joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446310
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000040
push 1
lea edi, [esi + 4]
push 0
push 0
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x44634e
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0x446d20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push eax
call dword [0xb7d294]
mov edi, eax
add esp, 4
test edi, edi
jne 0x446d43
pop edi
pop esi
ret
lea eax, [edi + 0xc]
push ebx
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, dword [esi + 0xc]
mov edx, eax
add edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [edi + 8], edx
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
push ebp
jbe 0x446d8e
push eax
call dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call dword [esi + 4]
mov ebx, dword [edi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
add ebx, eax
push edx
push ebx
call dword [esi + 8]
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x446d92
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi + 4]
push ecx
call dword [esi]
mov edx, dword [edi + 8]
push edx
call dword [esi]
mov eax, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
test eax, eax
jbe 0x446df8
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [ebx]
mov cl, byte [0xb755cc]
xor al, cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov edx, dword [edi + 4]
push 1
push ecx
push edx
call dword [esi + 4]
mov al, byte [ebx]
mov dl, byte [0xb755cd]
xor al, dl
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
mov edx, dword [edi + 8]
push 1
push ecx
push edx
inc ebx
call dword [esi + 4]
mov eax, dword [esp + 0x34]
add esp, 0x18
dec eax
mov dword [esp + 0x1c], eax
jne 0x446db1
cmp ebp, dword [esi + 0x10]
jae 0x446e24
mov eax, dword [edi + 4]
push 1
push 0xb755cc
push eax
call dword [esi + 4]
mov ecx, dword [edi + 8]
push 1
push 0xb755cd
push ecx
call dword [esi + 4]
mov eax, dword [esi + 0x10]
add esp, 0x18
inc ebp
cmp ebp, eax
jb 0x446dfd
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x446e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [section..data]
xor edx, edx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test eax, eax
jle 0x446eaf
mov ebx, dword [ebp + 0xc]
add ebx, edx
mov ecx, dword [esi]
mov al, byte [ebx]
lea ebx, [ebx + 4]
xor byte [edi + ecx], al
inc edi
mov eax, dword [section..data]
cmp edi, eax
jl 0x446e9b
inc edx
add esi, 4
cmp edx, 4
jl 0x446e90
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4474b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
test edx, edx
je 0x4474dd
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
sub esi, ecx
sub edi, ecx
mov al, byte [esi + ecx]
xor al, byte [ecx]
mov byte [edi + ecx], al
inc ecx
sub edx, 1
jne 0x4474cd
pop edi
pop esi
pop ebp
ret

Function at 0x4474df
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
sub edx, ecx
push edi
push 4
sub esi, ecx
pop edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
mov byte [esi + ecx], al
inc ecx
sub edi, 1
jne 0x4474f4
pop edi
pop esi
pop ebp
ret
Function at 0x44b417
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0xb7d274]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1000
call fcn.00b35d1e
mov edi, eax
xor ebx, ebx
push 0x41
lea eax, [ebp - 0x48]
mov dword [ebp - 0x5c], edi
push ebx
push eax
mov esi, ebx
call fcn.00b34440
push 0x1000
push ebx
push edi
call fcn.00b34440
add esp, 0x1c
mov ecx, ebx
mov al, cl
add al, 0x41
mov byte [ebp + ecx - 0x48], al
inc ecx
cmp ecx, 0x1a
jl 0x44b45a
mov ecx, ebx
mov al, cl
add al, 0x61
mov byte [ebp + ecx - 0x2e], al
inc ecx
cmp ecx, 0x1a
jl 0x44b46a
mov ecx, ebx
mov al, cl
add al, 0x30
mov byte [ebp + ecx - 0x14], al
inc ecx
cmp ecx, 0xa
jl 0x44b47a
mov edi, dword [ebp + 0xc]
mov ecx, ebx
mov word [ebp - 0xa], 0x2f2b
test edi, edi
je 0x44b5bc
push 3
pop edx
mov eax, dword [ebp + 8]
dec edi
mov al, byte [eax]
mov byte [ebp + ecx - 0x50], al
inc ecx
mov al, byte [ebp - 0x4e]
inc dword [ebp + 8]
mov ah, byte [ebp - 0x4f]
mov byte [ebp - 0x4a], al
mov al, byte [ebp - 0x50]
mov byte [ebp - 0x55], ah
mov byte [ebp - 0x49], al
cmp ecx, edx
jne 0x44b513
mov cl, byte [ebp - 0x49]
mov edx, ebx
shr al, 2
and cl, 3
mov byte [ebp - 0x54], al
mov al, ah
shl cl, 4
shr al, 4
add cl, al
mov al, byte [ebp - 0x4a]
mov byte [ebp - 0x53], cl
mov cl, ah
and cl, 0xf
shr al, 6
shl cl, 2
add cl, al
mov al, byte [ebp - 0x4a]
and al, 0x3f
mov byte [ebp - 0x52], cl
mov ecx, dword [ebp - 0x5c]
mov byte [ebp - 0x51], al
movzx eax, byte [ebp + edx - 0x54]
mov al, byte [ebp + eax - 0x48]
mov byte [esi + ecx], al
inc esi
inc edx
cmp edx, 4
jl 0x44b4fb
push 3
mov ecx, ebx
pop edx
test edi, edi
jne 0x44b49e
test ecx, ecx
je 0x44b5bc
mov eax, ecx
cmp ecx, edx
jge 0x44b547
cmp eax, edx
jae 0x44b5ce
mov byte [ebp + eax - 0x50], bl
inc eax
cmp eax, edx
jl 0x44b527
mov al, byte [ebp - 0x4e]
mov ah, byte [ebp - 0x4f]
mov byte [ebp - 0x4a], al
mov al, byte [ebp - 0x50]
mov byte [ebp - 0x49], al
jmp 0x44b54d
mov ah, byte [ebp - 0x55]
mov al, byte [ebp - 0x49]
shr al, 2
mov byte [ebp - 0x54], al
mov al, byte [ebp - 0x49]
and al, 3
mov edi, dword [ebp - 0x5c]
shl al, 4
mov byte [ebp - 0x49], al
mov al, ah
shr al, 4
and ah, 0xf
add byte [ebp - 0x49], al
mov al, byte [ebp - 0x49]
mov byte [ebp - 0x53], al
mov al, byte [ebp - 0x4a]
shr al, 6
shl ah, 2
add ah, al
mov al, byte [ebp - 0x4a]
and al, 0x3f
mov byte [ebp - 0x52], ah
mov byte [ebp - 0x51], al
lea eax, [ecx + 1]
test eax, eax
jle 0x44b5a7
lea edx, [ecx + 1]
movzx eax, byte [ebp + ebx - 0x54]
mov al, byte [ebp + eax - 0x48]
mov byte [esi + edi], al
inc esi
inc ebx
cmp ebx, edx
jl 0x44b592
push 3
pop edx
cmp ecx, edx
jge 0x44b5bc
sub edx, ecx
lea eax, [esi + edi]
push edx
push 0x3d
push eax
call fcn.00b34440
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x5c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00b330a8
leave
ret
call fcn.00b32fce
int3
Function at 0x44b91c
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x20
lea eax, [ebx + 0x44]
push esi
push eax
call fcn.00b33ec0
mov edi, dword [ebp + 0x10]
add ebx, 0x64
push 0xc
push edi
push ebx
call fcn.00b33ec0
push 0xb4f77c
call fcn.0044bae1
mov ecx, dword [ebp + 8]
push 0xb4f780
mov dword [ecx + 0x74], eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
push 0xb4f784
mov dword [ecx + 0x78], eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
push 0xb4f788
mov dword [ecx + 0x7c], eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
push esi
mov dword [ecx + 0x80], eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x84], eax
lea eax, [esi + 4]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x88], eax
lea eax, [esi + 8]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x8c], eax
lea eax, [esi + 0xc]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x90], eax
lea eax, [esi + 0x10]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x94], eax
lea eax, [esi + 0x14]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
add esp, 0x40
mov dword [ecx + 0x98], eax
lea eax, [esi + 0x18]
push eax
call fcn.0044bae1
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x9c], eax
lea eax, [esi + 0x1c]
push eax
call fcn.0044bae1
mov esi, dword [ebp + 8]
push edi
and dword [esi + 0xa4], 0
mov dword [esi + 0xa0], eax
call fcn.0044bae1
mov dword [esi + 0xa8], eax
lea eax, [edi + 4]
push eax
call fcn.0044bae1
mov dword [esi + 0xac], eax
lea eax, [edi + 8]
push eax
call fcn.0044bae1
push 0xc
push edi
push ebx
mov dword [esi + 0xb0], eax
call fcn.00b33ec0
add esp, 0x20
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xb0daea
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0xb0de39
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
pop ebp
ret
Function at 0xb444fb
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b4437a

Function at 0xb459b4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00b45674

Function at 0x40152e
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x40158a
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0xa0
mov dword [ebp - 0x88], 0
call fcn.0040152e
mov dword [esp], 0x401664
mov dword [ebp - 0x8c], 0
mov ebx, eax
lea eax, [ebp - 0x8c]
mov dword [esp + 0xc], eax
mov eax, ebx
or eax, 0x40
mov dword [esp + 8], eax
mov eax, 0x4020c6
sub eax, 0x401664
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x40162d
mov dword [esp], ebx
lea esi, [ebp - 0x88]
call fcn.0040144c
mov dword [esp], ebx
mov dword [esp + 4], esi
call fcn.004014ad
lea eax, [ebx + 0x1b600]
mov cl, bl
mov edx, 0x40300c
shl eax, cl
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, edx
or eax, 1
imul ebx, eax
sub edx, ebx
mov dword [esp], edx
call fcn.00401dc9
lea esp, [ebp - 8]
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x458c85
Capabilities:
Encode data using xor

Disassembly:
invalid
adc eax, 0x3181a2c4
and ecx, eax
push es
jne 0x458c31
xor dword [ecx], 0x7506c121
mov byte [0xa21b59e3], al
xor byte [edi], 0x95
xchg esp, eax
jecxz 0x458cea
sbb esp, dword [edx - 0x6b6ac87e]
jno 0x458c88
stosd dword es:[edi], eax
dec ebp
sar cl, 0x93
mov cl, 0xe
push edx
add al, 0x82
lea ebp, [ecx + 0x697620f]
js 0x458cea
inc edi
int1
cmp dword [edx + ebx*2 - 0x5e292d48], ecx
scasd eax, dword es:[edi]
lcall 0x45fb, 0xcfed0305
ljmp 0xa041
jno 0x458d4d
and byte [edx - 0x24aec4be], bh
xchg ebx, eax
adc cl, byte [eax]
out dx, al
out dx, eax
push ecx
fist dword [ebx - 0x1011f7ee]
or eax, ebp
xor eax, 0xa7c1ff41
ror dword [ecx + 0x22], 0x48
bound edi, qword [ecx - 0xb320b60]
inc esp
sbb eax, 0x1d334ae
mov esi, 0x21e85ec1
push edx
sbb dword [eax], edi
outsb dx, byte [esi]
add esp, eax
out dx, eax
mov cl, 0x22
test bh, bl
dec esp
push 0x1d
jmp 0xac354739
adc edi, dword [edx - 0x12805411]
loop 0x458da1
pop ecx
or byte [edi - 0x46], al
pushfd
sub byte [edx + ebp*2], 0xaa
jl 0x458d37
inc ebp
sub dword [edx - 0x5e569970], 0xfffffff2
stosb byte es:[edi], al
nop
test ax, 0xf2a1
sub byte [edi], ch
jnp 0x458dad
xchg esp, eax
and esp, ebp
lahf
js 0x458cf0
fst qword [ecx - 0x32]
adc dword [eax - 0x35ba0143], ebx
inc byte [ebp - 0x36]
mov word [ebx - 0x68adebe8], gs
xchg ebx, eax
nop
clc
pop esp
mov al, 0xc8
sub dword [edi - 0x47eb8e06], ecx
sal dword [ebp - 0x7ef046a], 0xb9
xchg byte [edx], cl
mov esp, 0xad708232
clc
or dword [eax - 0x5f0d58c8], ebp
mov al, 0xf0
push 0x3770affc
rcl dword [eax + 0x31401ca2], 0x85
jno 0x458d22
dec ecx
xor al, 0xdf
inc ecx
push edx
nop
call 0x9d89818
mov eax, dword [0x2d0e9d23]
sub ecx, esp
add eax, 0x59c44f53
sbb byte [eax + 0x7a], bh
js 0x458e1d
mov bh, byte [eax + ebp*4 + 0x27]
cld
cmp ch, 0x52
scasb al, byte es:[edi]
test dl, 1
add al, 0x9b
dec ecx
in al, dx
sbb al, 0x47
out 0x9e, eax
sbb ah, byte [esi]
aas
std
mov dh, 0xc8
stosd dword es:[edi], eax
aad 0xe6
dec ebx
pop ebp
std
shr dword [ebx + 0x46b47767], 1
add esi, esi
ret 0x401
add esi, esi
ror dword [ebp - 0x55], 1
cmpsb byte [esi], byte es:[edi]
cmp byte [esi], ch
mov ecx, 0x73909f2f
cmp dword [ebx + 0x6181c86c], eax
sub byte [esi - 0x34], ch
adc ah, bl
imul edx, dword [eax], 0xf16eb752
xor eax, 0x196da842
rcr eax, 1
add esi, dword [ecx]
push ss
add ecx, esp
or al, byte [edx - 0x6aac52d0]
imul ecx, dword [edi], 0x346c614d
adc bh, byte [edx]
cmp dword [eax - 0x7a], eax
lahf
or al, 0x19
test al, 0x10
call 0x401afe73
in eax, 0xe5
adc dword [ecx - 0x4c2eba62], ebx
jns 0x458dcb
mov dword [edi - 0x74], esi
mov dword [0xab129191], eax
stosb byte es:[edi], al
mov ch, bh
or dword [edx + 0x249ba0ba], ebx
fidiv dword [ebx - 0x6b]
push eax
sub dword [ebx], esi
pop ebp
in al, 0xcc
adc dword [edx], 0xf2e07e1e
cmp edx, dword [ebp + 0x19]
out 0x39, eax
iretd
Function at 0x4ae945
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
clc
adc al, 0x1b
cwde
pop esp
cmp ch, bl
sub eax, 0xc9891ff1
cmpsd dword [esi], dword es:[edi]
nop
adc byte [eax + 0xcb4356a], dh
inc ebp
jecxz 0x4ae99e
pop edx
salc
fist dword [edi + 0x5c0f67f]
add al, 0x3f
adc dword [0xc539da72], ecx
movsd dword es:[edi], dword [esi]
and eax, 0x7c7b5723
xchg edx, eax
loopne 0x4ae9e3
sub byte [ecx - 0x66], 0x51
fucomi st(0)
retf
jmp 0xcb0d8661
jg 0x4ae9d5
arpl sp, si
add bh, byte [eax + 0x44]
sub eax, 0xd72749a3
xchg ebp, eax
pushal
sub byte [ecx - 0x2d], cl
sub byte [ebp - 0x59], dh
jl 0x4aea1f
push 0xffffffffffffffc4
mov al, byte [esi]
mov al, byte [0x67be2e4c]
je 0x4ae941
test edx, 0x56861bfc
stosb byte es:[edi], al
rcr byte [esi + 0x5db268e], 0x4b
push ebp
rol dword [ebp + 0x59], cl
dec ebp
insd dword es:[edi], dx
push ecx
in eax, dx
rol dword [edx + edi*8 + 0x5b], 1
inc esp
cli
pop ebx
jge 0x4ae999
and ebp, edi
frstor dword [ebp - 0x3c]
jno 0x4ae9d7
and ecx, dword [ebx - 0x36]
add eax, 0x3052999a
aam 0x2c
xchg edx, eax
inc esi
pop ebp
pop ecx
cmp cl, ah
in al, dx
mov dl, 0x31
Function at 0x541b25
Capabilities:
Encode data using xor

Disassembly:
rol byte [ebx - 0xf125c15], cl
div dword [esi - 0x1b4c0b56]
invalid
adc ebx, dword [edi + 0x3f]
loope 0x541b67
push ss
pushal
popfd
inc esp
jbe 0x541b5e
push ebx
sub dh, byte [edi + 0x6f]
nop
fidiv word [ebx]
lcall 0xb283, 0x5916a0e7
int3
mov dl, 0xcc
xchg ebx, eax
out 0xc2, eax
add eax, dword [ebp + 0x433f2224]
bound esi, qword [ebp + 0x257485ab]
adc al, byte [ebp - 0x553d6fad]
mov al, 0x8b
jle 0x541b47
loop 0x541ac1
cmp al, byte [edx]
scasb al, byte es:[edi]
jnp 0x541af1
add dl, byte [edx + 0x63695222]
scasd eax, dword es:[edi]
add al, 0xc3
loop 0x541b0a
push edx
push 0x5f
mov esi, 0x3deda216
sub al, ah
ret 0x31f2
adc al, 0x10
scasd eax, dword es:[di]
invalid
mov dl, 0x13
inc ebp
lodsb al, byte [esi]
test al, 0xd0
mov ch, 0xd0
scasb al, byte es:[edi]
and esp, dword [edi]
xchg esp, eax
sub dh, 0x72
xchg dword [eax + esi*4], esi
in eax, dx
inc edx
sub eax, dword [edx + 0x42]

Function at 0x54cc75
Capabilities:
Encode data using xor

Disassembly:
lds esi, [ebx - 0x17b3087f]
dec ebx
invalid
xchg ebx, ebx
add byte [edx + 0x72], 0x1d
imul esp, dword [eax - 0x7d], 0x844ba1f8
insd dword es:[edi], dx
cld
daa
loop 0x54cbc9
xor edx, esp
add dword [ebx + ebp*4 - 0x6a], eax
add dword [edx + 3], edi
lds sp, [ecx - 0x31]
cmp byte [eax + 0x16181df3], bl
mov cl, 0xe1
and dword [ecx + 0x7a495152], 0x5b
rcr dword [0x1f521263], 1
push cs
lodsd eax, dword [esi]
xchg ebp, eax
mov eax, dword [0xaca8bab7]
imul dword [edx + 0x3e598335]
adc dl, byte [ebx + 0x4f4173bf]
jbe 0x54cc98
invalid
and ch, byte [0x53075d92]
sub eax, 0x53075d92
adc esp, dword [ebx]
adc dword [ebp - 0x1a], ebx
inc edx
salc
pop edi
ja 0x54cc43
xchg bl, bl
loop 0x54cc5a
cli
xchg edi, eax
invalid
pop ds
push ss
ror dword [ebx + 0x50250c51], cl
sub dword [ebx], 0xfbe4ca9c
loope 0x54cc2b
test al, 0xa7
add eax, dword [edx]
imul ecx, dword ss:[ecx - 0x19], 0xce73fb0
or eax, 0x2f6bc14f
and eax, 0x74fd58d
cmp cl, al
sub al, 0x9b
push 0x51e37c12
adc bh, byte [ebx + 0x51]
sub al, 0xa5
mov edx, 0xe53c4ce2
lodsd eax, dword [esi]
pop dword [ebp + 0xeb04e6]
stosb byte es:[edi], al
pop ebx
clc
push eax
scasb al, byte es:[edi]
test byte [esi], bh
or byte [ebx + 0x4bcb4e57], dh
movsb byte es:[edi], byte [esi]
loopne 0x54cca8
popal
mov esi, 0x8f5a9df3
das
xchg esp, eax
test dword [ebx], esi
cmc
aaa
cmp dh, byte [edx + 0x4701ff38]
jb 0x54cd39
pop ds
scasd eax, dword es:[edi]
fnsave dword [ebx + 0x75]
popal
cmp eax, 0xbca2d760
pushfd
and eax, 0xc5d05d5c
mov esi, 0x33ccbf58
push cs
mov al, byte [0x63c1b006]
int 0xc6
cmp dh, 0x60
dec esi
loop 0x54ccc3
imul eax, dword [edx + eax*4 + 0x33c27510], 0xffffff9d
outsb dx, byte [esi]
invalid
jns 0x54cda5
jmp [edx - 0x64962e0a]
cld
invalid
Function at 0x5973c5
Capabilities:
Encode data using xor

Disassembly:
popal
adc eax, 0x7219649d
and esp, dword [ebx]
dec esi
adc ebx, dword [0xf4a2cb17]
mov ch, 0xf1
xchg edi, eax
out 0xc7, eax
test byte [edi], ch
xchg edx, eax
stc
enter 0xffffffffffffb6cd, 0xfffffffffffffff2
cmp al, bh
and al, 0xe1
jmp 0x138bdacf
inc esi
xor dl, byte [bp + di]
push ds
jle 0x59739f
jns 0x5973e0
sub ebp, dword [edi - 0xd0b0e85]
cmp dword [edi + 0x44], edx
add eax, ebp
sti
inc esi
sti
jne 0x597364
inc ecx
xchg esi, eax
out 0x17, eax
bound edx, qword [edx - 0x33c628a6]
mov esi, 0xb4ab2027
pop es
adc ch, byte [edx - 0x56b9d4e]
lea eax, [esi + 0x2fdf02b2]
out 0x97, eax
jecxz 0x597427
cmp dl, byte [ecx + 0x44]
inc eax
cld
jb 0x597380
das
jl 0x597385
mov eax, dword [0x84340b10]
push 0x7f872478
mov esi, 0x7518caea
pop eax
invalid
imul esi, dword [esi + 0x29], 0x6b639a54
sbb eax, 0x62597714
pinsrw mm3, word [eax + 0x57], 9
neg byte [edx - 0x507873b2]
iretd
xchg dword [edi - 0x54c92831], ebp
invalid
salc
test al, 0x74
mov eax, 0x1a8c1a62
jno 0x5973f5
int3
Function at 0x5d96b5
Capabilities:
Check for vm using instruction vpcext

Disassembly:
or dl, bh
imul ebx, dword [esi - 2], 0x2d
or byte [ebx + 0x50], 0x1c
dec ecx
ror byte [edx], 1
invalid
Function at 0x109f0
Capabilities:
Create device object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x109c0
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00016350
lea edx, [ebp - 0xf8]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea ecx, [ebp - 4]
push ecx
push 0
push 0
push 0x22
lea edx, [ebp - 0x108]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
je 0x10a53
xor al, al
jmp 0x10aa7
push 0x109d4
lea ecx, [ebp - 0x80]
push ecx
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
lea edx, [ebp - 0x80]
push edx
call fcn.00016350
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x100]
push ecx
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
test eax, eax
je 0x10aa5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
xor al, al
jmp 0x10aa7
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x10d40
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push edi
mov ecx, 0x34
xor eax, eax
mov edi, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
pop edi
pop ebp
ret 4
Function at 0x15620
Capabilities:
Get file attributes
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov byte [ebp - 0x235], 0
push 0x15610
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.ntoskrnl.exe_wcscpy]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.ntoskrnl.exe_wcscat]
add esp, 8
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x234]
push ecx
call fcn.00014220
push 0
push 0
push 0
push 1
push 1
push 0
push 0
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x234]
push eax
push 1
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.ntoskrnl.exe_ZwCreateFile]
test eax, eax
jl 0x157f7
mov dword [ebp - 0x244], 0
push 0
push 0
lea edx, [ebp - 0x234]
push edx
call fcn.00014220
mov eax, dword [ebp - 0x21c]
push eax
push 0x8000000
push 2
push 0
lea ecx, [ebp - 0x234]
push ecx
push 0xf0005
lea edx, [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwCreateSection]
test eax, eax
jl 0x157d7
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], 0
push 2
push 0
push 1
lea eax, [ebp - 0x248]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0xffffffffffffffff
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwMapViewOfSection]
test eax, eax
jl 0x157ca
cmp dword [ebp - 0x24c], 0
je 0x157ca
push 5
push 0x18
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x270]
push ecx
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x157bb
cmp dword [ebp + 0x14], 0
je 0x15786
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x260]
mov dword [eax], ecx
cmp dword [ebp + 0x10], 0
je 0x15797
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x260]
jbe 0x157a0
mov eax, dword [ebp - 0x260]
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24c]
push eax
call fcn.00013910
mov byte [ebp - 0x235], 1
mov ecx, dword [ebp - 0x24c]
push ecx
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwUnmapViewOfSection]
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp + 0x18], 0
je 0x157ea
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x21c]
mov dword [eax], ecx
jmp 0x157f7
mov edx, dword [ebp - 0x21c]
push edx
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, byte [ebp - 0x235]
mov esp, ebp
pop ebp
ret 0x14