joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403def
pop dword [ebp - 0x48]
mov eax, 0x3da85d4
add eax, 0xfc65b81b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x48d61451
sub dword [ebp - 0x58], 0xfa83cf06
mov dword [ebp - 0x54], 0x9663db3d
sub dword [ebp - 0x54], 0x64308ef8
mov dword [ebp - 0x50], 0x98a391c0
add dword [ebp - 0x50], 0xb3a8b26e
mov dword [ebp - 0x4c], 0xd88ef443
sub dword [ebp - 0x4c], 0xd88ef443
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x2c733df2
add dword [ebp - 0x58], 0x47ff2b64
mov dword [ebp - 0x54], 0x2040b593
add dword [ebp - 0x54], 0x212babe2
mov dword [ebp - 0x50], 0x3996590a
add dword [ebp - 0x50], 0x29d91362
mov dword [ebp - 0x4c], 0x70018b53
sub dword [ebp - 0x4c], 0x70018b53
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x7bb31b42
add eax, 0x848e14f6
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3b081
push 0
call eax
mov ecx, 0xa7cf1fbe
sub ecx, 0xa7ced006
mov edx, eax
mov esi, 0x41a400
add esi, dword [ebp - 0x48]
mov ebx, 0xa8c469d7
add dword [ebp - 4], ebx
mov edi, dword [esi]
add dword [ebp - 0x2c], edi
sub edi, ebx
xor dword [ebp - 0x28], edx
mov dword [edx], edi
xor dword [ebp - 0x30], 0x8fec7b5a
add edx, 4
add esi, 0x5f411e3c
sub esi, 0x5f411e38
loop 0x403f00
add eax, 0xbcd20124
sub eax, 0xbcd0cf71
xor ebx, ebx
add ebx, eax
add eax, 0x25bc7acf
add eax, 0xda438536
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret
Function at 0x53a5a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4c0015
lea edi, [esi - 0xbf015]
mov dword [edi + 0x1245c4], 0x1c57070f
push edi
or ebp, 0xffffffff
jmp 0x53a5ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x53a5d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a5c0
mov eax, 1
add ebx, ebx
jne 0x53a5e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x53a5f4
jne 0x53a613
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a613
dec eax
add ebx, ebx
jne 0x53a600
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x53a5d8
add ebx, ebx
jne 0x53a60f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x53a665
xor ecx, ecx
sub eax, 3
jb 0x53a62b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53a69a
sar eax, 1
mov ebp, eax
jmp 0x53a636
add ebx, ebx
jne 0x53a636
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a604
inc ecx
add ebx, ebx
jne 0x53a644
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x53a604
add ebx, ebx
jne 0x53a651
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x53a646
jne 0x53a662
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x53a646
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x53a684
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x53a676
jmp 0x53a5c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x53a684
add edi, ecx
jmp 0x53a5c6
pop esi
mov edi, esi
mov ecx, 0x412b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x53a6a2
cmp byte [edi], 0x13
jne 0x53a6a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x53a6a7
lea edi, [esi + 0x133000]
mov eax, dword [edi]
or eax, eax
je 0x53a716
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13a4ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13a528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x53a6d4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13a530]
or eax, eax
je 0x53a710
mov dword [ebx], eax
add ebx, 4
jmp 0x53a6f1
call dword [esi + 0x13a52c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x53a747
cmp al, 0xef
ja 0x53a73a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x53a71c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x53a729
mov ebp, dword [esi + 0x13a534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x13a7a2]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x53a793
sub esp, 0xffffff80
jmp 0x4013f0
Function at 0x10030620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1003062f
pop dword [ebp - 0x48]
mov eax, 0x1003062f
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x987b150b
sub dword [ebp - 0x58], 0x4a28cfc0
mov dword [ebp - 0x54], 0x79b9d435
add dword [ebp - 0x54], 0xb8797810
mov dword [ebp - 0x50], 0xee1e61cc
sub dword [ebp - 0x50], 0xa1d21d9e
mov dword [ebp - 0x4c], 0x520c8580
sub dword [ebp - 0x4c], 0x520c8580
lea eax, [ebp - 0x58]
push eax
mov eax, 0xfd58ad75
add eax, 0x12ab72bf
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x755cf12a
sub dword [ebp - 0x58], 0xea87d4
mov dword [ebp - 0x54], 0x1e675874
sub dword [ebp - 0x54], 0xdcfaf6ff
mov dword [ebp - 0x50], 0xe24cb7ee
sub dword [ebp - 0x50], 0x7edd4b82
mov dword [ebp - 0x4c], 0x17e47aef
add dword [ebp - 0x4c], 0xe81b8511
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x467ca
push 0
call eax
mov ecx, 0xb22d8809
sub ecx, 0xb22d4297
xor esi, esi
add esi, eax
mov edi, 0xd65ca7bb
add edi, 0x39a8d645
add edi, dword [ebp - 0x48]
mov ebx, 0xb1e888fc
add ebx, 0xb625249f
mov edx, dword [edi]
xor edx, ebx
sub dword [ebp - 0x2c], ebx
mov dword [esi], edx
sub dword [ebp - 0x40], 0x94c9afc1
add esi, 0xde839744
add esi, 0x217c68c0
add edi, 0xddf96207
add edi, 0x22069dfd
loop 0x10030749
add eax, 0x1089b
mov ebx, eax
add eax, 0x46eadf5c
sub eax, 0x46eadf57
mov ecx, 0x10000000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x100346a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100512d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100346d0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x10034700
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x10034700
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100347fa
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10034729
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1003475d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x100347fa
cmp eax, 1
jle 0x100347bb
cmp eax, 3
jne 0x100347fa
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10030620
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x100347d9
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100347fa
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x100347fa
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003af70
mov esp, ebp
pop ebp
ret 4
Function at 0x100396b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100412f8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100512d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1005128c]
cmp eax, 0xffffffff
jne 0x100396e6
xor ebx, ebx
jmp 0x100396ef
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x1003972f
mov eax, dword [ebx + 0x18]
mov esi, dword [ebx + 0xc]
test eax, eax
jne 0x1003976e
test esi, esi
jne 0x10039772
push 0x10038230
push 0x10052ad8
call fcn.10030620
mov eax, dword [0x1005128c]
add esp, 8
cmp eax, 0xffffffff
je 0x1003972f
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x1003975c
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x1003975c
mov eax, dword [ebx]
mov ecx, ebx
push 0
call dword [eax]
push ebx
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100397b4
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [esi]
test ecx, ecx
je 0x1003979d
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [esi]
mov ecx, edi
push 0
mov eax, dword [edi]
call dword [eax]
push edi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
push esi
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x10039772
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10039700
nop
mov esi, dword [ebx + 0x14]
mov esi, dword [esi]
mov ecx, dword [esi + 0x14]
test ecx, ecx
je 0x100397d9
mov edx, dword [esi + 0x1c]
test edx, edx
je 0x100397d9
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push esi
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.10030620
mov eax, dword [ebx + 0x18]
test eax, eax
jne 0x100397c0
jmp 0x10039700
Function at 0x100017c1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push edi
push 0x14
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x1000185c
push str.jvm.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
jne 0x100017f3
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
xor eax, eax
jmp 0x1000185e
push esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.JVM_DTraceGetVersion
push ebx
call esi
push str.JVM_DTraceIsSupported
push ebx
mov dword [edi], eax
call esi
push str.JVM_DTraceActivate
push ebx
mov dword [edi + 4], eax
call esi
push str.JVM_DTraceDispose
push ebx
mov dword [edi + 8], eax
call esi
push str.JVM_DTraceIsProbeEnabled
push ebx
mov dword [edi + 0xc], eax
call esi
push ebx
mov dword [edi + 0x10], eax
call dword [sym.imp.kernel32.dll_FreeLibrary]
xor esi, esi
cmp dword [edi], esi
je 0x10001851
cmp dword [edi + 4], esi
je 0x10001851
cmp dword [edi + 8], esi
je 0x10001851
cmp dword [edi + 0xc], esi
je 0x10001851
cmp dword [edi + 0x10], esi
jne 0x1000185b
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov edi, esi
pop esi
mov eax, edi
pop edi
pop ebx
ret

Function at 0x100022cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100022de
pop dword [ebp - 0x10]
mov eax, 0xa8ffcbdb
add eax, 0x67005703
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x48eace03
add dword [ebp - 0x20], 0x5677748
mov dword [ebp - 0x1c], 0xa5266e6
sub dword [ebp - 0x1c], 0xd81f1aa1
mov dword [ebp - 0x18], 0x2544ea3d
add dword [ebp - 0x18], 0x270759f1
mov dword [ebp - 0x14], 0xecec0321
add dword [ebp - 0x14], 0x1313fcdf
lea eax, [ebp - 0x20]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x98c7358e
add dword [ebp - 0x20], 0xdbab33c8
mov dword [ebp - 0x1c], 0x698492ff
add dword [ebp - 0x1c], 0xd7e7ce76
mov dword [ebp - 0x18], 0x43d063c9
add dword [ebp - 0x18], 0x1f9f08a3
mov dword [ebp - 0x14], 0x686bb77b
sub dword [ebp - 0x14], 0x686bb77b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x80cd7680
sub eax, 0x70cd4678
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x346ae
push 0
call eax
mov ecx, 0x9ab87405
add ecx, 0x6547cbb4
xor ebx, ebx
add ebx, eax
mov esi, 0x6b10ef01
add esi, 0xa4ef72ff
add esi, dword [ebp - 0x10]
mov edi, 0xb6de4dbb
sub edi, 0x359b269b
sub dword [ebp - 0xc], edx
mov edx, dword [esi]
xor dword [ebp - 0xc], ebx
add edx, edi
xor dword [ebp - 8], edx
mov dword [ebx], edx
add dword [ebp - 4], 0xa9ed4091
add ebx, 4
add esi, 0x303f0f41
sub esi, 0x303f0f3d
loop 0x100023fd
add eax, 0x79d2a560
add eax, 0x862e4c57
xor ebx, ebx
add ebx, eax
add eax, 0x5da84f02
sub eax, 0x5da84efd
mov ecx, 0x7a51ff4d
add ecx, 0x95ae00b3
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x401443
pop dword [ebp - 0x40]
mov eax, 0xeb2a66a7
add eax, 0x1515ad9c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xcc4a9cbc
sub dword [ebp - 0x50], 0x7df85771
mov dword [ebp - 0x4c], 0xf8cc79a8
add dword [ebp - 0x4c], 0x3966d29d
mov dword [ebp - 0x48], 0x3c0e95af
sub dword [ebp - 0x48], 0xefc25181
mov dword [ebp - 0x44], 0xee3413bd
add dword [ebp - 0x44], 0x11cbec43
lea eax, [ebp - 0x50]
push eax
mov eax, 0xa06b44d3
add eax, 0x5fd53c31
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xaa29971d
sub dword [ebp - 0x50], 0x35b72dc7
mov dword [ebp - 0x4c], 0xb9ff8897
add dword [ebp - 0x4c], 0x876cd8de
mov dword [ebp - 0x48], 0xf2c6385f
sub dword [ebp - 0x48], 0x8f56cbf3
mov dword [ebp - 0x44], 0xe5501cdb
add dword [ebp - 0x44], 0x1aafe325
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xa14ea057
sub eax, 0xa10e1f57
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c1ca
push 0
call eax
mov ecx, 0x5749
mov esi, eax
mov edi, 0x28dd4230
sub edi, 0x28965e30
add edi, dword [ebp - 0x40]
mov edx, 0xae1687c9
add edx, 0x4311fce2
xor dword [ebp - 0x2c], ecx
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0x69ee8bc9
sub ebx, edx
sub dword [ebp - 0x28], 0xc887f557
mov dword [esi], ebx
xor dword [ebp - 0x3c], edi
add esi, 4
add edi, 0x79acd387
sub edi, 0x79acd383
loop 0x40155f
add eax, 0x14ff7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd109c020
sub ecx, 0xd0c9c020
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x57f790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x122000]
push edi
jmp 0x57f7aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x57f7b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7a0
mov eax, 1
add ebx, ebx
jne 0x57f7c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x57f7d4
jne 0x57f7f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7f3
dec eax
add ebx, ebx
jne 0x57f7e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x57f7b8
add ebx, ebx
jne 0x57f7ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x57f845
xor ecx, ecx
sub eax, 3
jb 0x57f80b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x57f87a
sar eax, 1
mov ebp, eax
jmp 0x57f816
add ebx, ebx
jne 0x57f816
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7e4
inc ecx
add ebx, ebx
jne 0x57f824
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x57f7e4
add ebx, ebx
jne 0x57f831
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x57f826
jne 0x57f842
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x57f826
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x57f864
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x57f856
jmp 0x57f7a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x57f864
add edi, ecx
jmp 0x57f7a6
pop esi
mov edi, esi
mov ecx, 0x40f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x57f882
cmp byte [edi], 0x11
jne 0x57f882
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x57f887
lea edi, [esi + 0x178000]
mov eax, dword [edi]
or eax, eax
je 0x57f8ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x219254]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2193d0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x57f8b4
mov ecx, edi
jns 0x57f8e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2193d4]
or eax, eax
je 0x57f8f9
mov dword [ebx], eax
add ebx, 4
jmp 0x57f8d1
call dword [esi + 0x2193e4]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x57f930
cmp al, 0xef
ja 0x57f923
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x57f905
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x57f912
mov ebp, dword [esi + 0x2193d8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x57f964
sub esp, 0xffffff80
jmp 0x420577
Function at 0x401933
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x42683f
call fcn.004256c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004032ae
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040198c
lea ecx, [esi + 0x30]
call fcn.004032ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405386
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x405512
Capabilities:
Create directory

Disassembly:
mov eax, 0x426bd0
call fcn.004256c0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x405535
mov al, 1
jmp 0x40557b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x405546
xor al, al
jmp 0x40557b
lea ecx, [ebp - 0x44]
call fcn.0040573f
lea ecx, [ebp - 0x1c]
call fcn.004032ae
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040598d
test al, al
je 0x405570
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00403a73
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40597e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40598c
or eax, eax
ret

Function at 0x406d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x406d57
pop dword [ebp - 0x50]
mov eax, 0x406d57
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x37bfa
push 0
mov eax, 0xcb13a8ac
add eax, 0x352ee780
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x42ec
mov edx, eax
mov ebx, 0x436e00
add ebx, dword [ebp - 0x50]
mov edi, 0xdf682054
add edi, 0x3b7f3b65
sub dword [ebp - 0x38], 0x1091b2dc
mov esi, dword [ebx]
mov dword [ebp - 0x4c], 0x2f904f98
sub esi, edi
xor dword [ebp - 0x48], 0xca6a5119
mov dword [edx], esi
xor dword [ebp - 0x24], 0xa660a871
add edx, 4
add ebx, 0x26c77cab
add ebx, 0xd9388359
loop 0x406da5
add eax, 0xfe83
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret