joyce8/EMBER2024-capa huggingface dataset:
Function at 0x8255eb
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov eax, 0xab4dc554
xor cl, ch
mov esi, 0xc18a9deb
clc
into
xchg esi, eax
sbb dword [0xa44e8a9c], ecx
and dword [eax + eax], 0
add byte [ecx + 0x53], dh
add byte fs:[eax], al
add byte [eax], al
jno 0x8255bd
push eax
push esi
call fcn.008187a7
je 0x8255b1
in al, 0x35
shl byte [edx], 0x4b
pop esp
pop edi
mov bl, byte [esi - 0x5f672349]
dec ebx
push ebp
lds ecx, [edx - 0x20797e4d]
rol dword [edx - 0x52], cl
sbb eax, 0xc03545c9
sbb eax, 0x8a5ff3aa
test edx, eax
fcomp qword [eax - 0x3aaaf24c]
pop eax
ljmp 0xae42
pop edi
mov ah, byte [ebp - 0x49]
fcomp qword [eax - 0x3aab2421]
rcr dword [edx + esi - 0x62a42a33], 0x8a
push ebp
js 0x82554c
pushfd
xor cl, ch
aad 0x5b
popfd
mov dl, byte [ebp + 0x78]
test dword [esi - 0x7561e010], edx
loop 0x82564b
xchg esi, eax
invalid
pop eax
add byte gs:[eax], al
add byte [eax], al
jbe 0x825563
invalid
and al, 4
push esi
call fcn.00832e04
jmp 0x2202414c
jmp eax
push 0xfb2160f2
push ecx
push edx
push ebx
push eax
push esi
call fcn.00438ea4
jle 0x8255e9
mov edi, ecx
mov edi, 0x8c9b6124
stosd dword es:[edi], eax
aas
xor al, byte [edx - 0x52]
and al, 0xb
add dword [ebx - 0x52], 0x2c
mov dword cs:[0x7855a50c], eax
jne 0x8255d2
cmc
aam 0x57
add al, 0x17
lds ebx, [ebx]
mov word [ebx - 0x3fc9f1c5], gs
sub al, 0xb7
mov al, byte [0x560fc036]
mov bh, cl
mov edi, 0x36a0b73d
ror byte [edx], 0x3b
push cs
shl byte ss:[edi], 0x56
mov bh, cl
mov edi, 0x36a0b71a
shl byte [edi + esi*4], 0xa0
rol byte ss:[ebx], 0xd5
xchg esp, eax
rcl byte ss:[ebx], 0xe8
rcl byte [ebx], 0xe8
add edx, dword [eax]
jne 0x8256c0
xchg ebp, eax
loopne 0x82561b
add eax, 0x360e3bdc
ror byte [edi], 0x3b
cmp ecx, dword [esi]
ror byte ss:[edi], 0x3b
push cs
sar byte ss:[0xbff98a56], 0xa
push esi
mov bh, cl
cmp eax, 0xbff98a56
or dl, byte [esi - 0x76]
stc
mov edi, 0x36a0b727
rcr byte [edx], 0xb7
mov al, byte [0xb724c036]
mov al, byte [0xd503c036]
xchg esp, eax
rcl byte ss:[ebx], 0
add byte [eax], al
add byte [ebp + 0x3d], bh
sbb dword [esi + edi*2], edx
aas
xor al, byte [edx - 0x52]
adc dword [edi], edi
xor al, byte [edx - 0x52]
push es
jo 0x825662
inc ebx
scasb al, byte es:[edi]
or bh, bh
push eax
inc ebx
scasb al, byte es:[edi]
or esp, dword [edx + 0xeae4195]
aas
xor al, byte [edx - 0x52]
or eax, 0xae4195a2
add al, 0x18
pop ds
inc ecx
scasb al, byte es:[edi]
das
int3
sahf
mov ch, ah
jl 0x82571d
add byte gs:[eax], al
add byte [eax], al
invalid

Function at 0x829212
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push eax
xlatb
wait
ja 0x8283bb
xor eax, 0x852682d5
sal dword [esi - 0x3fcbac40], 0x1d
or dword [edx + 4], edi
movsd dword es:[edi], dword [esi]
add bh, ch
push esp
invalid
push esi
pushfd
push ebp
call fcn.00803ea2
je 0x82835e
adc eax, 0x91748a9e
fcomp qword [eax - 0x3fca1bc2]
push es
stosb byte es:[edi], al
pop edi
mov ah, byte [esi + 0x41]
fcomp qword [eax - 0x3aab47b7]
cmp esi, dword ss:[ebx]
int 0x49
dec ebp
popfd
mov dl, byte [esi + 0x7f]
jecxz 0x82835e
invalid
lea esp, [esp + 4]
push eax
jmp 0x828399
Function at 0x84161a
Capabilities:
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
push eax
push esi
call fcn.0085b4b1
js 0x84168f
xor byte [ecx + 0x52517a21], al
push ebx
push eax
push esi
call fcn.0086bfb5
jg 0x84169f
mov edi, 0x51a2a181
jmp loc.0050f457
mov bl, 0x13
sahf
dec edx
int 0x78
push edx
adc dword [esi + 0x3c92c70e], ebp
xchg cl, ah
jb 0x84161f
scasb al, byte es:[edi]
push cs
invalid
sar dword [ebx - 0x43], 0xc0
cmp al, al
push cs
lahf
dec edx
xor eax, dword [ebp - 0x2ac91451]
stosb byte es:[edi], al
arpl word [ebp + 0x5412aa86], ax
mov bl, 0xeb
pop esi
mov eax, dword [0xdafc668a]
cwde
fst qword [esp + edx*2 - 0x4d]
lodsd eax, dword [esi]
stc
inc esp
scasb al, byte es:[edi]
adc esp, dword [ebx + edx - 0x44]
lodsd eax, dword [esi]
adc edx, ecx
pop ebx
nop
loop 0x8416dd
lahf
ror dword [eax + 0x2be55ec1], 1
mov ebx, 0x87e313ad
inc ebp
scasb al, byte es:[edi]
adc edi, dword [edi + 0x10]
mov dword [0x61f43d8a], eax
wait
sbb al, byte [eax + 0x46c98a9f]
cmp al, 0x66
cmp eax, 0x1a9b61f4
sbb byte [edi + 0x3c46c98a], 0x66
popal
xchg dword [eax - 0xf6fd276], esp
cwde
pand mm4, qword [ecx - 0x31be4676]
cli
or bh, byte [ecx]
aad 0xe1
jb 0x841687
rcr dword [edi], 0x7b
pop ebp
cmp al, al
adc eax, dword [ebx + 0x41a5471a]
add dword [ecx - 0x3b], ebx
mov dh, cl
aaa
aad 0xb4
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
cdq
in al, 0xfc
invalid

Function at 0x86be41
Capabilities:
Encrypt data using rc4 prga

Disassembly:
inc edi
scasb al, byte es:[edi]
sbb byte [edi], dh
xchg ebx, eax
inc edi
scasb al, byte es:[edi]
and dword [ecx + 0x34ae46d8], edx
aaa
xchg ebx, eax
inc edi
scasb al, byte es:[edi]
sub ebp, dword [edi + ebx*8 + 0x44]
scasb al, byte es:[edi]
or edi, dword [eax + 0x41863975]
xchg byte [edi], dh
shr byte [ebx], 0x9a
js 0x86be34
rcl byte [edx], 0x94
push ebp
mov eax, dword [0xd39b168a]
cwde
sti
sbb al, 0x24
vmaxsd xmm7, xmm1, qword [eax]
int 0x82
push eax
mov byte [0x22d7078a], al
cdq
add al, 0x87
mov eax, dword [0xcb9a938a]
add byte [eax], al
add byte [eax], al
jo 0x86be8d
scasb al, byte es:[edi]
and byte [ecx - 0x16adaed7], 0x1b
and al, 0xff
jmp edx
wait
retf 0x7eff
push 0xaf218190
call fcn.008751a8
invalid
Function at 0x877043
Capabilities:
Packed with generic packer

Disassembly:
push esi
pushfd
jmp 0x875551
push ebx
call fcn.0084a4aa
loope 0x867d22
in eax, 0x80
and dword [0xe8535251], esp
out dx, eax
rol dword [eax], 1
add byte [edi + 0x66], dh
mov dword [edx], eax
push 0x38a182e1
jmp 0x871233
push edx
mov bl, 0xeb
jbe 0x867d45
mov bl, 0x6d
pop edi
inc esi
scasb al, byte es:[edi]
add al, 0xe4
loope 0x867d81
mov bl, 0xf4
pop edx
cmp al, al
add al, 0x5f
sar dword [edi - 0x33], 0x91
fadd dword [esi - 0x52]
xor al, byte [ecx + edx*2]
inc edi
scasb al, byte es:[edi]
and al, 0x1a
sbb byte [edi - 0x72912e76], 0x98
pop dword [edi - 0x24a1755f]
retf
adc eax, dword [ecx]
dec ebp
mov ecx, 0x2ee517ad
mov ebx, 0x4c0b1cad
cmp ch, dl
mov esp, 0xaf868839
jmp 0x867dcd
inc esi
into
int1
sbb dl, byte [edx - 0x26]
adc al, 0x33
push 0x8897e12a
inc esi
scasb al, byte es:[edi]
cmp eax, 0xe2905bd1
sbb al, 0x70
add dword [edi + 0x3bbd50c1], 0x9f3dc038
dec edx
xor eax, dword [ebp - 0x2ac91451]
mov ebx, 0x898685de
dec ecx
push edx
test dword [edi - 0x442ac915], ebp
fiadd word [ebp + 0x52498986]
mov bl, 0x51
shl byte [eax - 0x276ac476], 0x98
fst qword [esp + edx*2 - 0x4d]
cld
jle 0x867e2f
scasb al, byte es:[edi]
adc al, 0xf1
and al, 0xb9
lodsd eax, dword [esi]
adc al, 0x62
in al, dx
pushal
loop 0x867e09
push eax
dec esp
xchg ecx, eax
xor esp, ebp
sal dword [ebx], 0xe5
sub edi, dword [ebx + 0x510414ad]
inc edi
scasb al, byte es:[edi]
adc al, 0x1a
sbb byte [edi - 0x6d30ee76], 0x97
popal
xchg dword [eax + 0x39df9e8a], esp
adc byte [eax - 0x5e], 0x8a
add dword [ecx + 0x71], esi
xchg esi, eax
pand mm4, qword [ecx - 0x35f7176]
push 0xd538efa6
jo 0x867dab
iretd
xchg ecx, eax
hlt
cmp al, al
adc al, 0x83
sbb al, byte [edi - 0x5b]
inc ecx
add dword [ecx - 0x3b], ebx
push edx
insd dword es:[edi], dx
cmp ch, dl
mov ah, 0xa4
stosb byte es:[edi], al
cdq
mov ecx, 0xc5572880
mov al, 4
stosb byte es:[edi], al
cdq
rcr ecx, 0x11
adc byte [ebp - 0x1bf08da5], ah
or byte [eax], al
add byte [eax], al
add byte [eax], al
loop 0x867df8
call fcn.0084016e
call 0x4aae2f3
lea esp, [esp + 4]
pop word [eax]
mov ebx, dword [esi]
add ebx, dword [edi]
add ebx, 0x2bc36514
lea esi, [esi + 5]
jmp ebx
pop ebx
jb 0x86afd6
in al, 8
add byte [eax], al
add byte [eax], al
add al, ah
shl eax, 2
lea eax, [eax + edi]
push dword [eax]
mov ecx, dword [esi]
call fcn.00847df2
jle 0x86b033
xor byte [ebx - 0x31eb17f2], cl
std
invalid
push eax
jmp 0x83d9f4
push ebx
call fcn.0084a133
ja 0x86afc4
cld
invalid
or al, 0x24
lea esp, [esp + 4]
pop dx
call fcn.0084551e
jle 0x86b08c
jecxz 0x86b085
sal byte [esi], 1
adc dword [eax - 0x52], ecx
sbb cl, byte [ebx + 0x2e]
mov al, byte [0xd863c28a]
cwde
dec dword [eax]
cmp eax, eax
pop ss
invalid
cwde
invalid
int 0xfe
retf 0x9232
push ecx
push edx
jmp 0x86b031
push ebp
push edi
jmp fcn.005159d5
lea esp, [esp + 4]
push ecx
push edx
jmp 0x867cb2
Function at 0x87d8b6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lodsd eax, dword [esi]
and eax, 0xe291b420
and eax, 0xc15dc625
adc byte [ebp - 0x62], cl
mov ebp, 0xb76625ad
dec eax
scasb al, byte es:[edi]
and eax, 0x8aa45781
out dx, al
test eax, 0x578198c4
movsb byte es:[edi], byte [esi]
mov bh, byte [ebx + 0x65]
push 0x33
shl byte [ebx - 0x41d62176], 1
cwde
xlatb
test dword [edx + ecx*4 + 0x6aa97b6b], esp
and al, 0x94
cmp dl, ch
push esp
inc esp
mov eax, ecx
rcr ebx, 1
dec ebp
cmp al, 0xc0
and eax, 0xa548a793
and eax, 0x3ac55bfc
xchg esp, eax
cmp dl, ch
lodsd eax, dword [esi]
loope 0x87d811
cdq
xchg esi, eax
lodsd eax, dword [esi]
push ebp
pop ebx
invalid
push 0x94a1837e
push ecx
push edx
push ebx
push eax
push esi
call fcn.0088b458
jno 0x87d854
invalid
and al, 4
mov al, byte [eax]
and eax, 0xff
push ax
lodsd eax, dword [esi]
add esi, 1
jmp 0x88977a
add eax, dword [edi]
add eax, 0x60b2ee1e
jmp eax

Function at 0x87ddfb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esi]
add edx, dword [edi]
lea esi, [esi + 5]
add edx, 0x52cadf9c
jmp edx
scasb al, byte es:[edi]
cmp edx, dword [edx - 0x31]
dec eax
scasb al, byte es:[edi]
aas
int1
sbb edi, dword [esi]
xchg byte [ecx - 0x5d], dl
mov eax, ecx
enter 0x4916, 0x3c
rcl byte [esp + edi*8], 0xb0
xor eax, 0x3a014e85
aad 0x76
ret
and eax, 0xc15d7eeb
xchg ebx, eax
dec ebp
sahf
mov ebp, 0xd0b525ad
dec eax
scasb al, byte es:[edi]
ror byte [eax - 0x52], 1
and eax, 0x8aa3d033
jno 0x87ddaa
xchg ebp, eax
cwde
adc dword [edi - 0x5c], 0x3e5ffe8a
push 0x2f
pop esi
movsb byte es:[edi], byte [esi]
mov ah, byte [edx - 0x7e]
jnp 0x87dd55
lea ecx, [ebp - 0x5c]
mov ch, dh
in eax, dx
wait
push 0x24
xchg esp, eax
cmp dl, ch
push ecx
mov dword [0x4354c18b], eax
mov esi, 0xa325c03b
dec ecx
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
xor al, 0x5c
lds edi, [edx]
xchg esp, eax
cmp dl, ch
cmc
fsubr dword [ecx + ebx*4 + 0x5b7a0219]
invalid
push 0xe421836e
call fcn.0088b0d4
jl 0x87dd94
invalid
and al, 4
push eax
push esi
pushfd
push ebp
call fcn.0087be59
jno 0x87dda0
add al, 0x24
lea esp, [esp + 4]
mov edx, dword [esp]
lea esp, [esp + 4]
imul edx
push ebx
mov dword [esp], edx
push esi
call fcn.008868fc
jl 0x87ddc1
dec dword [ebx + 0x486]
add byte [ecx + 0xffe0], al
add byte [edx + 0x2e0c1c0], cl
lea eax, [eax + edi]
jmp 0x88b4e9
mov al, byte [eax]
and eax, 0xff
push ax
jmp 0x87cbfe
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x403e59
pop dword [ebp - 0x28]
mov eax, 0x5b3915dd
sub eax, 0x5af8d784
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x42504998
sub dword [ebp - 0x38], 0xf3fe044d
mov dword [ebp - 0x34], 0xbe28389a
sub dword [ebp - 0x34], 0x8bf4ec55
mov dword [ebp - 0x30], 0xc19e5fe2
add dword [ebp - 0x30], 0x8aade44c
mov dword [ebp - 0x2c], 0x35d00ffc
add dword [ebp - 0x2c], 0xca2ff004
lea eax, [ebp - 0x38]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x68ad385a
add dword [ebp - 0x38], 0xbc530fc
mov dword [ebp - 0x34], 0x75bb4cbd
sub dword [ebp - 0x34], 0x344eeb48
mov dword [ebp - 0x30], 0x565f95fc
add dword [ebp - 0x30], 0xd0fd670
mov dword [ebp - 0x2c], 0xa054ddcb
sub dword [ebp - 0x2c], 0xa054ddcb
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0xfcccde3
add eax, 0xf073a2c5
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x35435
push 0
call eax
mov ecx, 0x4210
xor edx, edx
add edx, eax
mov ebx, 0x81002eba
add ebx, 0x7f40d146
add ebx, dword [ebp - 0x28]
mov esi, 0x996b9578
sub esi, 0x6b6d75c0
mov edi, dword [ebx]
add dword [ebp - 8], edi
xor edi, esi
add dword [ebp - 0x14], 0xdd09d8d5
mov dword [edx], edi
add edx, 0x7ccdba79
sub edx, 0x7ccdba75
add ebx, 4
loop 0x403f72
add eax, 0xf6498ffe
sub eax, 0xf64894eb
mov ebx, eax
add eax, 0xdcbb8397
add eax, 0x23447c6e
mov ecx, 0xd376369a
sub ecx, 0xd336369a
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401e10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x401e19
xor ecx, ecx
jne 0x401e19
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x401e60
mov eax, dword [ebp - 0xc]
jmp 0x401ebd
cmp dword [ebp - 4], 1
je 0x401e73
cmp dword [ebp - 4], 2
je 0x401e73
mov eax, 0xd
jmp 0x401ebd
cmp dword [ebp + 0xc], 0
je 0x401eb1
cmp dword [ebp - 8], 0
je 0x401ea9
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x401ea0
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x401ea7
mov eax, 0xd
jmp 0x401ebd
jmp 0x401eb1
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x402050
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x40d018]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.00401b30
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00401da0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4020bb
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.00401b90
mov eax, dword [ebp - 0x224]
jmp 0x40214c
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x402121
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402050
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x402118
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.00401b90
mov eax, dword [ebp - 0x228]
jmp 0x40214c
mov dword [ebp - 4], 0x100
jmp 0x4020c2
lea ecx, [ebp - 0x14]
call fcn.00401cd0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.00401c10
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.00401b90
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00407458
mov esp, ebp
pop ebp
ret 4
Function at 0x4031e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0xc8
call fcn.0040235d
dec ebx
movsb byte es:[edi], byte cs:[esi]
imul eax, dword [eax - 0x5435b], 0xffffffff
add byte [edx], ch
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.0040235d
aad 0xd7
push ecx
fild dword [eax - 0x22f5b]
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0040233b
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0040236d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402322
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0040235d
and al, 0x69
add al, 0xda
push 0x104
lea eax, [ebp - 0x12c]
push eax
call dword [ebp - 0x3d4]
mov dword [ebp - 0x28], eax
call fcn.0040235d
jno 0x40336c
inc ebp
fsubr st(0)
ljmp 0x2f7
add cl, dh
and byte [ebp - 0x20], 0
and byte [ebp - 0x1f], 0
mov byte [ebp - 0x1e], 0x1d
and byte [ebp - 0x1d], 0
mov byte [ebp - 0x1c], 0xa5
mov byte [ebp - 0x1b], 0x87
mov byte [ebp - 0x1a], 0x96
mov byte [ebp - 0x19], 0xb6
mov byte [ebp - 0x18], 0x87
mov byte [ebp - 0x17], 0x8f
mov byte [ebp - 0x16], 0x92
mov byte [ebp - 0x15], 0xb2
mov byte [ebp - 0x14], 0x83
mov byte [ebp - 0x13], 0x96
mov byte [ebp - 0x12], 0x8a
mov byte [ebp - 0x11], 0xa3
mov byte [ebp - 0x10], 0xe2
lea eax, [ebp - 0x20]
push eax
call fcn.0040236d
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402322
add esp, 0xc
mov dword [ebp - 0x370], eax
lea eax, [ebp - 0x654]
push eax
push 0x104
call dword [ebp - 0x370]
mov dword [ebp - 0x550], eax
mov eax, dword [ebp - 0x28]
movsx eax, byte [ebp + eax - 0x12d]
cmp eax, 0x5c
jne 0x403409
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x550]
invalid
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x40596d
pop dword [ebp - 0x30]
mov eax, 0x13801068
sub eax, 0x133fb6fb
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x6ef6d721
sub dword [ebp - 0x40], 0x20a491d6
mov dword [ebp - 0x3c], 0x9b4fefa2
add dword [ebp - 0x3c], 0x96e35ca3
mov dword [ebp - 0x38], 0x1abd07ac
add dword [ebp - 0x38], 0x318f3c82
mov dword [ebp - 0x34], 0xaeb3d92
add dword [ebp - 0x34], 0xf514c26e
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xaaaa7e5d
sub dword [ebp - 0x40], 0x36381507
mov dword [ebp - 0x3c], 0x57b24f80
sub dword [ebp - 0x3c], 0x1645ee0b
mov dword [ebp - 0x38], 0xf6f6ce80
add dword [ebp - 0x38], 0x6c789dec
mov dword [ebp - 0x34], 0xc34da12a
add dword [ebp - 0x34], 0x3cb25ed6
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x3f4b7fb
add eax, 0xfc4bb905
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x355f3
push 0
call eax
mov ecx, 0xf4090a7b
add ecx, 0xbf73824
xor edi, edi
add edi, eax
mov edx, 0xd7262afa
sub edx, 0xd6e52afa
add edx, dword [ebp - 0x30]
mov esi, 0x471d6536
sub dword [ebp - 4], 0x3e895871
mov ebx, dword [edx]
xor dword [ebp - 4], eax
add ebx, esi
sub dword [ebp - 0x10], edi
mov dword [edi], ebx
sub dword [ebp - 0x18], esi
add edi, 0xfc316b34
sub edi, 0xfc316b30
add edx, 0x94dc91e1
sub edx, 0x94dc91dd
loop 0x405a86
add eax, 0x7c322a31
add eax, 0x83ced31e
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x46bb7e54
add ecx, 0xb98481ac
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4116e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
test ebx, ebx
je 0x411768
push esi
push edi
mov edi, dword [ebx]
xor eax, eax
xor esi, esi
mov dword [ebp - 8], edi
mov dword [edi + 0x16], eax
cmp dword [ebx + 4], eax
jle 0x41171b
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x6b23a0]
cmp esi, dword [ebx + 4]
jl 0x411700
mov ecx, dword [ebx + 0xc]
xor esi, esi
test ecx, ecx
jle 0x41174d
mov edi, dword [ebx + 8]
mov ebx, ecx
nop dword [eax]
movzx edx, byte [edi + esi]
mov ecx, eax
shr ecx, 0x18
inc esi
xor edx, ecx
shl eax, 8
xor eax, dword [edx*4 + 0x6b23a0]
cmp esi, ebx
jl 0x411730
mov edi, dword [ebp - 8]
mov byte [edi + 0x16], al
mov ecx, eax
shr ecx, 8
mov byte [edi + 0x17], cl
mov ecx, eax
shr ecx, 0x10
mov byte [edi + 0x18], cl
shr eax, 0x18
mov byte [edi + 0x19], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416a80
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 0xfd14]
call fcn.004b6761
cmp dword [esi + 0xd834], 1
jne 0x416aa1
push 0
push 0
call dword [0x646900]
lea ecx, [esi + 0xd0]
pop esi
jmp fcn.00464de0
Function at 0x41d120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 8]
mov dword [ecx], vtable.CPicture.0
mov dword [ebp - 4], ecx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov eax, dword [edx + 0x1c]
mov dword [ecx + 0x1c], eax
mov eax, dword [edx + 0x20]
mov dword [ecx + 0x20], eax
mov eax, dword [edx + 0x24]
mov dword [ecx + 0x24], eax
mov eax, dword [edx + 0x28]
mov dword [ecx + 0x28], eax
mov eax, dword [edx + 0x2c]
mov dword [ecx + 0x2c], eax
mov eax, dword [edx + 0x30]
mov dword [ecx + 0x30], eax
mov eax, dword [edx + 0x34]
mov dword [ecx + 0x34], eax
mov eax, dword [edx + 0x38]
mov dword [ecx + 0x38], eax
mov eax, dword [edx + 0x3c]
mov dword [ecx + 0x3c], eax
mov eax, dword [edx + 0x40]
mov dword [ecx + 0x40], eax
mov eax, dword [edx + 0x44]
mov dword [ecx + 0x44], eax
mov eax, dword [edx + 0x48]
mov dword [ecx + 0x48], eax
mov eax, dword [edx + 0x4c]
mov dword [ecx + 0x4c], eax
movups xmm0, xmmword [edx + 0x50]
movups xmmword [ecx + 0x50], xmm0
movq xmm0, qword [edx + 0x60]
movq qword [ecx + 0x60], xmm0
mov eax, dword [edx + 0x68]
mov dword [ecx + 0x68], eax
mov eax, dword [edx + 0x6c]
mov dword [ecx + 0x6c], eax
mov eax, dword [edx + 0x70]
mov dword [ecx + 0x70], eax
mov eax, dword [edx + 0x74]
mov dword [ecx + 0x74], eax
mov eax, dword [edx + 0x78]
mov dword [ecx + 0x78], eax
mov eax, dword [edx + 0x7c]
mov dword [ecx + 0x7c], eax
mov eax, dword [edx + 0x80]
mov dword [ecx + 0x80], eax
mov eax, dword [edx + 0x84]
mov dword [ecx + 0x84], eax
mov eax, dword [edx + 0x88]
mov dword [ecx + 0x88], eax
mov eax, dword [edx + 0x8c]
mov dword [ecx + 0x8c], eax
mov eax, dword [edx + 0x90]
mov dword [ecx + 0x90], eax
mov eax, dword [edx + 0x94]
mov dword [ecx + 0x94], eax
mov eax, dword [edx + 0x98]
mov dword [ecx + 0x98], eax
mov eax, dword [edx + 0x9c]
mov dword [ecx + 0x9c], eax
mov eax, dword [edx + 0xa0]
mov dword [ecx + 0xa0], eax
mov eax, dword [edx + 0xa4]
mov dword [ecx + 0xa4], eax
mov eax, dword [edx + 0xa8]
mov dword [ecx + 0xa8], eax
mov eax, dword [edx + 0xac]
mov dword [ecx + 0xac], eax
movzx eax, byte [edx + 0xb0]
mov byte [ecx + 0xb0], al
movzx eax, byte [edx + 0xb1]
mov byte [ecx + 0xb1], al
mov eax, dword [edx + 0xb4]
mov dword [ecx + 0xb4], eax
movzx eax, byte [edx + 0xb8]
mov byte [ecx + 0xb8], al
movzx eax, byte [edx + 0xb9]
mov byte [ecx + 0xb9], al
movzx eax, byte [edx + 0xba]
mov byte [ecx + 0xba], al
mov eax, dword [edx + 0xbc]
mov dword [ecx + 0xbc], eax
mov eax, dword [edx + 0xc0]
mov dword [ecx + 0xc0], eax
mov eax, dword [edx + 0xc4]
mov dword [ecx + 0xc4], eax
mov eax, dword [edx + 0xc8]
mov dword [ecx + 0xc8], eax
mov eax, dword [edx + 0xcc]
mov dword [ecx + 0xcc], eax
mov eax, ecx
mov esp, ebp
pop ebp
ret 4