joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441497
Capabilities:
Encode data using xor

Disassembly:
wait
push ebx
daa
popfd
mul dword [edi]
mov ebx, 0xf290c3ad
invalid

Function at 0x44b8d0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xb0
mov al, byte [0x65e049]
mov cl, byte [0x65e048]
xor cl, al
push esi
mov byte [0x65e048], cl
mov cl, byte [0x65e043]
or cl, 8
mov esi, dword [esp + 0xb8]
shr cl, 3
and ecx, 0xff
push 0x11
mov dword [esp + 8], ecx
fild dword [esp + 8]
fdivr qword [0x661970]
fadd qword [0x65e050]
fstp qword [0x661960]
mov dword [esi], 0
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x44b936
or dword [esi], 0x4000000
mov al, byte [0x65e046]
mov cl, byte [0x65e045]
xor al, cl
mov byte [0x65e046], al
or al, 0x30
shr al, 4
and eax, 0xff
mov dword [esp + 4], eax
fild dword [esp + 4]
fdivr qword [0x6619d0]
fstp qword [0x661960]
fld qword [0x65e050]
fadd qword [0x661970]
fstp qword [0x661970]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call fcn.0044b810
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
push 5
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, esi
pop esi
add esp, 0xb0
ret

Function at 0x657e8d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x65e3a8
cmp edx, dword [eax]
je 0x657eaf
add eax, 8
inc ecx
cmp eax, 0x65e438
jl 0x657ea0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x65e3a8]
jne 0x657fdd
mov eax, dword [0xa5ae04]
cmp eax, 1
je 0x657fb7
test eax, eax
jne 0x657ee0
cmp dword [0x65e2d4], 1
je 0x657fb7
cmp edx, 0xfc
je 0x657fdd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657f17
lea eax, [ebp - 0x1a4]
push 0x65d500
push eax
call fcn.00658870
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658d00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657f5a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658d00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65d4fc
push edi
call fcn.0065abd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65d4e0
push eax
call fcn.00658870
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658880
lea eax, [ebp - 0xa0]
push 0x65d4dc
push eax
call fcn.00658880
push dword [esi + 0x65e3ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658880
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65d4b4
push eax
call fcn.0065ab44
add esp, 0x2c
pop edi
jmp 0x657fdd
lea eax, [ebp + 8]
lea esi, [esi + 0x65e3ac]
push 0
push eax
push dword [esi]
call fcn.00658d00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0xfe4440
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xe06015
lea edi, [esi - 0xa05015]
push edi
jmp 0xfe445a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfe4461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe4450
mov eax, 1
add ebx, ebx
jne 0xfe4473
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfe4484
jne 0xfe44a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe44a3
dec eax
add ebx, ebx
jne 0xfe4490
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xfe4468
add ebx, ebx
jne 0xfe449f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xfe44f5
xor ecx, ecx
sub eax, 3
jb 0xfe44bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfe452a
sar eax, 1
mov ebp, eax
jmp 0xfe44c6
add ebx, ebx
jne 0xfe44c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe4494
inc ecx
add ebx, ebx
jne 0xfe44d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfe4494
add ebx, ebx
jne 0xfe44e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfe44d6
jne 0xfe44f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfe44d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfe4514
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfe4506
jmp 0xfe4456
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfe4514
add edi, ecx
jmp 0xfe4456
pop esi
mov edi, esi
mov ecx, 0x4ceb6f
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0xfe454f
cmp byte [edi], 0x85
jne 0xfe4534
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0xfe4532
lea edi, [esi + 0xbe1000]
mov eax, dword [edi]
or eax, eax
je 0xfe4597
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbe5ae4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbe5b64]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfe4555
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbe5b6c]
or eax, eax
je 0xfe4591
mov dword [ebx], eax
add ebx, 4
jmp 0xfe4572
call dword [esi + 0xbe5b68]
mov ebp, dword [esi + 0xbe5b70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfe45cb
sub esp, 0xffffff80
jmp 0x92eaa4
Function at 0x5e341e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 0x18], 0
jne 0x5e3572
cmp dword [ebp + 0xc], 0
jne 0x5e3572
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x5e3465
sub eax, dword [ebp + 0x10]
js 0x5e3572
je 0x5e3572
cmp eax, dword [ebp + 0x14]
jl 0x5e3572
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
cmp word [eax], 0x5a4d
jne 0x5e3572
mov ebx, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
jne 0x5e3572
mov ebx, dword [eax + 0x50]
push edi
push 4
push 0x1000
push ebx
push 0
call dword [edi + 0x122d296c]
pop edi
test eax, eax
je 0x5e3572
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x14], ebx
pop ebx
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a77d5]
push eax
call int.005e2486
pop edi
test eax, eax
je 0x5e3572
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [edi + 0x124a77d9]
push eax
call int.005e2486
pop edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov ebx, dword [eax + 0x3c]
add eax, ebx
mov eax, dword [eax + 0x54]
mov dword [ebp - 0xc], eax
push edi
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
rep movsb byte es:[edi], byte [esi]
pop edi
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
mov ebx, dword [eax + 0x3c]
add eax, ebx
lea ebx, [eax + 0x18]
movzx ecx, word [eax + 0x14]
add ebx, ecx
movzx ecx, word [eax + 6]
test ecx, ecx
je 0x5e3565
push ecx
mov ecx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
add eax, dword [ebp - 8]
test eax, eax
je 0x5e3572
push edi
mov edi, eax
xor eax, eax
push ecx
push edi
rep stosb byte es:[edi], al
pop edi
pop ecx
mov edx, dword [ebx + 0x10]
cmp ecx, edx
jl 0x5e3552
mov ecx, edx
mov esi, dword [ebx + 0x14]
add esi, dword [ebp - 4]
rep movsb byte es:[edi], byte [esi]
pop edi
add ebx, 0x28
pop ecx
dec ecx
jmp 0x5e3520
push dword [ebp + 8]
call fcn.005e4314
jmp 0x5e3579
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x18]
leave
ret 0x14
Function at 0x5e3904
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
pushal
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x5e39f3
mov ecx, eax
mov ebx, dword [ecx + 0x3c]
add ecx, ebx
mov ecx, dword [ecx + 0x7c]
test ecx, ecx
je 0x5e39f3
mov dword [ebp - 4], ecx
mov ebx, eax
mov ecx, dword [ebx + 0x3c]
add ebx, ecx
mov ebx, dword [ebx + 0x78]
add ebx, eax
mov dword [ebp - 8], ebx
mov eax, dword [ebp + 0xc]
test eax, 0xffff0000
je 0x5e399f
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5e39f3
dec ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x20]
add eax, dword [ebp - 0xc]
push ecx
shl ecx, 2
add eax, ecx
mov eax, dword [eax]
add eax, dword [ebp - 0xc]
push edi
push dword [ebp + 0xc]
push eax
call dword [edi + 0x124a7935]
pop edi
pop ecx
test eax, eax
jne 0x5e3958
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp - 0xc]
shl ecx, 1
add eax, ecx
movzx ecx, word [eax]
jmp 0x5e39a5
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebx + 0x10]
mov ebx, dword [ebp - 8]
mov eax, dword [ebx + 0x14]
cmp ecx, eax
jge 0x5e39f3
mov eax, dword [ebp - 0xc]
mov edx, dword [ebx + 0x1c]
add edx, eax
shl ecx, 2
add edx, ecx
cmp dword [edx], 0
je 0x5e39f3
mov ebx, dword [edx]
add eax, ebx
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 8]
jle 0x5e39f3
sub eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x5e39f3
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.005e384d
mov dword [ebp - 0x10], eax
popal
mov eax, dword [ebp - 0x10]
leave
ret 8
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x54846e
Capabilities:
Encode data using xor

Disassembly:
call fcn.00549414
call fcn.00542c4a
stosd dword es:[edi], eax
xor al, byte [ecx + 0x37]
daa
ror byte [edx + edi*2], 1
cmp al, 0xd5
invalid

Function at 0x47c1b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x66000]
push edi
jmp 0x47c1ca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47c1d1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c1c0
mov eax, 1
add ebx, ebx
jne 0x47c1e3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47c1f4
jne 0x47c213
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c213
dec eax
add ebx, ebx
jne 0x47c200
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47c1d8
add ebx, ebx
jne 0x47c20f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47c265
xor ecx, ecx
sub eax, 3
jb 0x47c22b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47c29a
sar eax, 1
mov ebp, eax
jmp 0x47c236
add ebx, ebx
jne 0x47c236
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c204
inc ecx
add ebx, ebx
jne 0x47c244
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47c204
add ebx, ebx
jne 0x47c251
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47c246
jne 0x47c262
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47c246
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47c284
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47c276
jmp 0x47c1c6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47c284
add edi, ecx
jmp 0x47c1c6
pop esi
mov edi, esi
mov ecx, 0x297d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47c2a2
cmp byte [edi], 6
jne 0x47c2a2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47c2a7
lea edi, [esi + 0x79000]
mov eax, dword [edi]
or eax, eax
je 0x47c31f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7c000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7c118]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47c2d4
mov ecx, edi
jns 0x47c303
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7c11c]
or eax, eax
je 0x47c319
mov dword [ebx], eax
add ebx, 4
jmp 0x47c2f1
call dword [esi + 0x7c12c]
mov ebp, dword [esi + 0x7c120]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47c353
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40b02c], 0x8088405
inc edx
mov dword [0x40b02c], edx
mul edx
mov eax, edx
ret

Function at 0x4075c4
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40b55c
mov eax, esi
mov edx, 8
test al, 1
je 0x4075e0
shr eax, 1
xor eax, 0xedb88320
jmp 0x4075e2
shr eax, 1
dec edx
jne 0x4075d3
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x4075cc
pop esi
ret

Function at 0x4075f8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40b558], 0
jne 0x40761b
call fcn.004075c4
push 1
push 0x40b558
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407646
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40b55c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407621
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x468b3c
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004689b3

Function at 0x441370
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2d000]
push edi
or ebp, 0xffffffff
jmp 0x441392
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x441399
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x441388
mov eax, 1
add ebx, ebx
jne 0x4413ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4413a0
jne 0x4413bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4413a0
xor ecx, ecx
sub eax, 3
jb 0x4413d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x441442
mov ebp, eax
add ebx, ebx
jne 0x4413db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4413e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x44140c
inc ecx
add ebx, ebx
jne 0x4413f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4413ed
jne 0x441409
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4413ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x44142c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x44141d
jmp 0x44138e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x44142c
add edi, ecx
jmp 0x44138e
pop esi
mov edi, esi
mov ecx, 7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x44144a
cmp byte [edi], 9
jne 0x44144a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x44144f
lea edi, [esi + 0x3f000]
mov eax, dword [edi]
or eax, eax
je 0x4414c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x418e0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4191c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x44147c
mov ecx, edi
jns 0x4414ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41920]
or eax, eax
je 0x4414c1
mov dword [ebx], eax
add ebx, 4
jmp 0x441499
call dword [esi + 0x41930]
mov ebp, dword [esi + 0x41924]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4414fb
sub esp, 0xffffff80
jmp 0x40133c
Function at 0x489326
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x489386
sbb edi, dword [ebp + 0x31]
pop esi
xchg ecx, eax
wait
sal dword [edi], 1
sub edi, esi
dec esi
pop edx
invalid
sar dword [ebx], cl
jnp 0x489389
lcall 0x6fcb, 0xae12b00b
leave
mov ebx, edi
dec esp
imul eax, dword [ebx - 0x23], 0x69fbbb7e
or byte [esi + 0x64fc493d], cl
sbb eax, 0x383be6a5
cli
loope 0x48941d
jle 0x489387
pushfd
pop ebx
cdq
cmp al, byte [0x2796c16f]
pop dword [ebp + 0x1b]
pavgw mm6, qword [eax]
cmp al, 0xe1
jp 0x4893b4
xchg ebx, eax
jg 0x4893ac
jns 0x4893bf
clc
dec edx
xchg esp, eax
hlt
xchg byte [ebx - 0x7a], ch
mov ah, 0x20
push ecx
sbb eax, 0xd19fb15a
xor cl, dl
and esp, dword [0x4117edf6]
arpl word [eax + 0x3a], si
pushal
retf

Function at 0x4df8b6
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
loop 0x4df8a5
idiv dword [ecx + 0x72]
out dx, eax
mov dword [0x3d057dff], eax
jge 0x4df8c6
cmp eax, 0x643f0bfa
scasb al, byte es:[edi]

Function at 0x52aef0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [edx + 2]
add byte [ecx - 0x3ca4a1e7], cl
mov eax, dword [edx]
add dword [ecx - 0x3ca4a1ff], ecx
fadd dword [eax]
push ebx
push esi
push edi
push ebp
add esp, 0xffffffec
add byte [ecx], al
mov ebx, eax
xor esi, esi
mov esi, eax
add byte [edx], cl
add byte [eax], al
add byte [ebx + 0x10033c3], cl
int1
mov ebx, eax
mov eax, ebx
jg 0x52aec3
lea eax, [eax + eax*4]
sub edi, eax
inc esi
mov eax, dword [eax]
add edx, eax
xor byte [eax + 0x780014], bh
sub eax, esi
mov byte [esp + eax], dl
test ebx, ebx
add byte [ecx], al
mov edx, ebp
lea eax, [esp + ecx*8]
or bl, byte [eax - 0x690d2f6c]
jg 0x52ae8d
mov byte [0x134e53ad], al
jl 0x52af77
xchg dh, dl
dec esi
mov eax, ds
dec ebx
out 0x1f, al
cmp al, 0x7c
mov ah, 0x34
fidiv dword [esi - 0x74]
les esi, [ebx]
lcall 0x4810, 0xa695bb05
or eax, 0x7a47d8a0
Function at 0x53e236
Capabilities:
Encode data using xor

Disassembly:
add esp, 0xffffffcb
xchg esp, eax
pop edi
and dword [edx - 0x207f8c30], ebx
adc eax, 0x6eab5e81
stosb byte es:[edi], al
shl dword [eax + 0x77], 0x61
in eax, 0x3e
sbb dword [edi], ecx
cmp esi, edx
xchg ebx, eax
rcl cl, 0xe3
outsb dx, byte [esi]
mov ch, 0xbc
sub bl, byte [0x389e68e6]
xchg byte [ebx + 0x40], bh
call 0x4d0addd1
call 0xf3dc1404
call 0xe9793c04
movsb byte es:[edi], byte [esi]
lodsd eax, dword [esi]
pop ebp
inc edi
add dword [esi - 0x17a245e9], ecx
push ecx
mov ecx, 0x1183fa86
mov ah, 0x3e
push 0x39
and esp, ebx
sub eax, 0x75cb6bb
add byte [edx], dl
enter 0x1bee, 0xffffffffffffffd7
mov bh, bl
in eax, 0xb7
je 0x53e2df
fidiv dword [eax + 0x78cc3a9a]
lea eax, [edi]
pop edi
sbb eax, dword [ecx + 0x1afd1bbb]
sbb ecx, dword [edx - 9]
pop esi
mov es, word [esi]
rcr esi, 4
out 0x6c, eax
mov edx, 0x1adeacd0
adc byte [edx], al
mov eax, dword [0xbb9384f5]
sbb eax, 0xade41a0d
sbb eax, 0x2b953cc8
dec ebx
push esi
fcmove st(0), st(7)
sbb dl, byte [esi - 0x43e49a77]
mov esp, 0x1defb38
jmp 0xabe0d5b7
movsd dword es:[edi], dword [esi]
sub byte [ebp + 0x7a], cl
xchg byte [edx], al
scasb al, byte es:[edi]
cmp al, 0x4a
sbb dl, byte [esi]
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
push 0xffffffffffffffbe
adc al, 0xe4
adc al, 0x1e
fsub qword [ebx]
mov bl, 0x57
cwde
mov ch, 0xee
mov dh, 0xea
enter 0xffffffffffffb522, 0xffffffffffffffd9
mov edx, 0x722a0a38
or dword [ecx], esi
aaa
lds esp, [edx - 0x3ff540ea]
pushfd
dec eax
invalid

Function at 0x5ca7f6
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
salc
imul eax, edi, 0x3ab0de7b
invalid
Function at 0x6579ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6603b8
cmp edx, dword [eax]
je 0x6579cf
add eax, 8
inc ecx
cmp eax, 0x660448
jl 0x6579c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6603b8]
jne 0x657afd
mov eax, dword [0xa5cda4]
cmp eax, 1
je 0x657ad7
test eax, eax
jne 0x657a00
cmp dword [0x6602e4], 1
je 0x657ad7
cmp edx, 0xfc
je 0x657afd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657a37
lea eax, [ebp - 0x1a4]
push 0x65ca58
push eax
call fcn.00658390
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658820
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657a7a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658820
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65ca54
push edi
call fcn.0065a6f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ca38
push eax
call fcn.00658390
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006583a0
lea eax, [ebp - 0xa0]
push 0x65ca34
push eax
call fcn.006583a0
push dword [esi + 0x6603bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.006583a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ca0c
push eax
call fcn.0065a664
add esp, 0x2c
pop edi
jmp 0x657afd
lea eax, [ebp + 8]
lea esi, [esi + 0x6603bc]
push 0
push eax
push dword [esi]
call fcn.00658820
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x75092217
Capabilities:
Delete file
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x7509f008]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebx + 0x10]
test esi, esi
mov dword [ebp - 4], eax
je 0x75092292
push edi
mov edi, dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [esi + 8], 0
jne 0x75092281
push dword [esi]
lea eax, [ebx + 0x1c]
push eax
push 0x104
lea eax, [ebp - 0x108]
push eax
call fcn.75091efc
test eax, eax
je 0x75092281
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x75092281
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [esi]
call edi
mov eax, esi
mov esi, dword [esi + 4]
push eax
call edi
test esi, esi
jne 0x7509223d
pop edi
and dword [ebx + 0x10], 0
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.750922a9
leave
ret 4