joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a1c
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push 0x1004a90
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0x1004a48
xor al, al
jmp 0x1004a88
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push esi
jmp 0x100e4b0
pop ebx
leave
ret 8

Function at 0x1004d2c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x1006084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x10c]
push eax
push 0x20019
xor esi, esi
push esi
push 0x1004e14
push 0x80000000
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1004e01
push edi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push esi
push dword [ebp - 0x10c]
mov edi, 0x104
mov dword [ebp - 0x118], edi
mov dword [ebp - 0x114], 1
call dword [sym.imp.KERNEL32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004df0
cmp dword [ebp - 0x114], 2
mov byte [ebp - 5], al
lea eax, [ebp - 0x108]
jne 0x1004dda
push edi
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
dec eax
lea ecx, [edi - 1]
cmp ecx, eax
sbb esi, esi
inc esi
jmp 0x1004df0
push eax
push edi
push dword [ebp - 0x110]
call fcn.01004cc4
xor ecx, ecx
test eax, eax
setge cl
mov esi, ecx
push dword [ebp - 0x10c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, esi
pop edi
jmp 0x1004e03
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0100148d
leave
ret 4
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5e18072d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x651233e3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4020f9
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.00423517
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402144
push 0x80004005
call 0x400ec9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.00423517
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402174
push 0x80004005
call 0x400ec9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.00423517
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4021a1
push 0x80004005
call 0x400ec9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004018f9
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004018f9
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x417f2d
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417f2d
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret

Function at 0x419479
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0043a897
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4194c4
push 0x80004005
call int.00418249
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0043a897
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4194f4
push 0x80004005
call int.00418249
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0043a897
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x419521
push 0x80004005
call int.00418249
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.00418c79
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.00418c79
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x420729
Capabilities:
Encode data using xor

Disassembly:
std
stosd dword es:[edi], eax
mov ecx, 0x86b054d3
xchg edx, eax
sub dword [ecx - 0x3501baa5], esi
pop edx
jnp 0x420782
mov bl, 0x49
loope 0x420785
dec esi
or dl, ah
inc ecx
pop esp
scasd eax, dword es:[edi]
retf 0x864d
push eax
pop ebp
invalid
mov dh, 0xe0
or dword [eax - 0x458c7970], edx
nop
nop
xchg byte [ebx - 0x46], dh
push ebx
mov esp, 0xf5a3d977
jb 0x4207bd
dec eax
and eax, 0xe59a3323
retf 0x2a77
jbe 0x420755
dec ecx
mov esi, 0xc9fd8c49
popfd
mov word [edx], es
ret

Function at 0x4230fc
Capabilities:
Encode data using xor

Disassembly:
or al, 0x1d
mov cs, word [edx - 0x29bc2e7e]
invalid

Function at 0x447549
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00468967
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447594
push 0x80004005
call fcn.00446319
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00468967
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4475c4
push 0x80004005
call fcn.00446319
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00468967
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4475f1
push 0x80004005
call fcn.00446319
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x45e429
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.0047f847
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e474
push 0x80004005
call fcn.0045d1f9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.0047f847
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e4a4
push 0x80004005
call fcn.0045d1f9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.0047f847
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e4d1
push 0x80004005
call fcn.0045d1f9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0045dc29
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0045dc29
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x481f9e
Capabilities:
Encode data using xor

Disassembly:
popfd
push edx
shr byte [ecx], 1
call 0xab988f97
ret
pushfd
mov bh, 0x87
push edi
loopne 0x481f6c
mov dh, 0x72
pop ss
in al, 0x2a
jo 0x481f0a
xchg edi, eax
invalid
mov esp, 0xfbb40260
iretd
mov dword [edi], edx
rcl byte [ecx - 0x78], 0xc1
xchg ebx, eax
and ch, byte [edi - 0x5e]
jge 0x481f06
invalid
jmp 0x481f63
jae 0x481f79
push ebp
and eax, 0x4197c9fd
je 0x481f40
mov ebx, dword [edx - 0x7f]
cmc
salc
test eax, 0x8cde4669
mov dword [0x55c5439d], eax
mov ecx, 0xcd5cd154
jbe 0x481ff6
invalid
mov ecx, 0xde91b678
in al, dx
jne 0x48207c
invalid
sub al, byte [eax - 0x6db527d0]
or byte [ebp + edi + 0x74d85bdc], dh
add al, 0x3b
fidiv dword [esi + ebp*8]
cmp eax, 0xaf876b02
mov bl, 0xab
mov dword [eax], ebx
ror dword [eax - 0x320932cf], 7
push edx
mov eax, 0xd1fe509d
dec esp
imul ebx, dword [edi - 0x2edb8b6c], 0x3fda2a1a
lea ebx, [eax]
jg 0x482089
enter 0xfffffffffffff926, 0x3f
invalid

Function at 0x48cb69
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.004adf87
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cbb4
push 0x80004005
call fcn.0048b939
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.004adf87
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cbe4
push 0x80004005
call fcn.0048b939
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.004adf87
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cc11
push 0x80004005
call fcn.0048b939
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0048c369
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0048c369
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d5a9
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.004adf87
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d603
push 0x80004005
call fcn.0048b939
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.004adf87
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d636
push 0x80004005
call fcn.0048b939
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d4e9
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d6d4
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d688
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d6a8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048c969
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
invalid
invalid

Function at 0x4992f1
Capabilities:
Encode data using xor

Disassembly:
sub ah, 0xef
mov dword [edx + 0x1f], ebp
sbb dh, dl
sbb al, 0x8f
cdq
mov word [0xf6870b58], fs
stosd dword es:[edi], eax
invalid
Function at 0x4a15f9
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
popfd
and ch, byte [edx + 0x33f87758]
dec ebp
dec esi
pop eax
ja 0x4a15a5
xor ecx, dword [ebp + 0x4e]
in al, 4
adc esi, ebp
lodsd eax, dword [esi]
xlatb
or al, 1
inc ecx
mov ebp, 0x2d7c4c58
push ebp
pop edx
fisub dword [ecx + esi*4 + 0x4c]
lcall 0xc98, 0x85d02492
mov bh, 0xa6
sub al, 0x2f
fimul word [esi + ecx*8]
push edx
stc
adc al, 0xca
cmp esp, dword [ecx + 0x3f]
pop edx
xchg ebp, eax
invalid
sub ch, dl
jnp 0x4a166f
jne 0x4a1660
jo 0x4a1625
invalid
or eax, 0x6ad92cfa
js 0x4a15aa
inc esi
salc
pop edx
pop ecx
or dword [edx + 0x34d13038], esp
in al, 0x47
popfd
aad 0x7a
xor al, 0xf3
sar esi, 0xcc
outsb dx, byte [esi]
dec esp
and esp, dword [ecx]
jmp 0x811d7994
pop esp
arpl bx, dx
sbb byte [0xa2f8f636], 0x48
in eax, 0x28
mov byte [eax + 0x61], bl
jb 0x4a16a8
lahf
adc al, 0xea
jmp 0x4a16c0
adc ebp, dword [ebp + ebp*2 - 0x437ca17c]
mov al, 0xea
xor ebp, eax
mov eax, dword [0x53c9de24]
push ebx
jns 0x4a1634
add byte [ecx - 0x7a3c998b], bl
push es
scasb al, byte es:[edi]
in al, dx
outsb dx, byte [esi]
test dword [eax], edi
pop eax
push cs
inc ebp
or byte [eax], dl
dec ebp
jnp 0x4a1613
push ebx
loope 0x4a16c9
in eax, dx
and cl, byte [ebx + 0x49]
ljmp 0x644c
pushal
push cs
pop eax
psubusb mm6, qword [eax + 1]
sti
pop es
cdq
inc ebx
adc al, 0x8f
add al, 0x5e
invalid
shr dword ds:[ecx], 0x60
arpl word [esi], cx
into
pop dword [esi + 0x5ce76582]
and byte [ebp - 0x19], 0x5c
push cs
add al, 0xd3
jae 0x4a1710
xor dh, 0x5d
fbstp tbyte [ebx]
enter 0x77ad, 3
and bl, 0xb2
pop esp
push es
add eax, dword [eax + 0x65cb2e3]
xchg ebx, eax
xchg edi, eax
xchg dword [eax - 0x237ebc29], edi
jb 0x4a166f
push edi
pushfd
sbb ch, byte [0x488e26de]
mov ds, word [ecx - 0x49]
mov dword [ebx + edx*2 + 9], 0xf6524405
int1
inc ecx
dec esp
scasb al, byte es:[edi]
inc edx
aad 0xfc
xor byte [edi], ch
mov esp, dword [esi]
sal byte [ebx - 0x694ed400], 1
mov bl, 0
sub al, 0xb1
xchg esi, eax
sub al, 0x3a
lock and bh, byte [edx]
cmp dh, al
and bh, byte [edx]
bound ebx, qword [esi - 0x5eecf22b]
xor dh, byte [eax]
loope 0x4a172b
push eax
jg 0x4a170a
test al, 0x45
imul ecx, dword [edi - 0x77], 0xffffffa7
std
nop
push cs
rcl byte [edx + 0x43], cl
push edx
inc ebx
and dword [ecx + 0x4c75310d], edx
xor dword [ebp + 0x4c], esi
adc bh, byte [eax + 0x70d6dbf9]
loope 0x4a16da
ja 0x4a1730
mov dl, 0x9d
cmp esi, dword [ecx]
clc
xor dword [eax - 0x6c], 0x3f00ac74
sar dword [edi - 0x65], cl
xchg esp, eax
and esi, dword [0x3d0cf101]
sub al, 0xbc
and edx, dword [0x368251ce]
push edx
mov al, 0xbc
add ecx, dword [esp + eax]
imul ebx, dword [esi], 0x38
insd dword es:[edi], dx
in al, 0xba
xor ah, byte [ebp + 0x5c]
invalid
xchg dh, ch
Function at 0x4a3e29
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c5247
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e74
push 0x80004005
call int.004a2bf9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c5247
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ea4
push 0x80004005
call int.004a2bf9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c5247
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ed1
push 0x80004005
call int.004a2bf9
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a3629
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a3629
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4adb62
Capabilities:
Encode data using xor

Disassembly:
pop edi
sbb edx, dword [eax]
out dx, al
outsb dx, byte [esi]
retf
push eax
pop esi
bound ecx, qword [ecx - 0x36]
inc edx
popal
dec ebx
loope 0x4adbcf
dec edi
in al, 0xc0
jg 0x4adb07
sar eax, cl
push edi
inc ebx
insb byte es:[edi], dx
mov eax, dword [0xee591d64]
cmp esp, dword [esp + eax*2 - 0x39d25d3d]
xchg ebx, eax
retf
call 0x3225589
sbb byte [edx - 0x6c36ab0c], bh
stc
jae 0x4adbfe
pop ebx
cmp al, 0xbb
sub dword [esi + 0x6c], 0x20860c7f
aaa
or al, 0xfa
in al, 0x7b
daa
pop ebx
jl 0x4adbee
mov edi, 0x9dc41576
jg 0x4adb80
sti
add al, 0x39
or eax, 0xaaba7d7f
stosb byte es:[edi], al
push edi
scasb al, byte es:[edi]
jge 0x4adb93
xchg edx, eax
jo 0x4adc31
pop ds
cmp byte [edx + eax*4], ah
adc ch, byte [si + 0x457a]
pop ebx
leave
sbb al, 0xf9
add al, 0x86
cmp al, 0x7d
lodsb al, byte [esi]
jbe 0x4adc4e
scasb al, byte es:[edi]
cmp byte [esi + edi*4], bh
invalid
cld
mov esi, 0x22861b84
lodsd eax, dword [esi]
dec eax
invalid
dec ebp
test al, 0x1c
xor al, 0xd1
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x7215dd31]
xchg esp, eax
fsub dword [edi - 0x55120a57]
fidivr word [edx + ecx*4 + 0x42]
imul ecx, dword [edx - 0x3e], 0x16
test eax, 0x5b7d8cda
fimul dword [ebp + edi*2 + 0x4b1a435b]
push ebx
pop ebx
inc ebx
sbb cl, byte [ebx + 0x53]
jp 0x4adc2a
push ds
mov ah, byte [edi + 2]
jp 0x4adc69
rcr byte gs:[ebp - 0x3a], cl
adc al, 0x79
inc edi
fbld tbyte [ecx]
in eax, dx
mov eax, dword [0xd86cafe]
loop 0x4adc6c
xor ebx, dword [eax - 0x6fb771f]
iretd

Function at 0x4b88a3
Capabilities:
Encode data using xor

Disassembly:
pop esp
cld
sbb al, 0xf8
scasd eax, dword es:[edi]
aam 0x6e
or dword [edi + 0x7e], esi
iretd
xchg edi, eax
cmp bl, byte [eax + 0x6c24035c]
shl dword [edi], 1
mov eax, dword [0x1086b116]
int3
xchg edx, eax
in eax, dx
insd dword es:[edi], dx
add byte [edx - 0x73e574ac], al
jle 0x4b882f
dec edi
cli
loopne 0x4b8842
cld
mov eax, 0xfc45a5ca
sub ah, bl
cmp byte [ebx + 0x71], ch
invalid
Function at 0x419d30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x410015
lea edi, [esi - 0xf015]
push edi
or ebp, 0xffffffff
jmp 0x419d52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419d59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419d48
mov eax, 1
add ebx, ebx
jne 0x419d6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419d60
jne 0x419d7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419d60
xor ecx, ecx
sub eax, 3
jb 0x419d90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419e02
mov ebp, eax
add ebx, ebx
jne 0x419d9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419da8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419dcc
inc ecx
add ebx, ebx
jne 0x419db8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419dad
jne 0x419dc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419dad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419dec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419ddd
jmp 0x419d4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419dec
add edi, ecx
jmp 0x419d4e
pop esi
mov edi, esi
mov ecx, 0x2b3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x419e0a
cmp byte [edi], 5
jne 0x419e0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x419e0f
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419e87
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1908c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419e3c
mov ecx, edi
jns 0x419e6b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19090]
or eax, eax
je 0x419e81
mov dword [ebx], eax
add ebx, 4
jmp 0x419e59
call dword [esi + 0x190a0]
mov ebp, dword [esi + 0x19094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419ebb
sub esp, 0xffffff80
jmp 0x404c20

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219