joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014021
Capabilities:
Authenticate hmac
Encode data using base64
Parse pe header

Disassembly:
add edi, edx
cwde
mov ecx, dword [esi + ecx*4 - 0x400003e0]
jmp 0x1005ca0c
mov dword [esp], 0xed8fb28a
jae 0x1005afdd
mov dword [esp + edx*2 - 0x2f704302], ebp
ret
xor dl, bl
shr eax, cl
imul cx, ax
sbb cl, ah
adc dl, 0xe
inc eax
sub ecx, ecx
sbb ecx, 0xc63b0f1b
xor dl, 0x93
or ax, ax
seta al
sal cx, 0xcf
sbb dl, al
rol al, 0xe3
rol dl, 1
btr ecx, ecx
neg dl
ror ecx, 0xe3
adc dl, 0x26
inc eax
sal ecx, 0xdc
rol dl, 1
cbw
ror eax, 0x59
xor bl, dl
btc ecx, 0x3c
bts eax, 0x38
ror eax, 0x9e
adc edx, esp
xor eax, eax
rol ecx, 0x77
sar cl, 5
adc eax, dword [edx + ecx - 0x80000]
lea edx, [ecx + ecx - 0x1be1085b]
sar edx, 0x55
lea esi, [esi + ecx*2 - 0x100004]
bt ecx, 0x11
dec cl
mov dword [esi + ecx - 0x800ff], eax
jbe 0x100a1b89
jne fcn.10093165
rol edx, 1
and ax, cx
btc ecx, 0x3c
dec edx
or ecx, ecx
xchg cx, ax
and cl, cl
xor ebx, edx
jmp 0x10012c60
cmp edi, edx
lea esp, [esp + 4]
ja 0x1008d733
mov edx, esp
mov ecx, 0x60
jmp 0x100c4b4d
and eax, eax
lea esi, [esi + eax*2 - 0x1ec]
mov al, byte [ebp + eax - 0xf8]
adc ebp, 1
mov edx, 0xf8ad7f12
bts edx, edx
xor al, bl
push edx
rol al, 1
inc byte [esp + 2]
btc dx, 0xe
setb dl
neg al
rol edx, 0xa2
push edx
xor al, 0x82
sal dl, 0x61
rol edx, 4
dec word [esp + edx*2 - 0x569f81d7]
inc al
xor bl, al
bts edx, 0x15
adc dword [esp + edx - 0x2b6fc0ea], edx
lea eax, [esp + eax + 8]
lea edx, [edx*8 + 0x44082ea7]
mov dword [eax], ecx
neg dword [esp + 4]
call fcn.100d54e8
mov ebx, 0x413ff029
push ebp
or ebx, 0xea71400c
test dword [ebx], ecx
sar ch, 0xe6
dec esp
invalid
or eax, ecx
sub ecx, 0xc4a33a97
xor ebx, edx
bts cx, ax
xadd ecx, eax
inc cl
add edi, edx
movzx edx, cl
rol eax, 0x17
not al
mov dl, byte [ecx + ebp - 0x10b9e2da]
sar al, 0x62
jnp 0x1007967a
lea ebp, [ebp + ecx*2 - 0x2173c5b3]
jnp 0x10037636
push 0xaba7de01
rol dword [esp], 0xcb
and eax, 0xfffffffc
shl word [esp + 2], 0x8e
rol dword [esp], 0xc1
sbb eax, ecx
jmp fcn.10001015
or byte [esp + edx - 0x6a77fffc], dh
dec al
ror edx, 0xea
not edx
xor al, dl
shl dword [esp + 4], 0x86
xor ebx, eax
pop ecx
shr ecx, 0xc
add ebp, eax
jmp fcn.1006eb40
mov eax, 0xdb16f520
add eax, 0xbe964d9c
lea eax, [edi - 0x80]
jno 0x1008fa93
mov eax, 0xb3b97131
movsx ecx, al
mov edx, dword [ebp + ecx*8 - 0x188]
shl ecx, 0x76
ror eax, 7
lea ebp, [ebp + eax - 0x636772de]
imul cx, ax
shl ecx, 0x1b
shl cl, 0x67
xor edx, ebx
ror eax, 0x4b
not edx
or cx, ax
imul eax, ecx
rol eax, 0x2f
rol edx, 2
xadd eax, ecx
sbb edx, 0x9f97b891
xor eax, 0xa8b9631e
not edx
jno 0x10070a65
lea ebp, [ebp + eax*2 - 0x7090cc7e]
xor edx, ebx
rol edx, 1
neg eax
sal al, 0xc3
sbb edx, 0x56b77930
movzx ecx, al
btc eax, 0xa9
jae 0x1004adcd
lea edx, [ecx + ecx*8 + 0x42a09091]
lea eax, [eax + edx - 0x45431612]
shl edx, 0x6e
jp 0x100ad9ce

Function at 0x10018539
Capabilities:
Manually build aes constants

Disassembly:
and eax, eax
mov cl, byte [ebp + eax - 0x7efc2ee4]
call fcn.10088267
Function at 0x1003745c
Capabilities:
Encode data using base64

Disassembly:
not ax
dec byte [esp + edx - 0x5af27bee]
xor bx, ax
lea esi, [edx + esi - 0x5af27bf5]
push edx
add ecx, edx
and dl, ch
mov word [esi + edx - 0x5af27be3], ax
shl dx, 0x8e
xadd word [esp + edx - 0x5af2bfff], cx
pop ecx
pop eax
pop ecx
pop eax
jbe fcn.10060ba4
Function at 0x1005d2a0
Capabilities:
Encode data using base64

Disassembly:
bswap edx
adc cl, ah
rol edx, 3
shl eax, cl
jns 0x100327be
ror eax, 2
bswap eax
push edx
call fcn.100502eb
mov ecx, dword [esi]
mov edx, 0x6938fd1d
push edx
lea esi, [esi + edx - 0x6938fd19]
movsx eax, word [esp + edx - 0x6938fd1d]
btr edx, 0x87
xor ecx, ebx
lea ecx, [ecx + eax - 0x4e7fc7f8]
cwd
sar byte [esp + edx - 0x6938fffe], 0x62
not ecx
mul dword [esp + edx - 0x6938ffff]
sbb word [esp + edx - 0x6938fdeb], ax
jbe 0x1007851c
shl cx, 0x63
xor ebx, edx
bswap ecx
cwde
add edi, edx
movsx edx, ax
bt edx, 0x8b
mov eax, ebp
not edx
lea ebp, [ebp + ecx - 0x402a888a]
or dx, 0x1d1f
mov dword [ebp + ecx - 0x402a8886], eax
ror ecx, 0xf8
movsx eax, dx
jp fcn.1008f0e5
sal dx, 0x2a
js 0x100d4c5e
xor eax, ebx
xor ecx, ecx
neg eax
rol ecx, 0x30
adc dl, dl
sbb eax, 0xa3263901
ror edx, 0xd
xor eax, 0x962d6b19
rol ecx, 0x12
bts edx, edx
btc edx, 0x2e
rol eax, 3
xor ebx, eax
push ecx
add ebp, eax
or dword [esp + edx*2 - 0x8002], ebp
ret
jp 0x10032107
pop ecx
xor edx, ebx
push 0xecbeb03f
dec edx
mov ecx, 0x50959a16
bswap edx
mov eax, ecx
btr ax, 0xad
neg edx
inc edx
lea eax, [ecx + ecx*2 - 0x707f96d7]
neg dword [esp + ecx - 0x50959a16]
dec eax
xor ebx, edx
bt eax, eax
xor eax, ecx
jl 0x1009dcd3
mov ecx, 0xc23b3b8c
lea edx, [ecx + ecx*8 + 0x6927ebad]
lea esi, [esi + edx*2 - 0x7a7a0736]
mov edx, dword [esi + edx*2 - 0x7a7a0732]
mov eax, ecx
lea ecx, [eax*8 - 0x3653b94d]
xor edx, ebx
shl al, 0x66
sar eax, cl
sbb eax, 0x5ea49e1a
inc edx
xor edx, 0xa81cf789
or eax, 0x6a038295
rol al, 0x21
xadd eax, ecx
bswap edx
sbb ax, cx
sbb eax, ecx
sbb edx, 0xe0b1eca1
not cl
bswap eax
bts ecx, eax
xor ebx, edx
sal cl, cl
adc edi, edx
mov edx, 0x1d37f83b
mov edx, dword [ebp + edx*4 - 0x74dfe0ec]
bts eax, eax
mov ecx, dword [ebp + 4]
rol eax, 0xf9
btc eax, 0x92
adc ebp, 3
xor eax, eax
or edx, ecx
or eax, eax
not edx
mov dword [ebp + eax], edx
xor eax, edi
jmp eax
neg ecx
pop edx
ror ecx, 1
lea eax, [eax*2 + 0x54032390]
and eax, 0x291c8fb5
neg ecx
call fcn.10083469
sub edi, 4
mov eax, 0xee0221b6
lea edx, [eax + eax*2 - 0x247660d4]
call fcn.1009cf15
mov ecx, dword [edi]
mov edx, 0xc99d925
btr edx, edx
mov eax, dword [edi + edx*8 - 0x64cec824]
inc edx
shr edx, 0xa3
lea edi, [edi + edx - 0x1933b18]
adc edx, edx
sub edx, edx
btr edx, edx
mov dword ss:[ecx + edx*8], eax
mov eax, edx
shl eax, 0xa3
cdq
xor eax, dword [esi + edx]
movsx ecx, dl
shr dx, 0xa4
imul ecx, ecx
lea esi, [esi + edx + 4]
jae 0x10051d8a
adc ebp, edx
lea esi, [esi + ecx - 0x50959a17]
ror dword [esp + ecx - 0x50959a16], 0x16
movzx ecx, byte [ecx + esi - 0x50959a16]
xadd dword [esp], eax
sbb eax, dword [esp + eax*4 - 0x14fc1134]
sar eax, 0x61
xor cl, bl
movzx edx, al
ror cl, 1
lea eax, [edx*8 + 0x7f288928]
inc cl
dec word [esp + eax - 0x7f288b38]
bt eax, 1
not cl
jb 0x10056644
sbb cl, 0x3d
xor bl, cl
xchg dword [esp + eax - 0x7f288b38], eax
cwde
lea edi, [edx + edi - 0x44]
xor word [esp + edx - 0x40], ax
mov word [edi + edx*2 - 0x84], cx
call fcn.1006a9cb
Function at 0x10070b06
Capabilities:
Encode data using base64

Disassembly:
cmp edi, ecx
ja 0x1007aafe
mov edx, 0x91b1b110
mov ecx, 0x26175a91
sub edx, 0xc127e32c
mov edx, esp
adc ecx, 0x4db123b1
lea ecx, [ecx - 0x73c87de3]
mov eax, 0x710347a1
lea eax, [edi + eax - 0x71034821]
call fcn.1009c1c7
add eax, esp
inc edx
lea ecx, [edx*2 + 0x530e5a1e]
mov cx, word [eax + edx - 0x4ab2e401]
lea ebp, [ebp + edx - 0x4ab2e403]
inc dl
mov word [edx + ebp - 0x4ab2e402], cx
jnp 0x10040260
mov ecx, 0xd523f7a7
mov eax, dword [esi]
neg cl
movzx edx, cx
lea esi, [esi + edx*2 - 0x1eeae]
sal cx, 0xe1
lea edx, [ecx*8 - 0x75658360]
or ecx, ecx
xor eax, ebx
inc dx
sub dx, 0xd4b9
add edx, 0x67054aa1
xor eax, 0x6f1871a3
push edx
sal dx, 0x65
sar cl, 0x21
rol eax, 1
lea eax, [eax + edx - 0x75182e12]
sar ecx, cl
shr dword [esp], cl
ror eax, 1
dec eax
neg eax
and edx, ecx
xor eax, 0xc8932024
ror cx, 0xa1
neg cl
xor ebx, eax
sub edi, 4
add ecx, 0xb5a29137
mov dword [edi], eax
pop ecx
inc ecx
mov ecx, dword [ecx + esi - 0x26af9b]
mov eax, 0xc429a41d
adc esi, 3
xor ecx, ebx
lea ecx, [edx + ecx - 0x718e25ea]
xor ecx, 0x1db1d514
call fcn.1009996c
call fcn.10051dc6
mov edx, 0x2838e191
push edx
xor dword [esp + edx*2 - 0x5071c322], 0xe99643b4
mov ecx, dword [esi + edx - 0x2838e191]
mov eax, dword [edx + esi - 0x2838e18d]
lea esi, [esi + edx - 0x2838e189]
xchg dword [esp + edx - 0x2838e191], edx
adc dword [esp], edx
jb 0x10082bd1
mov dword ss:[ecx], eax
neg edx
movsx ecx, dl
shr dx, 0xef
mov edx, dword [ebp + edx - 0x3e510000]
movsx eax, cl
adc ebp, 3
and word [esp + 2], cx
sar word [esp + 2], 0x4d
xor edx, ebx
ror word [esp], 0x4b
setb cl
rol edx, 2
xor edx, 0xa10a9186
rol dword [esp], 0x16
setae cl
bswap edx
dec edx
ror ecx, 0x45
xor ebx, edx
bts eax, ecx
add edi, edx
mov dword [esp + ecx - 0x7fffff8], edi
ret
shr dl, 0xc7
lea edi, [edi + edx - 0x593dbafe]
bts edx, edx
sal al, cl
mov word [edx + edi - 0x593dbb01], ax
movzx ecx, dl
btc ecx, 0x2c
movsx eax, cl
jmp ebp
lea edx, [ecx + ecx - 0x4cd89067]
or cx, dx
adc esi, 1
rol cx, 0x89
and dl, 2
xor al, bl
btr ecx, 0x3f
adc cl, 0x24
imul edx, ecx
xor al, 0x89
dec al
not cl
dec ecx
not al
inc al
or cl, 0x8d
xor bl, al
jmp 0x10014037
jns fcn.1008f0e5
jmp 0x100115ac
call fcn.10016dda
mov edx, dword [esi]
mov eax, 0xff22a71f
mov ecx, 0x1a0ff7ba
lea esi, [esi + ecx*4 - 0x683fdee4]
xor edx, ebx
ror ecx, cl
ror edx, 2
btr cx, 0xbf
ror al, 7
rol ax, 0x8d
sbb edx, 0xdc2ed6b2
btc eax, eax
ror edx, 2
ror eax, 0xbb
neg edx
shl ecx, cl
btc ecx, 5
btc ecx, ecx
xor ebx, edx
cbw
add ax, cx
bt cx, ax
add edi, edx
sar cl, 0x61
movzx eax, byte [esi]
jbe 0x10030f1b
add eax, 0x4b2d26b4
lea ecx, [ecx + ecx*4 - 0x9e9c6f9]
ror edx, 1
lea edx, [edx + eax*2 + 0x34bd433d]
add eax, 0x4e8823bb
imul cx, cx
or cl, ah
xor ebx, edx
add ebp, edx
and eax, 0xd613b614
and ax, 0x96b5
setne cl
movzx ax, byte [edi]
mov cl, byte [edi + 2]
mov edx, 0x593dbb31
ja 0x10019791
shr dl, cl
movsx ecx, al
not cx
mov word [ebp + eax*2], dx
mov dword [esp + eax], ecx
mov dword [esp + eax*2], edi
ret
jmp 0x100b8bb7
shr eax, cl
push ecx
inc edx
call fcn.1003987f
jmp ebp
Function at 0x100b2a82
Capabilities:
Encode data using base64

Disassembly:
bt ecx, eax
xor edx, 0x41a474bb
lea eax, [ecx + ecx*4 - 0x57f3fc4d]
neg edx
or eax, 0x3f088a09
xor edx, 0x7332421d
or cl, 0xa1
sbb word [esp + eax*2 - 0x7e191771], 0xafb2
setl al
not edx
sar dword [esp + eax*2 - 0x7e191600], cl
bswap edx
xor edx, 0x8228489e
xor al, al
inc ecx
ror edx, 1
btc ax, 0xe
rol ax, cl
xor ebx, edx
add word [esp + eax*2 - 0x7e185802], 0x669c
or ecx, dword [esp + ecx - 0x500000a2]
adc esi, edx
add byte [esp + eax - 0x3f0c2bff], al
movzx edx, cl
mov dword [esp + eax*2 - 0x7e185806], esi
ret 4
jb 0x10067e49
not eax
or cl, dh
sbb eax, 0xe483133b
sar cx, 0x8a
mov dword [esp + ecx - 0x528effff], 0xb2b39e35
jbe 0x1006dab0
xor ecx, ebx
neg ecx
push edx
movzx eax, dx
not ecx
add byte [esp + edx*8 - 0x70f51000], 0x8c
cwde
sar word [esp + edx - 0xe1ea1ff], 0x8b
neg ecx
call fcn.100c3c2b
mov eax, 0x3eaa9620
lea eax, [eax*4 + 0x28aabfb7]
lea ecx, [eax*8 - 0x56e1d2c7]
mov eax, dword [eax + edi - 0x23551837]
sal cx, 0xc7
xor cl, ch
mov cl, byte [edi + 4]
adc edi, 2
mov edx, 0x4408840a
bt edx, edx
shr eax, cl
mov dword [edx + edi - 0x4408840a], eax
jmp 0x10070adf
Function at 0x100c89b9
Capabilities:
Authenticate hmac

Disassembly:
add ax, dx
add edi, ecx
xchg edx, eax
mov ecx, eax
mov edx, dword [ebp + eax - 0x4443d76c]
lea ecx, [ecx*4 - 0x27f43adb]
not cl
imul ecx, ecx
mov eax, dword [ebp + eax - 0x4443d768]
mov cl, byte [ebp + 8]
adc ebp, 5
push 0x5e228388
dec byte [esp + 1]
neg byte [esp]
shld edx, eax, cl
mov dword [ebp], edx
mov ecx, dword [esp]
mov dword [esp + ecx - 0x5e228278], edi
ret
mov edx, dword [esi + eax*8 - 0x550]
add word [esp + eax - 0xaa], cx
ror ecx, 0x9b
bts ax, 0xb5
lea esi, [eax + esi - 0xa6]
or eax, eax
rol cx, 0x68
btc ecx, 5
xor edx, ebx
lea ecx, [eax + 0x4abe431c]
bt cx, 0x3e
lea edx, [eax + edx + 0x5b9428f3]
jb 0x10035d07
mov edx, 0xfa8cb832
mov ecx, 0x5606c9b6
or edx, 0x860eee3a
mov dx, word [edi + ecx - 0x5606c9b6]
add cx, cx
movsx eax, cl
jne 0x10083fdf
sete al
not edx
sal al, 7
ror edx, 1
dec al
bswap edx
rol edx, 2
cwde
xor ebx, edx
sar eax, 0x99
dec eax
adc esi, edx
bswap eax
movsx edx, cx
mov ax, word [ebp + ecx*8 - 0x5bc00]
rol dx, 0xa2
jae 0x1007076c
mov eax, 0x539dd293
movzx ecx, al
jmp 0x10046b97
mov ecx, dword [ecx + esi - 0x93]
lea edx, [eax*8 + 0x6d08682e]
sal eax, 0xca
ror ax, 0x6d
lea esi, [esi + edx - 0x9f6fcc2]
xor ecx, ebx
lea ecx, [ecx + edx*2 - 0x7fefac96]
inc eax
cwde
rol ecx, 3
btc dx, dx
lea ecx, [ecx + eax - 0x6100b1a5]
xchg edx, eax
cbw
inc eax
neg ecx
lea edx, [eax*8 - 0xb7424cc]
rol ecx, 1
bswap ecx
xor ebx, ecx
or eax, eax
jae 0x10013141
movzx edx, byte [ebp]
mov eax, 0x1e80ba24
movsx ecx, al
sal cx, cl
lea ebp, [ebp + ecx*2 - 0x47f]
sbb eax, ecx
call fcn.10018ae6
mov ax, word [ecx + edi - 0x5606936a]
mov cl, byte [edi + ecx - 0x56069368]
call fcn.1004488f
mov eax, dword [ebp + edx - 0x41266435]
lea ecx, [edx*8 - 0x973b6cd]
mov edx, dword [ebp + edx - 0x41266431]
bts ecx, ecx
sal cx, 0xe2
mov dword [esp], 0x533bb883
adc ebp, 7
mov dword ss:[eax], edx
lea edx, [ecx + ecx*4 - 0x20588b72]
movzx eax, dl
jmp 0x1002eb27

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x432002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43200c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401415
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
sub esp, 0x28
and dword [esp + 4], 0
push ebx
push ebp
push esi
mov esi, ecx
mov dword [esp + 0x2c], 0x9e3779b9
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], esi
mov eax, dword [esi]
mov edi, dword [esi + 4]
mov dword [esp + 0x1c], eax
mov eax, dword [0x41a5a0]
mov dword [esp + 0x28], eax
mov eax, dword [0x41a5a4]
mov dword [esp + 0x2c], eax
call fcn.0040140e
mov eax, dword [0x41a5ac]
mov esi, eax
add dword [esp + 0x14], 0x23f
mov ebp, dword [0x41a5a8]
push 0x20
pop ebx
mov dword [esp + 0x20], 2
add dword [esp + 0x20], 3
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
shl eax, 4
add eax, ebp
mov dword [esp + 0x24], 0xedeb2e40
cmp dword [0x65efe4], 0xfa9
mov dword [esp + 0x10], eax
mov eax, dword [0x65efe0]
cmove eax, dword [esp + 0x24]
and dword [esp + 0x24], 0
cmp dword [0x65efe4], 0x3eb
mov dword [0x65efe0], eax
mov eax, dword [0x65ea68]
cmove eax, dword [esp + 0x24]
add ecx, dword [esp + 0x1c]
mov dword [0x65ea68], eax
mov eax, dword [esp + 0x1c]
shr eax, 5
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
add eax, esi
mov dword [0x65efdc], 0xf4ea3dee
xor eax, ecx
xor eax, dword [esp + 0x10]
sub edi, eax
mov dword [esp + 0x18], eax
mov eax, edi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
mov ecx, dword [esp + 0x14]
mov eax, edi
shr eax, 5
add ecx, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
add dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
xor eax, ecx
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
sub dword [esp + 0x14], eax
dec ebx
jne 0x40146b
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], edi
pop edi
mov dword [esi], eax
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x40d4e3
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00404cc5
mov dword [ebp - 0x14], eax
cmp dword [0x431304], esi
jne 0x40d5d6
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d563
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d6b6
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d6b6
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d6b6
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x431304], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x431308], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43130c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431314], eax
test eax, eax
je 0x40d5d3
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x431310], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d5fb
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d5ee
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d610
push 4
pop eax
jmp 0x40d6b8
cmp dword [ebp - 0x14], esi
je 0x40d610
push dword [0x431304]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d5f5
mov eax, dword [0x431310]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d66e
cmp dword [0x431314], edi
je 0x40d66e
push eax
call ebx
push dword [0x431314]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d66e
test eax, eax
je 0x40d66e
call ecx
test eax, eax
je 0x40d663
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d663
test byte [ebp - 8], 1
jne 0x40d66e
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d69e
mov eax, dword [0x431308]
cmp eax, edi
je 0x40d69b
push eax
call ebx
test eax, eax
je 0x40d69b
call eax
mov esi, eax
test esi, esi
je 0x40d69b
mov eax, dword [0x43130c]
cmp eax, edi
je 0x40d69b
push eax
call ebx
test eax, eax
je 0x40d69b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x431304]
call ebx
test eax, eax
je 0x40d6b6
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d6b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f41
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0xe3f628
Capabilities:
Encode data using xor

Disassembly:
cdq
popal
sbb dword [esp + ecx*8], 0x14
and byte [ebx + 0x8eb7437], 0
jmp 0xe3f632
add byte [esi + 4], bh
jmp 0xe3f632
add byte [eax], al
add byte [eax], al
add byte [eax - 0x18], ah
add byte [eax], al
add byte [eax], al
pushal
call 0xe3f638
pop ebp
sub ebp, 0x10
sub ebp, 0xa3f628
jmp 0xe3f64e
mov eax, 0xa3f628
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a1
mov edx, 0xa6f3eb69
mov eax, dword [0xba000005]
imul ebp, ebx, 0x1030a6f3
xor byte [eax], dl
inc eax
dec ecx
jne 0xe3f665
jmp 0xe3f678
loop 0xe3f61e
loop 0xe3f65c
push ebp
imul ebp, dword [ecx + 0x69], 0x6991a8e8
imul ebp, dword [ecx + 0x6a], 0x696dd1a4
imul ebp, dword [ecx - 0x2d], 0x69696941
call 0x6a4d882d
imul ebp, dword [edx - 0x5c], 0x69696dd1
imul edx, ebx, 0x69696941
sahf
mov ebp, dword [edx - 0x5f]
loop 0xe3f680
imul ebp, dword gs:[ecx + 0x69], 0x3939ac6a
add dword [0x169488d], ebx
fnstsw word [eax - 0x15]
imul ebp, dword [eax + 0x45], 0xcaeb014d
pop esi
sbb eax, 0x69696c81
imul eax, dword [eax + 0x6969695f], 0x954d0de4
loopne 0xe3f707
dec ebp
in al, 5
dec ebp
imul esp, edx, 0x696961ec
imul esp, edx, 0x696965fc
imul esp, edx, 0x696979e4
imul ebp, dword [eax + 0x6b586b80], 0x206dabea
in al, dx
popfd
xchg esi, eax
xchg esi, eax
xchg esi, eax
loop 0xe3f72f
dec ebp
in al, 0xd
dec ebp
insd dword es:[edi], dx
stosd dword es:[edi], eax
imul esp, edx, 0x696d4de5
imul ebp, dword [ecx + 1], 0x69488d1d
add ebp, ebx
js 0xe3f6ed
insd dword es:[edi], dx
imul ebp, dword [ecx + 0x69], 0x488d1d01
imul eax, dword [ecx], 0x69eb78dd
push 0x81384d45
insb byte es:[edi], dx
imul ebp, dword [eax + 0x45], 0x6c81384d
sub dword [ecx + ebp*2 + 0x69], 0x6b5a8069
imul ebp, dword [ecx + 0x3c], 0x1c96343d
xchg esi, eax
sbb al, 0x61
or dword [edi], 0xe2696969
aam 0x61
imul ebp, dword [ecx + 0x69], 0x696b5a80
imul edi, dword [edi + 0x651c9634], 0x81611c96
punpckhwd mm5, qword [ecx + 0x69]
loop 0xe3f6f5
popal
imul ebp, dword [ecx + 0x69], 0xbb5aa05a
ljmp 0x27ed
daa
imul ebp, dword [ecx + 0x69], 0x6921e166
imul ebp, dword [ecx + 0xf], 0xe95075e2
xchg edx, eax
and dword [esi - 0x13], 0x69696973
jmp 0xee4a77dd
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x434d2209
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
mov eax, section..rsrc
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x508875f8
nop
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401250
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Ensuring_registry_prerequisites_n
call esi
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftSystemCertificatesTrustedPublisherCertificates
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4012ca
push 0
push 0
lea ecx, [ebp - 4]
push ecx
push 0
push eax
push 0
push 0x3300
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push str.Error_Installing_Certificates..._n
call esi
mov edx, dword [ebp - 4]
push edx
call esi
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 8]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.trustedpublisher
push 0x24000
push 0
push 0
push 9
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
push str.Installing_all_certifcates..._n
mov ebx, eax
call esi
call section..text
push 2
push ebx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x10