joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ec7f
Capabilities:
Check os version
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
js 0x414309
jns 0x40ec8b
invalid
jns 0x414309
sub dl, 0xff
mov ebx, 0x66c98845
mov ax, ax
jno 0x41d2a3
jo 0x414318
cpuid
ret
jo 0x41d2a3
xor al, 0x77
call fcn.0040593c
add esp, 0x24
test ax, ax
jb 0x426b33
je 0x41435e
add byte [eax], al
add byte [ebp + 2], dh
jne 0x41433e
mov edx, 0x1a3d663b
add byte [edi], cl
test byte [esi], dl
add byte [eax], al
add byte [ebp + 4], dh
cmp ax, 0x1a
je 0x41435e
jne 0x41434e
loope 0x41435b
mov byte [0xa3d66c3], al
add byte [edi], cl
test dword [ebp + 0x740000d6], ebp
add al, 0xb5
cmp ax, 0xa
jne 0x421a05
lodsd eax, dword [esi]
salc
add byte [eax], al
je 0x41435e
mov ch, 0x10
jne 0x414337
adc byte [ebp - 0x27], dh
inc edi
cmp edi, 7
mov dword [ebp - 8], edi
jbe 0x4434a9
ja 0x414374
in al, dx
jb 0x414354
add cl, byte [ebx + 0x51006a0e]
mov ecx, dword [esi]
push 0
push ecx
shr al, 0x40
call fcn.00424c65
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
jmp 0x41c71d
pop ebp
ret
push ebp
mov ebp, esp
mov cx, cx
mov eax, dword [ebp + 0x10]
mov ecx, eax
dec eax
cmp edx, edx
test ecx, ecx
jb 0x42db17
jmp 0x437f1f
fld dword [ecx - 0x75]
inc esi
add al, 0xf5
je 0x416fe0
jne 0x437f29
dec ebp
retf
mov ebp, ebp
lea ecx, [eax + 1]
push 0x43b79d
ret

Function at 0x40f5c1
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
jne 0x430b68
je 0x40f5d1
mov word [eax - 0x51], ds
ja 0x41eadc
jbe 0x40f5db
test ecx, 0x1000
jb 0x443b6d
push ebx
pop ebx
jne 0x41401e
push eax
pop eax
je 0x4169fd
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
jmp 0x406614
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x443b62
jne 0x4247ba
je 0x430b97
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x4169e1
je 0x430bb4
cpuid
nop
ret
je 0x4169e1
in al, dx
sub eax, dword [ebx]
pop ds
popfd
shl al, 0x20
jmp dword [esi - 4]
pushal
pop esp
shl esi, 0x20
movzx eax, byte [edi]
popfd
jmp dword [esi - 4]

Function at 0x40f8c4
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
inc esp
and al, 0xfc
mov al, byte [ebp + 0xb]
add esp, 0x30
add eax, 0
cmp bl, 1
shr di, 0x40
mov cl, cl
mov byte [esi + 0xba], bl
js 0x4357f0
jns 0x40f8f1
cpuid
pop edi
ret
jns 0x4357f0
fnstenv [ebx - 0x3fabea01]
inc ebp
add byte [ebp - 0x7b7df040], al
cmp eax, dword [eax]
add byte [esi + 0xffa86d7], al
mov byte [ebp + 0x7900017a], cl
add al, 0xf
dec esi
jno 0x40f8c5
Function at 0x41b43e
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, edi
mov dl, dl
mov al, byte [eax]
lea esi, [esi + 0xc]
jmp 0x43445c
stc
jb 0x434463
popfd

Function at 0x420e8e
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x42336f
je 0x420ea9
and al, 0xc5
je 0x42336f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x423377
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.004137d2
shl eax, 0x20
call fcn.0043b14d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret

Function at 0x420f20
Capabilities:
Check os version

Disassembly:
mov al, byte [esi + edx]
push eax
call fcn.00421964
and bp, bp
add esp, 4
test eax, eax
jb 0x41c322
je 0x421950
jne 0x4050af
sbb cl, byte [edi]
mov byte [0xed0946c3], al
inc esi
or ebp, ebp
shl dx, 0x20
jno 0x4050bc
leave
sub dword [eax + 0xc810f14], esp
and eax, 0x99d90001
jno 0x4175ce
fstp dword [ecx - 0x74bba275]
inc esi
add al, 0x88
in eax, dx
jmp 0x40838e
mov bl, 0xcb
jmp 0x42e13b
lea esp, [esp + 4]
mov edx, dword [ebp + 8]
jne 0x405089
je 0x420ec2
bound ebx, qword [edi + ecx - 0x7c]
rol dword [ecx - 2], 0xff
je 0x405089
mov ax, word [ecx + 8]
add ecx, 8
inc edx
cmp ax, 0xffff
jne 0x427c8e
je 0x420ee2
cmpsd dword [esi], dword es:[edi]
jne 0x416fca
jne 0x416fca
je 0x420eed
rcr dword [esi + 0x36], 1
je 0x416fca
xor al, 0x42
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x423d6b
shr ax, 0x40
jbe 0x420f0b
push 0xffffffffffffffce
jbe 0x423d6b
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.00429db6
and eax, 0x24448f81
cld
js 0x43107b
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x420f37
cpuid
nop
ret
jns 0x43107b
invalid
push eax
ja 0x4142f5
jbe 0x423d77
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
add al, 0x54
inc ecx
jbe 0x4142f5
xor eax, 0x41540438
add byte [esi - 0x75], bh
inc ecx
add byte [edx], cl
mov byte [edx], al
xchg edx, eax
cmp eax, 0x54bb0042
or cl, byte [eax - 0x7481ffbe]
inc ecx
add bh, al
jae 0x423d85
cmc
jne 0x423da1
add byte [ebx - 0x531617bb], cl
aaa
add byte [eax], al
cmp byte [eax], 0xc0
loopne 0x423dce
mov al, byte [ebp + eax]
lea edi, [edi]
push 0x40bcb1
ret
add byte [edi], cl
adc byte [edx + 0x38], 0
add byte [ebp + 0x40fd04], cl
add byte [eax], al
pop es
invalid
add ah, 0
cmp ax, word [ebp + 8]
je 0x408374
jne 0x427ca1
nop
cpuid
ret
jno 0x420ec8
mov bh, bh
jo 0x427cae
js 0x427c83
test eax, 0x9214800f
invalid
jo 0x420ec8
ficom dword [edi - 0x75]
push esi
pop esi
jmp dword [esi]
mov cl, byte [ebp + 0x34]
xchg di, ax
xchg di, ax
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
rol word [ebx], cl
shl cl, 0x20
jmp dword [esi]
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20
Function at 0x421327
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push ebp
ja 0x42d036
jbe 0x40b512
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x42d036
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x40b505
jo 0x421332
dec edi
xor edi, ecx
jo 0x40b505
xor eax, 0xfbe1e8e0
invalid

Function at 0x422745
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
iretd
lea esp, [esp + 4]
mov ax, ax
xchg cx, dx
xchg dx, cx
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax]
stc
add esi, 8
mov ax, ax
shl eax, cl
test edx, 0x416e05a6
add edi, eax
test ecx, 0x80000000
jb 0x4200dc
shl esi, 0x20
jne 0x43f977
je 0x422786
enter 0xffffffffffff81a1, 0xffffffffffffffc6
add al, 0
add byte [eax], al
add esi, 4
popfd
jmp dword [esi - 4]

Function at 0x4227cf
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
jmp 0x40e2f3

Function at 0x424d80
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.004162f0
Function at 0x4282df
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
call fcn.0040755a
fxch st(1)
shr cl, 0x40
jmp fcn.00442a61
Function at 0x42c25f
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
aad 0x7b
xchg si, dx
xchg dx, si
jne 0x41c461
je 0x40faf4
cpuid
out 0xc3, al
je 0x41c461
xor al, 0x32
not byte [edi]
mov dl, dl
jmp dword [esi]
pop dword [esp - 4]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [ebp + 0xc]
and bx, bx
cmp ax, ax
xor edx, edx
jb 0x40fae0
cmp eax, 0xffffffff
setne dl
mov dword [ecx], eax
mov eax, edx
pop ebp
ret

Function at 0x42cf56
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
je 0x405147
jne 0x405141
inc esp
cdq
mov dword [eax], 0x48c
pop edi
pop esi
mov ax, 0x18
pop ebx
mov esp, ebp
pop ebp
ret
push ecx
pop ecx
mov eax, dword [esi + 2]
xor edx, edx
jb 0x43a3ba
mov dword [ebx], eax
mov cx, word [esi]
mov word [ebx + 8], cx
mov dword [ebx + 4], 0x60
lea edi, [ebx + 0x14]
jmp 0x405181
mov cl, byte [esi + edx + 6]
mov eax, edi
mov esi, 8
add edi, 0x60
mov bl, cl
mov byte [eax + 2], 0
push 0x443443
ret
pop dword [esp - 4]
cmp edi, 0x48c
mov dword [ebp + 0x14], 0x48c
jae 0x405154
jb 0x41e940
lodsd eax, dword [esi]
sub cl, ch
in eax, 0
add dl, bl
into
jmp 0x42cf38
rcr byte [edx - 2], 1
jmp [edx + 8]
mov eax, dword [ebp + 0x18]
test eax, eax
jb 0x43a3b2
ja 0x405137
jbe 0x42cf4e
push edx
popal
lea ecx, [edi]
xchg bl, ah
cmp ebp, 0x8f5a05ff
inc esp
and al, 0xfc
jbe 0x405137
add eax, 0x24448f5a
cld
lea ecx, [ebp - 0x10]
mov cl, cl
push ecx
lea esi, [esi]
push 0x43aec0
push 0
push 0x46ae99
js 0x44381f
jns 0x42cf79
jl 0x42cf14
dec edi
jns 0x44381f
add eax, 0x3026fff7
test al, 0x88
in al, 0x8b
jbe 0x42cf8e
call fcn.00433d0d
and eax, 0x86e286df
add byte [0x86e286df], ah
aam 0x8d
jbe 0x42cf9c
inc eax
push esi
call fcn.00450200

Function at 0x42e3d1
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
call 0x419598
sahf
and cl, al
loop 0x4179fa
ja 0x41288f
jbe 0x4179e4
add byte [edi], 0xf
xchg byte [ebp - 0x38000052], ah
sbb al, 0x9f
cmpsd dword [esi], dword es:[edi]
inc ecx
add byte [eax + eax], al
add byte [edx + eax*2 + 0x400041], bl
jbe 0x41288f
invalid
add byte [eax], al
xor al, 0
add byte [eax], al
rol word [edx], 1
inc eax
add byte [eax], al
add byte [eax + eax], al
add byte [edx + eax*8], ah
inc edx
add byte [eax - 0x76ffbcf3], dh
push ebp
cmp bh, bh
or edx, dword es:[edx - 0x75]
inc ebp
xor byte [eax + 0x6b01e8d2], cl
add dword [eax], eax
invalid
lea esp, [esp + 4]
xor ebx, ebx
jb 0x4179d5
test ecx, ecx
jb 0x4179e2
ja 0x44129e
jbe 0x42e3c9
cmp ebx, ebp
cmp dword [ebx + 0x2ecf860f], 0x28820001
jbe 0x44129e
sub byte [eax], 0x8f
inc esp
and al, 0xfc
Function at 0x432250
Capabilities:
Check os version

Disassembly:
jle 0x41d3d4
xchg bp, ax
mov esi, dword [esi + 4]
mov esi, dword [ebp + esi]
mov esi, dword [esi]
jmp dword [esi]
ret
pop dword [esp - 4]
mov esp, ebp
pop ebp
mov al, al
jne 0x41f2a6
je 0x432264
outsb dx, byte [esi]
pop es
xchg esi, eax
je 0x41f2a6
xor al, 0x6a
ja 0x41d3b9
jbe 0x432278
sbb al, 0x3e
insb byte es:[edi], dx
ja 0x432288
jbe 0x41d3b9
xchg byte [ebx], bh
mov cl, 0xfe
invalid
fnstcw word [ebx + 0x4c481]
add byte [eax], al
xor word [ebp + ebx], ax
jb 0x437b82
inc esp
sbb eax, 0xf1820f00
pop eax
add byte [eax], al
jmp dword [esi]
mov ch, 0x25
je 0x4384ff
and eax, 0x42d1662e
add byte [eax], bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx + 0x3000406a], bh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edx + 0x41], al
add byte [edx + esi + 0x41], ah
add byte [ecx - 0x6effbdfa], dh
mov al, byte [0x59e50040]
inc ebx
add byte [eax], dh
add byte [eax], al
add byte [eax + eax], cl
add ch, ah
pop ecx
inc ebx
add byte [eax + eax], cl
add byte [eax], dh
add byte [eax], al
add byte [edx - 0x3b], al
inc ebx
add dh, dl
jnp 0x437c16
add byte [eax + 0x12], al
inc edx
lds eax, [ebx]
xchg ecx, eax
mov al, byte [0x50250040]
add dh, 0xe8
sub dh, 0xe8
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x44416c
jne 0x42c046
je 0x437c08
and byte [edx], 0x1c
imul esp, dword [esi - 0x77], 0xffffffdb
mov bx, bx
call fcn.004282df
mov di, di
add edi, dword [ecx + 0x6870fb5]
popfd
cld
push dword [esi + 4]
jae 0x44418d
leave
pop ebx
jbe 0x40de7b
add byte [esi - 0x3f], ah
ljmp 0xd340
Function at 0x434f21
Capabilities:
Check os version

Disassembly:
push ebp
sub cl, byte [edi]
sub dword [edx + 0x24], 0x4700003
invalid
call fcn.00441ede
pop edi
pop esi
lea ecx, [ecx]
pop ebx
push eax
pop eax
mov esp, ebp
js 0x42cdd8
push esi
pop esi
jns 0x422ef5
jg 0x422f0a
clc
jns 0x42cdd8
push esi
mov byte [esi + 0xba], cl
shl cl, 0x20
mov si, si
mov byte [esi + 0xbb], 0
xchg byte [ebx], bh
xchg bx, bp
shl ax, 0x20
xchg bp, bx
shr edx, 0x40
mov word [esi + 0xbc], dx
shl bp, 0x20
call fcn.0040e888
mov al, byte [ebp + 0xb]
push esi
shr bx, 0x40
mov byte [esi + 0xba], bl
shr cx, 0x40
mov byte [esi + 0xbb], al
shl ecx, 0x20
shr dl, 0x40
mov word [esi + 0xbc], di
shl edx, 0x20
push 0x4294bd
ret
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid
pop ebp
ret
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
mov cx, cx
lea eax, [ebp - 8]
push 8
lea ecx, [ebp - 0x1c]
shr cx, 0x40
jne 0x43e755
je 0x4347f7
cpuid
and ebx, eax
je 0x43e755
add eax, 0x24448f00
cld
jmp 0x434804
push esi
call fcn.0041b1ef
add esp, 0x30
test ax, ax
jb 0x411df8
jne 0x422edf
je 0x434825
mov ch, 0x58
mov al, byte [0xff6ffeb]
sub dword [ecx], 0x70fffe7d
add al, byte [ecx]
adc ecx, dword [edi]
sbb byte [edi], 0x7d
invalid
jmp 0x434826
push esi
jno 0x41c557
jo 0x434832
add dword [ebx], edx
jo 0x41c557
and eax, 0x38558b69
div ebx
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x38], edx
jmp dword [esi]
add esp, 4
xor eax, eax
jb 0x430261
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x424d96
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x434f35
jge 0x434f64
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp 0x4347dc
jmp 0x43e756
push eax
add eax, 0x24448f62
cld
Function at 0x435917
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step

Disassembly:
push 0x41ea63
ret
mov bh, bh
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
mov bp, bp
call fcn.00417266
jne 0x4286dd
shl ebx, 0x20
je 0x418567
adc edx, esp
imul ecx, dword [edi], 0xffffff84
jo 0x41856c
je 0x4286dd
add dword [eax], eax
add cl, bl
pop esp
jmp 0x418570
fstp dword [ebx + ebp*8 - 1]
invalid
push eax
call fcn.00424c65
add esp, 0xc
pop edi
pop esi
xchg cl, ah
xchg ah, cl
pop ebx
mov esp, ebp
pop ebp
ret
pop dword [esp - 4]
mov byte [esi + 0xba], cl
shr ebp, 0x40
mov cl, cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
call fcn.0043d83a
stc
add esp, 0x3c
shr eax, 0x40
js 0x42b83f
jns 0x4210e7
xchg esi, eax
into
or dword [edi], 0xffffff89
push edx
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
jns 0x42b83f
fcomp st(1)
shl si, 0x20
mov dx, word [ebp + 0x10]
jno 0x4358ec
jo 0x421101
dec esp
fisttp qword [edi]
and ch, 0x47
add dword [eax], eax
jo 0x4358ec
and eax, 0x3b24f782
push esi
mov byte [esi + 0xba], cl
mov al, al
js 0x418541
jns 0x423b14
mov edx, 0x27890f10
dec edx
invalid
jns 0x418541
mov dword [esi], 0x880f3f8d
inc esp
jno 0x423b21
dec dword [eax + 0x20379c0]
invalid
push 0x428a66
ret
mov esi, eax
push 0x441ae8
ret
jne 0x41542a
shl dl, 0x20
je 0x4358e4
sal ch, 0x4e
je 0x41542a
or byte [edx], 0xeb
jmp 0x4358ed
push eax
xchg bl, dl
mov edx, edx
xchg dl, bl
mov ax, ax
jne 0x423b01
je 0x435902
cli
xchg esi, eax
je 0x423b01
fld dword [ecx + 0x6a]
add byte [ebp + 0x3e68d855], cl
out 0x40, al
add bl, al
and eax, 0x24448f7d
cld
push 0x9c40244c
push edx
call fcn.00412822
jne 0x4298d5
je 0x435932
loopne 0x43594d
jae 0x4358d6
je 0x4298d5
invalid
or al, 0x85
inc esp
sbb eax, 0xe3820f00
mov cl, 0xfe
dec dword [ebp + 0x3326ff36]
invalid

Function at 0x437cb0
Capabilities:
Check os version
Encode data using base64

Disassembly:
clc
lodsb al, byte [esi]
call fcn.00424d80
pop dword [esp - 4]
je 0x43e658
jne 0x437cbf
pop ebx
out 0x6e, al
xor eax, eax
jb 0x42d979
pop esi
mov esp, ebp
jne 0x43e651
je 0x437cd4
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x43e651
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x43e6ad
je 0x43e66a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x42d982
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x43025a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x43e67b
jge 0x43e6a6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
jmp 0x4347dc
cmp al, 2
mov esi, esi
call 0x4430c0
invalid
Function at 0x43a05a
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push 0x415089
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x41a1f4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x40ae39
je 0x425d89
push cs
sub byte [eax], ch
jmp 0x4051a0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x425d35
shr edi, 0x40
je 0x43a073
push ebx
out dx, al
je 0x425d35
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]

Function at 0x43bd85
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop ebp
ret
mov eax, 1
adc byte [ecx + 0xf], 0x8e
mov ch, 0x46
pop dword [esp - 4]
shr ax, 0x40
je 0x42db4b
jne 0x43bd98
add al, 0x16
xchg ecx, edx
xchg ecx, edx
xchg edx, ecx
shl ax, 0x20
inc eax
cmp eax, 0x43
jb 0x43d9e9
jae 0x43bdb2
rcl ch, cl
mov ecx, ebp
xor eax, eax
jb 0x434383
js 0x4244eb
jns 0x43bdc6
mov byte [0xfa8949b], al
mov dword [edi], ebx
xchg esi, edi
push dword [ecx + edi*4]
jns 0x4244eb
xor al, 0xb9
Function at 0x441500
Capabilities:
Get file size

Disassembly:
mov dword [0x8bf688c7], eax
pop esi
or cl, al
jmp 0x4142e2
clc
sbb eax, 0xdb896685
js 0x419ed6
jns 0x416c6c
mov cl, byte [ebp + 0x34]
mov ebx, dword [esi + 4]
shr edx, 0x40
lea esi, [esi + 8]
sar word [ebp + ebx], cl
shl edi, 0x20
jmp dword [esi]
lea eax, [ebp - 4]
shl ebp, 0x20
push eax
call fcn.0041b127
add esp, 4
pop edi
pop esi
xor eax, eax
jb 0x416c5d
pop ebx
push 0x412bc3
ret
pop ebp
ret
jne 0x431025
je 0x42a778
and al, bh
je 0x431025
invalid
push 8
lea ecx, [ebp - 0x10]
push 0x46abd4
push ecx
call fcn.004134c4
add esp, 0xc
test al, al
jb 0x414298
jne 0x43e78a
je 0x431050
mov dl, byte [ecx - 0x13]
ret 0x86a
push 8
lea edx, [ebp - 8]
push 0
push edx
call fcn.0040ec7f
mov eax, dword [esi]
push pe_nt_image_headers32
js 0x43d348
shr edi, 0x40
jns 0x431073
pop esi
xchg eax, edi
dec ecx
jns 0x43d348
fiadd dword [ebx - 0x77f4ba76]
fcmovnb st(0), st(0)
loope fcn.004310a3
jmp 0x431084
push esi
mov ah, ah
mov bh, bh
mov byte [esi + 0xba], bl
jno 0x409f88
jo 0x43109b
pop esi
sti
sbb al, 0xf
and bh, 0x8e
std
inc dword [edx + 0x24448f4d]
pop dword [esp - 4]
jo 0x409f88
or byte [ebp - 0x71], 0x44
and al, 0xfc
mov esi, eax
add si, 0x6742
sub si, 0x6742
add esp, 8
test esi, esi
jb 0x40a877
mov ah, ah
je 0x427db1
jne 0x4310cf
cmp esi, edi
movsd dword es:[edi], dword [esi]
sahf
jmp fcn.0041f659
fidiv dword [edx - 0x3dbbb71]
call fcn.00411cd2
lea ecx, [ebp - 0x11c]
push eax
shr ax, 0x40
push ecx
call fcn.0043b396
lea edx, [ebp - 0x11c]
push 0
push edx
call fcn.0043e043
lea eax, [ebp - 0x11c]
jmp int.00440d64
add esp, 4
cmp word [ebp + 0xa], ax
je 0x42a76e
jne 0x440ed2
mov dl, 0x55
xor eax, eax
jb 0x43b3c3
pop esi
mov esp, ebp
ja 0x42a76a
jbe 0x440ee9
cpuid
ret
jbe 0x42a76a
xor al, 0xb8
jne 0x4100e6
shr ecx, 0x40
shl edi, 0x20
mov bp, bp
je 0x440f04
mov ch, 0xcc
je 0x4100e6
invalid
push ebp
mov ebp, esp
js 0x40bcd6
jns 0x44150f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x40bcd6
fisubr dword [edi - 0x75]
push es
jmp 0x44151a
push eax
call fcn.0042cbbe
jno 0x440ebe
jo 0x44152d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x440ebe
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x44155f

Function at 0x44415c
Capabilities:
Check os version
Encode data using xor
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
jne 0x4247ba
shl ax, 0x20
je 0x44416f
ja 0x40de7b
jbe 0x44417b
Function at 0x444cc0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x444ce4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x444cfe
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.004545e0
add esp, 0xc
cmp si, 0xfc
jbe 0x444d49
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004513d0
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x444df7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x444d79
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x444d95
jmp 0x444eba
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.004545e0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.004545e0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x444e31
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x444e50
lea eax, [esp + 0x18]
push 0
push pe_nt_image_headers32
push eax
call fcn.004545c0
add esp, 0xc
mov edx, dword [esp + 0x14]
push pe_nt_image_headers32
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.00451420
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x445020
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x44504c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.00444cc0
add esp, 0xc
test ax, ax
jne 0x445198
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x445094
cmp eax, 1
je 0x44510e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x4450b5
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00451420
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00451580
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x4450cb
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x4450f6
mov eax, dword [esp + 8]
jmp 0x44517f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x44512f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00451420
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00451580
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x445145
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x44516d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.004545c0
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret