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x14]
push dword [esp]
movsx ecx, bl
lea ecx, [ebp - 0x4c]
jmp 0x790b8e20

Function at 0x79139e24
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, dword [esp + 0xc]
movsx bx, dl
xchg bx, si
call fcn.790a15b0

Function at 0x7913ac9b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0xc]
pushal
lea ecx, [esi + 0x2f2e42fc]
movsx ax, dl
movzx ax, cl
mov al, al
mov eax, dword [ebp + 4]
not cl
movsx cx, al
jmp 0x79099366

Function at 0x7914105c
Capabilities:
Check http status code

Disassembly:
pushfd
lea esp, [esp + 0x28]
jl 0x7908266f
jmp 0x790d238c

Function at 0x791447f9
Capabilities:
Packed with generic packer

Disassembly:
mov byte [esp], dl
mov dword [esp], 0x61f14c2d
lea esp, [esp + 4]
jl 0x7907ff18
jmp 0x79118b56
popfd
add byte [eax], al
pushal
lea esp, [esp + 0x20]
jg 0x790f2e35
call fcn.7914dce4
and dword [edx], edx
adc dh, al
aaa
push 0xffffffffffffffc6
test al, 0xff
mov esi, 0x206c1987
cmpsd dword [esi], dword es:[edi]
xor ebx, dword [ebx]
stc
dec ebp
mov bh, 0x82
cmp eax, esp
mov bl, 0x5a
push ecx
mov al, 0xf3
aas
int 0x5d
cmpsd dword [esi], dword es:[edi]
lahf
aam 0xd7
jg 0x79118b11
jns 0x79118bd0
invalid
sub byte [eax], ch
add byte [edx - 0x178bca1e], cl
wait
push ds
push cs
inc esp
ret 0x8362
bt dx, 0xa
cmp dword [ebp - 0x8c], 0
jmp 0x790b2f8f
Function at 0x79144eb5
Capabilities:
Encrypt data using tea
Encrypt data using xtea

Disassembly:
push esi
cmp bh, 0x68
and cx, ax
sbb cx, ax
mov ecx, dword ss:[ebp - 0x10]
not dh
shr ecx, 5
not dl
pushfd
xor eax, ecx
push dword [esp + 4]
sbb dx, 0xba78
mov edx, dword ss:[ebp - 0x10]
shr cl, 7
bsr cx, si
not cx
xor edx, dword ss:[ebp - 4]
btr cx, cx
shld cx, bp, cl
or cl, 0xad
add eax, edx
or dl, bl
mov ecx, dword ss:[ebp - 4]
pop edx
and ecx, 3
mov dl, byte [esp]
and dx, cx
test bh, cl
not dl
mov edx, dword ss:[ebp + 8]
test cl, cl
pushfd
add eax, dword ds:[edx + ecx*4]
not cx
pop edx
stc
mov ecx, dword ss:[ebp - 8]
sbb edx, 0xfbe27a34
pop edx
lea edx, [edi + 0x44454e93]
add ecx, eax
test bh, 0xbc
mov dword ss:[ebp - 8], ecx
test al, 0xe9
mov edx, dword ss:[ebp - 4]
movzx ecx, cl
sub edx, 0x61c88647
add cl, 0xae
mov dword ss:[ebp - 4], edx
cmp cl, bh
cdq
movsx ax, cl
mov eax, dword ss:[ebp - 8]
ror ch, cl
shl eax, 4
test al, 0xa9
shrd dx, bx, cl
mov ecx, dword ss:[ebp - 8]
clc
ror dl, 6
shr ecx, 5
stc
inc dx
xor eax, ecx
pop edx
mov edx, dword ss:[ebp - 8]
not ch
xor edx, dword ss:[ebp - 4]
sbb ch, dh
add eax, edx
setg ch
bts cx, 0xd
pushfd
bt bx, 1
mov ecx, dword ss:[ebp - 4]
inc dx
stc
shrd dx, ax, 5
bt di, sp
shr ecx, 0xb
rcr dh, cl
cmc
cmp bp, 0x46be
sub dh, bh
and ecx, 3
pushfd
btc dx, 3
clc
mov edx, dword ss:[ebp + 8]
jmp 0x7911b5ee
bt ax, bx
stc
add eax, dword ds:[edx + ecx*4]
rol ch, 5
mov byte [esp], cl
adc cl, bl
bts cx, 0xe
mov ecx, dword ss:[ebp - 0x10]
push 0xc234d539
bt dx, 0xc
bt ax, 3
bt ecx, 0x14
add ecx, eax
mov byte [esp], bh
push edi
pushfd
pushal
mov dword ss:[ebp - 0x10], ecx
pushfd
pushfd
mov dword [esp + 0x10], ecx
mov dword [esp + 4], esp
lea esp, [esp + 0x3c]
jmp fcn.7914109c
shr ecx, 5
ror dh, 6
btr edx, 0x1f
setae dh
call fcn.79149dca
pushfd
lea esp, [esp + 0x14]
je 0x7910aee6
cmp dl, dl
sar dh, cl
mov eax, dword ss:[ebp - 0x10]
not ch
test ebp, 0x2c0fd752
add ecx, ebx
shr edx, 0x1f
shl eax, 4
neg cl
lea edx, [edi - 0x6cd282e5]
ja 0x790b9114
test edi, ebp
mov ecx, dword ss:[ebp - 0x10]
jmp 0x7912365e

Function at 0x79145945
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [ebp - 0x14], ecx
cmp sp, 0x6b7b
cmp dword [ebp - 0x14], 0
jmp 0x79114057
pushal
lea esp, [esp + 0x30]
je 0x79115c9e
lea ecx, [ecx - 0x7c920265]
mov eax, dword [ebp - 0xc]
btr cx, di
mov ecx, dword [eax]
jmp 0x79083518
bts bx, sp
clc
btc di, 5
test bx, bp
xor eax, eax
cmp eax, dword [ebp - 0x10]
mov byte [esp + 0xc], 2
jmp 0x790bf2ad
Function at 0x79146a0e
Capabilities:
Packed with generic packer

Disassembly:
push eax
cmp dh, bl
jmp loc.790214a9
cmc
cmc
stc
cmp dword [0x790748f8], 0x23
pushfd
pushfd
lea esp, [esp + 8]
jne 0x790b94c0
pushfd
lea esp, [esp + 4]
call fcn.7911a439
push 0x4f63e05c
lea esp, [esp + 4]
jmp fcn.79090b5c
setne ah
mov eax, dword [ebp - 0x30]
pushfd
mov byte [esp], dl
call fcn.7912c2de
pushfd
clc
jmp 0x79132353
cwde
pushfd
bswap ax
push dword [ebp + 8]
pop dword [esp]
push 0x72e580d9
not ax
call fcn.7909466a
pushal
cmp dword [0x790748f8], 0x1c
pushfd
lea esp, [esp + 0x28]
jne 0x790d3b05
call fcn.790f74dd
not al
lea esp, [esp + 0x48]
jl 0x791250db
push dword [ebp + 8]
jbe 0x790d8c96
mov eax, dword [ebp - 0x30]
push 0xa358b022
pushal
mov dword [esp + 0x20], 0x790cf75b
push 0xb1e6e4c8
mov dword [esp + 0x20], eax
pushfd
push dword [esp + 0x24]
ret 0x28

Function at 0x79147a29
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 0x24]
jne 0x7909510f
pushfd
sub eax, eax
pushal
mov dword [esp + 4], 0xe3f7587c
mov byte [esp], 0x43
push 0xc53f6de1
lea esp, [esp + 0x28]
jmp fcn.79116664
cmp bp, si
sub ch, 0x28
setg dh
mov eax, dword [0x7907336c]
rcr dx, 8
and ch, 0x3c
ror cx, cl
mov ecx, dword [eax]
sal dl, cl
not dh
clc
sbb dl, dl
mov edx, dword [ecx]
jmp 0x790dd1c8
shr ah, 7
push esi
mov ah, 0x86
shr ax, cl
btc ax, 7
push edi
clc
mov eax, dword [0x7907336c]
cmp ax, 0xc32d
test bh, cl
cmp dword [eax], 0
pushal
mov word [esp + 4], bx
push 0x1a0c480d
jmp 0x79083dd9
clc
clc
pushal
mov dword [ebp - 8], edx
stc
cmp dword [ebp - 8], 0
pushal
push 0x72a939a0
lea esp, [esp + 0x44]
jne 0x790b9a51
cmc
sub eax, eax
pushal
lea esp, [esp + 0x20]
jmp fcn.79116664
not al
cmp dh, 0x20
shl eax, 0xb
push ebp
movsx bp, dl
inc al
clc
clc
mov ebp, esp
rol eax, 0xf
shl ax, 3
not al
ror ah, cl
sub esp, 0x90
aad 0x5c
mov eax, dword [0x7906c390]
cmp dl, dh
xor eax, ebp
stc
push ebx
test ah, 0x4c
cmp eax, eax
mov dword [ebp - 4], eax
movzx ax, bl
bts ax, 0xa
mov dword [esp], ebx
jmp 0x790d0cb8

Function at 0x79149939
Capabilities:
Packed with generic packer

Disassembly:
pushfd
push ecx
pushal
lea esp, [esp + 0x2c]
call fcn.79028be0
lahf
mov eax, dword [0x7907336c]
push edx
mov ecx, dword [eax]
setbe dl
pushfd
pop edx
mov edx, dword [ecx]
mov ch, al
movzx cx, dl
mov dword [esp], edx
call fcn.790b2525

Function at 0x79149963
Capabilities:
Packed with generic packer

Disassembly:
bsf ax, si
xor eax, eax
mov eax, dword [edx + ecx]
push dword [esp + 4]
mov dword [ebp - 0x14], eax
cmp ax, 0x539f
bt sp, bp
push dword [esp]
cmp dword [ebp - 0x14], 0
pushal
lea esp, [esp + 0x30]
jne 0x790b3bd0
bt ax, 9
xor eax, eax
push 0xb392f785
lea esp, [esp + 4]
jmp fcn.79116664
Function at 0x79149b10
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bp
call fcn.7912fd32
lea ecx, [ebp - 0x1b8]
jmp 0x79092d8b
mov dword [esp], ecx
pushfd
setb cl
bswap cx
mov ecx, dword [ebp - 0x30]
push ebx
lea esp, [esp + 8]
call fcn.79008720
movzx dx, dl
lea edx, [ecx + 0x58d86a8]
mov edx, dword [eax]
cwde
mov ah, 0xc
setbe ah
push edx
pushal
lea eax, [ebp - 0x60]
call fcn.7907e12d
mov dword [esp + 0x3c], 0x87f6d9fd
pushfd
lea esp, [esp + 0x40]
jmp fcn.7900ce25
pushal
push dword [esp]
pushfd
mov esp, ebp
movzx bp, bl
call fcn.7909bd36
push eax
pushal
push dword [esp]
lea esp, [esp + 0x28]
call fcn.7903edc6
pushfd
pushal
mov esp, ebp
not bp
pop ebp
push esp
mov byte [esp], 0x76
push dword [esp + 4]
ret 8
mov byte [esp + 8], 0xbe
lea esp, [esp + 0x1c]
jg 0x791180d9
call fcn.7903edc6
jno 0x790e4f49
mov esp, ebp
jmp 0x790859c1

Function at 0x7914a65c
Capabilities:
Encode data using xor

Disassembly:
pushfd
cmp dword [ebp - 0x34], 0x111
pushfd
lea esp, [esp + 8]
je 0x790eff3a
push 0xde6c9caf
test al, 0x43
cmp dword [ebp - 0x34], 0x211
push dword [esp]
pushal
call fcn.790eff30
mov byte [esp + 4], al
push dword [esp + 4]
call fcn.7912e264
pushfd
lea ecx, [ebp - 0x2c]
push dword [esp]
push dword [esp + 4]
mov byte [esp + 8], 0xf7
lea esp, [esp + 0xc]
call fcn.790de419
pushal
jmp 0x7900f039
lea esp, [esp + 8]
jne 0x790a3b69
adc eax, 0x3db1d5de
mov eax, dword [0x7907336c]
cmc
pushfd
pushal
cmp dword [eax + 0xe8], 2
mov byte [esp], 0x52
push 0xeee7c8e1
lea esp, [esp + 0x28]
je 0x790a3b69
push ecx
mov byte [esp], 0xcd
pushfd
mov dword [esp], 0x42fd33c1
lea esp, [esp + 8]
jmp fcn.790d4710

Function at 0x7914d7cb
Capabilities:
Encrypt data using xtea

Disassembly:
inc dl
bt ecx, 0xa
shr ecx, 0xb
push esp
test si, dx
and ecx, 3
shr edx, cl
sbb dh, 0x48
lea edx, [0x5bcffb25]
mov edx, dword ss:[ebp + 8]
cmc
add eax, dword ds:[edx + ecx*4]
sbb ch, dh
push 0x6a3c41a8
shl ch, 6
mov ecx, dword ss:[ebp - 0x10]
not dl
btc edx, 0x19
rcl dl, cl
shrd edx, esp, cl
sub ecx, eax
shrd edx, ebp, cl
mov dword ss:[ebp - 0x10], ecx
xchg cx, ax
mov edx, dword ss:[ebp - 4]
aad 0xce
aas
bts ax, 1
add edx, 0x61c88647
btc ax, dx
not ch
das
xor ah, dl
mov dword ss:[ebp - 4], edx
xor ecx, eax
mov eax, dword ss:[ebp - 0x10]
shr dh, 1
inc ch
shl eax, 4
add dl, ch
xor dl, bl
btr dx, 0xc
rol dl, cl
mov ecx, dword ss:[ebp - 0x10]
push 0xd92b4cd7
pushfd
shr ecx, 5
btc dx, sp
add dh, 0x49
bswap edx
xor eax, ecx
bts cx, 2
clc
movzx ecx, bl
bts cx, 4
mov edx, dword ss:[ebp - 0x10]
dec ecx
inc cl
sub cl, dh
xor edx, dword ss:[ebp - 4]
sar cl, 6
call fcn.790fb146
lea esp, [esp + 0x30]
je 0x7911f26b
push ecx
adc ah, 0xaa
mov eax, dword ss:[ebp - 8]
rol dx, 0xe
clc
bts ecx, 0x11
shl eax, 4
movsx cx, bl
mov ecx, dword ss:[ebp - 8]
bt bp, cx
sar dx, 2
rol dl, cl
xor dx, 0x7dd6
shr ecx, 5
or dh, 0x2b
stc
xor eax, ecx
shld ecx, edx, cl
shld dx, bx, cl
mov edx, dword ss:[ebp - 8]
inc ch
xor edx, dword ss:[ebp - 4]
neg ecx
sbb ch, 0xe0
add eax, edx
pushfd
mov ecx, dword ss:[ebp - 4]
jmp 0x7909631e
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4bba5062
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x4ea611dc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x420620]
xor eax, esp
mov dword [esp + 0x210], eax
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWARETencentQQPCMgr
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40128a
xor al, al
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004074fd
add esp, 0x214
ret
mov eax, dword [esp]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0x41b234
push eax
mov dword [esp + 0x1c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401273
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 8]
push edx
call fcn.004011e0
mov ecx, dword [esp + 0x214]
add esp, 4
xor ecx, esp
call fcn.004074fd
add esp, 0x214
ret
Function at 0x4026a0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4199b8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x420620]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x420620]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x98]
mov ebx, dword [esp + 0x9c]
xor esi, esi
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], esi
mov word [esp + 0x6c], si
xor eax, eax
push 0x44
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x28]
push esi
push eax
mov dword [esp + 0x9c], esi
call fcn.004073f0
mov eax, dword [ebx + 0x14]
add esp, 0xc
xor edi, edi
cmp eax, esi
mov dword [esp + 0x24], 0x44
je 0x4027cb
lea esi, [eax + 0x208]
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00406e34
push 0x41b328
mov edi, eax
push esi
push edi
call fcn.00408232
add esp, 0x10
cmp dword [ebp + 0x18], 8
jb 0x402771
mov ebp, dword [ebp + 4]
jmp 0x402774
add ebp, 4
push ebp
push esi
push edi
call fcn.004081b8
push 0x41b320
push esi
push edi
call fcn.004081b8
mov ebp, 8
add esp, 0x18
cmp dword [ebx + 0x18], ebp
jb 0x40279a
mov ebx, dword [ebx + 4]
jmp 0x40279d
add ebx, 4
push ebx
push esi
push edi
call fcn.004081b8
add esp, 0xc
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor esi, esi
jmp 0x4027f7
cmp dword [ebp + 0x18], 8
jb 0x4027d6
mov ebp, dword [ebp + 4]
jmp 0x4027d9
add ebp, 4
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 8
cmp eax, esi
jne 0x402815
cmp dword [esp + 0x80], ebp
jb 0x402811
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.0040730e
add esp, 4
xor al, al
jmp 0x402871
mov eax, dword [esp + 0x18]
cmp eax, esi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40282a
push eax
call ebx
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0x14]
cmp eax, esi
je 0x40284c
cmp byte [esp + 0xa0], 0
je 0x402849
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x14]
push eax
call ebx
cmp edi, esi
je 0x402859
push edi
call fcn.0040746a
add esp, 4
cmp dword [esp + 0x80], ebp
jb 0x40286f
mov edx, dword [esp + 0x6c]
push edx
call fcn.0040730e
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.004074fd
add esp, 0x80
ret
Function at 0x404660
Capabilities:
Get common file path

Disassembly:
sub esp, 0x624
mov eax, dword [0x420620]
xor eax, esp
mov dword [esp + 0x620], eax
push esi
push edi
mov edi, dword [esp + 0x630]
xor esi, esi
push 0x20a
lea eax, [esp + 0xe]
push esi
push eax
mov word [esp + 0x14], si
call fcn.004073f0
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x103
ja 0x40476a
push 0x410
lea edx, [esp + 0x21a]
push esi
push edx
mov word [esp + 0x21e], si
mov word [esp + 0x220], si
call fcn.004073f0
add esp, 0xc
push 0x208
lea eax, [esp + 0x218]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x40472e
cmp eax, esi
je 0x40472e
lea edx, [esp + 0x214]
push edx
mov ecx, edi
mov word [esp + eax*2 + 0x218], si
call fcn.00403850
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.004074fd
add esp, 0x624
ret
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x404735
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00402d70
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x620]
xor ecx, esp
call fcn.004074fd
add esp, 0x624
ret
mov ecx, dword [esp + 0x628]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.004074fd
add esp, 0x624
ret

Function at 0x405b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xffffffffffffffff
push 0x419fbb
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push esi
push edi
mov eax, dword [0x420620]
xor eax, esp
push eax
lea eax, [esp + 0x94]
mov dword fs:[0], eax
movzx eax, word [esp + 0xa4]
push 0x41b424
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x405c3f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x405c3f
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x405c3f
mov eax, dword [esp + 0xa8]
cmp dword [eax + 0x18], 8
jb 0x405bca
mov eax, dword [eax + 4]
jmp 0x405bcd
add eax, 4
push 1
push 0x40
push 0x20
push eax
lea ecx, [esp + 0x1c]
call fcn.004056a0
push esi
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0xa4], 0
call fcn.00405590
lea ecx, [esp + 0xc]
call fcn.00404c60
lea ecx, [esp + 0x60]
mov dword [esp + 0x9c], 0xffffffff
call fcn.00404bf0
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x64], vtable.std::ios_base.0
call fcn.00406cf4
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x94
ret
xor al, al
mov ecx, dword [esp + 0x94]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x94
ret