joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401050
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x40a0a4]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x401087
call fcn.00404c60
push eax
push str.Failed_to_set_access_protections_on_process:__s
call fcn.00404d20
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x40a0a4]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x4010bd
call fcn.00404c60
push eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.Failed_to_write_process_memory_at_offset__p_with__llu_bytes_of_data:__s
call fcn.00404d20
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x40a0a4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
jne 0x4010ee
call fcn.00404c60
push eax
push str.Failed_to_un_set_access_protections_on_process:__s
call fcn.00404d20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
cmp dword [0x40a0ac], 0
jne 0x40141b
cmp dword [0x40a950], 0
je 0x40146b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ntdll.dll__vscwprintf]
add esp, 8
add eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
shl eax, 1
call sub.ntdll.dll__alloca_probe_16
mov dword [ebp - 0x54], esp
mov eax, dword [ebp - 0x54]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ntdll.dll_vswprintf_s]
add esp, 0x10
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
sub ecx, 1
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004014c0
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteConsoleW]
cmp dword [0x40a0ac], 0
je 0x4014b6
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
lea edx, [ecx + ecx - 2]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [0x40a0ac]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x60]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
cmp dword [0x40a0ac], 0
je 0x40154e
mov eax, dword [0x40a0ac]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
call fcn.004014e0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401db0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
push ebx
push esi
push edi
push 2
push 0
push 0x40ab80
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0
jne 0x401df6
call fcn.00404c60
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40ab80
push str.Failed_to_scan_the_executable_file___s_:__010I32x:__s
call fcn.00404d20
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x401e22
mov eax, dword [ebp - 0x224]
sub eax, 1
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x228]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x22c], ecx
mov eax, dword [ebp - 0x22c]
add eax, 4
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x22c]
add eax, 0x18
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x230]
movzx ecx, word [eax]
xor edx, edx
cmp ecx, 0x8664
sete dl
mov dword [section..data], edx
cmp dword [section..data], 0
je 0x401e9c
mov eax, dword [ebp - 0x23c]
mov cx, word [eax + 0x30]
mov word [ebp - 0x234], cx
mov eax, dword [ebp - 0x23c]
mov cx, word [eax + 0x32]
mov word [ebp - 0x238], cx
jmp 0x401ebe
mov eax, dword [ebp - 0x23c]
mov cx, word [eax + 0x30]
mov word [ebp - 0x234], cx
mov eax, dword [ebp - 0x23c]
mov cx, word [eax + 0x32]
mov word [ebp - 0x238], cx
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, word [ebp - 0x234]
mov ecx, dword [0x406428]
cmp eax, dword [ecx + 0x26c]
ja 0x401f0a
movzx eax, word [ebp - 0x234]
mov ecx, dword [0x406428]
cmp eax, dword [ecx + 0x26c]
jne 0x401f14
movzx eax, word [ebp - 0x238]
mov ecx, dword [0x406428]
cmp eax, dword [ecx + 0x270]
jbe 0x401f14
push 1
call fcn.00401570
add esp, 4
mov eax, dword [section..data]
neg eax
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
push 0x40a964
push str.__sKex_d
push 0x10b
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.ntdll.dll_swprintf_s]
add esp, 0x14
push 0
push 0
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
add esi, eax
mov dword [ebp - 0x220], esi
mov eax, dword [ebp - 0x220]
shl eax, 1
call sub.ntdll.dll__alloca_probe_16
mov dword [ebp - 0x280], esp
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x21c]
push ecx
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x218]
push eax
mov ecx, dword [ebp - 0x220]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ntdll.dll_wcscat_s]
add esp, 0xc
mov eax, dword [ebp - 0x21c]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea esp, [ebp - 0x28c]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402380
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call fcn.00401ff0
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
mov eax, dword [0x40ad88]
push eax
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
mov eax, dword [0x40a0a8]
push eax
call dword [sym.imp.ntdll.dll_NtResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403ba0
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push ebx
push esi
push edi
mov ax, word [0x408628]
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x403bea
jmp 0x403c79
push str.VxKexLog_
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.00403ca0
test eax, eax
jge 0x403c06
jmp 0x403c79
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x40a0a0]
push eax
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00403ca0
test eax, eax
jge 0x403c32
jmp 0x403c79
push str..log
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionW]
test eax, eax
jne 0x403c4a
jmp 0x403c79
push 0
push 0x100
push 2
push 0
push 3
push 0xc0000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x403c74
jmp 0x403c79
mov eax, dword [ebp - 4]
jmp 0x403c95
call fcn.00404c60
push eax
lea eax, [ebp - 0x20c]
push eax
push str.Unable_to_open_the_log_file__s:__s
call fcn.00404d60
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403e90
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
push 0x104
push 0x40a964
push str.KexDir
push str.SOFTWAREVXsoftVxKexLdr
push 0x80000002
call fcn.00405250
add esp, 0x14
test eax, eax
jne 0x403ecb
push str.Could_not_find_the_VxKex_installation_directory._Please_reinstall_the_software_to_fix_this_problem.
call fcn.00404d20
push 0x40ab80
mov eax, dword [ebp + 8]
push eax
call fcn.004039f0
add esp, 8
push 0x5c
push 0x40ab80
call dword [sym.imp.ntdll.dll_wcsrchr]
add esp, 8
add eax, 2
mov dword [0x40a0a0], eax
cmp dword [ebp + 0x14], 0
je 0x403f64
call fcn.004014c0
mov eax, dword [eax + 0x10]
mov ecx, dword [eax + 0x8c]
mov dword [ebp - 4], ecx
call fcn.004014c0
mov eax, dword [eax + 0x10]
movzx ecx, word [eax + 0x88]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0x22c
jne 0x403f58
cmp dword [ebp - 4], 0
je 0x403f58
push 0x22c
mov eax, dword [ebp - 4]
push eax
push 0x40a940
call sub.ntdll.dll_memcpy
add esp, 0xc
mov dword [0x40a940], 1
mov dword [0x40a95c], 0
jmp 0x403f62
push str.StartupInfo_contains_no_or_invalid_KexData
call fcn.00404d20
jmp 0x403f76
push 0x40a940
push 0x40ab80
call fcn.00403a80
add esp, 8
push 0x40ab80
call fcn.00403ba0
add esp, 4
mov dword [0x40a0ac], eax
cmp dword [ebp + 0xc], 0
jne 0x403fb6
cmp dword [ebp + 0x18], 0
jne 0x403fb6
cmp dword [ebp + 0x14], 0
jne 0x403fb6
cmp dword [0x40a940], 0
jne 0x403fb6
mov eax, dword [ebp + 8]
push eax
call fcn.00402380
add esp, 4
xor eax, eax
jmp 0x404099
mov eax, dword [ebp + 8]
push eax
call fcn.00401ff0
add esp, 4
cmp dword [ebp + 0xc], 0
jne 0x403fd1
call fcn.004024b0
test eax, eax
jne 0x403fdd
cmp dword [ebp + 0xc], 0
je 0x40400d
cmp dword [ebp + 0x10], 0
je 0x40400d
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0x40ab80
push str.VxKexLdr_Debug_Console___s_
push 0x11d
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.ntdll.dll_swprintf_s]
add esp, 0x10
push str.VxKexLdr_Debug_Console
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0x40ab80
push str.Process_image_full_path:__s_r_n
call fcn.00401400
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.Process_command_line:__s_r_n
call fcn.00401400
add esp, 8
mov eax, dword [0x40ad90]
push eax
mov ecx, dword [0x40ad94]
push ecx
mov edx, dword [section..data]
neg edx
sbb edx, edx
and edx, 0x20
add edx, 0x20
push edx
push str.The_process_is__d_bit_and_its_base_address_is__p__PEB_base_address:__p__r_n
call fcn.00401400
add esp, 0x10
push str._KE__Copying_KexData_structure_to_child_process_r_n
call fcn.00401400
add esp, 4
call fcn.00402930
push str._KE__Rewriting_imports_of_executable_file_r_n
call fcn.00401400
add esp, 4
mov eax, dword [0x40ad94]
push eax
mov ecx, dword [0x40a0a0]
push ecx
call fcn.00402510
add esp, 8
call fcn.00403360
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x10
call fcn.00404c80
add esp, 0xc
mov dword [ebp - 4], 0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x404fc0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
mov eax, 0x19
mov word [ebp - 8], ax
mov dword [ebp - 0x34], 0x24
push 0
push 0x24
lea eax, [ebp - 0x30]
push eax
push 0x17
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtQueryInformationProcess]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x40500a
mov eax, dword [ebp - 4]
push eax
call fcn.00405100
add esp, 4
xor eax, eax
jmp 0x4050ec
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
movzx ecx, word [ebp - 8]
mov eax, 1
shl eax, cl
and eax, dword [ebp - 0xc]
je 0x4050d2
movzx eax, word [ebp - 8]
add eax, 0x41
mov word [ebp - 0xbc], ax
mov eax, 0x3a
mov word [ebp - 0xba], ax
xor eax, eax
mov word [ebp - 0xb8], ax
push 0x40
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0xbc]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x4050d2
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0xb4]
push edx
call dword [sym.imp.ntdll.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x4050d2
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax*2 - 4]
mov dword [ebp - 0xc4], edx
mov eax, dword [ebp - 0xc4]
mov cx, word [ebp - 0xbc]
mov word [eax], cx
mov eax, dword [ebp - 0xc4]
mov cx, word [ebp - 0xba]
mov word [eax + 2], cx
mov eax, dword [ebp - 0xc4]
jmp 0x4050ec
mov ax, word [ebp - 8]
sub ax, 1
mov word [ebp - 8], ax
movzx eax, word [ebp - 8]
test eax, eax
jne 0x405010
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405150
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0
push 1
push 0
push 2
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x405186
jmp 0x4051cd
push 1
push 0
push 0
push 4
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4051a3
jmp 0x4051cd
push 0x124
push 0x40a2d8
mov eax, dword [ebp - 8]
push eax
push 0xffffffffffffffff
call sub.PSAPI.DLL_GetMappedFileNameW
test eax, eax
jne 0x4051be
jmp 0x4051cd
push 0x40a2d8
call fcn.00404fc0
add esp, 4
jmp 0x4051ef
cmp dword [ebp - 8], 0
je 0x4051dd
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 4], 0
je 0x4051ed
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405250
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
shl eax, 1
mov dword [ebp + 0x18], eax
cmp dword [ebp + 0xc], 0
je 0x40528e
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40528e
jmp 0x4052ca
lea eax, [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4052b3
jmp 0x4052ca
cmp dword [ebp + 0xc], 0
je 0x4052c3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4052d6
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405380
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 4
cmp dword [ebp + 0xc], 0
je 0x4053bd
lea eax, [ebp - 4]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4053bd
jmp 0x4053f9
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4053e2
jmp 0x4053f9
cmp dword [ebp + 0xc], 0
je 0x4053f2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x405405
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44dde7
Capabilities:
Encode data using xor

Disassembly:
int1
push ecx
xor al, 0xb4
sub al, 0x7c
jmp 0x382add5a
add al, 0x54
in al, 0xa1
jno 0x44de62
jmp 0x44dd7b
hlt
dec edi
outsb dx, byte [esi]
add al, 0x46
cmp edx, dword [ebx]
mov ah, 0x4b
movsb byte es:[edi], byte [esi]
xor byte [eax], ch
jns 0x44de97
adc eax, 0x2f70f3a8
out dx, al
popfd
push cs
cli
add esi, dword [edi - 0x40]
jno 0x44dec6
in eax, dx
inc ebp
enter 0x2f17, 0xffffffffffffffb3
lodsb al, byte [esi]
xor al, 0x8f
je 0x44de89
push eax
popfd
js 0x44dead
push esp
jbe 0x44de57
or al, 0x9d
jp 0x44de74
lahf
push esp
mov ah, 0xcc
push 0xe8646434
xlatb
mov esp, 0x24645740
fld dword [esp + eax - 0x33]
mov ebp, 0x7498bc01
hlt
int3
push esi
loopne 0x44df0f
invalid
push ebp
pop es
pop ecx
cdq
mov eax, fs
inc esp
mov ebx, 0xc4d84ecf
sar byte [esp + edi + 0x5e53b], 1
test al, 0x98
sub al, 0x8a
aad 0x5d
sub dword [ebp + 0x4d], ecx
inc ecx
daa
push es
aad 0xb8
das
mov bl, 0x73
cmpsd dword [esi], dword es:[edi]
xor edx, edi
or al, 0x94
or al, 0x37
adc ebp, dword [edi + ebp*2]
aad 0xc8
xchg esi, eax
scasb al, byte es:[edi]
loope 0x44deeb
push edx
mov byte [esi + 0x25dec370], dl
jne 0x44df2a
bound edx, qword [0x223e0571]
xchg ecx, eax
les esp, [eax - 0x4a3e7ffb]
pop es
das
out dx, eax
inc esp
push edx
sal dword [ebp + 0x44ef2f07], 0x52
in eax, dx
cmp al, 0xf5
mov eax, 0x23d50450
mov al, 0xe9
dec eax
xor al, 0x5b
int 8
jl 0x44df57
in al, 0xea
and al, byte [esi - 0xb]
inc esi
cmc
js 0x44df02
and edi, esi
push ecx
movsb byte es:[edi], byte [esi]
push edx
lodsb al, byte [esi]
rcl byte [ebx], 0x2f
scasb al, byte es:[edi]
inc edx
test dword [ecx - 0x2a4bc670], 0x40bce08c
invalid
in al, dx
popal
wait
stosd dword es:[edi], eax
ja 0x44def9
invalid

Function at 0x4aab3b
Capabilities:
Encode data using xor

Disassembly:
add bl, byte [eax + ebp*4]
jecxz 0x4aaab2
outsd dx, dword [esi]
call 0x4ae2b089
cmp byte [ebp - 0x69], dl
add dl, byte [edx + ebp + 0x5a8b303e]
in al, dx
push eax
imul edi, ebx, 0x3c99b441
stc
mov dh, 0xa8
mov edx, 0x7648cc8e
mov ch, 0x40
and esp, esi
cmp cl, al
jnp 0x4aaafc
cwde
jl 0x4aab93
lea ebx, [ebx + eax*4 - 0x5ae5ad68]
enter 0xfffffffffffff907, 0xffffffffffffffe2
sub byte [esi - 0xdecc5c7], cl
dec ecx
or al, 0xc2
mov ebp, 0x4e1e28e3
xor byte [ecx + edi*8 - 0x640db7eb], 0x23
ror dword [ebp - 0x4d74e786], 0x4b
push ebx
or byte [eax - 0x7a], bh
daa
cli
sti
mov dl, 0x58
inc ebx
nop
rcl byte [esp + ebx*4 + 0x1726ab34], cl
pop edx
push cs
test al, 0x84
wait
invalid
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x80
xor eax, eax
mov dword [esp + 0x6c], eax
jmp 0x401177
mov eax, dword [esp + 0x68]
mov ecx, 0x4ec4ec4f
mov dword [esp + 0x64], eax
mul ecx
shr edx, 2
imul eax, edx, 0xd
mov ecx, dword [esp + 0x64]
sub ecx, eax
mov eax, ecx
sub eax, 1
mov dword [esp + 0x60], ecx
mov dword [esp + 0x5c], eax
je 0x4010df
jmp 0x401047
mov eax, dword [esp + 0x60]
sub eax, 0xb
mov dword [esp + 0x58], eax
je 0x4010df
jmp 0x4010c6
mov eax, esp
mov dword [eax], 0xe34382
mov eax, dword [sym.imp.USER32.dll_EndDeferWindowPos]
call eax
sub esp, 4
mov dword [esp + 0x54], eax
jmp 0x4011fc
mov eax, dword [esp + 0x50]
add eax, 1
mov ecx, esp
lea edx, [esp + 0x70]
mov dword [ecx], edx
mov ecx, dword [sym.imp.USER32.dll_SetRectEmpty]
mov dword [esp + 0x4c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xfafe5e
mov ecx, dword [sym.imp.GDI32.dll_GetTextColor]
mov dword [esp + 0x48], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x4c]
cmp ecx, 0xa
mov dword [esp + 0x44], eax
mov dword [esp + 0x50], ecx
je 0x401124
jmp 0x401075
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x64]
add eax, 1
cmp eax, 0x1f4
mov dword [esp + 0x68], eax
je 0x40113a
jmp 0x401017
mov eax, esp
mov dword [eax + 8], 0x2f
mov dword [eax + 4], 0xe80
mov dword [eax], 0x81de20
mov eax, dword [sym.imp.USER32.dll_SetClassWord]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 4], 0x980
mov dword [ecx], 0x22ac12
mov ecx, dword [sym.imp.USER32.dll_GetMenuItemID]
mov word [esp + 0x42], ax
call ecx
sub esp, 8
mov dword [esp + 0x3c], eax
jmp 0x4010c6
mov eax, dword [esp + 0x38]
add eax, 1
cmp eax, 0x119
mov dword [esp + 0x6c], eax
je 0x4010c2
jmp 0x401177
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x38]
sub edx, 2
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
je 0x4011fc
jmp 0x401159
mov eax, dword [esp + 0x38]
sub eax, 0x3d
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x50], ecx
je 0x40105a
jmp 0x401075
mov eax, dword [esp + 0x6c]
mov ecx, esp
mov dword [ecx + 4], 0x56f
mov dword [ecx], 0x203ce5
mov ecx, dword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov dword [esp + 0x38], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0x3c1
mov dword [ecx], 0x81cd85
mov ecx, dword [sym.imp.USER32.dll_GetClassWord]
mov dword [esp + 0x24], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx + 4], 0xe6eaf4
mov dword [ecx], 0xab4336
mov ecx, dword [sym.imp.GDI32.dll_PaintRgn]
mov word [esp + 0x22], ax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], 0x7eebbe
mov ecx, dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [esp + 0x1c], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x68], ecx
jmp 0x401017
mov eax, esp
mov dword [eax + 0xc], 3
mov dword [eax + 8], 0x113
mov dword [eax + 4], 0
mov dword [eax], 0x6831b3
mov eax, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
call eax
sub esp, 0x10
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
jmp 0x401124
Function at 0x401770
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x47b3b8]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xffffd6de
mov dword [0x47b3b8], ecx
mov dword [0x47b3b4], 0x1f5e
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
je 0x4018c9
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov esi, 0x100
mov edi, ecx
add edi, 1
add edx, 1
mov dword [0x47b3b4], 0x1f5e
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x47b3b8], 0xe3a
mov ebx, dword [ebp - 0x1c]
movzx ebx, byte [ebx + edx]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x30]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x38], edx
cdq
idiv esi
mov dword [0x47b3b4], 0xfffff63c
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov ebx, dword [0x47b3b8]
add ebx, 0xffffe802
mov dword [0x47b3b4], ebx
mov ebx, dword [ebp - 0x1c]
mov ch, byte [ebx + edx]
mov byte [ebx + esi], ch
mov byte [ebx + edx], cl
mov esi, dword [0x47b3b8]
add esi, 0xffffe802
mov dword [0x47b3b4], esi
mov esi, dword [ebp - 0x38]
movzx esi, byte [ebx + esi]
movzx ebx, byte [ebx + edx]
add ebx, esi
and ebx, 0xff
mov esi, dword [0x47b3b8]
add esi, 0xffffe802
mov dword [0x47b3b4], esi
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
mov cl, byte [esi + ecx]
mov esi, dword [ebp - 0x1c]
xor cl, byte [esi + ebx]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x34]
mov byte [ebx + esi], cl
mov ecx, dword [0x47b3b8]
add ecx, 0xffffe802
mov dword [0x47b3b4], ecx
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edx
jne 0x4017d1
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4080d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [fcn.004080d0]
mov dword [0x47b3b8], 0x1ec1
mov dword [ebp - 4], eax
jmp 0x40810b
mov eax, dword [ebp - 8]
add esp, 0xc
pop ebp
ret
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov ecx, dword [eax + ecx]
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x4550
je 0x4080eb
jmp 0x408118
mov eax, dword [ebp - 4]
cmp word [eax], 0x5a4d
mov dword [ebp - 8], eax
je 0x4080f3
mov eax, dword [ebp - 8]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [ebp - 4], eax
jmp 0x40810b