joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403180
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x4189e8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xb8]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xbc]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x1c], eax
test ecx, ecx
js 0x4031c8
mov eax, dword [0x429578]
add eax, ecx
push eax
call fcn.00403169
push 4
lea eax, [esp + 0x14]
push eax
push dword [0x40a010]
call fcn.004067df
test eax, eax
je 0x40338c
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x40332e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x40c960
mov dword [esp + 0x14], eax
call fcn.00407b0b
mov eax, dword [esp + 0x10]
and eax, 0x7fffffff
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
jbe 0x403326
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x4149e8
call fcn.00403153
test eax, eax
je 0x40338c
sub dword [esp + 0x10], ebp
mov dword [0x40c97c], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x40c978], 0x4149e8
mov ecx, 0x40c960
mov dword [0x40c980], ebp
mov dword [0x40c984], ebx
call fcn.00406d3f
mov dword [esp + 0x28], eax
test eax, eax
js 0x40332a
mov eax, dword [0x40c980]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x429614], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4032df
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x4032a3
test ecx, ecx
jne 0x4032df
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.00405be0
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40331e
test edi, edi
jne 0x403303
push eax
push ebp
push dword [esp + 0xbc]
call fcn.004068a2
test eax, eax
je 0x403371
mov eax, dword [esp + 0x18]
jmp 0x40330f
mov ebp, dword [0x40c980]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 1
jne 0x403250
jmp 0x403326
test ecx, ecx
jg 0x40321b
mov eax, esi
jmp 0x40338f
push 0xfffffffffffffffc
jmp 0x40338e
test edi, edi
jne 0x403375
test eax, eax
jle 0x403326
mov ebp, 0x4149e8
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00403153
test eax, eax
je 0x40338c
push edi
push ebp
push dword [esp + 0xbc]
call fcn.004068a2
test eax, eax
je 0x403371
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x40333b
jmp 0x403326
push 0xfffffffffffffffe
jmp 0x40338e
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00403153
test eax, eax
jne 0x403326
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x40339c
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4033bb
mov eax, dword [0x40c958]
test eax, eax
je 0x4033b3
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x40c958], 0
ret
cmp dword [0x40c958], 0
je 0x4033cc
push 0
call fcn.004060a6
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x429520]
jbe 0x4033ff
push 0
push 0x403662
push 0
push 0x6f
push dword [0x428514]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x40c958], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x405cc4
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405cde
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x406035
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
ja 0x40606f
test eax, eax
je 0x40606f
add eax, eax
cmp word [ebp + eax - 0x23e], 0x5c
je 0x406071
mov ecx, 0x4082a8
jmp 0x406076
xor eax, eax
mov ecx, 0x4082aa
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x23c]
add eax, ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4060d4
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x4060f7
push dword [esp + 8]
push dword [esp + 8]
call fcn.0040619d
pop ecx
pop ecx
inc dword [0x4295f0]
ret 8

Function at 0x40619d
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x426670], 0x55004e
mov ebp, 0x426670
mov dword [0x426674], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x4061f3
push 1
push 0
push esi
call fcn.004067b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4062d3
cmp eax, ebx
jg 0x4062d3
push ebx
mov esi, 0x425e70
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x4062d3
cmp eax, ebx
jg 0x4062d3
push esi
push ebp
push str._ls_ls_r_n
push 0x425a70
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x429530]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00405d3f
push 4
push 0xc0000000
push esi
call fcn.004067b2
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4062d3
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [ebp + 0xa]
add ecx, esi
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4062cc
push esi
push edi
push ebx
call fcn.004067df
test eax, eax
je 0x4062cc
push str._Rename__r_n
push edi
call fcn.004069cd
test eax, eax
jne 0x4062d8
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x425a70
lea eax, [ecx + edi]
push eax
call fcn.0040654b
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.004068a2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x408984
add eax, 0xa
push eax
call fcn.004069cd
mov ecx, eax
test ecx, ecx
je 0x40629d
lea edx, [edi + esi]
jmp 0x4062f7
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x4062f1
sub ecx, edi
inc ecx
jmp 0x40629f
Function at 0x40641c
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00406a34
mov edi, eax
cmp edi, 0xffffffff
je 0x40645f
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406440
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x406446
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40644f
xor eax, eax
inc eax
jmp 0x406461
test byte [ebp + 0xc], 4
jne 0x40645f
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8

Function at 0x4064cf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x425270
push ebx
call fcn.004069b1
push ebx
call fcn.00406a5c
mov esi, eax
test esi, esi
je 0x406544
push esi
call fcn.00406bd4
test byte [0x42952c], 0x80
je 0x406508
movzx eax, word [esi]
test ax, ax
je 0x406544
cmp eax, 0x5c
je 0x406544
sub esi, ebx
sar esi, 1
jmp 0x406522
call fcn.00406466
test eax, eax
je 0x40651c
test byte [eax], 0x10
je 0x406544
push ebx
call fcn.00406ba7
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x40650e
call fcn.004063ed
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x406544
xor eax, eax
inc eax
jmp 0x406546
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x40656d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x424a28], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x424a28
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4065ac
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x4065b0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.004064cf
mov dword [esp + 0x14], eax
test bl, 8
je 0x4065f2
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x4295e8], eax
jmp 0x406771
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x40660f
test eax, eax
je 0x406760
test bl, 2
je 0x406729
push esi
push 0x424a70
call fcn.004069b1
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406632
push 0x408960
push 0x424a70
call ebp
jmp 0x406638
push esi
call fcn.00406ba7
xor eax, eax
cmp word [esi], ax
jne 0x406649
cmp word [0x424a70], 0x5c
jne 0x406651
push 0x4082a8
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x424a70
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406712
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x40669b
cmp word [esp + 0x4a], 0
je 0x4066f4
cmp word [esp + 0x4a], ax
jne 0x40669b
cmp word [esp + 0x4c], 0
je 0x4066f4
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.004069b1
test byte [esp + 0x1c], 0x10
je 0x4066c2
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x4066f4
push ebx
push esi
call fcn.004065b0
jmp 0x4066f4
push edi
push esi
call fcn.0040641c
test eax, eax
jne 0x4066ec
test edi, edi
je 0x4066e4
push esi
push 0xfffffffffffffff1
call fcn.00405be0
xor eax, eax
push eax
push esi
call fcn.004060d4
jmp 0x4066f4
inc dword [0x4295e8]
jmp 0x4066f4
push esi
push 0xfffffffffffffff2
call fcn.00405be0
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x40667d
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406770
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406760
push esi
call fcn.00406466
test eax, eax
je 0x406770
push esi
call fcn.004063ed
mov eax, edi
or eax, 1
push eax
push esi
call fcn.0040641c
test eax, eax
jne 0x406768
test edi, edi
je 0x406760
push esi
push 0xfffffffffffffff1
call fcn.00405be0
xor eax, eax
push eax
push esi
call fcn.004060d4
jmp 0x406770
inc dword [0x4295e8]
jmp 0x406770
push esi
push 0xffffffffffffffe5
call fcn.00405be0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4067b2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x40680e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040616f
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406880
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406880
cmp dword [ebp + 0x18], 1
je 0x406885
cmp dword [ebp + 0x18], 2
je 0x406885
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x40688a
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x4068ed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406937
test edi, edi
jne 0x4068fa
mov word [esi], ax
jmp 0x406939
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x406a34
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406a56
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x406cd3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4270c4], 0
push esi
jne 0x406d0d
xor ecx, ecx
push 8
mov edx, ecx
pop esi
mov eax, edx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr edx, 1
and eax, 0xedb88320
xor edx, eax
sub esi, 1
jne 0x406ce4
mov dword [ecx*4 + 0x4270c0], edx
inc ecx
cmp ecx, 0x100
jl 0x406cdf
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
not ecx
test edx, edx
je 0x406d37
mov esi, dword [esp + 0xc]
movzx eax, byte [esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x4270c0]
inc esi
sub edx, 1
jne 0x406d1f
not ecx
mov eax, ecx
pop esi
ret 0xc
Function at 0x1005b710
Capabilities:
Encode data using xor

Disassembly:
pop ecx
mov al, bh
pushfd
pushfd
pop esi
in eax, 0xd6
mov dh, 0xc2
push ds
sbb byte [ebx + edx + 0x6e42bee], cl
popal
sbb dword [ebp + 0x53], eax
cmp eax, 0xfc9821be
or byte [esi + 0x46], cl
xor dh, byte [ebx]
add eax, 0x21135976
ja 0x1005b685
mov dword [ecx + edx*4], 0x6de98c2f
aad 0x91
pop ss
jp 0x1005b712
mov ebp, 0x2accd4ad
popal
bnd jg 0x1005b716
lodsd eax, dword [esi]
aam 0xcc
sub ah, byte [ecx - 0xe]
jg 0x1005b716
jle 0x1005b70d
sub eax, 0xf452251e
xlatb
jl 0x1005b6b5
hlt
pop ebx
ret 0x5cae
mov ecx, 0x1cda2d5a
inc esp
jg 0x1005b6c3
cmp edx, dword [ebp + 0x4586d381]
fnstenv [esi + ebx*8]
stosd dword es:[edi], eax
js 0x1005b681
insd dword es:[edi], dx
lodsd eax, dword [esi]
mov ch, ch
invalid
adc byte [0x74a69b1c], dh
bt dword [edi - 0x2f0fca68], ecx
lodsd eax, dword [esi]
stc
wait
cmpsb byte [esi], byte es:[edi]
je 0x1005b723
mov dword [0xf035988f], eax
shr byte [ebp + 0x3d1079f9], 1
cwde
jns 0x1005b6ce
cwde
xor eax, 0xf9add0f0
jns 0x1005b72e
cmp eax, 0x97ac7998
xchg edi, eax
dec esi
int 0xa
mov byte [edx + 0x51], bh
pop esi
dec edx
scasb al, byte es:[edi]
xor ebp, esi
cmc
outsb dx, byte [esi]
xor dword [edi + 0x6a22ae4a], ebx
cmp eax, 0x4d613bce
into
cmp esp, dword [ecx + 0x4d]
loope 0x1005b75a
sub eax, 0x2181736c
test byte [edx - 0x30], dl
or eax, 0xfd73274b
dec ebx
daa
jae 0x1005b747
ror dword [0xc03e2115], 0x8c
out 0xd4, al
mov dl, 0x5e
loope 0x1005b746
jne 0x1005b7cd
and esi, esi
jp 0x1005b755
idiv byte [edx - 8]
pop edi
or dword gs:[edi + ecx*4 - 0x66], ecx
cmp byte [eax + 0x40], dh
jo 0x1005b7a6
push ds
dec edx
inc ecx
cmp edx, dword [esi + 0x5db5b6dd]
pop esp
daa
and byte [edx - 0x1d], dl
out dx, eax
jecxz 0x1005b764
popfd
pop esp
jo 0x1005b776
jno 0x1005b773
ror byte [eax], 1
inc ebx
jl 0x1005b737
in eax, 0x91
jae 0x1005b797
mov eax, dword [0x66dff42a]
std
xor eax, 0x2e114c59
mov byte [esi], bl
and edi, ebx
invalid
xor cl, byte [eax + 0x17da436c]
dec ebp
sahf
int 0x9e
pop ss
cdq
fst dword [edi - 0x2131857b]
and dword [esi + 0x56ff4744], 0x2a
cmp dword [ebx + edi - 0x32], ebp
jp 0x1005b776
fiadd word [ebx - 0xb8bb5a]
push esi
sub bh, byte [ecx]
insb byte es:[edi], dx
cmp ecx, esi
int3
jge 0x1005b782
loopne 0x1005b7f3
cmpsb byte [esi], byte es:[edi]
pop ecx
invalid
mov cl, 0x5e
pop ebp
sub al, 0xe7
test eax, 0x9ecb9e49
mov dword [esi + 0x72da6fdf], ebx
adc eax, 0xbaf30456
xor byte [ebx + ecx*4 - 0x4b], bh
jp 0x1005b79e
cdq
xor dl, byte [edi + 0x56e70504]
and byte [esi + 0x3c3d8dcb], bl
xor byte [edx + ebx - 0xa91cfe0], bl
cmp dword [ebp + 0x55e0b0a6], ebp
call 0xe28b1e99
push 0xffffffffffffffe6
pop esi
fstp dword [eax - 0xd1908cd]
and dword [esi], ebp
add edi, ecx
mov eax, 0x43eeb76e
cmp edi, esp
push es
in eax, 0x38
pop ds
sal byte [esi + 0x2ef7814d], cl
sub esi, dword [edi]
mov ebx, 0x461cd32e
call 0x7c81613c
call 0xdbd21ecc
push esi
jge 0x1005b899
imul esp, ebp, 0xffffffc1
ficomp word [edi - 0x53]
loopne 0x1005b867
ljmp 0xcc6f:0xf1e9ce78
sal ch, cl
out 0x9c, eax
invalid
Function at 0x10067720
Capabilities:
Encode data using xor

Disassembly:
js 0x10067736
xor eax, 0xd98f0be
dec edi
wait
pop ebp
fld dword [eax - 0x1c]
xlatb
sar dword [ecx], 0x8d
push edi
pop ds
mov eax, 0xde2e6db7
neg al
out 0x8e, eax
insd dword es:[edi], dx
fdivrp st(6)
fsub st(7)
mov fs, esp
invalid
in al, 0x8f
sbb dh, dh
xor al, 0x2b
push ds
loope 0x1006773d
add al, 0xe
ljmp 0x70aa

Function at 0x10067c90
Capabilities:
Encode data using xor

Disassembly:
inc esi
adc ecx, esp
invalid
sbb byte [eax - 0x3da89518], dl
push eax
js 0x10067bda
inc esi
retf 0x3304
jb 0x10067bcc
into
or byte [eax - 0x5e6819c3], ah
mov ebp, 0x5993540
scasb al, byte es:[edi]
or esp, ecx
nop
mov dl, 3
jb 0x10067c3f
mov ebp, 0xc7ae240e
xlatb
add al, 0x5b
push es
int 0xfd
inc ebx
lahf
jb 0x10067be1
xchg edx, eax
sbb eax, 0x23dbe780
insd dword es:[edi], dx
les ecx, [esi + ebx*4 - 0x2a]
ret 0xbd9
and al, byte [edx - 0x2d4ce4c0]
pop ebp
pop es
js 0x10067c28
dec eax
and bh, byte [esi + ecx*2]
and byte [ebx + 0x64], 0x92
shr dword [ebp + 0x51f8ecba], cl
pop ebx
call 0x2fbf0195
imul esp, dword [edx], 0xffffffbc
in al, 0x69
das
sub dword [eax - 0x453b4840], eax
pop esi
sub al, 0x42
invalid

Function at 0x10069b00
Capabilities:
Encode data using xor

Disassembly:
jg 0x10069ad1
and byte [edi + 0x6948c550], bh
mov esp, 0xaf91762f
jo 0x10069b41
dec eax
imul edi, dword [edi + ebp + 0x70af9176], 0xa16b2232
and ch, byte [ebx - 0x5f]
cwde
inc eax
mov esi, 0xc85eabf7
invalid
mov dl, 0x8a
pop ss
xor cl, byte [ecx + 0x29a7613d]
sti
jbe 0x10069b06
xchg esi, eax
cmp dh, byte [edx + eax*8]
stosb byte es:[edi], al
push esi
push 0xdac8e77e
pop ecx
adc bh, al
clc
and eax, 0x4ead17f6
aam 0xa5
add edi, eax
ret

Function at 0x1006ad00
Capabilities:
Encode data using xor

Disassembly:
dec esp
dec dword [0x94fa778b]
ja 0x1006acfc
xchg esp, eax
ja 0x1006acfc
xchg esp, eax
ffree st(2)
stosb byte es:[edi], al
inc esi
push 0x425e201b
inc esi
jno 0x1006ad72
jb 0x1006ad37
pop ebx
aad 0x34
mov edi, 0x299f7289
lodsb al, byte [esi]
pop ebp
sbb dword [eax - 0x69bedded], edx
pushfd
mov ebx, 0x8c392bde
shl byte [ecx - 0x196a9c5f], 0xbc
push ds
pminub mm1, mm4
invalid
inc ecx
mov ebp, 0x1fe59a36
test edi, ecx
jnp 0x1006ad3d
mov ah, 0xcc
push ebp
inc edx
mov eax, 0x897ee829
adc ebx, dword [edi - 0x72]
sahf
outsb dx, byte [esi]
in al, 0xb2
scasd eax, dword es:[edi]
out 0xda, al
salc
wait
insd dword es:[edi], dx
and ecx, dword [0xf3354b59]
xchg ecx, eax
and byte [ebx + 0x2b73cb8a], dh
mov bh, 0xb6
xchg byte [ecx - 0x4e], al
leave
xchg ebx, eax
fidiv dword [edx + 0x78]
mov ebp, 0xf223da7f
fld dword [esi]
int3
fisub dword [ebx]
fld dword [esi]
xor dword [esi - 0x2cc8482b], edi
test eax, 0x52b9c797
loope 0x1006ad42
enter 0xffffffffffff85e9, 0xffffffffffffff92
jge 0x1006adbd
popfd
xchg edx, eax
ret
push ds
dec esp
mov edx, esp
mov eax, 0x88ecba85
xor ch, byte [0x7b790d5f]
cmc
jb 0x1006adac
mov edx, 0x2d3288ec
pop edi
or eax, 0x72f57b79
hlt
das
ret 0x8e88
pushfd
call 0x241a573
jle 0x1006ada6
in al, 0xe7
popal
int3
Function at 0x1006b190
Capabilities:
Execute syscall

Disassembly:
in eax, dx
invalid
jo 0x1006b11a
out 0x67, eax
retf 0xab50
mov dl, 0x3c
sahf
xchg edx, eax
ja 0x1006b1ca
jne 0x1006b1d1
mov ebx, ebp
loope 0x1006b1f6
adc ecx, esi
lcall 0xbb35, 0x5032b3d2
lcall 0xc74, 0x9881328e
out dx, al
adc eax, 0xac9f8e86
push eax
xor eax, 0x328e9abb
sbb dword [eax + 0x15ee0c74], 0xac9f8e86
lodsd eax, dword [esi]
mov edx, 0x73a47a7c
sti
mov edx, ebx
insd dword es:[edi], dx
outsb dx, byte [esi]
fnstsw word [eax + edi]
add al, byte [edi]
cmp byte [edi], 0x70
jbe 0x1006b235
mov ebp, 0xf386d77f
jg 0x1006b1a3
xchg bl, dh
salc
daa
sub dl, ah
stosb byte es:[edi], al
loop 0x1006b17d
mov ch, 0x98
stosd dword es:[edi], eax
mov eax, 0x96a0e7bd
invalid
mov ah, 0xaa
sbb al, 0x72
pushal
invalid
cmp al, 0x6e
int 0x2e
outsb dx, byte [esi]
push edi
or ch, cl
push cs
pop ss
clc
in eax, 0x7e
push 0xffffffffffffffce
xchg esi, eax
ret

Function at 0x10071120
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword ss:[esi], dword es:[edi]
mov bl, byte [esi + 0x2d8a6cc9]
sar dword [esi + 0x3e], 1
sub byte [esi - 0x63c5738a], cl
test ecx, edi
and byte [edx], 0x3f
sahf
xchg edi, eax
xor ebx, ecx
push cs
add byte [ebx + 0x7a], 0x89
salc
push eax
ror byte [esi + 0x3742a986], 1
and dword [esi - 0x45], edx
inc esi
test dword [eax], ecx
mov esi, 0xcd59e97d
std
scasb al, byte es:[edi]
loope 0x10071126
insb byte es:[edi], dx
mov ch, byte [0x283e7ed1]
invalid
jmp 0xd6edeaf
aam 0x93
jbe 0x100711d3
test byte [esi - 0x52dd6a0b], cl
lodsd eax, dword [esi]
dec ebp
cli
or eax, 0x9f52b309
pop ebx
cwde
mov al, byte [0x14f71fd1]
push edi
fsubr dword [0x82baf5b5]
cmp byte [ecx], dl
int1
pop ebp
sbb eax, 0xec7eae4
jno 0x10071162
pop esp
jecxz 0x10071151
sbb al, 0x48
adc eax, 0xfad861c3
pop ecx
mov edi, 0x6cb79554
xchg esp, eax
mov eax, 0x54819e5e
iretd
adc dword [edx - 0x57], esp
ret 0xa18a

Function at 0x10074de0
Capabilities:
Encode data using xor

Disassembly:
cmp ch, byte [ebx]
lodsb al, byte [esi]
mov esp, 0xce8e134c
mov cs, esi
adc byte [esi + 0x2f244a5c], 0x66
xor dl, dh
mov al, byte [0x9c24c66f]
mov eax, 0x1e186a07
cmpsb byte [esi], byte es:[edi]
dec esp
jge 0x10074de6
xor edi, dword [esi + ebp*4 + 0x7b935f3d]
mov bh, 0x7c
outsb dx, byte [esi]
imul ebp, dword [eax + eax*2 + 0x2def3bde], 0xf3c9fd7a
jmp 0x10074e75
dec eax
fcmovu st(0), st(3)
dec ecx
mov ecx, 0xd2980da2
pop es
and ah, 0xbf
pop ds
cdq
daa
push es
retf
wait
sub al, 0xfb
jno 0x10074e17
popal
cdq
pop ecx
test eax, 0x95c6cf41
push esp
push ecx
push ebx
call 0xa1a127bd
push 0x3e7c09c9
dec ebx
invalid
invalid
invalid