joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b38
Capabilities:
Get common file path

Disassembly:
push 0x14c
mov eax, 0x42aabf
call fcn.00428dbe
xor esi, esi
cmp dword [0x44fa14], esi
jne 0x422c4e
push 0x10
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, esi
je 0x422b6c
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
jmp 0x422b6e
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x44fa14], eax
mov eax, dword [0x44e798]
cmp dword [eax + 0x14], esi
je 0x422bbf
cmp dword [eax + 0x18], 0x10
jb 0x422b8c
mov eax, dword [eax + 4]
jmp 0x422b8f
add eax, 4
push eax
lea ecx, [ebp - 0x134]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 1
push eax
mov eax, dword [0x44fa14]
call fcn.00401a92
lea ecx, [ebp - 0x134]
jmp 0x422c44
call fcn.00422a1c
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x422c15
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x134]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x134]
mov dword [ebp - 4], 2
push eax
mov eax, dword [0x44fa14]
call fcn.00401a92
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x134]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
push 0x433b28
lea ecx, [ebp - 0x150]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
lea eax, [ebp - 0x150]
mov dword [ebp - 4], 3
push eax
mov eax, dword [0x44fa14]
call fcn.00401a92
lea ecx, [ebp - 0x150]
or dword [ebp - 4], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [0x44fa14]
call fcn.00428e41
ret

Function at 0x423877
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x423882
mov eax, dword [eax + 4]
jmp 0x423885
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x423894
xor al, al
ret
and al, 0x10
cmp al, 0x10
sete al
ret

Function at 0x42389c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x18], 8
jb 0x4238a7
mov eax, dword [eax + 4]
jmp 0x4238aa
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4238c0
and eax, 0x10
cmp al, 0x10
je 0x4238c0
mov al, 1
ret
xor al, al
ret
Function at 0x4238c3
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x1c
mov eax, 0x42a136
call fcn.00428d55
mov esi, dword [ebp + 0x214]
mov eax, esi
call fcn.00423877
test al, al
je 0x4238ff
mov al, 1
jmp 0x4239b1
xor ebx, ebx
push 0x206
lea eax, [ebp + 2]
push ebx
push eax
mov word [ebp], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x423924
mov eax, dword [edi]
jmp 0x423926
mov eax, edi
push 0xffffffffffffffff
push eax
lea eax, [ebp]
push 0x104
push eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
lea eax, [ebp]
push eax
call dword [sym.imp.MSVCR80.dll_wcslen]
add esp, 0x14
push 0x5c
lea ecx, [ebp + eax*2 - 2]
pop edx
jmp 0x423951
dec eax
dec ecx
dec ecx
cmp word [ecx], dx
je 0x42394e
lea ecx, [ebp + eax*2 - 2]
jmp 0x42395f
dec eax
dec ecx
dec ecx
cmp word [ecx], dx
jne 0x42395c
mov word [ebp + eax*2], bx
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x28]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 4], ebx
call fcn.004238c3
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
mov bl, al
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
test bl, bl
je 0x4239af
cmp dword [esi + 0x18], 8
jb 0x42399e
mov edi, dword [edi]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
dec eax
neg eax
sbb eax, eax
inc eax
jmp 0x4239b1
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00424d84
add ebp, 0x20c
leave
ret

Function at 0x423bd9
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, eax
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x423c0b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
push dword [ebp + eax - 0x18]
call esi
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
mov dword [ebp + ecx*4 - 0x18], eax
jl 0x423c08
push 0x10
xor eax, eax
pop ecx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 0x14]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x18]
sub eax, 0x61c88647
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
add ebx, edx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 0xc]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
add edi, edx
dec ecx
jne 0x423c2c
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
leave
ret
Function at 0x423c7f
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.WS2_32.dll_ntohl]
push edi
mov edi, eax
push dword [edi]
call esi
push dword [edi + 4]
mov ebx, eax
call esi
and dword [ebp - 4], 0
mov edi, eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
sub eax, ecx
mov dword [ebp - 8], eax
jmp 0x423cb1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx*4]
push dword [ebp + eax - 0x18]
call esi
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
mov dword [ebp + ecx*4 - 0x18], eax
jl 0x423cae
push 0x10
mov eax, 0xe3779b90
pop ecx
mov edx, ebx
shr edx, 5
add edx, dword [ebp - 0xc]
mov esi, ebx
shl esi, 4
add esi, dword [ebp - 0x10]
xor edx, esi
lea esi, [eax + ebx]
xor edx, esi
sub edi, edx
mov edx, edi
shr edx, 5
add edx, dword [ebp - 0x14]
mov esi, edi
shl esi, 4
add esi, dword [ebp - 0x18]
xor edx, esi
lea esi, [eax + edi]
xor edx, esi
sub ebx, edx
add eax, 0x61c88647
dec ecx
jne 0x423cd5
mov esi, dword [sym.imp.WS2_32.dll_htonl]
push ebx
call esi
mov ebx, dword [ebp + 0xc]
push edi
mov dword [ebx], eax
call esi
pop edi
pop esi
mov dword [ebx + 4], eax
pop ebx
leave
ret
Function at 0x424142
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call sub.MSVCR80.dll_memset
and dword [esi + 0x10], 0
and dword [esi + 0x14], 0
and dword [esi + 0x58], 0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
ret
Function at 0x424bac
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xfe8]
mov eax, 0x1068
call fcn.00428e60
mov eax, dword [0x44201c]
xor eax, ebp
mov dword [ebp + 0xfe4], eax
mov eax, dword [ebp + 0xff0]
push esi
push 0x10
push 0
push eax
mov esi, ecx
mov dword [ebp - 0x24], eax
call sub.MSVCR80.dll_memset
push 0
push esi
call dword [sym.imp.MSVCR80.dll__waccess]
add esp, 0x14
cmp eax, 0xffffffff
jne 0x424bf6
xor eax, eax
jmp 0x424c61
and dword [ebp - 0x20], 0
push 0x431600
lea eax, [ebp - 0x20]
push esi
push eax
call dword [sym.imp.MSVCR80.dll__wfopen_s]
add esp, 0xc
cmp dword [ebp - 0x20], 0
je 0x424bf2
push edi
lea esi, [ebp - 0x80]
call fcn.00424142
mov esi, dword [sym.imp.MSVCR80.dll_fread]
mov edi, 0x1000
jmp 0x424c34
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x80]
call fcn.0042488c
push dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push edi
push 1
push eax
call esi
add esp, 0x10
test eax, eax
jg 0x424c29
push dword [ebp - 0x20]
call dword [sym.imp.MSVCR80.dll_fclose]
push dword [ebp - 0x24]
lea esi, [ebp - 0x80]
call fcn.00424a97
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp + 0xfe4]
xor ecx, ebp
pop esi
call fcn.00424d84
add ebp, 0xfe8
leave
ret

Function at 0x424d84
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44201c]
jne 0x424d8e
repz ret
jmp fcn.0042524c
Function at 0x4274d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x429378
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [0x44201c]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [0x442038]
cmp eax, 0xffffffff
jne 0x42750b
xor ebp, ebp
jmp 0x427514
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x18], ebp
test ebp, ebp
mov dword [esp + 0x40], 0
je 0x427555
cmp dword [ebp + 0x18], 0
jne 0x42759c
cmp dword [ebp + 0xc], 0
jne 0x4275a2
push 0x4257f0
push 0x44f950
call fcn.00425a50
mov eax, dword [0x442038]
add esp, 8
cmp eax, 0xffffffff
je 0x427555
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test ebp, ebp
mov dword [esp + 0x40], 0xffffffff
je 0x427588
lea ecx, [ebp + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x427588
mov eax, dword [ebp]
mov edx, dword [eax]
push 0
mov ecx, ebp
call edx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
je 0x4275ea
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x4275d4
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0xc], 0
jne 0x4275a2
mov ecx, dword [ebp + 0x14]
mov esi, dword [ecx]
lea ebx, [ebp + 0x10]
mov edi, ebx
mov edx, ecx
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], edx
test edi, edi
je 0x42760a
cmp edi, ebx
je 0x427614
mov ebx, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
call ebx
jmp 0x42761a
mov ebx, dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [esp + 0x28]
je 0x427524
lea ecx, [esp + 0x1c]
call fcn.00420091
test edi, edi
jne 0x427633
call ebx
cmp esi, dword [edi + 4]
jne 0x42763a
call ebx
cmp dword [esi + 0x10], 0
je 0x42766f
cmp esi, dword [edi + 4]
jne 0x427647
call ebx
cmp dword [esi + 0x18], 0
je 0x42766f
cmp esi, dword [edi + 4]
jne 0x427654
call ebx
cmp esi, dword [edi + 4]
mov ebx, dword [esi + 0x10]
jne 0x427662
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ecx, dword [esi + 0x18]
mov eax, dword [ebx]
mov edx, dword [eax + 4]
push ecx
mov ecx, ebx
call edx
push esi
push edi
lea eax, [esp + 0x34]
lea ebx, [ebp + 0x10]
push eax
mov ecx, ebx
call fcn.0041fca7
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
jmp 0x427602
Function at 0x427720
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x427690
push 0
push 0
call dword [sym.imp.MSVCR80.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x42774a
pop edi
xor al, al
pop ebx
ret
mov edx, dword [edi]
push esi
add edx, 4
mov eax, 1
lock xadd dword [edx], eax
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x427771
cmp eax, 0xffffffff
je 0x427771
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret

Function at 0x867058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8671a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x86707e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86706a
add dl, dl
jne 0x867089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8670dc
xor eax, eax
add dl, dl
jne 0x867096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x86717d
add dl, dl
jne 0x8670a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8670b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8670bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8670c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8670d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x867075
mov eax, 1
add dl, dl
jne 0x8670ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8670f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8670e1
sub eax, ebx
mov ebx, 1
jne 0x867128
mov ecx, 1
add dl, dl
jne 0x86710e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x867119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x867105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x867075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x86713f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x86714a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x867136
cmp eax, 0x7d00
jae 0x86716d
cmp eax, 0x500
jb 0x867168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x867075
cmp eax, 0x7f
ja 0x867170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x867075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x86719e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x867075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x487d93
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg ebx, eax
inc ecx
shl byte [eax + 0x417fa1e3], 0x96
xchg esi, eax
lodsd eax, dword [esi]
nop
and esi, dword [esp + ebp - 0xcea0a35]
aam 0xe5
or cl, dl
mov dh, 0xe
push esp
lea esi, [ecx]
test dword [eax - 0x22fa8be9], eax
rcl dword [edi - 0x39cf1357], 0x1d
salc
xor eax, 0x21d11ac0
dec ebp
pop eax
xlatb
sub ecx, ebp
shr byte [esi - 0x29424e78], 0x24
mov eax, dword [0x31c51d23]
push ecx
frstor dword [ebx - 0x50]
salc
add dword [ecx - 0x3c], 0xffffffb2
les ebp, [eax + esi*8 - 0x73]
aad 0x55
jge 0x487d9b
stosd dword es:[edi], eax
hlt

Function at 0x4c2c23
Capabilities:
Encode data using xor

Disassembly:
pop ds
inc ebp
cli
adc eax, 0x411a9dfa
push esp
cwde
inc edx
das
xchg ebx, eax
pushfd
push ebp
inc ebx
sub edi, dword [ebx]
sbb eax, 0x575d742
mov ecx, 0x8e8a7ab3
movsd dword es:[edi], dword [esi]
nop
invalid

Function at 0x4cb563
Capabilities:
Encode data using xor

Disassembly:
inc edi
push ebx
and esi, dword [edx + eax*2 + 0x3a3c8221]
test al, 0x51
cwde
sbb dl, byte [0xc5974a07]
invalid

Function at 0x563c83
Capabilities:
Encode data using xor

Disassembly:
jbe 0x563c48
clc
add eax, 0x946d344c
dec esp
xor al, 0x6d
xchg esp, eax
imul eax, dword [edx + 0x452e8e9b], 0xffffff88
mov byte [0xe58eed0c], al
dec esi
mov al, 0xb8
and byte [eax - 0x40e97eff], ch
inc esp
jp 0x563c0d
dec ebp
sub dword [edx - 0x99f56bc], edi
rcr dword [edx], 0x13
shr byte [esi - 0x2104f567], 1
pop esp
sub al, 0x5d
rcl esi, 0x75
outsd dx, dword [esi]
and ebp, edi
stosd dword es:[edi], eax
aaa
dec esp
lodsb al, byte [esi]
jle 0x563c08
clc
invalid
in al, dx
int1
pushal
cdq
mov ecx, 0x955d934e
outsd dx, dword [esi]
ror dword [ecx], 1
fidivr dword [ebp - 0x416bb6ef]
mov ebp, 0xbe944911
loope 0x563c8c
pop ebp
test al, 0x59
mov es, edx
stosd dword es:[edi], eax
jae 0x563cab
pop ebx
cld
jne 0x563c29
push ebx
jb 0x563cf2
outsd dx, dword [esi]
mov ch, 0x52
xchg byte [eax - 0x62b593ba], bh
mov dh, 0xc
int3
push es
jbe 0x563c6c
xchg ebp, eax
and byte [esi - 0x35], dh
std
or esp, edi
stc
stosd dword es:[edi], eax
jb 0x563c79
clc
cmc
stc
xlatb
in al, 0x55
sub eax, 0x83350937
add byte [ecx], ch
in al, 0xce
add eax, 0xcebbbca1
mov bh, 0x10
popal
pop ss
scasd eax, dword es:[edi]
jo 0x563c89
adc byte [0x735ab955], dl
loope 0x563cdd
pop edi
and byte [ebp - 0x10ca0e1b], bh
mov ebp, dword [esi + 0x1951ae11]
push eax
clc
or dword [eax + 0xc1fa306], ebx
sbb eax, 0x7009e51f
push ebx
push edx
dec edi
dec edx
int3

Function at 0x5980b3
Capabilities:
Authenticate hmac

Disassembly:
pop esp
insb byte es:[edi], dx
test dword [edx + edx - 0x37], ebx
mov ebx, 0x605e1cd9
inc ebp
insb byte es:[edi], dx
inc eax
or dl, ah
push ebx
adc al, 0xcb
mov ecx, ss
push 0xfffffffffffffff8
adc edx, dword [edx]
loope 0x59809d
invalid
adc dl, byte [eax]
push cs
popal
shr dword [ebp - 0x56], 0x92
jnp 0x598037
xor al, 3
ret 0x11b0
cmp al, ah
insb byte es:[edi], dx
sar dword [ebx], 1
and bh, ah
mov bh, 0x57
and ecx, 0xffffffc2
jno 0x598042
invalid
Function at 0x5e1fd3
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp esp, dword es:[ebx + 0x1b]
out dx, al
je 0x5e1f9e
outsb dx, byte [esi]
xchg esi, eax
in eax, 0x31
push edx
pop edi
mov word [edx - 0x42], fs
invalid
jbe 0x5e1f2b
dec esp
scasd eax, dword es:[edi]
out dx, al
aaa
invalid
invalid
xor byte [ebp + 0x4660ff55], 0x94
mov ch, 0x12
mov ch, dl
add byte [ecx - 0x6e], ch
adc byte [ecx + 0x74], ah
push edx
cmp byte [ecx], dh
fiadd word [edi - 0x41]
sbb eax, 0x13cd300e
cmp esi, dword [ebx]
jb 0x5e1f9a
xor esi, ebx
inc edi
mov edi, 0xcd300e1d
adc edi, dword [ebx]
xor esi, dword [edx - 0x25]
jne 0x5e1fb2
inc edx
sub dword [edx + 0x43], esi
in eax, dx
push edx
push cs
and edi, edx
or eax, 0x2204829b
add al, 0x22
movsb byte es:[edi], byte [esi]
sti
mov ecx, 0xac8090c3
nop
invalid
lodsb al, byte [esi]
loop 0x5e2033
sub byte [edx + 0x2ebe315b], 0xcf
adc edi, dword [edi - 0x3fc5561e]
xor dword [esi - 0x40ec30d2], edi
loop 0x5e1f89
cmp al, al
mov bh, 0xa0
lds eax, [ebp - 0x6ea1446d]
sti
sub dword [ecx + 0x3ce9a6e], esi
sbb eax, 0xdb2bde03
adc edx, dword [edx]
xor byte [edx], bh
cdq
xchg edx, eax
xor dword [eax - 0x31], ebx
popfd
sahf
ja 0x5e1fcd
add dword [esi + 0x17], esp
notrack jmp 0x5e1fc1
invalid
Function at 0x636473
Capabilities:
Encode data using xor

Disassembly:
dec esp
insd dword es:[edi], dx
mov word [eax + 0x719ba417], fs
jae 0x635ea0
mov ecx, 0xf707aeff
mov cl, 0x96
sub dword [ecx], 0x19acc7de
pop edi
inc eax
pop edx
cmp ecx, edx
arpl word [ebx + 0x77], ax
xor dword [ebx + 0x475ecb8b], eax
dec ecx
xlatb
inc ebx
ja 0x635ed4
or dword [ebx + 0x49475ecb], 0xffffffd7
and byte [ecx + 0x7a501741], cl
mov eax, dword [0x2f57ff39]
stosb byte es:[edi], al
pop esi
imul ebp, dword [ebx + 0x2b09738f], 0xa61d12f
mov eax, 0x4f4b8131
adc ecx, ebp
sub esi, dword [ebx]
sub esp, dword [edi]
dec eax
clc
wait
pop es
scasd eax, dword es:[edi]
invalid
add dword [esi + 0x3f], 0xffffffc7
ljmp 0xd1b9
pop edi
fdiv st(3)
lea ebx, [eax + 0x63e1b23e]
cmc
mov dl, 0x33
jmp 0x635e83
sub eax, 0x9e5b2efa
dec ebx
jl 0x636443
not cl
aas
push ss
mov eax, 0xea49a2d5
cmp edx, dword [0xccd58af0]
push es
jmp 0x6364d3
lds esi, [edx]
enter 0x688d, 0x63
cwde
xchg ebx, eax
inc ebx
in al, 0xb6
popfd
jge 0x636452
mov ebp, 0x42190659
inc esp
pop ecx
push es
sbb dword [edx + 0x44], eax
xchg ebx, eax
push ss
mov ebp, 0x732c7b3e
xor esi, dword [ebx + 0x2c822ae]
in al, dx
xchg esi, eax
adc al, 0x33
dec ebp
jle 0x636483
adc dword [ebx + 0x1b78b9ae], ebp
mov ecx, 0x862b8798
scasb al, byte es:[edi]
je 0x6364c7
sbb al, 0xc
xchg ecx, eax
clc
adc al, 0x6f
fstp xword [ecx - 0x69]
pushfd
push ebp
sbb esi, dword [esi]
scasb al, byte es:[edi]
sub eax, 0x26837ffb
shr dword [ebx + 0x4bc358a3], cl
pop edi
ja 0x636537
out 0xa0, al
ja 0x63652e
or ebx, dword [edi + 0x24211ffb]
les esi, [eax + 0x769d2a87]
mov edi, dword [ecx + 0x539979f3]
xchg dword [edx], ebp
popfd
jbe 0x636463
mov ecx, 0x539979f3
lodsb al, byte [esi]
salc
stosd dword es:[edi], eax
imul edi, dword [ecx], 0x3fb5fa97
sbb bl, 0x93
pushal
int1
push 0x5785efa3
push ebp
fidiv word [esi]
adc dword [ebx], edx
cmp byte [ebp - 0x17], 0x2a
stosb byte es:[edi], al
pop ebp
mov ebp, 0x6b532f98
popal
pop ebx
mov edi, 0xa17f95bb
sahf
and eax, 0xbd09f214
and al, byte [ebx + 0xf9b24ae]
wait
xchg ebx, eax
div dword [edi]
pop ds
loope 0x636595
int 0xc8
mov byte [ebp - 0x27], dl
add byte [ecx + 0x53fa8867], cl
push ebp
dec eax
inc ecx
jp 0x63655c
or edi, dword [eax + ecx + 0x3b]
aad 0xa3
cmp edx, ebp
mov dword [0x88a9373a], eax
aad 0x12
cmp dh, byte [edi]
test eax, 0x9b12d588
wait
add byte [edx + 0x72], dh
adc eax, 0xab7f0414
lds esi, [0x57907939]
sal byte [eax], cl
mov dl, 0xeb
out 0xea, al
add dword [eax], edi
adc eax, 0x2b8b5524
insb byte es:[edi], dx
sub dword [esi + 0x2b8f6af2], ecx
imul ebp, dword [edx + 0x48a6e652], 0xc6a16115
invalid
jmp 0x636531
push edx
out 0xa6, al
dec eax
adc eax, 0xc5c6a161
shr ah, cl
mov edx, 0x197f0cc3
jge 0x636549
test al, 0x7a
sbb eax, 0xf67a7cfa
mov esp, 0x7a7ce726
retf 0x7691
mov esi, 0xd64ae55f
nop
iretd
Function at 0x41dc09
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x41dc18
pop dword [ebp - 0x4c]
mov eax, 0x93937092
sub eax, 0x9351947a
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3bfa8
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x4646
mov edi, eax
mov ebx, 0x432e00
add ebx, dword [ebp - 0x4c]
mov edx, 0x1eb91dcf
sub dword [ebp - 0x34], 0x8e5e96f0
mov esi, dword [ebx]
xor dword [ebp - 0x30], 0x84fc4ad2
add esi, edx
mov dword [ebp - 0x38], 0xc1f4f2af
mov dword [edi], esi
mov dword [ebp - 0x30], 0xc191b1d2
add edi, 4
add ebx, 0xcf02bd50
sub ebx, 0xcf02bd4c
loop 0x41dc60
add eax, 0xffb1e97e
add eax, 0x4f226d
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x403130
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
nop
nop

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx