joyce8/EMBER2024-capa huggingface dataset:
Function at 0x28699ab
Capabilities:
Encode data using xor

Disassembly:
call fcn.01608157
and byte [esp + 0xb], 0x37
xor ecx, 0x2382708
push 0x3a980888
dec dword [esp + 9]
dec edx
lea esp, [esp + 0x14]
jne 0x280ad4a
mov edx, 0x190876bf
xor dx, 0x3c32
pop ebx
rol dl, 0xa2
bswap ecx
not edx
xor edx, eax
cwde
xor ebx, ecx
add ebp, ecx
rol al, 0x43
cwde
mov dl, byte [esi + eax - 0x2b03]
movzx ax, byte [esi + eax*2 - 0x5604]
mov ecx, 0x8b9f213d
adc esi, 1
rol ecx, 0x69
sar cl, 0x66
imul dl
mov edx, 0x58b6a800
mov word [esi + ecx - 0x3e427b00], ax
lea eax, [edx + edx*8 - 0x44505ae5]
btr ax, ax
sal al, 0xa1
jmp ebp
popfd
pop esi
jmp 0x15c0abe
mov eax, 0xda80361e
pop ecx
jmp esi
push 0xbfadfd22
sar word [esp + 2], 0x4b
xor ebx, ecx
shl byte [esp + 2], 0x87
sar word [esp], 0x65
jnp 0x29329fd
mov ebx, 0xcf31b4a3
movzx ebx, byte [eax]
jmp 0x2808065
xor ebx, eax
add esi, eax
movsx eax, cl
or dx, cx
cwd
mov edx, dword [eax + ebp - 1]
sub cl, ah
mov ax, word [ebp + eax + 3]
sal cl, 0x87
mov dword [esp], ecx
adc ebp, 6
sal cx, 0xc5
sar cl, 0x67
sbb cl, cl
mov word ss:[edx], ax
jp 0x27d984d
mov dword [esp], esi
mov edi, 0x230b70bf
pushfd
bswap edi
mov esi, edx
shr edi, 0x98
mov edi, eax
push 0x5c98468a
shl dword [esp], 0xb9
adc byte [esp], 0x87
cld
shr byte [esp + 3], 0x41
rep movsb byte es:[edi], byte [esi]
pop edi
shr edi, 0xb7
jp 0x2686f0d
and ebx, 0xff
push 0xf318c717
mov dword [esp + 4], 0x3ea32928
mov ebx, dword [ebx*4 + 0x15cfec4]
mov dword [esp + 4], 0xc4b0b6bf
push 0x8258caa
shr ecx, 8
xor ecx, ebx
sal dword [esp + 3], 0xe4
sal dword [esp + 3], 0xb6
inc eax
shr word [esp + 6], 0xe3
call 0x15c0ac3
sub edi, 4
mov ecx, 0xa683c410
mov edx, 0xeb90c513
call fcn.0288e999
mov ecx, 0x5e838f07
mov ecx, dword [ecx + edi - 0x5e838f07]
mov eax, 0x1a939288
xor ecx, ebx
shr eax, 0xed
not ecx
movsx edx, ax
bswap ecx
inc ax
rol ecx, 3
or edx, eax
not ecx
neg ecx
idiv dl
xchg edx, eax
dec ecx
not eax
sub edx, 0xb9011087
ror ecx, 3
btr eax, 0xa1
jb 0x2280917
jmp 0x157abea
Function at 0x2872642
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
ror ecx, cl
dec al
sar ecx, 0x2b
xor al, 0x34
not al
not ecx
ror dl, 0xa6
jb 0x1656dbc
xor bl, al
not edx
add eax, esp
imul edx, edx
mov dx, word [eax + ecx*4 - 0x20c5d0]
lea esi, [esi + ecx*4 - 0x20c5d2]
mov eax, ecx
mov word [esi + ecx - 0x83174], dx
sar ecx, 0xe1
shl cl, 0xe6
jae fcn.0285a1c4
mov ecx, 0x89124f29
movzx eax, cl
lea edi, [edi + eax*2 - 0x56]
ror ax, 0xe7
inc cl
mov eax, dword [edi + eax*8 - 0x29000]
movsx edx, cx
add ecx, edx
setae dl
xor eax, ebx
sar dx, 0x46
jae 0x271611a
movsx edx, cl
movzx eax, byte [ecx + edi - 0x4174b8]
shr cl, 1
rol edx, cl
lea edi, [ecx + edi - 0x41745b]
xor ecx, edx
xor al, bl
lea edx, [edx*2 - 0x7c62bee4]
not cx
ror al, 1
or edx, edx
jle 0x269ea28
pop ebp
inc edx
xor dword [esp + edi - 0x68], ecx
push ebp
jmp 0x2918790
shr edx, 0x39
lea eax, [eax + edx - 0x5a28852f]
xor eax, 0x1d16c900
neg eax
rol cl, 0x62
sar cx, 0xcd
inc ecx
ror eax, 1
sal dl, 0x21
dec edx
xor eax, 0x21207926
dec cx
and dx, 0xae09
btc ecx, 0x31
xor ebx, eax
imul dx, dx
add ebp, eax
sub edi, 2
ror ecx, 0xf9
sub cl, dh
movzx eax, word [edi]
bts cx, 0x84
xor ax, bx
shr ecx, 0xd1
inc ax
btc ecx, edx
setae cl
call fcn.015be1b8
xor eax, ebx
mov dword [esp + 4], 0x4db5528a
rol eax, 2
movzx edx, word [esp + 4]
neg eax
inc eax
not eax
imul cx, dx
and ecx, ecx
not edx
xor ebx, eax
inc cl
dec dl
neg dl
add esi, eax
mov dword [esp], ecx
rdtsc
call fcn.02636d3b
mov ecx, 0xe4b58198
movsx eax, cl
xchg ch, cl
mov eax, dword [edi]
add edi, 4
neg ecx
xor eax, ebx
call fcn.0280c3c5
mov eax, 0x5c1b26a0
movsx ecx, al
mov edx, 0xbadd399
mov edx, dword [eax + edi - 0x5c1b26a0]
sal eax, 0xc8
lea ecx, [eax - 0x12f808fc]
lea edi, [edi + eax*2 - 0x364d3ffc]
add al, 0x1f
xor edx, ebx
lea edx, [edx + ecx*2 - 0x6ae16444]
inc ecx
neg edx
and ax, cx
xor edx, 0x1a288900
btr ax, 0x98
neg edx
xor ax, cx
shl eax, 0xe1
bswap edx
sar ecx, cl
xor ebx, edx
add ebp, edx
jmp 0x26a8b8a
inc ecx
push esp
dec esi
mov ecx, dword [esp + edi*2 - 0xc0]
not ebp
dec esp
mov dword [esp + ebp - 0x48e4], edi
dec eax
arpl cx, cx
shr dword [esp + ebp*2 - 0x91e2], 0x6e
dec eax
adc ebx, ecx
dec eax
mov dword [esp + ebp - 0x48f4], ebx
ret 0x10
Function at 0x2896cc4
Capabilities:
Check for software breakpoints

Disassembly:
dec edx
lea ebp, [ebx*2 - 0x29e44e6a]
dec edi
lea eax, [edx + eax - 0xb4]
inc cx
xor esi, ecx
inc cx
shr esi, 0xa1
dec eax
lea ecx, [edx + 0x39167807]
inc ecx
sar esp, 0xeb
adc si, 0xe201
inc ebp
sub dh, dl
mov eax, edx
sal cx, 0xc4
not si
dec ebp
bt edx, ebx
inc ecx
imul dh
mul dx
inc cx
sbb esi, esp
inc ecx
inc esp
inc ecx
rol esi, 0xe5
ror si, 1
inc ecx
xadd dl, ch
dec ecx
neg edx
inc ecx
rol ebx, 0xd3
inc sp
xor ecx, esi
dec ecx
or esp, 0x76ba2b0c
inc esp
xchg ebp, esp
dec eax
adc esi, esp
inc ecx
inc ah
dec esp
xchg ebp, edx
inc ecx
and bl, 0x28
dec esp
mov ebx, dword [esi + ebp + 0xe2]
bt bp, dx
dec eax
lea edi, [ebp + edi + 0xda]
dec esp
mov dword [ebp + edi + 0xe2], ebx
inc ecx
inc dh
shr dx, 0x61
jno fcn.027a8c5b
inc ecx
movzx ecx, si
dec esi
mov dword [esp + edx - 0xae], ecx
inc edx
xor dword [esp + edx - 0xae], eax
dec edx
mov dword [esp + edx*2 - 0x16c], ebp
pop edx
dec eax
and ebp, 0x310e369c
inc ecx
pop ecx
inc cx
sar ebp, 0x84
inc eax
ror ch, 0x67
dec eax
arpl ax, ax
dec eax
adc ebx, eax
dec esi
lea ebx, [ecx + 0x453dff15]
inc ebp
btc edi, edi
sar cl, 0x67
inc cx
mov esi, dword [eax + ebp - 0x110c0029]
js 0x282ece2

Function at 0x2896d8d
Capabilities:
Check for software breakpoints

Disassembly:
btr ax, dx
mov ecx, edi
lea edi, [edi + eax*2 - 0x602]
mov word [edi + eax - 0x300], cx
ror eax, 0xd9
cbw
pop ecx
jae fcn.026935ed
outsb dx, byte [esi]
scasd eax, dword es:[edi]
invalid

Function at 0x28a30ae
Capabilities:
Encrypt data using speck

Disassembly:
shr ecx, cl
not edx
dec edx
cwde
mov dword [esp + ecx + 4], 0x320f19a2
xor ebx, edx
call fcn.0165251f
lea ecx, [eax + eax + 0x5dbcaaba]
mov dword [esp + ecx - 0x1637c0ca], ecx
mov cl, byte [esi + ecx - 0x1637c0c8]
dec eax
push eax
lea esi, [esi + eax - 0x5c3d8b05]
and dl, cl
movzx ecx, ax
mov word [esp + eax - 0x5c3d8b02], 0xf909
not dl
ror eax, cl
sub cx, cx
bt ax, 0x22
mov word [esi + eax*2 - 0x1d70f62c], dx
mov edx, dword [edi + eax - 0xeb87b16]
lea edi, [edi + eax*2 - 0x1d70f628]
shr dword [esp + eax*8 - 0x75c3d8ac], 0x14
xor edx, ebx
not al
sar al, 0xa1
sal ax, 0xb
not edx
not cx
sbb cx, ax
cwde
inc edx
jmp 0x2753151
Function at 0x28c8ffe
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [ebp]
mov ecx, 0x9b931734
inc cl
or cx, cx
mov eax, dword [ebp + 4]
mov cl, byte [ebp + 8]
jge 0x27e46cf
mov ecx, 0x37b80613
movzx edx, byte [ebp + ecx*2 - 0x6f700c26]
lea eax, [ecx*8 - 0x40d0c8c8]
ror ax, 0xc8
lea ebp, [ebp + eax - 0x7cefd066]
xor dl, bl
xor ecx, 0x16aa858d
dec ecx
inc dl
rol dl, 1
sal ecx, 0x49
sub ecx, 0x2ead8729
shl ax, 0x21
adc dl, 0xbd
xor dl, 0x1d
inc ax
shr ecx, 0x46
xor bl, dl
add edx, esp
mov ax, word [edx + eax - 0x7cefa0cf]
call fcn.022a3c4d
mov eax, 0x52af0da5
mov ecx, eax
call fcn.027ce8e0
xchg edx, eax
bswap ecx
and ax, dx
dec ecx
dec ax
call fcn.022a0a69
push ebp
push ebx
inc ebp
push edx
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [edi + 0x57b091f1], bl
sbb eax, 0x7ea22912
jns 0x27a2412
jmp 0x27a248a
mov al, 0xc6
rcl dword [eax - 0x3b65346f], cl
dec ecx
and al, 9
and edx, dword [ecx - 0x7e5cfde1]
call 0x1fd1a53e
and dword [ecx - 0x65], edi
mov dword [0xad94ac29], eax
or dl, 0xdd
std
xchg esp, eax
pop edi
out 0xcb, eax
cmpsd dword [esi], dword es:[edi]
and edx, dword [edi - 0xd]
xchg ecx, eax
cmp byte [edx - 0x22], 0x90
sbb eax, 0x3a6d9559
xor eax, 0x7034d010
imul ecx, dword [0x1ad436a8], 0xd11a7a2
cdq
dec esp
retf
call fcn.0285a191
mov dword [esp + edx*2 - 0x7e6], ebx
sal eax, 0x78
movzx ebx, ax
mul bx
mov ebp, edi
btr bx, ax
ror bl, 0xc7
add ebx, ecx
or dx, 0xd0b
mov edx, ebx
btr eax, eax
bts eax, eax
sub eax, eax
sal edx, 2
ror ax, 0xc9
btc eax, 0xaf
btr eax, eax
mov eax, ebp
call fcn.015cdeb6
jmp 0x27a2383

Function at 0x28d49b9
Capabilities:
Check for software breakpoints

Disassembly:
dec eax
lea edi, [ebp + edi - 0x3a]
dec ecx
neg ebp
inc esp
xchg byte [esp + ebp*4 - 0xed], ah
inc sp
add ebx, ecx
push eax
inc sp
mov dword [edi + ebp*2 - 0x78], ebx
sal byte [esp + ebp*4 - 0xe8], 0x42
shr byte [esp + ebp - 0x37], 3
cdq
dec edx
mov dword [esp + ebp*2 + 0x4543ed3c], ebx
ret 0x10
inc ecx
sal ebx, cl
dec ecx
adc ebx, esi
inc sp
add ebx, dword [edi + edx*2 - 0xb256]
inc ecx
push ebp
inc ecx
inc ah
mov cx, word [edx + edi - 0x5929]
cdq
dec edx
mov dword [esp + ebp - 0x22a1f696], ebp
jne 0x15acee3
Function at 0x28eba0b
Capabilities:
Encode data using xor

Disassembly:
mov word [eax + esi - 0x10f73007], dx
neg eax
jbe 0x2680023
mov edx, dword [esi]
mov ecx, dword [esi + 4]
call fcn.025262aa
lea edx, [edx + eax - 0x2a9bb475]
rol eax, 0x61
xor edx, 0x9d1e57a0
dec edx
xor ebx, edx
dec ecx
ror eax, cl
adc esi, edx
movzx edx, cx
jmp esi
call fcn.024df15d
ror dword [esp + eax - 0x40000000], 0x42
xor ebx, ecx
bswap edx
mul dx
adc esi, ecx
xor ax, dx
jp 0x2634223
bts ecx, ecx
pop eax
jmp ebp
rol ecx, 3
ror edx, 0xe
not ecx
mov dword [esp + edx - 0x1c139620], eax
shr dx, 0xab
pop eax
ror ecx, 3
shl eax, 0xde
jne 0x266dd1c
call fcn.027c4799
mov eax, dword [edi]
mov ecx, 0x20b4ae12
mov edx, 0x15303503
lea edi, [edi + ecx*2 - 0x41695c20]
bt ecx, edx
ror ecx, 0x37
xor eax, ebx
lea edx, [ecx - 0x57de9cf7]
push ecx
sub eax, 0x7dbac08c
inc edx
sub cx, 0x2f9e
not eax
xadd dl, ch
setnp dl
neg eax
dec cl
sub dword [esp + ecx - 0x695c4ba2], ecx
bswap eax
not dword [esp + ecx - 0x695c4ba2]
sbb cl, cl
not dword [esp + ecx - 0x695c4bff]
xor ebx, eax
add ebp, eax
shr word [esp + ecx - 0x695c4bfd], 0xa6
mov dx, word [edx + esi - 0x117d8700]
mov ax, word [esi + ecx - 0x695c4bfd]
lea esi, [esi + ecx - 0x695c4bfd]
and dx, ax
not dx
lea eax, [ecx*4 + 0x6b85d39c]
ror ax, 0xa7
jae 0x230ada7

Function at 0x28f5620
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, 0xda1b9520
mov edx, dword [esi]
call fcn.015d478d

Function at 0x28fc4cf
Capabilities:
Encrypt data using speck

Disassembly:
xor edx, ebx
add edx, 0xd03a9295
call fcn.02278bfb

Function at 0x28fef4d
Capabilities:
Encrypt data using speck

Disassembly:
rol al, 0xa5
shl ecx, cl
add esi, edx
mov edx, ecx
sub cl, al
pop ecx
pop eax
pop ecx
pop edx
jl fcn.027400f9
dec ebp
arpl bx, bx
inc esp
sub esp, eax
jb 0x2918629
dec ebp
add edx, edx
dec ecx
adc ebx, ebx
inc dl
inc cx
shl esp, cl
pop edx
inc ecx
pop esp
jns fcn.027a8c5b
Function at 0x2900dd5
Capabilities:
Execute syscall

Disassembly:
inc ecx
xor eax, ecx
rol esi, 0xb9
bswap eax
inc ecx
sbb dh, bl
inc ebp
movzx esp, bx
rol eax, 2
inc bp
or ebx, esp
not eax
rol eax, 1
inc cx
xchg ebp, esi
inc ecx
neg bl
inc ecx
mov edx, ebx
dec eax
inc esp
movsx edi, dx
rol esi, 0xa4
neg edx
bswap eax
inc ebp
imul ebx, ebx
inc ecx
lea eax, [ebp + eax - 0x643490ac]
inc ecx
rol edi, 0xad
inc ecx
push edx
dec edx
lea ebp, [edx + ebp*4 + 0x3d0f2120]
xor eax, 0xf1a09910
dec eax
bswap esi
inc dx
neg dword [esp + ebp - 0x3b6a]
dec esi
mov dword [esp + edx - 0x4a9e93ab], ecx
dec esp
cmovae ebp, ebp
dec edi
lea esp, [edi + ebp + 0x4e0f23af]
inc ebp
movsx ecx, bp
inc edx
xor dword [esp + ebp - 0x3b6d], eax
sal si, 0x4e
inc ecx
pop ecx
inc ecx
shr esp, 0x21
dec eax
arpl ax, ax
shl dx, 5
dec eax
adc ebx, eax
inc si
mov ebp, dword [edi + edx - 0x4a9e93ab]
call fcn.02275236
sysenter
call fcn.028b35bd
neg edx
mov dword [esp + eax*2 - 0x249e02], 0xecb1982a
not edx
or ax, word [esp + eax - 0x124eff]
inc dword [esp + eax*4 - 0x4bbec4]
sbb ax, 0x6e2a
xor ebx, edx
add ebp, edx
btr cx, cx
or word [esp + eax*2 - 0x25030e], 0xbead
sets al
pop ecx
jno fcn.027b3ecd
sysenter
push esi
mov dword [esp], 0x124fa5d6
call fcn.024e962c
mov esi, 0x619d8eaf
inc ecx
mov edx, 0x4a9e93ab
inc esp
movzx ebp, si
inc ecx
mov eax, dword [eax + esi - 0x619d8eaf]
inc esp
mov ebx, esi
dec esi
lea eax, [esi + eax - 0x619d8eab]
jmp 0x22c0d7a

Function at 0x2905adb
Capabilities:
Encrypt data using speck

Disassembly:
div ecx
mov dword [esi], edx
mov dword [esi + 4], eax
mov eax, dword [edi]
mov dword [esp + 4], 0xcd0714a4
add edi, 4
mov dword [esp], 0x25119a3e
call fcn.0260218e

Function at 0x290bb67
Capabilities:
Encrypt data using speck

Disassembly:
xor ebx, ecx
jmp 0x28a6e51
xor ecx, ebx
push 0x80a7860d
mov dword [esp], 0x17837220
sal word [esp], 0x87
sbb ecx, 0xc501ba23
ror word [esp + 2], 0xec
not ecx
bswap ecx
setb byte [esp]
push 0x7c34da22
neg dword [esp + 4]
rol ecx, 3
jmp 0x156dec0
add edi, 4
jmp 0x26b82e3
Function at 0x2929551
Capabilities:
Encode data using xor

Disassembly:
mov cl, byte [edi + ecx - 0x1c909f27]
mov eax, 0x2d29cc8f
lea edi, [edi + eax - 0x2d29cc8d]
shl dx, cl
lea ecx, [eax*2 - 0x325ec058]
sar cx, 0xc2
mov word [ecx + edi - 0x27f4f631], dx
mov edx, 0x1d00371d
mov dword [esp + eax*2 - 0x5a53991e], esi
ret
rol eax, 3
neg eax
mov dword [esp + ecx - 0x1c909f29], 0x5986bc96
rol dword [esp + ecx - 0x1c909f29], cl
and dx, dx
xor ebx, eax
add esi, eax
add dword [esp + ecx*2 - 0x39213e52], 0x8884beb9
setnp dl
mov dx, word [ecx + edi - 0x1c909f29]
jp 0x25ca583
mov ecx, 0x69f2b20
movsx eax, cl
lea edx, [ecx + ecx*4 - 0x7143c155]
mov ecx, dword [edi + ecx*2 - 0xd3e5640]
cdq
imul dx, ax
lea edi, [edi + eax - 0x1c]
sal edx, 0x78
setb al
xor ecx, ebx
ror al, 0x61
neg edx
push eax
bswap ecx
sbb eax, 0x1f33e123
adc dword [esp + edx*4], 0x3c2c81b2
neg edx
lea ecx, [ecx + edx*8 - 0x5695aa90]
cwd
xor edx, 0x90bc5484
neg ecx
btr edx, edx
bswap ecx
rol dx, 0x8f
rol ecx, 1
dec edx
neg word [esp + 2]
bswap ecx
call fcn.024ca456
fldcw word [eax]
dec ecx
jle 0x292965e
jle 0x2929640
mov dl, 7
mov dword [edi - 1], esp
cmp dx, sp
push esp
pop edi
lodsd eax, dword [esi]
fist word [esi + 0x4e]
fmul qword [edx + eax]
fld dword [ebx - 0x6fe86ae1]
xor eax, 0x8b933714
das
je 0x2929601
int 0x31
sahf
adc byte [esi], al
and al, 0x20
les si, [ebp - 0x541cb6b0]
test al, 0xb4
retf
xchg dword [edi + 0x50e3915e], esi
call 0xbb1058a
sbb ecx, dword [ebx + esi*8 + 0x3a]
xchg esi, eax
or eax, dword [esp + esi*2]
xchg byte [esi - 0x33], dl
in eax, 0xa5
mov ebx, 0x39e3d967
sbb byte [ebx + 0x5d77bfa3], al
test byte [eax - 0x275a8049], bl
test eax, 0xe199889d
and dword [ebx - 0x7ba28841], 0xffffff98
mov bh, 0x7f
movsd dword es:[edi], dword [esi]
fsubr dword [ecx - 0x1e667763]
inc eax
out dx, eax
lea ecx, [edi - 0x79]
push 0xd830acf7
loope 0x29296b2
invalid
xor eax, 0xcf3001d7
mov dh, 0x1b
inc eax
invalid
Function at 0x292d6b3
Capabilities:
Encrypt data using speck

Disassembly:
inc al
bswap edx
jae 0x24d3904
lea esi, [esi + ecx*2 - 0x97aa6a4]
sar ecx, 0x64
mov word [esi + ecx - 0x4bd535], ax
add ecx, ecx
movsx eax, cx
push ecx
lea edi, [edi + ecx*2 - 0x12f54d8]
seta byte [esp + ecx*2 - 0x12f54d4]
adc eax, eax
mov ecx, dword [edi + ecx - 0x97aa6a]
xor ecx, ebx
mov edx, 0x5cb26884
xor dl, 0x88
neg ecx
jmp 0x276d7f8
sal ecx, cl
sbb edx, 0x5aa5ad0f
sub dword [esp], 0xcabdaf11
cwde
bswap edx
neg edx
ror al, 5
not edx
sal dword [esp], 0x53
xor ebx, edx
shl al, 0x87
bswap eax
add ebp, edx
jmp 0x28fb220
add edx, 0xb02b5f27
xor ecx, 0xe895a0a2
cbw
ror ax, 0xc
btr eax, 0xbb
rol ecx, 1
bt dx, dx
dec ecx
ror ecx, 1
shr ax, 0x61
xor ebx, ecx
btc edx, edx
sbb al, 0x19
ror word [esp + edx*4 - 0x33571ccc], 1
add ebp, ecx
pop edx
jmp fcn.028b2c8b
setnp cl
adc eax, esp
xor cx, dx
xor dx, cx
mov dx, word [ecx + eax - 0xf60]
xor ecx, ecx
lea eax, [ecx + ecx*4 + 0x443859b8]
not cl
lea esi, [esi + ecx*4 - 0x3fe]
lea eax, [eax*2 - 0x746edf52]
call fcn.0282c180
xor al, cl
mov edx, ecx
mov dx, word [esi + eax*2 - 0x1c5fffe]
xchg ecx, eax
adc eax, dword [esp + ecx - 0xe2ffff]
mov ax, word [esi + ecx*4 - 0x38bfffa]
lea esi, [esi + ecx - 0xe2fffd]
lea ecx, [ecx + ecx*8 + 0x69b5e317]
ror cl, 0xa5
imul cx, word [esp + ecx - 0x71b0e370]
or dx, ax
not dx
mov word [esi + ecx - 0x71b00000], dx
xor dword [esp + ecx - 0x71b00000], 0xce89b017
jb 0x22cddbf
mov dword [esp + ecx - 0x71b00000], ebp
ret
mov dword [esp], 0x6af901ff
call fcn.025f0087
sub edi, 1
mov eax, 0xa91b6195
lea edx, [eax + eax*8 - 0x14c528cf]
movzx eax, byte [edi]
movsx ecx, dl
xor al, bl
add edx, 0xffaeca31
inc al
and cl, 0xb
neg dl
rol al, 1
sub cl, ch
adc al, 0xac
bt ecx, edx
not al
xor bl, al
sar cl, 0x23
jne 0x28129c8
adc edi, 3
lea ecx, [eax + eax*8 - 0xf66c06f]
push ecx
neg cl
xor edx, ebx
xor cl, byte [esp + 3]
jno 0x1656103
mov dx, word [esi]
mov ecx, 0x580b969f
lea eax, [ecx + 0x40961508]
sub ax, cx
mov cl, byte [esi + ecx - 0x580b969d]
adc esi, 2
add ax, 0x609c
div al
call fcn.0231299b
Function at 0x401158
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8b0
push ebx
push esi
mov esi, 0x894
xor ebx, ebx
push esi
lea eax, [ebp - 0x8b0]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
mov byte [ebp - 8], 0x4e
push ebx
push ebx
push ebx
push ebx
push eax
mov byte [ebp - 7], 0x55
mov byte [ebp - 6], 0x4c
mov byte [ebp - 5], 0x4c
mov byte [ebp - 4], bl
mov byte [ebp - 0x14], 0x57
mov byte [ebp - 0x13], 0x69
mov byte [ebp - 0x12], 0x6e
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x6f
mov byte [ebp - 0xf], 0x77
mov byte [ebp - 0xe], 0x73
mov byte [ebp - 0xd], bl
call dword [0x409200]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
jne 0x4011cc
xor eax, eax
jmp 0x40125a
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x8b0]
push ecx
push 0x26
push eax
call dword [0x4091fc]
test eax, eax
je 0x40124e
push edi
push 0x400
mov esi, 0x4079b4
push ebx
push esi
call sub.MSVCRT.dll_memset
push 0x1000
mov edi, 0x407dc0
push ebx
push edi
call sub.MSVCRT.dll_memset
add esp, 0x18
cmp dword [ebp - 0x8ac], ebx
je 0x40121a
push dword [ebp - 0x8ac]
jmp 0x40121e
lea eax, [ebp - 8]
push eax
push esi
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0x8a8], ebx
pop ecx
pop ecx
je 0x401236
push dword [ebp - 0x8a8]
jmp 0x40123a
lea eax, [ebp - 8]
push eax
push edi
call sub.MSVCRT.dll_strcpy
mov eax, dword [ebp - 0x8b0]
pop ecx
pop ecx
mov dword [0x40701c], eax
pop edi
push dword [ebp - 0x1c]
call dword [0x4091f8]
push 1
pop eax
pop esi
pop ebx
leave
ret
Function at 0x4017d5
Capabilities:
Terminate process

Disassembly:
push ebx
xor ebx, ebx
push 0x12c
push ebx
push 0x408dd8
call sub.MSVCRT.dll_memset
push 0x14
push ebx
push 0x408f10
call sub.MSVCRT.dll_memset
add esp, 0x18
mov byte [0x408dd8], 0x31
mov byte [0x408dd9], 0x34
mov byte [0x408dda], 0x30
push 0x50
mov byte [0x408ddb], 0x2e
pop eax
mov byte [0x408ddc], 0x31
mov byte [0x408ddd], 0x31
mov byte [0x408dde], 0x32
mov byte [0x408ddf], 0x2e
mov byte [0x408de0], 0x31
mov byte [0x408de1], 0x39
mov byte [0x408de2], 0x2e
mov byte [0x408de3], 0x31
mov byte [0x408de4], 0x39
mov byte [0x408de5], 0x35
mov byte [0x408de6], bl
mov byte [0x408e3c], 0x31
mov byte [0x408e3d], 0x34
mov byte [0x408e3e], 0x30
mov byte [0x408e3f], 0x2e
mov byte [0x408e40], 0x31
mov byte [0x408e41], 0x31
mov byte [0x408e42], 0x32
mov byte [0x408e43], 0x2e
mov byte [0x408e44], 0x31
mov byte [0x408e45], 0x39
mov byte [0x408e46], 0x2e
mov byte [0x408e47], 0x31
mov byte [0x408e48], 0x39
mov byte [0x408e49], 0x35
mov byte [0x408e4a], bl
mov byte [0x408ea0], 0x31
mov byte [0x408ea1], 0x34
mov byte [0x408ea2], 0x30
mov byte [0x408ea3], 0x2e
mov byte [0x408ea4], 0x31
mov byte [0x408ea5], 0x31
mov byte [0x408ea6], 0x32
mov byte [0x408ea7], 0x2e
mov byte [0x408ea8], 0x31
mov byte [0x408ea9], 0x39
mov byte [0x408eaa], 0x2e
mov byte [0x408eab], 0x31
mov byte [0x408eac], 0x39
mov byte [0x408ead], 0x35
mov byte [0x408eae], bl
mov byte [0x408f10], 0x5a
mov byte [0x408f11], 0x49
mov byte [0x408f12], 0x46
mov byte [0x408f13], 0x33
mov byte [0x408f14], 0x32
mov byte [0x408f15], 0x37
mov byte [0x408f16], 0x36
mov byte [0x408f17], 0x36
mov byte [0x408f18], bl
mov dword [0x408f04], eax
mov dword [0x408f08], eax
mov dword [0x408f0c], eax
mov dword [0x407014], 0x7c
mov dword [0x407018], 2
call section..text
test eax, eax
pop ebx
jne 0x4019a6
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x40356a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
and byte [ebp - 0x11], 0
and byte [ebp - 3], 0
push ebx
push esi
push edi
lea eax, [ebp - 0xa0]
push 0x80
push eax
mov byte [ebp - 0x1c], 0x48
mov byte [ebp - 0x1b], 0x6f
mov byte [ebp - 0x1a], 0x73
mov byte [ebp - 0x19], 0x74
mov byte [ebp - 0x18], 0x4e
mov byte [ebp - 0x17], 0x61
mov byte [ebp - 0x16], 0x6d
mov byte [ebp - 0x15], 0x65
mov byte [ebp - 0x14], 0x3a
mov byte [ebp - 0x13], 0xd
mov byte [ebp - 0x12], 0xa
mov byte [ebp - 0xc], 0xd
mov byte [ebp - 0xb], 0xa
mov byte [ebp - 0xa], 0x49
mov byte [ebp - 9], 0x50
mov byte [ebp - 8], 0x73
mov byte [ebp - 7], 0x20
mov byte [ebp - 6], 0x3a
mov byte [ebp - 5], 0xd
mov byte [ebp - 4], 0xa
call dword [0x409224]
test eax, eax
jne 0x403672
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
push edi
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0xa0]
push eax
push edi
call sub.MSVCRT.dll_strcat
lea eax, [ebp - 0xc]
push eax
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
call dword [0x409228]
test eax, eax
mov dword [ebp + 8], eax
je 0x403672
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + esi]
test eax, eax
je 0x403672
push dword [eax]
call dword [0x40922c]
push eax
mov dword [ebp - 0x20], eax
call sub.MSVCRT.dll_strlen
push edi
mov ebx, eax
call sub.MSVCRT.dll_strlen
lea eax, [ebx + eax + 4]
pop ecx
cmp eax, dword [ebp + 0xc]
pop ecx
ja 0x403672
push dword [ebp - 0x20]
push edi
call sub.MSVCRT.dll_strcat
push 0x407174
push edi
call sub.MSVCRT.dll_strcat
add esp, 0x10
add esi, 4
jmp 0x403625
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403677
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x40368f
mov eax, dword [esp + 4]
add eax, ecx
xor byte [eax], 0xbe
inc ecx
cmp ecx, dword [esp + 8]
jl 0x40367f
ret
Function at 0x403690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push dword [ebp + 8]
and dword [ebp - 0xc], 0
and byte [ebp - 0x10], 0
and dword [ebp - 8], 0
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0x64
mov byte [ebp - 0x16], 0x64
mov byte [ebp - 0x15], 0x34
mov byte [ebp - 0x14], 0x36
mov byte [ebp - 0x13], 0x21
mov byte [ebp - 0x12], 0x79
mov byte [ebp - 0x11], 0x6f
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
jbe 0x403773
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push edi
mov edi, 0x40717c
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
push 2
push 0
mov bl, byte [eax + ecx]
mov eax, dword [ebp - 0xc]
xor bl, byte [ebp + eax - 0x18]
lea eax, [ebp - 2]
push eax
call sub.MSVCRT.dll_memset
mov al, bl
add esp, 0xc
shr al, 4
add al, 0x41
movsx eax, al
push eax
lea eax, [ebp - 2]
push edi
push eax
call esi
lea eax, [ebp - 2]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcat
push 2
lea eax, [ebp - 2]
push 0
push eax
call sub.MSVCRT.dll_memset
and bl, 0xf
add esp, 0x20
add bl, 0x41
movsx eax, bl
push eax
lea eax, [ebp - 2]
push edi
push eax
call esi
lea eax, [ebp - 2]
push eax
push dword [ebp + 0xc]
call sub.MSVCRT.dll_strcat
mov eax, dword [ebp - 0xc]
push 8
inc eax
pop ecx
cdq
idiv ecx
push dword [ebp + 8]
inc dword [ebp - 8]
mov dword [ebp - 0xc], edx
call sub.MSVCRT.dll_strlen
add esp, 0x18
cmp dword [ebp - 8], eax
jb 0x4036e1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403775
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4037b6
cmp dword [ebp - 0x84], 2
jne 0x4037b6
cmp dword [ebp - 0x90], 5
jne 0x4037b6
mov eax, dword [ebp - 0x8c]
add eax, 0x32
leave
ret
xor eax, eax
leave
ret