joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405f8b
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x12844fbb
dec edi
test byte [edx], dl
dec ecx
inc esp
sal dword [esi - 0x1b], 0xb7
movsd dword es:[edi], dword [esi]
jae 0x405f58
pop ss
jl 0x7bcbe743
invalid
out dx, eax
mov dword [0x56fa8c91], eax
pop esi
invalid
push ss
dec ebp
lcall 0xede7, 0x8cf27e49
dec ecx
jle 0x405f80
mov edi, fs
in eax, dx
dec ecx
jle 0x405f80
mov edi, fs
in eax, dx
mov cl, 0xb2
pop ss
mov byte [ecx - 0x13], ch
and edx, ebx
mov ecx, 0x4dccc2e8
int3
dec ebp
ja 0x405fdc
xchg bl, ah
xchg ebx, eax
or byte [eax - 0x292b5863], 0x33
jne 0x405f56
retf 0xf3df
inc edi
aam 0x32
mov ah, 0x85
push es
rcl dword [ecx + 5]
and byte [ebp - 0x51], al
inc ebp
scasd eax, dword es:[edi]
dec esi
xor byte [eax - 0x56], 0x7c
jno 0x405fd8
jo 0x405f88
jl 0x406051
not dword [ebx + 0x1f]
push ebx
pop ds
mov dl, 0xa6
fadd qword [ebp - 0x6b]
dec ebp
shl dh, cl
mov fs, word [esi + eax*2]
inc esi
xchg dword [0x2268e637], esp
and eax, dword [edi]
xor al, ch
les eax, [0x239aff66]
sub byte [edi - 0x6b6fab6f], ah
jbe 0x405fce
invalid
mov esi, 0x3737ea9d
aad 0xe
push cs
das

Function at 0x406b9d
Capabilities:
Encode data using xor

Disassembly:
and byte [edi - 0x2227889b], dh
push ds
mov byte [ebx], bl
push cs
sbb ecx, dword [esi]
mov dl, 0x2d
sbb esp, dword [ecx + 0x5b]
out 0xf4, eax
or dword [ecx + 0x2914431], 0xffffff9e
adc cl, byte [esi - 0x51872329]
xchg dword [eax], ebp
dec eax
lodsb al, byte [esi]
das
xor dword [ebx - 0x69], 0xf56cda41
in eax, 0xc5
jno 0x406ba5
ret

Function at 0x444387
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp - 0x10], ecx
xor cl, ch
call 0x3e69b6a7
mov eax, esi
add esp, 0x5b5f5644
sbb al, 0xc2
or al, 0x3e
test edi, edi
imul ecx, dword [edi], 0xe8cf8051
push ecx
or bh, 0xe8
push ecx
or bh, 0xe8
or dh, byte [ecx + 0x26]
mov ecx, edi
add esp, 0x85c78004
jle 0x44436d
push ss
mov eax, dword [esp + esi - 0x77]
push esp
mov ah, 0x8d
adc al, 2
cmp dword [esi], edi
mov dword [ebp - 0x60], edx
je 0x4443f7
xor byte [ebp - 0x4c], cl
adc byte ss:[ecx], bh
mov al, 0x76
or dword [ecx + 0x44e82ca], ecx
sub cl, al
cmp dword [esi], edi
jge 0x44441c
lea eax, [eax + edi]
mov ecx, esi
or dl, byte [esi + 4]
dec ebp
mov ah, 0x29
ret 0xd639
lea eax, [ebp + 0x3e]
lea ecx, [ebp - 0x58]
mov dword [eax - 0xa], eax
mov dword [eax + 0x3a], 0x3e0028

Function at 0x445b5b
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
aaa
das
or ah, al
aad 0xe9
aaa
cmp dh, 0xeb
movsd dword es:[edi], dword [esi]
sub al, 0x24
mov cl, 0x27
scasb al, byte es:[edi]
aas
invalid

Function at 0x46d213
Capabilities:
Encode data using xor

Disassembly:
adc bl, byte [esi + 0x5d]
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov eax, dword [0x128f3e90]
lea edi, [ecx + 4]
or dh, 0x31
sub byte [ecx + 0x1c73e45], cl
enter 0x7ca8, 0x12
Function at 0x473167
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x89
in eax, 0x3e
push edi
push esi
and esp, 0x50ec82f0
or dh, ah
mov eax, dword [0x8fd53e]
mov ebx, ecx
test byte [esi + 0x30], cl
out 0xa1, al
aad 0x8f
add byte [ecx + 0x304e84cb], cl
push cs
push edi
sar byte [esi], 0xe8
mov dword [eax + ecx*2 + 0xf], eax
and byte [ecx], al
call 0x3ea594c7
push 0x68
call 0x269b6f8
add dword [esp + eax], 0xffffff89
mov dword [esi], edi
xor eax, eax
and edx, edx
mov eax, esi
inc edx
push eax
adc dl, byte [eax + 0x52]
test al, 0
test al, 0
add byte [eax], al
mov dword [esi + 0xc], esp
mov dword [esi], edi
sub al, 0xf0
pop es
sub esp, 8
mov eax, dword [esi + 0x2c]
mov dword [eax], esp
test ecx, ecx
dec eax
add al, 0x64
add esi, eax
test byte [ecx], 0x8d
xor byte ds:[ecx - 0x17c776c2], cl
or dword [ecx], eax
add byte [eax], al
mov dword [edx], eax
mov esp, dword [esi + 0x3e]
test eax, eax
xor eax, 0xe789f289
adc byte [eax - 0x75], dl
sub al, 0x89
loopne 0x473174
pop esi
adc bh, al
inc esi
sub al, 0
add byte [esi], bh
add byte [ecx - 0x2f76fbb8], cl
mov dword [eax], edx
sub bl, dl
add edi, dword [esi]
add byte [ecx + 0x4d8bec], cl
push ebx
call 0x3e473545
mov ecx, ebx
call fcn.0047365b
xor dword [edx], ebx
lea ecx, [esi + 0x3e]
call fcn.004733ad
or byte [esi + 0x48], 0x30
jmp 0x22cc7109

Function at 0x48a92f
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
add dword [esi], ebp
push eax
inc edx
sal bh, 0x84
mov dh, 0xb1
sbb al, 0x92
or ah, byte [ecx + 0x7a303012]
inc dword [esi]
out dx, al
dec ebx
mov ss, word [ebp - 1]
daa
cmp dword [ecx], ecx
cmc
scasd eax, dword es:[edi]
lock or edi, dword [esi]
inc edi
and dword [0xba76913f], esi
xor dword [ecx], ebx
daa
push es
add dword [edi + 0x4e4ffeb8], 0xffffffa5
jns 0x48a97a
sbb bh, dl

Function at 0x49be47
Capabilities:
Encode data using xor

Disassembly:
call 0xee34827c
mov eax, esi
push esi
pop edi
pop ebx
sbb al, 0xc2
adc al, 0x3e
push ebp
mov ebp, esp
push esi
mov esi, dword [eax + ecx - 0x7b]
je 0x49be98
dec esi
xor byte [ecx - 0x367beb3a], al
je 0x49be70
invalid
or byte [esi + 0x18], 4
leave
je 0x49beb5
lock dec dword [ecx + 4]
jne 0x49be81
add ecx, 4
mov eax, dword [ecx + 0x3e]
add ecx, 0xffffffec
inc ecx
add ecx, 0xffffffec
push 1
not byte [eax]
mov dword [eax], esi
call 0x33fcc9
dec esp
pop ebp
jmp 0x25dbe98
pop esi
pop ebp
push ebp
mov ebp, esp
push esi
mov esi, dword [eax + ecx - 0x75]
push cs
movzx edi, word [esi]
or byte [ecx + 0x2460], ch
je 0x49beb6
sub byte [ecx - 0x14fec196], ch
add al, 0x66
mov dword [eax + 8], 0x46c70001
pop es
add byte [eax], al
add dh, al
inc esi
sbb dword [ecx], eax
mov word [eax + 8], 1
mov dword [esi + 0x3e], 7
mov byte [esi + 0x19], 1
or al, byte [esi]
mov edi, dword [esi]
and byte [eax + 0x74004968], al
and eax, dword [eax + 0x3e004a38]
sbb eax, 0x14940c6
cmp byte [eax + 0xac], 0x3e
jle 0x49beef
lds eax, [eax]
add byte [eax], al
add byte [esi], bh
inc dword [eax + 0x108]
pop esi
pop ebp
add cl, ah
Function at 0x49dcd7
Capabilities:
Encode data using xor

Disassembly:
test byte [ebx - 0x16cecfb3], 0x3e
mov ecx, 0x830201e1
les ebp, [eax]
pop esi
push ds
pop ebx
pop ebp
push ebp
mov ebp, esp
push 0x10
loopne 0x49dd55
loope 0x49dcf2
add al, byte [ebx - 0x3e76fbc2]
pop ebp
jmp 0x49dcec
int3
push esi
and esp, 0x20
mov eax, dword [0x3e8fd510]
mov edi, dword [ebp + 8]
mov esi, ecx
xor al, ch
mov dword [eax + esi*8], eax
call 0xee35a748
lea eax, [esi + 4]
mov dword [esi], 0x3e86f414
mov dword [esi + 4], 0x1286f41c
mov dword [esi], edi
or byte [ecx - 0x3fce2bc2], cl
mov dword [esi + 4], eax
push edi
call 0x3f488439
add esp, 4
mov edi, eax
test byte [ebp - 0x28], bl
xor al, al
mov dword [esi], edi
adc byte [eax + 0x128b9900], bh
mov dword [ebx + 0x14], 0x3e000f
mov byte [ecx], 0
push eax
loopne 0x49dcf6
ficom word [edx + eax]
cmp dword [esi], 4
mov ecx, ecx
push eax
mov eax, 0x128b9910
cdq
mov edx, dword [edx]
push eax
call 0xee34799c
mov ecx, edi
push edx
push dword [ebp + 0x14]
call fcn.00481c2f
mov ecx, ebx
call 0x3f343f36
mov ecx, dword [ebp + 0x3e]
xor ecx, ebp
call 0x25cbe88
mov dword [eax], esi
add esp, 0x3e
pop esi
pop edi
dec ecx
pop ebp
ret 4

Function at 0x4a9c3b
Capabilities:
Encode data using xor

Disassembly:
unpcklps xmm0, xmm0
pop ebp
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [0x128f3e90]
mov dword [ebp + 8], esi
xor al, ch
mov dword [eax], esi
mov dword [ebp + 0x3e], eax
push 0x125deda3
loopne 0x4a9c36
xchg edx, eax
inc dword ds:[esi + edi - 0x1c769c8c]
push eax
and al, 0x89
xor byte [eax - 7], ch
pop ebp
adc al, byte [eax - 0x18]
adc byte [esi + 0x7d0cffff], dh
call 0x653395b8
lcall 0xf908, 0xdc89f6ff
push 0x5e003e
push 0
loopne 0x4a9ce6
adc byte [eax], al
add byte [ecx - 0x76f417c2], cl
invalid
lcall 0x2534, 0xc084f6ff

Function at 0x4af8c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc ebp
in al, dx
adc byte [edi - 0x18], dl
add eax, dword ds:[eax]
add byte [ebx + 0x5e89304e], cl
xor byte [ebp - 0x74f9c137], al
add dword [edx + 1], ebp
not byte [eax]
lea ecx, [esp + ebp*8]
call 0xee341028
mov ecx, esi
loopne 0x4af8e2
out dx, eax
dec dword ds:[ebx - 0x367abfc2]
jne 0x4af8ff
loopne 0x4af95c
add al, 0
add byte [ecx + 0x2c4e893e], cl
mov dword [esi + 0x2c], ecx
lea eax, [esi + 0x24]
mov edx, dword [ecx]
adc bh, bh
push edx
mov ecx, dword ds:[esi + 0x2c]
mov eax, dword [ecx]
not byte [eax + 0x14]
or cl, byte [ebp - 0x10]
notrack jmp 0x13106304
jle 0x4af96e
jle 0x4af975
push 0x100
call 0x3e5dbd97
add esp, 4
mov dword [eax], eax
add byte [eax + 4], 8
inc eax
or byte [esi], bh
mov dword [eax + 0xc], ebx
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
push dword [ebp + 0x3e]
call 0x3482a9
test byte [esi + 0x1c], cl
jne 0x4af99e
push ss
mov ecx, ebp
dec dword [ecx + 0xe8d2076]
and al, 0xff
or al, ch
dec eax
add byte [eax], al
add byte [ecx + 0x5b5f1ef0], cl
ret 0xc
Function at 0x4b2e1b
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebx + 0x4493e08], cl
mov dword [eax + ecx + 0x30], ecx
test ecx, ecx
xor al, 5
mov edi, dword [esi]
call dword [eax + 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
sub byte [eax - 0x70], bh
add cl, byte ds:[ecx + 0x14c483e0]
pop esi
pop edi
sbb bl, byte [ebp - 0x3d]
push ebp
push ebp
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0x38
sub esp, 0x3e
mov eax, dword [0x128fc590]
adc al, byte [eax + 0x243c8dce]
or al, 0x3e
stc
xor eax, ebp
mov dword [esp + 0x20], eax
push esi
sub byte [ebx], cl
aad 0x3e
inc dword [eax + 0x600046d]
test byte [ecx], cl
add byte [eax], al
add byte [esi], bh
push es
lea ecx, [esp + 0x18]
add byte [eax + 4], 0xa
inc esp
push es
mov ecx, dword ds:[eax + 4]
mov dword [ebx + 4], ecx
mov eax, dword [ecx]
push eax
add al, 0x3e
dec esp
and al, 4
push 0
loopne 0x4b2df3
mov bh, 0x12
add cl, byte [ebx - 0x7fde0fc2]
adc bh, byte [ecx + 0x12901344]
mov dword [esi + edi + 0x14], edi
call 0xf733fe65
mov ecx, ebx
adc al, ch
inc edx
notrack call 0x860eb88b
sal byte [ebp + 0x3b], 4
dec dword [ecx - 0x72ca8ac2]
dec esp
and al, 0x10
lea eax, [esp + 0x14]
push ecx
notrack call fcn.0041f3a1
add ah, 8
add bh, al
invalid

Function at 0x4c1850
Capabilities:
Access peb ldr_data
Delete file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov dword [0x60cb50], 0x61655264
mov ebx, dword fs:[0x18]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 8]
push 0x104
push 0x60c7c8
mov ecx, dword [eax + 0x30]
push ebx
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0x1c]
mov eax, dword [eax + 8]
mov dword [0x620b68], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x60c7c8
mov dword [0x620bec], 0x73727473
mov byte [0x620bf0], 0x74
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x4c18d0
call fcn.00501ed0
call fcn.004c1980
call fcn.00501ed0
call fcn.004c1980
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x620b68]
push edi
push 0x620bec
push ecx
mov byte [0x620bf1], 0x72
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov edi, 0x60c7c8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [0x60c654], edx
mov esi, ecx
pop edi
dec esi
je 0x4c194b
mov al, 0x5c
cmp byte [esi + 0x60c7c8], al
je 0x4c1916
dec esi
jne 0x4c1909
jmp 0x4c194b
xor eax, eax
mov al, byte [edx + 1]
sub eax, 0x4c
je 0x4c1933
call fcn.005019a0
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [esi + 0x60c7c9]
push ecx
call fcn.00441010
add esp, 4
test eax, eax
jne 0x4c1974
call fcn.00602c70
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
push eax
push ecx
push ebx
mov dword [0x60cb54], 0x72745064
mov dword [0x60cb4c], 0x61427349
call fcn.005428d0
add esp, 0x10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4c36b7
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
lds eax, [ecx]
sbb al, 0xb0
aas
adc al, byte [esi]
inc ecx
add al, 0x3e
add byte [eax], al
add bl, al
push ebp
and ch, 0x53
push ss
push esi
cmp dword [esi], 8
mov eax, dword [0x128fd580]
lea edi, [ebp + 8]
xor eax, ebp
inc ebp
invalid

Function at 0x4f2e53
Capabilities:
Encode data using xor

Disassembly:
and esp, 0xc
mov ecx, dword [eax + esi*8]
xor dword [esi], edi
call 0x26dadc8
xor al, 0x83
add al, 0x14
pop esi
pop ebx
pop ebp
rol byte [eax + eax], 0xc4
push ebp
mov dword [ebx + edx*2], esp
push edi
sub esp, 0
mov edx, dword [ebp + 4]
mov esi, dword [ebp + 8]
mov edi, dword [ecx + 0x3e]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x10], ecx
mov ebx, edx
sub al, bh
sub dword [esi], edi
sar eax, 0
sar ebx, 2
mov dword [ebp + 0x28], eax
cmp ebx, eax
inc ecx
or byte [ecx + 0x5176ec45], cl
cmp dword [edx], 0x403e0000
jno 0x4f2e4d
mov edx, dword [eax + ebp*8]
mov ecx, 0x2dffff3e
mov eax, edx
shr al, 1
sub dword [eax], eax
cmp edx, ecx
pop es
add eax, eax
cmp eax, ebx
push es
inc ebx
fadd dword [edi + edi*8]
invalid
call 0x22d3149
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x128f3e90]
mov dword [ebp + 8], ebx
adc byte [ebp + 0x10], 0x30
call 0x8c3f6cf6
add dword [ebx + 0x7e800470], ecx
or al, 0
je 0x4f2eb5
mov dword [ebp - 0x14], eax
mov edi, eax
loop 0x4f2ec2
mov dword [esp], ecx
mov bh, byte [esi]
or al, 0x8b
add byte [ecx], dh
fild dword [eax + 0x460ae045]
adc byte [esi], bh
idiv dword [ecx]
ror byte [edi], 0x93
les edi, [ecx]
ret 0x920e
test ch, ch
mov dword [esp + ebp*8 + 0x74], esi
xor cl, byte [ebx + 0x458b3e4d]
loopne 0x4f2efe
cmp edi, dword [eax]
je 0x4f2ee2
cmp byte [esp + ebx - 0x77], dh
sbb al, 0x89
mov dword [esp], ecx
or al, 0xe4
lea edi, [esi]
in al, dx
mov esp, ecx
mov ebx, edx
loopne 0x4f2e64
int3
dec edi
xor al, 0xff
lea edi, [esi]
in al, dx
mov eax, ecx
mov al, 1
xor bl, 0x8b
or bl, ch
adc byte [esi], bh
jne 0x4f2ecd
jne 0x4f2ecd
in eax, dx
jne 0x4f2efc
push edx
push edi
push 0
jmp 0x4f2f08
lea esp, [ebp - 0x18]
movzx eax, al
push dword [esp + edx]
call 0xfe512
xor al, 0x14
push edx
push eax
push esi
call fcn.004f2f4d
mov eax, dword [esi]
mov dword [ebx], eax
inc ebx
add al, 1
jmp 0x4f2f37
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
loopne 0x4f2ec5
nop
push ds
add cl, byte [ecx + 0x4c4833e]
pop esi
pop edi
push edx
pop ebp
ret 0x10

Function at 0x4fc1bf
Capabilities:
Packed with generic packer

Disassembly:
mov eax, esi
push esi
pop edi
pop ebp
add al, byte [eax + eax]
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ecx]
or dh, cl
test dword [esi], edi
je 0x4fc23b
mov dword [esi + 4], edi
xor bl, bh
je 0x4fc1ec
lea ecx, [ebx + 0x3e]
call fcn.0054e293
sbb cl, 0xe8
adc al, 0x7e
hlt
mov eax, dword [esi + 0x3e]
sub eax, ebx
pop esi
push esi
Function at 0x5050d7
Capabilities:
Encode data using xor

Disassembly:
add byte [esi], bh
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp + 0x3e], esp
mov esi, ecx
lea edi, [ebp + 8]
mov al, byte [0x120ed590]
xor dword [esi], edi
mov dword [ebp - 0x20], eax
push eax
and esp, 0x1c
lea eax, [eax]
adc byte [ecx - 0x13ba76c2], cl
push 4
loopne 0x5050e5
jae 0x505120
add al, byte [ebx + 0xc7043e]
push eax
pop ebp
push edx
adc cl, byte [ecx + 0x3e8b0c02]
add al, 0x85
ror byte [ecx + 0x4740443], 0x30
inc dword [eax + 0x3e]
mov eax, dword [edi]
pop es
mov dword [ebp - 0x14], ecx
add byte [ebx], 0x31
add byte [ecx + 0x8433e07], cl
mov byte [eax + 0x5b], ah
adc al, dh
inc ebx
adc byte [ecx], al
invalid

Function at 0x51089d
Capabilities:
Encode data using xor

Disassembly:
push ss
mov ebx, 0x4f2fc6b7
inc ebp
je 0x5108f0
mov ecx, 0x8bc061bf
and ecx, 0xffffffc8
cli
call [0xa8ab16e8]
pop ebp
enter 0xfffffffffffffffa, 0x1d
call 0x5df9b3cc
invalid
sub al, 0x39
clc
mov bl, 0x9b
mov cl, 0xaa
ret
push cs
jp 0x5108ad
dec ecx
movsd dword es:[edi], dword [esi]
vandnpd xmm3, xmm2, xmmword [esi]
test al, 0x5e
jl 0x51096e
jge 0x5108de
dec edi
pop ds
out 0x7a, al
ret 0xdec0
in al, 0x4a
dec edx
xor al, 0x75
outsb dx, byte [esi]
sub eax, 0x5ee18e77
mov ah, byte [esi]
dec esi
xor al, 0x6f
adc dword [ecx + 0x5e], edi
imul ebp, esp, 0xf
xlatb
sal dword [ebp - 0x22c9a3bf], cl
inc esp
stosb byte es:[di], al
invalid
outsd dx, dword [esi]
sbb al, 0x11
js 0x51092f
int 0x66
push ds
push ds
enter 0xffffffffffffc263, 0x5f
or al, 0x72
out dx, al
push edx
add cl, bh
rol dl, 0x88
and eax, dword [edi - 0x29]
dec ebx
arpl sp, bx
jecxz 0x510961
push 0xffffffffffffff8d
inc edi
or byte [esi], bh
adc al, 0x41
psrlq mm5, qword [0xa9f53301]
mov edi, 0xa1818e08
xchg edi, eax
xor esp, esp
mov edi, 0xbd9a1509
xchg esp, eax
aam 0xcd
clc
fldenv [edi]
adc dword [ecx + eax + 0x5213ae17], edi
xchg dword [ebx + 0x41285db5], ebp
loop 0x51092e
adc edx, dword [edx - 0x79]
stosd dword es:[edi], eax
mov ch, 0x5d
sub byte [ecx - 0x1e], al
test dword [ecx + 0x5b], ebx
pop ecx
pop ebx
sbb dword [esi + 0x30bf3493], 0xfffffff5
test edi, edx
xor byte [ebx + 0xe], bl
pop es
mov ebp, 0x727ec963
xor al, 0x3a
mov bl, 0xdc
push edx
sbb eax, 0xfa967cd0
jl 0x51095c
cli
xor byte [eax], 0x88
mov dh, byte [ebp - 0x44]
mov ebx, 0xb90f8724
sti
cmp ecx, esi
jnp 0x510a50
inc edi
mov cl, 0xb4
cmp esi, edi
jp 0x5109c4
mov byte [0xc8215de6], al
jg 0x5109f8
jmp 0x51099f
mov eax, 0xe77a51c5
mov ah, 0xe0
add ebp, dword [edi]
xchg esi, eax
push ds
neg byte [esi - 0x10f400dd]
push edi
aam 0x33
insb byte es:[edi], dx
jbe 0x5109b8
wait
push esi
je 0x510a66
fild word [eax + 0x449b00ce]
adc eax, 0xfb3dbb0f
mov ebx, 0x2dcab110
and ebx, dword [edi]
xchg edx, eax
leave
sbb edi, dword [eax + 0x34]
pop ebp
in al, dx
pop ebp
dec edi
das
sbb eax, 0xdf573409
in eax, dx
mov ch, 0x36
ret
sal byte [ebx + edx], 0xf5
jae 0x5109e6
arpl word [edx], si
inc ebx
push ss
pop dword [ebx + 0x66dea6ce]
aam 0xc7
xor al, 0x42
lodsd eax, dword [esi]
repz ret
repz ret
Function at 0x529af7
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ebp
sub byte [edx + ebp], ch
add cl, byte ds:[ebp + 0x565ef465]
pop ebx
pop ebp
add cl, byte [eax]
add byte [esi], bh
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov dword [ebp + 0x3e], esp
mov esi, ecx
lea edi, [ebp + 8]
mov al, byte [0x120ed590]
xor dword [esi], edi
mov dword [ebp - 0x20], eax
push eax
and esp, 0x1c
lea eax, [eax]
adc byte [ecx - 0x13ba76c2], cl
push 4
loopne 0x529ae5
sub dword [edx], ebx

Function at 0x541ee0
Capabilities:
Clear file content
Compare security identifiers
Create directory
Delete directory
Delete registry value
Get common file path
Get disk size
Get file attributes
Get graphical window text
Query or enumerate registry value
Resume thread
Set file attributes
Terminate thread

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RaiseException]
Function at 0x582ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push esi
mov edx, dword [ecx + 0x3c]
push edi
mov dword [esp + 0x10], 0
mov eax, dword [edx + ecx + 0x78]
mov edx, dword [edx + ecx + 0x7c]
mov dword [esp + 0x20], edx
mov edx, dword [eax + ecx + 0x1c]
add edx, ecx
mov dword [esp + 0x1c], edx
mov edx, dword [eax + ecx + 0x24]
add edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [eax + ecx + 0x20]
mov eax, dword [eax + ecx + 0x14]
add edx, ecx
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x582b85
mov edi, dword [esp + 0x2c]
mov ebx, edx
mov al, byte [edi]
mov byte [esp + 0x28], al
mov edx, dword [ebx]
mov al, byte [esp + 0x28]
mov esi, ecx
xor ebp, ebp
add esi, edx
mov dl, byte [esi]
cmp dl, al
jne 0x582b65
mov eax, edi
mov edi, esi
sub edi, dword [esp + 0x2c]
test dl, dl
je 0x582b61
cmp byte [eax], 0
je 0x582b61
mov dl, byte [edi + eax + 1]
inc ebp
inc eax
cmp dl, byte [eax]
je 0x582b4e
mov edi, dword [esp + 0x2c]
cmp byte [esi + ebp], 0
jne 0x582b71
cmp byte [edi + ebp], 0
je 0x582b91
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x582b34
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 8
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
xor edx, edx
pop edi
mov dx, word [eax + esi*2]
mov eax, dword [esp + 0x18]
pop esi
pop ebp
mov eax, dword [eax + edx*4]
pop ebx
add eax, ecx
add esp, 0x14
ret 8

Function at 0x582bc0
Capabilities:
Parse pe header

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
and esi, 0xffff0000
push edi
add esi, 0x1000
sub esi, 0x1000
push 2
push esi
call ebx
test eax, eax
jne 0x582c09
cmp word [esi], 0x5a4d
jne 0x582c09
mov edi, dword [esi + 0x3c]
push 0x100
add edi, esi
push edi
call ebx
test eax, eax
jne 0x582c09
cmp word [edi], 0x4550
je 0x582c11
cmp esi, 0x400000
ja 0x582bdb
push str.CreateToolhelp32Snapshot
push esi
invalid
invalid
invalid
invalid
Function at 0x5a197f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [0x128f3e90]
mov dword [ebp + 8], esi
test byte [ebp - 0x28], bl
or bh, cl
mov dword [esi], edi
xor eax, ebp
mov dword [ebp - 0x10], eax
loopne 0x5a1976
shl byte [esi], cl
dec dword [ebx + 0x18b043e]
call dword [eax + 4]
movzx eax, byte [eax]
mov ecx, edi
push eax
push esi
call 0x5a197f
mov dword [eax], ebx
call 0x4057d9
mov dword [ebp - 0x10], ecx
xor cl, ch
call 0x3e69d297
mov eax, esi
add esp, 0x5b5f561c
les ebx, [esi + edx*2]
pop edi
pop ebx
sbb al, 0xc2
add al, 0x3e
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3e00001c
mov dword [ebp - 0x90000b4], ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x128f3e90]
and eax, ebp
mov dword [eax + esi*8 + 0x57], eax
sub byte [esi], bh
inc edi
inc dword ds:[ebx + 0x548d04c4]
fdiv dword [ecx]
add byte [ecx + 0x14433ed9], cl
or eax, 0xc7000000
inc ebx
adc byte [eax], al
add byte [esi], bh
add byte [eax + 0x60046a01], cl
loopne 0x5a1a08
xor dl, byte [edx]
call 0xee408e08
mov eax, dword [edi]
xor cl, cl
cmp byte [eax], cl
lea esi, [eax + 0x3e]
je 0x5a1a11
sub esi, ebx
je 0x5a1a3d
mov ecx, esi
sub byte [edi + 0x39], ah
push edx
or eax, 0xf2e04510
movups xmm0, xmmword [esi + 0x10]
movups xmm0, xmmword ds:[ebp - 0x28]
push es
adc byte [ebp + 0x20], cl
invalid
add byte [eax], al
add byte [esi], al
inc ebp
fdivr dword [esi]
jmp 0x5a1a45
mov dword [eax + 0x14], ecx
or byte [eax + 0x18], 0x32
movups xmm7, xmmword [esi]
call 0x466b2812
adc dl, dh
movups xmm0, xmmword [ebp - 0x28]
movups xmm1, xmmword ds:[ebp - 0x20]
push es
adc dword [esi + 8], ecx
invalid
add byte [esi], bh
inc ebp
fadd dword [eax]
mov byte [eax], 0
lea ebx, [ebp + 0x18]
mov ecx, ebx
clc
cmp ah, ah
dec dword [ebx + 0x3eff5c84]
call dword [ebx + 0x3e]
pushal
add eax, dword [eax]
add byte [ebx + 0x34788006], cl
add byte [ebp + 0x2d74383e], cl
cmp esi, ebx
sbb byte [ebp + 0x10], 0x34
outsb dx, byte [esi]
mov dword [esi], edi
call fcn.00404347
movsd xmm0, qword [eax + ebp*8]
adc dword ds:[esi], eax
adc dword [esi], eax
movsd xmm0, qword [ebp - 0x28]
xor cl, byte [edi]
adc byte [esi], bh
loopne 0x5a1a7b
or eax, 0xf2004e11
movups xmm0, xmmword [esi]
invalid

Function at 0x5a7f97
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
sub ah, 0x14
or cl, byte [0x128f3e90]
mov dword [ebp + 8], eax
xor cl, ch
mov dword [esp + esi*8], ecx
mov edi, dword [esi]
adc byte [ebx + 0x760f1468], al
add cl, byte [ebx + 0x3ed23100]
jne 0x5a7fa5
inc eax
push 0
push edx
push edx
push 0x3e316a22
push ecx
push eax
inc esp
call fcn.0044b049
add al, ah
sbb al, 0x3e
push es
mov ecx, dword [esp + eax - 0x46]
adc byte [eax], al
add byte [eax], al
sub ecx, eax
sal dword ds:[ebp + 0x24], 1
mov esi, dword [ebp + 4]
mov ecx, esi
adc al, ch
add byte [esi], bh
cld
inc dword [eax + eax*8 + 0x458b2674]
sub byte [ebp - 0x3f7cc1b3], cl
or byte [edx], ch
push eax
push eax
call 0x3e5a803d
add esp, 0xc
test al, al
je 0x5a8018
invalid
xor ebx, ebx
dec ebp
call 0xe1461a09
dec dword [ebx + 0x3e31f40c]
call 0x269c098
sbb al, 0x83
add al, 0x14
pop esi
pop ebp
ret