joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ea66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x40
mov ebx, edi
sub ebp, edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x44], ebp
jmp 0x45ea7a
Function at 0x464d7a
Capabilities:
Terminate process

Disassembly:
ror byte [edx + 0x781589d4], cl
mov esi, 0xc88b004b
and ecx, 0xff
mov dword [0x4bbe74], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4bbe70], ecx
shr eax, 0x10
mov dword [0x4bbe6c], eax
push 1
call fcn.00469515
inc edi
add byte [eax], al

Function at 0x464da8
Capabilities:
Terminate process

Disassembly:
inc edi
add byte [eax], al
pop ecx
test eax, eax
jne 0x464db8
push 0x1c
call fcn.00464e7a
pop ecx
call fcn.004692d2
test eax, eax
jne 0x464dc9
push 0x10
call fcn.00464e7a
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.00469116
call dword [0x46e358]
mov dword [0x4bd584], eax
call fcn.00468fe4
mov dword [0x4bbe38], eax
call fcn.00468d97
call fcn.00468cde
call fcn.00467e0b
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [0x46e2d8]
call fcn.00468c86
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x464e18
movzx eax, word [ebp - 0x2c]
jmp 0x464e1b
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [0x46e34c]
push eax
call 0x4729fe
mov dword [ebp - 0x60], eax
push eax
call fcn.00467e38
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.00468b0e
pop ecx
pop ecx
ret

Function at 0x46a447
Capabilities:
Access peb ldr_data

Disassembly:
test al, 3
add byte [ebp - 0x72fbdbac], cl
dec esp
and al, 0xc
push edx
call 0x4a4ccf
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call 0x4a4daa
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [eax], ecx
mov ecx, dword [esp + 0x20]
Function at 0x46b0f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 1
push eax
call edi
push eax
call 0x4a4fcb
mov ecx, dword [esp + 0xc4]
push 2
push ecx
mov dword [esp + 0x19c], eax
call edi
push eax
call 0x4a4fcb
push 1
lea ecx, [esp + 0xc0]
mov dword [esp + 0x1b4], eax
call 0x4a4710
mov eax, dword [esi + 0x44]
mov edi, dword [esp + 0x50]
shr eax, 1
and eax, 1
mov ecx, edi
mov dword [esp + 0x144], eax
call fcn.00467af0
mov ecx, edi
mov dword [esp + 0x64], eax
call fcn.00467bb0
mov ebx, eax
mov ecx, edi
mov dword [esp + 0x58], ebx
call fcn.00467b30
mov ecx, edi
mov dword [esp + 0x44], eax
inc esp
and al, 0x44
call fcn.00467bc0
mov edi, eax
push 1
mov ecx, esi
mov dword [esp + 0x3c], edi
call 0x4a1502
add eax, ebx
push ebp
mov ecx, esi
mov dword [esp + 0x2c], eax
call 0x4a1502
lea edx, [esp + 0xb4]
add eax, edi
push edx
mov ecx, esi
mov dword [esp + 0x14], eax
call fcn.0046a3b0
mov ecx, dword [eax]
mov dword [esp + 0x3c], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x94], ebp
mov dword [esp + 0x40], edx
mov dword [esp + 0x90], 0x484298
lea eax, [esp + 0x90]
mov ecx, esi
push eax
mov byte [esp + 0x288], 8
call fcn.0046a7b0
push 0xf
call dword [0x46e418]
push eax
lea ecx, [esp + 0x178]
call 0x4a509d
push 0xffffff
push ebp
push ebp
lea ecx, [esp + 0x144]
mov byte [esp + 0x290], 9
call 0x4a504d
push 0x808080
push ebp
push ebp
lea ecx, [esp + 0x11c]
mov byte [esp + 0x290], 0xa
call 0x4a504d
push ebp
push ebp
push ebp
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x290], 0xb
call 0x4a504d
mov eax, 5
mov dword [esp + 0x164], ebp
mov dword [esp + 0x16c], ebp
mov dword [esp + 0x168], ebp
mov dword [esp + 0x170], eax
mov dword [esp + 0x17c], ebp
mov dword [esp + 0x184], ebp
mov dword [esp + 0x180], ebp
mov dword [esp + 0x188], eax
lea ecx, [esp + 0x1ec]
mov byte [esp + 0x284], 0xe
call fcn.00469840
mov ecx, dword [0x49d218]
or eax, 0x49d218
mov dword [esp + 0xb0], ecx
mov byte [esp + 0x284], 0x10
mov dword [esp + 0x54], 1

Function at 0x46b16a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0xb4
add byte [eax], al
add byte [eax - 0x72ffb790], ch
mov word [esp + esi*4], fs
add byte [eax], al
add dh, al
test byte [esp + eax*4], ah
add al, byte [eax]
add byte [ecx], dl
Function at 0x46b260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc4]
lea edx, [esp + 0x14]
push 2
push edx
push eax
call dword [0x46e0e4]
lea ecx, [esp + 0x14]
push ecx
call dword [0x46e144]
push eax
lea ecx, [esp + 0x4c]
call 0x4a4fe0
mov edi, dword [esp + 0x4c]
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x68]
neg eax
sbb eax, eax
push 4
and eax, edi
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
push edx
call dword [0x46e0b0]
lea ecx, [esp + 0x48]
call 0x4a5037
mov eax, dword [esp + 0xc4]
lea edx, [esp + 0x14]
push 2
push edx
push eax
call dword [0x46e0e8]
lea ecx, [esp + 0x174]
je 0x46b2d5
add byte [eax], al
push ecx
lea ecx, [esp + 0xc0]
call 0x4a4634
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
sub eax, edx
sub ecx, edi
push 0xf00021
push eax
push ecx
push edx
mov edx, dword [esp + 0xd0]
push edi
push edx
call dword [0x46e0a4]
jmp 0x46b68c

Function at 0x46b2d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0xc4]
lea edx, [esp + 0x14]
push 2
push edx
push eax
call dword [0x46e0e4]
lea ecx, [esp + 0x14]
push ecx
call dword [0x46e144]
push eax
lea ecx, [esp + 0x4c]
call 0x4a4fe0
mov edi, dword [esp + 0x4c]
lea eax, [esp + 0x48]
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 0x68]
neg eax
sbb eax, eax
push 4
and eax, edi
neg ecx
sbb ecx, ecx
push eax
and ecx, edx
push ecx
push edx
call dword [0x46e0b0]
lea ecx, [esp + 0x48]
call 0x4a5037
mov eax, dword [esp + 0xc4]
lea edx, [esp + 0x14]
push 2
push edx
push eax
call dword [0x46e0e8]
lea ecx, [esp + 0x174]
je 0x46b2d5
add byte [eax], al
push ecx
lea ecx, [esp + 0xc0]
call 0x4a4634
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x14]
sub eax, edx
sub ecx, edi
push 0xf00021
push eax
push ecx
push edx
mov edx, dword [esp + 0xd0]
push edi
push edx
call dword [0x46e0a4]
jmp 0x46b68c
Function at 0x46bd15
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x40
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ebp - 0x74c2812e], al
test byte [esp + edi*2], ah
add dword [eax], eax
add byte [ebx + 0x164248c], cl
mov word [esp], fs
add dword [eax], eax
invalid

Function at 0x46bd2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x40
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ebp - 0x74c2812e], al
test byte [esp + edi*2], ah
add dword [eax], eax
add byte [ebx + 0x164248c], cl
mov word [esp], fs
add dword [eax], eax
invalid
Function at 0x46cc30
Capabilities:
Access peb ldr_data

Disassembly:
dec esp
and al, 0x18
call fcn.0046a1c0
mov eax, dword [esp + 0x50]
lea edx, [esp + 0x38]
push 2
push edx
push eax
mov byte [esp + 0x70], 1
call dword [0x46e0e8]
mov ecx, ebx
call fcn.00467b30
mov ebx, eax
mov eax, edi
cmp eax, ebx
jge 0x46cc84
push edi
mov ecx, esi
call fcn.0046a2d0
push eax
push ebp
mov ecx, esi
call fcn.0046a490
cmp eax, dword [esp + 0x40]
jg 0x46cc80
inc edi
mov ebp, eax
cmp edi, ebx
jl 0x46cc5e
mov eax, ebx
jmp 0x46cc8a
cmp edi, ebx
jl 0x46cc88
mov eax, ebx
jmp 0x46cc8a
mov eax, edi
lea ecx, [eax - 1]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jle 0x46cc9b
mov dword [esp + 0x30], eax
jmp 0x46cca6
cmp edi, ebx
jl 0x46cca1
mov edi, ebx
dec edi
mov dword [esp + 0x30], edi
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x1c]
call fcn.00467af0
mov ebp, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebp
mov edi, eax
jge 0x46cced
push edi
mov ecx, esi
call fcn.0046a1f0
push eax
push ebx
mov ecx, esi
call fcn.0046a5c0
cmp eax, dword [esp + 0x44]
jg 0x46cce5
inc edi
mov ebx, eax
cmp edi, ebp
jl 0x46ccbf
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x46ccf7
cmp edi, ebp
jl 0x46ccf1
mov eax, dword [esp + 0x2c]
mov ecx, ebp
jmp 0x46ccf7
mov eax, dword [esp + 0x2c]
mov ecx, edi
dec ecx
cmp eax, ecx
jle 0x46cd00
mov ecx, eax
jmp 0x46cd09
cmp edi, ebp
jl 0x46cd06
mov edi, ebp
lea ecx, [edi - 1]
mov esi, dword [esp + 0x6c]
mov edi, dword [esp + 0x28]
mov edx, esi
mov dword [edx], edi
mov dword [edx + 4], eax
mov eax, dword [esp + 0x30]
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
lea ecx, [esp + 0x14]
call fcn.0046a1e0
lea ecx, [esp + 0x48]
mov dword [esp + 0x64], 0xffffffff
call 0x4a4daa
mov ecx, dword [esp + 0x5c]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x401fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x70
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov eax, esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x4027c0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx + 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
mov word [ebp - 0x42], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x4c], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x30]
jae 0x40216f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x50]
mov dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp - 0x68]
mov dword [esp], eax
call fcn.00402820
sub esp, 4
cmp dword [ebp + 8], 0
jbe 0x402134
cmp dword [ebp + 0xc], 3
jbe 0x402134
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], 0
mov eax, esp
lea ecx, [ebp - 0x68]
mov dword [eax], ecx
mov dword [eax + 4], 0x14d
call fcn.00401e40
mov dword [ebp - 0x74], eax
jmp 0x4020d3
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
je 0x40212f
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp + 0xc]
jne 0x40212a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x24]
mov ecx, dword [ebp - 0x48]
shl ecx, 1
add eax, ecx
mov ax, word [eax]
mov word [ebp - 0x42], ax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x28]
add eax, dword [ecx + 0x1c]
movzx ecx, word [ebp - 0x42]
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x70], 2
jmp 0x402144
jmp 0x40212f
jmp 0x402134
mov eax, dword [ebp - 0x2c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x68]
call fcn.004028e0
mov eax, dword [ebp - 0x70]
test eax, eax
je 0x402161
jmp 0x40215c
jmp 0x40216f
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x4c], eax
jmp 0x402068
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x38]
add eax, ecx
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
add esp, 0x70
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4021b0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov esi, dword [edi + 0xc]
mov eax, dword [esi]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [0x4b6400], eax
pop esi
pop edi
pop ebp
ret
Function at 0x44a810
Capabilities:
Get common file path

Disassembly:
sub esp, 0x23c
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
jbe 0x44a82f
xor eax, eax
mov ecx, dword [esp + 0x240]
lea edx, [esp + eax*2]
push ecx
push str._s.dll
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
add esp, 0x23c
ret 4

Function at 0x45fc81
Capabilities:
Encode data using xor

Disassembly:
inc edi
pop ebp
pop esi
fidiv word [edi + 0x4f87c84]
push 0x4b
in eax, dx
out dx, al
sbb dword [ecx], ebp
and edx, 0x1a
and ebp, eax
aad 0x4c
shl dword [ecx - 0x27], cl
dec ebp
ror dword [edi + 0x1e25bdaa], 1
pop edi
mov word [edi + 0x7d], cs
cmp dword [eax - 0x6df39d8e], esp
cmpsd dword [esi], dword es:[edi]
or eax, 0x2df24820
or esp, ebx
xchg ebp, eax
xor ebx, dword [edx]
mov word [ecx - 0x7b], cs
inc edx
add eax, 0xeb716e48
stosb byte es:[edi], al
cmp bl, byte [ebp - 0x27]
or dl, ah
je 0x45fcb1
movsd dword es:[edi], dword [esi]
inc ecx
mov edx, 0xc51de9c9
daa
mov esp, 0x961b9ac9
test byte [ecx + ebx*4], dl
hlt

Function at 0x4d17e2
Capabilities:
Encode data using xor

Disassembly:
inc ecx
xchg ecx, eax
ror dh, 1
sub ah, bl
fdiv dword [eax - 0x3c]
adc edi, ebx
cdq
dec ebp
adc dl, bh
mov dword [0x6f2aa394], eax
sub dword [edx + 0x8dbdf1e], edx
mov ch, cl
cmp bh, byte [ebx + 0x40]
and edi, edx
and al, 0x4a
sal dword [ebp + 0x51788f70], 0xcb
add dword [ebx - 0x10], ebx
pop es
or al, 0x58
xchg ecx, eax
xor eax, 0x9cb6eddb
Function at 0x58239c
Capabilities:
Authenticate hmac

Disassembly:
cld
add al, 0xec
cli
ret
scasb al, byte es:[edi]
inc ebp
or esi, edi
or al, 0xba
sbb eax, 0x91819be6
jns 0x582393
adc byte [0x1f3a4c1f], dh
xor eax, 0x1f3a4c1f
fucomi st(3)
jo 0x58236f
aas
add eax, 0xe3655b05
iretd
fmul dword [edi]
int 0x46
ret
xchg esi, eax
push ecx
pop edx
insb byte es:[edi], dx
jp 0x582405
arpl si, bp
out dx, al
xor dword [eax - 0x60022501], ebx
xor byte [ecx + 0x2d], cl
test eax, 0x1fec1690
in al, dx
into
ror dword [ecx + 0x7d], 0x56
cmp al, 0xe2
mov esp, 0x10027aff
aas
int1
out dx, al
mov eax, dword [0x6aaf7ce3]
fnsave dword [eax - 0x33f0d0b0]
adc al, 0x89
leave
cld
cmp esi, dword [edi]
lahf
xor eax, 0xcd5f066f
jno 0x582382
enter 0xffffffffffffdd5f, 0xfffffffffffffffc
out 0x47, al
mov ecx, 0xcbb2fa32
dec esi
fdivr qword [edx - 0x1f]
test esi, 0xd7ec8acc
push edx
jl 0x582375
mov dword [0xde581b2c], eax
in eax, 0xd1
ret 0xaacb
jno 0x5823a2
test dword [edx], edx
dec esp
xor dl, 0x1b
out 0x7e, eax
jo 0x5823a1
inc esp
std
jle 0x582450
daa
jle 0x582401
in al, dx
add dl, byte [esi + 0x209c71dd]
movntps xmmword [edx], xmm1
stc
pushfd
call 0x38b5e591
push cs
pop ebp
cmp byte [esi], cl
fmulp st(4)
sbb ch, bh
scasb al, byte es:[edi]
adc dword [ecx + 0x2da13193], ebx
insb byte es:[edi], dx
mov byte [edi - 0x34], cl
cmpps xmm4, xmmword [eax - 0x58], 0x3f
cmp al, 0xf7
jne 0x58246f
xor dword [ecx + 0x4f886c2d], esp
int3
cmp edi, dword [esi]
test al, 0xe4
nop
iretd
push ss
dec ebp
mov ecx, 0x5f9c1acb
loope 0x582488
dec eax
mov esp, 0xb9e7ee3d
mov ebx, 0xe0956ad2
xor al, 0xc9
cmp ecx, dword [eax]
xor eax, 0xfaa2cd9
push 0x77
mov esi, 0x3bea6d28
jg 0x582423
ja 0x58242f
sub byte [ebp - 0x16], ch
cmp edi, dword [edi - 0x54]
xchg dword [edi], ebx
inc ecx
sti
shr esp, cl
jo 0x58240e
cld
stosd dword es:[edi], eax
xchg esi, eax
mov ebx, 0xaf4a4f7c
stosd dword es:[edi], eax
pop esi
sub eax, 0xfcad12a3
sahf
test dword [ebx - 0x2006d228], ecx
add eax, 0xbf39a72c
invalid
Function at 0x5c9ed5
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
or dh, cl
movsd dword es:[edi], dword [esi]
mul byte [esi - 4]
xor al, 0xf6
into
cmp byte [eax + ebx*8 + 0x56], bh
mov al, byte [0x4f1b5c52]
pop esp
wait
xor eax, 0xf4d1dcdc
add eax, 0xf0263b9c
inc ebp
fnstsw word [edx]
dec ecx
clc
popfd
mov dh, 0xfd
dec esp
add byte [eax], al
pop esp
jle 0x5c9ebc
dec dword [esp + edi*4]
or al, 0xbc
int3
pushal
div byte [edi - 0x2d]
adc al, byte [edx]
outsd dx, dword [esi]
lodsd eax, dword [esi]
jge 0x5c9f42
sub ah, byte [ebx]
rol dword [ebp - 0x1d], cl
inc esp
sub edi, 0xa9e6f5eb
pop eax
mov bl, 0x6b
out dx, eax
test eax, 0xef6bb358
test byte [ebx - 0x46], cl
int3
in eax, dx
in al, dx
test bl, 0xad
jge 0x5c9e90
fstpnce st(7), st(0)
jbe 0x5c9eb2
je 0x5c9f28
hlt
xlatb
sbb byte [ebp - 0x7eb718e], 0x97
mov dh, ah
mov eax, dword [0xad34dd04]
mov bl, 0xba
js 0x5c9eea
add ch, byte [ecx + edi*4 + 0x1d]
jecxz 0x5c9eba
xchg ecx, eax
xor al, 0xea
invalid
push es
test bl, ch
ja 0x5c9fa7
mov eax, edi
xor al, 0x16
movsb byte es:[edi], byte [esi]
jl 0x5c9f42
insb byte es:[edi], dx
jg 0x5c9efc
cmpsb byte [esi], byte es:[edi]
sub eax, 0xc869f443
pop es
and al, 0x7a
jnp 0x5c9f90
cmp eax, 0xdfccca9d
add cl, byte [ebx + edx + 0x7f]
inc esp
mov al, 0xe1
jo 0x5c9f10
cmp byte [ecx - 0x68da129], dl
dec esp
stc
cmp eax, 0x469ff98c
inc edi
scasd eax, dword es:[edi]
adc al, 0xbe
enter 0x485f, 0x6f
xchg ebx, eax
sbb ebx, edi
xchg esi, eax
sub dword [edx + 9], edi
inc ebp
aaa
aam 0xd7
jne 0x5c9ff8
test al, 0x2b
lds edx, [edi]
pop ss
push esi
sbb dl, byte [ecx - 0x13]
xor byte [ebx], ch
jns 0x5c9fad
add al, 0x19
pop ds
pop es
sub byte [ebx + 0x22], bh
sub ah, ah
and ecx, ebx
jae 0x5c9f6a
outsd dx, dword [esi]
sbb ebp, dword [eax]
xchg edx, eax
popal
push es
aas
mov edx, 0x55c48d82
test al, 0x20
mov word [esi - 0x80], ss
push edx
xor al, 0x65
mov edx, 0xfb4b3263
rcl byte [ecx + 0x3e]
mov ch, 0xe3
stc
inc edx
invalid
lahf
add al, dh
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
mov al, 0x87
adc ebx, dword [ecx - 0x32]
loopne 0x5ca01e
xchg ebp, eax
imul ecx, dword [ecx + ecx*2 + 0x6e], 0xfffffffa
sub al, 0xd9
add dl, byte [eax]
lds ebp, [edx - 0x4a]
mov ah, byte [0x2f579d02]
dec esp
into
xor eax, 0xc3ebb196
pop ecx
cmp esp, dword [ebp + ebp*8 - 0x3a86a20]
mov es, ecx
in eax, dx
fiadd dword [ebx]
adc eax, 0x502d9320
ret 0xa3d5
Function at 0x5f85f2
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sbb dword [edi], ebx
sbb al, 0xa4
std
in al, 0xa
jecxz 0x5f856a
movsb byte es:[edi], byte [esi]
wait
push esi
iretd
inc ecx
outsd dx, dword [esi]
xor dh, byte [ebp + 2]
sbb eax, 0xdd0428cf
dec edx
retf 0x437d
clc
mov edx, 0x51a4a1e1
loope 0x5f856a
movsb byte es:[edi], byte [esi]
push ecx
mov byte [0x6d63e07a], dh
scasb al, byte es:[edi]
int 0x26
in eax, 0x67
neg byte [edi + edi*4 + 0x23c76614]
cld
sub dh, byte [edi + eax*4 + 0x55]
retf
lea edi, [edx - 0x269cc672]
cmp dword [ebx - 0x27], esp
push edi
sbb ebp, ebp
ja 0x5f8627
daa
and al, 0x39
cmp eax, 0xa0c84cd8
aas
imul esp, dword [ecx - 3], 0x33
fsubr dword [eax + 0x68]
pushfd
lds esp, [ecx + 0x35]
cdq
and edx, esp
xor dword [ecx], ebp
mov word [edi + 0x5d], ds
jae 0x5f85a7
pop edx
dec ebp
not dword [edi]
aaa
inc ecx
out dx, eax
stosb byte es:[edi], al
jecxz 0x5f85f5
xchg esp, eax
xor eax, 0x9c7c9c75
jne 0x5f85c5
jl 0x5f85c7
invalid
Function at 0x613ba5
Capabilities:
Encode data using xor

Disassembly:
inc edx
daa
sub byte [ecx], 0x88
sar esp, 1
mul byte [eax]
sub esi, edi
test byte [eax - 0x44], cl
in eax, 0xcd
pop edi
retf
dec eax
mov esp, 0xcb5fcde5
sbb al, byte [esi]
push esi
in al, dx
adc byte [ecx + 0x2f1119d8], dl
daa
js 0x613b76
push ss
xchg dword [edx + edi*4], ecx
test byte [ebp + 0x7c88f699], dl
push cs
movsb byte es:[edi], byte [esi]
pushfd
invalid
mov al, 0
xor dword [ebp - 0x307ba62], edi
pop es
mov dl, 2
ja 0x613af7
sbb eax, 0xda1a7950
punpckldq mm7, dword [edx]
sub eax, 0xf073dd40
into
test dword gs:[eax], 0x68dd69a6
sti
jae 0x613b04
push edi
adc dword [ebp + 0x2da18177], edi
stosw word es:[edi], ax
in eax, dx
jo 0x613b7c
scasd eax, dword es:[edi]
xchg esp, eax
out dx, eax
push 0x831e59e0
and byte [ecx + eax*8 + 0xbe340cf], dl
je 0x613bac
iretd
imul esi, dword [edi], 0x12
ja 0x613bc0
mov eax, dword [0xe53912d]
mov ecx, 0x53d0e190
xchg dword [ebx - 0xb], ebx
rcl byte [ebx - 0x79]
pop ebx
cmc
clc
mov ecx, 0x6c97be93
cmpsd dword [esi], dword es:[edi]
fisub dword [0xce0b1dd3]
mov eax, dword [0x640a6f2e]
xor dword [eax - 0x1f97fee4], ebp
loopne 0x613b89
daa
loopne 0x613b89
daa
rcl dword [eax + edi*8 + 0x42748728]
and cl, ch
js 0x613b3a
xchg dword [edx + eax*2 + 0x22], esi
int 0x78
xchg dword [ecx - 0x6c91038], eax
xchg esi, eax
or eax, 0x96f936ef
push ss
arpl word [ecx + 7], ax
xchg esi, eax
xchg edi, eax
sahf
test al, 0xfc
push 0x7bf8f617
mov byte [0xc8dfd9ac], al
jne 0x613bf1
xor al, 0xd0
mov eax, 0x255d1754
sar byte [eax + 0x255d1754], 1
and eax, 0x89770113
pop esi
push edi
in eax, 0xb0
xchg ebx, eax
mov bl, 0x7e
nop
aas
xchg esp, eax
cmpsb byte [esi], byte es:[edi]
test eax, 0x3126ebdb
add ebp, eax
bound esp, qword [edx]
mov ch, 0x92
mov ebp, 0x3790002
jne 0x613c0b
stosd dword es:[edi], eax
or eax, 0xb7b65bf3
mov dword [eax - 0x6295b571], ecx
and byte [edx - 0x2f90f9d8], dl
leave
push eax
inc edi
cmpsb byte [esi], byte es:[edi]
out 0x1d, eax
push es
mov edi, 0xa531b60c
test byte [edx - 0x59], ah
cmpsd dword [esi], dword es:[edi]
jg 0x613bcf
dec esp
les esp, [ecx]
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
mov ecx, 0x49980791
and edi, dword [ecx + ecx*4 - 0x3d34d447]
sbb al, 0x31
jb 0xa1580b27
add eax, 0xb410cc1b
xor dword [ecx + 0x41], eax
xchg byte [eax - 9], dh
adc bl, 0x64
in eax, 0x1b
push edi
pop eax
inc ecx
pop esi
xchg esp, eax
rcl dword [ecx - 0x36ae9ec0]
jge 0x613c18
pop ebp
push esp
inc ecx
ffree st(0)
and eax, 0x3ee04b2c
inc ecx
mov edi, 0x45546da5
sub edx, dword [edi - 0x6b]
scasb al, byte es:[edi]
popfd
xchg esi, esp
out 0xd1, al
xor eax, 0x5d0e6f5
pop edx
out dx, eax
inc edx
cmc
inc ebx
and byte [edi], 0x52
sub eax, 0xbcc85fcc
mov byte [0x6e549f3e], ah
xor byte [ebp + 0x6674ab81], dl
arpl word [ecx], si
push esi
aas
inc edx
mov edx, 0x41e41d16
std
cmp eax, 0x22c912cb
insb byte es:[edi], dx
pop esp
inc edx
outsd dx, dword [esi]
cdq
nop
xor dh, byte [esp + edx*4 + 7]
add byte [ebp + 0x2ac837c2], 0x2f
out dx, al
and dword [0x8fbb062d], esi
hlt
Function at 0x408923
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop ebx
add edx, 0x54718edb
add edx, 0x58202c9a
call fcn.00408950
or eax, eax
xor dword [edi], ebx
and edx, edx
dec edx
inc edi
cmp edi, ecx
jne fcn.00408923
mov edx, 0x2c6ed4a2
add edx, eax
ret
Function at 0x4c63f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x4cb494]
cmp dword [eax + 0x28], 0
jne 0x4c6408
xor eax, eax
jmp 0x4c6537
mov ecx, dword [0x4cb414]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
add edx, 0xe
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [0x4cb408], ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 8]
mov dword [0x4cb404], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x10], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
mov ecx, dword [0x4cb408]
mov dword [ebp - 0x40], ecx
mov edx, dword [0x4cb404]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x40]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 0x1c], ecx
push 0
mov edx, dword [0x4cb48c]
push edx
push 0
push 0
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x40]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0x80000000
push 0x4ca604
push 0x4ca620
push 0x88
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [0x4cb400], ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.004c6330
push 5
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x4c63c0
mov edx, dword [0x4cb494]
mov eax, dword [edx + 0x34]
imul eax, eax, 0x3e8
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [0x4cb40c], eax
push 1
push 0
push 0
push 0
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x4c6537
cmp dword [ebp - 0x38], 0x12
jne 0x4c652b
mov dword [0x4cb41c], 0
call fcn.004c6540
xor eax, eax
jmp 0x4c6537
lea edx, [ebp - 0x3c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4c64fc
mov esp, ebp
pop ebp
ret 4

Function at 0x4c7840
Capabilities:
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebp
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
add ebp, 4
mov dword [ebp], 0
pop ebp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]