joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102154af
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102d2084]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10208f33
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10208f33
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10215526
cmp word [ecx], dx
je 0x10215526
mov eax, dword [0x102affec]
push edi
dec eax
push eax
push 0x102afed8
call fcn.1021544e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10215599
cmp word [eax], dx
je 0x10215599
mov eax, dword [edi]
test eax, eax
je 0x1021554a
cmp word [eax], dx
je 0x1021554a
lea eax, [ebp - 0x10]
push eax
call fcn.10214e31
jmp 0x10215553
lea eax, [ebp - 0x10]
push eax
call fcn.10214ecc
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x102155c3
mov eax, dword [0x102afed4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x102afbc8
call fcn.1021544e
add esp, 0xc
test al, al
je 0x102155c3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1021558e
cmp word [eax], di
je 0x1021558e
lea eax, [ebp - 0x10]
push eax
call fcn.10214e31
pop ecx
jmp 0x102155c5
lea eax, [ebp - 0x10]
push eax
call fcn.10214ecc
jmp 0x1021558b
mov eax, dword [edi]
test eax, eax
je 0x102155b0
cmp word [eax], dx
je 0x102155b0
lea eax, [ebp - 0x10]
push eax
call fcn.10214de6
pop ecx
jmp 0x102155c3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1021568e
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.102152d3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1021568e
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1021568e
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1021568e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1021561b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1020d6ec
test ebx, ebx
je 0x10215689
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1020d6ec
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021568e
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1021568e
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1021a2fd
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10215690
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f065f
leave
ret
Function at 0x1021a9e1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1021a95d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1021ab50
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1021ab50
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1021ab05
jg 0x1021aa3d
test eax, eax
je 0x1021aafb
push 1
push 0x1000
call fcn.1020ad65
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1021aa60
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1021aaf2
push 0x8000
push ebx
call fcn.1021a88e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1021aa89
jg 0x1021aa84
cmp ecx, 0x1000
jb 0x1021aa89
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1020b7cb
add esp, 0x10
cmp eax, 0xffffffff
je 0x1021aace
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1021aa84
jl 0x1021aab5
test ecx, ecx
jne 0x1021aa76
push dword [ebp - 0xc]
push ebx
call fcn.1021a88e
push esi
call fcn.1020b9e7
add esp, 0xc
xor ebx, ebx
jmp 0x1021ab5e
cmp byte [edi + 0x24], 0
je 0x1021aae5
cmp dword [edi + 0x20], 5
jne 0x1021aae5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1021aaf0
mov ebx, dword [edi + 0x18]
jmp 0x1021aaf2
xor ebx, ebx
push esi
call fcn.1020b9e7
pop ecx
jmp 0x1021ab5e
test ecx, ecx
jg 0x1021aac7
jl 0x1021ab05
test eax, eax
jae 0x1021aac7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1020e7e2
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1021ab25
cmp byte [edi + 0x1c], 0
je 0x1021aac7
jmp 0x1021ab56
push ebx
call fcn.10215a69
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1021aac7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1021ab5e
cmp byte [edi + 0x1c], 0
je 0x1021ab5b
mov ebx, dword [edi + 0x18]
jmp 0x1021ab5e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1020e7e2
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1021b680
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1021b6ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1021b6ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x4f42f10
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0xf5e4a0e
nop
nop
nop
nop
nop
test eax, eax
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x77bebceb
Capabilities:
Encode data using xor

Disassembly:
jmp 0x34ec8eba
idiv dword [edi - 0x44]
imul byte [ebp - 0x4a5228d4]
movd esi, mm6
mov esp, 0xd72cadf6
lodsd eax, dword [esi]
sub al, 0xd7
lodsd eax, dword [esi]
mov ch, 0xf
jle 0x77bebced
fdivrp st(5)
pop ebx
pop ds
mov ss, word [edi + 0x255c2372]
xlatb
xor al, 0xf8
out dx, al
in eax, 0x77
mov edi, 0x5edfeafd
clc
jl 0x77bebcef
loopne 0x77bebcca
mov dl, 0x9a
ret

Function at 0x77befca2
Capabilities:
Encode data using xor

Disassembly:
bound ebx, qword [edx + 0x65]
test al, 0xe4
cmp dword [edx + 0x2a3557e1], ebp
test byte [ebx - 0x69], 0xe3
wait
push 0x6e
adc bl, byte [edx - 0x74e9f62f]
aas
scasd eax, dword es:[edi]
enter 0x1612, 9
inc eax
scasd eax, dword es:[edi]
enter 0x2612, 0xfffffffffffffff4
and bl, al
xor al, byte [ecx - 0x2355eb17]
mov ebp, 0x772a813c
das
dec edi
stosd dword es:[edi], eax
dec ebx
stosd dword es:[edi], eax
popfd
popal
lcall 0x788, 0x13e12344
mov dword [0x1d2cd075], eax
test al, 0x4b
inc esp
mov cl, 0xf0
sub eax, 0x587bb2a8
and ebp, dword [edx - 0x56c9e114]
or eax, 0xcf528a65
invalid

Function at 0x77bfed8d
Capabilities:
Encode data using xor

Disassembly:
das
iretd
aaa
loopne 0x77bfed8b
sbb al, 0x63
cmp byte [ebx + ebx*2 - 0x5d41faea], al
cmp byte gs:[ecx - 0x53cae411], ch
fmul dword [ebx + esi*2 + 0x2e]
insb byte es:[edi], dx
pop ecx
cmpsb byte [esi], byte es:[edi]
pop ebx
sub esp, dword [esi]
arpl word [esi*4 + 0x2e680d0b], ax
insd dword es:[edi], dx
sub eax, 0x7ffbacab
pop ecx
or ebx, dword [eax + 0x1cefc55c]
and dword [edi + 0x5b], esi
mov cs, word [edx + ecx*2]
invalid

Function at 0x77c01fbd
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x56ea35de
shr byte [esi - 0x4894f3fb], cl
jo 0x77c02023
and al, dl
test al, 0xc6
add bl, ch
inc esp
outsb dx, byte [esi]
in eax, dx
xchg edi, eax
sal byte [eax + 0x38], cl
aam 0x9b
sti
or bh, bh
dec edi
lcall 0xc09b, 0x2732f6dc
xor dword [edi - 0x4f], ebp
xlatb
mov cl, 0xd7
pop edi
or edx, 0x2c8319d
jg 0x77c0200d
pop ebx
jbe 0x77c0206a
sub byte [esi + 0x4daa6d49], dl
insd dword es:[edi], dx
sbb eax, dword [0xd3089ec0]
inc ecx
test eax, 0x213d9642
pushal
fmul qword [ebp + 0x40ece2dd]
jg 0x77c0207c
sti
pop edi
mov ch, 0x84
dec ebp
add ebp, dword [ebp - 0x7b9662d4]
imul eax, dword [edx + ebx*4 + 0x4a1da170], 0x32e64ecb
mov ah, 0xdc
lahf
jge 0x77c020c5
aaa
mov dl, al
mov ebp, 0x716cd0f4
sar byte [ebp + 0x716cd0f4], 1
adc al, 0x3d
out 0x8c, al
shl byte [ebp + 0x61], 1
xor dword [edi + esi*4], ebx
push es
xchg ebx, esi
invalid
invalid
fistp word [eax - 0x6b]
mov ch, 0xd
push esp
pop esi
add eax, 0x5ad8f842
popal
mov word [ebp + 0x5d], cs
jmp 0x77c020d5
Function at 0x77c02c70
Capabilities:
Encode data using xor

Disassembly:
salc
push ebx
or dword [eax], ebp
push ss
test dword [ebp - 0x7f], edx
nop
mov eax, 0xe0df3193
les ebx, [ebx + 0x644317fe]
xor dword [esi - 0x43480fc8], ebx
inc ebx
xor dword fs:[esi - 0x43480fc8], ebx
invalid
or byte [ecx + 0x7d50af06], 0x9a
sub dword [edx + 0x6825a4fa], 0x9990a5a2
jp 0x77c02c61
inc esp
sub ch, cl
cmp bl, byte [esi + 0x5fb454c1]
test byte fs:[esi + 0x39], cl
xor byte [esi], bl
and dl, ch
mov dword [0x1f69ff31], eax
mov byte [esi - 0x4de4b27d], 0xe6
dec esi
jge 0x77c02bf8
inc edx
loope 0x77c02c6c
jg 0x77c02ca1
jbe 0x77c02c23
in al, 0x3b
pop edx
in eax, dx
invalid
mov edx, 0x6b0dbf03
scasb al, byte es:[edi]
cmp byte [edi + 0x4513df42], ch
inc ebp
loop 0x77c02c0f
and al, 0x13
jns 0x77c02cda
adc edi, dword [ecx + 0x67]
in eax, 0x4b
jb 0x77c02c0a
cmp dword [ecx + ebp*4 + 0x56], edi
inc edx
or byte [ebp + 0x3c], 0x38
mov eax, dword [0x405bb247]
lahf
dec esp
dec esp
jecxz 0x77c02cd0
dec edx
dec edi
inc edx
cmp byte [0x1cee19c0], ch
iretd
jno 0x77c02cbe
cmpsd dword [esi], dword es:[edi]
adc eax, 0x71a46026
scasd eax, dword es:[edi]
mov word [0x5afd38c0], gs
mov byte [0xad0346fd], al
mov ebx, 0x825dc542
sub ch, cl
enter 0x161, 0x5d
imul edi, dword [eax + 0x19], 0x64
sub eax, 0x1cc076dc
popal
add dword [ebp + 0x6b], ebx
js 0x77c02cdd
sub eax, 0x1cc076dc
stc
inc ebx
arpl word [edx + 0x24], si
test dl, 0xe7
clc
and eax, 0x23c323a7
invalid
retf 0xf8e7
pop eax
daa
pop edx
xor edx, ebp
retf 0x86aa

Function at 0x77c04ae6
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x3bdfac06
pop ebx
aam 0x5c
push edx
jbe 0x77c04b60
in eax, dx
invalid
cmpsd dword [esi], dword es:[edi]
dec ebx
arpl word [esi - 0x41], si
dec edx
mov dl, 0x69
insb byte es:[edi], dx
cld
pushal
cld
mov ecx, cs
push edx
jb 0x77c04b8d
iretd
dec ebp
loop 0x77c04b7c
aaa
and eax, 0xd967e9b3
outsd dx, dword [esi]
insd dword es:[edi], dx
pop esp
ja 0x77c04b88
xchg ebp, eax
loopne 0x77c04b91
jg 0x77c04b45
ljmp 0xd2d7:0x22d8c406
pop esp
jmp 0xc0bccade
lahf
dec esi
ret 0x9b99
mov ch, 0x3e
cmpsd dword [esi], dword es:[edi]
xor dword [esi + 0x7a], esp
push edx
jp 0x77c04be6
inc ebp
inc ebp
outsd dx, dword [esi]
mov byte [0x892819c0], al
or dh, dh
loopne 0x77c04c1d
adc byte [esi - 0x27e2a06d], cl
jmp 0xa2b3f866
aas
push ds
or dword [ebp + esi - 0x2e], edi
pushal
invalid
sbb edi, 0x79
or al, 0x43
retf

Function at 0x77c04fb8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
rcl dword [esi - 0x4e], 0xd4
test eax, 0x6c393cc4
mov eax, 0x6dd2524f

Function at 0x77c04fc6
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push esp
inc ebp
sbb al, bh
in al, dx
outsd dx, dword [esi]
invalid
add al, 0xae
dec edx
scasb al, byte es:[edi]
inc esp
jmp 0x77c04f58
Function at 0x77c04fd4
Capabilities:
Encode data using xor

Disassembly:
invalid
and byte [0x2443a4fe], bl
push 0x36e9d176
mov cl, 0xb2
cmp al, 0x8b
push esi
or byte [ebx], ch
jecxz 0x77c0504b
pop esi
int1
and eax, 0x8b2c1f6b
and al, 0x67
push edi
out 0xca, eax
in eax, dx
aam 0x8c
clc
loop 0x77c04f9e
mov ch, 0xa9
mov byte [0x6488bd02], al
scasd eax, dword es:[edi]
mov al, byte [0xdb11520e]
mov word [ebp - 3], fs
fdivr st(0)
adc edi, dword [0xefcdd12f]
xchg byte [eax + 0x6687a3d1], ah
sub bl, cl
invalid
sbb byte [esi], bl
rcl byte [ebp - 0x5b], 0xb5
mov al, byte [0x306e30eb]
and byte [ebp + 0x61], dl
in al, 0x17
adc eax, 0x5345b079
pop edx
sbb esp, dword [eax]
lodsd eax, dword [esi]
mov edx, esp
jp 0x77c05078
mov ds, esp
cmpsb byte [esi], byte es:[edi]
js 0x77c0506a
invalid
insd dword es:[edi], dx
xchg ebx, eax
dec ebp
push cs
sbb esi, dword [ebx + 0x6c32b8fd]
loopne 0x77c05032
jge 0x77c050e5
in eax, 0xd
call 0xc4bd7472
and dl, byte [eax]
clc
add bh, byte [0xbe3fce93]
sbb byte [ecx - 0x23a6acd8], cl
mov edi, 0xd1c79ff5
cmp eax, 0x5e8e6676
mov byte [0xd644504e], al
pop ecx
xchg ecx, eax
sub eax, 0xf4fdc9b0
mov bl, 0x8c
sub al, bl
and ecx, esi
add ebp, eax
pop eax
fldcw word [edi - 0x4d4bdbec]
xor eax, ebp
push 0x65551157
lds ebp, [eax + 0x57]
adc dword [ebp + 0x65], edx
dec edx
mov esi, 0xe8a12448
lahf
mov dword [0xcc38693e], eax
sbb byte [esi - 0x33e3a41c], 0xfb
retf
clc
push ebp
jg 0x77c050b6
push 0x1a076d86
jns 0x77c050a1
xor bh, ah
dec esi
push ds
xor eax, 0x9c01215a
add eax, 0x2a3c468f
xor cl, byte [ecx]
sub al, cl
xor esi, 0xffffffd3
sub dl, byte [edx - 0x6b885518]
mov dword [esi - 0x59], ebp
mov al, 0xa
xchg esi, eax
xor byte [esi], 0xce
popfd
or al, 0xa7
jo 0x77c0510e
or eax, 0xe5630295
mov eax, 0x5c90c284
mov ah, 0x6a
pop ebp
popfd
das
mul dword [esi]
mov bl, 0x55
add dword [ebx], ebp
std
jae 0x77c0518f
test eax, 0x49452d5b
hlt

Function at 0x77c0a519
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
xor dword [eax + 0x3c008628], esi
daa
ret 0x24a5
sub dword [0x9debbdc0], eax
jl 0x77c0a4e1
lodsd eax, dword [esi]
push ecx
jle 0x77c0a58d
mov bh, 0xe9
xlatb

Function at 0x77c10697
Capabilities:
Encode data using xor

Disassembly:
or al, byte [ebx + 0x117e67d1]
push esp
mov ecx, 0x233dd3b4
and eax, 0xe21b4601
cmp eax, 0x46012523
sbb esp, edx
dec byte [0x9e26424e]
pop ebx
js 0x77c106a1
or dword [ecx], 0x2b
and al, 0xd5
mov bl, 0x9f
xchg esp, eax
inc edi
inc esi
inc edi
and byte [edi + 0x72309cd2], 0xe0
in eax, 0x16
xor esp, dword [ebp - 0x5e]
mov ebx, 0x283897bf
add eax, 0xd45db3c0
add ecx, dword [edx + 0x5553e738]
sub al, 0x93
mov byte [0x72b6129f], al
and al, 0xa4
pop ebx
aaa
imul edx, dword [0x94035f7a], 5
mov edx, 0x3ef5adae
frstor dword [edi - 0x19]
or eax, 0xc8631a8d
sbb ebx, ebx
jge 0x77c106a6
stosd dword es:[edi], eax
cli
push 0xe428d3ff
fsub qword [edi - 0x6a]
jmp 0x7548c348
Function at 0x77c10e76
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
mov ebp, 0x7ffc9fcc
rcr byte [ebx - 0x59], 0xe7
mov gs, edi
imul esp, dword [edx], 0x174d7f21
mov esp, 0xfbd595
aas
call [ebp + 0x4afc1f9b]
adc ch, byte [edi]
stc
push edi
movsd dword es:[edi], dword [esi]
cwde
push 0xcd3f5002
salc
stosd dword es:[edi], eax
xlatb
jnp 0x77c10ef3
ret
xor edx, ecx
inc ebx
lodsd eax, dword [esi]
push esp
jne 0x77c10efa
and eax, 0xa38d0aa6
mov edi, 0x183da043
out 0xe6, eax
call 0x61a65f59
or al, 0x60
jecxz 0x77c10eb2
dec ebx
mov al, 0x37
xchg esp, eax
invalid

Function at 0x77c164bf
Capabilities:
Encode data using xor

Disassembly:
pop ebp
enter 0x3dc8, 0x73
xor ecx, ecx
in al, dx
sar bl, 1
outsd dx, dword [esi]
mov byte [ebx], bl
add eax, 0x842cfd45
sbb eax, 0x32a82e1f
xchg esi, eax
inc ebx
scasb al, byte es:[edi]
mov dl, 0xac
xor dl, byte [esi - 0x534d51bd]
aas
aam 0xb5
pop ebp
adc byte [ecx - 0x6192b05d], dh
je 0x77c164a2
mov dh, 0x32
enter 0x7d99, 0x7f
dec ecx
jae 0x77c164b8
push edi
push edx
retf

Function at 0x77c16b82
Capabilities:
Encode data using xor

Disassembly:
mov edi, dword [eax - 0x6a517f64]
invalid
xor cl, byte [eax]
bound eax, qword [0x1866ce58]
and ebp, dword [edi - 0x15]
nop
call 0x4e0ac4c5
or al, 0xb8
outsb dx, byte [esi]
rcr dword [esi + 0x11], 1
das
mov fs, edx
mov eax, 0x94a32477
jne 0x77c16b5b
ret 0x553f

Function at 0x77c1cf40
Capabilities:
Encode data using xor

Disassembly:
pop eax
shr ch, 1
add al, bh
push 0x9e136810
jle 0x77c1cef5
invalid
and byte [edi], 0x3e
xchg esi, eax
cmpsd dword [esi], dword es:[edi]
invalid
cdq
and al, 0x6a
rcl ah, 1
std
mov bl, byte [esi + 0x7664e408]
mov cl, 0xbe
out 0x55, al
sub ecx, dword [ecx + 0x27]
sahf
or ah, ah
jbe 0x77c1cec2
mov esi, 0x492b55e6
daa
fcomp st(1)
xor byte [edx - 0x5035c1d6], 0x6a
jle 0x77c1cf6e
shl byte [ebx - 0x2b], 0x2d
cmpsd dword [esi], dword es:[edi]
mov ah, dh
invalid
test al, 0x84
xor esp, dword [ecx - 0x3b]
pushal
pop es
invalid
sub al, 0x71
mov ecx, 0x28e95fd0
adc ebp, ebx
cld
clc
std
xchg esi, eax
jl 0x77c1cf0b
cmp ebx, edi
mov ecx, 0xad0b0ba2
pop ds
mov al, byte [0xafa45760]
scasd eax, dword es:[edi]
pushal
mov word [esi + 0x57], gs
push cs
xchg edx, eax
sti
adc dword [edx + 0x1a9edf99], 0xffffffc3
movsd dword es:[edi], dword es:[esi]
mov byte [ebx - 0x1d], dh
xchg esp, eax
jecxz 0x77c1cf04
mov ch, 0xe
xor dh, bl
sbb ch, ah
ja 0x77c1cf2d
leave
clc
adc dl, al
jnp 0x77c1cf5b
xchg esi, eax
retf 0x8a32
Function at 0x401dce
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00401f7e
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x401ecc
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x401e6f
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x401eb2
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x401e86
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x401ea1
test al, 0x40
je 0x401e98
mov ecx, dword [edi + 0x20]
jmp 0x401e9f
test al, 0x80
je 0x401eb2
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x401eb2
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x401e3e
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x40ab60
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045fb60
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40abe2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0045d90d
mov eax, dword [eax]
push 0x4a01d0
push eax
call fcn.0044fd94
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045fdeb
test bl, bl
je 0x40abe2
push 0x4a01d0
lea ecx, [esp + 0xc]
call fcn.0046017b
push 0x4a3d4c
lea ecx, [esp + 0xc]
call fcn.0046017b
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40ac1e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045fdeb
jmp 0x40ace9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40aca2
lea edx, [esp + 0x7c]
push 0x4a3d48
push edx
call fcn.0044fd94
add esp, 8
test eax, eax
je 0x40aca2
lea eax, [esp + 0x7c]
push 0x4a3d44
push eax
call fcn.0044fd94
add esp, 8
test eax, eax
je 0x40aca2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40ac32
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045fdeb
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40b4e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b542
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40b550
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x46b44b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x4aa6d0]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40b688
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40b5b6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fdeb
xor eax, eax
jmp 0x40b6ff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045ff28
push esi
lea ecx, [esp + 0xc]
call fcn.004601b7
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40b6dd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.0040b4e0
test eax, eax
jne 0x40b6dd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.0040b4e0
test eax, eax
jne 0x40b6dd
lea eax, [esp + 0x14]
push 0x4a3d60
push eax
call fcn.00450dd0
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b6bc
lea ecx, [esp + 0x14]
push 0x4a3d5c
push ecx
call fcn.00450d50
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b6bc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40b6bf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045fed8
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40b5ce
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045fdeb
xor eax, eax
jmp 0x40b6ff
mov byte [esi], 0
push 0x4a3d58
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045fdeb
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4