joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10163f0f
Capabilities:
Encode data using base64

Disassembly:
dec eax
mov dword [esp + ebp - 0xbf], 0xee8c2800
not si
inc ebp
sub ch, ah
dec ecx
xor ebp, 0x3d83b081
dec ebp
xor esp, esp
sbb si, 0xec0a
xor si, 0x658e
inc edx
sub dword [esp + 3], ecx
dec edx
sar dword [esp], cl
inc cx
sbb esi, esp
push ebp
rol si, 1
sub si, 0x4f98
inc esi
movzx esi, byte [esp + 9]
inc ebp
and esi, ebp
inc sp
xor edi, esi
inc dx
mov dword [edi - 2], esi
dec edx
or dword [esp + 8], 0x66294330
inc edx
xchg dword [esp + 0xa], ecx
inc ebx
movzx ecx, byte [esp + ecx - 3]
inc ecx
xor cl, bh
inc ecx
sar ah, 0x82
inc esi
xor byte [esp + 0xf], ah
inc esi
xor byte [esp + 7], ah
dec cl
rol cl, 1
call fcn.10226a27
inc ecx
mov esp, 0xfe8ac39b
dec esp
mov esi, dword [edi]
inc ecx
movsx ecx, sp
inc ecx
mov esi, esp
inc ebp
movzx eax, byte [ecx - 1]
dec eax
shr esi, cl
inc ebp
xor al, bh
xor cx, si
inc ebp
movzx ebp, ah
dec edx
lea esi, [ecx + ebp + 0x372ca82a]
inc ecx
neg al
inc ecx
dec al
inc ecx
neg al
dec edx
lea edx, [0xeb18f12]
inc ebp
movzx ebx, ah
inc ecx
add al, 0x34
dec eax
btr edx, esi
inc ecx
movsx ebp, ah
inc ebp
xor bh, al
mov eax, ebp
dec esp
add eax, esp
inc cx
dec esp
inc eax
xor ch, 0x9f
inc ecx
not ah
dec edi
mov dword [eax + ebp - 0x9b], esi
inc esp
movsx edx, dh
ror edx, 0x99
inc ebx
mov edx, dword [ecx + ebx*4 - 0x271]
shr al, cl
inc ecx
xor edx, edi
push esi
not edx
cwde
dec esp
btr ecx, ebx
inc ebp
movsx eax, bp
bswap edx
ror edx, 1
inc eax
and dh, 0x96
inc si
or ebx, dword [esp + ebp*8 - 0x4d5]
bswap edx
inc ebp
xor bl, bl
dec esi
mov dword [esp + ebp*2 - 0x136], edi
inc esp
btr esi, eax
xor dword [esp + esi - 0x372c6c00], edx
dec eax
xadd esi, eax
sar cl, cl
jnp 0x102297fc

Function at 0x10164a7a
Capabilities:
Encode data using base64

Disassembly:
cwd
cdq
xor bl, cl
mov dword [esp + eax], edx
btc eax, 0x11
lea ecx, [esp + ecx + 8]
mov dword [esp + eax - 0x1fffc], eax
add dl, byte [ecx + eax*4 - 0x80000]
lea edi, [eax + edi - 0x20002]
xchg word [esp + eax - 0x1fffd], ax
movsx ecx, word [esp + eax - 0x1fffc]
mov word [edi + eax - 0x20000], dx
movzx edx, cx
xchg dword [esp + eax - 0x1fffc], edx
call fcn.100d1359
add byte [eax], al
insd dword es:[edi], dx
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
jbe 0x10164b34
add byte [ebp - 0x76fbebac], cl
dec esp
and al, 0
sub byte [ebp + 0x32], 0xd6

Function at 0x10170764
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
dec ecx
sal ebx, 0xa5
inc bp
btc ebp, ebp
dec ebx
mov dword [edx + esi - 0xbaf9], ebp
call fcn.100ef4ff
mov ecx, 0xbc873e83
lea eax, [ecx + ecx - 0x8ef5bd2]
mov edx, 0x82982d81
mov dx, word [eax + edi - 0x701f2134]
div cl
call fcn.100f4808
Function at 0x10175591
Capabilities:
Get number of processors

Disassembly:
push edx
adc edi, 0xfffffffc
ror dl, 0x41
pop edx
pop edx
jno fcn.102260e1
Function at 0x1017940b
Capabilities:
Encode data using xor

Disassembly:
and edx, 0xb983e607
pop edx
and cl, al
mov eax, 0xd1906681
inc al
push eax
mov word [edi], cx
sub esi, 4
movzx ecx, word [esp]
inc ecx
rol ecx, cl
mov eax, dword [esi + ecx - 0x33418]
xor eax, ebx
rol cl, 0x42
inc eax
lea edx, [ecx*4 + 0x2c3233ab]
xchg byte [esp + ecx*2 - 0x668c0], cl
push edx
ror eax, 1
sub eax, 0xa63a85bb
neg eax
sal ecx, 0xff
xor ebx, eax
sar word [esp + edx - 0x2c3f052b], 0xc1
sal edx, 0xf0
ror byte [esp + ecx + 4], 0x22
adc ebp, eax
pop edx
call fcn.1014f57f
jo 0x1017942e
push 0x18c5c39f
push ss
pop ebx
lahf
dec ebx
stc
push eax
push ss
pop ebx
lahf
and esi, dword [ecx - 0x60a4e9bc]
cmpsd dword [esi], dword es:[edi]
invalid

Function at 0x1017bc78
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 8]
call eax
call fcn.1017f673
push 0xffffffffffffff93
push 0x5a0fb99f
pop ebx
lahf
mov ecx, 0x5b3e3ae7
pop ebx
lahf
test eax, 0x5b3e428f
lahf
xor dword [ebx - 0x60a4c1ba], eax
aad 0x87
test al, 0x88
test eax, 0x3e603224
test eax, 0xc18f5860
mov bh, 0xbc
jns 0x1017bc91
sal dword [edi + 0x18e079bc], 0xa4
cld
inc ebp
dec esi
invalid
sbb byte [esp + edi*8 - 0x6239b1bb], ah
sbb byte [eax + ecx*8 - 0x74], ah
jbe 0x1017bcac
out dx, al
popfd
sbb byte [esp + esi*8 - 0x18], ah
push edx
jo 0x1017bcbd
ror dword [edi - 0x4d], cl
xchg edx, eax
push 0xbbee709f
aas
pop ebx
lahf
fsub dword [edx - 0x55]
aas
pop ebx
lahf
pop eax
push ds
cmpsd dword [esi], dword es:[edi]
aas
pop ebx
lahf
push esp
xchg ebx, eax
aas
pop ebx
lahf
invalid

Function at 0x1017bf21
Capabilities:
Encrypt data using aes mixcolumns step
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
je 0x100c852e

Function at 0x102007a5
Capabilities:
Encode data using xor

Disassembly:
sub edx, edx
dec cl
xor bl, cl
mul dx
adc ecx, esp
btr eax, 0x3f
sub dx, ax
add dl, byte [ecx + edx*8]
xor al, 0x93
movzx ecx, ax
and ecx, 0x9995b0bb
mov word [edi + eax*4 - 0x24e], dx
movzx edx, al
mov ecx, dword [esi + eax*4 - 0x251]
lea esi, [esi + eax*2 - 0x12b]
xor ecx, ebx
dec dl
bt dx, dx
or edx, eax
dec ecx
bswap ecx
add ax, ax
xor ecx, 0xad092fb1
add eax, edx
inc ecx
or eax, edx
xor ebx, ecx
not ax
shr ax, 0xaf
add ebp, ecx
lea ecx, [edx - 0xf5c3adb]
sub ax, dx
ror ecx, 0x3e
movzx cx, byte [edi + eax*2 - 0x1fede]
sar ax, 0xa5
setb dl
neg eax
add dl, byte [edi + edx*4]
and cl, dl
div al
dec al
add eax, eax
not cl
add al, 0xb
mov word [edi], cx
jmp ebp
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.10232747
mov ecx, 0x9730be0e
movzx edx, cl
lea eax, [ecx + edx*8 - 0x146f3150]
movzx ecx, byte [edx + esi - 0xf]
xor cl, bl
sub eax, 0x75a13ea7
adc cl, 0xb4
bts dx, ax
cwde
inc dx
xor cl, 0xa
sub dx, 0xbd0f
ror dx, 0x64
rol cl, 1
and eax, 0x89214b95
jne 0x101570ab
cmc
inc dword [ebp + 0x369f5f27]
push esp
test dword [edi], esp
pop edi
lahf
push esp
stc
mov ch, byte [edi + ebx*4 + 0x1a]
jo 0x102007f0
mov ch, byte [edi + ebx*4 + 0x12]
pop eax
xchg ecx, eax
mov ch, byte [edi + ebx*4 - 0x3e]
pushal
in eax, 0x8a
insb byte es:[edi], dx
lahf
xchg esi, eax
xor al, 0xb
aas
sbb eax, 0x8ad73213
sahf
pushal
invalid
Function at 0x10205c62
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [esp + edx - 0x7ffffff6]
dec esp
mov dword [esp + ecx - 0x86f0], edi
mov esi, edx
dec eax
add ecx, edx
xor dword [esp + edx - 0x7ffffff0], ebp
dec byte [esp + esi - 0x7ffffff5]
not byte [esp + edx - 0x7ffffff6]
dec esp
mov edi, dword [esp + edx - 0x7ffffff0]
dec esp
mov dword [esp + esi - 0x80000000], edx
dec esp
xor edx, dword [esp + esi - 0x7ffffffa]
sar cl, 0x83
dec eax
arpl bp, bp
inc dword [esp + esi - 0x7ffffff6]
inc sp
adc ebp, edx
dec eax
adc ebx, ebp
pop eax
dec esp
or ebp, dword [esp + edx - 0x80000000]
inc ebp
movzx eax, byte [ecx - 5]
dec ecx
adc ecx, 0xfffffffb
inc ebp
xor al, bh
dec eax
mov dword [esp + esi - 0x7ffffff8], eax
mov byte [esp + edx - 0x7ffffffa], 0x32
inc ecx
push es
add byte [eax], al
xor byte [edx], 0x41
dec al
inc ecx
not al
dec ebp
btc edx, edx
inc ebp
adc al, bl
inc ecx
not al
inc ecx
dec ch
inc ecx
sub al, 0x2d
neg word [esp + edx - 0x7ffffffa]
inc ecx
rol al, 1
xor word [esp + edx - 0x7ffffff3], 0x78f
inc ebp
xor bh, al
inc esp
xor dword [esp + edx - 0x7ffffff5], ebp
inc cx
bt ebp, eax
call fcn.1020108b
jno 0x10205ccc
cmp byte [edi + eax], ch
mov dl, byte [eax]
lodsb al, byte [esi]
fcmovnb st(0), st(3)
dec ebx
adc dword [eax + 0x4b832b84], 0xffffff83
nop
lodsb al, byte [esi]
cmp ebp, dword [ebx]
dec ebx
adc dword [eax + 0x4b6beb50], 0xffffff83
nop
push esp
ror dword [ebx - 0x7d], cl
nop
inc eax
add ebp, dword [ebx]
dec ebx
adc dword [eax + 0x4b63f3b4], 0xffffff83
nop
jg 0x10205cd9
jns 0x10205d7b
adc dl, al
dec ebp
rsqrtps xmm3, xmm6
out dx, eax
loope 0x10205dd2
xor eax, 0x81102034
or ah, byte [0x11102034]
test ebp, edx
xor al, 0x20
adc cl, ah
dec edx
and eax, 0x81102034
aas
retf
and dword [eax], edx

Function at 0x10208532
Capabilities:
Encode data using xor

Disassembly:
dec esi
mov dword [esp - 0x133776d], edi
inc ecx
movsx ecx, dx
inc ebp
and dl, dh
inc edx
xor dword [esp - 0x99bbba0], esi
inc ecx
push esp
inc cx
mul esi
dec esi
mov edi, dword [esp - 0x266eeda]
adc ax, dx
dec eax
arpl si, si
dec eax
adc ebx, esi
dec edi
lea ecx, [ecx - 0x4cdddd5]
inc ebx
mov cl, byte [ecx - 0x4cdddd4]
not dl
inc ecx
mov esi, esp
inc ecx
xor cl, bh
dec esi
mov dword [esp - 0x4cdddcc], ebx
dec edx
mov dword [esp - 0x99bbb98], 0xe2f2da9
push edx
dec cl
dec eax
lea edx, [edx*8 + 0x3f88b916]
rol cl, 1
sub cl, 0x39
inc ebp
bts eax, ebx
rol cl, 1
dec ecx
lea esi, [eax + edx*8 + 0x322b2b08]
dec edx
sub eax, dword [esp - 0x266eede]
inc esp
xor bh, cl
dec eax
lea ecx, [esp + ecx + 0x20]
inc bp
btc ebp, edx
cdq
dec edx
mov eax, dword [ecx - 0x266eeea]
shl si, 0x8f
inc ecx
inc ebx
dec edx
lea edi, [edi - 0x266eef2]
dec edx
mov dword [edi - 0x266eeea], eax
pop esi
pop eax
inc ecx
pop esp
inc ecx
pop esp
js fcn.10115f46
Function at 0x10228bd5
Capabilities:
Check for software breakpoints
Encode data using base64

Disassembly:
shl eax, 0xdb
xor al, 0x2f
push edx
xor ebx, ecx
imul ax
lea eax, [eax*2 + 0x20240721]
dec edx
adc ebp, ecx
sal ax, 0xc2
movzx ecx, ax
inc ax
mov eax, dword [edi + edx*2 - 0x43fffffe]
sub ecx, ecx
xadd word [esp + edx - 0x21fffffd], dx
bts ecx, edx
lea edi, [edi + edx - 0x21ff21fc]
jae 0x100c3a09
push edi
inc eax
mov byte [esp + 7], bh
dec eax
mov edx, dword [esp + 8]
inc ecx
pop ebp
dec eax
mov dword [esp], edi
call fcn.100d9e62
inc bp
bt esp, esp
neg ecx
movsx eax, si
call fcn.100d30e5
sar edx, 0xae
bswap eax
jns 0x1020503f
dec dx
xor ebx, eax
or edx, 0x84bfebaa
rol word [esp + ecx], 0x6c
add ebp, eax
sar dword [esp + ecx*8], 0x55
sets byte [esp + ecx]
mov edi, dword [edi + ecx*2]
pop ecx
jb fcn.102260e1
mov eax, 0x8b284424
lea edx, [eax - 0x2b5e3a4f]
lea esi, [esi + edx - 0x5fca09d9]
dec eax
movsx ecx, dx
mov ecx, dword [esi + edx - 0x5fca09d5]
or dx, 0x2899
imul dl
xor ecx, ebx
ror edx, 0xfb
rol edx, 0xb9
bswap ecx
dec edx
rol ax, 0x66
sub ax, ax
xor ecx, 0x18110233
ror edx, 0x8a
dec ecx
lea eax, [edx + edx - 0x3a52fdd9]
dec eax
rol ecx, 2
bswap edx
xor ebx, ecx
add ebp, ecx
jmp 0x100ca026
ror dl, 0x43
bswap eax
mov dword [esp + ecx - 0x5ccf3041], edx
or dl, 0x82
lea eax, [eax + ecx - 0x7c8c755a]
ror word [esp + ecx - 0x5ccf303f], cl
jg 0x1015cccd
neg eax
ror eax, 2
add byte [esp + ecx - 0x5ccf303f], 0xa0
sub ecx, ecx
bswap eax
rol dx, 0x85
xor eax, 0x8bbee73b
sar dword [esp + ecx], 0x6d
jp 0x1017b831

Function at 0x1022d0f3
Capabilities:
Encode data using xor

Disassembly:
mov word [edx + edi - 0xd817416], ax
rol cx, 0xc9
sar ecx, cl
shl ecx, cl
lea esi, [edx + esi - 0xd81741a]
add dx, 0x96a7
mov edx, dword [edx + esi - 0xd810abd]
lea eax, [ecx + ecx + 0x10fe213]
jb 0x1022b07a
or ecx, ecx
xor ebx, edx
add ebp, edx
xor cl, 0xbd
lea edx, [eax + eax*8 + 0xe9c0f84]
mov dword [esp + ecx*4 - 0x1ee8], ebp
ret
sub al, ah
xor edx, ebx
add edx, 0x94abcf2c
xor cx, 0x3c26
sal cx, cl
bt ax, 0xb
xor edx, 0xc9b0d408
bts eax, eax
rol ecx, 0xb2
adc ecx, eax
lea edx, [edx + eax - 0x50d16bc6]
xor edx, 0x7d990522
bt eax, 8
xor ebx, edx
lea ecx, [ecx*8 + 0x101e8c2b]
sal cl, 1
and ecx, 0xa10b170b
adc ebp, edx
ror ecx, 0xca
jmp ebp
push ebp
mov ebp, 0x6da7c680
pushfd
neg ebp
and bp, bp
or bp, bp
push edi
mov dword [esp + 0xc], 0xcd10b94d
mov ebp, dword [esp + 8]
mov edi, 0xad8f9eb6
shl edi, 0xb2
lea edi, [edi + edi*2 + 0x59115107]
pop edi
je 0x1022d117
push dword [esp]
popfd
lea esp, [esp + 8]
call fcn.10232747
mov edx, 0xd817417
mov ecx, dword [edx + edi - 0xd817417]
movzx eax, dx
xor eax, edx
jle 0x10105da0
add ax, word [ecx + edx - 0xd817417]
dec dl
movsx ecx, dx
lea edi, [edi + edx*4 - 0x3605d056]
jne 0x1010799e
shl dx, cl
lea ecx, [eax - 0x266f4970]
mov word [edi + eax*2], dx
xadd dword [esp + eax], ecx
lea esi, [eax + esi - 4]
xadd eax, ecx
inc ecx
pop eax
mov edx, dword [esi + eax - 0x5f8bfc7e]
shl eax, cl
or ax, ax
xor edx, ebx
add ecx, ecx
dec al
dec edx
neg edx
sub cx, ax
cwde
sal eax, cl
not edx
push eax
ror edx, 3
inc edx
not edx
jmp 0x1012e508
Function at 0x10232b42
Capabilities:
Encode data using xor

Disassembly:
or dword [esp + eax], ebp
ret 4
dec edx
mov dword [esp + edx - 0x50240a], ebp
inc ebx
movzx eax, byte [ecx + edx*8 - 0x2812050]
inc ecx
pop esi
inc ecx
xor al, bh
inc ecx
bt ebx, ebp
inc ecx
neg dl
sbb al, dl
inc cx
shl edx, 0xef
inc ecx
movzx esi, al
rol al, 1
push ebp
dec eax
bt edx, 0x31
sbb al, 0x39
rol al, 1
inc esp
xor bh, al
dec eax
lea eax, [esp + eax + 8]
sar bp, 0xc4
inc cx
sub ecx, esi
dec esi
mov ebx, dword [eax + edx*2 - 0xa00000]
dec esi
xadd dword [esp + edx - 0x500000], esi
inc esp
xadd edx, esi
dec ecx
lea edi, [edx + edi - 0x500008]
xor edx, 0x5dbf4385
dec ebp
mov dword [edx + edi - 0x500000], ebx
inc ecx
pop edx
jp fcn.10115f46
mov dword ss:[ecx + eax], edx
jno 0x100fe80f
rol byte [ebx], cl
pop esp
lahf
popal
inc ebx
imul byte [esi + 0x37659f6f]
xchg byte [esi + 0x7fe59f6f], ch
shr byte [esi + 0x5b319f6f], cl
cli
scasb al, byte es:[edi]
outsd dx, dword [esi]
lahf
sbb dword [ebx - 0x5c], eax
push eax
cmp dword [eax], edx
xor bh, byte [eax - 0xb9f6252]
das
push ecx
cmp dword [ecx + ebx*8 + 0x24a42c70], 0x54
mov dh, 0x42
or eax, 0xf0e7642c
xchg edx, eax
push ds
or eax, 0xb9b3642c
mov dl, 0xb0
out 0x4f, eax
scasd eax, dword es:[edi]
add ebx, dword [edi + ebx*4 + 0x7c]
cmp al, byte [ebx - 0x1f609052]
dec esi
invalid

Function at 0x102330f1
Capabilities:
Encode data using xor

Disassembly:
inc ecx
mov eax, ebx
dec edx
lea edi, [edi + edx*2 - 0x1dcee]
dec eax
cdq
inc ecx
pop esi
inc ecx
pop esp
pop ecx
inc ecx
pop esi
jo fcn.10115f46
inc dx
mov dword [edi + edx*4 - 0x3b9da], edx
inc bp
imul ebx, edx
jb 0x1011b719
Function at 0x10233f73
Capabilities:
Encode data using xor

Disassembly:
shr ax, cl
or dl, 0x82
movzx ecx, dx
push edx
mov word [edi + edx - 0x83], ax
movsx eax, cx
add eax, ecx
xchg cx, dx
inc ebx
movzx eax, word [ecx + esi*8 - 0x1d648c70]
inc cx
xor eax, edi
call fcn.100df8f1
mov eax, 0x2cb3f13e
neg al
mov ecx, eax
mov ax, word [eax + edi - 0x2cb3f1c2]
mov cl, byte [ecx + edi - 0x2cb3f1c0]
mov edx, 0xa236cf05
setns dl
jno 0x10183bf4
dec eax
ror eax, cl
inc ecx
mov edx, dword [ecx + eax + 0x46bd1]
dec eax
not ecx
inc ecx
xor edx, edi
not edx
push ecx
dec eax
sal dword [esp + eax + 0x46bd1], cl
xor edx, 0x6a31a7af
inc ecx
mov esi, 0xd7a5ec1f
inc sp
xchg dword [esp + eax*4 + 0x11af4a], esi
not edx
sub byte [esp + eax*8 + 0x235e8a], 0x2c
dec edx
shr dword [esp + eax*2 + 0x8d7a5], 0x53
or si, ax
bswap edx
inc esi
movzx ebp, byte [esp + ebx - 0x42]
xadd cx, ax
inc ecx
neg dh
dec esp
mov dword [esp + eax*2 + 0x9c0fa], edi
dec esp
sbb ebx, esi
xor dword [esp + eax + 0x4e07d], edx
inc ebp
movsx eax, bp
inc ecx
pop edi
inc cx
bt ebx, esi
dec eax
btc eax, 0xab
dec eax
arpl dx, dx
dec eax
add ebx, edx
btc si, ax
jb fcn.10115f46
adc edi, 1
sub edx, edx
sete dl
jge 0x100dfe1d
mov esi, 0xe72f3329
inc esp
movsx esp, si
inc esp
mov esi, esi
dec edi
lea ecx, [ecx - 0x6656]
inc edi
mov eax, dword [ecx - 0x19948]
inc ebp
xor eax, edi
inc ecx
inc eax
inc esp
movzx edx, dh
call fcn.100fe01c
mov esi, 0xc8affd86
dec eax
lea edx, [esi*4 - 0x6df63cd6]
inc ebp
movzx esi, word [ecx]
movsx eax, dx
inc bp
xor esi, edi
dec eax
and edx, eax
mov ecx, eax
dec eax
lea ecx, [ecx - 0x4b57b174]
inc cx
sbb esi, 0x4166c593
neg esi
inc cx
add esi, 0x4166648a
xor esi, 0xf766b037
fisub dword [esi + 0x45]
xor edi, esi
dec eax
sub edi, 2
inc sp
mov dword [edi], esi
dec eax
cwde
inc esp
movzx ebx, al
ror cx, 0xa4
dec ebp
lea ecx, [ecx + eax*8 + 0x235ec]
jb 0x101118e9
dec eax
mov dword [esp + edx*4 - 0xeb24638], 0x33371835
jmp 0x100f30a0
Function at 0x102399ad
Capabilities:
Encode data using xor

Disassembly:
test eax, eax
call fcn.100c5940
popal
jo 0x1010d5b0
sub eax, 0x772d736d
imul ebp, dword [esi + 0x2d], 0x2d747263
outsb dx, byte [esi]
sub eax, 0x2d747263
jne 0x1010d5c9
imul ebp, dword [ecx + ebp*2 + 0x74], 0x316c2d79
sub eax, 0x2e302d31
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, ch
xor byte [ecx + 0x5db4000e], cl
js 0x1010d54d
push esp
idiv byte [edi]
sbb edx, dword [ecx + 0xf]
fadd qword [esi + 0x523b0be7]
paddq mm5, qword [edx - 0x164b1d4d]
jl 0x1010d604
insd dword es:[edi], dx
mov edi, ds
add esp, dword [edi + 6]
adc eax, dword [ecx + 0xf]
call 0x3032211b
fld qword [ebx + 0x46e97eec]
fcom dword [esi + 0x39]
mov ebx, 0x4614709f
or dword [0xa21e4b08], edi
scasb al, byte es:[edi]
jl 0x1010d564
dec esp
ret
pop edi
push esp
jl 0x1010d610
fst qword [esi + 0xad0b4ae]
rol byte [ebp + 0x23a900f8], 1
mov ah, 0x22
inc ecx
dec ebx
mov ebx, 0x3b4f787a
invalid
cmp ecx, dword [ebp - 0x4aa3760b]
xchg byte [edi - 0x80], cl
mov eax, 0x350e7ca9
dec esp
dec ecx
dec esp
xchg ebp, eax
adc eax, 0x5c287c55
ret 0x8f24
jmp 0x806620e6
jecxz 0x1010d684
test dword [0xac7ca9c1], 0xeaa08f51
xchg esp, eax
add esp, dword [ebx]
xchg byte [ecx - 0x291c5cf2], ah
ret
sbb al, 0xe8
mov cl, 0x24
std
inc dword [ecx - 0x42]
cmp edx, dword [ecx + 0x39]
lodsd eax, dword [esi]
dec eax
mov edx, dword [edi]
dec edi
lea eax, [esi + esi*2 + 0x61bfaba4]
mov ax, word ss:[edx]
inc ecx
bswap eax
dec ecx
lea edi, [eax + edi - 0x559f6b63]
inc ebp
movsx ebx, si
inc cx
mov dword [eax + edi - 0x559f6b69], eax
inc ecx
push ebx
inc bp
and esi, ebx
dec edi
lea ecx, [ecx + eax - 0x559f6b6d]
inc ebp
movzx esp, al
inc ebp
mov edx, esi
inc ebx
mov ecx, dword [ebx + ecx - 0x513b]
jne 0x100fd500
jmp 0x1010d53d
mov dword [esp], 0xec07f08f
adc edi, 3
push 0x7626c402
push 0xbd3df518
xor ecx, ecx
jmp 0x10171754
Function at 0x411f70
Capabilities:
Terminate process

Disassembly:
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [0x4976b4]
mov ecx, eax
inc ecx
mov dword [0x4976b4], ecx
imul eax, eax, 0x2b56c0eb
add eax, 0x71654c83
mov ecx, dword [0x4970d8]
xor ecx, eax
mov dword [0x4970d8], ecx
mov eax, dword [0x49b5d4]
mov ecx, esp
mov dword [ecx], eax
call fcn.00407ab0
mov dx, word [0x4979cc]
mov cx, dx
inc ecx
mov si, cx
mov word [0x4979cc], si
movsx ecx, dx
and ecx, 0xa6d1f083
mov dx, word [0x497b42]
movsx edi, dx
xor edi, 0xffffffff
xor edi, 0xff97bf03
cmp ecx, edi
mov byte [esp + 0xb], al
jl 0x411fff
mov eax, dword [0x4926a0]
imul eax, eax, 0x4d36d1a9
mov dword [0x4926a0], eax
mov eax, 1
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.0045c0b3
int3
Function at 0x430d70
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
sub esp, 8
mov eax, 0xad2c16de
mov dword [esp + 4], ecx
mov edx, dword [0x492ed0]
sar edx, 8
add edx, 0xcb70d18a
cmp eax, edx
mov dword [esp], ecx
jl 0x430da1
mov word [0x49ad64], 0x1046
mov eax, 0x890e041
mov ecx, dword [esp]
mov dword [ecx], 0
mov edx, dword [0x4905bc]
mov esi, dword [0x490244]
shl esi, 0xa
and esi, 0x44b218de
or edx, esi
cmp eax, edx
jg 0x430ddd
mov eax, dword [0x4949a4]
add eax, 0xf9a70a6f
mov dword [0x4949a4], eax
mov eax, 0xe1f42610
mov ecx, dword [esp]
mov dword [ecx + 4], 0
mov dx, word [0x4979ae]
movsx esi, dx
mov dx, word [0x4999c2]
mov di, dx
dec edi
mov dx, di
mov word [0x4999c2], dx
movsx edi, dx
imul esi, edi
xor esi, 0xfca9a21b
cmp eax, esi
jne 0x430e4d
mov ax, word [0x49a332]
movsx ecx, ax
mov edx, dword [0x491398]
shl edx, 3
cmp ecx, edx
jne 0x430e48
mov eax, dword [0x493334]
add eax, 0x9a80303c
mov dword [0x493334], eax
jmp 0x430e4d
mov eax, dword [esp]
mov dword [eax + 8], 0x67452301
mov cx, word [0x499c9a]
mov dx, cx
add edx, 0x30010
mov cx, dx
mov word [0x499c9a], cx
mov dword [eax + 0xc], 0xefcdab89
mov edx, dword [0x494d4c]
sar edx, 4
add edx, 0x2b6bbf8c
mov esi, dword [0x4949cc]
and esi, edx
mov dword [0x4949cc], esi
mov dword [eax + 0x10], 0x98badcfe
mov edx, dword [0x491ac4]
and edx, 0x53931c9f
mov dword [0x491ac4], edx
mov dword [eax + 0x14], 0x10325476
mov edx, dword [0x490978]
or edx, 0x77597e77
mov esi, dword [0x492904]
xor esi, edx
mov dword [0x492904], esi
add esp, 8
pop esi
pop edi
ret
Function at 0x46e524
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x48ed70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0046b798
mov dword [ebp - 0x14], eax
cmp dword [0x49c870], esi
jne 0x46e617
push 0x800
push esi
push 0x483fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x46e5a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x46e6f7
push esi
push esi
push 0x483fb0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x46e6f7
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x46e6f7
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x49c870], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x49c874], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x49c878], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49c880], eax
test eax, eax
je 0x46e614
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x49c87c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x46e63c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46e62f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x46e651
push 4
pop eax
jmp 0x46e6f9
cmp dword [ebp - 0x14], esi
je 0x46e651
push dword [0x49c870]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x46e636
mov eax, dword [0x49c87c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x46e6af
cmp dword [0x49c880], edi
je 0x46e6af
push eax
call ebx
push dword [0x49c880]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x46e6af
test eax, eax
je 0x46e6af
call ecx
test eax, eax
je 0x46e6a4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x46e6a4
test byte [ebp - 8], 1
jne 0x46e6af
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x46e6df
mov eax, dword [0x49c874]
cmp eax, edi
je 0x46e6dc
push eax
call ebx
test eax, eax
je 0x46e6dc
call eax
mov esi, eax
test esi, esi
je 0x46e6dc
mov eax, dword [0x49c878]
cmp eax, edi
je 0x46e6dc
push eax
call ebx
test eax, eax
je 0x46e6dc
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x49c870]
call ebx
test eax, eax
je 0x46e6f7
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x46e6f9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046894b
mov esp, ebp
pop ebp
ret