joyce8/EMBER2024-capa huggingface dataset:
Function at 0x662bad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + edx - 0x6f04143d], 0x4020f335
mov ecx, dword [ebp + edx - 0x6f04143d]
and dx, dx
or edx, dword [esp + edx - 0x6f04143d]
sbb word [esp + edx - 0x6f24f73b], dx
lea ebp, [ebp + edx - 0x6f24f739]
movsx eax, dx
pop edx
xor ecx, ebx
sub dl, ah
jae 0x6d1e38
rol ecx, 3
div eax
bts edx, eax
inc ecx
shl ax, 0x8f
bts dx, ax
neg ecx
rol eax, 0x2a
jb 0x667890
imul eax
xor ecx, 0xae2ef793
ror edx, 0xd
xchg dh, dl
cmovb eax, edx
adc ecx, 0x93af1a4
sub dx, dx
call fcn.007636c1
mov edx, ecx
neg eax
push edx

Function at 0x6762da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [edx + eax - 0x6a2b69a3]
xchg dword [esp + edx - 0x3827756d], edx
not eax
lea eax, [eax + ecx - 0x4e8e783f]
xor ebx, eax
add edi, eax
xor edx, 0xca054cb9
mov ecx, dword [ebp + ecx - 0x4987992f]
mov eax, dword [ecx + edx*2 - 0x2d3f7ee0]
jbe fcn.0076064c
lea ecx, [edx*4 - 0x334b0a55]
mov dword [edx + ebp - 0x169fbf70], eax
mov dword [esp + edx - 0x169fbf70], edi
ret 8

Function at 0x684805
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or word [esp + ecx - 0x662556fa], dx
ror eax, 1
shl dword [esp + ecx - 0x662556fa], 0x67
mov dword [esp + ecx - 0x662556fe], ecx
lea eax, [eax + ecx - 0x107f0d7]
adc edx, 0xf3171509
rol edx, cl
cmovbe edx, dword [esp + ecx - 0x662556fa]
xor ebx, eax
sal dword [esp + ecx - 0x662556fa], 0xe8
inc ecx
adc edi, eax
xadd dword [esp + ecx - 0x662556ff], ecx
pop eax
pop eax
ja fcn.00750bd0
Function at 0x68aa6d
Capabilities:
Encode data using xor

Disassembly:
invalid
jo 0x65cbab
mov eax, 0xe419e73a
lea edx, [eax + eax*2 - 0x55c3e4ff]
mov eax, dword [ebp + edx - 0x5689d0af]
push ecx
das
jbe 0x63bc4b
movsx ecx, dx
not dx
sar edx, cl
lea ebp, [ebp + edx*2 - 0x15a20]
ror dx, 0xe
sbb cl, dl
adc edx, edx
xor eax, ebx
inc dl
ror eax, 3
push ecx
dec eax
shl cl, 2
loope 0x63bcc7
shl ecx, 0x1c
bswap eax
call fcn.00661e9e
sbb al, 0xf
enter 0xffffffffffffcfe8, 0x61
add al, byte [eax]
mov eax, dword [edi]
mov cl, byte [edi + 4]
call fcn.00720637
lodsb al, byte [esi]
xor eax, 0x6ffbef55
das
mov esi, 0xd0d2270e
popal
mov dword [0xd9497f87], eax
loope 0x63bcc3
push edi
movsd dword es:[edi], dword [esi]
inc esi
push ds
inc eax
and dh, bh
int 0x2f
fstpnce st(3), st(0)
sbb dword [edi + 0x20ff5573], 0xd42bfb5e
loope 0x63bd16
sbb eax, 0xc89e2a94
cmp dword [esp + edx*8], ecx
mov eax, dword [0xd32cc86c]
add dword [ebp - 0x4643ea7d], ebp
je 0x63bc9e
mov esp, 0xc48474b9
sub dword [esi - 0x318ae9b2], 0x6c
les eax, [ebx + 0x75164eae]
into
push ss
jne 0x63bcef
insb byte es:[edi], dx
mov cl, 0x99
loop 0x63bd67
sbb ebp, dword [eax + 0x1de22dd2]
mov ebp, 0x9d112c30
cdq
out dx, eax
pop esp
and byte [ecx - 0x7c402a2e], ch
dec eax
pop esi
pop ebp
fmul dword [esi]
pop esi
adc al, bl
pop ds
sub al, byte [ecx]
out 0xea, al
adc ch, byte [ecx - 0x1f]
jae 0x63bd66
xchg byte [edi + 0x44], al
push ds
mov edx, 0xc1b0e189
ljmp 0x9e08
pop ebp
loope 0x63bd1e
invalid
push 0x9eab9a1f
adc edi, 3
shld dx, ax, cl
mov word [edi], dx
sub esi, 4
mov edx, dword [esp]
mov ecx, dword [esi]
mov eax, edx
xor ecx, ebx
xchg byte [esp + 2], al
shr ax, 0x22
neg ecx
lea edx, [edx - 0x674c93e0]
ror ecx, 3
cwde
bswap ecx
imul dl
inc ecx
neg ecx
ror eax, 0x79
xor ebx, ecx
shr dl, 0xc6
add ebp, ecx
sub dword [esp + edx - 0x375f0600], 0xb43172b9
mov dword [esp + edx - 0x375f0600], ebp
ret
pop edx
pop ecx
pop edx
jne fcn.005e34f5
mov dx, word [edi]
mov eax, 0xf529e3a8
mov ax, word [edi + 2]
mov ecx, 0xae94293a
and cl, 0x2d
imul ecx, ecx
mov cl, byte [edi + 4]
jb 0x63bc89

Function at 0x68e161
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
rol eax, 1
call fcn.007967fd
lea eax, [ecx*8 - 0x49779ff6]
not edx
cwde
call fcn.0070add8
mov ecx, 0x9f2ebd18
mov edx, dword [esi]
mov eax, 0xce39d582
add cl, 0x89
mov cx, word [esi + 4]
adc eax, 0x832f5985
ror eax, 0x4e
adc esi, 5
bts eax, 5
mov word ss:[edx], cx
imul eax
lea ecx, [eax + eax*2 + 0x1d242791]
mov ecx, dword [ebp + edx*2 - 0x2400ecb2]
lea ebp, [ebp + edx - 0x12007655]
jo 0x69d609
shr ax, 0xe1
xor ecx, ebx
not eax
not dx
ror ecx, 1
rol edx, 0x7b
push eax
rol al, 0x61
lea ecx, [ecx + edx - 0x70a8cd04]
mov dword [esp + eax - 0x45e697ee], 0x7c18608e
and edx, 0xcaa6523
xor ecx, 0x29bfaea9
pop eax
btc edx, edx
sbb ecx, 0xca81fb1b
shr edx, 0x72
and eax, edx
xor ebx, ecx
xor eax, 0xf2e1715
adc edi, ecx
bts ax, dx
lea edx, [eax*8 - 0x7c7d33fa]
btr eax, 0x2e
jmp edi
Function at 0x6923a7
Capabilities:
Set environment variable

Disassembly:
call fcn.005ffe52
not dl
inc dl
xor cl, cl
xor bl, dl
xor word [esp + ecx*2 - 0x28cd4df7], cx
lea edx, [esp + edx + 0x14]
not eax
call fcn.006fcd1d
mov ecx, 0x3a2ad0b8
or ecx, ecx
mov eax, dword [ecx + ebp - 0x3a2ad0b8]
movsx edx, cx
lea ebp, [ebp + ecx - 0x3a2ad0b4]
jns 0x692cd8
xor eax, ebx
rol ecx, 0x10
shl edx, cl
push ecx
xor eax, 0x5c933990
ror eax, 2
xor eax, 0x7075c34
sar edx, 9
neg dx
call fcn.006af1e2

Function at 0x6999f4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movzx eax, byte [esi]
xor al, bl
call fcn.006c10ce
mov edx, 0xab9d918c
lea eax, [edx + edx*4 - 0x776cba43]
mov edx, dword [ebp]
add ebp, 4
mov ecx, 0x33a5c105
shr ax, cl
xor edx, ebx
call fcn.0061cbde

Function at 0x6a62b9
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi + 0x10], ebp
jmp 0x7476d3
mov dword [edi], ecx
mov ecx, dword [esp + 0x38]
jmp 0x61b352
call eax
mov dword [esi + 0x17c], eax
jmp 0x75538d
mov dword [edi + 8], edx
cwd
mov edx, dword [esp + 0x30]
mov dword [edi + 0x18], ebx
jmp 0x5c84fa
mov dword [edi + 0xc], edx
nop
jmp loc.00416b4c
call fcn.00650a2d
mov edx, 0xb534c191
popfd
btr edx, edx
movzx eax, dx
mov eax, dword [esi + eax*2 - 0x18322]
adc esi, 4
mov ecx, 0x2e195292
xor eax, ebx
sar edx, cl
dec ecx
bts ecx, edx
xor eax, 0x3aa73635
neg dx
ror eax, 1
sub eax, 0x83ac8db7
not dx
call fcn.00726450
xor edx, ebx
bt eax, 0x93
rol edx, 2
inc edx
call fcn.0078ac6b
adc edi, esi
xchg byte [edi - 6], dl
jg 0x6a62c3
std
neg dword [edi - 0x7c]
pop ds
lodsb al, byte [esi]
mov al, 0xf3
push esi
lahf
mov ecx, 0xbf0dc50c
sar ebp, 0x3c
cmovae esp, esi
add eax, 0x60e590be
jae 0x6a6394
push eax
mov edi, 0xb784de3a
push esi
xor edx, dword [edi - 0x4ce45703]
cmp byte [edi + 0x5b3401fa], al
cmp bh, 0xc7
retf
push cs
add byte [edi - 0x57362d6], bh
mov edi, 0xfa8c9d2a
mov esp, ebp
popfd
call fcn.005a5edd
push eax
mov eax, 0x553a95a3
mov eax, dword [ecx + 0x18]
jmp 0x5fff80
mov dword [edi + 4], eax
jmp 0x76b782
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
setno al
mov eax, dword [esp + 0x28]
jmp 0x5ef724
mov dword [edi + 0x14], ecx
jmp 0x62ef3e
Function at 0x6a8cf9
Capabilities:
Encode data using xor

Disassembly:
bswap eax
bts edx, 0xb0
not ecx
xor ebx, eax
jmp 0x68b5f4
not cx
add esi, eax
mov ecx, dword [edi + edx - 0x10000]
lea eax, [edx - 0x385585d8]
rol ax, 6
mov al, byte [edi + edx - 0xfffc]
rol edx, 0xbe
dec dx
lea edi, [edi + edx - 0x3ff9]
adc edx, edx
neg dx
mov byte ss:[ecx + edx*8 - 0x40010], al
jmp esi
mov dword [esp + ecx - 0x36], eax
neg edx
xchg word [esp + ecx - 0x34], cx
dec word [esp + ecx - 0xfffd]
xor ebx, edx
btc ax, cx
jae fcn.0074a872
bswap eax
add edi, edx
call fcn.00693317
mov edx, 0x99aa00b2
shl dl, 0x64
sets dl
mov eax, dword [ebp]
movzx ecx, dl
lea ebp, [ebp + ecx*8 + 4]
xor eax, ebx
xor edx, edx
xadd ecx, edx
neg eax
bswap eax
and cl, 0x33
sbb dl, cl
bts cx, cx
sbb eax, ecx
dec cx
jp 0x609aa4
sbb eax, 0x6c3035a8
xor ebx, eax
call fcn.005e6e2a
sub esi, 4
mov edx, 0x309da0aa
movsx eax, dx
or ax, ax
mov edx, dword [esi + edx - 0x309da0aa]
xor al, 0x9c
jno 0x774b93
mov eax, 0x912fba90
sub ebp, 4
mov ecx, dword [ebp]
cdq
jmp 0x7585e8
not ax
mov dword [esp], 0x4e29bb1f
and cx, ax
movsx eax, dx
dec edx
mov word [edi + eax - 0x34b0], cx
mov eax, dword [ebp + eax*4 - 0xd2c0]
or dword [esp], edx
jp 0x5edb6f
adc ebp, 4
movsx ecx, dx
dec edx
xor eax, ebx
bswap eax
sub eax, 0xb7a2011c
sal dl, 0x44
bswap eax
neg ecx
jne 0x69eb42
xor ecx, ebx
xor ecx, edx
shl al, 0x27
sbb ecx, 0xaa172380
mul edx
imul edx
bswap ecx
setno al
dec ecx
xor ecx, 0xf10bc116
inc al
btc eax, edx
push eax
xor ebx, ecx
call fcn.006ccbc6
lea ebp, [ebp + eax - 0x40170a19]
xor ecx, ebx
sub dx, 0x2497
call fcn.005ca345
push ds
stc
stc
mov cl, 0x65
rol byte [edi + 0x26], 1
lcall 0x9a32, 0x217231b9
arpl sp, si
les sp, [ebp + 0x45]
jp 0x75860a
mov ebp, 0x9a3a1b02
ror byte [edi - 0x3465c3ed], 1
jo 0x7585d2
xor cl, ah
dec eax
div dh
dec ecx
out 0x28, eax
inc esp
inc esp
pop ecx
invalid
push eax
xor edx, ebx
sub edx, 0xd2ba125
dec al
movzx ecx, byte [esp]
not edx
shr byte [esp + ecx*8 - 0x1b0], 0x64
bswap edx
rol edx, 2
jmp 0x69b849

Function at 0x6ab2c3
Capabilities:
Read file on windows

Disassembly:
dec cx
lea eax, [eax + ecx - 0x1ecb55df]
jno 0x677e94
btc cx, 0x9f
xor ebx, eax
add ebp, eax
shr word [esp + ecx - 0x2bd53ff9], 0xe7
and edx, ecx
mov ecx, dword [edi + ecx*2 - 0x57aa7ffa]
bswap edx
mov ax, word [edx + ecx]
je 0x6b0d8d
mov word [edi + edx*4], ax
call fcn.00622dd6
not eax
mov dword [esp + ecx*2 - 0x57ab7ffc], 0x5807c7bb
ror eax, 3
jmp 0x64bd9d
lea edi, [edi + edx*8 + 2]
mov ecx, edx
jns 0x6aa3a3

Function at 0x6af08c
Capabilities:
Encode data using xor

Disassembly:
movsx ecx, dx
xor eax, ebx
jmp 0x61f429
neg eax
mov dword [esp + edx*4 - 0x24ab4], 0xe23ff3ad
inc edx
mov dword [esp + edx - 0x92af], edx
xor eax, 0x3e2730b6
ror eax, 1
not edx
xor ebx, eax
add ebp, eax
mov ax, word [edi]
mov cl, byte [edi + 2]
bts edx, 0x16
adc edi, 1
ror byte [esp + 2], 0xa4
inc dl
sal ax, cl
sub dx, word [esp + 3]
mov word [edi], ax
lea edx, [edx + edx*4 - 0x3c68cc7b]
adc dx, dx
jne 0x76c574
neg dx
jl fcn.007918df
xor edx, dword [ecx + edi - 0x1bad1eeb]
lea edi, [ecx + edi - 0x1bad1ee7]
lea ecx, [ecx + ecx + 0x120996bf]
call fcn.006c2b54
jl 0x643279
pop ecx
pop edx
jmp ebp
Function at 0x6b1571
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx + edx*2 - 0x84ee2e9]
jmp edi
mov word [esi + eax - 0x6883c606], dx
mov eax, dword [ebp + eax - 0x6883c606]
add ebp, 4
mov edx, 0xac250533
lea ecx, [edx + edx*4 + 0x12c8dab]
sar ecx, cl
xor eax, ebx
mov dword [esp + ecx*4 - 0x5de5a4], edx
not cl
sar byte [esp + ecx*8 - 0xbbccaa], 0x63
dec eax
not eax
push ecx
sar cl, 0x85
pop ecx
dec eax
ror edx, cl
ror eax, 2
shl edx, 0xcd
setne byte [esp + ecx*4 - 0x5de652]
xor ebx, eax
btc cx, 0xa3
pop edx
adc edi, eax
call fcn.00675295
mov ecx, dword [ebp + eax - 3]
dec ax
mov eax, dword [ebp + eax*8 - 0xc]
imul ecx
mov ecx, 0x793bb2a
neg cx
or ecx, 0x559ae52d
mov dword [ebp + ecx - 0x579be5ff], edx
sub cl, ch
lea edx, [ecx + ecx*2 + 0x1ba97187]
mov dword [ecx + ebp - 0x579be516], eax
jae 0x60630c
mov ecx, dword [edi]
mov edx, 0x79be2402
sal dx, 3
lea edi, [edx + edi - 0x79be200c]
push edx
movsx eax, byte [esp + edx - 0x79be2010]
call fcn.006d5e25
mov ecx, dword [esi]
movsx edx, al
mov eax, dword [esi + 4]
neg edx
setg dl
sal edx, 0xa2
adc esi, edx
btr edx, edx
adc ecx, eax
call fcn.0077329a

Function at 0x6d1d83
Capabilities:
Packed with generic packer

Disassembly:
jp 0x619bfb
sub dword [esi - 0x1a], eax
jp 0x619bd3
inc ebp
mov ah, 0x9b
jecxz 0x619b8d
push cs
and ah, al
add byte [ebx - 0x57a029e6], bh
mov ebx, 0xa85fd61a
mov edx, 0xa65fd986
push ebx
fstp qword [edi + 8]
shl dword ss:[ecx - 0x24], 0x1f
mov bh, 0x1a
mov ds, ecx
fist word [edi + 0x2ce02978]
fsub st(0)
jg 0x619b87
pop ds
outsd dx, dword [esi]
jne 0x619bfc
iretd
leave
or ecx, 0xc82f1a4
xor ebx, edx
add esi, edx
mov cx, word [edi + eax*4 - 0x7ffa380]
lea edx, [eax + eax*8 - 0x15cb61db]
call fcn.00674bd9
mov eax, dword [ebp + ecx*8]
xor eax, ebx
call fcn.00697039
cwde
stosd dword es:[edi], eax
sub byte [ebp - 0x7b], al
pop es
add byte [eax - 0x7abad755], bl
imul eax, dword [edx - 0x621af1f1], 0xffffffe6
or eax, 0x649c6245
js 0x619b96
dec eax
jg 0x619c13
int1
pop dword [esi]
jbe 0x619ba1
popfd
dec eax
iretd
mov cl, byte [edi + 2]
call fcn.005b8728
mov ecx, 0x4f1e8c03
mov eax, ecx
lea ebp, [ebp + eax - 0x4f1e8c07]
mov ecx, dword [ebp + eax - 0x4f1e8c03]
imul eax, eax
not eax
xor ecx, ebx
cwde
sal al, 0xc7
sbb ecx, 0x9db7d6be
bswap ecx
movsx edx, al
rol dl, 0xa1
not ecx
rol ecx, 1
xadd eax, edx
cmova dx, ax
sal dx, 0x4f
not ecx
inc edx
sbb ecx, 0xfaab4585
cdq
xor ebx, ecx
dec al
add esi, ecx
xor dx, dx
movzx ecx, dx
lea ebp, [ecx + ebp - 4]
jae 0x619bf2
Function at 0x70add8
Capabilities:
Set environment variable
Set registry value

Disassembly:
pushal
xchg ebp, eax
adc al, byte [eax]
add dh, bh
rol al, 0xe1
loope 0x637f31
inc al
shl cl, 0xe1
not al
not dx
ror al, 1
shl dl, cl
setb dl
not al
lea ecx, [ecx*2 - 0x1cc6f7d1]
shl edx, cl
xor bl, al
sal cl, 0x41
shl byte [esi - 9], 1
rcl al, cl
enter 0xffffffffffffe2d2, 0xf
xchg edx, eax
ret 0xd0f6
bt edx, ecx
push ecx
lea eax, [esp + eax + 4]
sal dl, 0x24
jns 0x5c5837
mov al, 0xd2
push 0x2d
stc
sbb ah, al
shr cl, 0x17
adc bl, byte [esi - 0x712338fe]
xor eax, 0xf1d2cba1
and dword [ebp + 0x3c], ecx
mov byte [ebx - 0x52], al
jecxz 0x637f34
scasb al, byte es:[edi]
test al, 0x8d
movsd dword es:[edi], dword [esi]
adc eax, 0x7507b07f
xor byte [0xbc05a6e2], cl
mov byte [0x846640bc], al
mov ah, byte [eax + 0x33]
sub dword [esi], ecx
or ch, byte [ebp + 0x274debcd]
dec edi
pop eax
daa
xor dword [edx + 0x15482686], eax
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
out dx, al
cmpsd dword [esi], dword es:[edi]
inc ecx
ror ebx, 1
cmp al, 0x1b
push eax
pop edx
jl 0x637fad
or al, 0x2d
pop edi
sahf
sahf
retf 0xbd59
bt ecx, 0x3a
xor al, bl
rol cx, cl
jno 0x637f35
ror edx, 2
call fcn.006e03a5
jge 0x70ada2
mov esi, 0x633f057
mov edi, 0x370b4135
pand mm5, qword [esi - 0xd]
mov ch, 0x90
rol byte gs:[ebp - 0x2540af92], 1
sub byte [edi - 0x3b7cf949], cl
xchg eax, ebx
lea ecx, [ebx]
or dh, byte [edx + 0x7f]
xor dword [ebp - 0x38], edi
salc
imul esp, dword [edi - 0x28183c9a], 0x37
dec dword [edx]
sub byte [ebp - 0x67de8dcd], al
dec edi
lodsd eax, dword [esi]
in eax, dx
inc ecx
xor byte [eax], dh
stosb byte es:[edi], al
cmp edx, 0xce0041f4
lea esp, [edx]
sal byte [edi], cl
push ecx
push 0x5a
and dword [esp + esi*8 + 0x2a8df969], ecx
push esi
nop
inc edi
cmp dh, byte [ebp + ebp*8 - 0x60]
pushal
or byte [edx + 0x16], dl
mov byte [edi], 0x3a
lahf
lodsd eax, dword [esi]
adc esp, dword [eax + 0x677c2397]
xor eax, 0x850fd851
or dword [edi], 0x558bfffb
adc al, 0x66
cwde

Function at 0x70d141
Capabilities:
Encode data using xor

Disassembly:
sal al, 0x82
mov dx, word [ecx + eax - 0x45579880]
lea edi, [edi + eax - 0x45579882]
mov word [edi + eax - 0x45579880], dx
pop edx
pop ecx
jne fcn.005de890
adc al, 0x32
sub dword [esp + ecx - 0x4d247b70], edx
shl byte [esp + ecx - 0x4d247b6f], 0xe4
ror al, 1
and dl, ch
not al
pop ecx
xchg dword [esp + ecx - 0x4d24334e], ecx
not cx
neg al
ror al, 1
not word [esp + 5]
xor bl, al
lea eax, [esp + eax + 8]
dec cl
movzx cx, byte [eax]
call fcn.0071cd49
neg ecx
lea eax, [edx + edx*2 + 0x6f1d8135]
btc eax, edx
call fcn.007911a5
xor eax, 0x761900c0
invalid
Function at 0x70df23
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebp]
jmp 0x6a5a29
out 0x12, al
test ah, al
out 0xf7, al
invalid
mov edx, dword [ebp]
call fcn.0069f26e
or dword [edx - 0x48b269de], eax
jle 0x63cb33
leave
outsb dx, byte [esi]
xchg dword ss:[ecx], esp
xchg esi, eax
out 0xb6, eax
test byte [esi], ah
jbe 0x63cbda
sahf
pop ecx
push cs
xchg esi, eax
xchg byte [edi - 0x27c9dea1], bl
stc
invalid
adc byte [ecx + ebp*8 - 0x7d], ch
sbb al, 0xf9
dec dword [edi]
test dl, dl
lodsd eax, dword [esi]
add byte [eax], al
mov edx, dword fs:[eax]
mov eax, 0xcf94320f
movzx ecx, al
mov dword [ebp + ecx - 0xf], edx
cdq
bswap ecx
mov eax, dword [ecx + edi - 0xf000000]
neg ecx
adc edi, 3
rol dx, 0x83
xor eax, ebx
ror edx, 3
call fcn.00686e5c
jge 0x6a5a76
movsb byte es:[edi], byte [esi]
xchg dword fs:[ebx], ecx
sub bh, byte [edi - 0x53]
test byte [eax + 0x51fca439], dh
sbb eax, 0x5b52c1d4
mov ch, 0x95
imul eax, dword [eax], 0x524baaee
mov ecx, 0xfc05a524
xchg ecx, eax
stc
lds esi, [esi]
test byte [esi + ecx*2], cl
movsd dword es:[edi], dword [esi]
add eax, 0xc5f991fc
test byte ss:[esi + ecx*2], cl
xor dword [ebp + 0x5484ae19], ebx
adc ebx, ebp
ret 0x9da7
add edi, 6
mov word ss:[ecx], ax
movzx eax, dx
mov edx, dword [esi + eax*2 - 0x1d026]
lea esi, [esi + eax*4 - 0x3a048]
xor edx, ebx
call fcn.007a3846
mov ecx, 0x13ad1329
imul ecx, ecx
jb 0x63cb51
mov edx, 0x83007fa4
jmp 0x629e3c

Function at 0x730f97
Capabilities:
Query or enumerate registry value
Set environment variable
Set registry value

Disassembly:
mov edx, dword [edx + edi - 0x90f4b84]
mov ecx, 0x6027d10a
lea edi, [edi + ecx - 0x6027d106]
mov eax, ecx
and eax, ecx
movzx ecx, byte [ebp + eax - 0x6027d10a]
call fcn.0063715d
lea edi, [edi + ecx*4 - 0x401bbbbc]
jp 0x70e780
sbb edx, 0xf13c4c3e
call fcn.00786ad8
xor eax, ebx
or dword [esp + ecx - 0x1006eef0], edx
or dword [esp + ecx - 0x1006eef0], 0xc9983b6
bswap eax
jno 0x737b0d
adc ebp, 1
lea ecx, [eax + 0x1006ef04]
mov dword [esp + ecx - 0x1006eef0], 0xd7aa983f
rol byte [esp + ecx*4 - 0x401bbbbe], 0x23
mov word [ebp + ecx - 0x1006eef0], dx
sar byte [esp + ecx*2 - 0x200dddde], 0x43
lea edx, [ecx + ecx*8 + 0x4812a18f]
mov eax, dword [edi + ecx*2 - 0x200ddde0]
cmovns edx, dword [esp + ecx - 0x1006eef0]
jp 0x5e3c07
mov ecx, 0x2a080abe
lea edx, [ecx + ecx*8 + 0x2bb42e96]
shr cl, 0x43
mov ax, word [esi + ecx*2 - 0x5410142e]
and cl, dh
mov cl, byte [esi + ecx*2 - 0x5410140c]
jl 0x5d41fe
adc esi, 2
sal edx, 0xfd
shl dl, 0xe5
btc edx, edx
shl ax, cl
jmp 0x6b021c
bswap edx
inc eax
lea ecx, [ecx*4 - 0x726ead55]
call fcn.007907ab
Function at 0x73273d
Capabilities:
Authenticate hmac

Disassembly:
bswap edx
dec ecx
neg word [esp + eax - 0x7b14b088]
xor edx, 0x23a3534
xchg word [esp + eax - 0x7b14b086], cx
bswap edx
neg edx
and byte [esp + eax - 0x7b14b08a], ah
or eax, eax
dec edx
push eax
imul ax, cx
xchg ecx, eax
xor ebx, edx
ror byte [esp + ecx - 0x7b14da44], cl
xchg cl, al
inc al
add ebp, edx
mov edx, 0x2d3c4380
fldz
shr ax, 0xe4
xadd dword [esp + edx - 0x2d3c4379], edx
mov dword [esp + ecx - 0x7b14daba], ebp
ret 8
xor ebx, eax
dec dl
jns 0x732127
xor ecx, ebx
call fcn.006bef21
mov ecx, 0xeab67238
sub ecx, 0x790e1da3
mov eax, ecx
lea esi, [esi + eax - 0x71a85499]
sar ecx, 0xc5
mov eax, dword [esi + ecx*4 - 0xe350a90]
sal ecx, 0x2c
movzx edx, cl
inc ecx
xor eax, ebx
shl cl, cl
call fcn.0063326e
shr edx, 0xc7
xor eax, ebx
inc dx
neg eax
or ecx, ecx
bswap edx
rol eax, 1
shl ecx, 0x81
jge 0x796270
xor eax, 0x39bb1abc
sub edx, edx
xor ebx, eax
call fcn.006b24b4
mov dword [esp + ecx*8 + 4], 0x7daecfba
add dword [esp + ecx + 4], ecx
dec edx
ror byte [esp + ecx*2 + 7], 0x61
sal ecx, 0xeb
xor edx, 0x21839fad
lea eax, [ecx + ecx*4 + 0x7b14b08a]
inc word [esp + ecx*8 + 3]
inc edx
jmp 0x6df604
add esi, eax
xor edx, dword [edi + edx*4]
movzx eax, cl
rol ecx, cl
neg al
mov cx, word [edx + eax*8 - 0x678]
bswap eax
btr eax, eax
sub ax, ax
adc edi, 2
movzx edx, al
lea eax, [eax*2 - 0x3171abf1]
lea eax, [eax + eax*2 - 0x6871fdf4]
mov word [edi + edx*2], cx
mul dx
dec dl
jmp esi
mov eax, 0x5735822a
pop ebp
mov edx, eax
lea ebp, [edx + ebp - 0x5735822f]
movsx ecx, dx
shr ecx, 0x85
mov eax, dword [esi + ecx*2 - 0xffff822]
lea esi, [esi + ecx*2 - 0xffff81e]
jae 0x6f5a5c
lea esi, [esi + eax - 0x4782]
mov dl, byte [esi + eax - 0x4781]
rol eax, 0xc1
xor dl, bl
push eax
xor dl, 0x15
jmp 0x73e9d6
ror dl, 1
mov ecx, dword [esp + eax*8 - 0x47810]
xor dl, 0x2f
push eax
add dl, 0x90
add eax, ecx
sbb eax, dword [esp + eax - 0x11e02]
xor bl, dl
call fcn.006e1c7a
mov edx, 0x9e2ff9b4
shr edx, 0xb6
lea eax, [edx + edx*2 + 0x5b1c1482]
lea esi, [edx + esi - 0x27c]
movzx ecx, al
mov edx, dword [edx + esi - 0x278]
not al
xor edx, ebx
lea edx, [edx + eax + 0x10e8da85]
bswap edx
inc edx
xchg ecx, eax
add ecx, eax
bswap edx
shl cl, 0x87
xchg ah, cl
lea edx, [eax + edx + 0x72ba6442]
push ecx
xor ebx, edx
xor cl, ah
jne 0x72d73c
mov ecx, 0xbba253ba
sar cx, 0x69
movsx edx, cl
mov eax, dword [ebp + edx - 0x29]
lea ebp, [ebp + edx - 0x25]
xor eax, ebx
neg eax
or dl, 0x96
lea eax, [eax + edx*2 - 0x2c9e2106]
neg eax
and cl, dl
neg edx
lea eax, [eax + ecx - 0x447e6bf4]
sar edx, 0xae
add cl, 0x36
sal cl, 0x26
xor eax, edx
neg eax
imul ecx, edx
sar cx, 0x8e
imul edx, edx
ror eax, 1
add cl, 0x32
jns 0x6e4f2b
xor eax, 0x8e80582f
lea ecx, [edx + edx + 0x3127679b]
bswap eax
ror edx, cl
dec eax
jmp 0x72be00
Function at 0x732bc4
Capabilities:
Create thread
Set environment variable
Set registry value

Disassembly:
dec edx
push ecx
xadd dword [esp + eax - 0x6c807bf9], eax
jae 0x5c5869
cli
jl 0x5f857a
mov edx, 0xdd515561
adc dword [edx - 0x7d], edi
push 0x64
fld xword [ebp + 0x3d]
and dword [esi + 0x49], ebp
add dword [esi + 0x51b1d1bc], 0xdb73ecff
lodsd eax, dword [esi]
pop eax
or esi, dword [esi]
mov es, ebx
je 0x5f84f1
int1
imul ebp, ecx, 0x539b64a5
mov bh, 0x66
xchg esi, eax
insb byte es:[edi], dx
sbb edx, dword [edi + 0x2083e763]
pop ss
sahf
add ah, dh
mov ah, 0xac
bound esp, qword [eax - 0x76ff6b44]
jne 0x5f850b
cwde
pop ebp
and eax, 0xf0356e32
out dx, eax
add byte [eax], dl
cmp ecx, eax
popfd
pop edi
in eax, 4
cmpsb byte [esi], byte es:[edi]
xor esp, ecx
pop ss
ret
adc edx, edx
xchg edi, eax
rcr edi, 0xff
xchg edx, eax
sbb ebp, 0x85a0307f
add dl, byte [ebp + 0x3b3749db]
add byte [ecx - 0x22803d72], dh
fnstsw word [edi]
mov ch, 0xd5
jg 0x5f85ae
xchg ebx, eax
xor byte ss:[edi], 0xab
cmp eax, dword [eax]
rcr dword [edx + 0x63ffccbe], 1
and al, 0xe8
cmp al, 0x80
bound ecx, qword [edi - 0x80]
xor byte [eax], al
pop ds
neg cx
not eax
rol eax, 1
bswap eax
jmp 0x78363f
mov dword [esp], ecx
lea eax, [ecx + ecx*8 - 0x9df9844]
mov eax, dword [esp + eax - 0x5e6295b8]
xadd dword [esp], ecx
mov dword [edi + 4], edx
movsx edx, cx
mov dword [edi + edx*2 - 0x7c00], eax
xor dx, 0x2704
mov edx, dword [ebp + edx - 0x1904]
inc cx
adc ebp, 4
pop ecx
xor edx, ebx
not edx
push ecx
mov dword [esp + ecx - 0x6c807bfc], 0x8b9621aa
lea edx, [ecx + edx - 0x3dceecf3]
xor edx, 0x10a97237
inc ecx
mov eax, ecx
jnp 0x5f84f0
xor ebx, edx
mov dword [esp + eax*2 - 0x409fb032], eax
add esi, edx
mov edx, dword [ebp + eax*2 - 0x409fb032]
pop eax
bts ecx, eax
add ax, ax
lea ebp, [ebp + eax - 0x204fb02e]
not ecx
jne 0x752305
call fcn.006b911e
xor edx, ebx
bts ecx, eax
lea eax, [ecx + eax*4 - 0x565c984a]
imul cx, ax
neg edx
sal eax, 0x66
inc edx
not edx
div al
bt ecx, 0xbe
rol edx, 1
call fcn.0078f6f6
shr ecx, 0xaa
sbb eax, 0xb133720c
xor ebx, eax
add esi, eax
lea eax, [edx*8 - 0x585b387b]
pop edx
jmp fcn.005e34f5

Function at 0x735fa3
Capabilities:
Read file on windows

Disassembly:
call fcn.0064c876
push 0xfc4
lea eax, [esi + 0x18]
jmp 0x6ab247
mov eax, dword [esi + 0x12848]
xor dh, 0x2e
mov edx, dword [esi + 0x12840]
stc
adc ecx, 0xbd8b391e
mov ecx, dword [eax + edx]
test dx, 0xe715
add eax, 4
cmc
test bx, 0x3400
jmp 0x42a753
jmp 0x699775
push eax
jmp 0x7919dc
call fcn.0043dba0
add esp, 0xc
test bp, 0xb806
clc
cmp dword [esi + 0xc], 0
jmp 0x759765
jne 0x5f45b3
mov ecx, dword [esi + 4]
not eax
cmovno eax, edi
cbw
push ecx
mov ax, 0xed39
setp ah
push 1
lea eax, [esi + 0xc]
jmp 0x685ee6
push 4
jmp 0x664675
push eax
jmp 0x6720bb
cmp dword [esi + 0xc], 0
je 0x6180d2
call fcn.0061acd9
mov edx, esi
jmp 0x5d4594
push 0x20
jmp 0x68abcd
push edi
jmp 0x681909
push ebp
cmovl bp, bx
bts bp, ax
mov ebp, esp
stc
and esp, 0xfffffff8
cmc
test esi, ecx
clc
sub esp, 0x2c
push ebx
test ah, bh
test bl, 0x2a
cmp bp, sp
push esi
shr esi, 0x28
stc
mov esi, eax
test edx, 0xa2ac80b2
cmp byte [esi + 0x12828], 0
jmp 0x6c2367
call fcn.0043cc1e
add esp, 0x10
jmp 0x65e970