joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5ed524
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5ed53b
add esp, 0xfffffff0
call fcn.00408cc4
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2024
mov eax, dword [0x6b35a0]
cmp byte [eax], 0
jne 0x5ed568
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x19c], al
mov eax, dword [0x6b3ce4]
cmp word [eax + 2], 0
jne 0x5ed582
mov eax, dword [0x6b3ce4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005ef9e8
mov eax, dword [0x6b3f6c]
cmp word [eax + 2], 0
jne 0x5ed59c
mov eax, dword [0x6b3f6c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005efe00
mov byte [ebx + 0x41], 0
mov dl, 1
mov eax, dword [0x516968]
call fcn.0051d4e4
mov esi, eax
mov dword [ebx + 0x54], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5f03ac
mov dl, 1
mov eax, dword [0x481500]
call fcn.004086a8
mov dword [ebx + 0xa8], eax
mov dl, 1
mov eax, dword [0x481500]
call fcn.004086a8
mov dword [ebx + 0xc8], eax
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x98], eax
mov dword [ebx + 0x70], 0xff000018
mov dword [ebx + 0x8c], 0x1f4
mov byte [ebx + 0x90], 1
xor eax, eax
mov dword [ebx + 0x94], eax
mov dword [ebx + 0x88], 0x9c4
mov byte [ebx + 0xbd], 1
mov byte [ebx + 0xd4], 1
mov dl, 1
mov eax, dword [0x51bad8]
call fcn.00527af8
mov esi, eax
mov dword [ebx + 0xb8], esi
push 0x5ed78c
mov eax, dword [0x6b3a14]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.00528014
mov eax, dword [ebx + 0xb8]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5f0698
mov dl, 1
mov eax, dword [0x481500]
call fcn.004086a8
mov dword [ebx + 0xb0], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x6b3a14]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00426c28
test eax, eax
je 0x5ed6af
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00426a80
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.00426c0c
test eax, eax
je 0x5ed6c7
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0xa4]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.0040afe8
push ebx
push 0x5ef3bc
call fcn.005e19b8
mov dword [ebx + 0x198], eax
mov byte [ebx + 0xe8], 0
mov eax, dword [0x6b35a0]
cmp byte [eax], 0
jne 0x5ed718
mov eax, ebx
call fcn.005ed954
mov byte [ebx + 0x6d], 1
mov byte [ebx + 0x6e], 1
mov byte [ebx + 0x6f], 1
mov byte [ebx + 0xbe], 1
mov byte [ebx + 0xe9], 0
mov byte [ebx + 0xf4], 0
xor eax, eax
mov dword [ebx + 0xec], eax
mov byte [ebx + 0xeb], 0
xor eax, eax
mov dword [ebx + 0xc0], eax
mov eax, ebx
call fcn.005f0a40
mov eax, ebx
call fcn.005f157c
mov byte [ebx + 0x19e], 0
mov byte [ebx + 0xf5], 1
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5ed783
call fcn.00408d1c
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5edc84
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x190]
test eax, eax
je 0x5edd26
cmp dword [ebx + 0xac], 0
jne 0x5edd20
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5edbc4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0xa8]
cmp dword [eax + 8], 0
je 0x5edd20
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5edce6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0xa8]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5edd20
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [ebx + 0xa8]
mov edx, esi
call fcn.004abfc8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5edcf5
inc dword [ebx + 0xac]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5ee068
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x6bbc38]
cmp dword [eax + 0x190], 0
je 0x5ee1d1
test bl, bl
jne 0x5ee124
cmp dword [esi + 0xb4], 0
jne 0x5ee119
mov eax, esi
call fcn.005f13cc
push eax
push 0x5edf68
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x58], 0
je 0x5ee0ea
mov eax, dword [0x6bbc38]
cmp byte [eax + 0xeb], 0
je 0x5ee0ea
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5ee0cb
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ee0ea
push 0
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ee0d3
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ee119
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004abfc8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ee0f9
inc dword [esi + 0xb4]
jmp 0x5ee1d1
cmp dword [esi + 0xb4], 0
jle 0x5ee1d1
dec dword [esi + 0xb4]
cmp dword [esi + 0xb4], 0
jne 0x5ee1d1
cmp dword [esi + 0x58], 0
je 0x5ee186
mov eax, dword [0x6bbc38]
cmp byte [eax + 0xeb], 0
je 0x5ee186
mov eax, dword [esi + 0xf0]
test eax, eax
je 0x5ee167
sub eax, 4
mov eax, dword [eax]
mov edi, eax
dec edi
cmp edi, 0
jl 0x5ee186
push 5
mov eax, dword [esi + 0xf0]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5ee16f
mov eax, dword [esi + 0xb0]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5ee1b5
cmp bl, 1
cmc
sbb eax, eax
push eax
mov eax, dword [esi + 0xb0]
mov edx, edi
call fcn.004abfc8
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5ee195
mov eax, dword [esi + 0xb0]
mov edx, dword [eax]
call dword [edx + 8]
lea eax, [esi + 0xf0]
mov edx, dword [0x5dde58]
call fcn.0040d3c8
pop edi
pop esi
pop ebx
ret
Function at 0x5eefc8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xc4], 0
je 0x5ef025
cmp byte [ebx + 0xeb], 0
jne 0x5ef025
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x190]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040a618
mov eax, dword [esi]
test eax, eax
je 0x5ef012
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5ef032
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a870
jmp 0x5ef032
mov eax, esi
mov edx, dword [ebx + 0xa4]
call fcn.0040a870
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5f0c54
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x98]
test esi, esi
je 0x5f0cc5
mov eax, esi
call fcn.0054d664
test al, al
je 0x5f0cc5
mov eax, dword [ebx + 0x98]
call fcn.0054d1fc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5f0cc5
mov eax, dword [ebx + 0x98]
mov edx, dword [eax]
call dword [edx + 0x160]
test al, al
je 0x5f0cb6
push 0
mov eax, dword [ebx + 0x98]
call fcn.0054d1fc
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebx + 0x98]
xor edx, edx
call fcn.00543434
jmp 0x5f0cc5
mov edx, dword [ebx + 0x88]
mov cl, 1
mov eax, ebx
call fcn.005f0a60
pop esi
pop ebx
ret
Function at 0x649ebc
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffdc
mov ebx, eax
mov eax, ebx
call fcn.0040a480
mov dword [esp], 0xf
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x649eed
lea edx, [esp + 4]
mov eax, ebx
mov ecx, dword [esp]
call fcn.0040a618
add esp, 0x24
pop ebx
ret

Function at 0x661024
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x66102c
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6611e3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x18]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 4]
mov edx, 0x6611fc
call fcn.0040b198
push esi
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x18]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0x1c]
xor edx, edx
call fcn.0065ebe4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0x11
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x661210
call fcn.006089e8
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x6610a7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6610e8
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
movzx ecx, word [ebx + 0x30]
mov eax, dword [ebx + 0xc]
xor edx, edx
call fcn.0065ebe4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x661278
call fcn.006089e8
mov edx, dword [ebp - 0x1c]
mov eax, esi
call fcn.0040b140
mov eax, esi
mov edx, 0x6612a4
call fcn.0040b140
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x661100
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x66116e
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6612b8
call fcn.006089e8
mov edx, dword [ebp - 0x2c]
mov eax, esi
call fcn.0040b140
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x661137
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x661162
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x6612e8
call fcn.006089e8
mov edx, dword [ebp - 0x30]
mov eax, esi
call fcn.0040b140
mov eax, esi
mov edx, 0x6612a4
call fcn.0040b140
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x66117a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x6611a5
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x24]
xor ecx, ecx
mov eax, 0x661314
call fcn.006089e8
mov edx, dword [ebp - 0x34]
mov eax, esi
call fcn.0040b140
mov eax, esi
mov edx, 0x6612a4
call fcn.0040b140
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6611ea
lea eax, [ebp - 0x34]
mov edx, 4
call fcn.0040a4e0
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.0040a4e0
lea eax, [ebp - 4]
call fcn.0040a480
pop eax
jmp eax
Function at 0x68f03c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.0040af34
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov eax, esi
mov edx, esp
mov ecx, 0x105
call fcn.0040afe8
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x68f078
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x68f16d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x68f18c
push ebx
push 0x68f19c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040b220
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00407ec8
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], di
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
call fcn.004267b0
mov eax, dword [ebp - 0x5c]
call fcn.0040af34
push eax
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040af34
push eax
push 0
call sub.kernel32.dll_CreateProcessW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x68f14d
jmp 0x68f126
mov eax, dword [0x6b3ed8]
mov eax, dword [eax]
call fcn.005ef598
push 0xc8
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x68f11a
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f174
lea eax, [ebp - 0x5c]
call fcn.0040a480
lea eax, [ebp - 4]
call fcn.0040a480
pop eax
jmp eax

Function at 0x68f1a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040a574
xor eax, eax
push ebp
push 0x68f250
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040af34
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, edi
xor ecx, ecx
mov edx, 0x34
call fcn.00407ec8
test ebx, ebx
jbe 0x68f236
mov eax, ebx
call fcn.00406fe8
mov esi, eax
push esi
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.0040af34
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x68f260
push esi
call sub.version.dll_VerQueryValueW
mov edx, edi
mov eax, dword [ebp - 0xc]
mov ecx, 0x34
call fcn.004073f0
mov eax, esi
call fcn.00407004
mov bl, 1
jmp 0x68f238
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68f257
lea eax, [ebp - 4]
call fcn.0040a480
pop eax
jmp eax
Function at 0x68f6c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, eax
mov ebp, dword [0x6b3ed8]
xor ebx, ebx
jmp 0x68f6ea
push 0xffffffffffffffff
push 1
call sub.kernel32.dll_SleepEx
mov eax, dword [ebp]
call fcn.005ef598
inc ebx
mov eax, edi
mov ecx, 0xa
xor edx, edx
div ecx
cmp ebx, eax
jbe 0x68f6d8
call sub.kernel32.dll_GetTickCount
mov esi, eax
mov eax, dword [ebp]
call fcn.005ef598
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, edi
mov ecx, 0xa
xor edx, edx
div ecx
mov eax, ebx
sub eax, esi
cmp edx, eax
jbe 0x68f726
cmp esi, ebx
jbe 0x68f700
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0xa95058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00a951a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa9507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9506a
add dl, dl
jne 0xa95089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa950dc
xor eax, eax
add dl, dl
jne 0xa95096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa9517d
add dl, dl
jne 0xa950a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa950d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa95075
mov eax, 1
add dl, dl
jne 0xa950ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa950f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa950e1
sub eax, ebx
mov ebx, 1
jne 0xa95128
mov ecx, 1
add dl, dl
jne 0xa9510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa95119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa95105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa9513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa9514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa95136
cmp eax, 0x7d00
jae 0xa9516d
cmp eax, 0x500
jb 0xa95168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
cmp eax, 0x7f
ja 0xa95170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa95075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa9519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa95075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x6fa8f979
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 8]
call dword [0x74d6111c]
mov ecx, dword fs:[0x18]
mov edx, dword [ecx + 0x30]
cmp byte [edx + 2], 0
mov ecx, 0xdeadbeef
jne 0x6fa8fa1a
test eax, eax
je 0x6fa8f9b7
mov edx, dword [eax + 0x60]
sub edx, dword [eax + 0x64]
cmp edx, 0x2000
jb 0x6fa8fa1a
mov edx, dword [ebp + 8]
cmp edx, ecx
jne 0x6fa8f9c5
test eax, eax
je 0x6fa8fa1a
mov edx, dword [eax + 0x64]
mov dword [0x74d94140], edx
cmp dword [ebp + 0xc], ecx
jne 0x6fa8fa23
test eax, eax
je 0x6fa9f7f3
mov eax, dword [eax + 0x64]
mov dword [0x74d94144], eax
add eax, 8
cmp eax, 8
jb 0x6fa9f7fb
mov eax, dword [ebp + 0x10]
mov dword [0x74d941a0], 0x74d65a14
test eax, eax
jne 0x6fa9f80a
mov eax, dword [ebp + 0x14]
mov dword [0x74d941a4], 0x74d6339d
test eax, eax
jne 0x6fa9f814
pop ebp
ret 0x10
and dword [0x74d94140], 0
jmp 0x6fa8f9cb
mov eax, dword [ebp + 0xc]
jmp 0x6fa8f9db
ret
fisubr dword [ebp + edx - 0x40]
jle 0x6fa9f82e
pushal
retf 1
out 0, eax
cmp eax, 0xe72c30
je 0x6fa9f902
add byte [eax], al
add al, ch
cld
and ah, byte [ecx]
add byte [ecx + eax], bl
call 0x6fcb1b18
pop esp
add dword [eax], eax
and byte [eax - 0x6bffd2e3], dl
sbb eax, 0x59a1502d
add al, 0xb0
call 0x6fc61bf6
and ebx, dword [eax + eax]
and ah, bl
sub al, 0xc0
and al, 0xdc
sub al, 0xc0
imul eax, dword [eax], 0
mov al, 0xae
Function at 0x6fa90038
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
add byte cs:[eax], al
shr byte [esi], 1
add byte [eax], al
out 0x2e, eax
add byte [eax], al
add al, 0x2f
add byte [eax], al
sbb al, 0x2f
add byte [eax], al
xor al, 0x2f
add byte [eax], al
dec ebx
das
add byte [eax], al
push 0x8a00002f
das
add byte [eax], al
lodsb al, byte [esi]
das
add byte [eax], al
lds ebp, [edi]
add byte [eax], al
fld xword [edi]
add byte [eax], al
das
add byte [eax], al
or eax, 0x30000030
xor byte [eax], al
add byte [edi + 0x30], dl
add byte [eax], al
xchg byte [eax], dh
add byte [eax], al
mov al, 0x30
add byte [eax], al
xlatb
xor byte [eax], al
add bh, bh
xor byte [eax], al
add byte [0x40000031], bl
xor dword [eax], eax
add byte [ebx + 0x31], ch
add byte [eax], al
mov dword [ecx], esi
add byte [eax], al
cmpsb byte [esi], byte es:[edi]
xor dword [eax], eax
add al, cl
xor dword [eax], eax
add al, dh
xor dword [eax], eax
add byte [ecx], cl
xor al, byte [eax]
add byte [edi], bl
xor al, byte [eax]
add byte [ecx + 0x32], cl
add byte [eax], al
imul esi, dword [edx], 0xadbf0000
add byte [eax], al
dec esp
scasd eax, dword es:[edi]
add byte [eax], al
jge 0x6fa90062
add byte [eax], al
popal
sub eax, dword [ecx]
add byte [ebx + esi + 0x32a10001], bl
add dword [eax], eax
in eax, 0x3a
add dword [eax], eax
and eax, 0xe700008a
xor al, 1
add bh, ch
xor eax, 0x291d0001
add dword [eax], eax
wait
aaa
add dword [eax], eax
add eax, 0x55000132
xor eax, dword [ecx]
add byte [edi + 0xe00009b], dh
sub al, 1
add byte [ebx - 0x68], bl
add byte [eax], al
inc ecx
xor al, 1
add byte [ebx - 0x49ffff9f], ah
add dword ds:[eax], eax
sub al, byte gs:[ecx]
add byte [edi], dl
mov ecx, 0x39d10000
add dword [eax], eax
imul dword [ebp + 0x2ec50000]
add cl, dl
cmp dword [ecx], eax
add bh, dh
lodsd eax, dword [esi]
add byte [eax], al
lds ebp, [esi]
add dword [eax], eax
jns 0x6fa90152
add dword [eax], eax
das
cmp eax, dword [ecx]
add byte [edi], bl
cmp dword [ecx], eax
add byte [eax], al
aas
add dword [eax], eax
or eax, 0x7600013f
aas
add dword [eax], eax
mov edi, 0xbe000061
inc ebp
add dword [eax], eax
mov al, byte [eax + 1]
add cl, dl
aas
add dword [eax], eax
mov byte [edx + 0x61700000], cl
add byte [eax], al
jno 0x6fa90180
add byte [eax], al
pop ebx
cmp byte [eax], al
add byte [esi - 0x49], bh
add byte [eax], al
jl 0x6fa9010b
add byte [eax], al
ret
and eax, 0x9e00005d
inc ebx
add dword [eax], eax
invalid
Function at 0x6fa9e7d2
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
push edi
mov edi, dword [eax]
test edi, edi
je 0x6facfd4d
mov ecx, dword [edi]
mov eax, dword [edi + 4]
and dword [ebp - 8], 0
mov dword [ebp - 4], ecx
mov dword [ebp - 0x14], eax
test ecx, ecx
jbe 0x6fa9e859
push ebx
mov dword [ebp - 0xc], eax
push esi
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
mov ecx, dword [ebp + 8]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x6fa9e861
test dl, dl
je 0x6fa9e828
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x6fa9e861
inc eax
inc eax
inc ecx
inc ecx
test dl, dl
jne 0x6fa9e80e
xor eax, eax
test eax, eax
je 0x6faa2c0e
xor esi, esi
cmp dword [ebp - 8], esi
ja 0x6fa9bd31
inc dword [ebp - 8]
add dword [ebp - 0xc], 4
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], eax
jb 0x6fa9e804
xor esi, esi
cmp dword [ebp - 0x10], esi
jne 0x6faa2c2f
pop esi
pop ebx
mov eax, dword [ebp - 0x10]
pop edi
leave
ret 8
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x6fa9e82a
add byte [0x36002200], bh
add byte [ebp], ah
and al, byte [eax]
and byte [eax], al
jo 0x6facfd56