joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14efc
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x150b8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x14f5d
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x150d4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x14fcf
xor eax, eax
push ebp
push 0x14fc8
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00014d54
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x14fb1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x150f4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x14fcf
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x150b0
cmp byte [ebp - 0xd], 0
jne 0x15011
cmp byte [ebp - 0x12], 0
je 0x150b0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x1502a
dec ebx
cmp byte [ebx], 0x2e
je 0x15039
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x15029
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x150b0
inc ebx
cmp byte [ebp - 0x12], 0
je 0x15066
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x150b0
cmp byte [ebp - 0xd], 0
je 0x150b0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x150b0
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x19efc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x19f35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00013aec
jmp 0x19f3e
mov eax, ebx
mov edx, esi
call fcn.00013a58
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x19f48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x19f69
mov al, byte [esp]
jmp 0x19f6b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x1c7b8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x3c85c
cmp dword [edi], 0
jne 0x1c834
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x3c858]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x359c8
mov ecx, 2
call fcn.000129c0
mov edx, 0x1c790
lea eax, [esi + 5]
call fcn.0001c7b0
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0001c7b0
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x1c809
mov dword [0x3c858], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x1d840
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push ebx
mov eax, esi
call fcn.00013e24
push eax
call sub.kernel32.dll_CreateDirectoryA
neg eax
sbb eax, eax
neg eax
mov ebx, eax
test bl, bl
jne 0x1d891
call sub.kernel32.dll_GetLastError_1
cmp eax, 0xb7
jne 0x1d878
cmp byte [esp], 0
je 0x1d891
mov dword [esp + 4], esi
mov byte [esp + 8], 0xb
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x1d8a4
call fcn.0001d6f0
mov eax, ebx
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x1da28
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
call sub.kernel32.dll_GetTickCount
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push eax
push edi
push esi
call sub.user32.dll_PostMessageA
test eax, eax
jne 0x1dab5
call sub.kernel32.dll_GetLastError_1
sub eax, 1
jb 0x1da83
sub eax, 0x717
je 0x1da83
mov dword [ebp - 0x14], edi
mov byte [ebp - 0x10], 0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x1dad0
call fcn.0001d6f0
push 0x3c9d4
call sub.kernel32.dll_InterlockedIncrement
push 1
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount
sub eax, ebx
cmp eax, 0x2710
jb 0x1da3f
mov eax, 0x1db08
call fcn.0001d2a8
call sub.kernel32.dll_GetTickCount
mov ebx, eax
jmp 0x1da3f
push 0x3c9d0
call sub.kernel32.dll_InterlockedIncrement
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1e3d4
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1e473
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x3c9f8], 0
je 0x1e408
mov eax, ebx
mov edx, dword [0x3c9f8]
call fcn.00013a58
jmp 0x1e45d
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
call sub.kernel32.dll_GetComputerNameA
neg eax
sbb eax, eax
neg eax
mov edx, 0x1e488
call fcn.0001d59c
push ebx
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x14]
mov ecx, 0x10
call fcn.00013c34
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
mov edx, 1
call fcn.00013e68
mov eax, 0x3c9f8
mov edx, dword [ebx]
call fcn.00013a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1e47a
lea eax, [ebp - 0x18]
call fcn.00013a04
ret

Function at 0x1e550
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push esp
push 0x104
call sub.kernel32.dll_GetTempPathA
test eax, eax
jne 0x1e57c
lea edx, [esp + 0x108]
or ecx, 0xffffffff
mov eax, 0x1e5a8
call fcn.0001d6f0
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00013c34
mov eax, dword [ebx]
mov edx, 0x1e5d4
call fcn.0001e3b4
add esp, 0x108
pop ebx
ret

Function at 0x1e5e8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e24
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x1e601
test al, 0x10
je 0x1e605
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x1e60c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e24
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x1e625
test al, 1
jne 0x1e629
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x1e630
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00013e24
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x1e649
test al, 0x10
jne 0x1e64d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x1ee08
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov ebx, edx
mov esi, eax
lea eax, [esp + 8]
push eax
push esi
call sub.kernel32.dll_GetFileSize_1
mov edi, eax
cmp edi, 0xffffffff
jne 0x1ee5b
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x1ee5b
test bl, bl
je 0x1ee4a
mov dword [esp + 0xc], esi
mov byte [esp + 0x10], 0
lea edx, [esp + 0xc]
xor ecx, ecx
mov eax, 0x1ee84
call fcn.0001d6f0
mov dword [esp], 0xffffffff
mov dword [esp + 4], 0xffffffff
jmp 0x1ee6d
mov edx, dword [esp + 8]
mov eax, edi
call fcn.0001ee04
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x1eeb0
Capabilities:
Clear file content

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push ebx
call sub.kernel32.dll_SetEndOfFile_1
test eax, eax
jne 0x1eed6
mov dword [esp], ebx
mov byte [esp + 4], 0
mov edx, esp
xor ecx, ecx
mov eax, 0x1eee4
call fcn.0001d6f0
pop ecx
pop edx
pop ebx
ret
Function at 0x20d3c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov edi, eax
mov eax, esi
mov edx, 0x80
call fcn.00013ef0
push 0x81
mov eax, esi
call fcn.00013e30
push eax
mov eax, edi
call fcn.00013e24
mov ebp, eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
mov ebx, eax
cmp ebx, 0x80
jg 0x20d84
mov eax, esi
mov edx, ebx
call fcn.00013ef0
jmp 0x20dee
dec ebx
mov eax, esi
mov edx, ebx
call fcn.00013ef0
lea eax, [ebx + 1]
push eax
mov eax, esi
call fcn.00013e30
push eax
push ebp
call sub.kernel32.dll_GetEnvironmentVariableA
cmp ebx, eax
je 0x20dc5
mov dword [esp], edi
mov byte [esp + 4], 0xb
push esp
push 0
mov ecx, 0x20e00
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
mov eax, dword [esi]
cmp byte [eax + ebx], 0
je 0x20dee
mov dword [esp], edi
mov byte [esp + 4], 0xb
push esp
push 0
mov ecx, 0x20e50
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x2bb68
Capabilities:
Inspect section memory permissions

Disassembly:
push ecx
mov word [esp], dx
mov ax, word [0x2bbd4]
cmp ax, word [esp]
jne 0x2bb80
mov eax, 0x80
pop edx
ret
xor eax, eax
test byte [esp], 2
je 0x2bb8d
or eax, 0x80000000
test byte [esp], 4
je 0x2bb98
or eax, 0x20000000
test byte [esp], 8
je 0x2bba3
or eax, 0x8000000
test byte [esp + 1], 4
je 0x2bbaf
or eax, 0x10000000
test byte [esp], 0x10
je 0x2bbba
or eax, 0x4000000
test byte [esp], 0x20
je 0x2bbc5
or eax, 0x100
test byte [esp], 0x40
je 0x2bbd0
or eax, 0x40000000
pop edx
ret

Function at 0x2f18c
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jne 0x2f1a1
mov byte [ebx + 0xd], 0
pop ebx
ret

Function at 0x30a60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00013e24
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x30ab8
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x375cc]
mov dl, 1
mov eax, dword [0x305d8]
call fcn.0001a788
call fcn.00013420
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.000306e8
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x32f87
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a690
mov edx, eax
xor eax, eax
test eax, eax
je 0x32f8c
mov eax, edx
call fcn.00013420
cmp byte [0x32f87], 0xe8
jne 0x3300a
mov eax, dword [0x32f88]
add eax, 0x32f8c
mov ebx, dword [eax]
cmp ebx, dword [0x33002]
jne 0x3300a
mov ebx, dword [eax + 4]
cmp ebx, dword [0x33006]
jne 0x3300a
push eax
lea ebx, [ebp - 4]
push ebx
push 0x40
push 0x10
push eax
call sub.kernel32.dll_VirtualProtect
or eax, eax
pop eax
je 0x3300a
lea ebx, [eax + 8]
mov dword [0x3cf30], ebx
mov byte [eax], 0x50
mov byte [eax + 1], 0xb8
mov dword [eax + 2], 0x32d58
mov word [eax + 6], 0xe0ff
push eax
lea ebx, [ebp - 8]
push ebx
push dword [ebp - 4]
push 0x10
push eax
call sub.kernel32.dll_VirtualProtect
or eax, eax
pop eax
je 0x3300a
mov eax, 1
jmp 0x3300c
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
setne bl
push 0
push 0
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x335e8
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, eax
test ebx, ebx
jne 0x33615
mov dword [esp], ebx
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x336d4
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
xor esi, esi
mov byte [edx], 0
mov eax, ebx
cmp word [eax], 0x5a4d
je 0x3364c
test cl, cl
je 0x336c3
mov dword [esp], ebx
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x336fc
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
je 0x3367e
test cl, cl
je 0x336c3
mov dword [esp], ebx
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x33728
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
mov di, word [eax + 0x18]
sub di, 0x10b
je 0x33692
sub di, 0x100
je 0x33697
jmp 0x3369c
mov byte [edx], 1
jmp 0x336c1
mov byte [edx], 2
jmp 0x336c1
test cl, cl
je 0x336c3
mov dword [esp], ebx
mov byte [esp + 4], 0
push esp
push 0
mov ecx, 0x33754
mov dl, 1
mov eax, dword [0x17754]
call fcn.0001a6cc
call fcn.00013420
mov esi, eax
mov eax, esi
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x401fd1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb
mov eax, dword fs:[0x8f0000]
push eax
sub esp, 0x410
add byte [eax], al
and al, 0x56
add byte [ebx], dh
lds esp, [eax + eax - 0x14]
push ebx
push esi
push edi
push eax
lea eax, [ebp]
add byte [ebx], ah
sub byte [eax], al
invalid

Function at 0x419fc1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb
mov eax, dword fs:[0x8f0000]
push eax
sub esp, 0x410
add byte [eax], al
and al, 0x56
add byte [ebx], dh
lds esp, [eax + eax - 0x14]
push ebx
push esi
push edi
push eax
lea eax, [ebp]
add byte [ebx], ah
sub byte [eax], al
invalid

Function at 0x41e6ca
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebp + 0x500b74c0], al
add byte [eax], al
lodsb al, byte [esi]
mov dh, 0x51
add byte [ebx - 0x7cffff6a], al
jle 0x41e659
add byte [eax + ecx], dh
add byte [eax + eax], dl
xor eax, eax
pop esi
push esp
add al, al
inc eax
pop esi
ret
add byte [ebx - 0x1f5ecb14], al
loop 0x41e661
add byte [ebx], dh
lds ecx, [ecx + 0x53fc45]
add byte [ebx - 0x6e04170f], cl
insb byte es:[edi], dx
add byte [ebx + 0x3bdb33f8], cl
sti
je 0x41e679
add byte [edi + 0x20], dh
jne 0x41e6a4
call 0x41e6ca
cmp byte [eax + 0x14], bl
jne 0x41e6a1
add byte [eax], al
insd dword es:[edi], dx
add byte [eax], al
cmp edi, dword [eax - 0x70]
add byte [ecx], cl
call fcn.0042b93e
test dword [eax], eax
add byte [esi], al
push ebx
call 0x5c6516
mov dword [edi + 0x20], ebx
cmp dword [edi + 0x24], esi
jne 0x41e6a9
add byte [edi + 0x24], bl
mov ecx, dword [esi + 0x64]
rol byte [eax], 0x74
or byte [ebx + 0x5050ff01], cl
add byte [eax + ecx - 0x75], dh
add edi, edi
push eax
push eax
add byte [eax], al
mov ecx, dword fs:[esi + 0x68]
xor esp, edx
add byte [ebp - 0x74f98b37], al
add dword [ebx], edx
add byte [ebx + eax*4], al
push 0xb00
add byte [eax + 0x74], bl
dec ecx
call fcn.00425471
add byte [eax + 0x3c], bh
test edi, edi
je 0x41e6b0
add byte [edi + 0x20], bh
add byte [edi + esi + 0x6a], dh
xor byte [eax], al
add ah, cl
push 0
push eax
call 0x50e702
mov eax, dword [esi + 0x20]
add esp, 0
add byte [ebp - 0x2c], al
mov dword [ebp - 0x28], eax
pop ecx
add ah, cl
push eax
push 0
push 0x433
push dword [edi + 0x20]
mov dword [ebp - 1], 0
mov dword [ebp - 0x30], ebx
inc dword [eax]
add byte [edi + 0x468b0051], dh
mov cl, 0
cmp eax, 0x51b7d0
push 0xfffffffffffffffc
add byte [eax], al
xlatb
mov ecx, esi
mov ebx, eax
jbe 0x41e731
std
invalid

Function at 0x432051
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb
mov eax, dword fs:[0x8f0000]
push eax
sub esp, 0x410
add byte [eax], al
and al, 0x56
add byte [ebx], dh
lds esp, [eax + eax - 0x14]
push ebx
push esi
push edi
push eax
lea eax, [ebp]
add byte [ebx], ah
sub byte [eax], al
invalid
Function at 0x43675a
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebp + 0x500b74c0], al
add byte [eax], al
lodsb al, byte [esi]
mov dh, 0x51
add byte [ebx - 0x7cffff6a], al
jle 0x4366e9
add byte [eax + ecx], dh
add byte [eax + eax], dl
xor eax, eax
pop esi
push esp
add al, al
inc eax
pop esi
ret
add byte [ebx - 0x1f5ecb14], al
loop 0x4366f1
add byte [ebx], dh
lds ecx, [ecx + 0x53fc45]
add byte [ebx - 0x6e04170f], cl
insb byte es:[edi], dx
add byte [ebx + 0x3bdb33f8], cl
sti
je 0x436709
add byte [edi + 0x20], dh
jne 0x436734
call 0x43675a
cmp byte [eax + 0x14], bl
jne 0x436731
add byte [eax], al
insd dword es:[edi], dx
add byte [eax], al
cmp edi, dword [eax - 0x70]
add byte [ecx], cl
call fcn.004439ce
test dword [eax], eax
add byte [esi], al
push ebx
call 0x5de5a6
mov dword [edi + 0x20], ebx
cmp dword [edi + 0x24], esi
jne 0x436739
add byte [edi + 0x24], bl
mov ecx, dword [esi + 0x64]
rol byte [eax], 0x74
or byte [ebx + 0x5050ff01], cl
add byte [eax + ecx - 0x75], dh
add edi, edi
push eax
push eax
add byte [eax], al
mov ecx, dword fs:[esi + 0x68]
xor esp, edx
add byte [ebp - 0x74f98b37], al
add dword [ebx], edx
add byte [ebx + eax*4], al
push 0xb00
add byte [eax + 0x74], bl
dec ecx
call fcn.0043d501
add byte [eax + 0x3c], bh
test edi, edi
je 0x436740
add byte [edi + 0x20], bh
add byte [edi + esi + 0x6a], dh
xor byte [eax], al
add ah, cl
push 0
push eax
call fcn.00526792
mov eax, dword [esi + 0x20]
add esp, 0
add byte [ebp - 0x2c], al
mov dword [ebp - 0x28], eax
pop ecx
add ah, cl
push eax
push 0
push 0x433
push dword [edi + 0x20]
mov dword [ebp - 1], 0
mov dword [ebp - 0x30], ebx
inc dword [eax]
add byte [edi + 0x468b0051], dh
mov cl, 0
cmp eax, 0x51b7d0
push 0xfffffffffffffffc
add byte [eax], al
xlatb
mov ecx, esi
mov ebx, eax
jbe 0x4367c1
std
invalid

Function at 0x461a31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb
mov eax, dword fs:[0x8f0000]
push eax
sub esp, 0x410
add byte [eax], al
and al, 0x56
add byte [ebx], dh
lds esp, [eax + eax - 0x14]
push ebx
push esi
push edi
push eax
lea eax, [ebp]
add byte [ebx], ah
sub byte [eax], al
invalid
Function at 0x46613a
Capabilities:
Encode data using xor

Disassembly:
sub byte [ebp + 0x500b74c0], al
add byte [eax], al
lodsb al, byte [esi]
mov dh, 0x51
add byte [ebx - 0x7cffff6a], al
jle 0x4660c9
add byte [eax + ecx], dh
add byte [eax + eax], dl
xor eax, eax
pop esi
push esp
add al, al
inc eax
pop esi
ret
add byte [ebx - 0x1f5ecb14], al
loop 0x4660d1
add byte [ebx], dh
lds ecx, [ecx + 0x53fc45]
add byte [ebx - 0x6e04170f], cl
insb byte es:[edi], dx
add byte [ebx + 0x3bdb33f8], cl
sti
je 0x4660e9
add byte [edi + 0x20], dh
jne 0x466114
call 0x46613a
cmp byte [eax + 0x14], bl
jne 0x466111
add byte [eax], al
insd dword es:[edi], dx
add byte [eax], al
cmp edi, dword [eax - 0x70]
add byte [ecx], cl
call fcn.004733ae
test dword [eax], eax
add byte [esi], al
push ebx
call 0x60df86
mov dword [edi + 0x20], ebx
cmp dword [edi + 0x24], esi
jne 0x466119
add byte [edi + 0x24], bl
mov ecx, dword [esi + 0x64]
rol byte [eax], 0x74
or byte [ebx + 0x5050ff01], cl
add byte [eax + ecx - 0x75], dh
add edi, edi
push eax
push eax
add byte [eax], al
mov ecx, dword fs:[esi + 0x68]
xor esp, edx
add byte [ebp - 0x74f98b37], al
add dword [ebx], edx
add byte [ebx + eax*4], al
push 0xb00
add byte [eax + 0x74], bl
dec ecx
call int.0046cee1
add byte [eax + 0x3c], bh
test edi, edi
je 0x466120
add byte [edi + 0x20], bh
add byte [edi + esi + 0x6a], dh
xor byte [eax], al
add ah, cl
push 0
push eax
call fcn.00556172
mov eax, dword [esi + 0x20]
add esp, 0
add byte [ebp - 0x2c], al
mov dword [ebp - 0x28], eax
pop ecx
add ah, cl
push eax
push 0
push 0x433
push dword [edi + 0x20]
mov dword [ebp - 1], 0
mov dword [ebp - 0x30], ebx
inc dword [eax]
add byte [edi + 0x468b0051], dh
mov cl, 0
cmp eax, 0x51b7d0
push 0xfffffffffffffffc
add byte [eax], al
xlatb
mov ecx, esi
mov ebx, eax
jbe 0x4661a1
std
invalid

Function at 0x46ee31
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x46ee60
outsb dx, byte [esi]
ficomp dword [ebx + 0x76]
pop esp
in eax, 0x33
mov cl, 0xc3
popal
sbb byte [ecx + edx*4], bh
dec esp
ja 0x46ee38
retf
out 0x69, al
je 0x46ee91
cmc
cdq
int1
ret 0x4915
fist word [edi + 0x44]
adc dh, bl
or byte [ecx], al
mov ebp, 0xe30bd97b
rcr dword [eax + 0x4e6057cc], cl
test eax, 0x1defca87
push cs
push esp
cli
lodsd eax, dword [esi]
dec edi
xor dword [edi + 0x58d5a71a], 0x8f41b648
and eax, 0x2c831462
outsw dx, word [esi]
test dword [ebp - 0x5037c2b2], eax
or dword [edx + ecx*2], ebp
or cl, byte [esi - 6]
cmp edx, ebx
bound eax, qword [eax + 0x7b1a60ac]
dec esp
dec esi
add al, byte [eax - 0x5c949791]
insd dword es:[edi], dx
sahf
add dword [esi], 0xffffffe1
invalid
Function at 0x47531e
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
js 0x47534f
lahf
ja 0x475388
lodsd eax, dword [esi]
shl dl, cl
invalid
cli
fcmovnu st(0), st(2)
mov eax, 0xd1f9b6a6
ffree st(7)
invalid
pop edx
sti
cmp eax, 0x986c5872
out 0xe8, eax
add bl, bh
sbb ecx, dword [edx - 0x222a8193]
sal byte [edx + 0x2dc959a9], 1
outsb dx, byte [esi]
sub dword [edx - 0x7d], ecx
mov ecx, 0xd600e45e
xor eax, 0x9df139f5
in eax, dx
jns 0x475338
add al, 0x12
fsub qword [esi + edx]
or ah, byte [edi + 0x6faf9dad]
mov ch, 0x2a
jne 0x4753ed
pop ebp
mov edx, 0xe0dcbcc6
out dx, al
dec ebp
out 0x7b, al
retf 0x27ea
ficom dword [eax + 0x7357b5af]
mov ds, word [ebx - 0x33e81bfd]
jl 0x475453
push ebx
sti
je 0x475442
mov al, 0xce
into
pop edx
dec ecx
mov gs, word [eax]
xor bl, byte [edx]
in eax, dx
lahf
cmp byte [esi - 1], cl
sahf
js 0x4753ff
xor byte [edx + edi*2], dl
and byte [ecx], ch
jb 0x475418
sub dword [ebx], esp
sbb eax, 0xa0530b60
or byte [esi - 0x54], ah
sub edx, dword [edi - 0x54]
mov dl, 0x2f
cpuid
mov eax, dword [0x48bea687]
dec eax
test edi, esp
sar byte [edx + 0x4d448971], 0x45
add eax, 0x56c89291
imul ebx, ebx, 0xffffffc1
mov ch, byte [edi + 0x15]
dec edi
lea esp, [ebx]
test dword [edi], 0xc6e52378
and esi, edi
pop es
js 0x47546a
in eax, 0xc6
stosb byte es:[edi], al
or eax, 0xfb036c14
or byte [edx - 0x1e], ch
clc
or eax, 0xa7d7734
xor ch, bh
or dh, byte [eax]
std
fsub qword [ecx + 0xc0e991e]
fsub qword [ecx + 0xc0e991e]
scasd eax, dword es:[edi]
pushfd
sub eax, dword [esi]
push es
cmp edi, esp
popfd
invalid
cmp byte [ebx + 0x3a7ec888], bh
or cl, byte [ebx + 0x4c9f5495]
arpl ax, bp
loopne 0x475400
add byte [edi], dh
mov byte [0x1ce1eb01], al
jge 0x47545b
add byte [ecx], bl
mov bh, pe_nt_image_headers32
jb 0x475457
pop ecx
mov dword [esi], edx
out dx, al
cmp edi, dword [edi + 0x510a9ae5]
pushfd
stosb byte es:[edi], al
jg 0x47542b
mov bl, 0x4b
movsb byte es:[edi], byte [esi]
out dx, al
retf

Function at 0x479a31
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xb
mov eax, dword fs:[0x8f0000]
push eax
sub esp, 0x410
add byte [eax], al
and al, 0x56
add byte [ebx], dh
lds esp, [eax + eax - 0x14]
push ebx
push esi
push edi
push eax
lea eax, [ebp]
add byte [ebx], ah
sub byte [eax], al
invalid