joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
dec ebx
mov edi, dword [ebp + 8]
lea eax, [ebx - 0x29]
cmp esi, eax
jle 0x429f46
push 0x2d
push 0x495c78
push 0x6e
push 0x79
push 4
call fcn.004344cc
add esp, 0x14
xor eax, eax
jmp 0x42a088
cmp ebx, 0x29
jge 0x429f67
push 0x33
push 0x495c90
push 0x78
push 0x79
push 4
call fcn.004344cc
add esp, 0x14
xor eax, eax
jmp 0x42a088
push 0x37
push 0x495ca8
lea edx, [ebx - 0x14]
push edx
call fcn.00410164
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x429f9f
push 0x3a
push 0x495cc0
push 0x41
push 0x79
push 4
call fcn.004344cc
add esp, 0x14
xor eax, eax
jmp 0x42a088
mov byte [edi], 0
lea edx, [edi + 1]
mov dword [ebp - 8], edx
add edi, 0x15
mov dword [ebp - 4], edi
push 0
call fcn.0043637c
push eax
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0043622c
add esp, 0x18
mov edi, ebx
sub edi, esi
mov eax, edi
add eax, 0xffffffd7
push eax
push 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.0040524c
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ecx + edi - 0x15], 1
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 4]
add edx, ebx
sub edx, esi
add edx, 0xffffffec
push edx
call fcn.004051dc
add esp, 0xc
push 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.004332f4
add esp, 8
test eax, eax
jg 0x42a01d
xor eax, eax
jmp 0x42a088
push 0x14
lea ecx, [ebx - 0x14]
mov edx, dword [ebp - 8]
push edx
push ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042a328
mov edx, dword [ebp - 4]
add esp, 0x10
mov esi, edx
mov edx, dword [ebp - 0xc]
xor eax, eax
jmp 0x42a046
mov cl, byte [edx]
inc eax
xor byte [esi], cl
inc esi
inc edx
lea ecx, [ebx - 0x14]
cmp eax, ecx
jl 0x42a03f
add ebx, 0xffffffec
lea edx, [ebp - 0x20]
push ebx
mov eax, dword [ebp - 4]
push eax
push 0x14
push edx
call fcn.0042a328
mov edx, dword [ebp - 8]
add esp, 0x10
mov ecx, edx
lea edx, [ebp - 0x20]
xor eax, eax
mov bl, byte [edx]
xor byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x14
jl 0x42a06d
mov eax, dword [ebp - 0xc]
push eax
call fcn.00410324
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x42a206
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x42a0c7
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
lea ebx, [eax - 0x14]
push 0x7a
push 0x495cd8
push ebx
call fcn.00410164
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x42a109
push 0x7d
push 0x495cf0
push 0x41
push 0x7a
push 4
call fcn.004344cc
add esp, 0x14
or eax, 0xffffffff
jmp 0x42a22c
push ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.0042a328
add esp, 0x10
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0x24]
cmp eax, 0x14
jge 0x42a13c
mov ecx, eax
mov edi, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
inc eax
mov cl, byte [edi + ecx]
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x42a128
push 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call fcn.0042a328
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x10], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0x42a16c
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp ebx, eax
jg 0x42a15c
push 0
call fcn.0043637c
push eax
lea eax, [ebp - 0x38]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0043622c
add esp, 0x18
lea eax, [ebp - 0x38]
push 0x14
push eax
push esi
call fcn.004054a4
add esp, 0xc
test eax, eax
jne 0x42a206
cmp dword [ebp - 0xc], 0
jne 0x42a206
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x42a1ba
cmp byte [edx], 0
jne 0x42a1ba
inc eax
inc edx
cmp ebx, eax
jg 0x42a1af
cmp byte [esi + eax], 1
jne 0x42a206
mov ecx, eax
inc eax
cmp ebx, ecx
jle 0x42a206
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x42a1eb
push 0x9b
push 0x495d08
push 0x6d
push 0x7a
push 4
call fcn.004344cc
add esp, 0x14
or ebx, 0xffffffff
jmp 0x42a1fb
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004051dc
add esp, 0xc
push esi
call fcn.00410324
pop ecx
mov eax, ebx
jmp 0x42a22c
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.004344cc
add esp, 0x14
test esi, esi
je 0x42a229
push esi
call fcn.00410324
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a3c8
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42a3e3
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42a404
cmp cl, 0x6b
je 0x42a404
push 0x72
push 0x495d50
push 0x89
push 0x80
push 4
call fcn.004344cc
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42a475
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42a44b
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42a44b
cmp dl, 0xbb
je 0x42a446
push 0x81
push 0x495d68
push 0x8a
push 0x80
push 4
call fcn.004344cc
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42a415
sub esi, ecx
test ecx, ecx
jne 0x42a478
push 0x8a
push 0x495d80
push 0x8a
push 0x80
push 4
call fcn.004344cc
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42a4a2
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004344cc
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004051dc
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x433c21
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov ebx, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x433d53
call fcn.0040fad0
test eax, eax
je 0x433d53
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.DLL_CreateDCA
mov esi, eax
push esi
call sub.GDI32.DLL_CreateCompatibleDC
mov dword [esp], eax
push 8
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x10], eax
push 0xa
push esi
call sub.GDI32.DLL_GetDeviceCaps
mov dword [esp + 0x14], eax
push ebx
mov eax, dword [esp + 0x14]
push eax
push esi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov edi, eax
push edi
mov eax, dword [esp + 4]
push eax
call sub.GDI32.DLL_SelectObject
mov dword [esp + 4], eax
lea edx, [esp + 0x18]
push edx
push 0x18
push edi
call sub.GDI32.DLL_GetObjectA
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x20]
movzx eax, word [esp + 0x28]
imul ecx, eax
mov dword [esp + 8], ecx
push 0x2d5
push str..crypto_rand_rand_win.c
mov edx, dword [esp + 0x10]
push edx
call fcn.00410164
add esp, 0xc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x433d2d
xor ebp, ebp
jmp 0x433d18
push 0xcc0020
push ebp
push 0
push esi
push ebx
mov eax, dword [esp + 0x24]
push eax
push 0
push 0
mov edx, dword [esp + 0x20]
push edx
call sub.GDI32.DLL_BitBlt
mov ecx, dword [esp + 0xc]
push ecx
mov eax, dword [esp + 0xc]
push eax
push edi
call sub.GDI32.DLL_GetBitmapBits
push 0
call fcn.0043637c
push eax
push 0
lea edx, [esp + 0x3c]
push edx
mov ecx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x20]
push eax
call fcn.0043622c
add esp, 0x18
push 0
push 0
push 0x14
lea edx, [esp + 0x3c]
push edx
call fcn.004332cc
add esp, 0x10
add ebp, ebx
mov ecx, dword [esp + 0x14]
sub ecx, ebx
cmp ebp, ecx
jl 0x433cb5
mov eax, dword [esp + 0xc]
push eax
call fcn.00410324
pop ecx
mov edx, dword [esp + 4]
push edx
mov ecx, dword [esp + 4]
push ecx
call sub.GDI32.DLL_SelectObject
mov edi, eax
push edi
call sub.GDI32.DLL_DeleteObject
mov eax, dword [esp]
push eax
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x436fb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x436fc9
cmp dword [esi + 8], 0
jne 0x436fd0
xor eax, eax
jmp 0x4370c3
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x436feb
mov dword [ebp - 4], 1
jmp 0x437048
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x437009
cmp eax, 0x7f
jle 0x437009
mov ebx, 1
xor ecx, ecx
jmp 0x437045
cmp dword [ebp - 8], 0
je 0x437045
cmp eax, 0x80
jle 0x43701f
mov ebx, 1
mov cl, 0xff
jmp 0x437045
cmp eax, 0x80
jne 0x437045
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x437041
cmp byte [edx], 0
je 0x43703f
mov ebx, 1
mov cl, 0xff
jmp 0x437045
inc eax
inc edx
cmp eax, dword [esi]
jl 0x437031
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x437053
mov eax, dword [ebp - 4]
jmp 0x4370c3
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x43705f
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x437069
mov byte [edx], 0
jmp 0x4370b8
cmp dword [ebp - 8], 0
jne 0x437081
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.004051dc
add esp, 0xc
jmp 0x4370b8
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x437096
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x437090
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x4370b8
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x4370aa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4370cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x4370e2
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x437100
push 2
call fcn.0043b3fc
pop ecx
mov esi, eax
test eax, eax
jne 0x4370f7
xor eax, eax
jmp 0x43724a
mov dword [esi + 4], 2
jmp 0x437105
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4a6304
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410164
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x43713c
mov eax, 0x41
jmp 0x437216
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x437151
mov dword [esi + 4], 2
jmp 0x4371e6
test byte [ebx], 0x80
je 0x4371bf
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x43716c
cmp dword [ebp + 0x10], 1
je 0x43716c
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x43717e
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x437187
test eax, eax
jne 0x437178
test eax, eax
jne 0x4371a0
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x4371e6
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x4371e6
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x4371af
jmp 0x4371e6
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x4371d5
cmp dword [ebp + 0x10], 1
je 0x4371d5
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.004051dc
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x4371f4
push eax
call fcn.00410324
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x43720a
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x43724a
push 0x103
push 0x4a631a
push eax
push 0xc2
push 0xd
call fcn.004344cc
add esp, 0x14
test esi, esi
je 0x437248
cmp dword [ebp + 8], 0
je 0x437241
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x437248
push esi
call fcn.0043b44c
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x43dce4
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x43dd53
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x43dd1b
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x43ed10
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
push edi
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x43edaf
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.004053cc
pop ecx
push eax
lea eax, [ebp - 0x110]
push eax
push 0x4a848a
call fcn.0040564c
add esp, 0xc
test eax, eax
jne 0x43edaf
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0xc]
jne 0x43edac
mov ecx, dword [ebp + 0x10]
mov esi, 0x4a84b6
mov edi, ecx
lea edx, [ebp - 0x110]
mov eax, edi
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push edx
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.004052f0
add esp, 8
mov eax, 1
jmp 0x43edba
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x43ed2f
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455c83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test bp, 0x63ea
cmp ebx, 3
pushfd
pushal
pushfd
lea esp, [esp + 0x2c]
je 0x44f677
push ebp
pushal
lea esp, [esp + 0x24]
jmp 0x455b24

Function at 0x4588c0
Capabilities:
Encrypt data using speck

Disassembly:
call 0x451e4b
mov byte [esp], 0xb6
lea esp, [esp + 0x20]
ja 0x45d20b
push eax
and al, bh
sub ebx, edi
rcr di, 0xb
add esp, 4
add ebx, esp
neg edi
dec di
shl al, cl
mov edi, ebx
test ch, 0xbf
shl al, 1
mov al, 0x2e
cmp ch, cl
clc
stc
repne scasb al, byte es:[edi]
push 0x99621e1
call fcn.004552f7
lea esp, [esp + 0x1c]
jne 0x452f37
shr si, cl
add ch, 0xee
sub ecx, eax
mov ecx, edi
pushfd
bt sp, dx
shl si, 0xe
movzx esi, dl
sub ecx, ebx
clc
cmp dl, 0xaa
shl si, 2
not si
lea esi, [esp + 4]
pushal
bt cx, 7
cmc
sub edi, 4
push ecx
push dword [edi]
pop dword [esp + 0x24]
stc
push dword [esp]
cmc
bt di, bx
cmp edi, ebx
lea esp, [esp + 0x28]
jns 0x45d998
pushal
pushal
pushfd
lea esp, [esp + 0x44]
ja 0x45d20b
and al, ah
sub ebx, edi
movsx di, bl
clc
not al
add ebx, esp
sub di, bp
sar di, cl
mov edi, ebx
rcl al, 7
neg al
sar al, 1
rcl al, 1
mov al, 0x2e
cmc
bt di, bx
pushfd
repne scasb al, byte es:[edi]
jmp 0x455d4a
pushal
jmp 0x455d59

Function at 0x45abc6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x452f37
cmc
bt di, si
mov esi, dword [eax + 0x3c]
bswap dx
sal dl, 6
add esi, eax
jmp 0x453c41
pushfd
mov edx, dword [esi + 0x78]
jmp 0x46332f
pushfd
jmp 0x4511f1
Function at 0x45d7aa
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x38]
call fcn.004736f8
jmp 0x453ad2
lea edx, [ebx*4 + 0x36d704d1]
test dh, 9
rol dh, 6
push ecx
btc dx, si
mov dh, ch
bsr dx, cx
push ebx
xchg dx, bx
movsx dx, cl
bsf bx, si
mov ebx, eax
not dx
mov edx, 1
cmp al, 0xa4
call fcn.0045121b
not ah
lea eax, [ebx + ecx*4 + 0x300]
call int.0044f80f
jmp 0x45e63d
push 0x2bd287ca
sub ecx, eax
lea esp, [esp + 4]
jmp 0x45b4de
rol al, cl
mov al, byte [ecx]
pushal
mov ah, al
cmc
cmc
call fcn.004559ad
lea eax, [esi*4 - 0x1610ec29]
lea eax, [ebx + edx*4]
pushfd
lea esp, [esp + 4]
call fcn.004736f8
push eax
adc dl, dl
push 0x37977e3f
jmp 0x45c37c
jmp 0x454a55
setl al
mov al, 0xad
not al
mov al, byte [ebp - 2]
call fcn.0045dbf6
hlt
mov byte [esp], cl
lea esp, [esp + 8]
jae 0x48554a
sets bl
rol ah, 4
dec bh
pop ebx
pushfd
mov ecx, dword [esp + 4]
shrd ax, sp, 1
bt bx, cx
cmp bp, bp
mov byte [ebp - 2], dl
bswap ax
cmp ecx, 4
cwde
setbe al
bswap ax
mov eax, ecx
push esp
lea esp, [esp + 0xc]
jb 0x45483c
bts ax, si
movzx ax, al
sar ah, cl
cmp ecx, 0xa
lea eax, [ecx - 0x6026cbad]
movzx ax, dl
call 0x484e1d
push dword [esp + 4]
pushfd
mov byte [esp], ah
lea esp, [esp + 0x10]
je 0x473e8c
push edx
call fcn.004558ef
add byte [eax], al
inc edi
je 0x45d81e
jb 0x45d83e
imul ebp, dword [edi + 0x6e], 0xe0c1f500
add al, 0x66
mov dword [esp], esp
cmc
push 0xd18d5c54
cmc
add eax, edx
mov byte [esp + 4], bh
mov word [esp], 0x89cd
pushfd
lea eax, [ebx + eax*4]
pushal
jmp 0x44f19f
xor edx, dword [ecx + 0x49]
mov ah, 0xbb
xor edx, edi
cmp al, 0x4c
cmc
mov bh, 0x7d
mov cl, 0x39
dec eax
stc
fsubr dword [0x27bb699a]
outsd dx, dword [esi]
pop edi
sbb eax, 0x7bcac6dd
stc
sbb dword [ecx], edx
dec ebx
popal
adc dword [ebx + 0x61], ecx
cmp dword [eax - 0x2db218ec], ebx
or eax, 0xd6d9e705
add eax, 0xcd5183ec
aad 0xde
mov edi, 0x424076a4
jp 0x45d8ab
wait
sbb dword [edi - 0x61e370b1], 0xffffffff
lodsd eax, dword [esi]
and eax, 0x3988d4ca
adc ecx, eax
add dl, byte [ecx]
xchg esp, eax
lcall 0xb407, 0xe6d43778
mov al, 0xf2
hlt
xor byte [eax - 0x50], cl
out dx, eax
popfd
push edi
cmc
out 0xb7, al
invalid
adc edx, eax
fidiv word [ebx]
and edi, ecx
push di
imul edi, dword [ebx], 0x65
adc al, 0xc4
push ss
lodsb al, byte ss:[esi]
lea ebp, [esi - 0x3bd8c3dd]
stosd dword es:[edi], eax
dec eax
or ebp, eax
cwde
cmp al, 0x27
les ebp, [ebx - 0x6717f4b8]
mov edx, 0x35cad8a4
dec edi
mov bl, 0x48
inc esp
jp 0x45d8a1
mov dword [0xb0c7f6f9], eax
test ah, ah
mov byte [esp], 0x2d
pushfd
push esi
lea esp, [esp + 0x4c]
jne 0x459c8d
call fcn.00450ee7
in al, 0x42
inc esi
out dx, eax
sar cl, 0x87
push esi
enter 0x2fed, 0x38
pop es
inc ebp
push ss
sti
or al, 0x8e
aaa
dec ecx
cli
jmp 0x45d91a
jmp 0x45d8bf
push 0x3b163f69
lea esp, [esp + 4]
jb 0x451e2d
movsx eax, al
movzx eax, byte [ebp - 2]
inc dh
btr dx, 5
not dh
sub dh, 0x4c
shr eax, 5
btr dx, 6
bt di, sp
rcr dl, cl
imul eax, eax, 0x300
bts dx, sp
lea eax, [ebx + eax*4 + 0x94d8]
jmp 0x44f7da
cmp dh, bh
xor eax, eax
jmp 0x454a63
Function at 0x45e788
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebp, ebp
sub ecx, dword [edx + 0x10]
cmc
cmp dl, 0x98
cmc
push edi
cmp ecx, dword [edx + 0x14]
pushfd
pushfd
jmp fcn.00466d6d
pushfd
push dword [esp]
lea esp, [esp + 0x3c]
jbe 0x44f71d
btr bx, 1
cmp ah, 0xe4
or edi, 0xa5f90abc
mov edi, dword [edx + 0x24]
pushfd
shrd ecx, edx, cl
cmc
xor cl, ah
add edi, eax
sets ch
rcr ch, cl
mov ebx, dword [edx + 0x20]
pushal
shl ecx, 0x1c
add ebx, eax
bswap ecx
clc
mov dword [ebp - 8], 0
sub cx, di
stc
bsr cx, sp
mov ecx, dword [edx + 0x18]
add esp, 0x24
stc
cmp ecx, 0xffff
jmp 0x458951

Function at 0x473855
Capabilities:
Encrypt data using speck

Disassembly:
mov ebx, eax
xadd di, cx
mov edi, eax
setle ch
mov ecx, 0x104
clc

Function at 0x27305be
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test eax, eax
pushal
lea esp, [esp + 0x20]
jns 0x29d0c74
pushfd
lea esp, [esp + 4]
je 0x272eb80
shrd esi, ecx, 0x14
or esi, 0x55d092d
mov esi, dword [eax + 0x3c]
neg dx
sal dx, cl
movsx edx, cl
cmc
add esi, eax
bts dx, 5
cmc
sbb edx, esp
mov edx, dword [esi + 0x78]
pushal
test ah, dh
test edx, edx
pushal
mov byte [esp + 4], al
lea esp, [esp + 0x40]
je 0x272eb80
pushal
shl ecx, cl
btr cx, di
add edx, eax
rcl ch, cl
shrd cx, di, cl
lea ecx, [ebx + 0x35c77514]
mov ecx, dword [esi + 0x7c]
bt dx, 3
add ecx, edx
bt si, bp
mov byte [esp], 0x40
pushal
mov dword [ebp - 0x10], ecx
and ch, bh
cmp bh, 0x48
mov ecx, dword [ebp + 0xc]
stc
cmp ecx, 0xffff
mov byte [esp + 4], 2
jmp 0x272dd53
lea esp, [esp + 0x40]
jbe 0x29ced91
inc ecx
mov edi, dword [edx + 0x24]
shr ebx, cl
add edi, eax
btr bx, bx
mov ebx, dword [edx + 0x20]
sub cx, si
mov ch, 0x60
add ebx, eax
neg cl
neg cx
mov dword [ebp - 8], 0
rcr cx, cl
mov ecx, dword [edx + 0x18]
movsx ax, bl
mov dword [esp], ebx
sbb eax, esp
pushfd
shr ah, 1
mov dword [esp], edx
or ah, 0xba
inc ah
sal eax, 1
shl ax, cl
mov eax, dword [ebp + 8]
jmp 0x272ba6e
Function at 0x401150
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x158
push esi
push edi
mov ecx, 0xd
mov esi, str.rundll32_printui.dll_PrintUIEntry__dl__n__3G_FAX___q
lea edi, [esp + 0x5c]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x33
lea edi, [esp + 0x91]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov word [esp + 0x48], ax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
mov dword [esp + 0x10], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
push eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x38], 0x44
push eax
push 0
mov dword [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4011f0
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop edi
pop esi
add esp, 0x158
ret
Function at 0x4014d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x9c
push eax
call esi
test eax, eax
jne 0x40151a
lea ecx, [esp + 8]
mov dword [esp + 8], 0x94
push ecx
call esi
test eax, eax
jne 0x40151a
pop edi
pop esi
add esp, 0x9c
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
dec eax
je 0x401533
dec eax
je 0x401572
pop edi
xor eax, eax
pop esi
add esp, 0x9c
ret
cmp ecx, 4
jne 0x401575
mov eax, dword [esp + 0x10]
cmp eax, 0xa
jae 0x40154f
pop edi
mov eax, 1
pop esi
add esp, 0x9c
ret
jne 0x40155f
pop edi
mov eax, 2
pop esi
add esp, 0x9c
ret
cmp eax, 0x5a
jne 0x401577
pop edi
mov eax, 3
pop esi
add esp, 0x9c
ret
cmp ecx, 4
ja 0x401585
pop edi
mov eax, 4
pop esi
add esp, 0x9c
ret
cmp ecx, 5
jne 0x4015c3
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x40159d
pop edi
mov eax, ecx
pop esi
add esp, 0x9c
ret
cmp eax, 1
jne 0x4015b0
pop edi
mov eax, 6
pop esi
add esp, 0x9c
ret
cmp eax, 2
jne 0x4015e8
pop edi
mov eax, 7
pop esi
add esp, 0x9c
ret
cmp ecx, 6
jne 0x4015e8
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4015de
pop edi
mov eax, 8
pop esi
add esp, 0x9c
ret
cmp eax, 1
mov eax, 0xb
je 0x4015ed
mov eax, 0x64
pop edi
pop esi
add esp, 0x9c
ret