joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5173e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040ef34
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00511394
test ebx, ebx
jne 0x517437
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00517260
mov ebx, eax
test ebx, ebx
je 0x51752d
cmp esi, ebx
je 0x517460
mov eax, dword [esp]
sub eax, dword [ebx + 0x48]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x4c]
mov dword [esp + 0x118], eax
jmp 0x517475
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x5174ad
add eax, 0xffffff5f
sub eax, 2
jb 0x5174c5
dec eax
sub eax, 2
jb 0x5174d9
dec eax
sub eax, 2
jb 0x5174cf
jmp 0x5174e3
add eax, 0xfffffdff
sub eax, 2
jb 0x5174c5
dec eax
sub eax, 2
jb 0x5174d9
dec eax
sub eax, 2
jb 0x5174cf
jmp 0x5174e3
mov byte [esp + 0x120], 0
jmp 0x5174eb
mov byte [esp + 0x120], 2
jmp 0x5174eb
mov byte [esp + 0x120], 1
jmp 0x5174eb
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004df3f0
mov esi, eax
call fcn.0050de94
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00512da8
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x51752f
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret
Function at 0xf551b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00f55140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00f55140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00f55140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00f55140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xf55bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xf55c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xf6787c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xf55c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf55c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10184d2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a6a10]
jne 0x10184d36
repz ret
jmp fcn.10184fdd

Function at 0x101856a3
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x101a69f8], 0
mov byte [0x101a69fc], 0
mov esi, dword [0x101a69f0]
add esi, 0x1248
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [0x101a69ec], ecx
mov dword [0x101a69f4], 0
mov dword [ebp - 0x20], eax
jmp 0x101857b8
mov eax, dword [ebp - 0x24]
mov ecx, 0x100
mov dword [0x101a6a00], 0
mov dword [0x101a69ec], 0x1dfc
mov edx, dword [0x101a69f8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + eax]
add edi, edx
mov dword [ebp - 0x28], eax
xor edx, edx
mov ebx, dword [ebp - 0x10]
div ebx
mov esi, dword [ebp - 0x14]
movzx edx, byte [esi + edx]
add edi, edx
mov dword [0x101a6a00], edi
mov eax, edi
cdq
idiv ecx
mov dword [0x101a69f8], edx
mov dword [0x101a69ec], 0x3326
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov cl, byte [ecx + edi]
mov byte [0x101a69fc], cl
mov dword [0x101a69ec], 0x118d
mov ecx, dword [ebp - 0x18]
mov cl, byte [ecx + edx]
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], cl
mov cl, byte [0x101a69fc]
mov edx, dword [0x101a69f8]
mov esi, dword [ebp - 0x18]
mov byte [esi + edx], cl
mov dword [0x101a69ec], 0x24c0
mov edx, dword [0x101a69f4]
add edx, 1
mov dword [0x101a69f4], edx
cmp edx, 0x100
mov dword [ebp - 0x24], edx
jl 0x101856fb
jmp 0x1018580e
mov eax, dword [ebp - 0x20]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x101a69ec], 0xa1e
mov eax, dword [0x101a69f4]
add eax, 1
mov dword [0x101a69f4], eax
cmp eax, 0x100
mov dword [ebp - 0x20], eax
jl 0x101857b8
xor eax, eax
mov ecx, dword [0x101a69f0]
add ecx, 0x101c
mov dword [0x101a69ec], ecx
mov dword [0x101a69f4], 0
mov dword [ebp - 0x24], eax
jmp 0x101856fb
mov dword [0x101a69ec], 0x23eb
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10185c1b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x101a69f0], 0xfdc
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x10187150]
mov dl, byte [eax + 0x10187121]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10185c3d
lea eax, [ebp - 0x24]
mov dword [0x101a69ec], 0x813
mov dword [0x101a69f0], 0xfffff9e4
mov dword [ebp - 0x34], eax
call fcn.10186ad0
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.101853c5
xor ecx, ecx
mov dword [0x101a69ec], 0x7b6
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], ecx
je 0x10185d7e
mov eax, dword [ebp - 0x38]
mov dword [0x101a69f0], 0x14b6
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x101a69f0], 0x1f02
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x40], eax
call fcn.10185574
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x101a69ec], 0x1cb
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x101a69f0], 0x19c8
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x28], ecx
mov ecx, dword [0x101a69f0]
add ecx, 0xfffffc67
mov dword [0x101a69f0], ecx
mov ecx, dword [ebp - 0x40]
mov dword [edx + 0x38], ecx
mov esi, dword [0x101a69ec]
add esi, 0xfffff830
mov dword [0x101a69ec], esi
cmp ecx, 0
mov dword [ebp - 0x3c], eax
je 0x10185d7e
mov eax, dword [ebp - 0x40]
add eax, 0x19d2
mov dword [0x101a69f0], 0x25ea
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
add esp, 0x4c
pop esi
pop ebp
ret
Function at 0x10185e6b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x30]
lea ecx, [esp + 0x40]
mov dword [0x101a69ec], 0x1c34
mov dword [0x101a69f0], 0x1ed1
mov dword [esp], eax
mov dword [esp + 0x2c], ecx
call fcn.10185820
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x48], 0x136c00
mov ecx, dword [0x101a69d8]
mov dword [esp + 0x88], ecx
mov ecx, dword [0x101a69dc]
mov dword [esp + 0x90], ecx
mov ecx, dword [0x101a69e0]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
lea eax, [0x10185af8]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x84], ecx
mov edx, dword [0x101a69e4]
mov dword [esp + 0x8c], edx
mov edx, dword [0x101a69e8]
mov dword [esp + 0x74], edx
mov dword [0x101a69ec], 0x2ba
mov dword [0x101a69f0], 0xffffe8fe
mov dword [esp + 0x20], eax
jmp 0x10185f51
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x18], ecx
je 0x10185f62
mov eax, dword [esp + 0x1c]
add eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
and eax, 0xfffff000
mov dword [0x101a69ec], 0xfffff2fa
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp word [eax], 0x5a4d
mov dword [esp + 0x1c], eax
je 0x10185f19
jmp 0x10185f2d
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x80], eax
mov dword [0x101a69f0], 0x1c0b
mov dword [0x101a69ec], 0x81b
mov ecx, dword [esp + 0x18]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x50], edx
call fcn.10186739
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
jne 0x10185fed
lea eax, [esp + 0x40]
mov ecx, dword [0x101a69ec]
add ecx, 0xffffe20a
mov dword [0x101a69f0], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10185c1b
mov dword [esp + 0xc], eax
mov eax, esp
lea ecx, [esp + 0x40]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
call eax
sub esp, 4
mov eax, 2
mov dword [0x101a69f0], 0x1693
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x101860c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [0x101a69ec]
mov dword [0x101a69f4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
mov dword [0x101a69f8], 0
mov dword [0x101a6a04], 0
mov eax, dword [ebp - 0x20]
add eax, 0xffffe517
mov dword [0x101a69f0], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], ecx
je 0x1018627c
xor eax, eax
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffff5ed
mov edx, eax
mov esi, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
mov edi, 0xc10
mov ebx, 0x100
mov dword [0x101a69f0], ecx
mov dword [0x101a69ec], 0x14b6
add edx, 1
mov dword [ebp - 0x38], eax
mov eax, edx
cdq
idiv ebx
mov dword [0x101a69f4], edx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ecx + edx]
add ecx, esi
mov eax, ecx
mov dword [ebp - 0x3c], edx
cdq
idiv ebx
mov dword [0x101a69f8], edx
mov dword [0x101a69ec], 0x44
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x3c]
mov cl, byte [ecx + esi]
mov byte [0x101a69fc], cl
mov dword [0x101a69ec], 0xe50
mov ebx, dword [ebp - 0x1c]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x101a69fc]
mov edx, dword [0x101a69f8]
mov byte [ebx + edx], cl
mov edx, dword [0x101a69ec]
mov ecx, edx
add ecx, 0xb7f
mov dword [0x101a69f0], ecx
mov ecx, dword [0x101a69f4]
movzx ecx, byte [ebx + ecx]
mov esi, dword [0x101a69f8]
movzx esi, byte [ebx + esi]
add esi, ecx
mov dword [0x101a69f0], 0x10dd
and esi, 0xff
mov dword [0x101a6a04], esi
add edx, 0xffffe052
mov dword [0x101a69ec], edx
mov cl, byte [ebx + esi]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x38]
mov ch, byte [edx + esi]
mov dword [0x101a69f0], 0xfffffdd5
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + esi], ch
mov dword [0x101a69ec], 0xc10
add esi, 1
mov edx, dword [ebp - 0x10]
cmp esi, edx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x24], edi
je 0x1018627c
mov eax, 0x1fd
mov ecx, dword [0x101a69f4]
mov edx, dword [0x101a69f8]
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], esi
jmp 0x10186144
mov eax, dword [ebp - 0x24]
add eax, 0xffffdbf0
mov dword [0x101a69f0], eax
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10186302
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x101a69ec], 0x18c8
mov dword [ebp - 0x10], eax
call fcn.10185230
xor ecx, ecx
mov edx, eax
mov dword [0x101a69f0], 0x1c0b
mov esi, dword [0x101a69ec]
mov edi, dword [eax + 0x3c]
mov ebx, edx
add ebx, edi
add esi, 0xffffdc58
mov dword [0x101a69ec], esi
cmp dword [eax + edi], 0x4550
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
je 0x10186429
jmp 0x101863e2
mov eax, dword [ebp - 0x20]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x101a69ec], 0x44e
mov edx, dword [ebp - 0x18]
add edx, ecx
mov dword [0x101a69f0], 0x1186
mov dword [ebp - 0x28], edx
jmp 0x101863c5
mov eax, dword [ebp - 0x2c]
mov ecx, eax
mov edx, dword [ebp - 0x30]
add ecx, edx
mov esi, dword [ebp - 0x18]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x36], cl
je 0x10186487
jmp 0x1018645a
mov eax, dword [ebp - 0x28]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
jmp 0x1018643b
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [0x101a69f0], 0x19b0
mov eax, dword [eax + 0x78]
mov edx, dword [ebp - 0x18]
add edx, dword [edx + eax + 0x20]
mov esi, dword [ebp - 0x18]
mov edi, dword [esi + eax + 0x24]
mov dword [0x101a69ec], 0x56b
mov ebx, dword [esi + eax + 0x18]
cmp ebx, 0
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x28], ecx
je 0x101863c5
jmp 0x101863d0
mov eax, dword [ebp - 0x14]
mov dword [0x101a69ec], 0x81b
mov dword [ebp - 0x1c], eax
jmp 0x101863e2
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov esi, dword [ebp - 0x4c]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edx
jmp 0x10186393
mov al, byte [ebp - 0x35]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x34]
add edx, 1
mov ah, byte [ebp - 0x36]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x2c], edx
jne 0x10186393
mov al, byte [ebp - 0x36]
test al, 1
jne 0x10186362
jmp 0x10186494
mov eax, dword [ebp - 0x20]
add eax, 2
mov ecx, dword [ebp - 0x50]
add ecx, 1
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
xor eax, eax
mov ecx, dword [ebp - 0x58]
mov edx, dword [ebp - 0x48]
cmp ecx, edx
mov esi, dword [ebp - 0x54]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], esi
jb 0x1018643b
jmp 0x101863c5
Function at 0x10186739
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x101a69ec], 0x9d2
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x101a69ec], 0x2420
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
jmp 0x101867ea
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x10186887
xor eax, eax
mov dword [0x101a69f0], 0x18b8
mov dword [ebp - 0x18], eax
jmp 0x101867e2
mov eax, 1
mov dword [0x101a69ec], 0x263b
mov dword [ebp - 0x18], eax
jmp 0x101867e2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10186779
jmp 0x1018678c
mov eax, dword [0x101a69f0]
add eax, 0x1815
mov dword [0x101a69f0], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0xe], 0x6c
je 0x1018679d
jmp 0x1018678c
mov eax, dword [ebp - 0x18]
add esp, 0x28
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], edx
je 0x10186828
mov dword [0x101a69f0], 0xffffe35a
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x104
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], ecx
jl 0x101867ea
mov eax, dword [ebp - 0x20]
mov dword [0x101a69ec], 0x568
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
jne 0x1018678c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1018678c
mov dword [0x101a69ec], 0x23ba
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov dx, word [eax + ecx*2 - 0x16]
mov word [ebp - 0x26], dx
mov ax, word [ebp - 0x26]
cmp ax, 0x61
je 0x101867b1
jmp 0x1018678c
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x10], 0x6c
je 0x101867c2
jmp 0x1018678c

Function at 0x3ad7258d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x3ad7a064]
jne 0x3ad72597
repz ret
jmp fcn.3ad73d0c

Function at 0x3ad74b48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x3ad74b57
pop dword [ebp - 0x44]
mov eax, 0xf0dcd6f1
add eax, 0x49fa7466
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3ca6d
push 0
mov eax, 0xa0fc66e3
add eax, 0x99daa9d1
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x5bc9
mov edi, eax
mov edx, 0x3ad88e00
add edx, dword [ebp - 0x44]
mov esi, 0x349bc979
add esi, 0xadd8c137
add dword [ebp - 0x30], edx
mov ebx, dword [edx]
sub dword [ebp - 0x40], 0xe407e6da
xor ebx, esi
add dword [ebp - 0x18], 0x3132afd8
mov dword [edi], ebx
xor dword [ebp - 8], 0x145fa15
add edi, 0x966ebd62
add edi, 0x699142a2
add edx, 4
loop 0x3ad74baa
add eax, 0x9664baa6
add eax, 0x699ca751
xor ebx, ebx
add ebx, eax
add eax, 0x16f3c02
add eax, 0xfe90c403
mov ecx, 0x3ad70000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x408296
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx - 0x7f702a0a], 0x91ce2535
pop dword [eax - 0x6e31dacb]
xor byte [0xc91ce25], 0x81
or al, 0x81
fstp st(1)
mov eax, 0x5eb2711b
outsb dx, byte [esi]
sbb al, 0xe4
aad 0xfe
fisub dword [eax]
mov bh, 0xa9
in al, 0x66
cmp dword [ecx + 0x76455df9], edx
scasb al, byte es:[edi]
pop ds
pushfd
add dword [ecx - 0x6447f5f5], 0x15953481
xor ah, al
js 0x40829a
mov byte [0x53445000], al
je 0x40829b
lds eax, [eax]
and eax, 0x9c5c121e
adc bh, byte [edx + 0xa9ca513]
sub eax, 0x1f24a463
arpl bx, cx
or esp, dword [ebx]
jecxz 0x408348
or dword [edi + edx*2], ecx
ljmp 0x64ae
lea ebx, [esi]
and eax, 0xe6906556
sti
call 0xc494ee8c
fxam
sub byte [ebx + 0xe000e1], 0x73
inc eax
push eax
adc ch, byte [edi]
push edx
mov dword [0x94dde644], eax
pop ebx
xchg esp, eax
add bh, byte [eax]
push ebx
loop 0x40839d
test byte [ebx], ah
clc
fstp qword [ebx + 9]
pop ds
add al, byte [0x10f9fc01]
fisub word [esp + ebx*8 + 0x55]
inc ecx
push 0x9a90acf9
cmp bl, byte [esi - 0x227d6ad6]
sbb byte [ebx], 0x1a
jb 0x4083f1
dec ebx
cmp dword [ecx - 0x3c85e142], esp
pop ds
mov cl, 0x25
xchg bh, dl
mov dh, 0xa1
movsd dword es:[edi], dword [esi]
inc edi
mov dl, 0xb8
mov cl, 0x61
mov cl, 0x4f
mov ebp, 0x3f42d428
out 0x43, eax
xchg byte [ebp + 0x58], cl
push ecx
test bl, 0xc4
sub eax, 0xdbb00325
add al, 0xc
je 0x4083e1
push es
mov esp, 0x71b45642
jecxz 0x408332
pop eax
jno 0x4083b9
cmp eax, 0xf1f2c746
int1
cld
add dword [ebp + 0x2430254f], 0x1a51570b
sbb dh, al
xor eax, 0x649737a1
mov bh, 0x7e
mov ebx, 0x25dcfbd4
test dword [ebx + 0x1b008280], eax
add byte [edx + 0xdca1b00], 0x85
in al, dx
bound esp, qword [edi]
shl ebp, cl
adc bh, ch
sbb dl, byte [ecx + 0x2bfaa4da]
sbb dword [0x5b47f14c], 0x22
std
ret

Function at 0x4083d6
Capabilities:
Encode data using xor

Disassembly:
invalid
add byte [edx + 0xdca1b00], 0x85
push eax
xor ch, al
out 0xec, eax
div byte [ebx + 0x44]
sbb edx, dword [esi]
add dword [edx - 0x714f989e], eax
push eax
xor al, 0xa1
les esp, [edx + 0x27]
pop edi
mov di, 0x7bb5
pushal
nop
out 0xf3, eax
sal ah, 0xc7
in eax, dx
cmc
sbb al, 0x2b
pushal
adc byte [eax - 3], dh
and ebp, ebx
xor al, 0x2c
push edi
mov esp, 0xb65382cd
dec ebx
cmpsb byte [esi], byte es:[edi]
jl 0x4083b7
mov ebx, 0xa4f78b1c
add eax, 0xf7c09324
outsd dx, dword [esi]
aas
popal
fnsave dword [ebx + 0x61676344]
mov ch, 0xf5
mov ecx, dword [edx + 0x40eba989]
insb byte es:[edi], dx
into
mov eax, dword [0x86346683]
retf 0x7b07
Function at 0x408686
Capabilities:
Encode data using xor

Disassembly:
in al, 3
and eax, 0x9c500457
sbb eax, 0xba544145
jmp 0x4086d8
mov ch, 0x3e
dec eax
stosb byte es:[edi], al
or al, 0xb9
cmp al, byte [eax]
shr dword [eax + 0x7c], 1
out dx, eax
push esp
pop ds
inc eax
adc eax, 0x323c775
adc byte [eax], bl
adc eax, 0xd517ee31
jo 0x408722
xor esi, ebp
pop ss
aad 0x70
inc esp
les ecx, [ebp + 0x77d72227]
add cl, dl
xor byte [eax], ah
push edi
mov byte [0x54de3828], al
adc dword [ebx + edi*8 - 0x4c28378c], esi
rcr dword [edi + esi*8 - 0x703e14c9], cl
aad 0x39
enter 0x6feb, 0xffffffffffffff83
jb 0x4086c0
inc edi
xor al, 0x33
cmp byte [edi + 0x4d3037f4], cl
push esi
pop esp
pop eax
push ecx
lahf
pop ecx
xchg esi, eax
sub edi, dword [eax - 0x5bae52fb]
out 0x8f, al
xor ebx, eax
inc ebx
in al, 0xaa
test eax, 0x373fd4c4
out 0x62, al
or esp, dword [edx]
std
invalid
Function at 0x426356
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x84b1af50
mov cl, 0x84
adc eax, 0x417e35ba
jl 0x4263db
adc dword [ecx], edi
leave
pop es
push ebp
je 0x4263b7
retf
adc byte [ebx], 0xc3
das
pop ss
inc ebp
push esp
out dx, al
aad 0x67
lcall 0x712d, 0xceb02f41
jae 0x4263ab
mov al, 0xce
sub eax, 0x6e307371
outsb dx, byte [esi]
aad 0xdf
or dword [ebx + 0x2f], edi
das
fidiv dword [eax + 0x61]
lodsd eax, dword [esi]
dec edx
jg 0x426368
xchg dword [edi + 0x41], edi
add dword [eax], ecx
aaa
jno 0x4263ee
push esi
mov eax, dword [0x99809191]
fbld tbyte [ecx - 0x6a]
xchg esi, eax
jle 0x4263c1
rcl dword [edx - 0x142e38e4], 0xc2
and edi, esp
add al, 0x21
imul ebx, dword [eax], 0xd278509a
push eax
js 0x426380
shl dl, cl
jo 0x426375
loop 0x426420
les eax, [edi + 0x1c9d34cb]
xor edx, dword [ebx + edx*8 - 0x463e5c6d]
invalid
xchg ebx, ecx
xor al, 0x9d
sbb al, 0x33
xchg esp, eax
rcl dword [ebx - 0x23463e5d], cl
fdivp st(7)
jo 0x426352
nop
int1
bound edi, qword [ebx + 0x52]
jne 0x4263ad
add eax, dword [ebx]
test byte [esi + 0x71], 0x73
jne 0x426399
pushal
inc ecx
call 0x8473e328
or dl, bh
fcmovu st(0), st(1)
inc esp
jne 0x426417
jge 0x426410
and edx, dword [edx + 0x13]
mov fs, word [eax - 0x54]
xchg esp, eax
and byte [ebp - 0x7f], dl
sbb byte [esi - 0x34], dl
int1
int1
invalid
pop edx
sub byte [edx + eax - 0x3b], dl
inc edi
rcl dword [eax - 0x5f1ebc1f], cl
xor ecx, esi
inc ebx
enter 0xffffffffffffb015, 0xffffffffffffffd6
daa
mov ah, 0x99
adc eax, 0xb427d6b0
cdq
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
jae 0x42643c
lds edx, [bx + di]
xchg ecx, eax
retf
push ss
fcmovne st(0), st(4)
and byte [eax + 0x75107df9], dl
stosd dword es:[edi], eax
inc ebp
pop ss
test ecx, esp
xor dword [0x631b5d95], ebp
je 0x426416
pop ebx
test dword [ebx + 0x79], ebx
shr byte [edx], 0x32
and edx, edx
mov dword [0xc26271c1], eax
xor ah, byte [ebx]
shl byte [ebx - 0x3d9d8e3f], cl
test byte [ebx], dl
add dh, ch
pop ebp
jae 0x4264b2
in eax, 0x58
das
adc bl, byte [edi + ebp*4]
mov dl, 0xa7
call 0x37c7c3fd
aaa
lcall 0x80af, 0xe5e59a7f
vsubps xmm0, xmm1, xmm7
dec ebx
inc edi
mov cl, 0xdb
push edi
test dword [eax + ebx*2 + 0x32], esi
and edi, edx
adc eax, 0x4da35e60
mov cl, 0x97
jno 0x426400
adc eax, edi
push ebp
push ds
adc esp, edx
ror dword [esi + 0x51], cl
add dword [edi], ebp
test eax, 0x67025a05
pushfd
xor dword [ebx], ebp
and bh, byte [ebx]
cmp cl, ch
test eax, 0x379f9126
lahf
sbb byte [ebx - 0x7f], ch
sbb eax, edx
jecxz 0x426503
invalid
jg 0x426457
test dword [eax - 0x40ad6e43], eax
in eax, 0x82
mov dword [ecx], ebx
mov esi, 0x1a2e2e89
push edx
dec eax
dec edx
iretd
xor dword [ebx], ebx
xor dh, byte [0x9ae3268e]
and al, 0x1c
lodsb al, byte [esi]
invalid