joyce8/EMBER2024-capa huggingface dataset:
Function at 0x689a6369
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x69326018]
movzx eax, word [eax + 0x14]
movzx eax, ax
mov edx, dword [0x69326018]
add eax, edx
add eax, 0x18
mov dword [ebp - 0xc], eax
jmp 0x689a646d
jmp 0x689a6551
jmp 0x689a6635
jmp 0x689a6719
jmp 0x689a67fd
jmp 0x689a68e1
jmp 0x689a69c5
jmp 0x689a6aa9
jmp 0x689a6b8d
jmp 0x689a6c71
jmp 0x689a6d55
jmp 0x689a6e39
jmp 0x689a6f1d
jmp 0x689a7001
jmp 0x689a70e5
jmp 0x689a71c9
jmp 0x689a72ad
jmp 0x689a7391
jmp 0x689a7475
jmp 0x689a7559
jmp 0x689a763d
jmp 0x689a7721
jmp 0x689a7805
jmp 0x689a78e9
jmp 0x689a79cd
jmp 0x689a7ab1
jmp 0x689a7b95
mov dword [ebp - 0x14], 0
jmp 0x689a7c80
jmp 0x689a7d64
jmp 0x689a7e48
jmp 0x689a7f2c
jmp 0x689a8010
jmp 0x689a80f4
jmp 0x689a81d8
jmp 0x689a82bc
jmp 0x689a83a0
jmp 0x689a8484
jmp 0x689a8568
jmp 0x689a864c
jmp 0x689a8730
jmp 0x689a8814
jmp 0x689a88f8
jmp 0x689a89dc
jmp 0x689a8ac0
jmp 0x689a8ba4
jmp 0x689a8c88
jmp 0x689a8d6c
jmp 0x689a8e50
jmp 0x689a8f34
jmp 0x689a9018
jmp 0x689a90fc
jmp 0x689a91e0
jmp 0x689a92c4
jmp 0x689a93a8
mov dword [ebp - 0x18], 0
jmp 0x689a9493
jmp 0x689a9577
jmp 0x689a965b
jmp 0x689a973f
jmp 0x689a9823
jmp 0x689a9907
jmp 0x689a99eb
jmp 0x689a9acf
jmp 0x689a9bb3
jmp 0x689a9c97
jmp 0x689a9d7b
jmp 0x689a9e5f
jmp 0x689a9f43
jmp 0x689aa027
jmp 0x689aa10b
jmp 0x689aa1ef
jmp 0x689aa2d3
jmp 0x689aa3b7
jmp 0x689aa49b
jmp 0x689aa57f
jmp 0x689aa663
jmp 0x689aa747
jmp 0x689aa82b
jmp 0x689aa90f
jmp 0x689aa9f3
jmp 0x689aaad7
jmp 0x689aabbb
mov dword [ebp - 0x10], 0
jmp 0x689aaca6
jmp 0x689aad8a
jmp 0x689aae6e
jmp 0x689aaf52
jmp 0x689ab036
jmp 0x689ab11a
jmp 0x689ab1fe
jmp 0x689ab2e2
jmp 0x689ab3c6
jmp 0x689ab4aa
jmp 0x689ab58e
jmp 0x689ab672
jmp 0x689ab756
jmp 0x689ab83a
jmp 0x689ab91e
jmp 0x689aba02
jmp 0x689abae6
jmp 0x689abbca
jmp 0x689abcae
jmp 0x689abd92
jmp 0x689abe76
jmp 0x689abf5a
jmp 0x689ac03e
jmp 0x689ac122
jmp 0x689ac206
jmp 0x689ac2ea
jmp 0x689ac3ce
mov dword [ebp - 0x10], 0
jmp 0x689b3c5e
jmp 0x689ac4be
jmp 0x689ac5a2
jmp 0x689ac686
jmp 0x689ac76a
jmp 0x689ac84e
jmp 0x689ac932
jmp 0x689aca16
jmp 0x689acafa
jmp 0x689acbde
jmp 0x689accc2
jmp 0x689acda6
jmp 0x689ace8a
jmp 0x689acf6e
jmp 0x689ad052
jmp 0x689ad136
jmp 0x689ad21a
jmp 0x689ad2fe
jmp 0x689ad3e2
jmp fcn.689ad4c6
mov eax, dword [0x69326018]
movzx eax, word [eax + 6]
movzx eax, ax
cmp eax, dword [ebp - 0x10]
ja 0x689ac3da
nop
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x1d6c760b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x285d700b
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x4014f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov byte [esp + 0x68], al
mov byte [esp + 0x69], al
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov byte [esp + 0x5c], al
mov byte [esp + 0x5d], al
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov byte [esp + 0x50], al
mov byte [esp + 0x51], al
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov byte [esp + 0x80], al
mov byte [esp + 0x81], al
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
mov byte [esp + 0x45], al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov byte [esp + 0x74], al
mov byte [esp + 0x75], al
mov dword [esp + 0x14], eax

Function at 0x4014f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x74
xor eax, eax
push ebx
push ebp
push esi
push edi
mov ebp, 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov byte [esp + 0x68], al
mov byte [esp + 0x69], al
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov byte [esp + 0x5c], al
mov byte [esp + 0x5d], al
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov byte [esp + 0x50], al
mov byte [esp + 0x51], al
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov byte [esp + 0x80], al
mov byte [esp + 0x81], al
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov byte [esp + 0x44], al
mov byte [esp + 0x45], al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov byte [esp + 0x74], al
mov byte [esp + 0x75], al
mov dword [esp + 0x14], eax
Function at 0x402dd0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x28
or eax, 0xffffffff
mov word [esp + 0x10], ax
push ebp
xor ecx, ecx
mov eax, 0x65
xor ebp, ebp
mov dword [esp + 0x20], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [esp + 0x24], ebp
neg ecx
or ecx, eax
push ecx
call fcn.0041171a
add esp, 4
xor ecx, ecx
push 4
add al, 0x89
inc esp
and al, 0x24
mov word [eax], cx
call fcn.0041171a
add esp, 4
test eax, eax
je 0x42b3f4
mov dword [eax], 1
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x3c]
cmp dword [edx + 8], ebp
jbe 0x402e63
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402e5d
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x402f2d
push esi
call fcn.004112ef
mov eax, dword [esp + 0x40]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x402e38
mov edx, dword [esp + 0x3c]
mov dword [edx + 8], ebp
cmp word [ebx], bp
je 0x40306f
jmp 0x402e80
cmp ax, 0x30
jl 0x402e50
mov ecx, dword [esi]
test ecx, ecx
je 0x402e50
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [esp + 0x10], ecx
cmp dword [edx], ebp
je 0x42b3fd
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004112ef
add esp, 4
jmp 0x402e50
je 0x38e73e2
test dword [eax], eax
add byte [esp + esi*2], al

Function at 0x409a40
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd4
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebx + 4]
push esi
push edi
mov edi, eax
mov eax, dword [edi]
mov edx, dword [ecx + eax*4]
mov eax, dword [edx]
mov esi, dword [eax]
push esi
call fcn.004112d5
add esp, 4
mov dword [esp + 0x34], eax
add eax, 1
je 0x42cec9
add eax, 7
std
invalid

Function at 0x40ab50
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x84
push ebx
push esi
push edi
mov ebx, 1
xor edi, edi
mov dword [esp + 0x24], ecx
test byte [0x4a9398], bl
je 0x40b26c
mov esi, dword [ebp + 0x10]
push 8
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
jl 0x40abaf
sbb al, 0x89
jl 0x40abb3
and byte [eax - 0x39dbdba4], cl
inc esp
and al, 0x25
add al, ch
jl 0x40ac07
add byte [eax], al
or dword [0x4a9398], ebx
push 0x429292
mov dword [0x4a9388], edi
mov dword [0x4a9390], ebx
mov dword [0x4a9394], edi
call fcn.00411421
add esp, 4
jmp 0x40ab76

Function at 0x40e740
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp eax, 2
je 0x4293d2
push ecx
push esi
push edx
push edi
push 1
test eax, eax
jne 0x42942f
push 0x400
call dword [0x48220c]
adc eax, 0x48220c
test eax, eax
je 0x429439
pop edi
add eax, 0xfffffffe
pop esi
ret 8
loopne 0x4293d8
jmp fcn.0040f547
dec dword [edi]
inc eax
or byte [ebx + 0x418b1048], cl
adc bl, al
push ebx
ret 0x7508
Function at 0x40e7e0
Capabilities:
Hash data with md5

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, 5
cmp dword [edi + 8], ebx
je 0x42b34a
call fcn.0040e8f0
test esi, esi
je 0x40e833
cmp dword [edi + 8], ebx
jne 0x42b354
mov eax, dword [edi]
mov dword [eax + 0x210], 0
or byte [ebp + 0x6a4446], cl
inc edi
mov eax, dword [0x8b00ecfe]
add al, 0x89
inc edi
add al, 0x33
shr cl, 0x46
inc ebx
invalid
xor eax, eax
jmp 0x40f6a1

Function at 0x40f450
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00425210
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x492380]
mov dl, byte [eax + 0x492378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x40f460
lea eax, [esp]
push 0x4876e8
push eax
call fcn.00413990
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00410f70
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x40f4b0

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret
Function at 0x46707f
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x18
ja 0x467088
mov dword [edi], eax
and byte [ebx + 0x56550843], cl
inc ebx
or byte [ebp + 0x56], dl
push edi
cmp eax, 0xb
cmp ecx, 0xfffffff3
add byte [eax + 0x54], dl
dec eax
cmp eax, 9
ja 0x559971d9
xlatb
and al, 0x85
mov edx, 0x8b004671
jae 0x4670b6
push 0
push esi
call fcn.00438a52
sbb al, ch
xor byte [ebp + 0x48], dh
jne 0x467100
push 1
push esi
call fcn.00438a52
sbb al, ch
js 0x467139
push cs
push 1
push esi
call fcn.00438a52
sbb al, ch
pop eax
jne 0x467100
mov edi, dword [esi + 4]
sub edi, 2
sar edi, 1
push edi
call 0x86411753
push ecx
call 0xc0c976f8
add al, 0x55
push eax
call 0x51435df9
add al, cl
loope 0x4670f1
shl ecx, 0xfd
xor esi, dword [ebp + 0x71]
push ebp
call 0x1411328
mov dword [esi], eax
mov ecx, dword [ebx - 0x7afb82]
add byte [ecx + 0x7e8b8b06], cl
add al, 0x85
dec dword [edi]
test al, dl
adc eax, 0xe857548d
inc edx
cmpsb byte [esi], byte es:[edi]
cli
add byte [ecx - 0x177474fa], cl
push edi
je 0x467129
mov edi, dword [esi + 4]
test edi, edi
je 0x54d386db
push edi
call 0x1411753
mov dword [esi], eax
mov ecx, dword [ebx + 0x107457e8]
xor al, 0x1c
push eax
call fcn.0044349f
adc al, 0xff
call [eax]
push ecx
push esi
call 0x5c45f020
jle 0x46712a
call [ebx + 0x10]
sub al, 6
pop ebx
adc byte [esi + eax], ch
sbb byte [edi + 0x52], dl
push ebp
call 0x51410fa9
add al, cl
loope 0x4670fc
shl ecx, 0xc0
sub byte [ecx + 0x18], dl
call 0x4d401369
jmp 0x467168
push edi
call 0x4d411753
cli
sub eax, 0x8b187c89
call 0x452ec6b3
sahf
cli
push eax
add al, cl
adc byte [edx + 8], ch
push 8
call 0x4d411753
mov dword [ebx], eax
mov dword [eax], edi
mov edx, dword [ebx]
mov dword [esi], eax
mov ecx, dword [ebx + 0x46a89f3]
call 0x16404209
adc eax, dword [ebx + 0x4c]
or eax, dword [eax]
or edi, esp
push edi
sub eax, 0x12
adc byte [ebx + 0xd18c483], al
rcl byte [edi - 0x75], 0xb
mov edx, dword [ebx + 4]
mov edi, 0x510c744c
dec dword [ebx + 0x40241024]
push ecx
adc al, 0xeb
test al, 0xdd
add edi, dword [edi + 0x510c744c]
fstp qword [esp + 0x10]
jmp 0x467151

Function at 0x47220c
Capabilities:
Encode data using xor

Disassembly:
adc ecx, dword [ebx + 0xbd5074c]
cld
call 0x336b5575
cmp dword [eax + 0x8c214], eax
push ebx
push 0xc4a83d8
call 0x15469cd3
push edi
mov ebx, esi
call fcn.00409249
mov al, byte [edi + 0x10]
mov byte [esi + 0x10], al
mov ecx, dword [edi + 0x14]
mov dword [esi + 0x14], ecx
mov dl, byte [edi + 0x18]
lea eax, [edi + 0x20]
push eax
lea ebx, [esi + 0x20]
mov byte [esi + 0x18], dl
call fcn.00409249
Function at 0x4781e7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
dec ebp
dec esp
in al, dx
xor byte [ebp + 0x4c], cl
sub byte [eax], bh
ja 0x4781e8
mov esi, dword [ebp + 2]
cmp al, 0x33
fist dword [esi + 0x50]
add byte [eax + ecx*2 + 0x245c8957], al
adc bh, al
and al, 0x89
sbb al, ch
aad 0xb
cld
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a7cc1], bl
je 0xacc837f
mov eax, dword [0x4a7cc4]
cmp eax, ebx
je 0x5047837f
mov edx, 0xfc0bd503
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x54500098], dx
call dword [0x74482304]
mov edx, dword [0x4a7cc4]
mov dword [edx - 0x3f42a60], eax
mov eax, 0xfc0bd503
mov word [edx - 0x367bdb58], ax
mov ecx, dword [ebp + 0x545000f4]
push ecx
call fcn.00437a86
mov dword [edx + 0x282828b0], eax
cmp esi, ebx
je 0xc9cba6ff
mov ecx, dword [esi + 4]
mov ebx, dword [0x482430]
mov eax, 0x510c744c
test dx, 0x208b
call 0x50687e2a
add edx, 0x68
push edx
dec dword [edx + ecx*2 + 0x30]
call ebx
mov eax, dword [0x4a7cc4]
mov ecx, dword [esi + 8]
invalid

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x6b9bb0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x6ce1f4
push 8
push edi
call fcn.006b9b70
add esp, 8
mov edx, 8
shl eax, 0x18
mov dword [esi], eax
mov ebx, eax
mov ecx, ebx
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebx, eax
jne 0x6b9bd1
push 0x20
push eax
mov dword [esi], ebx
call fcn.006b9b70
mov dword [esi], eax
add esp, 8
add esi, 4
inc edi
cmp esi, 0x6ce5f0
jle 0x6b9bba
pop edi
pop esi
pop ebx
ret

Function at 0x6b9c10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
or eax, 0xffffffff
test edx, edx
je 0x6b9c43
push ebx
push esi
lea esi, [edx]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x6ce1f4]
xor eax, edx
inc ecx
dec esi
jne 0x6b9c23
pop esi
pop ebx
not eax
ret
Function at 0x61d72700
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [ebp + 8]
push ebx
test eax, eax
mov ebx, ecx
jne 0x61d7271f
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push edi
mov edi, str.C:Program_FilesCommon_FilesRealcommon_security.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x20c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp - 4], 0
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [ebp - 0xc], 0x100
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 8]
push ecx
push str.SoftwareRealNetworksPreferencesDT_Common
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x61d72800
mov ecx, dword [ebp - 8]
lea edx, [ebp - 0xc]
lea eax, [ebp - 0x10c]
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x61d727f6
lea edi, [ebp - 0x10c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x10d], 0x5c
je 0x61d727da
mov edi, 0x61d86200
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x10c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ecx, [ebp - 0x20c]
push eax
push str._ssecurity.dll
push ecx
call dword [sym.imp.PNCRT.dll_sprintf]
add esp, 0xc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebx + 0x4c], eax
je 0x61d72831
push str.RMACreateSecurityInstance
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x61d72831
mov esi, dword [ebp + 8]
push 0
push esi
call eax
cmp dword [esi], 0
jne 0x61d7284d
mov eax, dword [ebx + 0x4c]
mov dword [ebp - 4], 0x80004005
test eax, eax
je 0x61d7284d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebx + 0x4c], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x424490
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x419015
lea edi, [esi - 0x18015]
push edi
xor ebp, ebp
dec ebp
jmp 0x4244b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4244b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4244a8
mov eax, 1
add ebx, ebx
jne 0x4244cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4244c0
jne 0x4244dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4244c0
xor ecx, ecx
sub eax, 3
jb 0x4244f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x424562
push eax
pop ebp
add ebx, ebx
jne 0x4244fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x424508
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42452c
inc ecx
add ebx, ebx
jne 0x424518
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42450d
jne 0x424529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42450d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42454c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42453d
jmp 0x4244ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42454c
add edi, ecx
jmp 0x4244ae
pop esi
push esi
pop edi
mov ecx, 0x87c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42456a
cmp byte [edi], 6
jne 0x42456a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x42456f
lea edi, [esi + 0x22000]
mov eax, dword [edi]
or eax, eax
je 0x4245de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x24978]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x249c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
test al, al
je 0x42459c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x249d0]
test eax, eax
je 0x4245d8
mov dword [ebx], eax
add ebx, 4
jmp 0x4245b9
call dword [esi + 0x249cc]
mov ebp, dword [esi + 0x249d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x24639]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x42462a
sub esp, 0xffffff80
jmp 0x4017c0
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x5586fb9
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x433060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3b0e6cb8
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x40d596
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x1505
jmp 0x40d5b7
lea eax, [ecx - 0x61]
cmp eax, 0x19
ja 0x40d5af
and ecx, 0xffffffdf
imul edx, edx, 0x21
xor edx, ecx
add esi, 2
movzx ecx, word [esi]
test ecx, ecx
jne 0x40d5a4
mov eax, dword [ebp + 0x10]
movzx ecx, dl
mov edx, ecx
and ecx, 0x1f
shr edx, 5
mov dword [eax], edx
xor edx, edx
mov eax, dword [ebp + 0x14]
inc edx
shl edx, cl
pop esi
mov dword [eax], edx
pop ebp
ret 0x10

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x6ba4076b
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x50a22221
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219