joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40abf8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x40ac19
jl 0x40ac10
test edi, edi
jne 0x40ac19
xor eax, eax
xor edx, edx
jmp 0x40acda
cmp dword [ebx + 0x38], 0
je 0x40ac2e
push eax
push edi
push dword [ebp + 8]
call fcn.0040ace0
jmp 0x40acda
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x40ac75
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x40ac75
cmp eax, edi
jb 0x40ac4f
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.0040c470
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x40ac7b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x40accf
mov ecx, ebx
call fcn.0040a48f
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x40acba
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00416f16
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x40accf
jmp 0x40ac8d
test edx, edx
je 0x40accf
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00416f16
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x40c2bc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40c2fb
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40c2fb
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c2fb
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40c2fb
cmp dword [ecx + 0x74], 0xe
jbe 0x40c2fb
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41ed22
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430610
push 0x430608
push str.FlsAlloc
push 0x1e
call fcn.0041eb8f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41ed56
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c130]
call esi
jmp 0x41ed5c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41eda0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x430620
push 0x430618
push str.FlsGetValue
push 0x20
call fcn.0041eb8f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41edd7
push dword [ebp + 8]
mov ecx, esi
call dword [0x42c130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x420dbc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00420c2d

Function at 0x4211b6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.0040c420
mov eax, dword [0x43a040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.0041e59b
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x4211f8
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x421354
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.0042ad20
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x43ba98]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00422193
mov ecx, dword [esi*4 + 0x43ba98]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x42134d
cmp eax, dword [edi + ecx + 0x24]
jne 0x42134d
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42134d
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00422193
add esp, 0x14
test edx, edx
jl 0x42134d
jg 0x4212c3
test eax, eax
jb 0x42134d
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x42134d
jl 0x4212dd
cmp dword [ebp - 0x1008], eax
ja 0x42134d
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x4212fb
test ebx, ebx
je 0x421334
cmp ecx, edi
jae 0x421334
mov al, byte [ecx]
cmp al, 0xd
jne 0x421315
lea eax, [edi - 1]
cmp ecx, eax
jae 0x421321
cmp byte [ecx + 1], 0xa
jne 0x421321
inc ecx
jmp 0x421321
movzx eax, al
movsx eax, byte [eax + 0x43a308]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x4212fb
cmp edx, ebx
jne 0x4212fb
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x421352
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040b531
leave
ret
Function at 0x42164b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x43ba98]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x42168b
cmp byte [ebx], 0xa
jne 0x42168b
or byte [eax + edi + 0x28], 4
jmp 0x421690
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x42178e
mov al, byte [edx]
cmp al, 0x1a
je 0x421770
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x4216bf
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x4216e4
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x4216ee
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x4216a1
jmp 0x42178e
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42176b
cmp dword [ebp - 0xc], 0
je 0x42176b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x43ba98]
test byte [eax + edi + 0x28], 0x48
je 0x421745
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x421730
mov byte [esi], dl
jmp 0x421741
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x43ba98]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x42178e
cmp byte [ebp - 1], 0xa
jne 0x421754
cmp esi, ebx
jne 0x421754
mov byte [esi], 0xa
jmp 0x42178d
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.004221b1
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x42178e
mov byte [esi], 0xd
jmp 0x42178d
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x43ba98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42178a
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x42178e
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x421797
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x43ba98]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4217da
cmp word [esi], dx
jne 0x4217da
or byte [edi + eax + 0x28], 4
jmp 0x4217df
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x421918
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4218f8
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x421821
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x421857
cmp eax, edx
jae 0x421863
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4217f9
jmp 0x421918
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4218f4
cmp dword [ebp - 0x14], 0
je 0x4218f4
mov eax, dword [ebx*4 + 0x43ba98]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4218cc
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x421912
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x43ba98]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x43ba98]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x43ba98]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x421915
pop ebx
cmp word [ebp - 4], bx
jne 0x4218dd
cmp esi, dword [ebp + 0xc]
jne 0x4218dd
mov word [esi], bx
jmp 0x421915
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004221b1
add esp, 0x10
cmp word [ebp - 4], bx
je 0x421918
push 0xd
jmp 0x421911
mov ecx, dword [ebx*4 + 0x43ba98]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x42190f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x421918
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x423a08
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x423aa5
push ebx
push esi
call fcn.004239d1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00422656
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x423a52
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423aa4
push edi
push eax
call fcn.0041d766
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x423a72
call fcn.0041d52f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x423aa3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00422656
add esp, 0x20
test eax, eax
jne 0x423a91
push edi
call fcn.0041d52f
jmp 0x423a99
push ebx
call fcn.0041d52f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x42ab20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ab4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ab4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401000
Capabilities:
Capture network configuration via ipconfig
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
push str.Russian
push 0
call dword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
mov esi, dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
push str.title_by_sharpenskiy_aka_wasd666
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 0xc
mov edx, 0x40315c
call fcn.00401080
push str.ipconfig__release__nul
call esi
add esp, 4
push str.ipconfig__renew__nul
call esi
add esp, 4
push 0x40319c
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
add esp, 4
mov edx, 0x4031a0
call fcn.00401080
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401b5f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b9e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b9e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b9e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b9e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b9e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4218a6
Capabilities:
Authenticate hmac

Disassembly:
xor edx, dword [edx]
push ecx
inc eax
xor byte [ecx - 0x64], 0x73
xchg edi, eax
imul edi, esi, 0xaac2df06
cmp byte [edx + ebp], 0x76
push ds
jno 0x4218dd
rcl dword [ecx - 0xf6ed4ef]
invalid
mov eax, 0xc931503c
pop eax
imul edx, dword [edi], 0x51
adc al, 0x3a
or byte [eax + 0x34], dh
mov byte [0x3200b8b1], al
mov eax, 0x426e3200
mov eax, 0x426e3200
cmova ebp, dword [eax - 0x2fa38cf4]
cmc
rol byte [eax + 0x19], 0x16
leave
fisub word [eax]
mov ch, 0x43
or eax, 0xecb8e7bf
sbb al, 0x26
mov byte [ebx - 0x4b], cl
pushal
mov fs, word [ebx + 0x50]
jo 0x421896
je 0x421931
jo 0x421867
nop
invalid
salc
mov word [eax + ebx*8 - 0x80], es
push cs
arpl word [ebx + 0x7f6e8e1c], dx
inc eax
mov ebx, 0x70f0f150
push eax
add byte [edx], bl
xchg dword [ebp - 0x49], ebp
iretd
push eax
xchg ebp, eax
xchg byte [edx], dh
clc
mov eax, 0x32423500
add edi, ebp
mov al, 0xb3
cwde
adc byte [eax + 0x40], dh
and dword [ecx - 0x78], ebx
sub ah, byte [ebx]
inc esi
loope 0x4219b1
rol byte [ecx - 0xb], 1
push 0x3d
loopne 0x421946
invalid
rcl byte [ecx]
out 0x52, al
mov esp, 0x62696a46
inc ecx
rcl byte [ebx - 0x50]
xchg ebx, eax
mov cl, 0xd0
jg 0x42193b
push eax
loopne 0x4219b8
push esp
inc ebp
clc
and ebx, dword [eax + 0x37]
rcl byte [eax], 0x11
xlatb
cmp dword [esi], ecx
push ds
sub bh, ah
popal
jbe 0x4219b6
aam 0xb9
test dword [edx - 0x4430635], esp
sti
or dword [eax - 0x21], eax
cmp al, 0x5c
inc eax
fistp qword [esp + ebx*2]
inc esp
xor al, 0xe2
jge 0x421986
jnp 0x4219d1
pop ecx
in al, 0x36
loopne 0x421a26
pop esi
inc eax
out 0x3c, al
xchg edx, eax
inc edx
jbe 0x42199c
mov eax, dword [0xd12eafb0]
ret 0xf0e0
scasd eax, dword es:[edi]
rol edx, 1
loopne 0x4219c7
xor dword [edx - 1], 0x50bad253
mov edi, 0xc4894170
out 0x46, eax
dec esp
arpl word [0x44927151], ax
add eax, 0xa5668d8
lahf
jnp 0x4219ef
push esi
or bl, byte [edi + 0x58ebfb7b]
fist dword [ebx]
inc edx
daa
and dword [ebx], esi
lea eax, [edi]
push edi
inc eax
mov byte [0xc4dac7f0], al
sbb byte [ecx - 0x5701b598], 3
xchg dword [edi + 0x45694031], esi
fst qword [ebx + 0x33ab18a8]
cmp ch, cl
int 0x76
sal ebx, 0xb1
inc eax
jmp 0x421a4e
xchg ebx, eax
test al, 0x18
stosd dword es:[edi], eax
xor edi, dword [eax]
int 0xcd
jbe 0x4219de
mov cl, 0x40
jp 0x421a13
iretd
lodsb al, byte [esi]
push es
xchg byte [esi - 0x27], dh
and byte [edi - 0x49], cl
jo 0x421a96
std
hlt
inc ecx
sbb al, 0xb
sbb al, 0x8d
add dh, 0xa4
mov dh, 0x50
shl dword [eax], 1
push ecx
pop esp
jo 0x421ab6
adc byte [eax - 0x3f85462c], dl
sal byte [esi - 0x4f], cl
pop ss
inc si
and byte [edi], cl
fbstp tbyte [ecx]
mov esi, 0xf607abb1
invalid
test dword [edx], esp
xor dh, byte [eax]
je 0x421ae0
popal
mov byte [0xa100113f], al
sub byte [eax + 1], cl
inc esp
adc dword [esi], 0x4907fb93
or eax, 0xd03cd7f1
invalid
ffree st(7)
dec ebp
sub byte [edx - 0x42], cl
add esi, dword [esi - 0x5e]
mov cl, 0xcf
sbb al, 0x9f
mov esi, 0x6887aa41
pop eax
pop edx
out dx, eax
lds esi, [edi + 0x128472bf]
invalid
push ecx
dec edi
lodsd eax, dword [esi]
cmp ebx, ebx
invalid
Function at 0x424bf3
Capabilities:
Encode data using xor

Disassembly:
jmp 0xc1d79a54
pop ebp
sar byte [edi], 0x33
push edx
add eax, 0xc1031124
pop edx
inc ebp
shl dword [esi], 0x1d
dec esp
add ah, dl
jle 0x424b8b
sbb edi, dword ds:[eax]
test byte [esi], bl
arpl word [edx + 8], sp
add dl, ch
inc dh
sbb ecx, dword [edi + 0x35781200]
xor byte [ecx + edi*2], ch
push ebp
xor byte [ebx + 0x14], ah
jne 0x424c0e
or byte [edx], al
aad 0xfe
invalid
or al, 0xb3
test byte [esi - 0xdc2437f], 0x45
inc ebx
invalid

Function at 0x437c96
Capabilities:
Encode data using xor

Disassembly:
push esp
sbb al, 0xa1
mov edx, 0x8ac360ea
xchg ebp, eax
mov al, 0x2a
cdq
jp 0x437c99
invalid
mov ebp, 0x43330fd5
cmpsd dword [esi], dword es:[edi]
sub eax, dword [ebx + ebx*8 + 0x22]
or eax, 0x6b257478
js 0x437d0c
and eax, 0x4867306b
imul esi, dword [eax], 0x67
dec eax
dec esi
enter 0x15b, 0x7b
fdivr qword [ebx]
pushfd
lcall 0xfbbb, 0xa2c49bb4
in al, 0x72
loop 0x437c8b
jb 0x437c91
fisttp dword [edx + 0x2ffa4b48]
mov cl, byte [eax + 0x4b]
cli
das
jle 0x437cd2
cmp ch, ah
cmp byte [ecx + 0x506d4879], cl
pop ecx
test byte [ebx + 0x26d62ec6], ch
add eax, 0xe2e593bf
lea eax, [eax + 0x54ff344f]
jne 0x437d45
jb 0x437d42
outsb dx, byte [esi]
daa
sbb esp, dword [esi + 0x62]
add byte [edx], dh
cmp al, 0xff
arpl word [ebp - 0x63], ax
and al, 0xe6
sar byte [ebx - 0x726e20ad], 1
inc ecx
call 0xc341b01a
and eax, 0x17304579
xor byte [edi], dl
lodsb al, byte [esi]
clc
or dword [ebx + ecx], esi
bound ebp, qword [ebx + 0x5c3f58c2]
adc dword [ebx], esi
loope 0x437cad
lodsb al, byte [esi]
mov ebx, 0x9b20f9f3
adc al, byte [edi - 0x7b]
or edx, dword [edx + 0x4bcad1e9]
insd dword es:[edi], dx
aam 0xb1
adc al, al
push ecx
inc edi
dec ebp
jae 0x437d1e
insb byte es:[edi], dx
add dword fs:[edx], ecx
or dword [ebx - 0x55], ebx
or cl, byte [ecx]
pop ebx
stosd dword es:[edi], eax
pop ds
adc al, 0x3a
invalid

Function at 0x441f5e
Capabilities:
Encode data using add xor sub operations

Disassembly:
wrmsr
pop ds
mov esi, dword [edx + 0x2969721b]
xchg esi, eax
lcall 0xdb59, 0x3ebbabf6
cmp byte [esi - 0x39], dl
add eax, 0x3aa576f
dec ebx
mov edi, eax
sbb dword [edi], ebx
stosd dword es:[edi], eax
sbb byte [ebx], dh
pop esp
sub eax, 0x2693acf6
mov al, byte es:[0x26adb4aa]
out dx, al
xor ebx, dword [ecx + 0x3a]
push ebx
stosd dword es:[edi], eax
aas
fst dword [ebp + edx*2 + 0x4c]
push ss
aas
sbb dl, byte [edx + ecx + 0x64]
cmp cl, byte [ebp + 0x66]
sti
movsd dword es:[edi], dword [esi]
std
lea ecx, [0xbdd075ff]
push edi
inc eax
xor eax, 0xfa769b7c
jb 0x441f68
mov edi, 0x3d432817
invalid
Function at 0x441f84
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
wrmsr
pop ds
mov esi, dword [edx + 0x2969721b]
xchg esi, eax
lcall 0xdb59, 0x3ebbabf6
cmp byte [esi - 0x39], dl
add eax, 0x3aa576f
dec ebx
mov edi, eax
sbb dword [edi], ebx
stosd dword es:[edi], eax
sbb byte [ebx], dh
pop esp
sub eax, 0x2693acf6
mov al, byte es:[0x26adb4aa]
out dx, al
xor ebx, dword [ecx + 0x3a]
push ebx
stosd dword es:[edi], eax
aas
fst dword [ebp + edx*2 + 0x4c]
push ss
aas
sbb dl, byte [edx + ecx + 0x64]
cmp cl, byte [ebp + 0x66]
sti
movsd dword es:[edi], dword [esi]
std
lea ecx, [0xbdd075ff]
push edi
inc eax
xor eax, 0xfa769b7c
jb 0x441f68
mov edi, 0x3d432817
invalid
Function at 0x4bb7bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43d0
cmp edx, dword [eax]
je 0x4bb7df
add eax, 8
inc ecx
cmp eax, 0x4c4460
jl 0x4bb7d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43d0]
jne 0x4bb90d
mov eax, dword [0x4c8d64]
cmp eax, 1
je 0x4bb8e7
test eax, eax
jne 0x4bb810
cmp dword [0x4c42fc], 1
je 0x4bb8e7
cmp edx, 0xfc
je 0x4bb90d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb847
lea eax, [ebp - 0x1a4]
push 0x4c0b30
push eax
call fcn.004bc1a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc630
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb88a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc630
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b2c
push edi
call fcn.004be500
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4c0b10
push eax
call fcn.004bc1a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc1b0
lea eax, [ebp - 0xa0]
push 0x4c0b0c
push eax
call fcn.004bc1b0
push dword [esi + 0x4c43d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc1b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4c0ae4
push eax
call fcn.004be474
add esp, 0x2c
pop edi
jmp 0x4bb90d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43d4]
push 0
push eax
push dword [esi]
call fcn.004bc630
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xf1ad04
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf1ad0e
pushal
call 0xf1ad14
pop ebp
sub ebp, 0x10
sub ebp, 0xb1ad04
lodsd eax, dword [esi]
mov cl, 0
jmp 0xf1ad2a
mov eax, 0xb1ad04
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c7
mov edx, 0x3ef89477
xor byte [eax], dl
inc eax
dec ecx
jne 0xf1ad41
jmp 0xf1ad54
cld
mov edx, 0x774bfefc
ja 0xf1add3
div byte [esi + 0x7777778f]
je 0xf1ad1e
iretd
lahf
xchg ebx, eax
clc
ja 0xf1ae4e
pop ebx
push ebx
cli
adc edx, dword [ebx - 0x75]
invalid
bound esi, qword [edi + 0x77]
ja 0xf1ae89
sahf
mov ebx, 0x5e888888
cmp ecx, dword [esi + 0x76]
hlt
cld
add bh, byte [ebx - 4]
or bh, byte [edi - 0x75]
invalid
Function at 0x10007760
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x1000776f
pop dword [ebp - 0x14]
mov eax, 0x872e3390
add eax, 0x88d243df
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x65625207
sub dword [ebp - 0x24], 0x17100cbc
mov dword [ebp - 0x20], 0xf85e7b48
add dword [ebp - 0x20], 0x39d4d0fd
mov dword [ebp - 0x1c], 0x1a631d75
sub dword [ebp - 0x1c], 0xce16d947
mov dword [ebp - 0x18], 0xbf8661f3
sub dword [ebp - 0x18], 0xbf8661f3
lea eax, [ebp - 0x24]
push eax
mov eax, 0x5e6e6b2c
sub eax, 0x4e6d2adc
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x9d14fea8
sub dword [ebp - 0x24], 0x28a29552
mov dword [ebp - 0x20], 0xff6cfe94
add dword [ebp - 0x20], 0x41ff62e1
mov dword [ebp - 0x1c], 0x2e374
add dword [ebp - 0x1c], 0x636c88f8
mov dword [ebp - 0x18], 0x5e1fe3f0
add dword [ebp - 0x18], 0xa1e01c10
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x37133
push 0
call eax
mov ecx, 0xac78669a
add ecx, 0x5387d5d0
mov esi, eax
mov edx, 0x1001e200
add edx, dword [ebp - 0x14]
mov edi, 0x986ad34d
sub dword [ebp - 4], 0xa2dcca30
mov ebx, dword [edx]
add dword [ebp - 8], 0x13d56558
xor ebx, edi
xor dword [ebp - 8], esi
mov dword [esi], ebx
add esi, 0x39533b15
sub esi, 0x39533b11
add edx, 0x6f7ab3ec
add edx, 0x90854c18
loop 0x10007880
add eax, 0xe47b
mov ebx, eax
add eax, 0xc950c539
sub eax, 0xc950c534
mov ecx, 0x10000000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret