joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10382fb8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop edx
sub al, 0x5a
push cs
pop edx
jno 0x10382ffb
xor al, 0xc1
xor eax, 0x3627355a
sar dword [ecx], 0xab
aaa
sar dword [eax], 0x12
mov edi, 0xc1b0dbe7
mov ebx, 0xc13b133a
cmp dl, byte [ebx]
cmp eax, ecx
cmp al, 0x3d
push es
aaa
pop edx
std
mov bh, 0x63
jnp 0x10382fea
aas
dec edx
pop edx
jo 0x10382f87
rol dword [ecx + 0x3f], 0x42
sar dword [ebx], 0x5a
cmp cl, byte [edi]
aas
sti
out dx, eax
jp 0x10383036
cmp ebx, dword [edx + 0x3a]
invalid
sbb eax, dword [ecx + eax*8 + 0x78]
pop ecx
cmp al, 0xee
push ds
inc ebp
rcr dword [ecx + 2], 0x46
sbb eax, dword [edi + edi*4]
jge 0x10383030
cmp eax, 0x5a405a6e
aas
pop edx
inc ecx
bnd jl 0x10382fd1
push es
ficom word [0xc14839ff]
dec ecx
sar dword [edx + ecx*2 + 0x2f], 0xf3
dec edx
inc esi
dec esi
sar dword [ebx + 0x4ba6ed35], 1
shr dword [eax + 0x4c], 0xe7
inc esi
adc byte [edx + 0x28], 0x2e
sar edi, 0x7b
rcr dword [edi + 0x35], 0x4e
dec esi
and cl, byte [edi - 0x3f]
inc ebp
pop edx
inc esp
pop edx
push esp
inc edi
inc edi
pop esi
mov ebx, 0xffbd7086
dec ecx
pop edx
dec eax
pop edx
push eax
rcl dword [ecx + 0x36], 0x3a
loopne 0x10383005
ja 0x1038307a
fsubr st(5)
pop eax
inc esi
push edx
ja 0x103830ae
mov edx, 0xba3f74b7
idiv byte [ebp + 0x30927e3d]
inc eax
sub byte [ebx + 0x49], dh
dec ebx
push ss
push esp
dec ebx
push ebp
push edi
sti
invalid
push edi
push ds
cmp byte [edx + 0x5d], cl
push ebp
inc esi
inc eax
pop eax
adc cl, byte [ecx + ecx*2 - 0x62]
jge 0x1038308b
invalid
jl 0x1038300b
pop esi

Function at 0x10383358
Capabilities:
Encode data using xor

Disassembly:
bound eax, qword [ecx + 0x6d]
ret 0xc23f
cmp bh, byte [edi]
js 0x10383305
invalid
mov edi, 0x5b2d44fb
das
dec edi
push esi
dec esi
dec ebx
jae 0x103832d5
sub eax, dword [esi + ebp + 0x5b]
jl 0x1038334d
je 0x10383335
jne 0x103832d5
add dword [edx + 0x5b2f4b2f], esp
pop ebx
xor byte [esi + edi*4], bl
and al, 0x4c
jbe 0x10383322
inc ecx
jl 0x1038335c
fimul dword [ebx + 0x25]
cmp esi, dword [edx]
jnp 0x1038339f
mov dh, 0xc2
push ecx
int1
mov dword [0x342a15f7], eax
pop ebx
aaa
pop ebx
jns 0x103833a3
ret 0xf151
pushal
xor eax, 0x6e2b0c77
dec edi
loop 0x10383367
xor eax, 0x5bea78c7
jns 0x1038336e
clc
pop edi
sub ebx, dword [eax]
scasb al, byte es:[edi]
aas
jnp 0x10383302
jnp 0x103833ab
dec ecx
xor byte [eax + 0x3a], ah
cmp al, 0x5a
inc edx
invalid
push cs
pop ebp
cmp al, 0x7c
ret 0x67d
pop ss
cmp edi, esi
invalid
pop edx
and al, 0xf8
cmp eax, dword [edi]
pop es
inc bl
dec edi
xor eax, 0x4747c325
ret
inc edi
mov eax, ebx
inc ecx
inc esi
inc esp
dec eax
jle 0x103833a5
fnstenv [edi + 0x6a]
imul ebp, dword [eax], 0x36
and bh, byte [edx + 0x1e]
push cs
inc esp
pop ebx
inc ebx
invalid
Function at 0x10383dbc
Capabilities:
Encode data using xor

Disassembly:
pop esi
jb 0x10383e22
push ebx
pop esi
sub bl, byte [edx]
outsb dx, byte [esi]
arpl word [eax - 0x51], si
xchg byte [ebp + 0x6437fbfe], bl
lahf
sub al, 0xc8
sub eax, 0xc87f6ac8
insb byte es:[edi], dx
invalid
xor ebp, dword [0x3045]
push ds
imul edx, dword [esi], 0xc832c831
xor ecx, eax
jno 0x10383e16
push edi
loopne 0x10383e6e
xchg esi, eax
enter 0x5e6b, 0x47
push esi
xor eax, 0x66c836c8
pop esi
aaa
clc
js 0x10383df8
inc eax
sahf
pop esi
cmp al, cl
cmp eax, ecx
cmp cl, byte [esi + 0x6a]
jp 0x10383eae
aas
adc dword [eax + 0x5a], ebx
inc ebx
inc ebx
insb byte es:[edi], dx
inc edx
pop edx
inc edx
invalid
aas
push es
inc eax
enter 0x5a78, 0xffffffffffffffdc
add bh, dh
hlt
dec edx
sub ecx, dword [ebx - 0x38]
dec esp
enter 0x4c21, 0x52
inc esp
push ebx
sbb cl, byte [ebp - 0x38]
dec esi
enter 0x53dd, 0xffffffffffffffef
sti
jnp 0x10383f22
jge 0x10383f24
dec edi
xor edx, dword [eax + 0xa]
xor al, bh
push ecx
enter 0x2a52, 0x78
sar ebx, 0x16
and dword [edi + 0x79], ebx
mov dh, 0x73
stosd dword es:[edi], eax
inc ebx
xor al, 0x8b
jg 0x10383f4a
std
outsd dx, dword [esi]
push esp
dec edx
push ebp
enter 0xffffffffffffc856, 0x57
enter 0x2b69, 0x58
enter 0x5f2f, 0x59
enter 0xffffffffffff8b5a, 0xfffffffffffffff7
ret
and eax, 0x615f2e06
pop edi
popal
enter 0x5662, 0x28
pop edi
daa
pop edi
sub eax, 0xdffd635f
pop ds
fistp word [edi]
or dword [edx - 0xa], esp
and al, 0x5f
invalid
mul byte [edi + ebx*2]
enter 0x7f65, 0x66
enter 0xffffffffffffc867, 0x68
enter 0xfffffffffffff030, 0x53
sub dh, bh
dec esi
imul ecx, eax, 0x366a5f31
sub byte [esi], 0x6d
enter 0x5f31, 0x6a
sub byte ss:[esi], 0x6d
insd dword es:[edi], dx
enter 0xffffffffffff9f42, 0xffffffffffffffe2
and edi, dword [eax + 0x47]
outsb dx, byte [esi]
sti
outsd dx, dword [esi]
enter 0x5e70, 0x4a
dec edx
xor eax, 0xbdb8a05f
push dword [edi]
pop edi
jno 0x10383f32
jb 0x10383f34
jae 0x10383f36
je 0x10383fa6
cmp dl, bh
jne 0x10383f7a
fcompi st(7)
jnp 0x10383f50
lcall 0x7822, 0x34ee43c8
enter 0x6f79, 0x38
cmp edi, dword [edx - 0x51]
inc ebx
out dx, al
xor al, 0x22
js 0x10383f48
jns 0x10383ff1
cmp byte [ebx], bh
jp 0x10383f35
js 0x10383f80
outsd dx, dword [esi]
xchg dword [ebx + 0x37], esp
jns 0x10383fd0
xor bl, byte [edi + 0x3b]
mov bh, byte [ebx - 0x26]
pop edi
jl 0x10383f5f
cmp ecx, dword [edx + 0x7c5fda7b]
enter 0xfffffffffffff77d, 0x3d
xor eax, 0xc87e2e7c
jge 0x10383f90
cmp eax, 0x7e2e7c35
enter 0x3e13, 0x5f
adc edi, dword [esi]
pop edi
cmp al, 0x6f
aas
or cl, byte [0x21efe0b5]
or eax, 0x21efe0b5
leave
inc edx
pop ss
and cl, cl
cmp esi, dword [esi]
cmp dword [eax], ebp
xor edi, dword [ecx]
invalid
push es
leave
imul ebp, dword [edi + 0x43], 0x1a45c927
sub cl, cl
sub ecx, ecx
dec ecx
pop edi
loope 0x10383f9f
mov edi, 0x47c92ae0
push edi
sub ecx, ecx
sub al, 0xc9
sub eax, 0x441e4372
std
jno 0x1038406f
iretd
inc esi
shl byte [esi], cl
Function at 0x103860c8
Capabilities:
Encode data using xor

Disassembly:
daa
invalid
dec edi
mov ebx, edi
sub bl, bl
outsd dx, dword [esi]
imul ebp, dword [ebx], 0x2d0a0a36
adc esi, edi
fdivr dword [edi - 0x21bf3dc8]
dec edi
js 0x10386109
fstp xword cs:[ecx - 0x6d]
and dword [edx - 0x1e], ebp
push ss
mov esp, 0x693f9fdb
das
fstp xword [esi + 0x2b]
xor byte [esi + 0x76], bl
inc esi
imul esi, dword [ecx], 0xffc62a34
push cs
and ch, byte [edx + 0x32]
invalid
jnp 0x10386089
pop ss
shr dword [ecx + 0x34], cl
imul esi, dword [esi + esi], 0xa36db35
jp 0x10386103
xor esi, dword [edi - 0x30]
in eax, dx
jmp 0x10386081
ja 0x103860ca
fnstsw word [esi - 1]
mov dh, 0xdb
push 0x48
sbb ah, byte [0x4a27496a]
ucomiss xmm5, dword [edx + 0x4b]
fcmovnb st(0), st(7)
fidivr word [ebx]
clc
dec esp
fisttp dword [ebp - 0x25]
sub byte [edx], dl
dec esi
xor byte es:[esi], cl
dec edi
outsd dx, dword [esi]
jg 0x10386110
mov edi, 0x9f334dc1
push 0x50
fist dword [ecx - 0x25]
sub ebp, dword [edx + 0x52]
das
das
and dh, byte [edx]
push 0x31
push 0xffffffffffffffde
jnp 0x103861a8
clc
push ebx
fist dword [ebx + ebx*8 + 0x55]
adc dword ss:[esi + 0x32], 0x2c
adc bh, byte [0xfefef7c1]
sbb edx, dword [edi - 0x25]
pop eax
push ebx
pop ecx
fistp dword [edx + 0xe]
pop ebx
pop ss
pop esp
mov dh, 0x6d
invalid
cmp al, 0x6a
aaa
push 0x6e
mov esp, 0x1a362b0d
push 0x70
pop edx
invalid
Function at 0x10387e58
Capabilities:
Authenticate hmac

Disassembly:
out dx, al
jae 0x10387e5a
inc dword [ecx]
push edi
inc dword [ebx + 0x38345b43]
inc esp
jae 0x10387ec0
add edi, edi
idiv edi
add dword [ebx + 0x5b], 0x34
cmp byte [ebx + esi*2 + 0x59], al

Function at 0x1038b6c0
Capabilities:
Encode data using xor

Disassembly:
or edx, dword [ebp + 0x7b]
adc ah, byte [edi]
je 0x1038b6d9
inc ebx
invalid
add al, 0x3b
les esp, [edi - 0x28d0eb93]
adc eax, 0xb0453e17
cmp ebp, dword [ecx]
insb byte es:[edi], dx
or eax, dword [edi + 0x16]
mov al, 0x3b
sub dword [ebx + ecx + 0x47], ebp
push ss
xor eax, dword [esi]
pop ss
inc edx
pop ss
cmp dword [ebp + 0x22], 0x19c31338
push esi
sbb al, 0x1f
insb byte es:[edi], dx
ja 0x1038b6e5
imul byte [0xa1d451d]
js 0x1038b723
bound eax, qword [ebx]
mov eax, dword [0xfe139c1d]
cmpsd dword ds:[esi], dword es:[edi]
add edx, edi
adc esi, dword [edi + 0x331de00a]
push ds
leave
add byte [ebx], bh
shr dword [edi + 0x762b1f1e], 1
imul ebx, eax, 0xffffffd1
jbe 0x1038b78d
fcom st(1)
sar dword [esi - 6], 1
jle 0x1038b720
pop ds
jnp 0x1038b74a
imul esp, dword [ebx], 0x13
lodsd eax, dword [esi]
insb byte es:[edi], dx
dec ebp
aam 0x4d
jecxz 0x1038b726
cdq
fsub dword [ecx]
sbb byte [edi - 0x54e0d7a5], dl
mov dword [ebp - 0x28], edi
jg 0x27636f6e
dec edi
sub edx, dword [eax + 0x2b]
dec edi
adc byte [0x1e46bf6f], al
sbb eax, 0x242ba62c
sub al, 0x53
insb byte es:[edi], dx
or eax, 0x2de1e282
lahf
push edi
cmpsd dword [esi], dword es:[edi]
pushal
sub edi, dword [esi + 0x725f31b6]
xor edx, dword [esi]
xor ebp, esp
sti
jle 0x1038b746
sal byte [ebx], cl
pop ds
sal byte [ebx], 1
in al, 0x33
aad 0x1b
fimul dword [edx]
fbstp tbyte [ebx]
imul ebp, dword [eax], 0x38
sti
adc ecx, dword [edx + 0x34]
push ecx
xor al, 0x4b
xor al, 0x17
xor al, 0x53
jge 0x1038b794
mul byte [edi]
daa
in al, 0x34
pop edx
xor eax, 0x395b3594
inc edi
pop ebx
cmp dword [esi], esi
inc edi
sbb byte ss:[ebp + 0x380ab9da], 0x36
cmp al, byte [ebx]
sbb al, 0x37
sub esi, esi
lds ebp, [esi]
or al, 0x64
pop ds
push dword [edi]
out 0x23, eax
push eax
rol dword [edi + 0x133824bd], 0x3d
cmp byte [eax + 0x1d801f3a], bl
and al, 0x7f
cmp al, 0x73
add byte [0xffd8214b], bh
sbb dword [eax - 6], eax
invalid
stc
invalid
invalid
Function at 0x407237
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x38], edi
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi]
mov dword [ebp - 0x30], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x34], eax
call fcn.0040717b
mov ebx, dword [ebp - 0x14]
mov eax, dword [esi + 8]
add ebx, 0x23f
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [esi + 0xc]
push 0x20
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], eax
pop edi
mov dword [ebp - 0x20], 2
add dword [ebp - 0x20], 3
mov esi, dword [ebp - 8]
mov eax, esi
mov ecx, dword [0x71e074]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x4072c2
push 0x401128
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x71e074]
mov edx, dword [ebp - 0x1c]
add eax, dword [ebp - 0x28]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x71e0b8]
mov dword [ebp - 0x24], 0xedeb2e40
cmove eax, dword [ebp - 0x24]
and dword [ebp - 0x24], 0
cmp ecx, 0x3eb
mov dword [0x71e0b8], eax
mov eax, dword [0x71e0c0]
cmove eax, dword [ebp - 0x24]
mov dword [0x71e0c0], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
and dword [ebp - 0x18], 0
mov dword [0x71e0bc], 0xf4ea3dee
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
xor eax, dword [ebp - 0x1c]
sub edx, eax
mov dword [ebp - 0x10], eax
mov eax, edx
mov dword [ebp - 0x1c], edx
shl eax, 4
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
mov eax, edx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x24]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
mov dword [ebp - 0x14], ebx
dec edi
jne 0x407287
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov dword [edi], eax
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4073a1
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
shr esi, 3
push edi
mov edi, ecx
test esi, esi
je 0x4073dd
cmp dword [0x71e074], 0x959
jne 0x4073cd
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edx, dword [ebp + 8]
mov ecx, edi
call fcn.00407237
add edi, 8
dec esi
jne 0x4073b1
pop edi
pop esi
pop ebp
ret 4
Function at 0x4103ff
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f650]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0040a613
mov dword [ebp - 0x14], eax
cmp dword [0x71ee54], esi
jne 0x4104f2
push 0x800
push esi
push 0x40512c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41047f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4105d2
push esi
push esi
push 0x40512c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4105d2
push 0x405144
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4105d2
push eax
call ebx
push 0x405150
push edi
mov dword [0x71ee54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405160
push edi
mov dword [0x71ee58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x405174
push edi
mov dword [0x71ee5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x71ee64], eax
test eax, eax
je 0x4104ef
push 0x405190
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x71ee60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x410517
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41050a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41052c
push 4
pop eax
jmp 0x4105d4
cmp dword [ebp - 0x14], esi
je 0x41052c
push dword [0x71ee54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x410511
mov eax, dword [0x71ee60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41058a
cmp dword [0x71ee64], edi
je 0x41058a
push eax
call ebx
push dword [0x71ee64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41058a
test eax, eax
je 0x41058a
call ecx
test eax, eax
je 0x41057f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41057f
test byte [ebp - 8], 1
jne 0x41058a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4105ba
mov eax, dword [0x71ee58]
cmp eax, edi
je 0x4105b7
push eax
call ebx
test eax, eax
je 0x4105b7
call eax
mov esi, eax
test esi, esi
je 0x4105b7
mov eax, dword [0x71ee5c]
cmp eax, edi
je 0x4105b7
push eax
call ebx
test eax, eax
je 0x4105b7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x71ee54]
call ebx
test eax, eax
je 0x4105d2
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4105d4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409c4e
mov esp, ebp
pop ebp
ret
Function at 0x4bcf50
Capabilities:
Encode data using xor

Disassembly:
fisub word [eax + 0x28]
sar dword [eax + edi*4 - 0x5138d1d3], 1
jno 0x4bcfdb
jmp 0x83ddbbc0
sahf
and ch, byte [ecx]
add ch, byte [ecx + 0x36]
mov gs, esp
insd dword es:[edi], dx
imul ecx, dword [ebx + 0x31d36f83], 0x16
or eax, 0x52f36724
push esp
salc
shr byte [ebx - 0x7b], 0xe8
jmp dword [edi + 0x2a]
lodsb al, byte [esi]
outsd dx, dword [esi]
or al, dl
imul ebp, ecx, 0x63
and eax, 0x134daf76
mul byte [edx + 0x32]
stosd dword es:[edi], eax
retf
xor ah, bl
jae 0x4bcf81
jecxz 0x4bd051
mov byte [0x891d97a9], al
je 0x4bcfba
test eax, 0x74891d97
aad 0x1d
add esi, dword [edx - 0x15]
aaa
sbb eax, 0x37eb7203
or eax, 0x5f0b8401
mov edx, 0x88381b34
out 0x38, eax
or bh, byte [ebx]
mov al, byte [0x9b75f07]
in eax, 0x79
push dx
jge 0x4bd07c
pop ebx
dec esi
inc ebp
bnd jae 0x4bd015
salc
retf 0x809
rol edx, 1
mov byte [ebx - 0x68ac841a], cl
xor eax, 0x38cf3915
lds eax, [ecx + 0x7632cb98]
adc byte [esp + eax + 0x34], al
dec edx
adc ebp, dword [edi - 0x6e]
jl 0x4bd01d
jo 0x4bcfdc
test al, 0x26
js 0x4bd033
js 0x4bd033
aam 0x53
ret 0xae93
cmp ebp, eax
sub al, 0x5a
mov bl, 0x76
bound eax, qword [ecx - 0x32063dd]
insb byte es:[edi], dx
dec ebp
sbb al, 0x5c
or byte [ecx], dl
sub al, 0x1e
mov ecx, cr6
arpl word [eax + 0x24], di
fistp word [eax + 0x43ac53c7]
invalid
call eax
push ss
pop es
xor eax, dword [ebx + 0x1a]
aaa
mov ebx, 0x2f68510f
test byte [edi + 0x1b], ah
push esi
mov esp, 0xecff51e1
popfd
xlatb
invalid
Function at 0xc60058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c601a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc6007e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc6006a
add dl, dl
jne 0xc60089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc600dc
xor eax, eax
add dl, dl
jne 0xc60096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc6017d
add dl, dl
jne 0xc600a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc600b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc600bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc600c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc600d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc60075
mov eax, 1
add dl, dl
jne 0xc600ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc600f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc600e1
sub eax, ebx
mov ebx, 1
jne 0xc60128
mov ecx, 1
add dl, dl
jne 0xc6010e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc60119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc60105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc60075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc6013f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc6014a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc60136
cmp eax, 0x7d00
jae 0xc6016d
cmp eax, 0x500
jb 0xc60168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc60075
cmp eax, 0x7f
ja 0xc60170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc60075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc6019e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc60075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4228e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
jmp 0x4228fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x422901
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4228f0
mov eax, 1
add ebx, ebx
jne 0x422913
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x422908
jne 0x422924
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422908
xor ecx, ecx
sub eax, 3
jb 0x422938
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4229aa
mov ebp, eax
add ebx, ebx
jne 0x422943
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422950
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x422974
inc ecx
add ebx, ebx
jne 0x422960
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x422955
jne 0x422971
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x422955
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x422994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x422985
jmp 0x4228f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x422994
add edi, ecx
jmp 0x4228f6
pop esi
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x4229f3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4229b1
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22030]
or eax, eax
je 0x4229ed
mov dword [ebx], eax
add ebx, 4
jmp 0x4229ce
call dword [esi + 0x2202c]
mov ebp, dword [esi + 0x22034]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x422a27
sub esp, 0xffffff80
jmp 0x403a55

Function at 0x414de2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx], edx
sub ecx, 0x97eb714f
mov eax, esi
dec esi
add ebx, 4
add eax, 1
cmp ebx, edi
jne fcn.00414de2
add eax, ecx
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x62176502
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x44396e80
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x419b24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x419b33
pop dword [ebp - 0x48]
mov eax, 0x8f41b0e0
add eax, 0x70ffea53
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x5492f
push 0
mov eax, 0x4fea2fab
sub eax, 0x4fa57cfb
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x7204c47e
add ecx, 0x8dfb956a
xor edx, edx
add edx, eax
mov esi, 0x98869946
add esi, 0x67c1f4ba
add esi, dword [ebp - 0x48]
mov ebx, 0x31a4218c
sub ebx, 0x27f08458
mov edi, dword [esi]
add dword [ebp - 0x3c], ecx
xor edi, ebx
mov dword [ebp - 0x10], 0x373275da
mov dword [edx], edi
sub dword [ebp - 0x44], eax
add edx, 0xbe8c0476
sub edx, 0xbe8c0472
add esi, 0x9203839d
sub esi, 0x92038399
loop 0x419b94
add eax, 0xb2af46a3
sub eax, 0xb2adec30
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret