joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dc80
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43dcb3
push esi
call fcn.00440d90
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43dcac
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43dd39
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43dd22
mov eax, dword [esi + 8]
test eax, eax
je 0x43dcd7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43dd1e
cmp eax, 2
je 0x43dd22
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43dcca
cmp eax, 3
je 0x43dcfd
cmp eax, 1
jne 0x43dcca
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43dcca
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43dcca
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043dd60
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43dd48
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043dd60
add esp, 4
pop esi
ret

Function at 0x45c568
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45c5a0
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045a61c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045a5f4
jmp 0x45c5ac
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45dc56
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45dc98
call fcn.0046370a
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45dc98
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45dc8f
xor eax, eax
jmp 0x45dca0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045dca6
pop edi
pop esi
pop ebx
ret 4

Function at 0x463c3a
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x463c68
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x463c86
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00463ba0
jmp 0x463c86
mov eax, dword [esi + 0x14]
test eax, eax
je 0x463c86
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00463ba0
test edi, edi
mov eax, edi
jne 0x463c70
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x40a004]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [str._wizard]
mov ecx, dword [0x409270]
mov dl, byte [0x409274]
push esi
mov esi, dword [esp + 0x118]
push edi
push 0xfb
mov dword [esp + 0xc], eax
lea eax, [esp + 0x15]
push 0
push eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0x1c], dl
call fcn.00405410
mov eax, esi
add esp, 0xc
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401052
lea edi, [esp + 8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401060
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 1
mov ecx, eax
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push str.MacTray.exe
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.004010a7
add esp, 0x108
ret 0x10

Function at 0x4010a7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a004]
jne 0x4010b1
repz ret
jmp fcn.00401267

Function at 0x403333
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402215
and dword [ebp - 4], 0
cmp dword [0x40b568], 0
mov ebx, eax
jne 0x4033e4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x403495
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x403495
push eax
call fcn.004021a3
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b568], eax
call esi
push eax
call fcn.004021a3
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b56c], eax
call esi
push eax
call fcn.004021a3
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b570], eax
call esi
push eax
call fcn.004021a3
pop ecx
mov dword [0x40b578], eax
test eax, eax
je 0x4033e4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021a3
pop ecx
mov dword [0x40b574], eax
mov eax, dword [0x40b574]
cmp eax, ebx
je 0x40343c
cmp dword [0x40b578], ebx
je 0x40343c
push eax
call fcn.0040221e
push dword [0x40b578]
mov esi, eax
call fcn.0040221e
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40343c
test edi, edi
je 0x40343c
call esi
test eax, eax
je 0x403433
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403433
test byte [ebp - 0xc], 1
jne 0x40343c
or dword [ebp + 0x10], 0x200000
jmp 0x403475
mov eax, dword [0x40b56c]
cmp eax, ebx
je 0x403475
push eax
call fcn.0040221e
pop ecx
test eax, eax
je 0x403475
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403475
mov eax, dword [0x40b570]
cmp eax, ebx
je 0x403475
push eax
call fcn.0040221e
pop ecx
test eax, eax
je 0x403475
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b568]
call fcn.0040221e
pop ecx
test eax, eax
je 0x403495
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x403497
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7214a7
Capabilities:
Encode data using xor

Disassembly:
lea eax, [eax + 1]
pop esi
pushal
mov word [esp + 0xc], bp
pushfd
mov dword [esp + 0x34], eax
lahf
pushfd
seto al
cwde
mov eax, 0x411e12
pop esi
mov eax, dword [eax + 0x65466]
mov dword [esp], 0xae88001f
movzx si, bl
call fcn.0073a253
or dword [eax], ebx
push dword [eax]
sahf
pop es
invalid

Function at 0x72deac
Capabilities:
Encode data using xor

Disassembly:
mov byte [esp], al
mov eax, dword [eax + 0x76d1f]
call 0x9278aa
jge 0x72df29
xchg edi, eax
push es
cmpsd dword [esi], dword es:[edi]
nop
push ebp
adc dword [ebx - 0x1b], 0x5ff05169
dec esp
outsb dx, byte [esi]
cmp byte [esi + 0x2c0231b7], bh
mov dl, 0x1e
inc ecx
inc esi
jl 0x72df0e
dec esi
and bh, ah
add eax, 0x7427b2b2
inc ebx
salc
push edx
push ebx
stosb byte es:[edi], al
arpl word [ecx - 0x48], ax
invalid
jmp 0x7fbbf040
jg 0x72df63
mov esp, 0x45b9ec40
mov dword [edi - 0x4d], 0x2a942804
jnp 0x72df07
popfd
adc al, 0x2b
cmpsd dword [esi], dword es:[edi]
xor al, 0xab
jo 0x72df41
pop eax
xor eax, 0xc1e52a4d
in eax, 0xc1
pop ebx
insb byte es:[edi], dx
in al, dx
js 0x72df1f
cmc
outsb dx, byte [esi]
cmp bl, byte [ebp + 0x55]
rol byte [esi], 1
cmp ebp, dword [eax]
lds esi, [ecx + edi*2 - 0x4d]
cmp byte [ebx + 0x37], cl
sbb al, 8
adc al, 1
inc edx
dec esi
lcall 0xe2a2, 0x66885278
mov esp, 0x298d08df
push edx
mov byte [esi - 0x5e], ah
loop 0x72df03
fisttp word [eax]
lea ebp, [ecx]
wait
pop edi
imul esi, eax, 0x1bc52b92
lds eax, [esi - 0x6279f6f7]
cwde
ja 0x72dfd8
xor bh, byte [ebx + 0x284e8cbb]
pop esi
arpl dx, sp
daa
lodsd eax, dword [esi]
pop ds
js 0x72df23
sbb dword [esi - 0x33], edi
retf
add byte [edi - 0x7317dbfc], al
mov bh, 0xd
invalid
Function at 0x7f99e4
Capabilities:
Encode data using xor

Disassembly:
inc ecx
int1
cmp al, 0xe9
and eax, 0xffffee9d
xor al, 0x24
jbe 0x7f9979
bnd jmp dword [eax + 0x68]
insb byte es:[edi], dx
and al, 0x28
call fcn.0070f615
out dx, al
xor dl, dl
sal dword [ebx + 0x53bed590], 0x3e
or al, 0xed
sub byte ds:[eax], ah
jnp 0x7f99d0
and al, 0x96
pop ss
jg 0x7f9a0f
clc
mov ecx, 0xea8ecb05
inc ebx
inc ebx
add byte [eax], ah
xlatb
cwde
imul esi, ecx, 0x335ef89e
and eax, 0xe1e7b61b
clc
pop esi
xor esp, dword [0xe1e7b61b]
pushal
jno 0x7f99db
leave
sub eax, dword [0x8aae8686]
cdq
and ebx, esi
dec eax
xor al, 0x91
insb byte es:[edi], dx
jae 0x7f9a9b
cwde
jb 0x7f9aa4
and byte [eax], bh
test al, bh
clc
sub cl, byte [edi + 0x4d]
xor dword [esi - 0x2c], ebx
dec esp
jg 0x7f9a30
or ch, byte [ecx + 0x558fe5b8]
sub eax, 0xe137d171
add al, ch
dec ecx
mov ebx, 0xeffcec26
xchg edi, eax
add cl, byte [edi]
mov bl, 0xf3
and byte [0x4e9a8ef4], dl
clc
dec ecx
xchg ebp, eax
pop ds
cmp dh, 0x7f
mov edx, ds
invalid
test byte [eax - 0xf], ah
jb 0x7f9a87
xor ecx, dword [edi]
salc
add eax, 0x53e0170c
push ds
push eax
js 0x7f9a64
iretd
in al, 0xbd
rcr byte [ecx + edx*4], 0xcc
test byte [ecx], bl
or dword [eax], eax
je 0x7f9add
add byte [ebx + edx*2 - 0x29], dh
xlatb
xlatb
js 0x7f9a90
dec edi
xor eax, 0x750e7af1
das
int1
jp 0x7f9aa1
jne 0x7f9ac4
add edx, edi
sub byte [esi + 0x7099ffa7], 0xd6
cdq
jo 0x7f9a74
xchg edi, eax
push edi
xor byte [edx - 0x72], dh
lea edi, [edx]
lahf
xor al, 0x93
push edi
lds edx, [eax]
xchg ebx, eax
aaa
ja 0x7f9b14
pop ecx
loope 0x7f9a7e
jge 0x7f9ac1
sbb dword [edi - 0x30], ebx
adc eax, 0x9a5d9f81
add eax, 0x2c1c444
inc ebx
les edx, [esi - 0x39d7cbc1]
invalid
add al, byte [ebx - 0x3c]
xchg esi, eax
aas
xor al, 0x28
invalid
push 0x9b6d0a01
daa
adc eax, 0xe4a27557
sub al, 8
or ebx, dword [ebx - 0x6d]
and edi, dword [eax + 0x3e]
int3
push cs
call 0x4d37b607
mov eax, 0x9d546fa6
stosb byte es:[edi], al
daa
loope 0x7f9ab5
adc esi, ecx
neg byte [eax - 5]
pop ss
aam 0x19
out 0xfd, al
loopne 0x7f9b8b
inc edx
mov edi, 0xc0a2dca
push ebx
sub byte [edi], ah
int 0x84
lodsb al, byte [esi]
mov fs, edi
and dword [ebx + 1], edi
invalid
sub cl, dl
mov al, byte [0xe354082e]
or esp, ebp
loopne 0x7f9be1
push ebx
xchg ebx, eax
fmul dword [ebp + edx*2 + 0xac9dc8]
pop esp
imul esi, ecx, 0xa78a1731
idiv dword [ebp + 0x1dfc6267]
stc
mov dl, byte [esi + edx*2]
and al, 0xc0
das
adc bh, byte [ebp + ebp - 0x8e236d8]
add eax, ebx
adc ah, bl
mov esi, 0xa07bda0a
test dword [ebx], 0xbee312c3
or bl, dl
jnp 0x7f9b35
add dword [esi], edi
sub edi, dword [ebp - 0x25323b34]
jle 0x7f9b5d
retf
adc dword [ebx - 0x7e], edi
push ebp
stosb byte es:[edi], al
daa
dec edx
iretd
Function at 0x8028d4
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [edi + 0x4a48a]
jmp 0x73e430
jmp 0x7f0de0
lea edi, [edi + 0x4f03763b]
jmp 0x736701
pushfd
push eax
xchg dword [esp + 0x28], edi
mov byte [esp], cl
push 0x5f04bf9f
mov byte [esp + 0xc], 0x78
push dword [esp + 0x2c]
ret 0x30
mov gs, word [ecx - 0x63ffef6d]
pushfd
lea esp, [esp + 8]
jmp 0x866142
dec dword [ecx + 0x6820245c]
in eax, 0x53
pop ds
sbb al, 0xff
je 0x8028f4
and al, 0xc2
sub byte [eax], al
lea edi, [edi + 1]
pushal
call fcn.00735a19
xchg esi, eax
das
aad 0x50
mov ah, 0x90
jecxz 0x8028a5
push cs
push edx
fstp qword [esi]
or eax, 0x246887e1
faddp st(7)
cmpsb byte [esi], byte es:[edi]
jnp 0x8028c3
wait
xchg esp, eax
out dx, al
pop es
mov dword [eax - 0x7f], ebp
xchg esi, eax
salc
sub ecx, 0xffffffac
sar byte [ebp + 0x4cd349bd], cl
cld
std
cdq
rcr dword [esp + ebp], 1
jne 0x802950
mov eax, dword [0x9f258489]
imul edx, dword [ebp - 0x4f6325fa], 0xbc11279
ret
sbb byte [esi], 0x20
int1
aam 0x7e
sbb al, byte [eax + 0x3c]
stc
pop esp
xor edi, edi
jle 0x8029b7
imul ebp, ebx, 0x40ab84ca
insd dword es:[edi], dx
pop ebp
js 0x802947
jle 0x8093d2
cmp eax, dword [ecx]
pop edi
stosb byte es:[edi], al
ret
push 0x830dc4a1
mov byte [esp], 0x42
mov byte [esp + 4], 0xc7
mov dword [esp + 0x20], edi
pop edi
bswap di
pop edi
mov edi, 0x432e10
lea esp, [esp + 0x18]
jns 0x6e63d4
pushfd
pushal
mov edi, dword [edi + 0x4a48a]
pushal
pushfd
mov byte [esp], dl
lea edi, [edi + 0x4f03763b]
mov word [esp + 0x18], 0x3834
mov byte [esp], 0x9b
pushfd
xchg dword [esp + 0x4c], edi
mov word [esp + 4], si
push dword [esp + 0x4c]
ret 0x50
and eax, 0xdc34fee
cmpsd dword [esi], dword es:[edi]
mov bh, 0xa
jp 0x809424
xor byte [ecx - 0x4ca3945b], al
cmp edi, dword [ebx + 0x5b5d2073]
test byte [ebx + 0x6c], 0x44
pop edx
lcall 0xf474, 0x78579118
inc ebx
xchg byte [eax + 0x6cad1fd6], dl
movsb byte es:[edi], byte ds:[esi]
xor dword [ebp + ebp*2 + 0x239976e9], ecx
or dword [ecx - 0x70040815], edi
mov esp, 0xb24c808b
pop es
add byte [ebp + ecx*4 + 0x3535e980], bl
push es
test bx, 0x2716
not al
setle ah
bswap ax
mov eax, dword [edi + ebx*8 + 4]
clc
test eax, eax
call 0x91a24b
mov edi, dword [esp + 0xc]
bswap ebx
pushal
pop ebx
movzx ebx, al
mov ebx, dword [esp + 0x2c]
jmp fcn.00869a17
Function at 0x80856c
Capabilities:
Encode data using xor

Disassembly:
pushal
xchg dword [esp + 0x30], edi
push edx
xchg dword [esp + 0x30], edi
movzx di, bl
mov edi, 0x42703f
mov word [esp], ax
push 0xfcb53e1c
mov edi, dword [edi + 0x12a659]
mov byte [esp + 4], 0xde
lea edi, [edi + 0x9553247]
call fcn.00884582
fst dword [ecx - 0x6f4b528d]
xor al, 0x5d
cmp esi, dword [ebp - 0x3278a188]
jle 0x808576
bound edx, qword [ebx + edx*4 - 0x79b9822c]
xchg byte [ecx + 0x7b], ah
sbb ebx, esp
jae 0x808636
mov ss, word [edi - 0x30b2ba23]
nop
outsd dx, dword [esi]
invalid
fstp qword [ebp - 0x58]
add byte [ebp + 0x69], ah
in al, dx
inc eax
jle 0x808620
dec esi
jge 0x80866d
mov bl, 0xb8
inc ebp
lcall 0x4c47, 0x6d8cca22
mov dword [edi], ebx
add eax, 0xb6c9d5fc
sub byte [edx], 0xea
sahf
sub dword [edi + ebp], eax
push ds
or al, 0xb4
mov edx, 0x7e54496f
sub ebx, edx
xchg ebx, eax
invalid
mov ebx, 0xddc33d88
lodsd eax, dword [esi]
inc ebp
in al, dx
hlt
adc byte [edi + 0x534b9acc], bl
je 0x808649
cmp dword cs:[eax], ecx
lahf
or al, 0x6d
shr ah, cl
mul dword [ecx - 0x71]
js 0x8085ea
into
wait
push esi
jne 0x8086ad
ficom dword [edi - 0x1b85423c]
add eax, 0x979eb21a
popfd
pop ecx
cmp dword fs:[esi + 0xe5bf085], 0xe5423ced
jp 0x8086aa
wait
push esi
add edi, dword [ebp + eax*8 - 0x3ec53987]
inc ecx
enter 0xffffffffffffc0b3, 0xffffffffffffffab
mov esp, 0x3ac679c5
rol dword [ecx - 0x38], 0xb3
shr byte [ebx + 0x2a419861], 0x78
add ebx, dword [ebp + 0x44]
stosd dword es:[edi], eax
popal
cwde
inc ecx
sub bh, byte [eax + 3]
pop ebp
inc esp
out dx, al
sbb dh, byte [ecx + 0x26]
mov edi, 0x23b91236
xor al, 0xf6
imul edi, dword [ebx], 0xffffffe9
inc esp
in al, 9
imul edi, dword [ecx + eax], 0x73
call 0xa6cf2117
inc eax
push cs
mov dword [0xb7af4364], eax
fstp dword [edi + ebx*2 + 0x4d51cead]
or byte [ebx + ebx*2 + 0x49], 0xcf
pop ebx
dec ecx
iretd
mov byte [ecx + 0x26477145], dl
mov bh, 0x91
sub eax, 0x8a0ef098
aad 0x61
sahf
mov es, word [esi]
loop 0x808689
dec ebp
adc eax, 0x96164cf2
pushfd
adc dword [ecx + 0x351ee28], 0xffffffdc
wait
push ds
out dx, eax
jbe 0x808677
push esp
invalid

Function at 0x883679
Capabilities:
Execute anti-debugging instructions

Disassembly:
cdq
movsx ecx, cl
movsx cx, al
rdtsc
mov ecx, dword [ebp + 0x10]
rdtsc
bswap dx
mov edx, dword [ebp + 0xc]
jmp 0x864934
mov dword [esp + 0x40], ecx
call fcn.007ee19b
lea eax, [ebp - 8]
pushal
mov dword [esp + 0x1c], eax
lea eax, [0xd92cb6b0]
lahf
mov eax, dword [ebp + 8]
pushal
jmp 0x90fb98
bswap ax
setb ah
mov eax, dword [ebp + 8]
pushal
pushal
push edi
pushfd
mov dword [esp + 0x44], ecx
pushfd
call fcn.007113ed
pushfd
mov byte [esp], 0x50
lea esp, [esp + 0xc]
jne 0x8f73d1
mov ah, bl
jmp 0x8033ee
pushal
pushal
jmp 0x74b4b6
movzx ax, al
jb 0x7420da
setp ch
mov ecx, dword [ebp + 0x10]
movsx ax, al
mov dl, ah
mov edx, dword [ebp + 0xc]
movsx ax, cl
lahf
movsx ax, bl
pushfd
mov eax, dword [ebp + 8]
jmp 0x88b8ba
Function at 0x893b4b
Capabilities:
Encode data using xor

Disassembly:
cwde
mov edx, dword [ebp + 0xc]
movzx ax, dl
bswap ax
mov eax, dword [ebp + 0x10]
pushfd
pushfd
mov dword [esp + 4], 0
push 0x2035addc
push dword [esp + 4]
pushal
push 0xb7aae1f9
mov dword [esp + 0x2c], edx
jmp 0x830776
pushfd
push edx
lea esp, [esp + 0x48]
je 0x7e8316
bswap dx
cdq
jmp 0x6e77d0
lea eax, [eax + 1]
mov byte [esp], 0x6c
mov byte [esp + 0x14], cl
mov dword [esp + 0x48], eax
lea esp, [esp + 0x44]
jle 0x91e561
mov eax, 0x421641
pushal
jmp 0x80848a
bts bp, 6
sub eax, eax
pushal
pushfd
mov ebp, dword [esp + 0x24]
pushfd
push ecx
pushfd
push dword [esp + 0x34]
ret 0x44
mov eax, dword [eax + 0x320ea]
push 0xb015050e
lea eax, [eax - 0x2231c7b9]
pushfd
call fcn.00749970
jmp 0x720950
mov word [esp], 0x8bfe
mov word [esp], 0xe396
call fcn.008697df
mov byte [esp], bl
jmp 0x7e7903
jmp 0x8f1dad
mov dx, sp
bswap dx
nop
pushfd
mov byte [esp], al
bswap dx
mov edx, dword [esp + 4]
call fcn.008610d2
and ebx, dword [eax]
xor byte [eax + 0x35], ah
jnp 0x893b59
fdivr st(0), st(0)
popal
mov eax, 0xef81c768
loope 0x893b28
pop esp
test eax, 0x82179c41
stc
fsub qword [ecx - 0x61a3c4d6]
and byte [ebx + ebp], ah
cmp byte [eax - 0x80], dl
ficomp word [edx + 0x4ea0fc10]
aaa
sti
sub byte [esi + 0x64], cl
iretd
not ax
mov eax, dword [esp + 0x44]
pushfd
jmp 0x886227
Function at 0x404257
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call 0x40427c
pop dword fs:[0]
pop eax
popal
call fcn.0040465d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x404299
push 0
call fcn.00406f44
add esp, 4
push 0x80000004
push 0
lea eax, [ebp - 4]
push eax
push 1
mov ebx, 0x4040a0
call fcn.00406f3e
add esp, 0x10
mov ebx, dword [ebp - 4]
call fcn.00404127
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
je 0x40436c
push 0xa0000101
push 0
push 0x467684
push 1
mov ebx, 0x404c00
call fcn.00406f3e
add esp, 0x10
mov dword [ebp - 8], eax
push 0x467696
push dword [ebp - 8]
mov ecx, 2
call fcn.004041ab
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404314
push ebx
call fcn.00406f26
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x404327
mov eax, 0x46769e
push eax
push 0x80000301
push 0
push 0
push 0x80000004
push 0
push 0x46769f
push 3
mov ebx, 0x404ed0
call fcn.00406f3e
add esp, 0x28
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x404362
push ebx
call fcn.00406f26
add esp, 4
mov eax, 0
jmp 0x4044a2
mov ebx, dword [ebp - 4]
call fcn.00404207
mov eax, 0
cmp eax, ecx
jl 0x40438a
push 1
call fcn.00406f32
add esp, 4
shl eax, 2
add ebx, eax
mov dword [ebp - 8], ebx
push 0x80000004
push 0
mov ebx, dword [ebp - 8]
mov eax, dword [ebx]
test eax, eax
jne 0x4043a7
mov eax, 0x46769e
push eax
push 1
mov ebx, 0x404510
call fcn.00406f3e
add esp, 0x10
mov dword [0x4860e0], eax
cmp dword [0x4860e0], 0
jne 0x4043db
call fcn.00406263
mov eax, 0
jmp 0x4044a2
call fcn.004063c0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40448e
push 0xa0000101
push 0
push 0x467684
push 1
mov ebx, 0x404c00
call fcn.00406f3e
add esp, 0x10
mov dword [ebp - 8], eax
push 0x467696
push dword [ebp - 8]
mov ecx, 2
call fcn.004041ab
add esp, 8
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x404436
push ebx
call fcn.00406f26
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x404449
mov eax, 0x46769e
push eax
push 0x80000301
push 0
push 0
push 0x80000004
push 0
push 0x4676b2
push 3
mov ebx, 0x404ed0
call fcn.00406f3e
add esp, 0x28
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x404484
push ebx
call fcn.00406f26
add esp, 4
mov eax, 0
jmp 0x4044a2
call fcn.004067ee
call fcn.00406ae1
mov eax, 0
jmp 0x4044a2
push eax
mov ebx, dword [ebp - 4]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x4044c1
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x4044bd
imul eax, dword [ebx]
jmp 0x4044b2
mov ecx, eax
test ecx, ecx
je 0x4044e0
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x4044d9
push ebx
push eax
call fcn.00406f26
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x4044c7
call fcn.00406f26
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x415cd3
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x463078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.00410bf3
test eax, eax
jne 0x415d3f
push ebp
push 0x47befc
mov ecx, edi
call fcn.00414f53
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.00410773
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.00408323
push ebx
mov dword [esp + 0x4c], ebp
call fcn.00410da3
add esp, 4
test eax, eax
je 0x415de2
add esi, 0x18
push esi
call fcn.00408d73
add esi, eax
push esi
call fcn.00408d73
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x4160e5
jmp dword [ecx*4 + 0x413000]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.00415093
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.00408d73
add esi, eax
push esi
call fcn.00408d73
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x415e33
mov ecx, dword [esi + 0x1c]
push ecx
call dword [fcn.004663f0]
test eax, eax
je 0x415e33
mov eax, 1
jmp 0x415e35
xor eax, eax
cmp ebx, 8
jge 0x41609a
cmp ebx, 7
ja 0x4160e5
jmp dword [ebx*4 + 0x413010]
test eax, eax
jne 0x4160ad
mov ecx, dword [esp + 0x10]
push eax
push 0x47bee8
call fcn.00414f53
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.004165f3
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x46a0f8
call fcn.00408523
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x419b03
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4927a0]
xor edx, edx
cmp eax, edx
jne 0x419b29
xor eax, eax
mov byte [eax + 0x4926a0], al
inc eax
cmp eax, 0x100
jl 0x419b11
mov dword [0x4927a0], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4926a0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x419bba
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x419b8d
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x419b5b
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419c33
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x419c86
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x419c6d
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret