joyce8/EMBER2024-capa huggingface dataset:
Function at 0x64a7b4
Capabilities:
Read .ini file

Disassembly:
mov word [edi + edx*4 - 0x14c54], cx
cwde
adc edx, eax
lea ebp, [ebp + eax - 0x5344]
movzx ecx, al
add edx, eax
mov eax, dword [eax + ebp - 0x5340]
neg cl
btc dx, cx
xor eax, ebx
bswap ecx
ror cx, 0x8e
neg eax
shl cl, 0x41
sub ecx, edx
sal cx, 2
xor eax, 0xd181860e
inc ecx
not dx
lea eax, [eax + edx*4 + 0x3e1e1100]
call fcn.004f3e9f
ljmp 0x1985
dec eax
xchg dh, dl
rol dl, 0xe7
rol eax, 2
mov dword [esp + edx*8], edx
neg cl
sbb edx, dword [esp + ecx]
lea eax, [eax + edx*4 + 0x12b3c214]
or ecx, ecx
sbb dl, 0x3f
ror eax, 3
and ecx, 0x693ea427
sbb dword [esp + edx*4 - 0x304], ecx
imul edx, dword [esp + edx - 0xc1]
xor ebx, eax
push ecx
imul edx, edx
neg ecx
lea ebp, [ebp + edx - 4]
push edx
push edx
mov dword [ebp + edx], eax
movzx eax, word [esp + edx*4 + 8]
imul edx, eax
pop eax
pop eax
pop edx
pop edx
jae fcn.009a708b
mov cx, word [edi]
mov edx, 0x438023af
or dx, 0x8593
mov dx, word [edx + edi - 0x4380a7bd]
mov eax, 0x253959b8
je 0x9d8ed7
dec al
lea edi, [edi + eax - 0x253959b5]
rol al, 0xe3
not cx
sar eax, 0x81
ror eax, 0xb3
xadd al, ah
not dx
or cx, dx
movzx edx, ax
shl al, 0x86
jbe 0x5e0516
xor ecx, ebx
cwde
push edx
shr eax, 0xe8
xor ecx, 0xe730ef3f
or dl, dh
rol edi, 0x73
push edi
setae byte [esp]
mov edi, edx
push 0xa717f31b
jb 0x4e7d50
cld
mov dword [esp], 0xf1977a11
shr dword [esp + 4], 0x23
jbe 0x66c03a
rep movsb byte es:[edi], byte [esi]
push dword [esp + 0xc]
popfd
mov esi, dword [esp + 8]
lea esi, [esi + 0x2c1364]
jmp esi

Function at 0x681714
Capabilities:
Encode data using base64
Read .ini file

Disassembly:
shr cl, 0x41
not edx
bts cx, ax
btr eax, 0xc
ror edx, 1
rol eax, 0x69
neg edx
sar eax, cl
sets al
xor ebx, edx
jmp 0x6d4633
push esi
call fcn.00792790
mov ecx, 0xada35db3
lea edx, [ecx + 0x51a02305]
neg cl
mov edx, dword [edi]
adc edi, 3
movsx eax, cx
lea eax, [ecx*4 - 0x4d7bbd60]
shl cl, 0xa1
xor edx, ebx
add al, ch
and al, ah
ror edx, 1
bt ecx, 0x8c
jb 0x5e205f
mov ecx, 0x1fba520a
lea ebp, [ecx + ebp - 0x1fba520e]
bt ecx, 7
mov edx, ecx
mov ecx, dword [ecx + ebp - 0x1fba520a]
xor ecx, ebx
movzx eax, dl
not ecx
not edx
mul ax
sbb ecx, 0xf9005e2a
bts eax, 0x81
cwd
xor ecx, 0x940e9327
push edx
lea eax, [eax + edx + 0x2ea48609]
call fcn.0096a7bd
add esi, edx
dec ecx
movzx edx, byte [edi + eax - 0x4600]
cwde
ror eax, 0x4f
adc edi, 0
inc ax
je 0x65722f
inc ecx
xor dl, bl
cwde
inc eax
dec dl
xor dl, 0xc
bt ecx, 0x3a
sbb dl, 0xb0
neg dl
sal cx, 0x49
xor bl, dl
neg eax
bswap ecx
lea ebp, [ecx + ebp - 0x9ea3b1]
dec ecx
xor cx, ax
not eax
mov dword [eax + ebp - 1], edx
imul cx, cx
cdq
idiv eax
jmp fcn.008e93a9
Function at 0x688eb5
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add al, bh
rcl ax, cl
or ah, 0x80
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x463779
rol ah, cl
cwde
sar al, cl
mov eax, dword fs:[0]
clc
cmc
test edx, 0xbf276539
push eax
sub esp, 0xa60
bt eax, 0x31
mov eax, dword [0x487010]
xor eax, esp
stc
test esi, 0x851d6423
mov dword [esp + 0xa58], eax
push ebx
movsx eax, si
sal al, 0x21
cbw
push esi
cmp sp, ax
push edi
mov eax, dword [0x487010]
btr si, 0xbb
sub esi, ebp
xor eax, esp
mov si, 0x410b
push eax
lea eax, [esp + 0xa70]
cmovbe si, bp
mov dword fs:[0], eax
mov si, dx
not esi
mov esi, dword [ebp + 8]
jmp loc.00417699

Function at 0x691908
Capabilities:
Read .ini file

Disassembly:
lea esi, [esi + edx*4 - 4]
btr ecx, 0xd
sar dl, 0xe1
or dl, byte [esp + edx*2 + 0xf]
mov dword [esi + edx*4 - 0x264], eax
rol cl, 0x85
adc ecx, 0xc21ea3b9
mov dword [esp + edx*8 - 0x4c4], edx
pop ecx
pop eax
pop eax
pop ecx
js fcn.0050f018
push edi
mov edi, 0x2a967b8a
pushfd
shr edi, 0x77
shr edi, 0xf
xor di, 0x7415
mov edi, dword [esp + edi*4 - 0x1d050]
mov dword [esp + 4], 0x89d52789
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.008f3223

Function at 0x6996b6
Capabilities:
Read .ini file

Disassembly:
xchg cl, dl
shl edx, 0x38
xor ebx, eax
not edx
mov dword [esp + ecx*4 - 0x5918c704], 0xedbf3bae
add edi, eax
or dword [esp + ecx*2 - 0x2c8c6382], edx
pop eax
jae fcn.0050f018

Function at 0x6a687c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov dword [esp + 4], ebp
pop ebp
mov ebp, 0x3e26e98c
pushfd
push ecx
mov ecx, ebp
and ecx, ecx
push esi
imul ecx, ebp
push eax
lea eax, [ecx*2 + 0x621510aa]
jo 0x57c62f
jo 0x7240f9
call fcn.0053d319
jmp 0x570539

Function at 0x6b4938
Capabilities:
Read .ini file

Disassembly:
xor edx, 0x7a63739
mov dword [esp], 0xe5989d8f
bswap edx
movsx eax, cx
ror edx, 1
pop ecx
bts eax, 0x10
dec ecx
dec edx
btc eax, ecx
xor ebx, edx
sal ecx, 0xcb
adc esi, edx
lea ebp, [ebp + eax - 0x104e8]
lea edx, [ecx*8 - 0x1b66fd55]
movzx eax, word [ebp + eax*2 - 0x209cc]
and ecx, 0xd52fef3a
xor ax, bx
sub ax, 0x702
or edx, ecx
xor ax, 0x202e
btr edx, 0x82
lea ecx, [ecx - 0x6d40037f]
imul edx, ecx
rol ax, cl
inc edx
xadd edx, ecx
inc dx
not ax
inc ax
ror ax, 1
not dl
add cx, dx
xadd ecx, edx
xor bx, ax
lea edi, [edi + edx*4 - 0x5e1ed1f6]
shl ecx, cl
imul dx, dx
sbb ecx, edx
mov word [edi + edx*2 - 0x2f0e0a12], ax
jle fcn.0050c1db

Function at 0x6d9281
Capabilities:
Encode data using xor

Disassembly:
jno 0x7a8a92
inc edx
push ecx
xadd ecx, eax
xor ebx, edx
and dword [esp], 0xb6a754b3
adc esi, edx
mov edx, dword [esp]
not ax
btc ecx, 0x38
sbb ebp, 0
shl edx, 0xf6
cwd
movzx eax, byte [ebp + edx - 0x2040ffff]
sub ecx, ecx
xor al, bl
ror al, 1
neg al
ror al, 1
call fcn.006c1e39

Function at 0x6fd304
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push dword [esp + 0x10]
popfd
lea esp, [esp + 0x14]
call fcn.0079131a
Function at 0x708e6b
Capabilities:
Reference 114dns dns server

Disassembly:
bt cx, 0xb2
mov word [ebp + ecx*8 - 0x80b05c0], ax
pop eax
ror word [esp + ecx*4 - 0x40582e0], 0x6c
cdq
pop eax
jae fcn.009a708b
call sub.MFC42u.dll_CWnd::CheckDlgButton
lea eax, [ebp]
jmp 0x899748
push 0xc5b669b2
pushfd
xor byte [esp + 4], 0x28
and dword [esp + 4], 0xe48ec001
mov dword [esp + 4], 0xd3404888
push dword [esp]
popfd
lea esp, [esp + 4]
call fcn.008145be
mov ecx, 0xbf0d8fa2
movzx eax, cx
cdq
mov eax, dword [edi + eax*4 - 0x23e88]
bts cx, dx
ror edx, cl
lea edi, [edx + edi + 4]
bswap ecx
sar edx, cl
add cx, cx
xor eax, ebx
lea edx, [ecx + edx*8 + 0x12adce91]
not ecx
neg eax
lea ecx, [edx*2 + 0x721aacb3]
push edx
ror eax, 3
inc eax
and ecx, 0xfbbfb896
xor eax, 0xfd03d804
xchg ch, cl
push edx
neg eax
add dword [esp + 1], edx
xor eax, 0xee348ebe
bts edx, ecx
sbb dword [esp + 4], 0x4295349f
bswap ecx
xor ebx, eax
shl dl, 0x81
adc esi, eax
sal byte [esp + 4], 0x23
inc dword [esp + 2]
movzx eax, byte [edi]
xadd dx, cx
adc edi, 0
ror ecx, 0x7f
xor al, bl
neg al
or cx, dx
inc al
rol al, 1
mov byte [esp + ecx - 0x121fefa], 0xa5
inc cx
and dx, 0x76b4
adc al, 0x8a
and ecx, 0x6f1561b8
sal edx, 0x11
sar dl, 0x64
xor bl, al
lea ebp, [ebp + ecx*4 - 0x40582e2]
jmp 0x5830dd
call esi
push eax
push 0x40f
cmovo ecx, ebp
mov ecx, ebx
jmp 0x8f8a0a
push eax
lahf
mov ax, 0x994
bswap eax
push 1
cwde
movsx eax, bx
push str.connectionthroughproxy
cbw
mov al, 0xa2
lea eax, [ebp + 0x208]
push eax
jmp 0x75c159

Function at 0x7105dc
Capabilities:
Read .ini file

Disassembly:
mov edi, 0xa93e171d
shl di, 0x90
add edi, 0xd888010b
mov edi, 0x7b227b3f
neg di
mov edi, dword [esp + 0xc]
call fcn.005361e6

Function at 0x7240ef
Capabilities:
Check for time delay via gettickcount

Disassembly:
lea edi, [eax + edi - 0x184250f]
xor edx, ebx
imul ax, word [esp + eax*4 - 0x610944a]
ror edx, 2
btr eax, 0x91
sub word [esp + eax*2 - 0x309d9ff], ax
movsx ecx, ax
lea edx, [edx + ecx - 0x45b8d7e]
and word [esp + eax*2 - 0x309d9fe], ax
not eax
pop eax
xor edx, 0x43015310
sub al, ch
or cx, ax
call fcn.005c4ffe
push ecx
pushfd
mov ecx, 0x92bf53b6
add ecx, 0xc295542d
call fcn.00659dcf
mov esi, 0x5407c6b1
call fcn.007c8a34
push edi
mov eax, 0
mov edi, 0x60a53826
mov dword [esp + ebp - 0x3e26e974], eax
jae 0x77dc3b
jo 0x8dc2f4
mov eax, 0x1842513
push eax
sar byte [esp + eax*2 - 0x3084a23], 2
fld dword [ebp + eax - 0x1842513]
sbb dword [esp + eax*8 - 0xc212898], eax
inc dword [esp + eax*2 - 0x3084a26]
mov edx, dword [edi + eax*2 - 0x3084a26]
jb 0x539278
lea esi, [ecx*4 - 0x66d812f1]
mov esi, dword [esp + ebp*2 - 0x7c4dd2f8]
neg esi
not esi
bswap esi
lea ebp, [ebp + edi - 0x744c41f7]
not esi
xadd di, cx
adc esi, eax
rol bp, 0xa8
xor ecx, edi
bts di, di
mov dword [esp + ebp - 0x2a7fbbc3], edx
lea ecx, [ecx + ecx + 0x70224d10]
sal cx, 0xa2
mov edx, 0x1b9a23ba
mov dword [esp + ebp - 0x2a7fbbbf], ebx
call fcn.0074a6a3

Function at 0x726c52
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
neg word [esp + 8]
mov dword [esp + 0xc], 0x4dd5580a
push dword [esp]
popfd
lea esp, [esp + 0xc]
call fcn.008d84ad
Function at 0x726c75
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], 0x2e83b12c
rep movsb byte es:[edi], byte [esi]
mov esi, 0xc2a90b1a
push dword [esp + 4]
popfd
mov esi, dword [esp + 8]
call fcn.007a5b66

Function at 0x727e91
Capabilities:
Authenticate hmac
Read .ini file

Disassembly:
bswap eax
neg cx
shl dl, 0x42
xor ebx, eax
shl ecx, cl
adc esi, eax
movzx eax, cx
jmp fcn.008e93a9
push edx
rol byte [esp + eax*8 - 0x11ff6], 0xa7
xor bl, cl
not dword [esp + eax*8 - 0x12000]
btc eax, 0x1a
lea ebp, [ebp + eax*2 - 0x8004802]
neg byte [esp + eax*2 - 0x8004800]
mov word [eax + ebp - 0x4002400], cx
pop eax
pop edx
pop eax
pop ecx
jb fcn.0050cb56
add ecx, 0x881d6296
adc edi, 4
xor eax, ebx
add edx, edx
not eax
imul cx, dx
sbb dl, dh
neg eax
neg dx
imul ecx, edx
jb 0x7880d0
mov edx, 0xa2de908
lea edx, [edx + edx*2 + 0x3e994304]
lea eax, [edx + edx*4 - 0x3408300]
mov eax, dword [edi + edx - 0x5d22fe1c]
lea ecx, [edx*4 + 0x3f2ae613]
shl dl, cl
setne dl
lea edi, [edi + edx - 0x5d22fdfd]
add cx, cx
sar cl, cl
ror edx, 0x5c
xor eax, ebx
neg eax
dec edx
bt dx, dx
sar dl, 0x46
lea eax, [eax + ecx - 0x4d31244c]
call fcn.00793459
lea eax, [eax + ecx - 0x56d9e313]
xadd edx, ecx
xchg dx, cx
jp 0x5c5f83
jmp 0x7e89e1e6

Function at 0x72a83c
Capabilities:
Get graphical window text

Disassembly:
mov dword [esp + 4], 0x46b36300
lea esp, [esp + 4]
call fcn.0099cbdc
call int.0058aec3

Function at 0x764807
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 0xc]
popfd
lea esp, [esp + 0x10]
call fcn.004303c5
mov edx, dword [edi]
mov ecx, 0x28051dbe
xor cl, ch
lea edi, [edi + ecx*2 - 0x500a3b42]
xor edx, ebx
bts ecx, 0xb
lea eax, [ecx*8 - 0x34f6d1f5]
xadd cx, ax
rol edx, 1
push ecx
lea edx, [edx + ecx*4 + 0xbef208f]
bswap edx
push ecx
xadd ecx, eax
lea ecx, [ecx + eax - 0x304db2e3]
dec edx
or eax, 0xd8ac00b
not al
sub eax, 0xf2888bbb
xor ebx, edx
pop eax
add esi, edx
mov bp, word [ecx + ebp - 0x2aeedc4c]
pop eax
jmp fcn.00732732

Function at 0x76817d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
lea esp, [esp + 0x18]
call fcn.0099cbdc

Function at 0x77c584
Capabilities:
Read .ini file

Disassembly:
neg al
inc al
xor al, 0xbf
rol dx, 0xe1
mov dword [esp + ecx*2 - 0x7fdc4c36], edx
rol al, 1
dec al
dec byte [esp + ecx - 0x3fee2619]
rol al, 1
not dx
push edx
shr word [esp + ecx - 0x3fee261b], 0xce
xor bl, al
neg dword [esp + ecx*2 - 0x7fdc4c32]
push ecx
push ecx
lea eax, [esp + eax + 0x10]
sbb cl, 0xa8
mov dx, word [eax + ecx*2 - 0x7fdc4ce4]
xor cx, word [esp + ecx - 0x3fee2664]
add ecx, ecx
lea esi, [esi + ecx - 0x7fdca91a]
mov word [ecx + esi - 0x7fdca918], dx
setne byte [esp + ecx - 0x7fdca90c]
pop eax
pop eax
pop edx
pop eax
jp fcn.00557a43
mov ecx, 0xeabce0a8
movzx edx, cl
mov eax, dword [edx + edi - 0xa8]
add ecx, ecx
imul cx, dx
lea edi, [edi + edx*8 - 0x53c]
adc cx, 0x282
setge dl
xor eax, ebx
bts ecx, ecx
shl ecx, cl
not eax
dec cl
lea eax, [ecx + eax + 0x2c38ba9]
neg eax
bswap ecx
lea ecx, [edx - 0x3049fd57]
lea eax, [edx + eax + 0x401c3e85]
and ecx, ecx
bswap ecx
ror eax, 1
xor ebx, eax
btc edx, ecx
adc esi, eax
sub dx, dx
imul ecx, ecx
mov ebp, dword [ebp + edx]
movzx eax, dl
call int.0068bc05
Function at 0x788a19
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
mov edx, 0x4a3c6d35
mov dword [esp + 0xc], 0xd3580402
mov edx, dword [esp + edx - 0x4a3c6d2d]
popfd
lea esp, [esp + 8]
call fcn.0090f702
ror dl, 1
xor al, al
neg al
shr eax, 0x97
xor dl, al
ror al, 0x65
call fcn.00514307

Function at 0x79d2aa
Capabilities:
Read .ini file

Disassembly:
mov ecx, dword [esp + 4]
lea esi, [esi + ecx - 0xd3d4ab8]
mov dword [esp + ecx*2 - 0x1a7a9568], ecx
mov edx, dword [esi + ecx - 0xd3d4ab4]
xor edx, ebx
lea eax, [ecx*2 - 0x76c69d48]
lea eax, [eax*8 - 0x5bf21fe4]
push eax
neg edx
pop eax
xor edx, 0x6108080b
call fcn.00621427
mov edx, 0x8172013
shl edx, 0x5d
lea ebp, [ebp + edx - 0x60000004]
and edx, 0x2408e410
mov eax, dword [ebp + edx*4 - 0x80000000]
bt edx, edx
movsx ecx, dl
xor eax, ebx
bts dx, dx
jb 0x818c67
xor ecx, edx
xor eax, 0x771d2a21
dec cx
bswap eax
lea edx, [edx + edx + 0x33b7781e]
xor eax, 0xf8948037
bswap eax
sar cx, 0x47
xor ebx, eax
add edi, eax
push edx
lea ebp, [ebp + ecx - 0x20000001]
lea eax, [ecx + ecx + 0x218eea01]
xor eax, ecx
movzx edx, byte [ebp + edx - 0x73b77820]
xor dl, bl
ror al, 0x83
pop ecx
rol dl, 1
not ecx
xadd eax, ecx
btr ecx, 0x83
adc dl, al
dec ecx
cbw
xor dl, 0x81
neg dl
xor eax, 0xcc381c15
or ax, cx
xchg ecx, eax
xor dl, cl
xor bl, dl
sar cx, 0x84
lea esi, [ecx + esi - 0x1effec3]
mov dword [esi + ecx*4 - 0x7bffafc], edx
btr ecx, ecx
movzx edx, cl
setae cl
jae fcn.0050f018
jmp 0x9d8429
dec ax
dec cx
dec edx
xadd dx, ax
not cx
mov dword [esp], edx
xor cx, 0xd7a0
mov edx, 0xf38a8437
lea eax, [edx + edx*8 - 0x60777ae9]
mov edx, dword [edi + eax - 0x2f672b06]
lea ecx, [eax + eax*4 - 0x71d786de]
shr ecx, 0xe9
btc ax, 0x35
lea edi, [edi + eax*2 - 0x5ece5648]
xor edx, ebx
or ax, ax
neg edx
neg cl
dec edx
ror edx, 1
rol ax, 0x4c
xchg ch, cl
lea ecx, [eax + eax + 0x4013172b]
neg edx
xor edx, 0x5612c59b
sub edx, 0xedbac910
shr ax, 0xea
sbb eax, ecx
add cx, ax
xor ebx, edx
add esi, edx
shr cl, 0x46
neg ax
mov eax, dword [ebp]
inc ecx
movzx edx, cl
sub ecx, 0x7385100b
mov dx, word ss:[eax + ecx - 0x2b5beff6]
lea eax, [ecx*8 + 0x132ef9ba]
lea ebp, [ebp + ecx*2 - 0x56b7dfea]
bts ax, cx
shl eax, 0xcb
push eax
mov word [ebp + ecx - 0x2b5beff6], dx
inc ax
add cl, 0xa0
mov dword [esp + ecx - 0x2b5bef96], esi
ret

Function at 0x7bd5fc
Capabilities:
Read .ini file

Disassembly:
shrd dx, ax, cl
mov eax, dword [esp + 0xc]
mov word [ebp + eax*2 - 0x7f3f25d8], dx
cdq
xor byte [esp + eax - 0x3f9f92df], dl
mov dword [esp + edx*2], esi
ret 0xc
push 0x1000ed98
adc ebp, 4
shl word [esp + 8], 0xa2
push 0x6f11dc95
jne 0x67acf3
mov ecx, dword [esp]
mov word [eax + ecx*4 - 0x64f2f478], dx
lea edx, [ecx + ecx*2 - 0x3d4ee1cd]
add byte [esp + ecx - 0x193cbd1b], dl
mov eax, dword [esi + ecx*2 - 0x32797a3c]
jnp 0x5c500a
sub dx, cx
lea esi, [ecx + esi - 0x193cbd1a]
xor dword [esp + ecx - 0x193cbd1e], ecx
sbb dword [esp + edx*4 - 0x399e61bc], edx
xor eax, ebx
dec ecx
lea eax, [eax + edx - 0x6094a291]
pop ecx
push ecx
not eax
bswap edx
sar cl, 1
xor eax, 0x120363c
inc eax
rol ecx, cl
xor ebx, eax
add edi, eax
ror word [esp + edx - 0x6f98670d], 0xa1
mov dword [esp + edx - 0x6f98670e], edi
ret
Function at 0x7be1d6
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp], 0x4a884cc5
call fcn.0079131a

Function at 0x7dd170
Capabilities:
Get graphical window text

Disassembly:
jge 0x9367d3
sbb cx, cx
dec eax
push ecx
ror eax, 1
shr ecx, 0x30
imul dx, cx
xor eax, 0xe43d7138
sal dword [esp + ecx*4], 0x7d
and dword [esp + ecx], edx
sub dl, 1
xor ebx, eax
jmp 0x7b43d1
call fcn.0075f764
mov dword [esp + 4], 0xf6b7eb1a
add esi, eax
pop eax
mov eax, dword [esp]
mov ebp, dword [ebp]
shr ax, 0x81
pop eax
jl fcn.009a708b
sub esi, 4
mov eax, dword [esi]
mov edx, 0x84a97e27
xor eax, ebx
movsx ecx, dx
or edx, edx
not eax
jae 0x6a81b0

Function at 0x7e740f
Capabilities:
Encode data using xor

Disassembly:
bswap edx
not cl
not dl
xadd word [esp + edx - 0x244600f5], dx
not dx
xor bl, cl
lea ecx, [esp + ecx + 0xc]
add word [esp + edx - 0x2446fff9], dx
movzx dx, byte [ecx + edx*2 - 0x488dfffe]
lea ecx, [eax + eax + 0x50365005]
mov dword [esp + ecx - 0x63b45005], ecx
lea edi, [ecx + edi - 0x63b45007]
xchg byte [esp + ecx - 0x63b44ffc], al
mov word [edi + ecx - 0x63b45005], dx
pop eax
pop edx
pop eax
jne fcn.0050c1db
xchg esp, eax
cwde
sar byte [eax - 0x6b], 0x27
invalid

Function at 0x803c9b
Capabilities:
Encode data using xor

Disassembly:
xor ebx, eax
and dx, 0x7125
adc edi, eax
inc ecx
setle cl
mov dword [esp], edx
mov eax, dword [ebp]
sar edx, cl
mov edx, dword [ebp + 4]
mov cl, byte [ebp + 8]
jno 0x83a4bd
push esp
and eax, 0x254c8a04
or byte [edi], cl
cmp ebp, 0xde000367
jecxz 0x803d3f
fsubrp st(3)
jl 0x803cc0
cld
mov esp, 0x3deadd67
push ecx
mov edi, edx
add bh, byte [0x47f52e94]
daa
sbb eax, 0xffa5260e
xor byte [ebx + 0x4d7f5ddf], dh
loop 0x803cb3
inc ebp
jmp 0xd8c3c06e
push edx
popal
cmpsb byte [esi], byte es:[edi]
out 0xe8, al
and al, 0x6b
invalid

Function at 0x80aed5
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x9f2fc222
mov dword [esp + 8], 0xd06b3196
mov ebx, dword [esp + ebx + 0x60d03de2]
call fcn.0040b836
rol dword fs:[ecx + 0x18], cl
jge 0x80aed7
ret 0x9f2f
pop ebx
sahf
sbb byte [eax - 0x549adb8a], 0xb4
push ss
push edx
in eax, 0x91
xchg dword [ebx - 0x8cf9566], esi
xor ah, byte ss:[ebp - 0x7a]
pop esi
sahf
jge 0x80aef5
fsub qword [ebp - 0x5e]
lcall 0xd665, 0x24ea8c5e
cmpsb byte [esi], byte es:[edi]
dec edx
bound edx, qword [esi + 0x65]
push esp
test dword [ebx], ebx
pop ds
iretd

Function at 0x80fe8d
Capabilities:
Check if file exists
Delete file
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + ecx*2 + 0x24], edx
mov dword [esp + ebp - 0x552b4959], eax
lea ebp, [esp + ebp - 0x552b4979]
mov dword [esp + ecx], ebx
lea ebx, [ebp + ecx*2 - 0xe8]
movzx eax, cx
lea edx, [eax + 0xc067524]
mov esp, ebx
Function at 0x8487fb
Capabilities:
Read .ini file

Disassembly:
dec edx
xadd dl, cl
neg eax
lea edx, [ecx - 0x7f4acc7f]
lea eax, [eax + ecx + 0x1e9aed69]
neg ecx
btr edx, edx
sar cx, 0x81
xor ebx, eax
add edi, eax
movsx eax, cx
pop ecx
mov ax, word [esi + ecx*2 - 0x1a6fc4c]
neg cx
lea esi, [esi + ecx*2 - 0x1a703b2]
lea ebp, [ebp + ecx*8 - 0x69c0ed1]
btc edx, ecx
movzx ecx, byte [ebp + ecx*8 - 0x69c0ed0]
dec dx
bt edx, edx
or edx, edx
xor cl, bl
btr edx, edx
btr dx, 0x15
not cl
neg edx
neg cl
or edx, edx
btr edx, edx
dec cl
xor cl, 0xbe
dec edx
xor bl, cl
btc edx, 0x97
jb 0x618391
cmpsb byte [esi], byte es:[edi]
sbb ebp, dword [edi - 0x171d4009]
lodsb al, byte [esi]
dec edx
salc
inc esp
iretd
inc word [esp + 5]
add edi, 6
shld edx, eax, cl
push 0x7d024c0c
mov dword [edi], edx
mov ecx, 0xfeaa289b
add word [esp + 2], 0xc732
movzx edx, cl
lea esi, [esi + edx*4 - 0x270]
rol cx, 0xe2
pop edx
ror dl, 0xe6
mov ecx, dword [edx + esi - 0x44344c30]
xor ecx, ebx
bswap ecx
mov dword [esp + edx - 0x44344c30], edx
dec ecx
xor ecx, 0x731a3739
and dword [esp + edx - 0x44344c2c], edx
jae 0x9b8a86
mov ecx, dword [esi]
add esi, 4
mov edx, 0xb9ba7b20
movsx eax, dl
shr ax, 0xe3
xor ecx, ebx
dec ecx
rol ecx, 3
neg edx
or dx, dx
sub dl, dl
neg ecx
imul edx, eax
rol ecx, 1
btr dx, dx
setb al
btr eax, 0xa3
inc ecx
btr edx, eax
sbb al, ah
rol ecx, 1
sar dx, 1
cbw
or edx, edx
xor ebx, ecx
add edi, ecx
add ax, dx
shl eax, 0xef
jne 0x9ba6ba
adc al, 0x1e
pop ss
add byte [edi + 0x68], al
add eax, 0xc856ce12
sbb al, 0x12
adc cl, byte [edx + 0x11]
sal dword [ebp - 0x13], 1
inc edi
push 0x56ce1205
enter 0x121c, 0x12
dec edx
adc ecx, edx
jne 0x8488a2
sal byte [ebx + edx*2 - 0x70], 0xec
aad 0x8f
or edx, dword [edx]
xchg esp, eax
add byte [edx + 0xb50100c], bl
imul esi, dword [edx - 0x70], 0x44b7ce29
jnp 0x84891a
jnp 0x84891b
arpl word [esi + edi*2 - 0x68], dx
aaa
and eax, 0x7c711cdb
adc bl, byte [edi - 4]
jl 0x8488ed
pop edi
cld
in al, dx
adc al, bl
mul dword [ecx - 0x71]
fild qword [ebp + 3]
imul eax, dword [ecx + 0x6f], 0x75065466
bswap ebx
add byte [edx + 0x723d8f9a], cl
inc ebx
mov dword [edx - 0x2f7f74f5], ecx
loope 0x8488d9
and cl, byte [ebx - 0x55]
stosd dword es:[edi], eax
mov dl, 0xbc
fdiv st(7), st(0)
inc ebx
rcl byte [esi - 0x57411b3d], 0x26
sub byte [edx - 0x53ce0b63], 0xb1
mov dl, 0xe8
lcall 0xa6f2, 0x5682814
stc
push 0xf9a6f205
add eax, 0x97f9a6f2
xchg edi, eax
or cl, bl
pop ebx
adc byte [eax - 0x5f], bh
movsd dword es:[edi], dword [esi]
xchg ebp, eax
loopne 0x84896b
jmp 0xc89c77a5
add eax, 0x57b3a29a
inc edx
add eax, 0xc4bb336a
cli
sal byte [ebx], 0xc6
pop ebp
salc
jmp [edx - 0x70]
dec ecx
rol dl, 1
ror byte [esp + edx - 0x44344c5f], 0x27
mov eax, edx
not ecx
jae 0x6af887
sub edx, 0xa68d99b8
xor ebx, ecx
shl al, 0x41
sar dword [esp + eax - 0x44344cbc], 0x3b
not dword [esp + eax - 0x44344cbc]
add ebp, ecx
and al, 0xa9
sar dword [esp + eax - 0x44344c7c], 0x85
mov dword [esp + eax - 0x44344c80], ebp
ret 4
mov bp, word [ebp + edx*2 - 0x322c1000]
ja fcn.0050cb56
Function at 0x852a19
Capabilities:
Read .ini file

Disassembly:
neg ecx
bswap edx
mov dword [esp + edx - 0x18], 0xf82a2707
imul edx, dword [esp + edx*2 - 0x30]
lea ecx, [edx + ecx + 0x7125c9f8]
movzx eax, dl
xor ebx, ecx
bts edx, eax
btr eax, eax
adc edi, ecx
div dl
mov ecx, esi
sar edx, 0x76
lea esi, [esi + edx - 0x113]
bswap edx
adc eax, dword [esp + edx - 0xf010000]
xchg dword [esp + edx - 0xf010000], edx
mov dword [esi], ecx
pop ecx
jno fcn.00557a43
in al, dx
pop edi
clc
inc esi
dec ebx
lcall 0x8a96, 0x18e5556d
lcall 0x2265, 0xc196493
adc ecx, ebp
ja 0x852afa
mov esi, 0x1ae8162a
stosd dword es:[edi], eax
bound esp, qword [esi - 0x49f26542]
inc esp
std
mov esp, 0x653b238c
mov dword [0x655c6a08], eax
in al, dx
pop es
jmp 0x2d78f2a3
pop edi
jl 0x852b3b
salc
cld
dec edx
in eax, 0x27
repne movsb byte es:[edi], byte [esi]
xchg edi, eax
dec edi
outsd dx, dword [esi]
loope 0x852b61
xchg ebp, eax
adc dword [ebx + ebp*8 + 0x4bc69ab5], ecx
pop esi
xor edx, dword ds:[edi]
cli
add edi, edx
wait
invalid
clc
invalid
imul esp, edx, 0xd1fbd90b
and ah, byte [ebp - 0x71]
mov bl, 0xf
invalid

Function at 0x859253
Capabilities:
Accept command line arguments

Disassembly:
jg 0x5a2253
sub eax, eax
rcl ch, cl
sub esi, 0x23300d15
push ebp
mov ebp, esp
bt ax, 0xaf
btr ax, dx
and esp, 0xfffffff8
rcr eax, cl
push 0xffffffffffffffff
push 0x461d6c
btr eax, 0xb5
mov eax, dword fs:[0]
stc
push eax
lea esp, [esp - 0x708]
mov eax, dword [0x487010]
cmp dh, bh
stc
jmp 0x87fb09
xor eax, esp
mov dword [esp + 0x700], eax
sub ax, 0x25a2
bswap ax
push ebx
shrd ax, sp, 0x95
stc
cwde
push esi
btr ax, 0xa
sal eax, 0x3b
push edi
mov eax, dword [0x487010]
test dh, dl
cmp ebx, edi
xor eax, esp
push eax
ror ah, cl
neg ah
lea eax, [esp + 0x718]
test ax, dx
clc
mov dword fs:[0], eax
mov eax, dword [sym.imp.msvcrt.dll___argc]
cmp ebx, ebp
cmp dword [eax], 1
jmp 0x7fec85
Function at 0x863e9c
Capabilities:
Encode data using xor
Packed with generic packer
Read .ini file

Disassembly:
add ax, 0x58c
xor bx, dx
mov dword [esp + ecx - 0x74fe], ecx
lea edi, [ecx + edi - 0x7500]
not ecx
dec ecx
dec eax
mov word [eax + edi - 0x3b5be7f6], dx
cdq
shl byte [esp + eax - 0x3b5be7f4], 1
sal byte [esp + eax - 0x3b5be7f5], 0x45
pop ecx
js fcn.0059ba7e
invalid
shr dx, cl
lea ecx, [eax + eax - 0x18cdf4ce]
xor al, 3
sbb ecx, 0x131cb00a
mov word [ebp + eax*4 - 0x10000c], dx
sub cl, 0x2e
mov ecx, dword [esi + eax - 0x40003]
cdq
ja 0x76c967
inc al
lea esi, [esi + edx + 4]
neg eax
xor ecx, ebx
xor dx, ax
rol ecx, 1
inc ecx
sar ax, 0xad
xor ecx, 0xfe33b6b2
call fcn.0094a187
call fcn.0073dbb7
push 0xd2049e2e
cld
jecxz 0x650f30
sbb dword [ebp + 0x27], 0x6770f5e2
or byte [eax - 0x431f7ee1], ah
aas
push eax
invalid
sal eax, 0xd2
jp 0x650eeb
adc ebp, eax
lea esi, [esi + edx*2 - 2]
add dx, word [edx + esi]
mov dword [esp + ecx - 0x3b5c1cd2], 0x8e8bc599
movsx eax, word [esp + ecx*2 - 0x76b839a4]
xor dx, bx
cwde
sub word [esp + ecx - 0x3b5c1cd2], 0xf019
xor dx, 0x9807
xadd eax, ecx
xchg byte [esp + eax - 0x3b5be26b], cl
dec word [esp + eax - 0x3b5be269]
neg dx
not ecx
sal word [esp + ecx - 0x3a7d], 1
xor dx, 0x79a0
sub dx, 0x3e1d
rol cx, 1
jno 0x415f8a
je 0x863e93
in eax, dx
std
xlatb
push ebp
add dword [edx], 0xffffffb1
push ds
invalid

Function at 0x86857a
Capabilities:
Read .ini file

Disassembly:
sub edx, 0xb8298939
mov dword [esp + eax - 0x431e53ba], ecx
push ecx
mov dword [esp + eax - 0x431e53b2], eax
xor ebx, edx
cwde
cwde
add edi, edx