joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c33a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1003c349
pop dword [ebp - 0x4c]
mov eax, 0x3f56881b
add eax, 0xd0ad3b2e
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xffe89680
add dword [ebp - 0x5c], 0x4e69aecb
mov dword [ebp - 0x58], 0x178c5e3b
add dword [ebp - 0x58], 0x1aa6ee0a
mov dword [ebp - 0x54], 0x98a93688
add dword [ebp - 0x54], 0xb3a30da6
mov dword [ebp - 0x50], 0x36ced54f
add dword [ebp - 0x50], 0xc9312ab1
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xd1a1125f
add eax, 0x3e62ce1d
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x1c656158
sub dword [ebp - 0x5c], 0xa7f2f802
mov dword [ebp - 0x58], 0x53bc4797
add dword [ebp - 0x58], 0xedb019de
mov dword [ebp - 0x54], 0x16ff4a9c
add dword [ebp - 0x54], 0x4c7021d0
mov dword [ebp - 0x50], 0xa2482694
add dword [ebp - 0x50], 0x5db7d96c
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xf50fa5c9
add eax, 0x1af43abb
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b6be
push 0
call eax
mov ecx, 0x6d771419
add ecx, 0x92892b25
xor edi, edi
add edi, eax
mov esi, 0x10071200
add esi, dword [ebp - 0x4c]
mov ebx, 0x4e956e2b
sub ebx, 0x81d5e148
add dword [ebp - 0x20], 0x54f2dcf1
mov edx, dword [esi]
sub dword [ebp - 0x14], 0x324964dc
xor edx, ebx
xor dword [ebp - 0x40], 0xc9368dc1
mov dword [edi], edx
add dword [ebp - 0xc], eax
add edi, 0x280efc16
add edi, 0xd7f103ee
add esi, 0x3700f152
sub esi, 0x3700f14e
loop 0x1003c467
add eax, 0xefcb
xor ebx, ebx
add ebx, eax
add eax, 0xeafd8622
sub eax, 0xeafd861d
mov ecx, 0x811095b8
sub ecx, 0x711095b8
add ecx, dword [ebp - 0x4c]
call ebx
Function at 0x406106
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x406115
pop dword [ebp - 0x14]
mov eax, 0x66532380
sub eax, 0x6612c26b
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xa333bb73
add dword [ebp - 0x24], 0xab1e89d8
mov dword [ebp - 0x20], 0x988baf40
add dword [ebp - 0x20], 0x99a79d05
mov dword [ebp - 0x1c], 0xbf437ddc
sub dword [ebp - 0x1c], 0x72f739ae
mov dword [ebp - 0x18], 0x779996f2
sub dword [ebp - 0x18], 0x779996f2
lea eax, [ebp - 0x24]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xd9ded74e
sub dword [ebp - 0x24], 0x656c6df8
mov dword [ebp - 0x20], 0x93898476
add dword [ebp - 0x20], 0xade2dcff
mov dword [ebp - 0x1c], 0xc183aed1
sub dword [ebp - 0x1c], 0x5e144265
mov dword [ebp - 0x18], 0xc897bd8
sub dword [ebp - 0x18], 0xc897bd8
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3720f
push 0
call eax
mov ecx, 0x983671fd
sub ecx, 0x98362982
mov edi, eax
mov ebx, 0x3329b08f
add ebx, 0xcd1b5371
add ebx, dword [ebp - 0x14]
mov edx, 0x1e4bf10f
add edx, 0x63c7bcc1
add dword [ebp - 0x10], 0xee4b3a83
mov esi, dword [ebx]
add dword [ebp - 0xc], eax
xor esi, edx
add dword [ebp - 8], edx
mov dword [edi], esi
add dword [ebp - 0x10], esi
add edi, 0x28a7e153
add edi, 0xd7581eb1
add ebx, 4
loop 0x40622d
add eax, 0x50120f31
sub eax, 0x5010fa72
mov ebx, eax
add eax, 0x104f257
sub eax, 0x104f252
mov ecx, 0x400000
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc
Function at 0x40c506
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a538]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408e31
mov dword [ebp - 0x14], eax
cmp dword [0x81985c], esi
jne 0x40c5f9
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c586
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c6d9
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c6d9
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c6d9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81985c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x819860], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x819864], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81986c], eax
test eax, eax
je 0x40c5f6
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x819868], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c61e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c611
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c633
push 4
pop eax
jmp 0x40c6db
cmp dword [ebp - 0x14], esi
je 0x40c633
push dword [0x81985c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c618
mov eax, dword [0x819868]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c691
cmp dword [0x81986c], edi
je 0x40c691
push eax
call ebx
push dword [0x81986c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c691
test eax, eax
je 0x40c691
call ecx
test eax, eax
je 0x40c686
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c686
test byte [ebp - 8], 1
jne 0x40c691
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c6c1
mov eax, dword [0x819860]
cmp eax, edi
je 0x40c6be
push eax
call ebx
test eax, eax
je 0x40c6be
call eax
mov esi, eax
test esi, esi
je 0x40c6be
mov eax, dword [0x819864]
cmp eax, edi
je 0x40c6be
push eax
call ebx
test eax, eax
je 0x40c6be
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81985c]
call ebx
test eax, eax
je 0x40c6d9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c6db
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404268
mov esp, ebp
pop ebp
ret
Function at 0x1669120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xae8000]
push edi
or ebp, 0xffffffff
jmp 0x1669142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1669149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1669138
mov eax, 1
add ebx, ebx
jne 0x166915b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x166916c
jne 0x166918b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x166918b
dec eax
add ebx, ebx
jne 0x1669178
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1669150
add ebx, ebx
jne 0x1669187
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x16691dd
xor ecx, ecx
sub eax, 3
jb 0x16691a3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1669212
sar eax, 1
mov ebp, eax
jmp 0x16691ae
add ebx, ebx
jne 0x16691ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x166917c
inc ecx
add ebx, ebx
jne 0x16691bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x166917c
add ebx, ebx
jne 0x16691c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16691be
jne 0x16691da
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16691be
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x16691fc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16691ee
jmp 0x166913e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16691fc
add edi, ecx
jmp 0x166913e
pop esi
mov edi, esi
mov ecx, 0x3404a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x166921a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x166921f
lea edi, [esi + 0xe63000]
mov eax, dword [edi]
or eax, eax
je 0x1669287
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe710ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe71240]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1669245
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe71244]
or eax, eax
je 0x1669281
mov dword [ebx], eax
add ebx, 4
jmp 0x1669262
call dword [esi + 0xe71254]
mov ebp, dword [esi + 0xe71248]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x16692bb
sub esp, 0xffffff80
jmp 0x10106f4
Function at 0x4c2a31
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x732e3f98
adc byte [ecx + 0x42], dh
and esp, dword [edi - 0x7b5cbb51]
test byte [eax + 0x33], bl
salc
xor ah, ch
mov bl, 0x43
mov ah, 0xc
dec esi
pop edx
loope 0x4c29b0
jo 0x4c2a9e
in eax, 0xdc
xchg edx, eax
xchg edi, eax
cmp al, 0xd2
lodsb al, byte [esi]
ret 0xe226
invalid
loop 0x4c2a1b
outsb dx, byte [esi]
xlatb
mov al, 0x94
leave
jl 0x4c2a66
lds ebp, [eax]
salc
pushal
or dword [ebp - 0xfbdeda4], 0xffffffe0
jle 0x4c29d5
mov dl, 0x6e
cmpsd dword [esi], dword es:[edi]
cld
or eax, 0xa5b97c32
pop es
adc dh, byte [eax + 0x70b827af]
add esi, dword [edx]
imul ebp, dword [ebp - 0x3a], 0xa80a7759
and byte [ebp + esi*8 + 0xb0bd371], ah
or ecx, dword [ebx]
cld
push es
push ecx
cmp dword [edx + 0x1c], ebp
jno 0x4c2a8a
push es
not byte [eax]
bound ecx, qword [ecx - 0x4f]
mov eax, 0xa7214f7
mov edx, 0x1b747e74
dec ecx
mov cl, 0xb8
not dword [edx + esi*2]
or bh, byte [edx + 0x1b747e74]
xor dl, cl
nop
inc esi
pop ebp
leave
mov bh, 0xe6
movsb byte es:[edi], byte [esi]
jbe 0x4c2a74
jmp 0xe0a79d4b
mov esp, 0xd4e05b72
bound ebp, qword [edx]
add dword [edx - 0x5fccb1b0], esi
sbb eax, 0x60925f91
mov byte [0x42d31866], al
sbb bl, dl
inc edx
wait
bound edx, qword es:[0xe3d988a1]
ljmp 0xc274

Function at 0x4cefaf
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x2422d33f
xchg edi, eax
out dx, al
cmpsb byte [esi], byte es:[edi]
int1
mov word [ebx], fs
ret 0xe895
dec esp
or dh, byte [0xa71066de]
jae 0x4cefa3
xor al, 0x81
mov ecx, 0x9c662e6
jns 0x4cefd8
imul ebp, dword [edi], 0x13a731b4
and dword [ecx - 0x2bb954e8], eax
div ecx
adc esp, dword [ecx]
sbb dword [eax], 0x26d446ab
div ecx
mov dl, 0x5e
enter 0x23ad, 0x42
stosb byte es:[edi], al
nop
push esi
add byte [ecx - 0x7d7b9cd4], 0xf6
push cs
in eax, dx
lahf
imul esi, dword [0xe33630f2], 6
xor al, ah
jb 0x4cefc9
sub ch, byte [edi - 9]
jb 0x4cef5e
outsd dx, dword [esi]
div dword [edx - 0x7e]
je 0x4cefe2
mov ebx, 0x782a666c
inc esi
js 0x4cf048
inc esi
push ebp
out 0x99, eax
les edi, [esi]
fmul dword [edx*8 + 0x2f65aedc]
or al, byte [edx - 0x70]
mov dword es:[0xb100e189], eax
neg dword [ecx]
pop ss
jb 0x4cef98
salc
dec ecx
ret 0x5260
invalid
Function at 0x555db1
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
sub dword [ebx], eax
pop ss
mov ecx, 0x6d09239e
salc
inc edx
in al, 0x9d
pop edi
ja 0x555e15
sub eax, 0x9d763198
xor dword [esi - 0x63], esi
arpl word [ebp - 8], bx
dec edi
pop edx
sbb al, 0x29
pop ds
xlatb
push ss
jbe 0x555dc5
xchg esi, eax
ret 0xba6d
div dword [edi]
retf 0xb4b0
retf 0xb4b0
mov bl, 0x77
test dword [ebx], esi
pop edi
jo 0x555e0d
lodsb al, byte [esi]
mov eax, dword [0xe3c0ae27]
mov edx, 0x2b270dc5
sbb ah, byte [esi - 0x1969d493]
dec edi
add ebp, dword [esi + edx*8]
dec ebx
salc
div dword [esi + 0x3d51aaf7]
cmp edi, dword [eax - 0x59d45477]
sub al, 0xd8
jnp 0x555e0a
jno 0x555e39
nop
scasb al, byte es:[edi]
add edi, esi
inc esi
adc ah, byte [ebx - 0x5969d01e]
dec ecx
pop ds
mov ds, word [ebp + 0x22]
xor eax, 0x7948f4e4
ja 0x555e6c
not byte [edi + 0x2f49e918]
cld
push 0x21
and byte [ebx], ah
popfd
wait
jae 0x555eb9
dec esp
mov ebp, 0x70856152
invalid
mov eax, 0x9fa7858b
sub ebx, dword [esi + 0x25426d61]
pop es
jb 0x555f38
xor dword [edx + 0x27042235], esp
aaa
retf
push 0xffffffffffffffe0
xchg byte [edi], dl
clc
pop ebx
retf 0x334f

Function at 0x5efc31
Capabilities:
Encode data using xor

Disassembly:
xor ah, ch
stosd dword es:[edi], eax
mov eax, 0x5e5d0e48
dec eax
push cs
pop ebp
pop esi
dec eax
push cs
pop ebp
pop esi
sub eax, 0x47c04842
add dword [ecx], edi
mov esp, 0x99d61f1f
into
shr dword [eax - 0x47], 0x97
or dh, dl
ja 0x5efbfe
test eax, 0x84ab9096
jnp 0x5efc5e
cmpsd dword [esi], dword es:[edi]
mov bl, 0xd8
add byte [ebx], dl
imul ecx, ecx, 0xfffffffe
stosb byte es:[edi], al
xor byte [esp + ecx*2 - 0x58a3d1d6], 0x93
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
cdq
mov word [ebx - 0x48], ss
fucomi st(6)
mov al, 2
ret 0xea53
Function at 0x623426
Capabilities:
Encode data using xor

Disassembly:
fstp qword [esi + 0x79acf063]
or al, 0x26
dec edx
jns 0x623434
dec edx
aas
push 0x15
xor bl, dh
bound edi, qword ds:[edi + ebp*8]
invalid
clc
mov dl, 0xcd
xchg esi, eax
outsb dx, byte [esi]
pop esp
lodsb al, byte [esi]
xor al, 0xa9
in al, 0xeb
jb 0x623421
cmpsb byte [esi], byte es:[edi]
pop ebp
fnstenv [edx - 5]
sahf
dec ebx
cmp eax, 0x8df3ee1d
mov esi, cs
add dword [eax], eax
sti
sub ecx, ebx
and al, 0xe3
dec eax
push 0x2e
cli
mov eax, dword [0x9417cab4]
and esi, esp
jb 0x623480
jo 0x623493
adc dl, byte [esi + 0x1d]
dec esp
add edx, dword [ebx + 3]
inc ebp
jl 0x623460
out dx, eax
aam 0x71
into
daa
test ecx, esp
pop edi
loope 0x6234d7
mov dword [0x977e4d1f], eax
pavgw mm7, mm4
in eax, dx
lahf
mov esp, 0xaf2cad84
inc ebx
les ebx, [ebx + eax*8 + 6]
inc edx
push cs
out 0x9f, eax
out dx, eax
in eax, 0xe0
aam 0xc2
loop 0x623470
loopne 0x623469
ret 0xd8e2
mov byte [0x9f69227], al
arpl word [edx], di
shr dword [esi + 0x6c], cl
push ebx
jb 0x623476
inc ecx
xchg edx, eax
inc esp
dec esp
xchg ebp, eax
sbb dword [edx + eax*2], ecx
ror dl, cl
cmp dword [esi], esi
mov al, byte [0x73c2ece7]
dec ebp
adc byte [esp + edx*2 - 0x6f2b5904], dh
popfd
adc ecx, eax
mov ebx, 0xd3557e8a
or eax, 0xe2d21c78
sbb byte [edx - 0x70], al
lea ecx, [edx + ebx]
wait
rcl dword [edi + 0x23]
and al, 0xb0
adc bl, dh
inc esi
mov ch, 0x9c
mov al, 0x12
fiadd word [esi - 0x4b]
pushfd
std
lodsb al, byte [esi]
wait
popal
wait
ret 0xf3c

Function at 0x631ab1
Capabilities:
Encode data using xor

Disassembly:
aaa
jae 0x631ae1
outsd dx, dword [esi]
imul eax, dword [0x20e01d23], 0x468d126e
movsb byte es:[edi], byte [esi]
mov eax, 0xc6de2eb5
sbb eax, 0x630899e8
inc esp
insd dword es:[edi], dx
xchg dword [edi + 0x72986aca], ecx
xor byte [eax - 0x522ba5ca], bl
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
sbb al, 0xce
and dword [esp + esi + 0xfd74030], ecx
in al, dx
push esi
inc ebx
pop ebx
fisttp qword [edi + ebx*4 + 0x4a]
push 0xce7ae38b
add esi, dword [ebp + 0x53]
add dh, ch
jle 0x631a7a
push esi
aaa
scasd eax, dword es:[edi]
add dword [edx - 0x7cd33217], esi
pushal
mov esp, 0xe8eb8cb5
push eax
frstor dword [eax]
je 0x631a61
cmp al, 0xd
nop
into
aam 0xe
in eax, dx
add dl, ch
or dh, dl
invalid
push edi
inc ebx
movsb byte es:[edi], byte [esi]
push es
insb byte es:[edi], dx
cmp dl, byte [edx - 0x2c]
xor eax, 0xc181990
mov dl, 0x85
mov bl, 0xa4
sti
cwde
popfd
mov dl, 0x49
in al, dx
test al, 0xbd
push edi
cmp ecx, eax
mov dword [edi - 3], eax
xchg ebp, eax
jnp 0x631ab0
push edx
loop 0x631b32
loopne 0x631b56
test ch, bl
mov ch, 0xc
add dword [esi], ecx
dec edx
mov eax, 0xcc31efd2
pop ecx
pop esp
popfd
mov esp, 0xbaa485b6
cdq
retf 0x38ea
invalid
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x638cc1
Capabilities:
Encode data using xor

Disassembly:
add bh, byte [ecx + ebp*2]
rcl edi, 0xcc
rcl byte [ebx]
push ebx
or dword [edi], 0xffffffa9
mov dword [0x67ae901b], eax
mov esp, dword [edx - 0x5e]
mov esp, dword [bp + si - 0x5e]
push edi
push edx
rol bh, 1
test dword [esi + 0x11], ebx
or eax, 0xbe098736
jecxz 0x638ca0
xor byte [eax + 0x5d87dacf], ah
adc dh, byte [edx]
cmp al, 0xa5
sbb ecx, dword [ebp - 0x3f9d63ac]
sar byte [ebx + 0x5411327a], 0x5d
sar byte [ebx + 0x5411327a], 0x5d
jg 0x638d16
les edx, [ecx]
scasb al, byte es:[edi]
adc eax, 0xd1540623
repne lodsb al, byte [esi]
lodsb al, byte [esi]
xchg edx, eax
xor al, 0xe3
test al, 0x33
sub al, 0xf3
out 0x7b, eax
sar dword [ebp + 0x62], cl
jle 0x638cd3
jmp 0x638c90
pop edi
cmp dl, dl
jge 0x638d52
invalid
clc
adc eax, 0xb070fe67
rol dword [ebx - 0x14], 0x86
invalid
Function at 0x63e771
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
out dx, al
cld
scasb al, byte es:[edi]
inc edx
mov esp, 0x70229093
push ebx
jo 0x63e6e9
lodsd eax, dword [esi]
push 0x4c
sub eax, 0x5d9671a2
sub eax, 0x5d9671a2
adc byte [ebx + 0x2eb22fd0], al
xchg edx, eax
cmp esi, ecx
or edx, esp
mov ecx, 0xc9c64c42
lea ecx, [eax + 0x33a06d02]
adc ch, byte [ebp + 0x3e]
mov dword [0xe9776972], eax
jg 0x63e725
xlatb
mov eax, 0x1d6dff0
mov ch, 8
pop esi
int3
test ecx, esi
mov ebp, 0x38f42412
sbb eax, 0x8318420b
sbb al, 0xf6
sub dh, bh
adc dh, 0xd8
adc dword [eax], edi
inc ecx
or bl, 0x2c
mov byte [0x84a03327], al
mov eax, 0xebec461a
mov cs, word [edi + 0x7c]
push es
or bh, bh
sbb dl, ah
das
sar dword [0xccaf3b6c], 0x63
mov ecx, 0xf29c91de
push cs
mov al, byte [0x461ab884]
in al, dx
jmp 0x63e6d8
int3
xchg ecx, eax
stosd dword es:[edi], eax
push es
xor ch, byte [edx + 0x46]
inc esi
sub al, 0x45
js 0x63e75f
mov esp, 0xe129121
stosb byte es:[edi], al
pop ebp
test eax, 0x130ca225
and eax, 0xe130ca2
and eax, 0xe130ca2
and dh, byte [eax - 0x3d]
inc edx
clc
jge 0x63e757
jb 0x63e742
and dword [edx + edi*2 - 0x73], edi
cmp ah, byte [esi]
mov dword [0xfa2d239e], eax
mov word [edx + 0x1f], gs
loop 0x63e7ed
shr ebx, 0xb2
sub ah, bl
mov dword [0xc2bc2297], eax
xlatb
mov bl, 0x4d
and byte [ecx + 0x4a], 0x82
mov dh, 0x6f
jge 0x63e804
sbb dword [edi + 0x53], edx
and edi, edi
or esi, ebx
cli
inc edi
sbb byte [ecx], al
jmp 0x63e764
adc edx, dword [eax]
jle 0x63e840
mov dword [0x7be7b9a3], eax
and ebp, dword [edi + 0x28778deb]
aas
rcr ebx, cl
sahf
imul ecx, dword [ecx - 0x184e5c39], 0x5d2da982
xor esp, dword [ebx]
add al, 0xf3
jne 0x63e84e
mov cl, 0xe7
sub byte [ecx + 0x23335d2d], 4
jne 0x63e84e
pushfd
pushfd
adc ah, bh
imul ecx, dword [esi - 0x1b1b0acd], 0xfd8d72b3
rcl byte [eax], cl
dec edi
jbe 0x63e83f
inc esi
sbb dword ds:[eax + 0x1e], 0xd03f746c
inc ebx
loop 0x63e811
out 0x89, al
jmp 0x63e884
dec esp
cmp dword [ebx + 0x57], ecx
or dword fs:[edx + 0x50], ebp
jp 0x63e852
xor eax, esp
int3
jb 0x63e7f1
outsd dx, dword [esi]
sbb al, 0x87
mov eax, dword [0x1c3d8ef2]
xchg dword [ecx + 0x1c3d8ef2], esp
push edx
test al, 0xb2
sbb al, 0x92
movsb byte es:[edi], byte [esi]
das
mov dword [edi], esp
dec ebp
xchg byte [eax], ch
dec ecx
push eax
das
cmp ebp, dword [esi]
and al, 0x3d
xor edx, dword [edi + 0x11]
int3
add cl, byte [eax + 0x4d]
inc edi
xchg edi, eax
pop es
insb byte es:[edi], dx
push es
fisubr dword [edi + 0x26]
mov bl, 0xee
fidivr word [edi]
aas
cmp al, 0xd6
sub ecx, dword [esi - 0x72299704]
adc byte [edx + 0x760d6d57], 0xd3
invalid
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437030]
jne 0x401116
repz ret
jmp fcn.00401ea1

Function at 0x4086ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406a72
and dword [ebp - 4], 0
cmp dword [0x439814], 0
mov ebx, eax
jne 0x40875f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408810
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408810
push eax
call fcn.00406a00
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439814], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439818], eax
call esi
push eax
call fcn.00406a00
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43981c], eax
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x439824], eax
test eax, eax
je 0x40875f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406a00
pop ecx
mov dword [0x439820], eax
mov eax, dword [0x439820]
cmp eax, ebx
je 0x4087b7
cmp dword [0x439824], ebx
je 0x4087b7
push eax
call fcn.00406a7b
push dword [0x439824]
mov esi, eax
call fcn.00406a7b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4087b7
test edi, edi
je 0x4087b7
call esi
test eax, eax
je 0x4087ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4087ae
test byte [ebp - 0xc], 1
jne 0x4087b7
or dword [ebp + 0x10], 0x200000
jmp 0x4087f0
mov eax, dword [0x439818]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087f0
mov eax, dword [0x43981c]
cmp eax, ebx
je 0x4087f0
push eax
call fcn.00406a7b
pop ecx
test eax, eax
je 0x4087f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439814]
call fcn.00406a7b
pop ecx
test eax, eax
je 0x408810
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408812
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc60
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x437030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2c17114]
push ebx
mov ebx, dword [0x2c16f60]
push esi
mov esi, dword [0x438050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cca1
push str.lefovuweceh
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2c17114]
mov dword [0x4399ec], esi
cmp eax, 0x114e
jne 0x40cccb
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.nanucucolumisocifozoguvex
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2c17114]
cmp eax, 0x2f
jne 0x40cced
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cbb0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret