joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440a68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
enter 0x28, 0
push ebx
push edi
push esi
test dword [ebp + 0xc], 0xc000
jne 0x440a87
mov eax, dword [0x45860c]
mov eax, dword [eax]
and eax, 0xc000
or dword [ebp + 0xc], eax
test dword [ebp + 0xc], 0x8000
jne 0x440a97
or dword [ebp + 0xc], 0x4000
mov eax, dword [ebp + 0xc]
and eax, 0x700
sub eax, 0x100
je 0x440ad7
sub eax, 0x100
je 0x440ade
sub eax, 0x100
je 0x440ad0
sub eax, 0x200
je 0x440ac9
sub eax, 0x100
je 0x440ade
sub eax, 0x100
jne 0x440ae5
mov esi, 1
jmp 0x440aea
mov esi, 2
jmp 0x440aea
mov esi, 4
jmp 0x440aea
mov esi, 5
jmp 0x440aea
mov esi, 3
test dword [ebp + 0xc], 0x100
je 0x440b21
lea eax, [ebp + 0x10]
lea edx, [ebp - 4]
mov dword [ebp - 4], eax
mov ebx, dword [edx]
add ebx, 4
mov dword [edx], ebx
mov eax, dword [ebx - 4]
and eax, dword [0x458df0]
test eax, 0x80
je 0x440b1a
mov edi, 0x80
jmp 0x440b1f
mov edi, 1
jmp 0x440b32
push dword [ebp + 8]
call sub.KERNEL32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
jne 0x440b32
xor edi, edi
mov eax, dword [ebp + 0xc]
and eax, 3
or eax, eax
je 0x440b44
dec eax
je 0x440b4d
dec eax
je 0x440b56
jmp 0x440b5f
mov dword [ebp - 8], 0x80000000
jmp 0x440b71
mov dword [ebp - 8], 0x40000000
jmp 0x440b71
mov dword [ebp - 8], 0xc0000000
jmp 0x440b71
push 1
call fcn.004412c0
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x440c81
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x440b8d
sub eax, 0x10
je 0x440b96
sub eax, 0x10
je 0x440b9f
sub eax, 0x10
je 0x440ba8
jmp 0x440ba8
mov dword [ebp - 0x10], 0
jmp 0x440baf
mov dword [ebp - 0x10], 1
jmp 0x440baf
mov dword [ebp - 0x10], 2
jmp 0x440baf
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 0xc]
and eax, 0x80
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push 0
push edi
push esi
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
cmp eax, 0xffffffff
mov dword [ebp - 0x20], eax
jne 0x440c2d
call sub.KERNEL32.dll_GetLastError
and eax, 0xffff
cmp eax, 0x6e
mov dword [ebp - 0x24], eax
jne 0x440c1c
test dword [ebp + 0xc], 0x100
je 0x440c0f
mov dword [ebp - 0x28], 0x50
jmp 0x440c16
mov dword [ebp - 0x28], 2
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push eax
call fcn.004412c0
add esp, 4
mov dword [ebp - 0xc], eax
jmp 0x440c81
push dword [ebp - 0x20]
call fcn.004409a4
add esp, 4
test eax, eax
je 0x440c43
or dword [ebp + 0xc], 0x2000
test edi, 1
jne 0x440c52
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
push dword [ebp + 0xc]
push dword [ebp - 0x20]
call fcn.00440f42
add esp, 8
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x440c81
push 4
call fcn.004412c0
add esp, 4
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
leave
ret
Function at 0x440c8a
Capabilities:
Read file on windows

Disassembly:
enter 4, 0
push edi
mov edi, dword [ebp + 8]
mov eax, edi
cmp eax, dword [0x458568]
jb 0x440ca8
push 6
call fcn.004412c0
add esp, 4
jmp 0x440cdc
lea eax, [edi*4]
mov edx, 0x45fcf4
mov eax, dword [eax + edx]
lea edx, [ebp - 4]
push 0
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_ReadFile
cmp eax, 1
je 0x440cd7
call fcn.0044132f
jmp 0x440cdc
mov eax, dword [ebp - 4]
jmp 0x440cdc
pop edi
leave
ret

Function at 0x440cf6
Capabilities:
Write file on windows

Disassembly:
enter 4, 0
push edi
mov edi, dword [ebp + 8]
mov eax, edi
cmp eax, dword [0x458568]
jb 0x440d14
push 6
call fcn.004412c0
add esp, 4
jmp 0x440d48
lea eax, [edi*4]
mov edx, 0x45fcf4
mov eax, dword [eax + edx]
lea edx, [ebp - 4]
push 0
push edx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_WriteFile
cmp eax, 1
je 0x440d43
call fcn.0044132f
jmp 0x440d48
mov eax, dword [ebp - 4]
jmp 0x440d48
pop edi
leave
ret

Function at 0x440dce
Capabilities:
Write file on windows

Disassembly:
enter 0x58, 0
push ebx
push edi
push esi
mov esi, dword [ebp + 8]
cmp byte [0x450069], 0
je 0x440e30
lea eax, [ebp - 0x50]
push 0x50
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
lea eax, [ebp - 0x50]
push 0x5c
push eax
call fcn.0043c742
add esp, 8
mov edi, eax
test edi, edi
jne 0x440e1b
lea eax, [ebp - 0x50]
push 0x3a
push eax
call fcn.0043c742
add esp, 8
mov edi, eax
test edi, edi
jne 0x440e1b
lea edi, [ebp - 0x50]
jmp 0x440e1c
inc edi
call fcn.00440d74
or eax, 0x10
push eax
push edi
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x440e7d
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov edx, 0x45a0e8
lea ebx, [ebp - 0x54]
push 0
push ebx
push 2
push edx
push eax
mov dword [ebp - 0x58], eax
call sub.KERNEL32.dll_WriteFile
push esi
call fcn.0043c624
add esp, 4
lea edx, [ebp - 0x54]
push 0
push edx
push eax
push esi
push dword [ebp - 0x58]
call sub.KERNEL32.dll_WriteFile
mov eax, 0x45a0eb
lea edx, [ebp - 0x54]
push 0
push edx
push 2
push eax
push dword [ebp - 0x58]
call sub.KERNEL32.dll_WriteFile
pop esi
pop edi
pop ebx
leave
ret
Function at 0x401ed0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x407048
call sym._EnterCriticalSection_4
mov ebx, dword [0x407040]
sub esp, 4
test ebx, ebx
je 0x401f1b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401f14
test esi, esi
je 0x401f14
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401ef0
mov dword [esp], 0x407048
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402100
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402228
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40218e
cmp eax, 4
jne 0x4021b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40219e
cmp edx, 4
je 0x40219e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402100
Function at 0x401230
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
push edi
push 0
push str._SignCraCK_
push 1
push 2
call fcn.00401390
push str.Enter
push 4
call fcn.004014f0
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x18
mov esi, 0x7530
push 0
push 0x401150
call edi
push 0xa
call ebx
dec esi
jne 0x401263
push str.Leave
push 4
call fcn.004014f0
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x4012e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x110]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov edx, ecx
push edi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x10], 0
and ecx, 3
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 0x4073f8
call esi
call fcn.00401290
test eax, eax
je 0x40136a
mov al, byte [esp + 0x120]
test al, al
je 0x40136a
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push 0x407408
call esi
lea edx, [esp + 0x10]
push edx
push 0x40741c
push ebx
push ebp
call fcn.00401700
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret
Function at 0x4014f0
Capabilities:
Copy file
Delete file
Print debug messages
Write file on windows

Disassembly:
mov eax, 0x1114
call fcn.00404340
mov eax, dword [0x40733c]
push ebp
push esi
mov esi, dword [esp + 0x1120]
cmp esi, eax
push edi
jb 0x4016e9
mov eax, dword [esp + 0x1128]
test eax, eax
je 0x4016e9
mov ecx, 0x200
xor eax, eax
lea edi, [esp + 0x20]
cmp esi, 8
rep stosd dword es:[edi], eax
mov ecx, 0x240
lea edi, [esp + 0x820]
rep stosd dword es:[edi], eax
jbe 0x401542
xor esi, esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
push str.GWCLI
shl esi, 4
add esi, 0x407344
and ecx, 0xffff
push esi
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x22]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
push str.__02d__02d__02d:_02d:_02d___s___s_
lea eax, [esp + 0x40]
push 0x800
push eax
call fcn.00401700
mov edx, dword [esp + 0x1150]
lea ecx, [esp + 0x1154]
push ecx
push edx
lea eax, [esp + 0x850]
push 0x800
push eax
call dword [sym.imp.MSVCRT.dll__vsnprintf]
mov esi, dword [sym.imp.MSVCRT.dll_strncat]
lea ecx, [esp + 0x858]
push 0x7ff
lea edx, [esp + 0x5c]
push ecx
push edx
call esi
add esp, 0x44
lea eax, [esp + 0x20]
mov byte [esp + 0x81f], 0
push 0x4074a0
push eax
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
push 0x7ff
lea ecx, [esp + 0x24]
push 0x4074a4
push ecx
call esi
mov al, byte [0x407340]
add esp, 0xc
test al, 1
mov byte [esp + 0x81f], 0
je 0x40162e
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test byte [0x407340], 2
je 0x4016e9
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push ebp
push 0x40000000
push str.c:gwlog.txt
mov dword [esp + 0x28], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4016e9
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push ebp
push ebp
push esi
call edi
cmp eax, 0x400000
jbe 0x40167f
mov ebp, 1
push 2
push 0
push 0
push esi
call edi
cmp eax, 0x500000
jbe 0x40169f
push 0
push 0
push 0
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea eax, [esp + 0xc]
push 0
push eax
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x4016e9
push 0
push str.c:gwlogbk.txt
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push str.c:gwlog.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebp
add esp, 0x1114
ret
Function at 0x401b80
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x128
push ebp
xor ebp, ebp
push esi
push ebp
push 0xa
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x401c02
push ebx
lea eax, [esp + 0xc]
push edi
push eax
push esi
mov dword [esp + 0x18], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x401bee
mov edi, dword [esp + 0x13c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea ecx, [esp + 0x34]
push ecx
push edi
call ebx
test eax, eax
je 0x401bdc
lea edx, [esp + 0x10]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401bee
jmp 0x401bbf
mov eax, dword [esp + 0x140]
mov ecx, dword [esp + 0x18]
mov ebp, 1
mov dword [eax], ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebx
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret
mov eax, ebp
pop esi
pop ebp
add esp, 0x128
ret

Function at 0x4036f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x110]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x110]
push esi
mov edx, ecx
push edi
xor eax, eax
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
mov byte [esp + 0x10], 0
and ecx, 3
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
rep stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x11]
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push str.ProgramFiles
call esi
call fcn.00401a90
test eax, eax
je 0x40377a
mov al, byte [esp + 0x120]
test al, al
je 0x40377a
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
push 0x104
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ecx
push str.ProgramFiles_x86_
call esi
lea edx, [esp + 0x10]
push edx
push str._sGatewaySSLVPN
push ebx
push ebp
call fcn.00401700
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x403a00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea edx, [esp]
push eax
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403a41
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
mov dword [ecx], edx
add esp, 8
ret 8
Function at 0x403c00
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x120
lea ecx, [esp + 8]
push ebx
push ebp
push esi
push edi
call fcn.00403870
mov edi, dword [esp + 0x13c]
mov esi, 0x10008
test edi, edi
je 0x403c28
mov esi, 0x10108
mov ebx, dword [esp + 0x138]
test ebx, ebx
jne 0x403c4c
lea ecx, [esp + 0x18]
call fcn.00403880
pop edi
pop esi
pop ebp
mov eax, 0x3f2
pop ebx
add esp, 0x120
ret
mov ebp, dword [esp + 0x134]
push edi
push ebx
push ebp
call fcn.00403d30
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push esi
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x403d0f
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x40]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x34], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, 0x103
je 0x403cc8
test esi, esi
jne 0x403d04
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x30]
push edi
push ecx
push edx
call fcn.00403c00
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403c78
jmp 0x403d04
lea ecx, [esp + 0x24]
call fcn.00403870
push edi
push ebx
push ebp
call fcn.00403d30
add esp, 0xc
test edi, edi
je 0x403cf1
push edi
push ebx
push ebp
call fcn.00403b90
mov esi, eax
add esp, 0xc
test esi, esi
je 0x403cfb
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0x24]
call fcn.00403880
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
call fcn.00403880
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret

Function at 0x4015d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401607
cmp dword [esp + 0x10], 2
jne 0x401607
cmp dword [esp + 4], 6
jb 0x401607
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x401610
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 4]
mov edx, dword [esp + 0x4c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x3c
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x14], str.runas
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
pop edi
add esp, 0x3c
ret
Function at 0x52f698
Capabilities:
Encode data using xor

Disassembly:
add bl, ch
jno 0x53f69f
add byte [esi + 7], bh
mov dword [ecx + 0x10], 0xff
mov eax, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
in al, dx
cmpsb byte [esi], byte es:[edi]
mov edi, 0xb8003c41
pop ss
mov ecx, 0xe740fca5
adc esi, 0x704fc93c
push dword [0x8f1a3d06]
mov bl, 0x10
test ah, bh
xor byte [ebx + eax*8 + 0x4d], cl
cmc
invalid

Function at 0x64b078
Capabilities:
Encode data using xor

Disassembly:
add dword [edx - 0x43dfb352], esi
xor eax, esp
ror byte ss:[0xe76dbc5d], 0xfc
popfd
js 0x64b0e7
inc ebx
sal ecx, 0x7c
sbb eax, 0x80178d09
inc edx
sal byte [ecx + 0x2c], 0x2d
in eax, dx
inc edi
mov al, byte [0x6486ed74]
sbb ebx, edi
or byte [edi], dl
cdq
add byte [edi + 0x14], ch
mov ebx, 0x41c3c024
or eax, 0xa599ef87
sbb eax, 0x2aab097c
in eax, 0xf8
invalid
adc al, 0x82
iretd
Function at 0x654d28
Capabilities:
Encode data using base64

Disassembly:
test dword [ecx], edx
retf
scasb al, byte es:[edi]
dec esi
pop ebp
sar dword [ecx - 0x25], 0xfc
adc byte [edi + 0x57], bl
pop edi
push edi
jle 0x654d97
sub eax, 0x55da4bcf
popal
mov bh, 0xd7
daa
adc ch, byte [0xc3f2a6d7]
sub bh, byte [esi]
sahf
loopne 0x654d16
mov cs, word [ecx - 0x40]
rcl dword [esi], 0x31
rcl ah, 0xb6
or al, 0xcd
aas
int 0x3f
jnp 0x654d52
sub al, 0x17
arpl word [ebx + 0x6f688bc7], dx
stosd dword es:[edi], eax
cmp dh, byte [eax - 0x62832f6]
je 0x654dd3
push ebx
mov dword [esi], ebp
sti
inc eax
mov esi, dword [ebx]
xchg ebx, eax
into
inc esi
jno 0x654d30
xchg edi, eax
ret 0x42d1
mov ebx, 0x2c5b43d7
pop es
fdivr qword [esi - 0x45]
popal
mov dh, 0xf
in eax, dx
imul esp, dword [esi - 0x7d3f4a00], 0xffffffd7
ljmp 0x7dec
mov esi, dword [edx + 0x39ba38df]
sub eax, 0x42afa11e
std
outsd dx, dword [esi]
jecxz 0x654d2a
in al, dx
std
shl esp, 1
xor dword [edi + 0x3a], edx
cld
popal
int3
outsb dx, byte [esi]
xchg edx, eax
xchg edi, eax
mov dword [0xb5f43ab0], eax
jno 0x654d7a
or edx, 0x3d51de4f
push eax
mov ds, word [ecx + 0x23a0b7b]
cmp al, byte [edx]
cmp al, 0xa7
mov byte [ecx - 0x55], ah
sub ch, byte [edx - 0x29]
cmpsd dword [esi], dword es:[edi]
jb 0x654e00
xchg ebx, eax
mov edx, dword [ebx]
movsb byte es:[edi], byte [esi]
mov ecx, 0x54add20d
int3
or eax, 0xcc54add2
inc esp
mov ecx, 0xedb6aea2
dec esi
in eax, dx
sahf
jle 0x654e5b
movsb byte es:[edi], byte [esi]
daa
lodsd eax, dword [esi]
cmp ebp, dword [edi + 2]
dec ebp
jae 0x654e6c
loope 0x654de8
xchg dword [edi], esi
add al, 0x9b
jnp 0x654e8a
jp 0x654e49
fisubr dword [edi]
aam 0x3c
push cs
enter 0x6b20, 0x16
pushfd
adc edi, ebp
iretd
out 0xb6, al
jne 0x654ec0
mov al, byte [0x754bf7d]
imul esi, esp, 0x9980a66
shr dword [esi + 0x3021d88e], 0x2d
pop eax
lahf
std
fsub dword [ecx]
xor byte [0xfd9f2658], ch
dec edx
nop
mov ch, 0xbd
and dword [eax], ebx
cld
xchg ebx, eax
or al, 0xd6
salc
jb 0x654dfa
inc edx
cmc
invalid
mov eax, edi
std
loope 0x654e21
fcom st(3)
mov edi, 0xd026d618
outsb dx, byte [esi]
test al, 0xa
test ah, ch
mov byte fs:[ecx + ecx*8 + 0x171f7379], al
pop eax
std
inc edi
lea edx, [eax + 0x5eef1466]
lea eax, [ecx + 0x39]
iretd
push ebx
sti
push ebx
xchg ebp, ebp
or byte [0x4017e741], 6
jmp 0xf576ac0c
Function at 0x1000ce19
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov edx, 0x811c9dc5
xor ecx, ecx
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 4
jb 0x1000ce27
pop esi
mov eax, edx
pop ebp
ret 4
Function at 0x1000e852
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push ebx
push esi
mov esi, dword [0x1018938c]
xor ebx, ebx
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0x1a], 0x7d
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x7f
mov byte [esp + 0x1e], 0x70
mov byte [esp + 0x1f], 0x5b
mov byte [esp + 0x20], 0x7d
mov byte [esp + 0x21], 0x7a
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x7e
mov byte [esp + 0x25], 0x7e
mov byte [esp + 0x26], 0x4c
mov byte [esp + 0x27], bl
mov al, byte [esp + 0x19]
mov eax, ebx
sub byte [esp + eax + 0x19], 0xb
inc eax
cmp eax, 0xe
jb 0x1000e8b5
mov byte [esp + 0x10], 0x71
mov byte [esp + 0x11], 0x6b
mov byte [esp + 0x12], 0x78
mov byte [esp + 0x13], 0x74
mov byte [esp + 0x14], 0x6b
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x16], 0x39
mov byte [esp + 0x17], 0x38
mov byte [esp + 0x18], bl
mov al, byte [esp + 0x10]
mov eax, ebx
sub byte [esp + eax + 0x10], 6
inc eax
cmp eax, 8
jb 0x1000e8f2
push 1
push 0xa
push 0x1000e641
push ecx
lea eax, [esp + 0x29]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1005d160
pop ecx
push eax
mov ecx, esi
call fcn.1005b8cf
mov byte [esp + 0x19], 0x4e
mov byte [esp + 0x1a], 0x7d
mov byte [esp + 0x1b], 0x70
mov byte [esp + 0x1c], 0x6c
mov byte [esp + 0x1d], 0x7f
mov byte [esp + 0x1e], 0x70
mov byte [esp + 0x1f], 0x5b
mov byte [esp + 0x20], 0x7d
mov byte [esp + 0x21], 0x7a
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x23], 0x70
mov byte [esp + 0x24], 0x7e
mov byte [esp + 0x25], 0x7e
mov byte [esp + 0x26], 0x62
mov byte [esp + 0x27], bl
mov al, byte [esp + 0x19]
mov eax, ebx
sub byte [esp + eax + 0x19], 0xb
inc eax
cmp eax, 0xe
jb 0x1000e971
mov byte [esp + 0x10], 0x6e
mov byte [esp + 0x11], 0x68
mov byte [esp + 0x12], 0x75
mov byte [esp + 0x13], 0x71
mov byte [esp + 0x14], 0x68
mov byte [esp + 0x15], 0x6f
mov byte [esp + 0x16], 0x36
mov byte [esp + 0x17], 0x35
mov byte [esp + 0x18], bl
mov al, byte [esp + 0x10]
sub byte [esp + ebx + 0x10], 3
inc ebx
cmp ebx, 8
jb 0x1000e9ac
push 1
push 0xa
push 0x1000e6ca
push ecx
lea eax, [esp + 0x29]
mov ecx, esi
push eax
lea eax, [esp + 0x24]
push eax
call fcn.1005d160
pop ecx
push eax
mov ecx, esi
call fcn.1005b8cf
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000e9e1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [0x1018938c]
xor ecx, ecx
mov byte [ebp - 0xf], 0x77
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0xd], 0x71
mov byte [ebp - 0xc], 0x72
mov byte [ebp - 0xb], 0x6e
mov byte [ebp - 0xa], 0x68
mov byte [ebp - 9], 0x31
mov byte [ebp - 8], 0x67
mov byte [ebp - 7], 0x6f
mov byte [ebp - 6], 0x6f
mov byte [ebp - 5], cl
mov al, byte [ebp - 0xf]
sub byte [ebp + ecx - 0xf], 3
inc ecx
cmp ecx, 0xa
jb 0x1000ea1e
lea eax, [ebp - 0xf]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x54], eax
pop esi
leave
ret