joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453e40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.sect_1
lea edi, [esi - 0x50000]
push edi
or ebp, 0xffffffff
jmp 0x453e62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x453e69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e58
mov eax, 1
add ebx, ebx
jne 0x453e7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x453e8c
jne 0x453eab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453eab
dec eax
add ebx, ebx
jne 0x453e98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x453e70
add ebx, ebx
jne 0x453ea7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x453efd
xor ecx, ecx
sub eax, 3
jb 0x453ec3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x453f32
sar eax, 1
mov ebp, eax
jmp 0x453ece
add ebx, ebx
jne 0x453ece
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e9c
inc ecx
add ebx, ebx
jne 0x453edc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x453e9c
add ebx, ebx
jne 0x453ee9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x453ede
jne 0x453efa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x453ede
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x453f1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x453f0e
jmp 0x453e5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x453f1c
add edi, ecx
jmp 0x453e5e
pop esi
mov edi, esi
mov ecx, 0x90
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x453f3a
cmp byte [edi], 3
jne 0x453f3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x453f3f
lea edi, [esi + 0x51000]
mov eax, dword [edi]
or eax, eax
je 0x453fae
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9b7e4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9b834]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x453f6c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9b838]
or eax, eax
je 0x453fa8
mov dword [ebx], eax
add ebx, 4
jmp 0x453f89
call dword [esi + 0x9b840]
mov ebp, dword [esi + 0x9b83c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x453fe2
sub esp, 0xffffff80
jmp 0x4015c9
Function at 0x49e1b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x403ad9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
mov edx, dword [0x4040b4]
push ebx
xor ebx, ebx
mov cl, byte [eax]
mov dword [esp + 0xc], ebx
mov byte [esp + 8], cl
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [edx]
push esi
push ecx
push ebx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], ebx
call dword [fcn.004040b0]
mov edx, dword [0x4040b4]
mov cl, byte [0x404209]
push 1
mov byte [esp + 0x34], cl
mov eax, dword [edx]
lea edx, [esp + 0x34]
push eax
push edx
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], ebx
call dword [fcn.004040ac]
mov ecx, dword [0x4040b4]
cmp eax, dword [ecx]
je 0x49e240
mov esi, dword [esp + 0x2c]
push eax
push ebx
push esi
lea ecx, [esp + 0x18]
call dword [fcn.004040a8]
jmp 0x49e269
mov esi, dword [esp + 0x2c]
mov dl, byte [esp + 0xc]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x4040b4]
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push ecx
push ebx
push edx
mov ecx, esi
call dword [fcn.004040b0]
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x49e29e
mov al, byte [ecx - 1]
cmp al, bl
je 0x49e294
cmp al, 0xff
je 0x49e294
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.004a0110
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x49e2c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x403af9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push ebx
lea ecx, [esp + 0x10]
mov al, byte [esi]
mov dword [esp + 0xc], ebx
mov byte [esp + 0x10], al
call dword [fcn.004040a0]
mov ecx, dword [0x4040b4]
mov edx, dword [ecx]
lea ecx, [esp + 0xc]
push edx
push ebx
push esi
call dword [fcn.004040b0]
push esi
mov dword [esp + 0x28], ebx
call fcn.0049e430
add esp, 4
test al, al
je 0x49e36c
mov esi, dword [esp + 0x2c]
mov al, byte [esp + 0xc]
push ebx
mov ecx, esi
mov byte [esi], al
call dword [fcn.004040a0]
mov ecx, dword [0x4040b4]
lea eax, [esp + 0xc]
mov edx, dword [ecx]
mov ecx, esi
push edx
push ebx
push eax
call dword [fcn.004040b0]
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call dword [fcn.004040a0]
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, dword [0x4040b4]
mov dl, byte [0x40420b]
push 1
mov byte [esp + 0x34], dl
mov eax, dword [ecx]
lea ecx, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
call dword [fcn.004040ac]
mov ecx, dword [0x4040b4]
mov ecx, dword [ecx]
cmp eax, ecx
jne 0x49e3b8
mov dl, byte [0x40420a]
push 1
lea eax, [esp + 0x34]
push ecx
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], dl
call dword [fcn.004040ac]
mov ecx, dword [0x4040b4]
cmp eax, dword [ecx]
je 0x49e3d5
mov esi, dword [esp + 0x2c]
push eax
push ebx
push esi
lea ecx, [esp + 0x18]
call dword [fcn.004040a8]
jmp 0x49e3e8
mov esi, dword [esp + 0x2c]
mov dl, byte [esp + 0x2c]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0x10]
cmp ecx, ebx
je 0x49e41d
mov al, byte [ecx - 1]
cmp al, bl
je 0x49e413
cmp al, 0xff
je 0x49e413
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.004a0110
add esp, 4
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x49f3f0
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 8]
xor eax, eax
xor ecx, ecx
push ebx
mov ax, word [edx + 0x14]
mov cx, word [edx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
lea eax, [eax + edx + 0x18]
jbe 0x49f429
mov edi, dword [esp + 0x10]
mov edx, dword [eax + 0xc]
cmp edi, edx
jb 0x49f421
mov ebx, dword [eax + 8]
add ebx, edx
cmp edi, ebx
jb 0x49f42b
inc esi
add eax, 0x28
cmp esi, ecx
jb 0x49f411
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x10001070
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x100010a8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret

Function at 0x10001170
Capabilities:
Connect to http server

Disassembly:
push esi
mov esi, ecx
call fcn.100011d0
mov ecx, esi
call fcn.10001070
test eax, eax
jne 0x10001187
pop esi
ret 0x14
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push 0
neg eax
sbb eax, eax
and eax, 0x8000000
push eax
mov eax, dword [esp + 0x1c]
push 1
push ecx
mov ecx, dword [esp + 0x18]
push edx
mov edx, dword [esi]
push eax
push ecx
push edx
call dword [sym.imp.WININET.dll_InternetConnectA]
xor ecx, ecx
mov dword [esi + 8], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
ret 0x14
Function at 0x100025f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x10002656
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x10002656
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x10002637
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x10003270
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.100033c0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x10003290
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x10003271
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.100033c0
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x10003290
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WSOCK32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x100032c0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WSOCK32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WSOCK32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10003317
push esi
call sub.WSOCK32.dll_gethostbyname
test eax, eax
je 0x1000332d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.10003350
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WSOCK32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x10003350
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WSOCK32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x100033e0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WSOCK32.dll_select
cmp eax, 0xffffffff
jne 0x10003429
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x10003b50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10019d00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.10003450
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.100034d0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.100034d0
lea ecx, [esi + 0xc]
call fcn.10011cc8
lea ecx, [esi + 0x10]
call fcn.10011cc8
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.10006140
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.10006140
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.10006140
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.10011d3d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.10011d3d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10004978
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10019f28
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x10004988
call fcn.10004ea0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x10004a6b
cmp byte [edi], 0
je 0x10004a6b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x100049ad
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.10003270
test eax, eax
jne 0x100049cd
push 0x10023974
lea ecx, [esi + 0x38]
call fcn.10011e7a
jmp 0x10004a6b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.100032c0
test eax, eax
jne 0x100049fc
mov ecx, esi
call fcn.100033c0
push edi
add esi, 0x38
push 0x10023950
push esi
call fcn.1001121d
add esp, 0xc
jmp 0x10004a6b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.10005730
test eax, eax
je 0x10004a64
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WSOCK32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.10004b40
test eax, eax
jne 0x10004a80
push edi
lea eax, [esi + 0x38]
push 0x1002392c
push eax
call fcn.1001121d
add esp, 0xc
mov ecx, esi
call fcn.10004ea0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x10004b28
mov ecx, dword [0x10023c28]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.1001121d
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.10003370
test eax, eax
jne 0x10004aea
push 0x10023910
lea ecx, [esi + 0x38]
call fcn.10011e7a
jmp 0x10004afa
push 0xfa
mov ecx, esi
call fcn.10005730
test eax, eax
jne 0x10004b17
mov ecx, esi
call fcn.10004ea0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.10011d3d
jmp 0x10004a6b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.10011d3d
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x1000c402
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x100248e8
cmp edx, dword [eax]
je 0x1000c424
add eax, 8
inc ecx
cmp eax, 0x10024978
jl 0x1000c415
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x100248e8]
jne 0x1000c552
mov eax, dword [0x10033534]
cmp eax, 1
je 0x1000c52c
test eax, eax
jne 0x1000c455
cmp dword [0x10033538], 1
je 0x1000c52c
cmp edx, 0xfc
je 0x1000c552
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1000c48c
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.1000dd30
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.1000b930
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x1000c4cf
lea eax, [ebp - 0x1a4]
push eax
call fcn.1000b930
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x1001c970
push edi
call fcn.1000f550
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.1000dd30
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.1000dd40
lea eax, [ebp - 0xa0]
push 0x1001c950
push eax
call fcn.1000dd40
push dword [esi + 0x100248ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.1000dd40
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.1000f64e
add esp, 0x2c
pop edi
jmp 0x1000c552
lea eax, [ebp + 8]
lea esi, [esi + 0x100248ec]
push 0
push eax
push dword [esi]
call fcn.1000b930
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1001a897
Capabilities:
Encode data using xor

Disassembly:
sub dword [eax], 0xd5c35044
jmp 0x1001a760
jmp fcn.10008335
stc
sbb eax, 0xfffffffb
jmp 0x1001a8eb
sub ebx, 0x32e
jmp 0x1001a93c
jne 0x1001a718
jmp 0x1001a925
je 0x1001a807
jae 0x1001a9d9
cmp byte [edx - 0x10], al
cmpsb byte [esi], byte es:[edi]
xor byte [ebp + 0x1a3a0e06], bh
mov esi, 0x33411ab4
fcomp qword [eax - 0x52]
sar dh, 0xd6
ret
dec dword [edi]
jmp 0x1001a974
pop ecx
pop esi
pop eax
pop edi
pop ebx
pop edx
stc
jb 0x1001a730
int 0xa8
add ebx, ebx
xchg byte [ecx], ah
inc edi
call fcn.1001aa31
jmp 0x1001a807
push dword [ebx]
pop eax
jmp 0x1001a9a5
sar eax, cl
push eax
pop ds
sahf
adc cl, bl
push eax
in al, dx
invalid
mov edx, dword [ebx + 4]
jae 0x1001a718
or ch, 0x32
xor eax, 0x96dec982
jl 0x1001a846
xor al, 0x9b
xchg edi, eax
cmp eax, 0xe4e9aeec
popal
dec edi
inc ebx
pop esi
xchg esi, eax
pop es
pop edx
mov eax, dword [0xd5249d77]
bound ecx, qword [ebp - 0x49199c7b]
sub ecx, dword [edi - 0x35]
push ebx
mov bh, 0xc7
pop ebx
jmp 0x1001a798
add edx, 0xffffffff
jmp 0x1001a7ac
stc
adc ebx, 7
jmp 0x1001a7f5
cmp dword [ebx], 0
clc
jae 0x1001a7d0
cwde
xor byte [ebp - 0x36], bh
cmc
sub al, 0x8f
mov ebp, 0x6a5c5fe0
jecxz 0x1001a9d0
salc
lds esi, [ecx - 0x3147c48]
sub ebx, 0xfffffffc
jmp 0x1001a832
jne 0x1001a832
jmp 0x1001a81c
xchg ecx, eax
push es
sbb eax, 0xf9c91a64
mov al, byte [0x4b1b5134]
cmp ebx, dword [eax + ebx*8 - 0x47]
dec edx
imul eax, dword [esi - 0xd], 0xff8c303
xor dword [esi + 0x78fffffe], 0xfffffff3
inc esi
add eax, ebx
add eax, ebx
clc
jae 0x1001a864
js 0x1001a9a3
mov byte [0x2ed61167], al
popal
xchg dword [ebp - 0x56815cda], eax
jecxz 0x1001a9f4
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
push 0x8dc1db1b
fbstp tbyte [edi]
cmc
pop ebp
jo 0x1001a991
les edi, [edi + ebp + 0x464dbd33]
dec ebp
inc esi
sar dword [edx - 0x6e], 1
cmp al, 0xdc
aam 0x55
mov edi, ebx
jae 0x1001a958
les eax, [edx]
push ebx
inc edi
loope 0x1001aa08
call 0xef54c7d4
cmpsb byte [esi], byte es:[edi]
cmp al, 0x28
cmovns edi, ebx
xor dl, byte [esi + ecx*4 + 0x30]
invalid
invalid
Function at 0x1cfb4e9
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1df5e92
lea esp, [esp + 0x24]
jne 0x1df2769
setne ah
mov byte [edi - 1], 0
call fcn.01ae1273
pop ecx
push esp
outsd dx, dword [esi]
xor dword [edi], edx
pop esi
dec esp
fucompi st(0)
mov al, byte [0x30792acb]
popal
cmp byte [ebp + 0x3e], ch
imul esp, dword [ebx + esi*2], 0x43
test eax, 0xbb1179e6
xchg edi, eax
sbb al, 0xc0
and al, 0x25
out dx, al
jbe 0x1df5e9f
fist dword [ecx + eax]
sti
lahf
sub al, 0xb4
xor ebx, dword [ebx + 0x554c94ee]
sar bl, 1
mov edx, 0xd223a3bc
sub al, byte [eax + 0x7019b79b]
inc ecx
idiv dword [eax + 0x21]
pop edi
sbb cl, dh
cmp ebp, dword [edi + 0x1e]
cmp byte [edx - 0x19], ah
dec eax
out 0x94, al
cmp al, 0xdf
jg 0x1df5ece
push esp
pop edx
mov eax, dword [0x86ed4142]
in eax, 0x45
add eax, 0xa0de05bd
ror byte [edi - 0x36c34d6], 0xc6
mov ch, 0xdf
sub dword [ebx + 0x45], eax
cmp cl, byte [edx + 0x5eb5def9]
sti
mov ah, 0x81
rol byte [ebx - 0x72d7636], 0x97
adc dword [esi], edi
sub al, 0x29
xlatb
lcall 0xbd3, 0x3f83d19e
retf 0x299d

Function at 0x1cfb5fe
Capabilities:
Encode data using xor

Disassembly:
not bl
inc ecx
neg bl
xchg ebp, eax
seto ah
btr eax, 0x1e
rcr ah, cl
das
mov eax, ebp
mov byte [esp + 4], dh
mov bl, 1
mov byte [esp], dl
mov word [esp + 4], cx
stc
xchg dword [esp + 4], esi
bts esi, esp
xor si, dx
rcl si, cl
rol si, cl
mov esi, edi
pushfd
pushal
sub esi, eax
call fcn.01cfcfce
cmpsb byte [esi], byte es:[edi]
xor dword [edx + 0x2c], esp
dec edx
adc dword [edx + edx*4 + 0x6b], eax
xchg esp, eax
inc ebx
mov byte [0x6854e18e], al
xchg byte [eax + 0x75], bh
or al, 0x6c
xchg ecx, eax
je 0x1cfb626
out 0xb5, al
leave
mov edx, 0x608dbee2
push edx
mov esp, es
sub dword [0x593cc31b], ecx
cmp al, 0x1b
adc ah, byte [ecx + 0x44]
pop ss
dec esi
sbb eax, 0x44430544
retf

Function at 0x20dbd83
Capabilities:
Encode data using xor

Disassembly:
cmc
sub al, 0x30
pushal
mov word [esp + 4], sp
cmp al, 9
pushal
lea esp, [esp + 0x44]
ja 0x1df2769
push 0x16b516d0
imul edx, edx, 0xa
bt si, 8
add edx, eax
mov word [esp], cx
lea esp, [esp + 4]
jmp fcn.01d01b64
Function at 0x4023e6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x402406
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x40240f
cmp byte [ebx], 0
jne 0x402416
xor eax, eax
jmp 0x402496
xor esi, esi
jmp 0x402459
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402440
cmp dword [ebp - 4], 0
je 0x402440
test esi, esi
jne 0x402440
cmp dword [ebp + 8], 0
je 0x40243c
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x402459
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x40244e
cmp ecx, 0xa
jne 0x402456
cmp ecx, 0xd
jne 0x40245e
inc ebx
jmp 0x40245e
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x40241a
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402494
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x402494
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call fcn.004132b8
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0040f1b4
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4