joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da16c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4da3ba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004d8a2c
xor eax, eax
push ebp
push 0x4da390
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d902c
test al, al
je 0x4da374
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00409d7c
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4da374
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040a814
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d898c
test al, al
je 0x4da368
mov eax, dword [ebp - 4]
call fcn.0040a814
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040a87c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d9a84
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4da368
xor eax, eax
push ebp
push 0x4da361
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004d8a2c
xor eax, eax
push ebp
push 0x4da343
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040a814
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040a87c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d8a30
mov eax, dword [ebp - 4]
call fcn.0040a814
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040a87c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d9a84
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4da320
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004da034
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004da16c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da327
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4da1f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da397
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004d8a2c
ret
Function at 0x4e0d20
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4e0d26
ret
Function at 0x4eaf4c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x531790
test edx, edx
jne 0x4eaf6b
xor eax, eax
jmp 0x4eb089
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x4eaf88
push esi
push edx
push eax
call fcn.004eb090
add esp, 0xc
jmp 0x4eb089
push esi
push edx
push eax
call fcn.004eb350
add esp, 0xc
jmp 0x4eb089
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x403ccd
Capabilities:
Accept command line arguments

Disassembly:
push 0x38
mov eax, 0x42aa1f
call fcn.00406cb3
mov edi, ecx
mov dword [ebp - 0x40], edi
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
xor ebx, ebx
mov dword [ebp - 0x44], eax
push eax
mov dword [ebp - 0x38], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 4], ebx
mov ecx, edi
mov esi, dword [edi]
push dword [esi + 4]
call fcn.004040b2
mov ecx, dword [edi]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ecx + 4], esi
mov eax, dword [edi]
mov dword [eax], esi
mov eax, dword [edi]
mov dword [eax + 8], esi
mov esi, ebx
mov dword [edi + 4], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 1
cmp dword [ebp - 0x38], ebx
jle 0x403d7f
mov edi, ebx
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
push dword [eax + ebx*4]
call fcn.0040270e
mov byte [ebp - 4], 2
lea eax, [ebp - 0x28]
push eax
cmp edi, esi
je 0x403d5b
mov ecx, esi
call fcn.00402530
push 0x18
pop eax
add esi, eax
mov dword [ebp - 0x30], esi
jmp 0x403d6a
push esi
lea ecx, [ebp - 0x34]
call fcn.00402a92
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.00402733
inc ebx
cmp ebx, dword [ebp - 0x38]
jl 0x403d30
mov edi, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, edi
call fcn.004037f2
cmp dword [edi + 4], 0
jbe 0x403da1
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x403da1
push eax
lea ecx, [edi + 8]
call fcn.004026e7
mov edi, dword [ebp - 0x34]
test edi, edi
je 0x403dda
mov esi, edi
cmp esi, dword [ebp - 0x30]
je 0x403dc3
push 0x18
pop edi
mov ecx, esi
call fcn.00402733
add esi, edi
cmp esi, dword [ebp - 0x30]
jne 0x403db2
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
sub eax, edi
push 0x18
pop ecx
cdq
idiv ecx
imul eax, eax, 0x18
push eax
push edi
call fcn.00402030
pop ecx
pop ecx
call fcn.00406c6e
ret 4

Function at 0x404fd6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x44206c]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push 0x43ac70
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40504d
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x40504d
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004062bb
leave
ret

Function at 0x407e8f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x63d1fe
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
jmp 0x63d208
jle 0x63d287
mov dx, word [esp]
jmp 0x670840
mov edi, ebp
lea edx, [edi*4]
jmp 0x6708ea
pop edi
mov bx, 0x1e79
jmp 0x670f5e
lea ecx, [eax - 1]
inc dl
xchg bl, dl
add dx, 0x391d
jmp 0x67086e
push edi
mov edi, ebp
add edi, 0xfffffffc
mov dword [edi], ecx
jmp 0x67087f
pop edi
mov edx, dword [esp]
mov ecx, 0xff
jmp 0x63d268
lea ebx, [esi + esi]
pop esi
call fcn.00670f84
xor dh, byte [edi + 0xab14227]
sub byte [eax + 0x6ca8593e], ch
inc ebp
hlt

Function at 0x658b2b
Capabilities:
Check for trap flag exception

Disassembly:
jmp 0x63f53f
pushfd
or dword [esp], reloc.WINMM.dll_midiStreamOut
popfd
rdtsc
nop
jmp 0x63f556
ret
push di
lea esp, [esp + 2]
pushfd
lea esp, [esp + 4]
jmp 0x63f534

Function at 0x670533
Capabilities:
Encrypt data using aes

Disassembly:
lea eax, reloc.WINMM.dll_midiStreamOut
lea ecx, [ecx + esi]
clc
jmp 0x67039a
mov eax, edi
mov cx, 0x1622
sub esp, 0x17
mov byte [esp + 8], bh
xchg di, dx
jmp 0x6703d2
add esi, 0xc
mov edx, dword [esi]
pop esi
sub esp, 4
xchg cx, di
bsf cx, ax
jmp 0x670417
lea esp, [esp + 3]
push esi
mov esi, eax
jmp 0x6703bc
lea esp, [esp + 2]
lea esp, [esp + 2]
mov ecx, edx
shr ecx, 8
jmp 0x6703fa
xor ecx, edi
mov edi, ebp
bswap edi
jmp 0x670518
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
shr edi, 0x18
movzx edi, byte [edi*4 + 0x647d9c]
jmp 0x6704ee
and edx, ebp
xor ecx, edx
mov edx, 0x43d87700
jmp 0x670541
mov byte [esp + 2], ch
pop word [esp]
lea esp, [esp + 2]
jmp 0x670504
lea esp, [esp + 0x20]
xor ecx, dword [ebx]
lea edi, [eax + 0x10]
mov dx, cx
jmp 0x670553
mov dx, word [esp]
rcl dx, 5
jmp 0x6705e9
push ebp
mov ebp, eax
add ebp, 4
jmp 0x67058f
add al, 0xdc
das
and dword ss:[ebx + reloc.WINMM.dll_midiStreamOut], ecx
rol dword [ecx - 0x15], 1
sub dword [ebx + reloc.WINMM.dll_midiStreamOut], eax
mov edx, dword [ebp]
pop ebp
xor edx, ecx
inc ecx
jmp 0x6705c1
add ebx, 8
mov ecx, dword [ebx]
pop ebx
cmc
call 0x6705c9
outsd dx, dword [esi]
loop 0x670617
pop ss
loop 0x6705fd
mov dword [reloc.WINMM.dll_midiStreamOut], eax
lea esp, [esp + 0xc]
add ebx, 4
rol dx, 0xa
mov dword [edi], ecx
not dx
jmp 0x670583
mov dword [eax + 0x14], edx
push ebx
mov ebx, eax
jmp 0x670598
xor ecx, edx
jmp 0x6705d1
bsf edx, esp
jmp 0x6706f5
xor ecx, dword [eax]
sub esp, 0x10
pop dword [esp + 7]
xchg byte [esp + 9], dh
jmp 0x6705af
add byte [eax], al
loop 0x670673
loopne 0x67058a
jb 0x6705c5
loopne 0x67067e
out 0x82, eax
jno 0x6705c9
ljmp 0x81e7:0xeb51b405
jmp 0x670635
jne 0x63cbf9
mov bp, 0xcae4
not ebp
lea eax, [eax + ecx]
jmp 0x670659
push 0xa
setnp al
mov eax, dword [esp]
jmp 0x6706a7
lea esp, [esp + 8]
pop esi
lea ebx, [ebp - 0xb9]
jmp 0x67068c
cmpsb byte [esi], byte es:[edi]
push ebp
xchg edi, eax
dec edi
aam 0x4a
sub eax, 0x80c16cdc
inc ebx
cli
aad 0x83
ror dword [ebx + ecx*4], 0x11
pop ecx
call fcn.00670654
pop ebp
pop ebx
ret
mov edi, dword [esp + 4]
xchg esi, ebp
bswap ebx
mov esi, 0x7ef412bd
bswap ebp
jmp 0x670663
mov dword [eax + 0x18], ecx
bsf dx, bp
call 0x67060e
Function at 0x670654
Capabilities:
Encrypt data using aes

Disassembly:
cmp ebx, 0x6495c4
xor edx, ecx
sub esp, 0
mov dword [eax + 0x1c], edx
lea esp, [esp + 0x20]
jmp 0x670611
sub esp, 0x14
jmp 0x670627

Function at 0x670862
Capabilities:
Encrypt data using aes

Disassembly:
mov eax, dword [ebp - 8]
jmp 0x63d1f5
lea esp, [esp + 4]
jl 0x63d231
jge 0x670838

Function at 0x67099b
Capabilities:
Encrypt data using aes

Disassembly:
mov edx, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
cmc
jmp 0x6709b9
lea esp, [esp + 3]
and edx, ecx
jmp 0x670985
add esp, 0x1a
mov dx, word [esp]
lea esp, [esp + 2]
jmp 0x6709c9
and edx, ecx
lea esp, [esp + 0x20]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x6709a3
mov edx, dword [esi + 4]
sub esp, 3
lea esp, [esp + 3]
jmp 0x670a06
mov dword [esi], edi
shl edi, 0x10
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov edi, ecx
jmp 0x6709f0

Function at 0x670b26
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp + 3]
lea esp, [esp + 2]
jmp 0x670b77
xchg dword [esp], esi
mov dword [esp + 0xc], ebx
lea esp, [esp + 4]
popal
lea ebp, [ebp*4]
jmp 0x670b98
push ebp
pushal
rcl ah, cl
pushfd
jmp 0x670b53
lea esp, [esp + 4]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
setno bl
bsf bx, sp
jmp 0x670c49
lea ebp, reloc.WINMM.dll_midiStreamOut
mov ebx, dword [ebp]
pop ebp
cmc
and ebx, ecx
jmp 0x670b7e
pop eax
push sp
lea esp, [esp + 2]
jmp 0x670c0d
mov eax, edx
lea eax, [eax*4]
lea eax, reloc.WINMM.dll_midiStreamOut
mov edx, dword [eax]
jmp 0x670ba7
add eax, 4
mov dword [eax], edi
pop eax
rol di, 0xa
mov edi, esp
jmp 0x670bef
mov edx, dword [esi + 8]
pushal
push eax
mov eax, esi
jmp 0x670bd0
mov di, 0x835
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
lea edi, [ecx*4]
jmp 0x670c2f
and edx, ecx
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushfd
jmp 0x670be6
mov edi, edx
call fcn.00670c19
std
insd dword es:[edi], dx
hlt
movzx ebx, byte [esi + 9]
and edx, ecx
push eax
jmp 0x670bbd

Function at 0x670c19
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
pop word [esp]
lea esp, [esp + 2]
jmp 0x670c55
shr edi, 0x18
push ecx
mov ecx, edi
jmp 0x670c98
pop dword [esp + 6]
lea esp, [esp + 2]
jmp 0x670c82
cmpsd dword [esi], dword es:[edi]
push edx
jecxz 0x670cc7
retf 0x5488
and edi, ecx
call fcn.00670cad
js 0x670c70
jne 0x670ca9
out dx, eax
pop esp
mov dl, byte [esi]
test bl, ah
push ds
fiadd dword [edi]
scasb al, byte es:[edi]
mov ecx, 0x8d0c8d
add byte [eax], al
add byte [ebp + 0x647d9c89], cl
add byte [ebx - 0x137ca6c7], cl
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ecx]
pop ecx
sub esp, 0x16
in al, dx
push ss
jmp 0x670c5d
dec ebp
fsubr qword [edi]
Function at 0x670cad
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, edi
jmp 0x670eb7
lea ebp, [ebp*4]
lea ebp, reloc.WINMM.dll_midiStreamOut
mov edi, dword [ebp]
pop ebp
call fcn.00670d82
lea esp, [esp + 0x24]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
pushal
jmp 0x670f50
pop ebp
jmp 0x670f74
push ebp
mov ebp, esi
lea ebp, [ebp + 0xc]
mov dword [ebp], edi
jmp 0x670f1a
lea esp, [esp + 0x20]
dec dword [ebp - 4]
push edi
mov byte [esp + 2], dh
jmp 0x670f30
lea esp, [esp + 4]
jne 0x63d268
je 0x63d287

Function at 0x670d57
Capabilities:
Encrypt data using aes

Disassembly:
pop word [esp]
mov byte [esp], al
lea esp, [esp + 2]
jmp 0x670e40
lea ecx, [ecx*4]
lea ecx, reloc.WINMM.dll_midiStreamOut
mov edx, dword [ecx]
pop ecx
jmp 0x670da1
lea esp, [esp + 8]
xor edi, dword [edx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x670def
and edx, ecx
sub esp, 0xb
cmc
lea esp, [esp + 3]
jmp 0x670d8b
mov edi, edx
call int.00670dd7
scasb al, byte es:[edi]
sub edi, dword [ebx - reloc.WINMM.dll_midiStreamOut]
dec esp
ret 0x54a5
lea edi, [ebp + 0x50]
bts di, di
mov ebx, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
mov di, word [esp]
jmp 0x670dad
mov edx, dword [esi + 0xc]
mov dword [esi + 8], edi
mov di, si
mov di, word [esp]
jmp 0x670dc3
and edx, ecx
push ecx
mov ecx, edx
jmp 0x670d67

Function at 0x670f0d
Capabilities:
Encrypt data using aes

Disassembly:
and edx, ecx
sub esp, 8
pop word [esp + 1]
sub esp, 0x1d
push word [esp + 0x21]
lea esp, [esp + 1]
jmp 0x670ecd
lea esp, [esp + 0xc]
xor edi, dword [ebx*4 + reloc.WINMM.dll_midiStreamOut]
jmp 0x670ee3
Function at 0x74fc88
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x12
xchg dword [esp], ebp
pop dword [esp + 1]
lea eax, [esi + ebp]
mov word [esp + 0xc], di
jmp 0x74fcab

Function at 0x74fd3e
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop edx
lea ebp, [edx + esi]
lea edi, reloc.WINMM.dll_midiStreamOut
pop word [esp + 0xe]
jmp 0x74fd60

Function at 0x75023d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 0x1a]
mov bh, byte [esp + 0x1d]
pop edi
lea edi, [edx*4]
jmp 0x750134
mov bl, 0x56
setbe ch
xchg byte [esp + 6], ch
not ecx
sets cl
lea eax, [eax + ebx]
jmp 0x7500df
dec ax
mov byte [esp + 0x1e], ah
lea ecx, [edi + ebp]
mov cl, 0x9b
pop word [esp + 4]
mov bp, cx
jmp 0x750163
ror al, cl
bswap esi
mov edi, edx
mov dh, byte [esp + 0x1f]
mov ebp, ecx
cmp ecx, edi
jmp 0x75014c
lea ecx, reloc.WINMM.dll_midiStreamOut
pop edi
rdtsc
mov ax, word [esp + 0x1e]
sbb edi, 0xa4e5be33
cpuid
jmp 0x750108
inc bh
mov ah, dl
not bl
sbb bh, 0x84
mov byte [esp + 0x20], ch
cpuid
jmp 0x750173
pop ebp
stc
mov ax, sp
sub esp, 0xb
mov ecx, dword [esp + 9]
rdtsc
jmp 0x75011d
mov edi, eax
popal
mov ecx, dword [esp + 1]
lea esp, [esp + 3]
push word [esp + 2]
add esp, 3
jmp 0x7501bd
not dx
bsr edi, edx
mov dword [esp + 0x2c], ecx
pop dword [esp + 0x1a]
xchg si, ax
add esp, 4
jmp 0x7500f5
rdtsc
xchg cl, al
lea edx, [eax + edx]
call fcn.007501a7
mov ecx, dword [esp + 0x13]
bswap esi
push edi
xchg byte [esp + 0x1d], cl
mov word [esp + 0x1c], si
cld
jmp 0x75018f
rdtsc
xchg dword [esp + 0x21], ebp
jmp 0x75020c

Function at 0x750245
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp], edx
pop ebp
jmp 0x7502e1
lea ebp, [ebx*4]

Function at 0x754d76
Capabilities:
Packed with generic packer
Parse pe header

Disassembly:
mov dword [esp + 0x1c], esi
pushal
mov dword [esp + 0x11], ebp
lea esp, [esp + 0x17]
jmp 0x754dc2
mov dword [esp + 7], edi
mov byte [esp + 0xe], ch
mov dword [esp + 0x24], esp
mov dword [esp + 0x20], ebp
jmp 0x754d60
lea esp, [esp + 1]
mov dword [esp + 0x20], edi
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x695d64ed
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
mov ecx, 0x46536e05
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x84b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0084b1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x84b07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84b06a
add dl, dl
jne 0x84b089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84b0dc
xor eax, eax
add dl, dl
jne 0x84b096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x84b17d
add dl, dl
jne 0x84b0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x84b0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x84b0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x84b0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x84b0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x84b075
mov eax, 1
add dl, dl
jne 0x84b0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x84b0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x84b0e1
sub eax, ebx
mov ebx, 1
jne 0x84b128
mov ecx, 1
add dl, dl
jne 0x84b10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84b119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x84b105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x84b075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x84b13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x84b14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x84b136
cmp eax, 0x7d00
jae 0x84b16d
cmp eax, 0x500
jb 0x84b168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x84b075
cmp eax, 0x7f
ja 0x84b170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x84b075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x84b19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x84b075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x42211b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42215a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42215a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42215a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42215a
cmp dword [ecx + 0x74], 0xe
jbe 0x42215a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4d6d5570
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x633e426c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x64055310
Capabilities:
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, ebx
push esi
push edi
call sym.Qt5Network.dll_public:_enum_QNetworkConfiguration::Purpose___thiscall_QNetworkConfiguration::purpose_void_
mov esi, eax
mov ecx, ebx
shl esi, 8
call sym.Qt5Network.dll_public:_enum_QNetworkConfiguration::BearerType___thiscall_QNetworkConfiguration::bearerType_void_
mov edi, eax
mov ecx, ebx
or edi, esi
shl edi, 8
call sym.Qt5Network.dll_public:_enum_QNetworkConfiguration::Type___thiscall_QNetworkConfiguration::type_void_
mov ebx, eax
or ebx, edi
movzx ecx, bl
mov eax, ebx
xor ecx, 0x811c9dc5
shr eax, 0x10
imul edx, ecx, 0x1000193
mov ecx, ebx
shr ecx, 8
movzx ecx, cl
movzx eax, al
shr ebx, 0x18
xor edx, ecx
imul ecx, edx, 0x1000193
pop edi
pop esi
xor ecx, eax
imul eax, ecx, 0x1000193
xor eax, ebx
imul eax, eax, 0x1000193
pop ebx
ret 4
Function at 0x64068710
Capabilities:
Get networking parameters

Disassembly:
sub esp, 0x258
mov eax, dword [0x640f0ebc]
xor eax, esp
mov dword [esp + 0x254], eax
push esi
push edi
mov edi, dword [esp + 0x264]
lea eax, [esp + 8]
push eax
lea esi, [esp + 0x18]
mov dword [esp + 0xc], 0x248
mov eax, esi
push eax
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
cmp eax, 0x6f
jne 0x64068783
push dword [esp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x64068779
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
test eax, eax
je 0x64068783
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
mov ecx, edi
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
jmp 0x640687dc
push 0xffffffffffffffff
lea eax, [esi + 0x84]
push eax
lea ecx, [esp + 0x14]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::constructor_char_const___int_]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QUrl::fromAce_class_QByteArray_const__]
add esp, 8
lea ecx, [esp + 0xc]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
lea eax, [esp + 0x14]
cmp esi, eax
je 0x640687c5
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
lea eax, [esp + 0x10]
mov ecx, edi
push eax
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString__]
lea ecx, [esp + 0x10]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [esp + 0x25c]
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.640ae828
add esp, 0x258
ret