joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4098e8
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x40c07c], 2
jne 0x40994f
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40990a
xor eax, eax
jmp 0x40995e
lea eax, [esp + 8]
push eax
push 0x409964
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x40994f
xor eax, eax
jmp 0x40995e
push 0
push 2
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret

Function at 0x409978
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x4099d2
inc esi
xor edi, edi
cmp edi, 1
jne 0x40999e
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099ac
cmp edi, 1
jle 0x4099ac
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409438
test eax, eax
jne 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x4099d2
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x4099d2
inc edi
dec esi
jne 0x40998e
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x4099dc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test edi, edi
je 0x409a29
xor ebx, ebx
jmp 0x409a1e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, edi
call fcn.00405090
test eax, eax
jne 0x409a1d
jmp 0x41503e
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call esi
test al, al
jne 0x4099ff
mov al, byte [ebp - 1]
sub al, 1
jb 0x409a34
je 0x409a3d
jmp 0x409a46
call fcn.004074a0
mov edi, eax
jmp 0x409a48
jmp 0x415fcb
xor edi, edi
test di, di
jmp 0x41741f

Function at 0x409e8c
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409f5f
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409f78
push ebx
push 0x409f84
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne fcn.00409f0c
mov al, 0x6a
jmp loc.00417185
Function at 0x409f88
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [0x40dbd8], 0
je 0x409fa9
mov ecx, dword [0x40dbd8]
mov dl, 1
mov eax, 0x404ab0
call fcn.00405ce0
call fcn.00402eb4
ret
mov ecx, 0x409fc8
mov dl, 1
mov eax, 0x404ab0
call fcn.00405ce0
jmp loc.00416cea

Function at 0x40a018
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows
Packed with generic packer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je fcn.0040a0cc
jmp 0x40a0c1
mov eax, dword [esi + 4]
cmp eax, edi
jmp loc.00417788

Function at 0x40a0d4
Capabilities:
Extract resource via kernel32 functions
Packed with generic packer

Disassembly:
push ebx
push 0xa
push 0x2b67
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne fcn.0040a0ee
jmp loc.004163bf

Function at 0x40a810
Capabilities:
Packed with generic packer

Disassembly:
xor ecx, ecx
je 0x40a812
insd dword es:[edi], dx
push ebx
imul ebp, dword [esi], 0x204c4c64
add byte [eax + 9], ch
test al, 0x40
add bh, bh
adc eax, sym.imp.kernel32.dll_LoadLibraryA
push 0x40a809
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov ecx, 0
add ecx, 1
push eax
cmp byte [eax + ecx + 2], 0x84
pop eax
jne 0x40a822
push ecx
cmp byte [eax + ecx], 0xc0
pop ecx
jmp loc.00415a58
pushfd
pushal
push ebp
mov ebp, esp
push ebx
push edi
push 0x20
push 0x8001
push 8
push 0x2b4
push eax
push 0x40931c
push 0x409304
push 0x46adc0
push eax
mov edi, 0x4c30a0
push edi
mov eax, edi
add esp, 0x30
leave
popal
popfd
jne 0x40a801
jmp fcn.0040a7ff

Function at 0x416b2b
Capabilities:
Packed with generic packer

Disassembly:
pushfd
pushal
push ebp
mov ebp, esp
mov eax, dword [0x40b0d7]
shl eax, 2
push edi
push ecx
xor eax, eax
mov edi, 0x40d490
mov ecx, 0x40d95c
cmp ecx, edi
add esp, 8
leave
popal
popfd
jmp fcn.00402614
Function at 0x52a04d
Capabilities:
Encode data using xor

Disassembly:
sub ebx, edi
ror di, 0xe
call fcn.005196a0
push ebp
push 0x12
mov ecx, 0x7139b1b1
push ds
xchg ebp, eax
dec eax
jnp 0x52a08b
jge 0x52a087
lahf
inc edx
push ecx
or al, 0xab
push esi
pop ebp
add byte [edi + 0x77207d32], cl
sub ah, byte [ecx - 0x7ee19ca4]
jge 0x52a093
ja 0x52a09f
mov eax, dword [0x811e635c]
cmp dword [edx - 0x1c], edi
cmp eax, esp
invalid
adc cl, byte [esi]
mov byte [eax], dh
cmp esi, dword [edi - 0x6b04c816]
pop ss
or ebp, dword [ecx - 0x67]
adc ebp, dword [esi + 0x1c7bc6c1]
inc ebx
jne 0x52a0e8
imul ebx, dword [ecx - 0x393e51ed], 0x75431c7b
dec edx
xchg ebp, eax
xchg esp, eax
aaa
adc eax, 0xbcf6b4ff
rcr byte cs:[eax - 0x3c], cl
cmpsb byte [esi], byte es:[edi]
mov esp, 0xe5b20a99
pop ebx
mov ebp, 0x5f484017
cwde
pop eax
cmp cl, al
cmp bl, al
popfd
add byte [esi - 0x37f6e590], 0x82
push edi
pop esi
invalid
xchg ebx, eax
int3
stc
jp 0x52a071
lahf
mov ecx, 0x560cafa7
jae 0x52a143
or eax, 0xcb0f2aae
jbe 0x52a0e4
enter 0xffffffffffffdfda, 0xffffffffffffff83
cmp eax, 0x1839f21
jge 0x52a150
invalid
invalid
sub byte [eax], dl
xchg dword [edx], edi
invalid
rcl bl, 0xde
in eax, dx
push ecx
arpl si, bx
pop edi
cdq
xchg esp, eax
or esi, dword [esi - 0x500ed31f]
jns 0x52a1a9
sal dh, 0x1a
xchg esp, eax
scasd eax, dword es:[edi]
inc ebp
cwde
xor eax, 0xccde6259
mov esi, 0xa8f305b6
cmp dh, byte [esi - 0x60]
push ebp
jo 0x52a1a0
fcompi st(5)
sahf
lodsd eax, dword [esi]
inc ebp
sahf
mov bl, 0xa1
test eax, 0x5e6144fe
inc esp
popal
pop esi
add ebp, dword [eax + edx*2 + 0x686c66fa]
aad 0x49
dec edi
xor edx, dword [ecx - 0x6fe6f473]
mov edx, fs
pop esi
sub byte [esi + eax*4], dl
or al, 4
bound esi, qword [edx + 0x6beee33a]
jb 0x52a1b2
cmp ah, bl
out dx, al
imul esi, dword [edx + 0xc], 0x71
xchg ecx, eax
jno 0x52a139
dec edi
inc edx
jb 0x52a1fb
sbb ebx, dword [eax]
je 0x52a183
wait
invalid
jl 0x52a19c
insd dword es:[edi], dx
stosb byte es:[edi], al
rcl ebp, 0xe1
in al, 0xca
je 0x52a20b
inc ebp
movsb byte es:[edi], byte [esi]
pop ebx
ljmp 0xbef3
mov ss, word [0x29aef3c8]
aam 0xef
xchg edx, eax
adc esp, ecx
repe scasb al, byte es:[edi]
std
mov al, byte [0xb7416ff3]
pop ebx
outsd dx, dword [esi]
inc ecx
mov bh, 0x5b
outsd dx, dword [esi]
mov cl, al
or al, 1
scasb al, byte es:[edi]
push ebx
xor al, 0x28
jbe 0x52a244
in al, 0x85
inc ebx
test dword [eax + 0x79c1ea37], ecx
jno 0x52a251
cmp esp, dword [eax - 0x5e]
sub al, bl
aad 0xd6
invalid
out dx, al
ret
mov eax, 0xd693feb1
fcmovne st(0), st(0)
lds ebx, [0xa168c19e]
and byte gs:[edx], 0xb6
pushal
invalid

Function at 0x5aa880
Capabilities:
Encode data using xor

Disassembly:
cmp eax, dword [ebp - 0x10]
call 0x5005cd
add byte [eax], al
inc ecx
arpl word [ebx + 0x65], sp
jae 0x51a65b
imul esp, dword [edx + 0x6c], 0x6a624f65
arpl word gs:[esi + eax*2 + 0x72], si
outsd dx, dword [esi]
insd dword es:[edi], dx
push eax
outsd dx, dword [esi]
imul ebp, dword [esi + 0x74], 0x81669c00
pushfd
cmp sp, 0x68a
cmp sp, ax
cmp eax, edx
mov byte [esp], 0x48
call fcn.005aa880
pushal
pushfd
lea esp, [esp + 0x30]
jb 0x52c69c
pushfd
test di, 0xc6a3
pushal
jmp 0x51a5d8
Function at 0x4030a0
Capabilities:
Create mailslot

Disassembly:
push ecx
cmp dword [0x2b9d7dc], 3
jne 0x4030c6
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [esp], 0
mov eax, dword [esp + 0x10]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
xor dword [esp], eax
mov eax, dword [esp]
mov ecx, dword [esp + 8]
mov dword [ecx], eax
pop ecx
ret 0xc

Function at 0x4032f0
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, dword [0x2b9d7dc]
mov ecx, dword [0x2b9d750]
sub esp, 0xc0c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x403404
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b9d7dc], 0x959
jne 0x4033ea
push 0
call edi
push 0
lea eax, [esp + 0x41c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x402d00
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x402d10
push 0x402d24
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov edx, dword [esp + 0x10]
push edx
call fcn.00403110
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403330
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc0c
ret
Function at 0x409930
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x444b70]
jne 0x40993a
repz ret
jmp fcn.0040b95c

Function at 0x40a303
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405e53
and dword [ebp - 4], 0
cmp dword [0x4469ac], 0
mov ebx, eax
jne 0x40a3b4
push 0x402bfc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a465
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bf0
push edi
call esi
test eax, eax
je 0x40a465
push eax
call fcn.00405de1
mov dword [esp], 0x402be0
push edi
mov dword [0x4469ac], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bcc
push edi
mov dword [0x4469b0], eax
call esi
push eax
call fcn.00405de1
mov dword [esp], 0x402bb0
push edi
mov dword [0x4469b4], eax
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x4469bc], eax
test eax, eax
je 0x40a3b4
push 0x402b98
push edi
call esi
push eax
call fcn.00405de1
pop ecx
mov dword [0x4469b8], eax
mov eax, dword [0x4469b8]
cmp eax, ebx
je 0x40a40c
cmp dword [0x4469bc], ebx
je 0x40a40c
push eax
call fcn.00405e5c
push dword [0x4469bc]
mov esi, eax
call fcn.00405e5c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a40c
test edi, edi
je 0x40a40c
call esi
test eax, eax
je 0x40a403
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a403
test byte [ebp - 0xc], 1
jne 0x40a40c
or dword [ebp + 0x10], 0x200000
jmp 0x40a445
mov eax, dword [0x4469b0]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a445
mov eax, dword [0x4469b4]
cmp eax, ebx
je 0x40a445
push eax
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a445
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4469ac]
call fcn.00405e5c
pop ecx
test eax, eax
je 0x40a465
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a467
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7ffe5409
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
add eax, 0
nop
and bh, 0xff
cld
and bh, 0xff
cld
lea esp, [esp]
cld
push edx
cdq
pop edx
cld
and bh, 0xff
cld
add eax, 0
cld
and bh, 0xff
nop
pushal
inc eax
popal
nop
lea esp, [esp]
cld
add eax, 0
stc
and bh, 0xff
stc
push edx
cdq
pop edx
nop
add eax, 0
nop
and bh, 0xff
cld
pushal
inc eax
popal
nop
call 0x7ffe5454
pop edx
add eax, 0
cld
stc
xor dx, dx
cld
nop
stc
stc
add edx, 0xd5e0
stc
xor ecx, ecx
stc
mov cl, 0x1e
and bh, 0xff
xor byte [ecx + edx], 0x8a
loop 0x7ffe5470
add eax, 0
push dword fs:[0x24]
nop
pop dword [edx + 0xa]
lea esp, [esp]
cld
clc
mov cl, 0xff
clc
push edx
loop 0x7ffe548c
add eax, 0
clc
cld
mov dword [edx + 0x11], 0xffffacbb
stc
pushal
inc eax
popal
mov ecx, dword [eax + 0x2c]
cld
mov dword [edx + 0x1b], ecx
add al, 0
clc
mov dword [edx + 0x100], ecx
push edx
cdq
pop edx
cld
mov dword [eax + 0x2c], esp
clc
cld
push 0
pushal
inc eax
popal
cld
cld
push 0
push eax
pop eax
nop
push 0
nop
lea esp, [esp]
stc
clc
push 0
push 0x30
cld
lea esp, [esp]
clc
nop
push 0x20
push 0
nop
stc
push 0
add edx, 0xffff7f32
stc
and bh, 0xff
stc
push edx
pushal
inc eax
popal
cld
push edx
and bh, 0xff
cld
cld
push 0
call dword [edx + 0x8211]
add esp, 0x3f8
cld
stc
xor eax, eax
clc
push es
pop ds
stc
inc eax
stc
nop
ret 0xc
Function at 0x7ffe8354
Capabilities:
64-bit execution via heavens gate
Encode data using xor

Disassembly:
pop eax
nop
add eax, 0
cld
add eax, 0x19
pushal
inc eax
popal
cld
mov byte [eax], 5
add eax, 0
stc
add eax, 0xf900c083
inc esi
dec esi
cld
call 0x7ffe8354
pushal
inc eax
popal
push eax
pop eax
cld
add eax, 5
cld
mov ecx, eax
call 0x7ffe831b
clc
cld
cld
pop eax
stc
cld
add eax, 0x15
cld
lea esp, [esp]
clc
mov byte [eax], 5
and bh, 0xff
stc
call 0x7ffe84d6
lea esp, [esp]
cld
clc
nop
clc
add eax, 5
cld
add eax, 0
nop
cld
xchg ecx, eax
cld
sub ecx, eax
xor byte [eax + ecx], 0x73
inc esi
dec esi
cld
loop 0x7ffe8349
clc
cld
pop ecx
wait
jae 0x7ffe83cb
jae 0x7ffe83cd
sub esi, eax
mov bl, 0x74
mov ch, 0x73
jbe 0x7ffe82fd
invalid
sub esp, dword [ebx]
wait
jae 0x7ffe8443
jae 0x7ffe8445
sub esi, dword [ebp - 0x648989cd]
aaa
mov esp, 0xb3f08c8c
jns 0x7ffe83da
mov word [eax + esi*8 + 0x36fa79b3], cs
xchg edi, eax
xchg edi, eax
sub ecx, edx
jae 0x7ffe845a
jae 0x7ffe83e1
push es
xchg edi, eax
dec dh
add dword [edx - 0x297f7374], 0xfffffff8
xchg edx, edi
test bh, 0x8b
mov word [eax + edi*8 - 0x737ad802], cs
mov word [eax + 0x3e], ds
xchg edx, edi
mov esp, dword ds:[edx]
and al, 0x23
ret
mov dl, 0x9a
outsd dx, dword [esi]
wait
jae 0x7ffe84bc
jae 0x7ffe84be
sub esi, dword [eax - 0x4e]
mov word [ebx - 0x34d5d4d8], ss
jb 0x7ffe84c9
jae 0x7ffe84cb
mov edx, 0x2a2b28b0
sub byte [ebx], ch
sub cl, dl
pushal
jae 0x7ffe84d4
sub ebp, dword [edx]
retf 0x7360
jae 0x7ffe845b
invalid
mov word [eax + esi*8 - 0x6b2894d], cs
xor esi, dword [ecx - 5]
test byte [eax + eax*4 - 0x9077374], 0x9f
or byte [esp + ecx*4 - 0x7adc1974], 0x8c
invalid
invalid
mov word [eax + edi*8 - 0x737d600a], cs
mov word [esi - 0x73737add], cs
jg 0x7ffe853e
clc
neg byte [edi - 0x7373737e]
out 0x23, al
test dword [esp + ecx*4 + 0x62d2657f], ecx
add byte [edx], al
shl byte [edx - 0xd], cl
add byte [edx], al
pop ds
push ds
rol dword [edi + 0x101b0ca1], 1
sbb eax, 0x8f1c0e03
sbb al, 0x3f
add eax, 0xdb94831b
push cs
push ds
push cs
xchg byte [edi + 0x64a71263], cl
adc eax, 0x9c375d91
ficomp word [esp + ebx]
adc eax, 0xff4f8995
test al, 0x5c
invalid
inc ebx
lahf
inc eax
xor eax, 0xb49e636
iretd
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x18
mov eax, dword [0x634038]
mov edx, dword [0x63403c]
mov dword [esp + 0x14], 0
push esi
lea ecx, [eax + eax]
push edi
or ecx, edx
lea edx, [esp + 0x10]
mov dword [esp + 0x18], ecx
push edx
fild qword [esp + 0x1c]

Function at 0x487ea1
Capabilities:
Encode data using xor

Disassembly:
pop ds
mov byte [0x51d38ad], al
imul ecx, dword [eax + 0x29], 0x48
push ecx
cmp dl, byte [esi - 0x4e]
adc ah, bh
push esi
mov dl, 0x10
cld
das
cmp al, 0x96
cmp ebp, 6
mov edi, 0x721603b2
pop esi
push esp
in eax, 0x23
inc edx
lcall 0x6cd5, 0x19a1ce4
adc eax, dword [edx]
mov ebp, 0x58e59db6
jo 0x487e87
jmp 0x487ed3
pop edx
rol eax, 1
jle 0x487efb
dec edi
daa
xchg ecx, eax
imul ecx, edx, 0x7a
mul ch
jl 0x487e77
out dx, eax
salc
in al, 0xeb
in al, dx
js 0x487e4d
jmp 0x487e78
mov ah, 0xac
inc eax
xor ebp, dword [0x643de13d]
std
popal
jg 0x487e47
jae 0x487e8a
dec esp
cmp al, byte [eax - 0x79e8080e]
not dword [edi]
xchg bh, dl
aaa
shr dword [ecx - 0x26], 0xca
mov dword [ecx - 0x5b7d9417], ebx
or dl, al
mov bl, 0x76
jb 0x487e53
mov al, byte [0x3fe8f98a]
stosd dword es:[edi], eax
inc ebx
mov bl, 0x32
inc edx
adc byte [ecx + 0x73], cl
in al, dx
arpl word [edx], si
and ecx, ecx
mov esp, gs
sub ecx, 0xe54b96d4
jbe 0x487f3d
out 0x89, eax
cmpsd dword [esi], dword es:[edi]
push ecx
in al, dx
pop ss
rcl dword [edx + 0x33], cl
xchg esi, eax
push cs
xchg ebp, eax
and ch, byte [ebp - 0x46338218]
cmp al, 0xf8
and ch, dh
pop ebp
pop ebp
xchg dword [eax + ecx*4 - 0x44], ebx
jo 0x487f08
int 0xb6
mov ebx, 0x32b699d6
and dword [edx + 7], eax
inc edx
pop es
mulps xmm4, xmmword [ebp + 0x65e9db4]
and dword [eax + 0x1f747f15], ebp
jg 0x487f7e
pop ds
stc
fiadd dword [edx]
sbb eax, dword [esi - 0x58]
sbb eax, 0xf4c46ea
jb 0x487ed6
clc
stc
popal
mov ch, 0xa
bound edx, qword [edi]
shr dword [ebx], 0xcb
add bh, byte [ecx + 0x11c0f155]
js 0x487f74
jmp 0x487f85
push ecx
and al, 0xcf
xchg dword [ecx + ebp*8 - 0x5bd9a865], eax
adc al, 0xe3
sti
dec ebp
lea edx, [ecx - 0x2d4c750f]
mov bl, 0x27
fyl2x
jmp dword [ebx + 0x55d8b9f6]
test byte [0x798ebfff], bh
loopne 0x487fd5
inc eax
adc edi, dword fs:[ebx + 0x76]
adc edi, dword [ebx + 0x76]
and byte [0xf1d98d0e], dh
fyl2x
xchg esp, eax
sbb cl, byte [ecx + 0xb]
arpl word [edi - 0x1b5ebfd5], cx
xor eax, 0x1f82c81d
dec ecx
mov bl, 0x97
xor al, 0xe5
lcall 0x3cb7, 0xbf283929
in al, dx
insb byte es:[edi], dx
pushfd
xor al, 0x76
dec esi
pop eax
out 0x5f, eax
invalid
imul ecx, dword ds:[edi], 0xffffff83
bound ebp, qword [ebx + 0x1f]
xchg cl, bh
iretd
Function at 0x408b7d
Capabilities:
Terminate process

Disassembly:
push 0xc
mov eax, 0x44e382
call fcn.00437c8f
mov ebx, ecx
lea esi, [ebx + 0xa0]
mov eax, dword [esi]
cmp eax, 1
jne 0x408ba6
cmp dword [ebx + 0x90], 0
jne 0x408ba6
call fcn.00408d0e
mov esi, dword [esi]
cmp esi, 1
jge 0x408bcc
push 0xbd2
lea eax, [ebp - 0x18]
push eax
call fcn.00403d1e
and dword [ebp - 4], 0
lea eax, [ebp - 0x18]
mov ecx, 0x46c7a8
jmp fcn.0040ce8d
dec esi
cmp dword [ebx + 0x90], esi
je 0x408be7
push 0
push 0
push 0x8002
push dword [ebx + 0x20]
call dword [0x4505c8]
call fcn.00437d67
ret

Function at 0x408d0e
Capabilities:
Terminate process

Disassembly:
push 0x2c
mov eax, 0x44e35d
call fcn.00437c8f
lea ecx, [ebp - 0x10]
call fcn.00401b86
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x457638
mov ecx, 0x46c924
call fcn.0042809c
test eax, eax
jne 0x408d5c
push 0xbd3
lea eax, [ebp - 0x24]
push eax
call fcn.00403d1e
mov byte [ebp - 4], 1
lea eax, [ebp - 0x24]
mov ecx, 0x46c7a8
jmp fcn.0040ce8d
lea ecx, [ebp - 0x38]
call fcn.0042dc70
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x45764c
lea edi, [ebp - 0x38]
call fcn.0040155a
mov byte [ebp - 4], 3
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.0040496c
mov byte [ebp - 4], 4
mov byte [ebp - 4], 2
call fcn.004122e3
mov edi, dword [ebp - 0x30]
xor esi, esi
inc esi
cmp edi, esi
pop ecx
pop ecx
jbe 0x408e13
test esi, esi
jl 0x408e31
cmp esi, dword [ebp - 0x30]
jge 0x408e31
mov eax, dword [ebp - 0x34]
lea eax, [eax + esi*4]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x408e0e
push 0x457650
push eax
call fcn.004098ad
test al, al
pop ecx
pop ecx
je 0x408ddb
push ebx
call fcn.00408f7a
jmp 0x408df7
cmp esi, dword [ebp - 0x30]
jge 0x408e31
mov eax, dword [ebp - 0x34]
lea eax, [eax + esi*4]
push 0x455c60
push eax
call fcn.004098ad
test al, al
pop ecx
pop ecx
jne 0x408e0e
cmp esi, dword [ebp - 0x30]
jge 0x408e31
mov eax, dword [ebp - 0x34]
lea eax, [eax + esi*4]
push eax
lea ecx, [ebx + 0x98]
call fcn.00409c3b
inc esi
cmp esi, edi
jb 0x408da7
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x38]
call fcn.0042de21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00401bc0
call fcn.00437d67
ret
jmp fcn.00428fb9
Function at 0x419510
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov dl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x41955b
movzx esi, dl
push edi
nop
mov ecx, dword [eax + 0x260]
mov edi, ecx
shr edi, 0x18
shl ecx, 8
xor edi, esi
xor ecx, dword [edi*4 + 0x466040]
mov dword [eax + 0x260], ecx
mov ecx, dword [ebp - 4]
add ecx, ebx
cmp ecx, dword [eax + 0x38]
mov dword [ebp - 4], ecx
jl 0x419530
pop edi
mov ecx, dword [eax + 0x34]
mov byte [eax + ecx + 0x58], bl
mov esi, dword [eax + 0x38]
mov ecx, esi
sub ecx, ebx
je 0x4195e9
sub ecx, ebx
je 0x4195cb
sub ecx, ebx
je 0x4195bf
mov byte [esi + eax + 0x54], bl
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov dl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
sub dl, 4
mov byte [esi + ecx], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
mov ecx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov ecx, dword [eax + 0x24]
mov byte [ecx + esi], dl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret