joyce8/EMBER2024-capa huggingface dataset:
Function at 0x99a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.0099a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x99a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a06a
add dl, dl
jne 0x99a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a0dc
xor eax, eax
add dl, dl
jne 0x99a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x99a17d
add dl, dl
jne 0x99a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x99a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x99a075
mov eax, 1
add dl, dl
jne 0x99a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x99a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a0e1
sub eax, ebx
mov ebx, 1
jne 0x99a128
mov ecx, 1
add dl, dl
jne 0x99a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x99a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x99a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x99a136
cmp eax, 0x7d00
jae 0x99a16d
cmp eax, 0x500
jb 0x99a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
cmp eax, 0x7f
ja 0x99a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x99a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x99a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x99a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x404b40
Capabilities:
Encode data using xor

Disassembly:
inc ebx
xor ebp, dword [0x30313032]
arpl word cs:[edx + 0x6c], si
xor byte [esi + eax + 3], al
push ebp
sbb eax, 0x303d0420
cmp esi, dword [eax]
cmp dword [esi], eax
or esp, dword [eax - 0x7a]
dec eax
add dword [esi + 0x70145f8], eax
pop ss
add esi, dword [eax]
sub dh, byte [eax]
sub byte [esi], al
or byte [ebx], ch
push es
add dword [0x1020705], eax
push ss
sbb al, 0x68
je 0x404bec
jo 0x404bed
cmp ch, byte [edi]
das
ja 0x404bf6
ja 0x404baf
jbe 0x404be8
jb 0x404bee
jae 0x404bf0
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
das
jb 0x404c00
popal
xor byte [ebx], dl
push es
add edx, dword [ebp + 0x1d]
and eax, 0xa300c04
push es
or byte [ebx], ch
push es
add dword [0x3030705], eax
xor byte [ecx + 6], dh
or byte [ebx], ch
push es
add dword [0x1010705], eax
pop es
add dword [ecx], eax
add al, 0x65
xor byte [ebx + 0x30], ah
and al, 6
or byte [ebx], ch
push es
add dword [0x1300705], eax
xchg byte [eax], bl
push 0x3a707474
das
das
outsd dx, dword [esi]
arpl word [ebx + 0x70], si
jbe 0x404c37
jb 0x404c3d
jae 0x404c3f
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
xor byte [ebx], bh
push es
or byte [ebx], ch
push es
add dword [0x2300705], eax
xchg byte [edi], ch
push 0x3a707474
je 0x404c5e
jo 0x404c29
cmp ch, byte [edi]
das
das
arpl word [ebx + 0x63], si
xor ebp, dword [0x30313032]
xor dh, byte [eax]
xor dword [eax], esi
sub eax, 0x2e616961
jbe 0x404c66
jb 0x404c6c
jb 0x404c6c
jae 0x404c6e
outsb dx, byte [si]
arpl word cs:[edi + 0x6d], bp
insd dword es:[edi], dx
das
inc ebx
push ebx
inc ebx
xor ebp, dword [0x30313032]
arpl word cs:[ebp + 0x72], sp
xor byte [edi], bl
push es
add edx, dword [ebp + 0x1d]
and eax, dword [eax + ebx]
xor byte [esi], dl
adc byte [edi + ecx*8], 0x99
test eax, 0xf4267bea
dec ebx
leave
mov cs, word [edi + 0x2605f0d7]
out dx, eax
jecxz 0x404c0a
ljmp 0x8ec9:0x4bf4267b
shl byte [edi + 0x611309d], cl
cmpsd dword [esi], dword es:[edi]
popfd
xor byte [ecx], dl
push es
or dword [eax - 0x7a], esp
dec eax
add dword [esi + 0x10142f8], eax
xchg byte [eax + 1], cl
xchg al, bh
inc edx
add dword [ecx], eax
add al, 4
add eax, dword [edx]
add al, 0x10
xor byte [esi], dl
push es
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [ebx], ebx
add al, 8
xor byte [esi], al
push es
add dword [ecx], eax
add byte [ecx], al
add edi, edi
xor byte [0x862a0906], cl
or eax, 0x862a0906
dec eax
xchg bh, dh
or eax, 0x5050101
add byte [ebx], al
add byte [ecx], 1
add byte [edx - 0x4076fe8a], bl
pop ebx
scasd eax, dword es:[edi]
mov ecx, 0xeedd70ec
xchg ecx, eax
ljmp 0x44af
Function at 0x4349b0
Capabilities:
Encode data using xor

Disassembly:
loopne 0x4349af
cmp edi, dword ss:[edx]
cmp edi, dword [edx]
pushfd
push ebp
inc esp
imul ebp, esi, 0xfffffff8
pop ecx
pop esi
call 0x30d1b8d9
jae 0x434977
push esi
stosb byte es:[edi], al
mov ah, 0x20
scasd eax, dword es:[edi]
push esi
movsb byte es:[edi], byte [esi]
mov edi, 0xa8f80ba
pop esi
or dword [esi + ecx*8 - 0x3fc7f6ca], esp
sbb bh, byte [esi + 0x75d59ccc]
out dx, al
pushal
dec ecx
ja 0x434a25
cmp dword [edi*4 + 0x1a1afc9], ebp
mov ebp, 0x1a1afc9
push edx
jno 0x434978
jecxz 0x4349e1
xchg edx, eax
ret 0xa849
push ds
mov al, 0xef
repne stosd dword es:[edi], eax
dec esi
pop eax
push ss
enter 0x7532, 0xffffffffffffffe7
arpl sp, dx
sahf
pushal
dec ecx
in eax, 0x38
cld
test eax, 0xcb93ed7a
test dword [ebx + 0x4b], edx
jnp 0x4349b8
mov bh, 0x9f
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
jne 0x43499b
or esi, dword [ebx + edi]
out dx, al
inc esp
fsubrp st(2)
mov bl, byte [edi]
jne 0x434995
mov word [edi - 0x73d6073], gs
adc eax, 0x3f51ee07
mov ebx, 0xc4438ae8
les esp, [edx - 0x53]
test eax, 0x890a902b
xchg edi, eax
dec ecx
sub edx, dword [eax + 0x4997890a]
push 0x20183142
lcall 0x434, 0x207c9360
movsb byte es:[edi], byte [esi]
mov ebx, 0xb913997
inc ecx
mov dword [0x25a8c2c6], eax
inc edi
mov dl, 0x91
or edi, dword [edx]
jae 0x434a37
and byte [ebp - 0x5f7de99], dh
out 0x85, al
mov dl, 0xac
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x7a3326ce
push ebp
aas
mov ecx, 0xf61680be
push esi
invalid
Function at 0x40eee0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x114], 0
mov dword [0x446240], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, dword [ebp - 0x110]
mov eax, ebp
mov edx, 0
call fcn.0040f0c0
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x446240]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00402830
call sub.kernel32.dll_GetCommandLineA
mov dword [0x43b240], eax
mov esi, dword [0x43b240]
jmp 0x40f080
add esi, 1
movzx eax, byte [esi]
sub eax, 1
cmp eax, 0x20
jb 0x40ef70
cmp byte [esi], 0
je 0x40f089
mov byte [ebp - 0x10c], 0
mov edi, esi
mov dword [ebp - 0x110], 0
jmp 0x40efe5
mov al, byte [esi]
cmp al, 1
jb 0x40efdb
sub al, 0x20
jbe 0x40efac
sub al, 2
je 0x40efbf
jmp 0x40efdb
mov al, byte [ebp - 0x10c]
test al, al
je 0x40efea
add dword [ebp - 0x110], 1
jmp 0x40efe2
cmp byte [esi + 1], 0x22
je 0x40efd6
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40efe2
add esi, 1
jmp 0x40efe2
add dword [ebp - 0x110], 1
add esi, 1
cmp byte [esi], 0
jne 0x40ef9c
test dword [ebp - 0x114], 0xffffffff
je 0x40f079
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x114]
mov eax, ebp
call fcn.0040f0c0
mov byte [ebp - 0x10c], 0
mov esi, edi
mov eax, dword [0x446240]
mov edx, dword [ebp - 0x114]
mov ebx, dword [eax + edx*4]
jmp 0x40f071
mov al, byte [esi]
cmp al, 1
jb 0x40f067
sub al, 0x20
jbe 0x40f038
sub al, 2
je 0x40f04b
jmp 0x40f067
mov al, byte [ebp - 0x10c]
test al, al
je 0x40f076
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
jmp 0x40f06e
cmp byte [esi + 1], 0x22
je 0x40f062
mov al, byte [ebp - 0x10c]
test al, al
sete byte [ebp - 0x10c]
jmp 0x40f06e
add esi, 1
jmp 0x40f06e
mov al, byte [esi]
mov byte [ebx], al
add ebx, 1
add esi, 1
cmp byte [esi], 0
jne 0x40f028
mov byte [ebx], 0
add dword [ebp - 0x114], 1
cmp byte [esi], 0
jne 0x40ef73
mov ebx, dword [ebp - 0x114]
mov dword [0x446230], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x446240
call fcn.0040d320
mov eax, dword [0x446240]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417f90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0
mov ebx, 1
mov esi, 6
add esi, 1
sub esi, 1
movzx eax, byte [esi + 0x43bed0]
push eax
call sub.user32.dll_GetKeyState
movsx eax, ax
mov edx, ebx
and edx, eax
je 0x417fce
movzx edx, byte [esi + 0x43bee0]
mov eax, edi
or eax, edx
mov edi, eax
mov ebx, 0x8000
test esi, esi
jg 0x417fa8
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419de0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10c]
push ebx
push esi
push edi
mov edi, eax
mov dword [ebp - 0x10c], edx
test edi, edi
jne 0x419e34
push 0
push 0x105
lea eax, [ebp - 0x108]
push eax
push 0
call fcn.00417cc0
mov esi, eax
lea eax, [ebp - 0x108]
mov ebx, eax
mov eax, dword [ebp - 0x10c]
call fcn.00402d50
mov eax, dword [ebp - 0x10c]
mov edx, ebx
mov ecx, esi
call fcn.00408c50
jmp 0x419e8b
call fcn.00417cb0
mov ebx, eax
nop
mov eax, ebx
call fcn.00419d80
mov esi, eax
call fcn.00419da0
mov ebx, eax
sub edi, 1
test edi, edi
jge 0x419e3c
mov eax, ebx
sub eax, esi
cmp eax, 2
jl 0x419e6d
cmp byte [esi], 0x22
jne 0x419e6d
cmp byte [ebx - 1], 0x22
jne 0x419e6d
add esi, 1
sub ebx, 1
push 0
sub ebx, esi
mov eax, dword [ebp - 0x10c]
call fcn.00402d50
mov eax, dword [ebp - 0x10c]
mov edx, esi
mov ecx, ebx
call fcn.00408c50
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41bca0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
and dword [ebx + 0x24], 0xefffffff
test dl, dl
je 0x41bcb8
or dword [ebx + 0x24], 0x10000000
test dl, dl
je 0x41bcc2
or byte [ebx + 0x27], 0x10
jmp 0x41bcc6
and byte [ebx + 0x27], 0xef
cmp dword [ebx + 0x1c], 0
je 0x41bcfa
test dl, dl
je 0x41bce4
mov eax, ebx
call dword [0x43be90]
push 5
push dword [ebx + 0x1c]
call sub.user32.dll_ShowWindow
jmp 0x41bcfa
and byte [ebx + 0x37], 0xfe
push 0
push dword [ebx + 0x1c]
call sub.user32.dll_ShowWindow
mov eax, ebx
call dword [0x43be90]
pop ebx
leave
ret

Function at 0x41f610
Capabilities:
Check os version

Disassembly:
push ebx
cmp byte [0x43c020], 0xff
je 0x41f625
mov bl, byte [0x43c020]
jmp 0x41f69f
call sub.kernel32.dll_GetVersion
mov dl, al
mov cx, ax
and ecx, 0xffff
shr ecx, 8
and ecx, 0xff
test eax, eax
jl 0x41f66f
mov bl, 4
cmp dl, 6
jb 0x41f656
cmp cl, 1
jb 0x41f652
mov bl, 9
jmp 0x41f697
mov bl, 8
jmp 0x41f697
cmp dl, 5
jb 0x41f697
cmp cl, 1
jb 0x41f66b
mov bl, 6
cmp cl, 2
jb 0x41f697
mov bl, 7
jmp 0x41f697
mov bl, 5
jmp 0x41f697
mov bl, 1
cmp dl, 4
ja 0x41f680
cmp dl, 4
jne 0x41f690
cmp cl, 0xa
jb 0x41f690
mov bl, 2
cmp dl, 4
jne 0x41f697
cmp cl, 0x5a
jb 0x41f697
mov bl, 3
jmp 0x41f697
cmp dl, 3
ja 0x41f697
mov bl, 0
movzx eax, bl
mov byte [0x43c020], al
mov al, bl
pop ebx
ret

Function at 0x421740
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, eax
mov esi, edx
mov eax, esi
mov cx, 0
mov edx, 0x200
call fcn.00408430
push 0x200
mov eax, dword [esi]
push eax
push dword [ebx + 0xc]
call fcn.00417e30
mov edx, eax
mov eax, esi
mov cx, 0
call fcn.00408430
lea eax, [ebx + 4]
mov cx, 0
mov edx, 0x200
call fcn.00408430
push 0x200
mov eax, dword [ebx + 4]
push eax
push dword [ebx + 0xc]
call fcn.00417e10
mov edx, eax
lea eax, [ebx + 4]
mov cx, 0
call fcn.00408430
pop esi
pop ebx
leave
ret
Function at 0x424530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
je 0x424591
mov byte [ebx + 0x28], 0
push 0
push dword [ebx + 4]
call sub.kernel32.dll_TerminateProcess
push dword [ebx + 4]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0x14]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0x18]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0x1c]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 8]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0xc]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0x10]
call sub.kernel32.dll_CloseHandle
push dword [ebx + 0x24]
call sub.kernel32.dll_CloseHandle
mov dword [ebx + 4], 0
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x38]
push ebx
push esi
mov dword [ebp - 0x38], 0
mov eax, 1
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x18]
call fcn.0040ab00
call fcn.0040c370
push eax
test eax, eax
jne 0x4330c4
mov ebx, 1
sub ebx, 1
mov esi, esi
add ebx, 1
lea eax, [ebx*4 + 0x44701c]
mov edx, 0
call fcn.00407810
mov dword [ebx*4 + 0x44703c], 0xffffffff
cmp ebx, 7
jl 0x433038
call sub.kernel32.dll_GetThreadLocale
mov esi, eax
push 0xb
lea eax, [ebp - 0xc]
push eax
push 0x100b
push esi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x4330c4
push 1
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xc]
mov cx, 0
mov edx, 0xa
call fcn.004081d0
mov eax, dword [ebp - 0x38]
mov edx, 1
call fcn.0042c6b0
mov ebx, eax
sub eax, 3
cmp eax, 3
jae 0x4330c4
push 4
push ebx
push esi
mov eax, 0x432ec0
push eax
call sub.kernel32.dll_EnumCalendarInfoA
push 3
push ebx
push esi
mov eax, 0x432f60
push eax
call sub.kernel32.dll_EnumCalendarInfoA
call fcn.0040ad80
lea eax, [ebp - 0x38]
call fcn.00402d50
pop eax
test eax, eax
je 0x4330db
call fcn.0040aeb0
pop esi
pop ebx
leave
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x40f778
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x40f841
lea eax, [esp + 4]
push eax
push esi
call sub.user32.dll_GetClientRect
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 4]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 8]
mov dword [esp], edx
mov ebp, eax
sub ebp, 0xa
sub ebp, 0x20
sub ebp, 0xa
sub ebp, 0xa
mov ebx, 0x14
mov edi, 0x34
fild dword [esp]
fdiv dword [0x40f84c]
mov dword [esp + 0x14], ebx
fild dword [esp + 0x14]
fdiv dword [0x40f84c]
fsubp st(1)
call fcn.00402840
push edi
push eax
push ebp
push ebx
push esi
push 0
mov eax, dword [0x411660]
push eax
push 0
mov eax, 0x40f850
mov ecx, 0x44000000
xor edx, edx
call fcn.00405988
mov ebx, eax
test ebx, ebx
je 0x40f841
mov dx, 0x64
xor eax, eax
call fcn.00405958
push eax
push 0
push 0x401
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xa
push 0x404
push ebx
call sub.user32.dll_SendMessageA
mov eax, dword [0x4109c4]
mov eax, dword [eax]
push eax
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_UpdateWindow
mov eax, ebx
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0xb101d0
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x9e23e56
or dword [ecx - 0x29], esp
push 0x7d
invalid
xchg bl, dl
clc
ror dword [edi], 0x50
or dh, byte [ecx - 7]
dec eax
inc ebp
inc ebp
dec edi
jne 0xb101fb
mov dl, 0x87
or edi, dword [edx]
mov esp, 0x9b1d256c
daa
fimul dword [ebx + 0x35d63de1]
jb 0xb1018c
xor eax, 0x584e9972
dec esi
pop eax
pop ds
jno 0xb101f0
dec eax
mov cl, 0x65
xor byte [0xc271728b], ah
push edx
ror dl, 0x73
xchg esp, eax
cmp dword [edx], esi
mov byte [eax - 0x112b4b25], al
fidivr word [esi + 0x1f]
push ss
mov esp, dword [ebp - 0x28daa707]
out 0x4a, al
in al, 0x24
mov esi, 0x64733941
shr bh, 1
mov ecx, 0x5aab5083
vpor ymm6, ymm1, ymmword [ebp + 0x7f322cf]
mov byte [esi + 0xc], al
mov ebp, 0x545a1a15
wait
mov edx, 0xe4c6506a
jae 0xb10267
in al, dx
pop ds
pop es
daa
cmc
out dx, al
ret 0x1b5e
xchg esi, eax
dec esp
dec esp
invalid

Function at 0xe9e170
Capabilities:
Encode data using xor

Disassembly:
or al, 0xc7
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov bh, bh
mov edi, 0x7f144276
js 0xe9e075
mov al, 0xbf
mov dh, 0xd8
xchg ebx, eax
sbb ch, byte [esi + 0x22294e26]
mov dh, 0x3a
outsb dx, byte [esi]
mov edx, 0x7cbf4b87
xchg esi, eax
sbb al, 0xb9
shl byte [eax + 0x72], 1
xor dword [ecx + edi*4], ebp
das
push 0x4925c794
aam 0xe0
ror dword [esp + edi], cl
out dx, eax
sbb dword [ebx + 0x1b], 0x12bd67b8
das
or edi, dword [ebx + 0x77]
ret 0xf0c9
cmc
cmp eax, 0x8bbecf8b
jg 0xe9e06f
retf 0x804c
out dx, al
push ds
xor byte [ebx], ch
pop eax
push cs
insd dword es:[edi], dx
insb byte es:[edi], dx
ficom word [ebp + 0x2e5406f8]
sbb byte [eax - 0x1595eea2], 0x68
push es
push esp
sbb byte cs:[eax - 0x1595eea2], 0x68
push ss
mov byte [0xa758bfbb], al
push esp
add eax, 0x79f6e451
les esi, [eax + 0x57]
enter 0xfffffffffffff6cb, 0xffffffffffffffec
rol esp, cl
loope 0xe9e102
popal
jne 0xe9e0df
scasb al, byte es:[edi]
retf 0x654d
dec edx
std
scasd eax, dword es:[edi]
je 0xe9e1ce
test eax, 0xa25d3c58
test dl, cl
lcall 0x8e4c, 0xb123efbf
xor al, 0xce
jae 0xe9e16e
dec esi
xchg dword [edi - 0x64], esi
je 0xe9e1c8
jecxz 0xe9e10e
out 0x21, al
push cs
sahf
mov al, 0xb9
adc byte [edx + 0x7d], ch
add ah, byte [edx - 0x60]
mov esp, 0x33725341
stosd dword es:[edi], eax
call dword [ecx - 0x6f54c788]
dec ecx
iretd
sub al, dh
mov al, byte [0x4e018358]
mov ebx, 0xe9f7350c
in al, dx
fild dword [ebp - 0x5cb426fb]
shl byte [edi + 0x1ee54e01], cl
jmp 0x66fbdb9
dec ebx
mov dword [0x4e01a7d2], eax
in eax, 0x1e
mov byte [esi], bl
or eax, 0x8d4cb313
mov edi, 0x7b9fad8b
js 0xe9e1bd
pop ss
invalid
Function at 0xfd4e60
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x58
rcr dh, 1
mul byte [0x944f7858]
mov al, byte [esi]
cmpsd dword fs:[si], dword es:[di]
retf
push ds
outsb dx, byte [esi]
lcall 0x5de9, 0xbabe370e
imul dword [ebp + 0x4e367317]
push cs
aaa
mov esi, 0xf75de9ba
lodsd eax, dword [esi]
pop ss
jae 0xfd4e6c
dec esi
scasd eax, dword es:[edi]
cmpsb byte [esi], byte es:[edi]
xor eax, 0xc8a37a9d
sbb dword [eax - 0x2b1936a0], ebp
jg 0xfd4e28
ja 0xfd4e0a
push eax
or esi, ebp
and eax, 0x801926d7
salc
lds edx, [edi - 0x6f]
cmpsb byte [esi], byte es:[edi]
ljmp 0x8c27
jp 0xfd4e92
adc eax, 0x6e04936c
not byte [ebx + 0x11563669]
pushal
cmc
adc dword [eax - 0xb], esp
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
wait
out 0xd1, al
jno 0xfd4e2b
push 0x6b
mov ss, word [edx]
imul ebp, dword [ebx + 0x40d71e73], 0xffffffc6
pop esi
int 0x86
sar dword [edi - 0x4e], cl
push ebx
test esp, esp
call 0x2a82041e
fst qword [ecx + ecx*4 + 3]
mov dword [ebx], eax
and ebp, dword [eax + 0x11]
dec ebp
dec esi
inc ebp
pop eax
and ebp, esi
jno 0xfd4ea6
ret
popfd
dec esp
fcom qword [ebx + edi*8 + 0x1de37ded]
stosb byte es:[edi], al
cli
xchg edi, eax
xchg edi, eax
les esi, [edi + ecx*2 + 0xe00914f]
rol byte [edx + 0x72b018de], 1
adc al, 0xd1
jmp 0x389c9c92

Function at 0x1361820
Capabilities:
Encode data using xor

Disassembly:
mov dword [0x7fc84cdc], eax
sub al, 0x72
sbb byte [edi + 0x35], cl
pop es
sbb eax, 0x9ce3b032
push ds
xlatb
sbb dword [ebp + 0x481a3dd], edi
hlt
not byte [ebp - 0x76]
sub eax, 0xfcc9e96a
dec esi
add edx, dword [eax - 0x7255d03f]
fsub dword [ebp + eax*8 - 0x2570e664]
cmp eax, 0xe7c8a5a
daa
test byte [eax + ecx*4 - 0x588f91a1], bh
cmpsd dword [esi], dword es:[edi]
push edx
loop 0x13617ce
and edi, 0xa
test ch, ch
xlatb
push ebp
mov esp, 0xaf515e34
push ecx
adc bl, al
jmp 0x1361899
push 0x4a
and eax, 0xa64fb3bb
push ds
dec esp
je 0x136184d
fisttp word [ebx]
popfd
insb byte es:[edi], dx
adc byte [eax], bl
or eax, dword [esp + edx*8]
mov ecx, 0x78b15346
salc
mov dl, 0xb
ret 0x782f
dec ecx
loopne 0x13618e0
pop esp
or ebx, dword [edi - 0x6fc991a]
wait
jecxz 0x1361875
jg 0x1361842
mov ecx, edi
out dx, al
in eax, 0xed
xchg ebp, eax
insb byte es:[edi], dx
mov bh, 0xb4
adc al, 0xb5
dec eax
cmp eax, 0xc448f8d9
xchg edi, eax
outsd dx, dword [esi]
aam 0x9b
lodsb al, byte [esi]
in al, dx
aas
inc esp
out dx, al
out dx, al
jbe 0x13618c6
jne 0x13618fb
xor al, 0xd0
invalid
sar dh, 1
test al, 0xc5
or dword cs:[ebx - 0x24], 0x48d194a2
cmp bh, byte [eax - 0x3766f0ff]
xchg edx, eax
adc byte gs:[esi], dl
fist word [esi - 0x31c24619]
retf 0xfa10
mov ecx, 0x10cace3d
cli
out dx, al
retf
adc byte [ebx - 0x42], ah
jle 0x136190d
pop edx
lcall 0x4aaf, 0xb2e886e3
jo 0x1cce9f34
cwde
sbb ecx, dword [0xd70aea8]
or eax, 0xd70aea8
invalid
Function at 0x100068d3
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x100068f5
mov eax, 0xfffffffd
jmp 0x100069d5
mov ebx, dword [0x100c4a50]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x100069a3
mov ebx, dword [0x100c4a50]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10006944
mov ebx, dword [0x100c4a50]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10006944
mov eax, 1
jmp 0x10006949
mov eax, 0
test eax, eax
je 0x10006975
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x1000695e
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x100c4a50]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x100069cb
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x100069d5
mov esp, ebp
pop ebp
ret 4

Function at 0x10006bdc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10006c8f
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x1000760e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10006bdc
test eax, eax
je 0x10007651
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10007651
cmp word [eax], 0x5a4d
jne 0x10007651
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10007651
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10006cae
mov eax, dword [ebp + 8]
jmp 0x1000766a
mov esp, ebp
pop ebp
ret 4