joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100475e0
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x10047610
push str.Couldnt_set_desired_mode
push esi
call fcn.10021d00
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x10047627
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200
push esi
call fcn.10021dd0
add esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
cmp eax, 0x13
jne 0x10047642
push ebx
push esi
call fcn.100474e0
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x10047752
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp byte [esi + 0x4d8], 2
mov dword [esp + 0x18], edi
jne 0x100476c0
mov eax, dword [esi + 0x134]
mov eax, dword [eax]
test eax, eax
je 0x100476c0
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
call fcn.1004f630
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x1004777f
push 0x2f
push dword [esp + 0x18]
call fcn.10062a30
add esp, 8
test eax, eax
je 0x100476af
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x100476bc
push dword [esp + 0x14]
call dword [0x100b8004]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x518]
test ecx, ecx
jne 0x100476de
cmp byte [esi + 0xd1c], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x100adfa9
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x1009a08c
cmove eax, edx
push eax
push ecx
push 0x1009a700
call fcn.10033b50
push ebx
mov ebp, eax
call dword [0x100b8004]
add esp, 0x14
test ebp, ebp
jne 0x1004771b
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x100994e8
lea eax, [edi + 0x418]
push eax
push esi
call fcn.1005a920
push ebp
mov edi, eax
call dword [0x100b8004]
add esp, 0x14
test edi, edi
jne 0x1004777f
mov eax, dword [esi + 0xc]
pop ebp
mov dword [eax + 0x49c], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x1004776b
push 0xd
push 1
push esi
call fcn.10047070
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x1004777f
push 0xe
push 1
push esi
call fcn.10047070
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x1005d450
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov esi, eax
add esp, 4
test esi, esi
jne 0x1005d47b
pop esi
pop ebp
add esp, 0xc
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x24]
mov dword [esi + 8], eax
push edi
lea edi, [ebp + 4]
cmp ebx, dword [ebp + 0x10]
jbe 0x1005d4ca
mov eax, dword [ebp]
push ecx
call eax
mov eax, dword [edi]
push ebx
push dword [esp + 0x2c]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebp + 0xc]
push dword [esi + 4]
mov dword [esp + 0x28], eax
push eax
mov eax, dword [ebp + 8]
call eax
mov ebx, dword [ebp + 0x14]
add esp, 0x18
mov dword [esp + 0x28], ebx
jmp 0x1005d4d2
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
push dword [esi + 4]
mov eax, dword [ebp]
call eax
push dword [esi + 8]
mov eax, dword [ebp]
call eax
mov eax, dword [esp + 0x30]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1005d543
mov ebp, dword [esp + 0x14]
mov ebx, eax
mov dword [esp + 0x18], eax
nop dword [eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x13], al
lea eax, [esp + 0x13]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x1f], al
lea eax, [esp + 0x1f]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1005d500
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x20]
cmp ebx, dword [ebp + 0x10]
jae 0x1005d575
nop dword [eax + eax]
mov eax, dword [edi]
push 1
push 0x100a5d60
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100a5d61
push dword [esi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [ebp + 0x10]
jb 0x1005d550
pop edi
pop ebx
mov eax, esi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x100604f6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x10060517
jl 0x1006050e
test edi, edi
jne 0x10060517
xor eax, eax
xor edx, edx
jmp 0x100605d8
cmp dword [ebx + 0x38], 0
je 0x1006052c
push eax
push edi
push dword [ebp + 8]
call fcn.10002880
jmp 0x100605d8
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x10060573
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x10060573
cmp eax, edi
jb 0x1006054d
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.100624b0
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x10060579
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x100605cd
mov ecx, ebx
call fcn.1005fe44
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x100605b8
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.1006d985
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x100605cd
jmp 0x1006058b
test edx, edx
je 0x100605cd
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.1006d985
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc

Function at 0x100756ef
Capabilities:
Parse pe header

Disassembly:
push 0
push esi
call fcn.103ff1df
test eax, eax
je 0x1007572e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1007572e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1007572e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1007572e
cmp dword [ecx + 0x74], 0xe
jbe 0x1007572e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x100879e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10087a0d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10087a0d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x100cebf0
Capabilities:
Contain obfuscated stackstrings
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 0x10]
cmp ebx, esi
je 0x100ced52
cmp edi, esi
je 0x100ced52
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, edi
mov dword [ebp - 0x48], 0x44434241
mov dword [ebp - 0x44], 0x48474645
mov dword [ebp - 0x40], 0x4c4b4a49
mov dword [ebp - 0x3c], 0x504f4e4d
mov dword [ebp - 0x38], 0x54535251
mov dword [ebp - 0x34], 0x58575655
mov dword [ebp - 0x30], 0x62615a59
mov dword [ebp - 0x2c], 0x66656463
mov dword [ebp - 0x28], 0x6a696867
mov dword [ebp - 0x24], 0x6e6d6c6b
mov dword [ebp - 0x20], 0x7271706f
mov dword [ebp - 0x1c], 0x76757473
mov dword [ebp - 0x18], 0x7a797877
mov dword [ebp - 0x14], 0x33323130
mov dword [ebp - 0x10], 0x37363534
mov dword [ebp - 0xc], 0x2f2b3938
mov dword [ebp - 4], esi
mov ecx, edi
mov dword [ebp - 8], eax
cmp edx, esi
jbe 0x100ced42
add edi, 4
jmp 0x100ceca3
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x100cecb8
mov dword [ebp - 4], 2
jmp 0x100cecd9
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x100ceccf
mov dword [ebp - 4], 1
jmp 0x100cecd9
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x100ced52
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x48]
mov byte [ecx + 1], bl
mov ebx, dword [ebp - 4]
cmp ebx, 1
jbe 0x100ced10
mov byte [ecx + 2], 0x3d
jmp 0x100ced1d
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x48]
mov byte [ecx + 2], al
add ecx, 3
add edi, 3
test ebx, ebx
je 0x100ced2c
mov byte [ecx], 0x3d
jmp 0x100ced32
mov dl, byte [ebp + edx - 0x48]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x100ceca0
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
sub ecx, edi
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x101492f0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x30313731
seto byte [esp + 0xc]
test dword [esp + 0x20], 0x13a170d5
call fcn.10208ed9
and ch, byte [ebp + 0x62]
in eax, 0xcb
invalid

Function at 0x10160c90
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], 0xb61cc767
bswap ecx
xor cx, 0x68e3
lea ecx, [ecx*8 + 0x5bfb5de2]
push esi
mov ecx, dword [esp + 0x10]
mov esi, 0x79d67140
lea esi, [esi + 0x1c675ff0]
lea esi, [esi + esi*8 + 0x5b161cf4]
je 0x10160c98
or si, si
call fcn.101670d9
cmp bp, 0x666c
test dl, bl
add ebp, eax
jmp 0x10462d53
jmp ebp
Function at 0x10167b3f
Capabilities:
Encode data using xor

Disassembly:
add al, ch
mov edx, dword [edx + 0xf]
add al, ch
call fcn.1038c567
invalid
je 0x10167b6b
call fcn.1038c567
push dword [esp]
popfd
lea esp, [esp + 4]
add byte [ebp + 0x424648d], bl
call fcn.103bc7f9
mov ch, 0xb0
push ss
xor byte [esi], ch
jno 0x10167b39
mov ch, 0x9c
invalid
and cl, byte [ebp + 0x1ab49dc4]
aam 0x95
adc eax, 0x38ba1593
into
mov byte [esi], dl
and dl, byte [ebp - 0x11]
xchg esi, eax
das
inc ebx
sahf
iretd

Function at 0x102587ae
Capabilities:
Encode data using xor

Disassembly:
setg bl
mov dword [esp + 0xc], ebx
jne 0x1033a9d2
dec ecx
mov edi, dword [ecx + 8]
inc sp
shrd eax, edx, 0xa8
dec eax
movsx eax, dx
bswap ax
dec ecx
not edi
xchg al, ah
inc ecx
and al, ch
xadd ah, ah
dec eax
not edi
inc cx
cmovg eax, ebp
dec esp
or edi, edi
dec eax
cwde
sets al
dec ebp
mov dword [ecx + 8], edi
bswap ax
not ah
movsx ax, bl
pushfd
neg ax
cmp dl, 0x44
and ax, 0x64e1
inc ecx
pop dword [ecx]
btc eax, 0x4e
rcr ax, 0xb4
dec ecx
sub esp, 4
cmc
rcr ah, 0x9c
inc esp
bts eax, ebx
inc ecx
mov eax, dword [esp]
inc ecx
cmp ah, 0x95
inc ecx
cmp bh, bl
xor eax, ebp
neg eax
inc cx
test esp, 0x84444181
imul ecx
jle 0x102587e8
invalid
invalid
Function at 0x102b2a34
Capabilities:
Encode data using xor

Disassembly:
lcall 0xf716, 0x8bfab30f
invalid
jno 0x10399eb9
push cs
add byte [ebp + ebp*4 - 0x5d], ch
rcl dword [ebx - 0x27]
pushfd
insb byte es:[edi], dx
lodsd eax, dword [esi]
mov dword [0x9cd953d1], eax
test al, 0
mov ecx, 0xcc17104d
lcall 0xa34a, 0xf17fc16a
lds esp, [ecx - 0x4c]
mov bl, 0xa2
mov ebp, cs
jne 0x102b2ad2
mov ah, 0xb3
mov byte [0x7a75cd8c], al
sbb eax, 0xab69df8
inc esp
jnp 0x102b2a77
xor dword [ebx - 0x65], edx
jg 0x102b2ae3
je 0x102b2a12
mov bl, byte [ebp - 0x9d1be7]
out dx, al
inc ecx
das
in al, dx
invalid
mov esp, 0x15b1ff62
xor ch, bl
xor ecx, dword [edx + 0xeb5e12a]
push dword [ecx + 0x33dd3015]
mov ch, byte [edx]
loope 0x102b2a38
push cs
jb 0x102b2a51
in eax, 0xab
dec ebx
lodsb al, byte [esi]
adc ch, byte [edi + eax - 0x2722a576]
push edi
dec ecx
mov ebp, 0xcedd5b5c
jnp 0x102b2a2d
pop edi
mov ah, 0x8b
mov ebp, dword [ebp + 0x483ed275]
test dword [eax - 0x70], 0xfaa833d
sbb al, 0x27
invalid
jnp 0x102b2b52
cld
nop
mov byte [0xfefe887f], al
mov edx, 0x81b41e84
add al, 0x6f
pop ebp
invalid
adc byte [ecx], 0x6e
or dword [esi], esp
sub eax, 0x23fd21ca
jbe 0x102b2a79
add al, 0xda
jbe 0x102b2b37
dec esp
out 0x25, al
aas
jp 0x102b2ad2
and al, 0x5b
movsd dword es:[edi], dword [esi]
out 0x29, al
fxch st(1)
imul esp, dword [ebp - 0x30], 0xffffffdb
aas
retf 0x3398
fldcw word [ecx - 0x24332edd]
ja 0x102b2ad9
sub al, 0x2f
pop edi
pop ss
inc esi
movsb byte es:[edi], byte [esi]
loopne 0x102b2ba1
ret
jle 0x102b2b54
and ah, al
aas
scasd eax, dword es:[edi]
push 0xabc64f1f
jbe 0x102b2bb9
popal
pop edi
loop 0x102b2b3d
wait
daa
adc byte [esi + 0x31b0588a], 0x15
add bh, bl
int1
jbe 0x102b2b82
imul ebx, dword [edx + 0xef36f5e], 0x97a270a
stc
scasd eax, dword es:[edi]
lcall 0x443e, 0x4e66e239
inc esp
sal byte [ebp + 0x11], cl
and edi, dword [eax + 0x5e]
retf 0x3fdd
mov dword [0xae6920ca], esi
xor dword [ebx - 0x5974319b], esp
mov ebp, 0xa4f387d0
hlt
pop esi
insb byte es:[edi], dx
mov edx, 0x342be112
xchg ebp, eax
sub eax, 0x9b731237
inc ecx
push ebp
mov dh, 0xff
arpl word [edi + 0x4b562ca4], bp
lds esi, [edi]
leave
adc bl, byte [edx + 0x42920b11]
mov al, 0x6f
jo 0x102b2b65
invalid
Function at 0x102e1fad
Capabilities:
Encode data using xor

Disassembly:
jmp ebp
cmp cl, ch
dec eax
mov ecx, dword [esp + 0x20]
jle 0x1042dff5
and word [esp + 0x18], 0x695e
jl 0x1042dff5
call fcn.102df4fc
push edi
mov edi, 0x6b321912
push ebx
pushfd
mov edi, dword [esp + 8]
mov dword [esp + 8], 0xa9218e28
mov ebx, 0x53090105
call fcn.100d878a
xor esi, ebp
jmp 0x1039b78d
dec esi
stc
ror esi, 2
inc ecx
test ah, 0x73
inc ecx
cmp edx, 0x37cc3f2f
add esi, 0x453361fc
cmc
clc
bswap esi
dec eax
test ebx, 0x2fa273a4
cmc
push ebp
xor dword [esp], esi
inc ax
movzx ebp, dh
dec ecx
movzx ebp, sp
pop ebp
inc esp
test dh, ah
inc cx
test edx, 0x6348034f
test byte [ebx + eax - 0x3a], 0xe9
dec edx
mov dl, 0xde
invalid
xor edx, 0x280172e3
test dl, 0x67
not edx
lea edx, [edx + 0x76ca3d20]
not edx
clc
cmc
xor ebx, edx
stc
add ebp, edx
jmp 0x101c69e0
ror esi, 3
jmp 0x1033ee21
dec eax
mov edi, 0x3fe02341
salc
sub dh, byte [eax - 0x87e63a9]
mov al, 0x31
mov ebx, 0x48515204
push edx
push ecx
dec eax
mov edx, 0x6bdc67bc
xor bl, byte [eax - 0x34]
inc ebx
dec eax
add edx, 0x86b2db5
dec eax
add edi, edi
push 0x3c069e2
dec eax
mov edi, dword [esp + 0x20]
dec eax
mov dword [esp + 0x20], 0xbcf39941
sete dl
jl 0x1042dfe4
dec eax
mov ecx, edx
call fcn.1014d8e4
call eax
mov ebp, dword [ebp - 4]
mov dword [ebp], eax
mov edi, ebp
adc ebp, 0x673c6da7
shrd edx, ecx, 0xc0
bswap bp
pop ebx
pop ebp
xor dx, si
pop esi
add edx, ebp
sub esi, 4
cmove dx, si
bt edx, 0x30
mov edx, dword [esi]
test bp, 0x6d0c
stc
xor edx, ebx
stc
not edx
jmp 0x1037ef52

Function at 0x10388731
Capabilities:
Encode data using xor

Disassembly:
inc edx
stc
xor edx, 0x1a1310a6
jmp 0x1037e859
inc edx
test bp, dx
xor ebx, edx
test bp, dx
add esi, edx
jmp 0x10430301
rol dword [edi - 0x20e7f364], 0x5f
stosb byte es:[edi], al
push edx
xor word [esp + 0x14], cx
test dword [esp + 0x14], ecx
jae 0x1041b921
mov eax, dword [edi]
rcr dh, 0xf7
mov cl, byte [edi + 4]
stc
movsx edx, bp
add edi, 6
mov byte [eax], cl
adc dx, 0x184d
bt dx, 0x7d
or dx, 0x76e8
sub ebp, 4
shl edx, 0xbc
add cl, al
loop 0x10388688
mov edx, dword [ebp]
cmp eax, edi
xor edx, ebx
test dx, bp
xor edx, 0x1a006e60
jmp 0x1022ebac
loope 0x10388730
invalid
call fcn.1017b54e
jle 0x103886c8
mov edi, 0x703f5e0a
add esp, eax
ja 0x1038876b
mov dh, dh
popal
jne 0x1038872f
popal
imul eax, dword [eax + 0x7a514481], 0xddc8ecdf
lds edx, [ebx]
xchg dword [edi + 0x202ead0c], eax
invalid
out dx, al
add dword [esi + 0x39abacb2], 0x3bcb5007
invalid
xor word [esp + 0x14], 0x546f
not cx
mov ecx, dword [esp + 8]
mov edx, 0x322770fd
lea edx, [edx + edx + 0x2182322f]
xor byte [esp + 0x14], dh
setbe byte [esp + 0x14]
and dword [esp + 0x14], edx
call fcn.10446f53
push esi
ret
Function at 0x10396068
Capabilities:
Encode data using xor

Disassembly:
push ebp
call fcn.103fc930
outsb dx, byte [esi]
pushal
ror byte [edx + 0x43], 1
xlatb
adc byte [ebx - 0x5987ee4b], cl
fidiv word [esi + ebp*8 - 0x4b75136e]
sti
dec ebp
xchg edx, eax
das
dec edx
dec esp
aaa
mov eax, dword [0x89fdb480]
inc edx
sal byte [edi + esi*2 - 0x4b589730], cl
lodsd eax, dword [esi]
les edi, [eax + 0x6f]
dec ebx
dec esi
xor eax, 0x744b6294
cmp bl, byte [edx - 0x26]
mov ah, 0x2c
and byte [edi], dl
cmp dh, byte [ebp + edx*4 + 0x2e15a615]
dec edx
mov ch, 0xa
pop ebp
push eax
xlatb
rcl byte [ebx], cl
rcr dword [edi], 1
xchg esp, eax
cmpsd dword [esi], dword es:[edi]
mov bl, 0xd1
push ecx
pop ds
xor al, 0x88
sbb ch, byte [esp + eax*4 - 0x123dd122]
mov eax, dword [0xcd722f2c]
cwde
push 0xffffffffffffff8c
pop edx
sub dword [eax - 0x1ac3ba0f], esp
mov al, byte [0xe53c45f1]
mov bh, 0xeb
jnp 0x10396127
mov edx, ecx
dec ebp
sub dword [ebx - 0x1f], edi
sbb ecx, ebx
pop edi
jae 0x10396118
ret
or esi, dword [ecx + 0x15ef76ce]
mov eax, dword [0xe16114eb]
aam 0xf0
mov eax, dword [0xd7dbd70b]
jmp 0x10396135
xlatb
fcmovnbe st(0), st(7)
sub bh, bl
imul edi, dword [ebx - 0x3864fbe4], 0xa7a261b2
cmpsd dword [esi], dword es:[edi]
sub dword [ecx], 0x57
jp 0x103960d3
pop ebx
sub dword [ebp + 0xa629441], ecx
in eax, 0x78
das
cmp al, 0x75
scasd eax, dword es:[edi]
xor ebx, esp
pop esp
jno 0x1039611f
dec ebp
dec ecx
mov edi, 0x8c62cf7a
pop ebx
sub al, 0xa6
pop eax
std
sal byte [edx - 0x24], cl
mov ebp, 0x9d88bf07
or dword [0x6823039a], esp
and eax, 0x26fb51ce
fisubr dword [ebx - 0x257971ca]
jmp dword [edx - 0x3d]

Function at 0x103bd391
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x14]
mov eax, dword [eax + ebx*2 - 0x2a68fcfc]
mov dword [esp + 0x14], ebx
mov edx, 0x23cb7a04
add dword [esp], 0xffe9c575
cmp dword [esp + 0x14], 0x5e3c3c47
lea eax, [eax + ebx + 0x436f9454]
call fcn.10426ce4
dec ecx
mov esi, dword [ecx]
dec ecx
bsf ecx, ecx
dec esp
shld ecx, edi, 0x91
dec cx
dec ecx
mov ecx, dword [ecx + 8]
dec ecx
cmp eax, edx
stc
dec ecx
add ecx, 0x10
dec eax
mov dword [esi], ecx
inc eax
dec dh
btr esi, 0xc1
dec ecx
sub esp, 4
inc eax
sub dh, dl
rcl si, cl
btc esi, eax
inc ecx
mov esi, dword [esp]
inc ecx
test bh, 0x69
jmp 0x102ca4c6
xor esi, ebp
clc
xor esi, 0x2d845b69
inc cx
cmp ebp, 0xc6816d3a
stc
sub esp, dword [edx + 0x3e]
inc ecx
test ch, dh
stc
xor esi, 0x25d68c5
inc eax
test ch, 0xaf
clc
neg esi
cmp dh, 0xe1
push ebp
sal ebp, cl
xor dword [esp], esi
inc eax
mov ch, 0xd3
btr ebp, 0xe2
pop ebp
inc sp
cmp ebp, edx
dec eax
arpl si, si
inc bp
test edi, ecx
inc cx
cmp ebx, 0x34c5783
invalid
jno 0x1021a73e

Function at 0x103dd81c
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 8], eax
call fcn.1040b2f9
cmpsd dword [esi], dword es:[edi]
push 0x5d
xchg edx, eax
sbb byte [esi + 0x1e], 0x2c
daa
add byte [edi - 0x7f6da296], ah
pop esi
push ds
sub al, 0x27
pop edx
loop 0x103dd824
je 0x103dd865
retf
add byte [ebp + 0x29], ah
pop es
aam 0x10
in eax, dx
out dx, eax
xor ah, byte [ebx - 0x7dffdd3a]
mov ah, 0x25
adc al, 0x69
invalid
Function at 0x103dfe70
Capabilities:
Encode data using xor

Disassembly:
push edi
push ebp
call fcn.1024cd2d
pop es
stc
outsd dx, dword [esi]
std
stosb byte es:[edi], al
sub ebx, ecx
invalid

Function at 0x103e29c9
Capabilities:
Check for software breakpoints

Disassembly:
call eax
mov ebp, dword [ebp - 4]
rol ebx, 0xf3
mov dword [ebp], eax
not dh
ror dx, cl
cmp ch, 0x48
pop ebx
pop edi
bsf esi, esp
pop esi
mov edx, dword [esi]
cmc
clc
lea esi, [esi + 4]
cmp eax, 0x7c4e17
xor edx, ebx
stc
clc
cmc
ror edx, 2
jmp 0x104200d5
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
je 0x103dbf76
mov eax, dword [ebp + ebx*4]
test ah, 0x73
cmp eax, 0x6a072af1
push eax
cmp ah, 0xcc
sub ebx, 1
jne 0x103dbf5a
mov eax, dword [ebp]
jmp 0x1036c217
call fcn.102ca2da
movzx edx, byte [esi]
shl ah, cl
btr ax, di
lea esi, [esi + 1]
ror ah, 0x2e
sar al, 0x77
xor dl, bl
lahf
ror dl, 1
sub al, 0x96
or ah, dh
xor dl, 0x2e
sbb ax, 0x7582
shl ax, cl
add dl, 0xdf
movsx ax, ch
not dl
cbw
dec dl
ror dl, 1
sets ah
xor bl, dl
xor al, ch
bts eax, eax
push esi
btr ax, 0x27
sar ax, cl
push edi
test sp, 0x1565
cmc
push ebx
movsx eax, dx
mov ebx, edx
test ch, 0x86
mov edx, ebx
rol ah, 0x1b
shl edx, 2
add ah, 0x68
mov eax, ebp
cmp ebp, 0x7b230f72
jmp 0x103dbf4c

Function at 0x10440ed2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x10], ebx
jge 0x10225db3
mov ebx, dword [esp + 0x34]
call fcn.1040a510

Function at 0x10440ee5
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ebx, dword [esp + 0x1c]
lea esi, [esi*2 + 0x88430cc]
jo 0x102d8f34
xchg dword [esp + ebx - 0x4aebfb43], edx
neg esi
mov dword [esp + 0xc], ebx
sub si, bx
xor esi, 0x3ce25dbd
push esi
jno 0x10420f0c
xor edx, ebx
xor edx, 0x1a006e60
jmp 0x10301201

Function at 0x10469d45
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 0xc], ebx
call fcn.10216bbb
or eax, 0x3eafb903
push ebx
cmp eax, dword [edi + edi*8 + 0x3b]
dec esi
invalid
Function at 0x40a200
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4815fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00475d5d
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a282
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00473acd
mov eax, dword [eax]
push 0x4a1c94
push eax
call fcn.00465d64
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00475fe8
test bl, bl
je 0x40a282
push 0x4a1c94
lea ecx, [esp + 0xc]
call fcn.00476378
push 0x4a1ca0
lea ecx, [esp + 0xc]
call fcn.00476378
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a2be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00475fe8
jmp 0x40a389
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a342
lea edx, [esp + 0x7c]
push 0x4a1c9c
push edx
call fcn.00465d64
add esp, 8
test eax, eax
je 0x40a342
lea eax, [esp + 0x7c]
push 0x4a1c98
push eax
call fcn.00465d64
add esp, 8
test eax, eax
je 0x40a342
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a2d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00475fe8
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ab80
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40abe2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc