joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57831b
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x578366
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.005784b6
test al, al
jne 0x578360
sub edx, 2
cmp edx, edi
jne 0x578346
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x578388
lea eax, [edi + 2]
cmp edx, eax
je 0x578388
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.00578267
add esp, 0x10
jmp 0x578482
push esi
lea ecx, [ebp - 0x255]
call fcn.005784b6
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x5783cb
push dword [ebp - 0x25c]
jmp 0x578378
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x578408
cmp word [ebp - 0x226], 0
je 0x578429
cmp word [ebp - 0x226], ax
jne 0x578408
cmp word [ebp - 0x224], 0
je 0x578429
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00578267
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x578475
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x5783e2
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x57845d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x578482
push 0x578097
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0056aab0
add esp, 0x10
jmp 0x578452
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ca7d
leave
ret

Function at 0x578e00
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x578e11
pop esi
ret
push ebx
push edi
push esi
call fcn.00578dc9
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00570707
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x578e39
push ebx
push esi
push edi
call fcn.0054eef0
add esp, 0xc
push 0
call fcn.005706cd
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x579209
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00578e4e
Function at 0x57b2df
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.005702c9
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005702c9
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x57b356
cmp word [ecx], dx
je 0x57b356
mov eax, dword [0x5b5644]
push edi
dec eax
push eax
push 0x5b5530
call fcn.0057b27e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x57b3c9
cmp word [eax], dx
je 0x57b3c9
mov eax, dword [edi]
test eax, eax
je 0x57b37a
cmp word [eax], dx
je 0x57b37a
lea eax, [ebp - 0x10]
push eax
call fcn.0057ac61
jmp 0x57b383
lea eax, [ebp - 0x10]
push eax
call fcn.0057acfc
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x57b3f3
mov eax, dword [0x5b552c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x5b5220
call fcn.0057b27e
add esp, 0xc
test al, al
je 0x57b3f3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x57b3be
cmp word [eax], di
je 0x57b3be
lea eax, [ebp - 0x10]
push eax
call fcn.0057ac61
pop ecx
jmp 0x57b3f5
lea eax, [ebp - 0x10]
push eax
call fcn.0057acfc
jmp 0x57b3bb
mov eax, dword [edi]
test eax, eax
je 0x57b3e0
cmp word [eax], dx
je 0x57b3e0
lea eax, [ebp - 0x10]
push eax
call fcn.0057ac16
pop ecx
jmp 0x57b3f3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x57b4be
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0057b103
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x57b4be
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x57b4be
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x57b4be
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x57b44b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.005723d4
test ebx, ebx
je 0x57b4b9
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.005723d4
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x57b4be
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x57b4be
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.0057e68a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x57b4c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ca7d
leave
ret
Function at 0x57f8a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x2ec], ebx
push edi
test ebx, ebx
je 0x57faa4
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x57faa4
push esi
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.0054f9f0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x2d8]
add esp, 0xc
push eax
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call esi
test eax, eax
jne 0x57fa79
xor edi, edi
mov dword [ebp - 0x2dc], 0x104
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x1d0]
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x57fa68
lea eax, [ebp - 0x2e0]
push eax
push 1
push 0
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x2d8]
call esi
test eax, eax
jne 0x57fa32
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x2e8], 1
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp - 0x2e4], 0x104
push eax
lea eax, [ebp - 0x2e8]
push eax
push 0
push str.ServiceName
push dword [ebp - 0x2e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x57fa2a
push 0x64
push eax
lea eax, [ebp - 0xcc]
push eax
call fcn.0054f9f0
push 0x64
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x2d4]
push eax
call fcn.0057fac0
add esp, 0x18
test eax, eax
je 0x57fa2a
cmp byte [ebp - 0x68], 0
je 0x57f9ec
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jns 0x57fa2a
lea ecx, [ebp - 0x68]
mov edx, 0x64
lea esi, [ebp - 0xcc]
mov eax, ecx
sub esi, eax
nop
lea eax, [edx + 0x7fffff9a]
test eax, eax
je 0x57fa19
mov al, byte [esi + ecx]
test al, al
je 0x57fa19
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fa00
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov byte [eax], 0
push dword [ebp - 0x2e0]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2dc]
mov dword [ebp - 0x2dc], 0x104
push eax
lea eax, [ebp - 0x1d0]
inc edi
push eax
push edi
push dword [ebp - 0x2d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x57f940
push dword [ebp - 0x2d8]
call ebx
mov ebx, dword [ebp - 0x2ec]
mov edi, dword [ebp + 0xc]
cmp byte [ebp - 0x68], 0
pop esi
je 0x57faa4
lea eax, [ebp - 0x68]
push eax
push edi
push ebx
call fcn.00580a90
xor ecx, ecx
test eax, eax
pop edi
setns cl
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
Function at 0x57fbe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x57fd5f
cmp dword [ebp + 0xc], 0x20
jb 0x57fd5f
push 0x400
lea eax, [ebp - 0x504]
mov dword [ebp - 0x50c], 1
push 0
push eax
mov dword [ebp - 0x508], 0x400
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x508]
push eax
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x50c]
push eax
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x57fd5f
lea ecx, [ebp - 0x504]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x57fc70
sub ecx, edx
cmp ecx, 0x40
jne 0x57fd5f
lea edx, [ecx + 0x40]
push esi
lea ecx, [ebp - 0x84]
lea esi, [ebp - 0x504]
mov eax, ecx
sub esi, eax
lea eax, [edx - 0x60]
test eax, eax
je 0x57fcac
mov al, byte [esi + ecx]
test al, al
je 0x57fcac
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fc96
test edx, edx
lea eax, [ecx - 1]
lea esi, [ebp - 0x4e4]
mov edx, 0x80
cmovne eax, ecx
lea ecx, [ebp - 0x104]
mov byte [eax], 0
mov eax, ecx
sub esi, eax
nop dword [eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x57fce9
mov al, byte [esi + ecx]
test al, al
je 0x57fce9
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x57fcd0
test edx, edx
lea eax, [ecx - 1]
push 0x400
cmovne eax, ecx
push 0
mov byte [eax], 0
lea eax, [ebp - 0x504]
push eax
call fcn.0054f9f0
push 0x400
lea eax, [ebp - 0x504]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0057fd70
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
pop esi
test eax, eax
jne 0x57fd5f
lea eax, [ebp - 0x84]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00580a90
neg eax
pop edi
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
Function at 0x580630
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2c10
call fcn.0046d600
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c10], eax
test eax, eax
je 0x58079d
cmp dword [ebp + 0xc], 0
je 0x58079d
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
nop dword [eax]
push esi
push str..PhysicalDrive_d
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00536330
add esp, 0x10
lea eax, [ebp - 0x104]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x580780
push 0x2710
xorps xmm0, xmm0
mov dword [ebp - 0x2c0c], 0
lea eax, [ebp - 0x2bfc]
movq qword [ebp - 0x2c08], xmm0
push 0
push eax
mov dword [ebp - 0x2c00], 0
mov dword [ebp - 0x2c08], 0
mov dword [ebp - 0x2c04], 0
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x2c0c]
push 0
push eax
push 0x2710
lea eax, [ebp - 0x2bfc]
push eax
push 0xc
lea eax, [ebp - 0x2c08]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x580775
push 0x3e8
lea eax, [ebp - 0x4ec]
push 0
push eax
call fcn.0054f9f0
lea eax, [ebp - 0x4ec]
push eax
push 1
push dword [ebp - 0x2be4]
lea eax, [ebp - 0x2bfc]
push eax
call fcn.00581000
add esp, 0x1c
lea eax, [ebp - 0x4ec]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x2c10]
call fcn.00580a90
test eax, eax
mov eax, 1
cmove ebx, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x58078a
inc esi
cmp esi, 0x10
jl 0x580670
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
Function at 0x5807b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
test ebx, ebx
je 0x580898
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0054f9f0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x580898
mov ecx, ebx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x580807
sub ecx, esi
mov eax, 0x103
sar ecx, 1
sub eax, ecx
cmp edx, eax
jae 0x580898
push edi
lea edi, [ebp - 0x20c]
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x580830
mov eax, dword [0x5ac51c]
mov esi, ebx
mov dword [edi], eax
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x580845
lea edi, [ebp - 0x20c]
sub ebx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x580860
mov ecx, ebx
lea eax, [ebp - 0x20c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
Function at 0x5808b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x5d1e24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x84]
push edi
push 0x80
push 0
push eax
call fcn.0054f9f0
push 0x80
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0057fd70
lea ecx, [ebp - 0x188]
mov edi, esi
mov eax, ecx
add esp, 0x18
mov edx, 0x104
sub edi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x58091a
mov al, byte [edi + ecx]
test al, al
je 0x58091a
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x580901
lea eax, [ecx - 1]
test edx, edx
cmovne eax, ecx
mov ecx, 0x104
mov byte [eax], 0
lea eax, [ebp - 0x188]
cmp byte [eax], 0
je 0x58093b
inc eax
sub ecx, 1
jne 0x580930
mov edx, 0x104
mov edi, ecx
mov eax, edx
sub eax, ecx
neg edi
sbb edi, edi
and edi, eax
test ecx, ecx
je 0x580990
lea ecx, [ebp - 0x188]
lea ecx, [ecx + edi]
sub edx, edi
je 0x580985
lea edi, [ebp - 0x84]
mov eax, 0x7fffffff
sub edi, ecx
push ebx
nop dword [eax + eax]
test eax, eax
je 0x580984
mov bl, byte [edi + ecx]
test bl, bl
je 0x580984
mov byte [ecx], bl
dec eax
inc ecx
sub edx, 1
jne 0x580970
pop ebx
test edx, edx
lea eax, [ecx - 1]
cmovne eax, ecx
mov byte [eax], 0
push 0x100
lea eax, [ebp - 0x288]
mov dword [ebp - 0x290], 1
push 0
push eax
call fcn.0054f9f0
add esp, 0xc
mov dword [ebp - 0x28c], 0x100
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x290]
push eax
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
test eax, eax
jne 0x580a4a
lea eax, [ebp - 0x288]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x580a14
test cl, cl
je 0x580a10
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x580a14
add eax, 2
add esi, 2
test cl, cl
jne 0x5809f4
xor eax, eax
jmp 0x580a19
sbb eax, eax
or eax, 1
test eax, eax
je 0x580a4a
lea ecx, [ebp - 0x288]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x580a26
sub ecx, edx
lea eax, [ebp - 0x288]
push ecx
push eax
push 1
push str.mid_old
push str.SoftwareComMaster
push 0x80000002
call edi
lea ecx, [ebp - 0x188]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x580a53
sub ecx, edx
lea eax, [ebp - 0x188]
push ecx
push eax
push 1
push 0x5b7bac
push str.SoftwareComMaster
push 0x80000002
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0046ca7d
mov esp, ebp
pop ebp
ret
Function at 0x43d586
Capabilities:
Encode data using xor

Disassembly:
sbb esi, dword [ecx - 0x22515805]
or esi, esi
inc esp
lodsb al, byte [esi]
mov eax, dword [0x811b76e1]
mov bh, 0x54
pop es
or byte [ecx + ebx*2], dh
loopne 0x43d569
dec ecx
sbb byte [esi + edi*8 - 0x627327ba], 0xb7
or eax, 0x3f3ba1ff
add edi, edi
out dx, al
dec ecx
or bh, byte [edx + 0x77]
lcall 0xa506, 0x7dabd42
dec ecx
push es
les ebp, [eax]
xor byte [eax - 0xa], 0xeb
int 0xf7
adc dword [edx + 0x3e], 0x32
or ebp, dword cs:[edx - 0x60]
push ds
pop ecx
jne 0x43d5c4
test al, 0x81
xchg ecx, eax
or al, 0xad
or esi, esi
inc ebx
sbb ch, byte [ebp + 0x30]
xchg ebx, eax
or edx, eax
push dword [edi + ecx*4 - 0x28f93919]
jle 0x43d575
shl dword [ecx + 0x2797b449], 0x7a
xchg edi, eax
mov eax, dword [0x2797b449]
jp 0x43d524
mov bh, 0xf4
mov dh, 0x5c
rcl dword [edx + 0x49], 0xe7
inc ebx
adc byte [0x7f48dffb], bl
cmp al, byte [ecx - 0x72]
jbe 0x43d559
xor eax, 0x253fef66
daa
daa
mov al, 0x92
invalid
jnp 0x43d5dd
pop ss
in al, dx
rol dword [ebx + 0x196a406c], cl
adc dword [ebx], esi
push edx
sub esi, eax
dec edi
dec ecx
imul ecx, dword [ecx - 0x37], 0x6f
jl 0x43d5d0
out dx, eax
insd dword es:[edi], dx
inc edi
inc edi
xchg ebx, eax
cmp ecx, dword [ecx + 0x3a25ed8a]
mov esi, 0xfb64ab7a
sti
leave
sti
mov ch, bl
in al, 0x15
and esp, dword [edi + 0x42c1f4e0]
xchg edi, eax
adc eax, 0xeb51948d
jg 0x43d5e9
rcl dword [ebx], cl
lea eax, [ecx]
inc esp
rol dword [0x9daaa1d], 1
rol byte [esi + 0x662fcd1c], 1
pushal
das
pushaw
sub ebx, dword [eax + 9]
dec esp
inc esp
les eax, [ecx]
jle 0x43d60f
hlt
mov cl, 0xbf
aas
in al, 0x89
sub al, 0xa3
in eax, dx
in eax, dx
dec ebx
jp 0x43d5c5
pop ds
sbb esi, eax
pushal
fisttp word [ebx - 0x18]
in al, dx
sub dword [ebp + 0x53], esi
sahf
shr dword [eax + ecx], 4
cmp dword [eax + 0x7f], 0x46fe740e
mov dword [0x53a56531], eax
push 0xb2d5b877
shl byte [esi - 0x4be9de38], cl
inc edi
insd dword es:[edi], dx
cmp byte [eax], bh
xchg ebp, eax
and al, 0xa
pushfd
mov byte [0x56765dd6], al
loop 0x43d61a
nop
mov dl, 0xcc
rcr edx, 0x50
les ebx, [eax + ebp*8 + 6]
cmp eax, 0xadfbbb2c
sub eax, dword [ebx]
or al, 0x6f
xchg ecx, eax
scasd eax, dword es:[edi]
stc
dec edi
in eax, dx
ja 0x43d633
invalid

Function at 0x43f7ac
Capabilities:
Encode data using xor

Disassembly:
push ss
jge 0x43f818
dec ecx
adc byte [eax + 0x352f5bb6], cl
stosb byte es:[edi], al
loopne 0x43f827
and bh, cl
salc
sub byte [ebp - 0x4b], dl
pop ecx
out 0xb2, eax
lodsd eax, dword ss:[esi]
xchg ebx, eax
and byte [eax + 0x40c46d2b], 0x6b
jge 0x43f7f4
invalid
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
jne 0x43f870
Function at 0x450377
Capabilities:
Encode data using xor

Disassembly:
mov al, 0xc
jp 0x450355
and cl, byte [eax]
test byte [edx - 0x33], dh
mov bh, 0x2f
pop esp
cmp al, byte [esi + edx - 0x259c718e]
mov fs, word [ebx - 0x26]
xchg dl, dl
push esp
insb byte es:[edi], dx
retf
pushal
out 0x69, al
xchg edx, eax
and al, 0x29
add byte [edx + 0x7bed721c], 0xd0
inc edx
in al, 0x85
mov cl, 0x96
pushal
outsb dx, byte [esi]
js 0x450340
insb byte es:[edi], dx
or byte [edi + edx*8 + 0x1c], bh
xchg edi, eax
xor eax, 0x5ccbc337
lcall 0xd68, 0x72a7ac72
xchg esi, eax
fisttp dword [ebp - 0xc0b9f3f]
popal
test eax, 0x81eadea
cmp dword [esi + 0x78c048d2], edx
or al, 2
scasb al, byte es:[edi]
wait
ja 0x450350
jo 0x450361
inc esp
call 0x7b261a65
or eax, 0x33d72680
fdiv dword [edi + 0xbe3248b]
mov edi, 0xc29366e5
mov eax, 0xd7ae116
and byte [esi], 0xd7
xor ebx, eax
mov bh, 0x8b
and al, 0xe3
or edi, dword [edi - 0x3d6c991b]
mov dh, 0x4c
out 0x6a, al
aad 0xad
inc esi
arpl word [0xa2aae1a], si
adc al, 0x96
adc byte [eax + 0x71b6c60a], ah
adc byte [esi + 0x42], bh
jl 0x4503a9
jne 0x4503a3
add esp, dword [edx]
invalid
Function at 0x49dbeb
Capabilities:
Encode data using xor

Disassembly:
mov byte [esi], ah
jae 0x49dbff
rol dword [ebx + 0x96b45b8], 0x5e
sar byte [ebx + 0x3ff25cfc], 0x58
mov al, byte [0xbd68bab0]
xchg edx, eax
pop edx
in eax, dx
movsb byte es:[edi], byte [esi]
sbb al, 0x7e
mov al, byte [0xff3ccd2a]
and ebp, dword [ecx + 0x6491feb2]
fadd st(1), st(0)
pop ecx
popal
je 0x49dc42
jmp dword [ebx]
pop edi
xor esp, dword [esi - 0x57d2614a]
or byte [eax], dl
imul edi, dword [ebx], 0x3385ce86
lcall 0x7e6d, 0x8e4d3b19
mov edx, 0x3071d957
xor ebx, dword [edx - 0x71b2c4e7]
insd dword es:[edi], dx
jle 0x49db99
push edi
fnstenv [ecx + 0x30]
dec edi
scasd eax, dword es:[edi]
loop 0x49dc55
mov esi, 0x6baf3a92
xlatb
push edx
imul edx, edi, 0x52
loopne 0x49dbd6
loopne 0x49dc28
in eax, dx
cwde
in al, 0xc4
lahf
xchg esp, eax
or byte [eax + 0x6c82c5ae], ah
mov ebp, 0x8bb6a267
mov ebp, 0x8bb6a267
fmul dword [ebx + edi*8 + 0x79]
mov cl, 0x1c
mov eax, dword [0xd280ac34]
popfd
sti
jns 0x49dbba
sbb al, 0xa1
xor al, 0xac
adc dl, 0x9d
add edi, dword [edx + 0x63]
cwde
jg 0x49dc06
mov byte [ecx + 0x1b], ah
add eax, 0x99019754
sub dword [ebx + 0x1b], esp
push ebx
in eax, dx
cmp eax, 0x6fd64c55
sbb dword [eax], ecx
movsb byte es:[edi], byte [esi]
in al, 0xdd
enter 0xffffffffffffcc23, 0x48
into
or dword [eax], edi
pop es
mov byte [0x816eb438], al
and eax, ebp
xchg ah, ch
add esp, dword [esp + ebp*2]
or al, 0xa0
imul edx, dword [ecx + esi*4], 0x5659e9a3
in al, dx
fild qword [eax + 0x47b38da4]
push edi
sub ah, dl
mov al, byte [0xa3b11469]
jmp 0xe03632a5
ror dword [eax], 1
sub dword [eax], 0x43e997e1
cwde
hlt

Function at 0x4acf22
Capabilities:
Encode data using xor

Disassembly:
in al, 0x56
rol ecx, 0xcc
mov dword [edx + 8], ebx
mov bh, 0x9c
and dword [edi + ecx*8], eax
mov al, byte [0xe0be92fa]
test eax, 0x7c1cd174
add byte [ebp + 0x3539f4f3], ch
xor al, 0x1e
sbb dh, byte [ecx + 0x54]
cmc
mov eax, dword [0xa2208ace]
pop ebp
push ss
lcall 0x6b15, 0x4b0a606e
inc esi
loopne 0x4acedb
mov al, 0x66
mov al, 0xb0
stosb byte es:[edi], al
inc esi
xchg ecx, eax
and al, 0x71
adc byte [eax + esi + 0x71], bh
cmp al, 0xc1
mov ah, 0xa1
salc
mov dh, 0xc1
rcl dword [esi - 0x7b19f3ca]
inc ecx
cmpsd dword [esi], dword es:[edi]
dec esi
push 0xffffffffffffff97
loope 0x4acece
test eax, 0x81d2413f
mov ebx, 0x57ca14ab
int3

Function at 0x4b37ae
Capabilities:
Encode data using xor

Disassembly:
fcomp qword [eax - 0x68]
fldcw word [edi + 0x37182cc3]
push 0xbf46fc9f
pop ebx
inc esp
cmp dword fs:[edx], 0x56
inc edi
jecxz 0x4b3774
pushfd
sar dword [ebx - 0x2c], 0x73
in eax, dx
ret
sbb ebx, ebx
test eax, 0xc3b7d621
aam 0xa0
sar bl, 0x84
mov esp, 0x4aea117a
adc edx, ebp
dec edx
xchg dword [edi + 0x3c35147b], edi
jae 0x4b373a
scasd eax, dword es:[edi]
dec ebx
jp 0x4b37bb
inc edx
wait
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
invalid
add ebx, edi
sub ecx, dword [0xed1abe63]
sbb ch, ch
popfd
je 0x4b375e
cmpsd dword [esi], dword es:[edi]
xor eax, dword [eax - 0x33ff46f4]
out 0xc7, al
adc dl, byte [esi]
loope 0x4b37b4
or byte [ecx + edi*4], 0
int3
cmp dword [ecx + 0x17], 0x834f0898
pop ecx
lcall 0x9087, 0xfd3fa267