joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ab58
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ab82
push 0
push 0
push 0
push 0
push 0xcc2
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001ab92
push 0x1a9f
push 0x10bc
call dword [sym.imp.KERNEL32.dll_Beep]
pop ebp
ret

Function at 0x1001cf1f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001cf50
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001cf4b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001d043
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.10017408
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 4]
mov dword [edx], ecx
test eax, eax
jne 0x1001cfef
push 0
mov ecx, dword [ebp - 8]
call fcn.10017408
cmp dword [eax], 0x2f38d927
jl 0x1001cfc5
mov dword [ebp - 0xc], 1
jmp 0x1001cfc9
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xeb59
jg 0x1001cfdb
mov dword [ebp - 0x10], 1
jmp 0x1001cfdf
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jle 0x1001cfef
and dword [ebp - 0x14], 0
jmp 0x1001cff6
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 0xffff
je 0x1001d00a
mov dword [ebp - 0x18], 1
jmp 0x1001d00e
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
je 0x1001d021
mov dword [ebp - 0x20], 1
jmp 0x1001d025
and dword [ebp - 0x20], 0
push 0
mov ecx, dword [ebp - 8]
call fcn.10017408
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x1001d2a1
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001d2fc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d2dd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1001d2fa
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017408
mov dword [eax], 0x1265
jmp 0x1001d2d2
jmp 0x1001d31a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001d31a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x10029c0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029c45
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10029c43
push 0
push 0
push 0
push 0
push 0xcc2
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10029c90
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10029c73
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x10029c90
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10017408
mov dword [eax], 0xfffffffa
jmp 0x10029c68
mov esp, ebp
pop ebp
ret

Function at 0x1002a174
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002a1a1
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002a19f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1002a1ae
push 0
push 0x1f0d
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov esp, ebp
pop ebp
ret
Function at 0x10031cc7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10031d22
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031d03
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10031d20
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10017408
mov dword [eax], 1
jmp 0x10031cf8
jmp 0x10031d2a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x1003297b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
push 1
call fcn.100324ea
add esp, 0xc
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100329ab
xor eax, eax
jmp 0x10032b05
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100329c9
xor eax, eax
jmp 0x10032b05
push 0x69c0
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10032536
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x100329ed
xor eax, eax
jmp 0x10032b05
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
push 1
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10032375
add esp, 0x18
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.100325a3
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x79f8
lea eax, [ebp - 0x14]
push eax
push 0x1311
push 1
call fcn.10032606
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x10032a75
push 0x4b2a
lea eax, [ebp - 0x14]
push eax
push 1
push 0x2dae
push 0x192e
push 0x29e1
push 0x5966
lea eax, [ebp - 4]
push eax
push 0x8ae
call fcn.10032699
add esp, 0x24
push dword [ebp - 4]
call fcn.10031d8b
pop ecx
test eax, eax
jne 0x10032a86
xor eax, eax
jmp 0x10032b05
lea eax, [ebp - 4]
push eax
push 0x18d1
push 0x1f12
push 1
push 0x1f05
push 0x2e4f
call fcn.10032845
add esp, 0x18
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x10032aed
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10032ac7
xor eax, eax
jmp 0x10032b05
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10032ae0
xor eax, eax
jmp 0x10032b05
lea eax, [ebp - 4]
push eax
push 1
call fcn.10032925
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x10032afe
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10032b02
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100484a4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100484c4
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x100484f7
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100484f7
push 0
push 0
push 0
push 0
push 0xcc2
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x1004ac2f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004ac47
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1004ac71
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 1
mov ecx, dword [ebp - 0xc]
call fcn.10017408
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x1004ac75
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004ad31
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0x18]
mov ecx, dword [ebp - 0xc]
cmp dword [ecx], eax
jae 0x1004ad0a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
lea eax, [ecx + eax*4]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x10]
mov eax, dword [ecx + eax]
mov dword [edx], eax
jmp 0x1004ad2f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
push dword [eax + 0x14]
call fcn.10048469
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1004ad39
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x10086e85
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100915b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10076494
mov dword [ebp - 0x14], eax
cmp dword [0x1067ddb0], esi
jne 0x10086f78
push 0x800
push esi
push 0x10007b0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10086f05
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10087058
push esi
push esi
push 0x10007b0c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10087058
push 0x10007b24
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10087058
push eax
call ebx
push 0x10007b30
push edi
mov dword [0x1067ddb0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b40
push edi
mov dword [0x1067ddb4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007b54
push edi
mov dword [0x1067ddb8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067ddc0], eax
test eax, eax
je 0x10086f75
push 0x10007b70
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1067ddbc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10086f9d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10086f90
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10086fb2
push 4
pop eax
jmp 0x1008705a
cmp dword [ebp - 0x14], esi
je 0x10086fb2
push dword [0x1067ddb0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10086f97
mov eax, dword [0x1067ddbc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10087010
cmp dword [0x1067ddc0], edi
je 0x10087010
push eax
call ebx
push dword [0x1067ddc0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10087010
test eax, eax
je 0x10087010
call ecx
test eax, eax
je 0x10087005
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10087005
test byte [ebp - 8], 1
jne 0x10087010
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10087040
mov eax, dword [0x1067ddb4]
cmp eax, edi
je 0x1008703d
push eax
call ebx
test eax, eax
je 0x1008703d
call eax
mov esi, eax
test esi, esi
je 0x1008703d
mov eax, dword [0x1067ddb8]
cmp eax, edi
je 0x1008703d
push eax
call ebx
test eax, eax
je 0x1008703d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1067ddb0]
call ebx
test eax, eax
je 0x10087058
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1008705a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x40e77f
Capabilities:
Encode data using xor

Disassembly:
adc dword [edx - 0x23ebeb44], ebp
pop edi
mov al, 0x2c
jle 0x40e70f
hlt

Function at 0x49f893
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xa4730a92
or dh, byte [ebx - 0x5c]
xchg esp, eax
mov cl, 0xac
push ebp
mov ah, 0x39
movsb byte es:[edi], byte [esi]
adc byte [ecx + ecx - 0x3c], 0xe1
push ss
salc
push ecx
clc
sub dword [ebx], ebp
dec ecx
jle 0x49f83d
fisttp dword [edx + 0x4a]
fmul dword [eax - 0x3f6af472]
invalid
salc
test eax, 0xc9c17453
in eax, 0xeb
and al, byte [ecx + 0x4a]
push edi
cmp byte [edx], 0x63
daa
clc
in al, dx
cld
dec ecx
jp 0x49f83b
bound ecx, qword [ecx]
mov edx, 0xca36889e
and ch, al
invalid

Function at 0x5350a3
Capabilities:
Encode data using base64

Disassembly:
jnp 0x5350e8
invalid
cmp eax, 0xc8bc3593
pop ecx
jmp 0xe1a311cf

Function at 0x545733
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
add byte [edx + esi*4], dl
sbb al, 0xa
jle 0x5456cf
and eax, 0xd4127eec
add byte [0xdb59b7ba], 0xa7
lea ebx, [esi + 0x3dce67ac]
push eax
stosb byte es:[edi], al
add al, al
in eax, dx
push esi
push es
ret 0xe7ac
fmul dword [0x7a77ca83]
aaa
invalid
cmc
lcall 0x36aa, 0xf2856b86
invalid
push edx
pop ebx
jo 0x54570b
invalid
inc esi
push esp
js 0x54571a
movsb byte es:[edi], byte [esi]
jecxz 0x5456c7
test al, 0xda
push ebp
int 0x9e
xchg esi, eax
js 0x545780
jl 0x54579b
shl byte [edi], 1
jb 0x54571b
and esp, dword [edx - 0x4d6d1c37]
test dword [edi + 0x3ddb426], esp
int 0xba
out 0x77, eax
adc dword [eax + 0x7a35c68b], edx
into
loopne 0x545702
dec ebx
inc edx
pop ss
mov edi, 0x3b2f89ad
mov esp, 0xcc0ea68b
and al, 0x89
mov dl, 0xff
adc dword [ecx + 0x207558b0], esp
test al, 0xc5
ror byte [ecx - 5], 0x66
dec edx
xchg esp, eax
jp 0x5457a1
mov bh, byte ss:[eax - 0x31]
adc byte [0x76b38e82], cl
xchg ebx, eax
push 0xffffffffffffff9f
hlt
imul byte [esi]
invalid
cmp dword ss:[ebp + eax*2 + 0x334868b], ebx
cmp al, ch
or eax, 0x6efba97f
push ss
add dl, ah
fld st(5)
shr dword [eax + 0xc9a0b5b], cl
sbb eax, 0x378f006a
inc eax
outsd dx, dword [esi]
xchg esp, eax
loope 0x545809
jl 0x5457e0
ljmp 0x2e93:0xabd8bb4c
cli
inc ebp
and cl, bh
invalid
or edi, eax
pop ebp
wait
loopne 0x54582d
cmpsb byte [esi], byte es:[edi]
invalid
outsd dx, dword [esi]
lds edi, [edx - 0x1e]
pmaddwd mm6, qword [ebp + 0x52a23f4c]
cwde
enter 0xffffffffffffddeb, 0x2e
add byte [ebx + 0x58], al
into
inc edx
pop ds
in al, 0x23
or byte [edi + 0xf73076a], bl
xor eax, 0x723491cc
cdq
and bh, bl
sub byte [eax + 0x30ed59be], bl
iretd
Function at 0x5458e7
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x4c
aas
mov byte [0xebc89852], al
invalid
cmp al, 0x5f
xor ecx, dword [edx]
into
adc dh, dh
sbb al, 0x34
sti
rcl eax, 0x19
jbe 0x545833
mov byte [eax - 0x61d44eeb], ah
mov al, 0xce
adc eax, 0x4afabe04
add byte [edx + 0x25f5c1f], dh
aas
ret 0xf029
sub esp, dword [esi]
lcall 0xb281, 0x7da52cc0
loope 0x545885
and dl, byte [edx]
push esp
fistp dword [edx + edi*8 + 0x175aa24b]
sar edi, cl
xchg edi, eax
xchg ebx, eax
add al, 0xce
bound ecx, qword [edi]
pop edx
in al, dx
add ebx, eax
fmul dword [0x23d63a1f]
fmul dword [0x23d63a1f]
out dx, eax
xor eax, 0x7a48e201
jge 0x5458c7
test al, 0x3f
fisub word [ebx + 0x532ff8ba]
inc edi
adc dl, ch
mov ah, byte [ebx]
je 0x54595f
push ebx
cmp dword [ebx + 0x62], esi
and ah, byte [edi]
mov byte [0xcb903048], al
jp 0x545900
push cs
inc eax
mov cl, 0xd1
fcmovnbe st(0), st(2)
mov esi, 0xc143ac70
sbb bh, ch
stosd dword es:[edi], eax
lcall 0x3e5e, 0xe91f1ea9
push es
inc ecx
outsb dx, byte [esi]
dec eax
invalid
mov esi, 0x1b463e67
xor dword [ebx], eax
push esp
push ecx
dec esp
push edi
dec ecx
inc ebp
or dword [ebx], esi
add ebx, ecx
invalid

Function at 0x5c16d3
Capabilities:
Encode data using xor

Disassembly:
in al, 0x76
sbb eax, 0x7744aa4f
pop ecx
mov ebp, 0x198ee716
fcomp qword [ebp + ecx*4 - 0x5648c90]
push esi
not dword [edx + 0x43]
cmpsb byte [esi], byte es:[edi]
and dword [ebx], edi
adc eax, 0x3308f8d5
scasd eax, dword es:[edi]
jns 0x5c1753
xor ebp, dword [edi + 0x14115d79]
mov cx, 0x7a7
xor dl, bh
adc dword [esi], edx
mov ecx, 0xd73207a7
fild word [ecx]
fld qword [esp + ecx*2 - 0x1b]
dec esp
dec eax
js 0x5c16f2
dec ebp
cmp dword [edx], ebp
dec ebp
ror dword [edi - 0x134b04d9], 0x89
das
sal byte [0x66f2fc7], cl
jae 0x5c172a
lds edx, [esi + 0x42]
dec edi
sub dh, byte [edi + 0x573ec429]
sub ch, byte [edx + 0x2108339c]
jmp 0x301c8f6e

Function at 0x615d13
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc ebx, dword [esi + 0x32e36a1b]
add byte [edx + 0x21bd5e10], ah
push 0xffffffffffffffe3
xor al, byte [eax]
mov byte [0x21bd5e10], al
push ebx
salc
pop esp
dec edi
neg byte [0xa1ab1bb7]
loope 0x615d8a
stosd dword es:[edi], eax
mov eax, dword [0xca5c5fe1]
in eax, 0x4c
sub edx, edx
jmp 0x615d2c
pop esp
retf 0x4ce5
inc eax
inc esp
cmp dword [ecx], 0xdbe178c6
fisubr word [eax]
invalid
sub byte [edi], cl
aas
cmp esi, ebx
jecxz 0x615d27
adc eax, 0xda3d5ccd
sub eax, 0xad39b702
push eax
or dword [edi - 0x13], ebp
cmp bl, byte ss:[esi - 0x6ee4af01]
call dword [eax + 0x1b]
xchg ecx, eax
pop edi
push ecx
ja 0x615d16
cmp eax, dword [eax]
popfd
and dword [esi - 0x30b362c1], ecx
fcom st(0)
inc eax
jns 0x615d69
fist dword [eax - 0x5b]
xor al, 0x5c
jecxz 0x615db2
adc dword ds:[ebx - 0x5fe2b967], esp
push ds
invalid
mov dl, 0xc4
push esp
loopne 0x615d72
pop esp
ret

Function at 0x619e63
Capabilities:
Encode data using add xor sub operations

Disassembly:
or eax, 0x80a3f5c1
imul ecx, dword [ecx + 0x7d1f117c], 0xe5d19807
dec esi
test al, al
Function at 0x619eab
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
out dx, al
lea eax, [ecx - 0x3b0cde13]
dec esp
inc esp
push ebx
add byte [ebx - 0x6d], dl
cmovnp ebp, dword [ebp - 0x6c5e4d56]
dec edi
stosd dword es:[edi], eax
or dword [ecx + 0x58], edx
push ebp
sahf
sub dword [0x1b6d8d81], ebx
and dword [eax], edi
xor ecx, dword [ecx + 0x1c9aa0e1]
mov bl, 0x57
adc esi, dword [0x3e338005]
push esi
test dword [0x327f684e], edx
push 0x5109327f
mov cl, 0x6c
push 0x5109327f
mov cl, 0x6c
xor dword [eax], edx
pop ebp
lcall 0xaf90, 0xfcc1ff97
aaa
inc ecx
scasd eax, dword es:[edi]
jo 0x619e75
inc esp
sahf
dec ebx
add al, 0x27
and al, 0xc0
fiadd word [edx + 0x64ffd907]
mov ebx, dword [edx - 0xd727d87]
lahf
sub ch, bh
push edi
inc cl
scasd eax, dword es:[edi]
retf

Function at 0x634d6f
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xeb
sub edx, ecx
invalid
xchg dword [ecx + 0x20b77ef5], ebx
invalid
aas
loopne 0x634d5b
jnp 0x634d14
invalid
invalid
Function at 0x49e210
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x57af0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0056bc23
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x49e292
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.005686cf
mov eax, dword [eax]
push 0x691d64
push eax
call fcn.00559bd4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0056beae
test bl, bl
je 0x49e292
push 0x691d64
lea ecx, [esp + 0xc]
call fcn.0056c23e
push 0x691d70
lea ecx, [esp + 0xc]
call fcn.0056c23e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x49e2ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0056beae
jmp 0x49e399
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x49e352
lea edx, [esp + 0x7c]
push 0x691d6c
push edx
call fcn.00559bd4
add esp, 8
test eax, eax
je 0x49e352
lea eax, [esp + 0x7c]
push 0x691d68
push eax
call fcn.00559bd4
add esp, 8
test eax, eax
je 0x49e352
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x49e2e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0056beae
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x49eb90
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x49ebf2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc