joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027bfd
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10027c79
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10027c49
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10027c47
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10027c77
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10027c77
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x10027c95
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x20]
push dword [ebp - 0x24]
call fcn.10027974
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10048f57
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10048f7f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x6b08
push 1
push dword [ebp - 4]
call fcn.10048fd3
add esp, 0xc
jmp 0x10048fcf
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10048fa1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10048fcf
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10048fcf
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esp, ebp
pop ebp
ret
Function at 0x1004ee59
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1004ee8a
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push 0x4368
push dword [ebp - 0xc]
call fcn.10058f8b
add esp, 0x10
jmp 0x1004ef04
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x28], 0x1008f664
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004eeb9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1004ef04
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1004eee7
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1004ef04
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x24]
call fcn.10022db7
mov dword [eax], 0xdf603fa7
jmp 0x1004eedc
mov esp, ebp
pop ebp
ret
Function at 0x10058fb7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1005905e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10059011
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1005900f
push 0xda3
push 0
call fcn.1005bc79
pop ecx
pop ecx
jmp 0x1005905c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1005903f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1005905c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10022db7
mov dword [eax], 0x7ca0029b
jmp 0x10059034
jmp 0x100590be
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10059088
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x100590be
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 0x50]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1005e40d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1005e462
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1005e449
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1005e447
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x1005e460
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1005e488
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
push 0
push dword [ebp - 0x18]
push 0x1300
push 0x280f
push dword [ebp - 0x1c]
call fcn.100693e9
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100695c7
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100696c2
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], 0x11bb
mov dword [ebp - 0x1c], 0x100102d0
cmp dword [ebp - 0x10], 0x14c0
jle 0x10069664
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
and dword [ebp - 4], 0
jmp 0x10069609
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x255f
jge 0x10069664
and dword [ebp - 8], 0
jmp 0x1006961f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x69d0
jge 0x10069662
and dword [ebp - 0xc], 0
jmp 0x10069635
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x6e6c
jge 0x10069660
mov eax, dword [ebp - 4]
xor eax, dword [ebp - 8]
xor eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1006962e
jmp 0x10069618
jmp 0x10069602
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x10], 0x10ea
jge 0x10069680
mov edx, dword [ebp - 0x1c]
mov ecx, 0x1008fbf8
call fcn.1002574f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100696a9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x100696c0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
jmp 0x100696df
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
push 0x367
push dword [ebp - 0x34]
push 0x59c3
push 0
call fcn.1004e6ad
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1006a847
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1006a93d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1006a89e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1006a899
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
jmp 0x1006a93b
mov dword [ebp - 0x10], 0x2ced
mov dword [ebp - 0x24], 0x10010644
cmp dword [ebp - 0x10], 0x2e8a
jle 0x1006a909
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 8], 0
jmp 0x1006a8cc
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x79
jge 0x1006a909
and dword [ebp - 0xc], 0
jmp 0x1006a8df
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x7541
jge 0x1006a907
mov eax, dword [ebp - 8]
and eax, dword [ebp - 0xc]
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x1008fbf8
call fcn.100229ff
jmp 0x1006a8d8
jmp 0x1006a8c5
mov byte [ebp - 1], 0
push 0xd5f
push 0
lea eax, [ebp - 1]
push eax
push 0x3fc4
call fcn.1006b7b4
add esp, 0x10
cmp dword [ebp - 0x10], 0x2955
jge 0x1006a93b
mov edx, dword [ebp - 0x24]
mov ecx, 0x1008fbf8
call fcn.1002574f
jmp 0x1006a951
push 0xe99
push 0x736c
push 1
call fcn.10060afa
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10070f8a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x100710b4
push ebx
push edi
push dword [esi]
xor ebx, ebx
push ebx
push dword [esi + 4]
call fcn.10048241
add esp, 0xc
mov dword [ebp - 8], 0xc184c506
mov dword [ebp - 8], ebx
push 1
pop edi
jmp 0x10070fc7
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10070fbd
mov dword [ebp - 8], ebx
jmp 0x10070fe5
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10070fe2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x10070fd2
push dword [esi + 4]
call fcn.10075059
mov dword [esi + 4], ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], 0xae5d5ec7
mov dword [ebp - 0xc], edi
pop ecx
mov dword [ebp - 8], ebx
jmp 0x10071016
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10071008
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x100710b0
push 4
lea ecx, [ebp - 0x2c]
call fcn.10022d19
mov dword [ebp - 8], 0xbf38
mov dword [ebp - 8], ebx
jmp 0x1007104e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], 0x2b57e8b7
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1007103e
mov edi, dword [ebp - 0x2c]
mov dword [edi + 4], ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10071070
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_DeferWindowPos]
inc dword [edi + 4]
cmp dword [edi + 4], 0xa
mov dword [ebp - 8], 0x19ac196a
jne 0x1007105a
xor edi, edi
inc edi
cmp dword [ebp - 8], ebx
jne 0x1007109c
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0xc], ebx
je 0x1007109c
mov dword [ebp - 0xc], edi
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
lea ecx, [ebp - 0x2c]
call fcn.10022d9b
inc dword [ebp - 0x1c]
je 0x10071028
pop edi
mov dword [esi], ebx
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1008532f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1008e750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10078548
mov dword [ebp - 0x14], eax
cmp dword [0x10090c54], esi
jne 0x10085422
push 0x800
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100853af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10085502
push esi
push esi
push 0x1000675c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10085502
push 0x10006774
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10085502
push eax
call ebx
push 0x10006780
push edi
mov dword [0x10090c54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10006790
push edi
mov dword [0x10090c58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100067a4
push edi
mov dword [0x10090c5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10090c64], eax
test eax, eax
je 0x1008541f
push 0x100067c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10090c60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10085447
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1008543a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1008545c
push 4
pop eax
jmp 0x10085504
cmp dword [ebp - 0x14], esi
je 0x1008545c
push dword [0x10090c54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10085441
mov eax, dword [0x10090c60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100854ba
cmp dword [0x10090c64], edi
je 0x100854ba
push eax
call ebx
push dword [0x10090c64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100854ba
test eax, eax
je 0x100854ba
call ecx
test eax, eax
je 0x100854af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100854af
test byte [ebp - 8], 1
jne 0x100854ba
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100854ea
mov eax, dword [0x10090c58]
cmp eax, edi
je 0x100854e7
push eax
call ebx
test eax, eax
je 0x100854e7
call eax
mov esi, eax
test esi, esi
je 0x100854e7
mov eax, dword [0x10090c5c]
cmp eax, edi
je 0x100854e7
push eax
call ebx
test eax, eax
je 0x100854e7
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10090c54]
call ebx
test eax, eax
je 0x10085502
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10085504
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10075a5a
mov esp, ebp
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x50755400
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
mov ecx, 0x3ce241e3
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40124e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x418c00
dec eax
adc al, byte [ecx + eax*4]
jle 0x418c51
cmp dword [esi + 0x4e], 0x86737b66
cmp byte gs:[edi + 1], 2
jnp 0x418c79
xchg byte [ebp - 0x80], ah
jg 0x418c0c
add al, byte [eax + ecx*2]
add al, 0x48
adc byte [ecx + eax*4], al
jg 0x418c20
nop
add ch, byte [ecx + 0x51]
push ecx
xor al, 0x81
jle 0x418c21
cmp al, 0x6f
cmp byte [bp + 8], 0x82
cmp byte [esi + 8], 0x82
jle 0x418c2b
add byte [ecx*2 + 0x7e820480], 0x29
add al, 0x4d
add byte [edx + eax*4], 0x7e
sub dword [eax - 0x24a5124a], esi
cmp byte [ebp + 0x6c], 0x4b
movsb byte es:[edi], byte [esi]
mov al, 0xb6
in eax, dx
pop edx
fild dword [edx - 0x5bb49383]
in al, 0xc5
xchg ebx, eax
cmp byte [ebp + 0x7a], 0xca
mov dl, 0x15
inc esp
test byte [ecx + 0x7b62de7e], 0xf3
mov esp, 0xdd7d81c1
push 0x77
cwde
sal dword [esi - 0x7f], cl
jle 0x418c16
xor byte [eax - 0x4a], bh
js 0x418c0c
sbb eax, 0x4d7e827b
adc cl, byte [edi]
pop esi
imul ebx, ebx, 0xffffff81
jle 0x418c54
out 0x79, al
wait
xchg dword [ecx - 0x7f], edi
jl 0x418bfd
add al, 0x52
xchg edx, eax
les edi, [esi]
cmp dword [esi + 0x5b], 0x6d8679ec
sub al, 0x81
jge 0x418cd3
mov ebx, 0xdb1babd5
cmp byte [esi + 0x5b], 0x56
les ebp, [ebp + 0x3c]
fild dword [ecx + 0x743b8e7d]
pop edx
xlatb
cmp dword [esi - 0x32], 0xe3832de6
fld dword [edx - 0x61b4ef83]
das
dec ecx
xor dword [edx - 0x50c48a82], eax
push 0x7e82c733
outsb dx, byte [esi]
shl dword [esi + ecx*4], cl
pop ss
pushal
cmp dword [esi - 0x65], 0xb019673d
insd dword es:[edi], dx
cmp byte [esi + 0x71], 0x51
sub al, 0x6b
pop ebp
mov ebx, 0xdb9b7d81
outsb dx, byte [esi]
xor edx, ebx
sbb al, byte [edx - 0x178add83]
insb byte es:[edi], dx
fmul dword [edx - 0x138f817f]
in al, dx
inc ecx
pushfd
cmp dword [eax + 0x2402087f], eax
dec eax
xchg edx, eax
add al, 0x81
jg 0x418d30
shl dword [eax], cl
dec ecx
shl dword [edx - 0x43fe817f], 1
int 0xb3
insd dword es:[edi], dx
cmp dword [bp + 0x58], 0x10ce78bc
add eax, dword [edx - 0x6ab7e883]
and ebx, eax
lahf
cmp dword [esi - 0xd], 0xe79b19b6
fadd dword [edx - 0x3b1c4982]
jmp 0x7ec34862
cmp dword [ebp - 0x1c], 0x6f
invalid

Function at 0x3493700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0349378f
jae 0x349370e
xor ecx, ecx
call fcn.0349378f
jae 0x349373d
xor eax, eax
call fcn.0349378f
jae 0x349374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0349378f
adc al, al
jae 0x349372f
jne 0x3493779
stosb byte es:[edi], al
jmp 0x3493711
call fcn.0349379b
sub ecx, ebx
jne 0x3493756
call fcn.03493799
jmp 0x3493775
lodsb al, byte [esi]
shr eax, 1
je 0x3493783
adc ecx, ecx
jmp 0x3493772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.03493799
cmp eax, 0x7d00
jae 0x3493772
cmp ah, 5
jae 0x3493773
cmp eax, 0x7f
ja 0x3493774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x3493711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x10008fff
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1000900e
pop dword [ebp - 0x3c]
mov eax, 0x5332beb0
sub eax, 0x43322ea2
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xba8221dd
add dword [ebp - 0x4c], 0x93d0236e
mov dword [ebp - 0x48], 0xf948af7a
add dword [ebp - 0x48], 0x38ea9ccb
mov dword [ebp - 0x44], 0xacfc0b4e
add dword [ebp - 0x44], 0x9f5038e0
mov dword [ebp - 0x40], 0x8024e78b
add dword [ebp - 0x40], 0x7fdb1875
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x4c51346c
sub eax, 0x3c509468
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xe3618dbf
sub dword [ebp - 0x4c], 0x6eef2469
mov dword [ebp - 0x48], 0xbb6e6804
add dword [ebp - 0x48], 0x85fdf971
mov dword [ebp - 0x44], 0xeb033cc
sub dword [ebp - 0x44], 0xab40c760
mov dword [ebp - 0x40], 0xaa171aef
sub dword [ebp - 0x40], 0xaa171aef
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x7fdb7058
sub eax, 0x6fdad050
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x375a6
push 0
call eax
mov ecx, 0x1f5b651b
add ecx, 0xe0a4e62a
xor edi, edi
add edi, eax
mov ebx, 0x1000f800
add ebx, dword [ebp - 0x3c]
mov edx, 0x5b76c5c6
xor dword [ebp - 8], 0x82a9b956
mov esi, dword [ebx]
add dword [ebp - 0x24], eax
xor esi, edx
mov dword [ebp - 0x18], 0xa62c1d2c
mov dword [edi], esi
xor dword [ebp - 0x14], 0xc0036d0
add edi, 0x3f1b379b
add edi, 0xc0e4c869
add ebx, 0xcd3a279
sub ebx, 0xcd3a275
loop 0x10009126
add eax, 0xed56fd46
sub eax, 0xed55dd5f
mov ebx, eax
add eax, 0x6ca0e8db
sub eax, 0x6ca0e8d6
mov ecx, 0xe966cd1d
add ecx, 0x269932e3
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x103f52a1
Capabilities:
Check for software breakpoints

Disassembly:
mov cl, byte [edi + ecx - 0x2eb3a080]
push 0xb7231e3d
add edi, 2
and dl, cl
call fcn.10580310
sysenter
call int.1093819d
mov ebp, 0xf7b994b4
push ebp
neg byte [esp + 2]
mov edi, dword [esi]
shr ebp, 0x3f
sbb ebp, 0x3719903c
add esi, 4
xchg edi, esi
lea ecx, [ebp - 0x7375435f]
inc dword [esp + ecx - 0x55712c65]
movsx eax, cl
mov ebp, edi
js 0x109843e8
ror dword [ebx + 0x12880fef], 0xf1
pop eax
add bl, ah
cmc
jecxz 0x103f52cd
adc al, 0x98
aad 0xd1
wait
sub ebp, esi
jp 0x103f535f
dec edx
sbb edx, dword [edi + 0xd9c9692]
pop ecx
int3
stosb byte es:[edi], al
iretd
movsx edx, cx
pop edi
jne 0x104300c3

Function at 0x10429cb8
Capabilities:
Encrypt data using speck

Disassembly:
not dl
not al
or dl, al
mov word [esi], dx
call fcn.10605847

Function at 0x10449839
Capabilities:
Encrypt data using speck

Disassembly:
je 0x10555416
dec eax
mov dword [esp], 0xcf250d90
dec eax
add ebp, 6
mov word [ebp], ax
call fcn.1051a22e

Function at 0x1045778d
Capabilities:
Encrypt data using speck

Disassembly:
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.103f7c7e

Function at 0x10465cff
Capabilities:
Encrypt data using speck

Disassembly:
jmp 0x1096c628
lea esp, [esp + 4]
jmp fcn.1041c311

Function at 0x10469884
Capabilities:
Parse pe header

Disassembly:
mov edi, dword [ecx + edx + 0x18]
test bp, 0x8235
test edi, edi
jmp 0x105ed956
push ebp
or ebp, 0x302f6f10
btc ebp, 0x82
mov ebp, esp
mov edx, dword [ebp + 8]
test ebx, 0x7209acb4
stc
lea esp, [esp - 0x114]
push esi
test cx, 0xb012
test esi, esp
test edx, edx
jmp 0x1094769a
ja 0x104317b9
mov eax, esi
cmp bx, 0x351c
cmc
clc
sub eax, dword [ecx + edx + 0x10]
jmp 0x10932bb9
je 0x105d8148
xor eax, eax
pop esi
jmp 0x105aed6b
jne 0x104ea300
mov ecx, dword [eax + 0x78]
stc
test esi, edi
mov dword [ebp - 4], ecx
jmp 0x105a2fb9
je 0x104ea300
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x104ea2fa
test ecx, ecx
jmp 0x1095e59d
mov esp, ebp
movsx ebp, di
pop ebp
ret
lea eax, [eax + edx]
xor ebx, ebx
test ah, ch
mov dword [ebp - 0xc], eax
test esp, ebp
test ah, 0xb8
test edi, edi
jmp 0x1095683f
mov eax, dword [edx + 0x3c]
test dl, dl
add eax, edx
cmc
test cx, ax
cmp sp, 0x29c
cmp dword [eax], 0x4550
jmp 0x1053b84e
je 0x10986c05
mov eax, dword [ecx + edx + 0x20]
jmp 0x105f8e9c
dec edi
jmp 0x105c05b2
je 0x104ea300
mov esi, dword [ebp + 0xc]
clc
test esi, esi
jmp 0x105412dc
je 0x104ea300
mov eax, dword [eax + 0x7c]
test esp, ecx
push ebx
cmp esp, 0x18bd3eb8
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0xffffffff
clc
cmc
cmp esi, 0xffff
jmp 0x104b415f

Function at 0x10497634
Capabilities:
Encrypt data using speck

Disassembly:
mov word [edi], ax
call 0x1094c194
dec ecx
sub eax, 1
add dword [eax], eax
add byte [eax], al

Function at 0x104a52da
Capabilities:
Encode data using xor

Disassembly:
sbb esi, 2
call 0x1045de6c
dec eax
mov edx, dword [ebp + edx - 0x621c9021]
jmp 0x1098301f
jae 0x10418ecb
mov edx, 0x621c9021
jmp 0x1048fd40
inc ecx
mov edi, 0x7e137694
inc cx
xor edi, 0x8b4ee70a
mov esp, 0xec6e6a3d
sub eax, 0xffc74d14