joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49ee75
Capabilities:
Encode data using xor

Disassembly:
cli
imul esi, ebp, 0xa0c263c6
lds eax, [esi]
test ah, bl
pop eax
out dx, al
mov esp, 0xb5e86061
pop esp
add eax, 0x1d9148
dec eax
sub al, 0x95
add ebp, edx
test eax, 0xdd3179e5
in eax, 0x79
xor ebp, ebx
mov al, byte [0x7dddc09e]
stc
les eax, [ebp + 0x46]
inc esp
lahf
jg 0x49ee95
popal
push esp
lahf
inc ecx
adc edx, ecx
sti
fst qword es:[ebp - 9]
salc
push 0x36
sahf
mov esp, ebx
sbb byte [ebp + 0x3d76aa4d], 0x44
dec esi
mov dword [0xf0bf0deb], eax
push 0x5eca675
hlt

Function at 0x4df795
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x5d444e
mov dword [0x7b4b8581], eax
or bl, ah
test al, 0xfe
invalid

Function at 0x4e8e5a
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx + 0x6dd89368], esi
fstp xword [ebx - 8]
imul ecx, dword [edx], 0xfffffffc
cmpsb byte [esi], byte es:[edi]
or al, 0xcc
push es
sub al, 0xaa
push eax
rcl byte [ebx + 0x74df58a]
jge 0x4e8e8f
cmp ch, byte [edx + 0x36a53f1a]
adc esp, ebx
cmp byte [edi + 4], dl
xor eax, 0x87642734
invalid
xor al, 0x88
jno 0x4e8df7
lodsb al, byte [esi]
invalid
push 0xae7c426d
insd dword es:[edi], dx
out 0x2d, al
invalid

Function at 0x4f8474
Capabilities:
Encode data using xor

Disassembly:
rol byte [esi - 0x33], cl
or eax, 0xbf92e787
sbb cl, 0x91
dec eax
lodsd eax, dword [esi]
mov al, 0x6a
pop edx
jle 0x4f84cf
cmp al, 0xda
nop
out dx, eax
sbb eax, 0x2c66f6c1
add al, 0xd4
mov esi, esp
xor eax, 0x398cb3bf
xchg esi, eax
or dword [ebp - 0x42feab9a], ebx
fucomi st(1)
sbb al, 0x10
adc eax, 0x161fc2ad
pop esp
inc eax
mov bl, 0x3c
outsd dx, dword [esi]
mov eax, dword [0x464e8b07]
aaa
mov ebp, 0xf46b791d
mov bh, 0xb2
pop edx
jl 0x4f8442
nop
and eax, 0xf14ea1a2
xor dword [edi + 0x33], esi
xchg esi, eax
cwde
pop ebp
lea ebp, [edi + 0xd]
adc eax, 0x53245ad8
sbb eax, 0x730fe944
invalid
jbe 0x4f8509
add cl, byte [ebx - 0x7e]
inc edx
rcr byte [esi + esi*4 + 0x58], 1
mul dword [ebx + ebx*2]
or eax, 0xfb8f3be9
add esi, esi
and eax, 0x500b7af6
mov dword [ebx - 0x47], esp
xchg esi, eax
scasb al, byte es:[edi]
jne 0x4f84b1
mov cl, 0x6b
push esi
sbb byte [edx - 0x3eb29ed3], al
pop es
not dword [ecx - 0x36]
or esp, dword cs:[eax]
invalid
invalid
ja 0x4f84bd
inc eax

Function at 0x535ab3
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor byte [ebp + 0x66], dh
add dword [ecx - 0x2bcbd62f], edx
sub dword [esp + edx*8], esi
sub dword [esp + edx*8], esi
xchg edx, eax
in eax, dx
xor byte [ecx], al
sub ecx, ecx
dec ebp
push esp
out dx, al
arpl word [ebx], cx
mov ch, 0xb1
inc esp
fcom dword [edi]
pop ebx
jne 0x535aad
xor esp, dword [ecx + 8]
sbb ebp, dword [edi - 0x1d3c5c17]
rcl byte [ebx], 0xe0
mov al, byte [0xfc634b85]
mov al, byte [0x68e1009e]
or esi, dword [edi - 0x46]
aam 0x87
mov esp, 0x881e63b1
push ecx
add eax, 0xb089bd0c
fstp qword [ecx]
inc eax
pushfd
mulps xmm6, xmmword [esi - 0x44411e1b]
sar byte [ebx - 0x30], cl
or eax, 0x12d838a3
invalid
Function at 0x541155
Capabilities:
Encode data using xor

Disassembly:
cmp dl, byte [esi - 0x63a62342]
sbb esp, dword [ecx - 0x5880ea3d]
pop ss
sbb al, 0x5e
inc ecx
lodsb al, byte [esi]
mov eax, 0xdcb11e9c
sub byte [eax - 0x58], 0xcc
test al, 0xcc
test al, 0xcc
mov ecx, 0x83c86e9b
inc eax
salc
pavgb mm0, qword [ecx]
scasd eax, dword es:[edi]
jo 0x54113d
js 0x54118f
push ecx
fsubrp st(0)
inc ebp
je 0x541176
xor eax, dword [ebx - 0x70600437]
shl byte [ebp + edx*8 - 0x5cbb0f03], 1
dec ebp
adc al, 0xd9
dec edx
xor ebp, dword [edx + 0x5c]
pop esi
pop ss
salc
imul esi, dword [ebx - 0x43825fb4], 0x58
rol byte [ecx - 0x5cb986b1], 0x69
or cl, byte [edi]
lodsd eax, dword [esi]
invalid
invalid
mov dword [0xad0f0a69], eax
in eax, dx
mov bl, 0xcb
leave
aam 0x63
loopne 0x541171
into
rcl dword [edx]
pop ecx
stosd dword es:[edi], eax
inc esp
jb 0x5411df
rcl ebp, 1
mov fs, word [eax]
call dword [eax - 0x78]
das

Function at 0x570dd4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.00579de3
mov dword [esp + 0x28], 0
test esi, esi
jne 0x570e1a
xor eax, eax
jmp 0x570e1d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0057a418
lea eax, [edi + 0x7c]
test eax, eax
je 0x570e38
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0057a77d
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x570e76
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0057a77d
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.00579afd
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0057a499
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x579afd
Capabilities:
Encode data using xor

Disassembly:
and dword [ecx + 0x6f], esp
xchg dword [edx + ebp*2 + 0x75584885], edi
cwde
add al, 0x67
push ebx
add eax, 0x56843bf6
mul dword [ebp + 0x66]
mov bh, 0x6c
mov ch, 0xa7
push ebx
lahf
mov dl, 0x1c
cmc
mov dh, 0x60
xor dword [0x5518726e], edx
jp 0x579b1c
cmpsd dword [esi], dword es:[edi]
pop edi
xchg edi, eax
jne 0x579b70
aad 0x8a
adc eax, 0x714d3957
sbb eax, 0x72585d04
mov edi, 0xb450b7a
mov ch, 0x13
mov ch, 0xe3
add eax, 0xbb875b2b
into
test dword [ebp + 0x4f0391e9], ecx
rcr dword [edi + 0x531cf763], cl
pop es
or dword [edi + eax], esi
jno 0x579b5b
jl 0x579b62
push es
lodsd eax, dword [esi]
test byte [ebx], cl
invalid
mov ch, 0x13
and byte [eax], ch
sbb byte [edx + 0x4d], bh
sbb dword [edx - 0x48b9ea6d], esp
dec esp
and byte [edi + 3], cl
stosb byte es:[edi], al
fisubr word [ebp + 0x11]
or eax, 0x10160960
daa
pop esp
ficom word [esi - 0x5c]
retf

Function at 0x57a624
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
jg 0x57a65b
cld
adc al, 0x56
test byte [edi - 0x67], dl
and dl, ch
jecxz 0x57a604
inc edx
jne 0x57a645
shl byte [ecx + 0xfd259e4], 1
popal
invalid
push ebp
pop ebx
std
xor al, 0xd8
in al, 0x97
invalid
jmp [edx]
Function at 0x58a205
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
and byte [ecx - 0x5474e20f], al
popal
xor ecx, 0x61ab8b1d
jbe 0x58a209
add ch, byte [eax + 0x45]
fild qword [ebp - 0x23]
pop dword [ebx]
and al, 0xf5
xor eax, 0xda362b53
mov edx, 0x883a051d
xchg ebp, eax
imul ebp, dword [esi], 0xffffffbc
mov eax, 0x17faf064
push ecx
ljmp 0x7434

Function at 0x6158b0
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebp + 0x5e], 0xffffff8b
or dword [ebp - 0xe638350], 0xffffff9c
add ecx, eax
push cs
jecxz 0x6158ec
lds ecx, [edi]
sub eax, eax
inc ebx
stosb byte es:[edi], al
xor esi, ebp
salc
cld
mov esi, 0x11ea2303
pop ecx
push ecx
call dword [eax + 0xc]
popfd
sub eax, 0x812d134f
add ch, ch
cmp al, 0xf3
outsb dx, byte [esi]
pop dword [edi + 0x10]
inc edi
adc dl, ah
invalid
inc edi
adc dl, ah
and bh, al
clc
mov byte [0xe67f92c5], al
dec esp
dec edi
fdiv qword [edx - 0x80]
jle 0x61587f
out dx, al
dec esi
sbb ebp, ebx
stosb byte es:[edi], al
xor byte [ebx + 0x3fd6c315], 0x52
and dword [edx], ebp
popfd
clc
shl ebx, cl
inc ecx
add ecx, dword [ebp + edx - 0x5413471a]
mov word [0xabecb8e6], ss
xor ah, byte [ebx - 0x4d]
aas
jne 0x61592d
add edi, dword [eax + 0x49bfa4b3]
and dword [esi], ecx
add eax, 0xa130ddfb
popfd
movq mm0, qword [edx + 0x75]
and byte [ebp + 0x2712088a], ch
sti
fnsave dword [eax]
mov eax, dword [0x426f0f9d]
xor byte [ecx + 0x426f0f9d], ah
jne 0x615916
lodsd eax, dword [esi]
mov cl, byte [eax]
adc ah, byte [edi]
add byte [ebx], 0x5c
dec edi
lcall 0x5d92, 0xaa823db2
pop eax
xchg edx, eax
or eax, 0xd227e2d2
jecxz 0x6158ee
sub al, 0xfd
push ds
out dx, al
and eax, 0xc3cdf4dd
fisub dword [edx + 0x7d]
sal byte [ebx + 0x73608dfc], cl
mov byte [0xac525c8c], al
mov eax, dword [0x8b3aeb0b]
sal bl, cl
cmp eax, 0xc1fe3202
hlt
cmp eax, 0xc1fe3202
in eax, dx
adc bl, ch
add al, cl
mov cl, 0xb1
pop dword [esi]
out 0x64, al
inc esi
adc ebp, dword [ebp - 0x53]
inc eax
sub eax, 0x825f1f84
arpl word [edx], bp
push 0xef1ccc2b
mov dword [0xdc954c01], eax
iretd
Function at 0x615ec3
Capabilities:
Encode data using xor

Disassembly:
div dl
mov dl, 0x94
fbld tbyte [0xbdc3ad72]
ja 0x615f09
int 0xc5
adc al, byte [ebx]
cmp al, 0xae
mov eax, dword [0x9f54ebc9]
test eax, 0xb07f996f
xchg byte [edx + ebx + 0x47], dh
pop ebx
mov ebp, 0x9dbe114b
dec ebx
sub eax, 0x57f33aad
sub cl, al
add esp, dword [eax - 0x23]
mov al, byte [0xbf3c1a7]
pop ds
mov esi, 0x7e3dfcfd
xlatb
imul ebp, dword [eax + 7], 0x11345426
or byte [edi + 0x4a], 0x9e
xchg dword [ecx + edi*4 - 0x74], ebx
mov cl, 0x27
dec edi
lock sub byte [eax + ecx*2 - 0x5f], ch
or esi, dword [ebx - 0x2e]
pop ecx
jae 0x615f99
inc edi
and eax, 0xd0476df1
push ebx
mov ecx, 0x504da3
push es
std
cli
lodsb al, byte [esi]
push ebp
jns 0x615f85
inc ebp
or ah, ch
inc ebx
inc edx
stosw word es:[edi], ax
fild word es:[edx - 6]
cdq
in eax, dx
xchg ah, bl
arpl word [ebx + eax*4 + 0x5d6cd30c], cx
pop ds
leave
dec esp
xchg dword [edx - 1], esp
aaa
or ah, ch
rcl bh, cl
push ebx
dec esi
mov word [ebx], es
xor dword [ebx + 0x72], esi
jae 0x615fcd
push es
out dx, al
push ebx
out 0x5b, al
and esi, eax
invalid
mov cl, 0x69
idiv byte [eax + 0x3f7f8cbf]
jg 0x615fcc
jle 0x615fab
push ebp
mov dh, byte [esi]
arpl word [eax - 0x3fadc402], cx
cmp edx, dword [edx - 0x40]
int1
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
rol byte [ebp - 0x3cec6d80], 1
shl byte [ecx + 0x7e], 1
mov ch, 0xdb
jl 0x615f8b
nop
sal dword [edi + edx*2 - 0x193eb218], cl
and dword [ecx], ebx
jns 0x615f99
jno 0x615f59
sbb byte [ebx - 0xa597c17], dh
cmpsb byte [esi], byte es:[edi]
cmc
jns 0x615fb6
dec ecx
push 0xffffffffffffffec
push edx
mov ecx, 0x148cdb53
shr dword [0xaec4e742], cl
ja 0x616038
wait
pop edi
cld
jnp 0x615fb8
dec ebp
invalid
add edi, dword [edi - 0x43]
std
inc esp
adc edx, dword [edx + 0x23]
fisttp qword [ebp + 0x46]
ja 0x61606f
dec esp
mov al, byte [0x66540a3]
push es
invalid
loopne 0x616049
jecxz 0x6160a7
and dword [ebp + 0x74a5dd70], eax
aas
popfd
movsd dword es:[edi], dword [esi]
sahf
or cl, byte [ebx - 0x78]
lds edi, [0xaf7d50b3]
fnstsw word [esi]
push ds
dec ebx
in eax, 0x37
add byte [ebx], 0x1c
scasd eax, dword es:[edi]
push ebx
xor dword [edx], eax
cmp eax, 0xca18b337
jmp 0x6160b7
cmp al, 0x1a
cmp cl, byte [eax - 0xf]
mov byte [0x5cb33d23], al
lock sub dword [ebx], 0x1359caad
wait
idiv byte [edx + 0x70]
push cs
adc ebx, dword [ebx + 0xe707af6]
je 0x616109
invalid
push esp
jmp 0xf5cfa422
mov bh, 0xc7
xchg esi, eax
clc
xor ch, cl
cmp dword [edx], eax
in eax, dx
mov word [esi - 0x2d323dcd], ds
enter 0x23bc, 0xb
adc dword [edi - 0x5dfa897a], ebp
dec edx
fidiv dword [ebp + 0x45]
dec eax
jno 0x6160e2
mov esi, 0x5aec517a
xor esi, dword [ebx]
jl 0x61617c
iretd
dec eax
jg 0x616129
mov cl, 0x5d
sti
push ebx
movsb byte es:[edi], byte [esi]
mov byte [ebx + 0x237faf6d], dh
fmul st(4)
dec esp
or byte [ebx], ch
mov edi, 0xe7dee009
in al, dx
adc cl, byte [edi + 0x1c]
pushfd
push edx
adc al, 0x43
mov esi, 0x85213313
inc edx
ret
Function at 0x40e21b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409dd3
and dword [ebp - 0x14], 0
cmp dword [0x416cac], 0
mov dword [ebp - 0x18], eax
jne 0x40e2ce
push 0x412318
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e376
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41230c
push ebx
call edi
test eax, eax
je 0x40e376
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4122fc
push ebx
mov dword [0x416cac], eax
call edi
push eax
call esi
push 0x4122e8
push ebx
mov dword [0x416cb0], eax
call edi
push eax
call esi
push 0x4122cc
push ebx
mov dword [0x416cb4], eax
call edi
push eax
call esi
mov dword [0x416cbc], eax
test eax, eax
je 0x40e2ce
push 0x4122b4
push ebx
call edi
push eax
call esi
mov dword [0x416cb8], eax
mov eax, dword [0x416cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e327
cmp dword [0x416cbc], ecx
je 0x40e327
push eax
call esi
push dword [0x416cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e327
test ebx, ebx
je 0x40e327
call edi
test eax, eax
je 0x40e31e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e31e
test byte [ebp - 8], 1
jne 0x40e327
or dword [ebp + 0x10], 0x200000
jmp 0x40e35a
mov eax, dword [0x416cb0]
cmp eax, dword [ebp - 0x18]
je 0x40e35a
push eax
call esi
test eax, eax
je 0x40e35a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e35a
mov eax, dword [0x416cb4]
cmp eax, dword [ebp - 0x18]
je 0x40e35a
push eax
call esi
test eax, eax
je 0x40e35a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416cac]
call esi
test eax, eax
je 0x40e376
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e378
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404908
leave
ret

Function at 0x433002
Capabilities:
Authenticate hmac
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
bswap edi
rol esi, 0x62
imul eax
bswap esi
rcl ebx, 0xb0
sub ebx, 0x89
bswap edi
sub ebx, 0xbc
add edi, 0xc0
bswap eax
imul ebx
rcl edi, 0x73
ror edi, 0xc5
imul edi
not edi
inc esi
rcl eax, 0xf
neg esi
not esi
inc ebx
dec edi
dec esi
rol eax, 0x68
neg eax
add edi, 0xcb
neg edi
rcl esi, 0x65
not ebx
add edx, 0xd3
dec edx
bswap edx
and esi, 0xaf
add ebx, 0x6d
inc ebx
rcr ebx, 0xc1
inc edi
bswap ebx
rcl edx, 0xd8
or esi, 0xb5
neg esi
and eax, 0xb9
bswap eax
bswap eax
inc esi
mov esi, 0x7d
bswap edx
rcl eax, 0xe
mov eax, 0x95
imul ebx
inc esi
xor ecx, ecx
xor edi, edi
dec edi
rcl edi, 0x45
neg esi
sub esi, 0x22
not edx
or eax, 0x6e
imul edi
ror ebx, 0xb6
and eax, 0xf0
sub edi, 0x91
bswap edi
neg edi
inc edx
rcr ebx, 0x9a
and edx, 0x21
sub edx, 0x5e
sub eax, 0xa1
imul eax
sub edx, 0xde
or edi, 2
sub edi, 0x12
bswap eax
bswap edi
or edi, 0x5f
imul edx
sub edi, 0x79
neg ebx
rol ebx, 0x40
bswap edx
ror edi, 0x34
inc ebx
mov esi, 0xdc
rcr ebx, 2
rcr eax, 0xbc
and esi, 0xb1
rol ebx, 0x4e
not edx
neg ebx
neg esi
bswap edi
ror eax, 0x2c
dec esi
rcr ebx, 0x82
neg esi
add esi, 0x46
dec esi
or eax, 0xf0
mov ebx, 0x26
ror edx, 0x81
rcr edx, 0x4c
mov ecx, dword [ebp + 0xc]
inc ebx
mov ebx, 0x32
imul esi
dec esi
imul ebx
imul eax
bswap edx
or eax, 0xfb
inc eax
add esi, 0xe4
rcl esi, 0x5a
rcl edi, 0xda
mov esi, 0x2f
or eax, 0xfb
rol eax, 0x61
bswap ebx
sub ebx, 0xf8
imul edx
sub edi, 0xe6
rol eax, 0x95
bswap esi
rol edi, 0x5f
mov edx, 0xde
add edx, 0x9e
bswap esi
imul edx
sub edx, 0x9f
rol edi, 0xb7
not ebx
dec edx
sbb ebx, 0x7c
bswap esi
neg edx
imul eax
mov edx, 0x91
inc esi
inc esi
bswap edx
sub esi, 0x6a
imul eax
sbb eax, 0xf2
sub eax, 0x18
mov edi, 0xe5
not eax
sbb edx, 0x11
sbb esi, 0x59
neg edx
ror esi, 0x32
mov edi, 0x84
inc eax
mov edi, dword [ebp + 8]
mov ebx, eax
mov ebx, esi
xor ebx, ebx
mov eax, ebx
xor esi, eax
mov eax, eax
xor esi, eax
mov esi, ebx
xor eax, esi
xor ebx, ebx
xor esi, eax
mov eax, esi
not byte [edi]
xor eax, ebx
mov ebx, ebx
xor ebx, ebx
xor eax, ebx
xor esi, eax
xor eax, esi
mov esi, eax
mov ebx, ebx
mov eax, ebx
sub byte [edi], 0x46
mov eax, ebx
xor eax, eax
xor esi, ebx
mov ebx, esi
xor eax, eax
mov eax, ebx
mov ebx, eax
mov ebx, eax
mov esi, eax
add byte [edi], 0x88
mov esi, eax
xor ebx, esi
xor eax, esi
mov esi, eax
mov esi, esi
xor ebx, eax
mov ebx, eax
xor ebx, ebx
mov eax, ebx
imul byte [edi]
inc edi
loop 0x4011ce
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x411ca0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x411ccd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x411ccd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x260
mov eax, dword [0x49e280]
xor eax, esp
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x264]
cmp dword [eax + 0x14], 0
push esi
push edi
je 0x4010fd
cmp dword [eax + 0x18], 8
jb 0x401032
mov esi, dword [eax + 4]
jmp 0x401035
lea esi, [eax + 4]
lea eax, [esp + 0x60]
mov ecx, eax
xor edi, edi
mov edx, 0x100
sub esi, ecx
lea ecx, [edx + 0x7ffffefe]
test ecx, ecx
je 0x401064
movzx ecx, word [esi + eax]
test cx, cx
je 0x401064
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x401044
jmp 0x401068
test edx, edx
jne 0x401070
sub eax, 2
mov edi, 0x8007007a
xor edx, edx
mov word [eax], dx
test edi, edi
jl 0x4010fd
push 0x40
push edx
lea eax, [esp + 0x24]
push eax
call fcn.0045acf0
add esp, 0xc
xor eax, eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x80]
push eax
push 0
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4010fd
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 0x25c]
xor ecx, esp
call fcn.00457c10
add esp, 0x260
ret
mov ecx, dword [esp + 0x264]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.00457c10
add esp, 0x260
ret

Function at 0x401e10
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49e280]
xor eax, esp
mov dword [esp + 0x208], eax
push ebp
xor ebp, ebp
test edi, edi
je 0x401ee6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x401ee6
test ebx, ebx
je 0x401ee6
test esi, esi
je 0x401ee6
cmp dword [esi], ebp
je 0x401ee6
lea eax, [esp + 4]
push eax
push 0x20019
push ebp
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401ee6
mov edx, dword [esp + 4]
push esi
push ebx
lea ecx, [esp + 0x10]
push ecx
push eax
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401ec3
cmp dword [esi], ebp
je 0x401ec3
mov eax, dword [esp + 8]
cmp eax, 1
je 0x401ebe
cmp eax, 2
jne 0x401ec3
push 0x100
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esi], eax
test eax, eax
je 0x401ebe
lea ecx, [esp + 0xc]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebp, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00457c10
add esp, 0x20c
ret
mov ecx, dword [esp + 0x20c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.00457c10
add esp, 0x20c
ret
Function at 0x401f00
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0xa10
mov eax, dword [0x49e280]
xor eax, esp
mov dword [esp + 0xa0c], eax
push edi
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x61a]
push ecx
mov word [esp + 0x61c], ax
call fcn.0045acf0
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x26]
push eax
mov word [esp + 0x28], dx
call fcn.0045acf0
add esp, 0x18
test esi, esi
je 0x401fa0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 3
jle 0x401fa0
cmp word [esi + 2], 0x3a
jne 0x401f6c
cmp word [esi + 4], 0x5c
je 0x401fc4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x614]
push edx
push esi
call dword [sym.imp.SHELL32.dll_FindExecutableW]
cmp eax, 0x20
jbe 0x401fdf
lea eax, [esp + 0x10]
push eax
call edi
test eax, eax
je 0x401fdf
lea ecx, [esp + 0x10]
push ecx
call edi
add eax, eax
cmp eax, 0x100
jbe 0x401fb8
xor eax, eax
pop edi
mov ecx, dword [esp + 0xa0c]
xor ecx, esp
call fcn.00457c10
add esp, 0xa10
ret
lea edx, [esp + 0x10]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 1
pop edi
mov ecx, dword [esp + 0xa0c]
xor ecx, esp
call fcn.00457c10
add esp, 0xa10
ret
push ebx
push ebp
xor eax, eax
push 0x1fe
push eax
lea ecx, [esp + 0x222]
push ecx
xor ebx, ebx
mov word [esp + 0x224], ax
call fcn.0045acf0
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x42e]
push eax
mov word [esp + 0x430], dx
call fcn.0045acf0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x18
push 0x48e2e0
lea ecx, [esp + 0x21c]
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x48e348
lea edx, [esp + 0x21c]
push edx
call edi
push esi
lea eax, [esp + 0x21c]
push eax
call edi
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x224]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x402091
pop ebp
pop ebx
xor eax, eax
pop edi
mov ecx, dword [esp + 0xa0c]
xor ecx, esp
call fcn.00457c10
add esp, 0xa10
ret
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x41c]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push eax
mov dword [esp + 0x24], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x402120
mov ecx, dword [esp + 0xc]
test ecx, ecx
je 0x402120
mov eax, dword [esp + 0x14]
sub eax, 1
je 0x402108
sub eax, 1
jne 0x402120
push 0x100
lea ecx, [esp + 0x81c]
push ecx
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [esp + 0xc], eax
test eax, eax
je 0x402120
cmp eax, 0x100
jae 0x402120
lea eax, [esp + 0x818]
push eax
jmp 0x402118
cmp ecx, 0x100
jae 0x402120
lea ecx, [esp + 0x418]
push ecx
push esi
call ebp
mov ebx, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xa18]
pop ebp
mov eax, ebx
pop ebx
pop edi
xor ecx, esp
call fcn.00457c10
add esp, 0xa10
ret