joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40478c
Capabilities:
Identify system language via api

Disassembly:
mov dx, word [0x430e68]
test dx, dx
jne 0x4047f6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov cx, ax
mov word [0x430e68], ax
mov edx, 0x3ff
and cx, dx
cmp cx, 9
je 0x4047b9
movzx eax, ax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, 0x409
cmp ax, cx
jne 0x4047ef
push esi
mov esi, dword [0x426dc0]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
movzx edx, word [0x430e68]
cmp eax, esi
movzx ecx, si
cmove edx, ecx
mov word [0x430e68], dx
pop esi
jmp 0x4047f6
mov dx, word [0x430e68]
movzx eax, dx
ret

Function at 0x40493f
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x404992
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 8]
pop ebx
leave
ret

Function at 0x404c1a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movzx ecx, word [0x430e68]
mov edi, eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceExA]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x404c5e
push 0x409
push dword [ebp + 0xc]
push dword [ebp + 8]
push edi
call ebx
mov esi, eax
test esi, esi
je 0x404c84
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x404c6f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebx], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404c84
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x404cf1
cmp dword [0x430e74], 0
jne 0x404cef
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetProcessPreferredUILanguages
push dword [0x430eb8]
mov dword [0x430e74], 1
call edi
movzx ecx, word [0x430e68]
xor ebx, ebx
push ebx
push 0x409
push ebx
push ecx
mov esi, eax
lea eax, [ebp - 0x40]
push str._04X_c_04X_c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test esi, esi
jne 0x404ce6
push str.SetThreadPreferredUILanguages
push dword [0x430eb8]
call edi
mov esi, eax
test esi, esi
je 0x404cef
push ebx
lea eax, [ebp - 0x40]
push eax
push 4
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404dc3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 1
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp + 8]
mov edi, eax
call fcn.0041158b
mov ecx, dword [ebp + 8]
lea esi, [edi + 2]
push esi
call fcn.00404031
lea eax, [edi + 1]
mov edi, dword [ebp + 8]
push eax
push esi
mov ecx, edi
call fcn.00404031
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [edi]
push esi
call fcn.00404eab
pop ecx
mov dword [edi + 4], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, edi
pop edi
pop esi
leave
ret

Function at 0x4057e3
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x405825
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 0xb7
cmp eax, esi
je 0x405810
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x405828
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405825
test al, 0x10
jne 0x405825
push esi
jmp 0x405806
xor eax, eax
inc eax
pop esi
pop ebp
ret
Function at 0x405a7a
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x30
push ebx
push edi
push 0x3a
pop edx
cmp word [eax + 2], dx
jne 0x405bfc
movzx ecx, word [eax + 4]
push esi
push 0x5c
pop esi
cmp cx, si
je 0x405aa8
cmp ecx, 0x2f
jne 0x405bfb
mov ax, word [eax]
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], dx
mov word [ebp - 8], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x405bf8
lea eax, [ebp - 0x24]
push str.7ZSfx_03x.cmd
push eax
call fcn.00403be2
pop ecx
pop ecx
xor eax, eax
push eax
push 0x80
push 2
push eax
push eax
push 0x40000000
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x405bef
lea ecx, [ebp - 0x18]
call fcn.0041158b
push str.:Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.004116bd
mov ebx, str.del__
lea ecx, [ebp - 0x18]
push ebx
call fcn.0041185b
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041181d
mov esi, 0x427cb8
lea ecx, [ebp - 0x18]
push esi
call fcn.0041185b
push str.if_exist__
lea ecx, [ebp - 0x18]
call fcn.0041185b
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041181d
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x18]
call fcn.0041185b
push ebx
lea ecx, [ebp - 0x18]
call fcn.0041185b
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
call fcn.0041181d
push esi
lea ecx, [ebp - 0x18]
call fcn.0041185b
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push 1
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00405873
add esp, 0xc
lea ecx, [ebp - 4]
xor ebx, ebx
push ebx
push ecx
push esi
push dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x30]
mov esi, eax
call fcn.00419a19
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x405c07
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x14]
jne 0x405c07
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push dword [ebp - 0x24]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x18]
call fcn.00419a19
pop ecx
push dword [ebp - 0x24]
call fcn.00419a19
pop ecx
mov eax, dword [ebp + 8]
pop esi
push eax
call fcn.00419a19
pop ecx
pop edi
pop ebx
leave
ret
push dword [ebp - 0x24]
call fcn.00403da4
push dword [ebp - 0x18]
call fcn.00419a19
push dword [ebp - 0x24]
call fcn.00419a19
add esp, 0xc
jmp 0x405bf8
Function at 0x406323
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x430fd8], esi
jle 0x406377
mov eax, dword [0x430fd4]
lea ecx, [ebp - 0xc]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
call fcn.00411523
lea eax, [ebp - 0xc]
push eax
call fcn.00405f4e
mov eax, dword [0x430fd4]
pop ecx
push dword [ebp - 0xc]
mov eax, dword [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0xc]
call fcn.00419a19
inc esi
pop ecx
cmp esi, dword [0x430fd8]
jl 0x406334
pop esi
leave
ret

Function at 0x406390
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
push 0x4279fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x430eb8], eax
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
call fcn.0040a481
call fcn.0040478c
push 3
call fcn.004041e0
push 0x28
mov dword [0x430e7c], eax
call fcn.004041e0
push 2
mov dword [0x430ebc], eax
call fcn.004041e0
push 5
mov dword [0x430e78], eax
call fcn.004041e0
push 0x15
mov dword [0x430e84], eax
call fcn.004041e0
push 0x16
mov dword [0x430e88], eax
call fcn.004041e0
push 0x17
mov dword [0x430e8c], eax
call fcn.004041e0
add esp, 0x1c
mov dword [0x430e94], eax
xor ebx, ebx
mov dword [0x430e90], ebx
mov esi, ebx
mov dword [0x430e80], ebx
push ebx
push esi
lea eax, [ebp - 0x268]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x406484
push esi
lea eax, [ebp - 0x5c]
push str.SfxFolder_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 1
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0040575f
add esp, 0x18
mov edi, ebx
cmp dword [edi + 0x4303c4], esi
jne 0x40647c
push ebx
lea eax, [ebp - 0x268]
push eax
push dword [edi + 0x4303c8]
call fcn.0040575f
add esp, 0xc
add edi, 8
cmp edi, 0x28
jb 0x40645e
inc esi
cmp esi, 0x40
jl 0x406423
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406563
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.ntdll.dll
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edi, edi
mov ebx, eax
push edi
push edi
push 3
push edi
push 1
push SysReAllocStringLen
push str.c:windows_system32_ntdll.dll
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push edi
push edi
push edi
push 0x1000002
push edi
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push edi
push edi
push edi
push 4
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, dword [ebx + 0x3c]
add esi, ebx
mov dword [ebp - 0xc], eax
xor eax, eax
cmp ax, word [esi + 6]
jae 0x406648
movzx eax, di
imul ecx, eax, 0x28
movzx eax, word [esi + 0x14]
add eax, 0x18
push str..text
add ecx, esi
add eax, ecx
push eax
mov dword [ebp - 8], eax
call fcn.0041b600
pop ecx
pop ecx
test eax, eax
jne 0x406641
and dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push 0x40
push dword [eax + 8]
mov eax, dword [eax + 0xc]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
push dword [eax + 8]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
add eax, ecx
push eax
lea eax, [ecx + ebx]
push eax
call fcn.00416ba0
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push dword [ebp - 4]
push dword [eax + 8]
mov eax, dword [eax + 0xc]
add eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc edi
cmp di, word [esi + 6]
jb 0x4065cd
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
push dword [ebp - 0x18]
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407868
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.0041b90e
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.00407793
add esp, 0x1c
leave
ret
Function at 0x408dcc
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d0
push ebx
push esi
push edi
lea eax, [ebp - 0x10]
mov esi, 0x4b6
push eax
push esi
mov edi, ecx
call fcn.00408528
mov eax, dword [ebp - 4]
mov ecx, edi
sub eax, dword [ebp - 0xc]
push 1
add eax, 2
push esi
mov dword [edi + 0x58], eax
call fcn.00409dfa
push 1
lea ebx, [esi + 1]
mov ecx, edi
push ebx
call fcn.00409dfa
mov esi, 0x2b4
lea eax, [ebp - 0x2c4]
push esi
push 0
push eax
call fcn.00416a40
add esp, 0xc
lea eax, [ebp - 0x4d0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x103
push esi
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x4d0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [ebp - 0x2c4]
push ebx
push dword [edi + 4]
mov dword [edi + 0x50], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x407e84
push 0xfffffffffffffffc
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, edi
mov dword [edi + 0x54], eax
call fcn.0040885e
mov ecx, edi
mov esi, eax
call fcn.004098d4
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x409dab
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
call fcn.0040860b
test eax, eax
jne 0x409dc9
push eax
push eax
push esi
push 0x409fef
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
ret
push dword [0x430e78]
mov ecx, esi
push dword [esi + 4]
call fcn.00409ad9
push 0x2d
call fcn.004041e0
pop ecx
push eax
push 0x4b2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov ecx, esi
call fcn.00409ad9
pop esi
ret

Function at 0x40a481
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
push 8
mov ecx, edx
pop esi
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor ecx, eax
sub esi, 1
jne 0x40a489
mov dword [edx*4 + 0x433ce0], ecx
inc edx
cmp edx, 0x100
jb 0x40a484
mov esi, 0x800
jmp 0x40a4d1
mov ecx, dword [edx*4 + 0x4338e0]
movzx eax, cl
shr ecx, 8
xor ecx, dword [eax*4 + 0x433ce0]
mov dword [edx*4 + 0x433ce0], ecx
inc edx
cmp edx, esi
jb 0x40a4b5
mov eax, 0x424c90
mov esi, 0x424bb0
mov dword [0x433cc0], eax
mov dword [0x433cb8], eax
mov dword [0x433cbc], esi
call fcn.0040fed8
mov ecx, dword [0x433cb8]
test eax, eax
cmove ecx, esi
mov dword [0x433cb8], ecx
pop esi
ret
Function at 0x41022e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x410254
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x410254
xor al, al
jmp 0x410268
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x413490
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [edi + 0x1c]
shr edi, 2
mov eax, edi
mov dword [ebp - 0xc], ecx
shr eax, 1
add eax, 3
mov dword [ebx], eax
add ebx, 0x10
test edi, edi
je 0x4134c6
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, edi
jb 0x4134b9
cmp esi, ecx
jae 0x4135a9
mov eax, esi
sub eax, edi
lea eax, [ebx + eax*4]
mov dword [ebp - 4], eax
xor edx, edx
mov ecx, dword [ebx + esi*4 - 4]
mov eax, esi
mov dword [ebp + 8], ecx
div edi
mov dword [ebp - 8], eax
test edx, edx
jne 0x41353f
movzx ecx, cl
movzx edx, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
shr ecx, 0x18
shl edx, 8
movzx eax, byte [ecx + str.cw]
mov ecx, dword [ebp + 8]
or edx, eax
mov eax, ecx
shl edx, 8
shr eax, 0x10
movzx eax, al
shr ecx, 8
movzx eax, byte [eax + str.cw]
or edx, eax
movzx eax, cl
shl edx, 8
movzx ecx, byte [eax + str.cw]
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x428338]
xor ecx, eax
or ecx, edx
jmp 0x41358f
cmp edi, 6
jbe 0x41358f
cmp edx, 4
jne 0x41358f
mov edx, dword [ebp + 8]
mov eax, ecx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, edx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, edx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, dl
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
add edx, 4
xor eax, ecx
mov dword [ebp - 4], edx
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [ebp - 0xc]
jb 0x4134d8
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4140d5
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
pop ebp
ret

Function at 0x41fd1a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041f9bc
Function at 0x418ac2
Capabilities:
Encode data using xor

Disassembly:
ret 0xa24b
add al, byte [edx - 0x54]
arpl dx, bp
cmpsd dword [esi], dword es:[edi]
xor dh, bl
xchg edx, eax
out dx, eax
mov al, 0xf2
shr byte [ebx], 0x3f
xchg ebx, eax
add ebx, esp
adc dh, byte [ecx]
or dword [ecx + 0x5a], ebp
invalid
pop edx
into
jle 0x418a63
imul ebx, dword [edx - 0x32], 0x39c19c7e
mov dh, 0x54
sar dword [ecx], 0xb6
push esp
mov al, byte [0x7192da8c]
in al, dx
sti
adc eax, 0xadae87b
cmp ebp, dword [ebp - 0x69c0781b]
sti
cmovge esi, dword [edx + 0x51]
jge 0x418aad
push esp
stosd dword es:[edi], eax
out dx, eax
ret

Function at 0x4b6e90
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dword [edi + 0x70f9a229], ebp
clc
sub al, 0x29
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
mov al, byte [0x7408ba5c]
lea esp, [ebp + 0x44]
or byte [ebp + ecx*4 + 0x65], dh
inc esp
aam 0x71
pop edx
sbb dword [esi + 0x55], esi
loopne 0x4b6ebb
mov al, 0x19
mov ecx, 0x314c9578
scasb al, byte es:[edi]
push 0xf5583009
cdq
jl 0x4b6f1d
popal
dec edx
push ecx
or eax, 0xc44425df
imul esi, dword [edx + edx + 0x24], 0xba88a5c5
cmp al, 0xb4
and eax, dword [ebp - 9]
pop ebp
mov dl, 0xfd
jns 0x4b6e9f
sbb esi, dword [eax - 4]
imul edi, ecx, 0x87ca6994
mov ch, 0x9b
add al, 0x39
xor eax, 0xcb3aa428
fst dword [0x23ed2fc9]
xor dword [edi - 0x3f], ecx
jp 0x4b6f4c
stosb byte es:[edi], al
loop 0x4b6f45
add dword [ebp + 0x12], ebp
sti
mov esi, 0xc9d3a148
and al, 0x16
or ah, bl
dec edx
inc edx
cmp esp, esi
xor byte [edi], 0xb1
and al, 0x1b
mov byte [edx + 0x25], ah
push dword ss:[ecx]
xchg edi, eax
or al, 0xb0
retf 0x38e5
xchg edi, eax
cmp dword [ebx], esi
in eax, 0xbf
inc edi
inc esp
out 0xd1, eax
lcall 0x9629, 0xd498af26
adc dword [edi - 0x17], ebp
push ss
leave
salc
pop ss
lds edi, [eax]
invalid
outsb dx, byte [esi]
push esp
jmp 0xe0a168cd
mov dl, byte [eax]
push ecx
jbe 0x4b6fb3
wait
pop edx
out 4, eax
sti
mov edi, 0xf7b97bcd
dec esi
int3
push ebp
outsd dx, dword [esi]
or byte [edx + 0x1f9804d5], ch
popal
rcl esi, 0x20
sub dword [edx], edx
bound ecx, qword [ebp + 0x4419a34d]
inc ecx
out 0x3f, eax
cwde
jge 0x4b7027
adc byte [ecx + ebp - 0x58], 0xfb
test ax, 0x969
dec edx
jns 0x4b7023
wait
add cl, byte [edi]
mov ebx, 0x677cb514
mov edi, 0xe24b8d09
sub bh, dl
add esp, esp
adc al, 0x78
sal ebp, 0x29
shl byte [ebp + 0x4ac5f86a], 0x7e
jo 0x4b7043
jg 0x4b702f
mov dword [edx + edx*2], esp
sub dh, byte cs:[esi - 0x4b64557a]
cmp dword [esi + 0x335d043e], edi
invalid
dec esi
invalid
jmp 0x4bcc6f50
dec esp
ret 0x57cd
invalid

Function at 0x5459cb
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x9b83b7ed
pop ebp
jnp 0x5459dd
dec edx
movsd dword es:[edi], dword [esi]
inc dword [ecx]
cmp byte [eax], dl
dec ecx
xlatb
std
test al, 5
mov dword [0x13fb995b], eax
mov ebx, 0x784a8d7b
Function at 0x5f4df1
Capabilities:
Encode data using xor

Disassembly:
fdiv qword [edi + 0x1f7cdf53]
jp 0x5f4daa
push 0xffffffffffffffeb
popfd
mov eax, dword [0x563a1893]
call dword [ebx + 0xa4f961b]
ljmp 0xa72d
and bl, ch
inc edx
push ss
jb 0x5f4dba
shr ebx, 0x2e
inc ecx
or ah, byte [ebx]
clts
ret
xor eax, 0x3e37c3cd
push esp
call 0xffebc40b
xor ch, ch
mov al, 0x63
or ah, byte [esi + 0x1c69a302]
xor ch, dl
mov edi, dword [eax - 0x26]
cmp al, 0x25
arpl cx, si
pushal
fiadd dword [edx - 0x69]
xchg edi, eax
mov eax, dword [0xd8b35f3c]
je 0x5f4e34
arpl word [ecx + 0x46], sp
pop edx
push 0xffffffffffffff8d
cwde
inc edx
sbb dh, byte [edi]
xor dword es:[eax], ebx
lea esi, [edx + edi*2 + 0x2d]
je 0x5f4e6d
sub eax, 0xefbd0b93
xchg edi, eax
cmp ebx, esp
in al, 0xcf
nop
jg 0x5f4ddb
lea edi, [ebp + 0x7b6e9233]
int1
sbb al, 0x6b
jle 0x5f4e18
adc al, 0xdf
mov byte [0xc2500a53], al
invalid
pop edx
push edx
jp 0x5f4dd9
add al, 0xac
mov eax, 0x939c12d8
sbb byte [edx], al
inc edx
sub al, 0x6b
invalid
xor al, 0x9f
xchg esp, eax
aaa
retf 0xbb5a

Function at 0x619918
Capabilities:
Encode data using xor

Disassembly:
invalid
bound esi, qword [edi - 0x17c39ebe]
pop ds
mov cl, 3
jb 0x6198e4
daa
adc edi, dword [ecx]
push eax
and dword [edx - 0x13], esp
loope 0x6198f7
sbb byte [ecx], 0x92
lds ebx, [eax + 0x23773ab8]
xchg dword [0x44f6f469], ebx
test al, 0x6d
fsubr qword [eax]
xor al, 0xa5
movsd dword es:[edi], dword [esi]
dec eax
jmp 0x56d4bcb9
cmpsb byte [esi], byte es:[edi]
cwde
jg 0x619986
bnd je 0x6198a2
add bh, 0x83
and dword [esi - 0x30dea904], eax
mov dword [ebx + 0x56fc8621], 0x3c8acf21
mov ebx, 0x51e847ca
dec esp
xchg ecx, eax
jg 0x6198cd
and dword [ecx], 0xffffff86
cld
push esi
and edi, ecx
mov bh, byte [ebx + edi*4]
retf 0xe847
xor dh, bh
pop esi
mov ebp, 0x8a530732
mov dh, 0xd7
jo 0x61991f
push ds
invalid
sahf
mov cl, 0x58
lds edx, ds:[ecx + 0x63]
jecxz 0x619921
arpl bx, sp
xchg edx, eax
clc
stosd dword es:[edi], eax
leave
test al, 0xf0
jae 0x61998c
inc ecx
in al, dx
invalid

Function at 0x61cbd4
Capabilities:
Encode data using xor

Disassembly:
or al, 0xa2
xor byte [edx], ah
insb byte es:[edi], dx
xchg edi, eax
out 0x1b, eax
xor esi, dword [edx]
pop di
aas
invalid
Function at 0x414de2
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], esi
and edx, eax
add eax, 0x6e4a8cb3
add ecx, 4
cmp ecx, ebx
jne fcn.00414de2
dec edx
mov edx, 0x7981566d
ret
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40895e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
and esi, edx
call fcn.00408983
add esi, 0x1e80dd0c
dec esi
xor dword [eax], ebx
mov esi, edx
sub esi, 0xdd798b1a
inc eax
cmp eax, edi
jne fcn.0040895e
sub edx, esi
ret