joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69d0d0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x68000]
push edi
or ebp, 0xffffffff
jmp 0x69d0f2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x69d0f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69d0e8
mov eax, 1
add ebx, ebx
jne 0x69d10b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69d11c
jne 0x69d13b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69d13b
dec eax
add ebx, ebx
jne 0x69d128
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x69d100
add ebx, ebx
jne 0x69d137
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69d18d
xor ecx, ecx
sub eax, 3
jb 0x69d153
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x69d1c2
sar eax, 1
mov ebp, eax
jmp 0x69d15e
add ebx, ebx
jne 0x69d15e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69d12c
inc ecx
add ebx, ebx
jne 0x69d16c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69d12c
add ebx, ebx
jne 0x69d179
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69d16e
jne 0x69d18a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69d16e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x69d1ac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x69d19e
jmp 0x69d0ee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x69d1ac
add edi, ecx
jmp 0x69d0ee
pop esi
mov edi, esi
mov ecx, 0x1e11
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69d1ca
cmp byte [edi], 0x11
jne 0x69d1ca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69d1cf
lea edi, [esi + 0x299000]
mov eax, dword [edi]
or eax, eax
je 0x69d23e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2f8eb4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2f8edc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69d1fc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2f8ee4]
or eax, eax
je 0x69d238
mov dword [ebx], eax
add ebx, 4
jmp 0x69d219
call dword [esi + 0x2f8ee0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x69d26f
cmp al, 0xef
ja 0x69d262
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x69d244
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x69d251
mov ebp, dword [esi + 0x2f8ee8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x69d2a3
sub esp, 0xffffff80
jmp 0x4024c0
Function at 0x44e988
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
add esp, 0xfffffbe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.00404914
mov eax, dword [ebp - 8]
call fcn.00404914
sub eax, eax
push ebp
push 0x44eaea
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0xc1c23
push esi
pop eax
mov edx, 0x44eb04
call fcn.004044b8
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.004044fc
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0x5c
jne 0x44e9fe
lea eax, [ebp - 0x18]
push 1
pop ecx
pushal
popal
push edi
pop edi
push 1
pop edx
call fcn.004049c4
mov eax, dword [ebp - 0x18]
call fcn.00404724
mov edx, dword [ebp - 0x18]
cmp byte [edx + eax - 1], 0x5c
jne 0x44ea27
mov eax, dword [ebp - 0x18]
call fcn.00404724
push eax
pop edx
lea eax, [ebp - 0x18]
pushfd
xor ecx, ecx
inc ecx
popfd
call fcn.004049c4
lea edx, [ebp - 0x41c]
mov eax, dword [ebp - 0x18]
call fcn.004081a0
mov edx, dword [ebp - 0x41c]
lea eax, [ebp - 0x18]
call fcn.004044fc
push ebx
pop eax
sub eax, 0xc1c22
mov dword [ebp - 0x14], eax
push ebx
pop eax
sub eax, 0xc1823
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
push eax
sub ebx, 0xa1c0a
push ebx
push 0
mov eax, dword [ebp - 0x18]
call fcn.00404924
push eax
push edi
call dword [0x452bb0]
or eax, eax
jne 0x44eabc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00404924
push eax
mov eax, dword [ebp - 0xc]
push eax
call dword [0x452bb8]
test eax, eax
jne 0x44eab2
push esi
pop eax
lea edx, [ebp - 0x418]
mov ecx, 0x400
call fcn.004046d4
mov eax, dword [ebp - 0xc]
push eax
call dword [0x452bbc]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44eaf1
lea eax, [ebp - 0x41c]
call fcn.00404464
lea eax, [ebp - 0x18]
call fcn.00404464
lea eax, [ebp - 8]
nop
push 2
nop
pop edx
call fcn.00404488
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, reloc.kernel32.dll_OpenMutexA
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x492b84
Capabilities:
Execute anti-debugging instructions

Disassembly:
push edi
mov dword [esp + 8], ecx
call fcn.00492ba8
push 0xf0485814
jmp 0x492cbe
mov ax, bp
adc bh, 5
jl 0x492d0d
lea ebx, [ebx + edi]
setae bh
jmp 0x492ced
lea ebx, [ebx + edi]
setae bh
mov edi, dword [esp + 0x2c]
jmp 0x492cf7
mov bp, 0x715e
mov bl, ch
and bp, cx
jb 0x492d28
dec ebx
jmp 0x492d0f
jmp 0x492ce7
lea ebp, [esp]
rdtsc
sbb ax, dx
jne 0x492d41
je 0x492d41
hlt
dec ebx
jmp 0x492d0f
call fcn.00492d2b
sub esp, 0xbc
jmp 0x492f93
jmp fcn.00492daa
mov esi, esp
lea ecx, [ecx*4]
mov dx, sp
bsf ecx, edx
jne 0x492e6d
je fcn.00492daa

Function at 0x492c83
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xd], ecx
jmp 0x492c8d
lea esp, [esp + 0x11]
push esp
mov word [esp + 7], di
push ebp
lea esp, [esp + 3]
mov dword [esp + 0x20], edi
jmp 0x492cdd
lea esp, [esp + 0x20]
pushfd
jmp 0x492b8e

Function at 0x492cad
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
mov dword [esp], ebp
mov dword [esp + 0xc], esi
pushal
call fcn.00492c83

Function at 0x49521d
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0485814
jmp 0x4951c1
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
pushfd
jmp 0x494c31
lea esp, [esp]
jmp 0x495182
mov al, 7
mov ecx, dword [esp]
mov dh, ch
setne bl
jmp 0x4951d9
jmp 0x4951a5
not ah
or ecx, 0x5d9ab704
jns 0x495203
cpuid
jmp 0x4951ed
mov esi, dword [esp + 0x2c]
lea ecx, [ecx*4]
mov ax, word [esp]
lea ebp, [esp]
jmp 0x4951c3
neg ebx
jmp 0x495207
cpuid
neg ebx
sub esp, 0xc0
jmp 0x4952c4
lea esp, [esp + 2]
push word [esp]
jae 0x4951a0
lea esp, [esp]
mov dword [esp + 0x44], edi
lea esp, [esp + 0x44]
jmp 0x49518a
cpuid
add esp, 6
lea esp, [esp + 1]
jmp fcn.0049528c
sub esp, 0x13
jmp 0x49523b
mov edi, esp
neg ax
jns 0x495251
sub esp, 0x13
cpuid
add esp, 6
lea esp, [esp + 1]
jmp fcn.0049528c
Function at 0x570aca
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap ebp
mov ah, dl
not eax
rdtsc
xchg dword [esp + 0xa], edx
pop esi
jmp 0x570ae6
btr si, ax
jmp 0x570aad
neg di
rol ch, 0
shr bp, 5
mov ebp, dword [esp + 6]
jmp 0x570b60
mov cl, 0x7c
pop dword [esp + 4]
lea ebp, reloc.KERNEL32.dll_HeapAlloc
cld
mov bl, dh
mov byte [esp + 3], dh
jmp 0x570ad0
xchg bp, cx
not esi
rdtsc
pop word [esp + 0x10]
pop edx
setb al
jmp 0x570b46
xchg si, cx
xchg byte [esp + 5], bh
xchg byte [esp + 0xe], bl
mov dx, word [esp + 7]
bswap edi
push dword [esp + 0xc]
jmp 0x570b18
bsf ax, dx
xchg byte [esp + 3], bh
pop dword [esp + 8]
dec bh
pushfd
push word [esp + 7]
jmp 0x570b79
mov bp, bx
push di
mov ecx, dword [esp + 0xe]
mov esi, 0x22e9e30e
btr eax, edx
lea ebx, [esi - 0xc6]
jmp 0x570b2e
push word [esp + 0xc]
seto cl
mov dword [esp + 9], esi
mov byte [esp + 5], dh
mov cx, 0xc98a
call fcn.00570c79
jmp 0x570c01
push esp
and al, 0xa
mov di, ax
call 0x570c0d
mov ebp, 0x28247c87
xchg edi, edx
mov byte [esp + 8], ch
jmp 0x570c50
xchg esi, eax
lea esi, [edi*4]
cpuid
xchg ecx, eax
bsr esi, ebx
jmp 0x570c62
inc ebp
pop word [esp + 0x23]
xchg di, ax
cld
bts bp, dx
xchg ebp, ebx
jmp 0x570c3a
bswap ecx
mov ebp, dword [esp + 0x24]
mov edx, ebx
mov dl, byte [esp + 0x19]
mov dword [esp + 8], ebx
jmp 0x570c96
xchg byte [esp + 2], al
push ax
mov bl, byte [esp + 0xc]
add esp, 0x24
neg esi
jmp 0x570cd1
cpuid
pop cx
lea ebx, reloc.KERNEL32.dll_HeapAlloc
mov edx, 0x5d2cc910
cld
setnp ah
jmp 0x570c80
cpuid
xchg edx, edi
mov bl, 0xe
lea ebp, reloc.KERNEL32.dll_HeapAlloc
lea ecx, [edx + 0xd]
mov ebx, 0xc488eda7
jmp 0x570ce2
bswap ebx
lea esp, [esp + 2]
not ebp
push dword [esp]
stc
bsr edx, ecx
jmp 0x570cab
mov byte [esp + 4], bh
neg dh
std
mov word [esp + 2], ax
shl di, cl
mov word [esp], di
jmp 0x570d31
btc edx, ebx
pop eax
mov bx, word [esp + 1]
or bp, ax
jmp 0x570d68
rcl ah, 3
std
xchg si, ax
rdtsc
pop dx
mov ebx, 0xaac773d3
jmp 0x570d1b
xchg word [esp + 2], bp
call fcn.00570d52
pop word [esp]
pop word [esp]
dec si
mov dl, ch
push word [esp + 1]
xchg di, bx
jmp 0x571170
not ah
mov bl, byte [esp + 1]
mov di, sp
pop cx
xchg di, cx
bt eax, esp
call fcn.00570fdd

Function at 0x570e7e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], bl
mov dx, 0x8c13
mov di, bx
setle ch
pushal
jmp 0x570e96
jmp 0x570e68
mov bl, ch
clc
mov bh, ah
bsr ecx, ecx
mov cx, word [esp]
neg ah
jmp 0x570ecc
lea esp, [esp + 0x48]
neg dl
dec bl
mov dh, 0xe9
mov dh, byte [esp]
xchg bx, si
jmp 0x570e80
sub di, 0x6f40
clc
mov ebx, dword [esp]
lea ecx, [ebp + 0x1d]
dec al
cpuid
jmp 0x570f6e
dec ax
std
sub esp, 0x15
mov cl, dl
sub esp, 0x1b
inc bp
jmp 0x570efe
xchg al, ch
or si, 0xd2cd
cld
shr dx, 1
rdtsc
mov bx, word [esp]
jmp 0x570f14
Function at 0x570ebd
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg cl, dl
push dword [esp + 0x1d]
mov cl, 0x9b
pop si
mov dword [esp + 0x21], ecx
jmp 0x570e52
sub esp, 0xb
bswap ebx
pop bp
cpuid
bt cx, ax
mov edx, dword [esp + 0x27]
jmp 0x570e00
bsr esi, edi
pop ebx
mov dword [esp + 0x14], ebp
mov si, ax
xchg dword [esp + 7], edi
inc dh
call fcn.00570e7e
imul ebp, ecx, 0x79
sbb bl, ch
mov esi, 0xff980a8b
or ch, byte [edi + ebp]
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x44894286
and al, 5
mov dword [esp + 5], eax
pop dword [esp + 0x17]
mov di, 0xd2d0
rdtsc
mov bp, word [esp + 0x18]
inc ebp
jmp 0x570e29
rdtsc
mov si, word [esp + 0xc]
sub esp, 3
jmp 0x570e16

Function at 0x57100d
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x43]
mov dh, byte [esp]
jmp 0x5710f7
bsf di, si
lea edx, [ebp*4]
lea esp, [esp + 1]
mov ebp, edx
push di
xchg di, cx
jmp 0x571045
rol si, 1
neg edi
not dl
neg si
mov dh, byte [esp]
lea esi, reloc.KERNEL32.dll_HeapAlloc
jmp 0x57105b
push ax
mov al, byte [esp + 1]
btr ebp, esp
lea eax, [ecx*4]
mov word [esp], ax
mov dh, 0xb3
jmp 0x57107a

Function at 0x5713cb
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ebx
cpuid
cld
rcl ebx, 1
bts eax, edi
push di
jmp 0x5713ec
rdtsc
lea edi, [ebp*4]
jmp 0x5713b5
rdtsc
mov dl, byte [esp]
mov ch, 0x73
pop dword [esp]
xchg esi, eax
xchg bx, ax
jmp 0x571480
xchg word [esp], si
std
cld
mov ax, si
add esp, 5
lea edx, [ebp*4]
jmp 0x5713d6
cld
xchg dword [esp], ebp
bsr eax, edx
mov cx, bp
call fcn.00571415
mov edx, dword [esp + 2]
lea edx, [ebx*4]
add esp, 1
mov dh, 0xc
mov bh, byte [esp]
bts cx, bx
jmp 0x57142b

Function at 0x571504
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xa], ecx
shr edi, 0xb
push dword [esp + 0xe]
pop word [esp]
jmp 0x5714d9
bswap ebx
mov ah, 7
mov cx, word [esp + 0xc]
rdtsc
xchg dword [esp + 4], eax
lea esp, [esp]
jmp 0x571499
sbb al, 0xcc
xchg dword [esp + 9], ebx
lea edx, [eax*4]
jmp 0x57152d
not cl
mov dword [esp + 0xc], ebx
lea eax, [edi*4]
not bp
bswap ecx
push dword [esp + 0x11]
jmp 0x5714c3
lea ebx, [edx + ebp]
lea edx, [ecx*4]
mov eax, edx
lea edi, [edx + ebp]
mov al, 0x52
jmp 0x5714af
mov bl, cl
xchg byte [esp + 0xb], bl
lea ebp, [edi + edi]
xchg byte [esp + 0x11], dh
xchg ebp, ecx
jmp 0x571577
xchg dword [esp + 0xf], edx
mov eax, dword [esp + 8]
mov ebp, dword [esp + 0x10]
xchg word [esp + 0xa], di
seto bl
rdtsc
jmp 0x571517
lea ebx, [ebp - 0x93]
call 0x57155a

Function at 0x5716fa
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edi, [ebp + ebp]
xchg al, dl
mov bh, byte [esp + 0xc]
push dword [esp + 0xb]
xchg word [esp + 8], bx
not ebx
push bx
jmp 0x571646
mov edi, dword [esp + 3]
lea ecx, reloc.KERNEL32.dll_HeapAlloc
xchg di, cx
rdtsc
jmp 0x571689
Function at 0x477c00
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x72000]
push edi
jmp 0x477c1a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x477c21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x477c10
mov eax, 1
add ebx, ebx
jne 0x477c33
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x477c28
jne 0x477c44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477c28
xor ecx, ecx
sub eax, 3
jb 0x477c58
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x477cca
mov ebp, eax
add ebx, ebx
jne 0x477c63
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x477c70
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x477c94
inc ecx
add ebx, ebx
jne 0x477c80
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x477c75
jne 0x477c91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x477c75
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x477cb4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x477ca5
jmp 0x477c16
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x477cb4
add edi, ecx
jmp 0x477c16
pop esi
mov edi, esi
mov ecx, 0x266
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x477cd2
cmp byte [edi], 1
jne 0x477cd2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x477cd7
lea edi, [esi + 0x75000]
mov eax, dword [edi]
or eax, eax
je 0x477d4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x907b8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x90870]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x477d04
mov ecx, edi
jns 0x477d33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x90878]
or eax, eax
je 0x477d49
mov dword [ebx], eax
add ebx, 4
jmp 0x477d21
call dword [esi + 0x90874]
mov ebp, dword [esi + 0x9087c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1e7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x477d83
sub esp, 0xffffff80
jmp 0x40344a
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
push 4
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x73d660f3
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x2a545687
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x10001890
Capabilities:
Write file on windows

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff8
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x38
mov eax, dword [ecx + 4]
mov ebx, dword [ecx]
mov esi, dword [ecx + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x28], eax
test byte [0x100130f8], 8
jne 0x100019e0
mov eax, dword [ebx + 8]
cmp eax, 4
jbe 0x100019a0
mov edx, dword [ebx + 0x1c]
mov ecx, dword [ebx + 0x18]
mov edi, edx
or edi, ecx
je 0x10001920
cmp eax, 7
jne 0x10001940
mov edi, dword [ebx + 0x10]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edi
je 0x10001940
test byte [0x100130f8], 1
jne 0x10001a20
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x78
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 6
lea esp, [ebp - 0x10]
xor eax, eax
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x24]
mov ebx, dword [0x1001b0c4]
mov dword [ebp - 0x20], ecx
mov ecx, dword [0x1001b0c0]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edx
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
call dword [0x10013228]
mov ecx, 0
mov edi, dword [ebp - 0x28]
sub esp, 0x10
test eax, eax
cmove esi, ecx
mov dword [edi], esi
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov eax, dword [ebp - 0x28]
mov dword [esp + 8], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
sub esp, 0x14
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
mov dword [esp + 0x1c], eax
mov eax, dword [ebp - 0x24]
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__p__p__lu__p__n
mov dword [esp + 8], str.localmon_WritePort
mov dword [esp + 4], 0x100130f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x100018c2
mov dword [esp + 0xc], str.used_from_other_thread_n
mov dword [esp + 8], str.localmon_WritePort
mov dword [esp + 4], 0x100130f8
mov dword [esp], 0
call sym._wine_dbg_log.constprop.0
jmp 0x100018fa
Function at 0x10002490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
test byte [0x100130f8], 8
je 0x10002507
xor eax, eax
test ebx, ebx
je 0x100024b0
mov eax, dword [ebx]
call sym._wine_dbgstr_wn.constprop.0
mov dword [ebp - 0x14], eax
mov eax, esi
call sym._wine_dbgstr_wn.constprop.0
mov edi, eax
mov eax, dword [ebp + 8]
call sym._wine_dbgstr_wn.constprop.0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.__s___ld___p___s_____s_n
mov dword [esp + 8], str.localmon_AddPortExW
mov dword [esp + 4], 0x100130f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
test esi, esi
je 0x10002558
mov dword [esp + 4], 0x100150ec
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_lstrcmpiW]
sub esp, 8
test ebx, ebx
je 0x10002558
test eax, eax
jne 0x10002558
mov eax, dword [ebx]
test eax, eax
je 0x10002558
cmp word [eax], 0
je 0x10002558
cmp dword [ebp + 0xc], 1
je 0x10002578
xor esi, esi
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x7c
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
lea eax, [ebp - 0x10]
mov dword [esp + 4], 0x10015600
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x100025f0
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
xor esi, esi
test byte [0x100130f8], 8
je 0x10002567
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.___u_with__lu_n
mov dword [esp + 0x14], eax
mov dword [esp + 8], str.localmon_AddPortExW
mov dword [esp + 4], 0x100130f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10002567
mov eax, dword [ebx]
call sym._does_port_exist
test eax, eax
jne 0x10002653
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0x10015114
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
mov ebx, eax
mov eax, dword [ebp - 0x10]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test ebx, ebx
jne 0x1000259d
mov esi, 1
jmp 0x100025ac
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test byte [0x100130f8], 8
jne 0x1000267d
mov eax, dword fs:[0x18]
mov dword [eax + 0x34], 0x57
jmp 0x10002567
mov dword [esp + 0x10], 0x57
mov dword [esp + 0xc], str.__FALSE_with__u_n
mov dword [esp + 8], str.localmon_AddPortExW
mov dword [esp + 4], 0x100130f8
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x1000266b
Function at 0x10004ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x14]
mov esi, edx
push ebx
mov ebx, eax
lea eax, [ebp - 0x10]
sub esp, 0x28
mov dword [esp + 0xc], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [ebp - 0x18], eax
call eax
sub esp, 0x18
test eax, eax
jne 0x10004b48
cmp dword [ebp - 0x10], 1
jne 0x10004b48
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
test eax, eax
je 0x10004b48
mov dword [esp + 0x10], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
mov edx, dword [ebp - 0x1c]
sub esp, 0x18
test eax, eax
je 0x10004b4a
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
nop
lea esi, [esi]
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret