joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c6a50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4dfc34
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], 4
call fcn.004bd340
lea ecx, [esi + 0x28]
mov byte [esp + 0x14], 3
call fcn.004c3990
lea ecx, [esi + 0x20]
mov byte [esp + 0x14], 2
call fcn.004c3990
lea ecx, [esi + 0x18]
mov byte [esp + 0x14], 1
call fcn.004c3990
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, edx
add edx, edx
push edx
mov edx, dword [esi + 4]
push edx
mov byte [esp + 0x1c], 0
call eax
mov dword [esi], vtable.Botan::ELG_Operation.0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4c6c60
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x4dfd0a
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x53132c]
xor eax, esp
mov dword [esp + 0x88], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53132c]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb4]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xbc]
mov edi, ecx
mov ecx, dword [esp + 0xb8]
push pe_nt_image_headers32
push ecx
xor edx, edx
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0xb4], edx
mov dword [esp + 0x60], esi
mov dword [esp + 0x20], edx
call fcn.004bcf00
push 1
lea ebp, [edi + 4]
push ebp
lea ecx, [esp + 0x34]
mov dword [esp + 0xb0], 1
call fcn.004bc710
test eax, eax
js 0x4c6d4a
push 0x2b
push str.Default_ELG_Op::encrypt:_Input_is_too_large
lea ecx, [esp + 0x60]
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], 0
mov byte [esp + 0x60], 0
call fcn.00404270
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x78]
mov byte [esp + 0xac], 2
call fcn.00473ba0
push 0x5213bc
lea ecx, [esp + 0x78]
push ecx
mov dword [esp + 0x7c], vtable.Botan::Invalid_Argument.0
call fcn.0045869c
push ebx
lea edx, [esp + 0x1c]
push edx
lea ecx, [edi + 0x18]
call fcn.004c4a90
push ebx
lea eax, [esp + 0x5c]
push eax
lea ecx, [edi + 0x20]
mov byte [esp + 0xb0], 3
call fcn.004c4a90
push eax
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x48]
push edx
lea ecx, [edi + 0x30]
mov byte [esp + 0xb4], 4
call fcn.004c8520
mov edx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
add edx, edx
add edx, edx
push edx
mov edx, dword [esp + 0x5c]
push edx
mov byte [esp + 0xb0], 6
call eax
mov ecx, ebp
call fcn.004bcb60
add eax, eax
push eax
mov ecx, esi
call fcn.00474690
mov edi, dword [esi]
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], 1
call fcn.004bcb60
mov ecx, ebp
sub edi, eax
call fcn.004bcb60
add eax, edi
push eax
lea ecx, [esp + 0x1c]
call fcn.004bcb70
mov ebx, dword [esi]
mov edi, dword [esi + 4]
lea ecx, [esp + 0x40]
call fcn.004bcb60
shr edi, 1
add edi, ebx
mov ecx, ebp
sub edi, eax
call fcn.004bcb60
add eax, edi
push eax
lea ecx, [esp + 0x44]
call fcn.004bcb70
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
add eax, eax
push eax
mov eax, dword [esp + 0x44]
push eax
mov byte [esp + 0xb0], 3
call edx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
mov eax, dword [ecx]
mov byte [esp + 0xa8], 1
add edx, edx
mov eax, dword [eax + 4]
add edx, edx
push edx
mov edx, dword [esp + 0x1c]
push edx
call eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edx, dword [ecx]
mov edx, dword [edx + 4]
add eax, eax
add eax, eax
push eax
mov eax, dword [esp + 0x30]
push eax
mov byte [esp + 0xb0], 0
call edx
mov eax, esi
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
xor ecx, esp
call fcn.004587b6
add esp, 0x98
ret 0x10
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x71660be1
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x35626a0d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x431bf4
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
jbe 0x431bc6
in eax, dx
lea ecx, [esi + 0x71]
sbb al, 0x1c
push cs
ret
or esi, 0x76
sti
mov esi, ecx
movsb byte es:[edi], byte [esi]
sal ebp, 1
ror byte [edx - 0x22], 9
and cl, byte [eax + 0x6ef1fe17]
adc dword [ecx + 0x38], ebx
jg 0x431c3a
js 0x431c0a
xchg dword [edx - 0x6d], eax
sbb byte [ecx], 0x23
lodsb al, byte [esi]
mov byte [0xe7c01ce1], al
movsb byte es:[edi], byte [esi]
enter 0xffffffffffff95ac, 0xffffffffffffffd6
loope 0x431bea
sub eax, 0x10a9cbc6
cmp edi, ecx
cmc
loopne 0x431c2e
jl 0x431c5c
sub dword [edx + 0x4e], edi
test al, 0xec
push ds
arpl bp, si
inc eax
call 0xd80ffd56
loope 0x431bb8
xlatb
cli
jmp 0x431ba4
wait
je 0x431b82
or eax, 0x5b808b90
fild qword [0xb5b36965]
mov eax, dword [0xccccba89]
push esp
pop ds
mov ebx, 0x9bd1ce83
or esi, 0xffffffd1
wait
or ecx, 0x3c9f5902
fidiv word [edx]
stosd dword es:[edi], eax
and esi, ecx
dec esp
sub al, 0x4c
and cl, dl
adc dword [edi + 0x34312651], 0x58
push ecx
xor dword es:[eax + ebx*2], esi
push edi
push eax
cmp edi, ecx
pushal
xlatb
or dword [esi], ecx
jbe 0x431c20
int1
mov dh, dh
sbb ecx, esp
or dword [ecx], edx
mov edx, dword [ebx + 0x3d599009]
cld
mov ch, byte [edi]
xchg ecx, eax
cmp eax, 0x912f8afc
sbb dh, byte [ecx + ebx*4 - 0x2d]
inc eax
fidiv word [esi + 0x1a]
dec byte [ebx - 0x6c]
mov dh, 0x5a
imul edi, dword [esi], 0x13d57d57
loope 0x431c5a
push edi
mov ah, 0xa0
inc esi
mov ebp, 0x9dd6a83b
cmp ebp, dword [eax + 0x4d469dd6]
salc
popfd
inc esi

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd7c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd7c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657550
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x484a4c
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x380b901a
xor byte [esi], 0xe1
sal byte [edi + edi + 0x18], 0xeb
fild qword es:[edx + 0x31]
invalid
Function at 0x4855ab
Capabilities:
Encode data using xor

Disassembly:
jo 0x4855d2
mov edi, edx
xchg ecx, eax
and ecx, dword [ecx + 0x74e5b04a]
ljmp 0xcc55
push esp
jecxz 0x4855ee
mov byte [ecx + 0x49], dl
pop edi
sbb dword [ebx - 0x47bd51e8], edx
lodsd eax, dword [esi]
loope 0x485625
cmp ah, byte [ebx - 0x20]
mov cl, 0x59
pop esi
sub al, 0x47
mov dword [0x5c0a13e9], eax
and dword [ecx - 0x27], 0x34
push 0xffffffffffffffea
push ecx
fldcw word [ebx - 5]
jmp 0x83a45fdc
or al, 0x20
shl dword [ecx - 0x63], 1
ror dword [ecx + 0x323f4be3], 0xd1
jecxz 0x485626
aas
xor dl, cl
jne 0x4855d9
jmp 0x485589
imul esi, dword [eax], 0x43
push ds
retf
jecxz 0x4855c4
jg 0x4855e2
invalid
sbb eax, 0xba7637f2
mov cl, 0x6b
push ebp
scasb al, byte es:[edi]
jecxz 0x4855f1
sub byte [ebx], ch
wait
loop 0x485657
inc esp
clc
pop esi
nop
mov byte [0x409fded3], al
dec ebp
adc bh, ah
dec eax
jnp 0x4855e0
das
cmpsb byte [esi], byte es:[edi]
int3
dec esi
invalid
mov bl, byte [edx - 0x768cdc04]
sub cl, cl
add eax, dword [esi - 0x5e6b76f0]
push ss
mov al, byte [0x6577fdbf]
fimul dword [edi]
sahf
hlt

Function at 0x4d0cb6
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
in al, dx
sal dword [bp + di - 4], 0xfb
leave
test ebp, ebp
invalid

Function at 0x510dbc
Capabilities:
Encode data using xor

Disassembly:
fldenv [eax + 0x13291654]
aas
in al, dx
in al, dx
insd dword es:[edi], dx
sub eax, 0xad5e71e6
pop ecx
mov cl, 0x14
ror byte [eax], cl
sar dword [esi + 0x7dbe4d23], 0x7b
inc ebx
jmp [eax + 0x6b]
dec ecx
fldpi
jle 0x510d2d
dec ecx
add dword [eax - 0x37], 0xffffff86
or dword [esi - 0x5b74da2d], edx
cwde
xchg dword [edx - 0x4cb61438], esp
retf
adc al, 0xc2
xor ebp, dword [edx]
in eax, 0xf3
mov esp, 0x8353b5d3
mov dl, 0x12
mov ebx, 0xfd3fe4ce
in al, 0x3f
std
fldenv [eax - 0x5b]
mov eax, dword [0xb316f293]
leave
add eax, 0xcc0520e9
mov dword [edi], ebp
mov edx, 0x18ee45b2
inc ecx
xchg esi, eax
jb 0x510d5b
lodsd eax, dword [esi]
xlatb
aad 0x37
sbb ebx, ebp
pop ebp
wait
invalid
xor al, 0xd8
pop es
jbe 0x510d7c
jne 0x510dea
outsb dx, byte ss:[esi]
inc esp
cmp al, 0x5d
ja 0x510db3
dec edi
dec ebx
inc edi
pop es
imul ecx, esi, 0xffffff82
and bl, byte [edi - 0x72]
lea eax, [esi + eax*8]
sbb dl, ah
mov edi, 0xfd66629a
xchg edx, eax
stosd dword es:[edi], eax
int3
mov dword [0xf1f11a27], eax
pop ds
int 0xf5
sbb ch, bl
push esi
jbe 0x510e25
xor al, dl
movaps xmm1, xmmword [eax + ebp*4]
xor dword [ebx + edx*4], edi
mov eax, dword [0x72d9a13b]
ret 0x25b3
sbb dword [ebp - 0x34eeda12], esp
fist dword [ebx - 0x16]
add esp, 0x3b
inc esi
idiv byte [ebp - 0x5250ce3d]
out dx, al
xchg dword [edi], ecx
aaa
and dword [ebp - 0x15], esi
xor al, 0x11
cmp eax, 0x6ca54b7f
cmp al, 0x4b
add ecx, dword [esi - 0x67]
sbb bh, byte [0xd39315c9]
cwde
test edi, edi
test eax, 0x988e688
inc ecx
arpl word [eax], di
pop ebx
mov ebp, 0xa53a434
test al, 0x6c
invalid
Function at 0x51ad67
Capabilities:
Encode data using xor

Disassembly:
sub dword [esi + 0x42da3b44], eax
invalid
xor dword [ebx + 0x4a272b34], esi
inc edi
mov edi, 0x8d655a97
mov bh, 0x13
push edx
cwde
sbb esi, dword [esi]
and ebp, eax
and byte [esi], ah
out 0xcd, eax
cmpsb byte [esi], byte es:[edi]
push esi
pop edi
cmpsd dword [esi], dword es:[edi]
push ss
or al, 0x99
xchg edi, eax
inc ebx
jns 0x51ad34
inc edi
xchg ebx, eax
aad 0xa2
test byte [ebp - 0x5c], 0xf9
pop edi
xor esp, edi
add dword [0xca3a3745], 0xffffffff
pop edi
ror ebx, 0x4b
xor ch, byte [ebx]
and dh, al
xor bl, 0x8f
xor al, 0xfa
lea ecx, [ecx + 0x3a]
xchg edx, eax
push ds
mov dword [ebx + 0x1f41e516], edx
adc ecx, edi
cmpsd dword [esi], dword es:[edi]
in eax, dx
xchg edi, eax
mov al, byte [edx + 3]
invalid

Function at 0x52b8b9
Capabilities:
Encode data using xor

Disassembly:
in al, dx
xor ebp, edi
push ds
in al, dx
sub esp, dword [esi]
xor eax, 0x1dbaf214
add dword [edx - 0x33c5b695], ebp
push ds
int3
adc eax, 0x873850
xlatb
push eax
cmp byte [edi - 0x5842900], al
add bh, dl
jnp 0x52b850
and al, 0xfc
sbb eax, 0x245da35
clc
clc
xor dword [ecx + 0x7b], 0xffffffd1
mov al, byte [0x3862254f]
fmul qword [edx - 0x1b]
xor eax, 0x83a19e1b
arpl word [edi + 0x6b], si
aad 0x5b
loop 0x52b852
xchg esi, eax
jp 0x52b837
sbb al, 0xe4
ja 0x52b8a5
insb byte es:[edi], dx
stosb byte es:[edi], al
xor esi, 0xffffff9a
outsb dx, byte [esi]
iretd
pop ebx
push ebp
xor dl, byte [ecx - 2]
push dword [ecx - 0x1f975245]
fcomi st(2)
imul ecx, dword [ecx], 0xffffffe2
popfd
push 0x4d
adc bh, byte [eax - 0x6d]
js 0x52b84e
js 0x52b84e
out 6, al
loopne 0x52b84f
out 0x3a, al
xchg dword [ebp + ecx + 0x51e8975e], ebx
outsb dx, byte [esi]
call 0xab52dab5
xchg edi, eax
call 0xe83b271c
and dword [eax], eax
stosd dword es:[edi], eax
loope 0x52b8c5
mov ecx, 0x8560c479
push edx
scasd eax, dword es:[edi]
loope 0x52b8f5
mov fs, word [esi]
Function at 0x530109
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.0057eee9
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x530191
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call fcn.0057c0b0
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.00530039
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x53028c
shr edx, 2
je 0x530257
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x5301e9
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x5301dd
test edx, edx
je 0x5302b8
jmp 0x530299
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x530299
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x53030a
mov eax, 1
jmp 0x53035f
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.0052ba89
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call fcn.0057c55c
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.0057c0b0
add esp, 0x864
ret
Function at 0x56691f
Capabilities:
Encode data using xor

Disassembly:
invalid
pop eax
push es
ljmp 0xde06
fisttp word [edx + esi*4 + 0x595eea5e]
adc dword [ecx + 0x42], esi
dec ebx
mov ah, 0x4b
mov cl, 0x4a
add esi, dword [eax - 0x6c]
cmp dword [ecx - 0x51a7a1fd], ebx
imul edx, dword [edi - 0x57], 0x43
wait
add al, 2
invalid
mov byte [0xbd70ab0], al
das
pop ebx
in eax, dx
aam 0xe4
dec edi
sub byte [edx - 0x59], ch
loope 0x566875
fsub st(0), st(0)
int3
or ah, ah
mul byte [ebx + eax*8]
sub ecx, esp
cdq
sahf
loop 0x5668ae
mov dh, 0xdd
xor byte [eax], 0x35
pop eax
jo 0x56689a
fld qword [edx + 0x70583530]
wait
mov ch, 0xf5
dec edx
mov edx, 0x30f8a219
mov ah, 0xf6
pop ss
ja 0x5668ed
out dx, eax
inc ecx
or bl, 0x7c
fimul dword [esi - 0x46]
out 0xb, al
daa
sub byte [edx], cl
lcall 0x2b1f, 0x69c6a797
pop ds
sub ebp, dword [edi + edx*4 + 0x19]
dec byte [esi - 0x5effba9e]
mov ebp, 0xfb04c755
pop ds
sub ebp, dword [edi + edx*4 + 0x19]
dec byte [esi - 0x5effba9e]
mov ebp, 0xfb04c755
outsd dx, dword [esi]
stosd dword es:[edi], eax
loopne 0x5668f7
mov bh, 0x36
sub ebx, dword [esi]
push cs
dec edi
cmpsb byte [esi], byte es:[edi]
je 0x5668d0
mov eax, 0x6d90e647
sub bh, byte [0xf797ec88]
invalid

Function at 0x56864a
Capabilities:
Encode data using xor

Disassembly:
lcall 0x7bd0, 0x5f06a111
add ebp, dword [ecx + 0x61f709fa]
inc ecx
invalid
Function at 0x6005b5
Capabilities:
Encode data using xor

Disassembly:
pop ebx
mov ch, 0x77
xchg ebp, eax
das
xor al, 0xa8
sal ebx, 1
cmc
ja 0x600620
divps xmm3, xmmword [edx + ebp + 0x60]
adc bl, cl
pop ebx
xor byte [edx + 0x47], 6
jmp 0x60060d
pop esi
pop esp
sub ah, byte [eax + 0x10]
retf
retf
fmul st(7)
pop ebp
invalid
je 0x600615
jo 0x6005c2
sahf
xlatb
inc edi
nop
mov cl, 0
and byte [edx], bh
push edi
push 0x6e
mov esi, 0x83c6cf31
ja 0x600623
das
lcall 0xe589, 0x29033437
daa
mov esi, 0xacd78857
xor al, 3
sub dword [ecx + 0x57be27e5], ecx
mov bh, dl
lodsb al, byte [esi]
mov bh, 0x8a
wait
mov edx, 0x83d8a5a3
jo 0x600638
std
push edx
aas
mov ebp, dword [eax + 0x26e8b096]
jmp 0xa2173112

Function at 0x615149
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
pop esi
xlatb
wait
test byte [ebx - 0x61], 0x6e
dec ebp
in al, dx
dec ecx
pop es
mov ch, byte [ebp + 0x46]
mov byte [ebx - 6], dl
push 0xf8d1b08b
sub al, 0x3a
dec edi
fld st(6)
fild word [ebp + 0x1e]
xchg dword [ecx - 0x7c526148], edi
inc esi
push edx
and byte [edi], dl
invalid
Function at 0x401157
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x40119e
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x401190
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x401177
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x40116a
pop ebp
pop esi
ret

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd6c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd6c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657600
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x4964e7
Capabilities:
Encode data using xor

Disassembly:
push esi
push eax
push ebx
xor esi, esi
call dword [0x475488]
cmp word [ebx], si
je 0x49652e
mov edx, ebx
push ebp
xor eax, eax
cmp word [edi], ax
je 0x496520
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x496507
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x4964fa
pop ebp
pop esi
ret

Function at 0x4cf37e
Capabilities:
Encode data using xor

Disassembly:
mul byte [ebp + 0x24]
nop
xlatb
sub byte [esi - 0x68], dl
mov dl, 0x59
outsb dx, byte [esi]
cmc
sar cl, 0xb2
invalid

Function at 0x509727
Capabilities:
Encode data using xor

Disassembly:
dec esp
aam 0x37
or eax, 0x8c358f22
in eax, dx
or al, 0xf4
popal
or al, 0xd3
or bh, byte [ebx]
salc
dec ebp
leave
popfd
sub byte [edi - 0x20250f57], ch
sub byte [edi + ecx], 0xfb
das
sbb dl, byte [ebp - 0x4e]
dec ebx
dec ebp
ficomp word [ebp + 0x18]
fsubr qword [edi]
std
pop edx
or eax, 0xdd7fad0d
push es
jge 0x509705
sub al, 0x94
pop edi

Function at 0x519dde
Capabilities:
Check for software breakpoints

Disassembly:
mov byte [eax + 0x57], 0xdc
stosb byte es:[edi], al
mov ebp, dword [esi + 0x2a]
mov dh, 0xd0
dec eax
movsd dword es:[edi], dword [esi]
Function at 0x59cff7
Capabilities:
Encode data using xor

Disassembly:
push es
imul esi, edi, 0x57
sbb ebp, dword [esi - 0x75ad13f0]
and bh, byte [eax - 0x3a]
mov cs, word [eax - 0x52]
scasb al, byte es:[edi]
test byte [ecx - 0x66], 0xa8
and eax, edi
aad 0xe8
add ah, byte [eax + 0x33]
xor eax, 0x8cf5fe24
aad 0x85
mov ch, 9
mov byte [0x127dba88], al
insd dword es:[edi], dx
outsd dx, dword [esi]
insd dword es:[edi], dx
pop esi
dec ebx
cmp edx, dword [esi + 0x608fd4da]
inc edx
add edx, dword [eax - 0x80]
mov dl, byte [esi]
jb 0x59d00f
or byte [ebp + 0x6babe657], dh
test al, 0x70
jecxz 0x59d0b7
lds ebp, [ebp + 0x73]
or esp, dword [edx]
invalid
and dh, byte [edi + 0x702b76c2]
xchg edx, eax
mov dword [0xa2b4001], eax
and dword [ebp + 0x50], edi
or edi, dword [edx]
and ecx, dword [esi - 0x3faf77ec]
mov dl, 0x68
jmp 0xb341ed86
mov dl, 0xac
xor edx, ecx
inc edx
das
int 0x33
cmpsb byte [esi], byte es:[edi]
pop ds
sub ebp, dword [eax - 0x3e]
into
jno 0x59d0e5
inc edx
sbb bh, ch
out dx, eax
jo 0x59d105
loope 0x59d099
sub dword [ebp - 0x25f251dd], 0xffffffd0
test al, 0xbf
sub eax, dword [ebx - 0x63]
sbb edx, dword [edx + 0x628296cf]
inc edi
fisubr word [eax]
jnp 0x59d0c9
jecxz 0x59d135
dec esi
xlatb
sbb esi, dword [edi - 0x7c0c50a1]
adc edi, dword [ebp + edx + 0x19]
adc eax, 0x9ec6365b
pushfd
add esp, ebx
push ebp
mov ah, 0x4a
pop edi
adc dword [esi], 0xfffffff6
add byte [eax], ah
sub edx, dword [eax]
loop 0x59d0c5
arpl word [edi], bx
add eax, esi
push ecx
pop esp
push eax
cld
fstp dword [eax - 0x31ee3caa]
xor cl, byte [edi]
fcom dword [edx + esi*4 + 0xc7ef752]
sbb al, 0xc1
sbb al, 0xc1
jb 0x59d191
mov dh, 0xe3
xor dword [esi + 0x3e], ebx
aad 0x22
mov byte cs:[0x70a5bf6], al
adc dword [eax + 0x4bcef2ee], 0xffffffb4
fcmove st(0), st(5)
pop ebx
dec ebx
mov ah, 0xda
int 0x5b
imul edi, dword [edx + 0x35eb54a4], 0xffffffd5
push eax
inc ebp
mov dword [0xdc4f1620], eax
lodsb al, byte [esi]
popfd
cmp ebp, dword [ebx + 0x41f03126]
invalid
call 0xd51e9423
cmp al, 0x54
loopne 0x59d11f
test eax, 0x28a882ce
or eax, 0xd33a5434
insd dword es:[edi], dx
push esi
push eax
sub eax, 0x1f303f21
invalid

Function at 0x5c1fc7
Capabilities:
Encode data using xor

Disassembly:
add byte [ebp + 0x24a4], cl
add byte [eax], al
nop
inc edi
add byte [esi + 0x39], ah
xor esi, dword [edi + esi - 0x75]
rcl dword [ebp + 0x33], cl
shl byte [esi + 0x39], 7
xor eax, eax
cmp word [edi], ax
je 0x5c2000
mov ecx, edi
lea esp, [esp]
mov ebp, esi
imul ebp, eax
add bp, word [ecx + 2]
add eax, 1
xor word [edx], bp
cmp word [edi + eax*2], 0
lea ecx, [edi + eax*2]
jne 0x5c1fe7
add esi, 1
cmp word [ebx + esi*2], 0
lea edx, [ebx + esi*2]
jne 0x5c1fda
pop ebp
pop esi
ret
Function at 0x63d71a
Capabilities:
Encode data using xor

Disassembly:
pop es
pop edx
aad 0xdd
xor eax, 0x4b77899d
pop ebx
lodsd eax, dword [esi]
retf
mov ah, ah
add eax, 0x927cee5d
and eax, 0xf6899854
push ds
pop esp
push ebx
push 0xd67d8ed1
stosd dword es:[edi], eax
loope fcn.0063d71a
lodsb al, byte [esi]
loopne 0x63d6ff
jl 0x63d777
popal
adc al, 0xe9
arpl word [ecx], bx
aad 0x3a
sahf
sub eax, dword [ebp + edx - 0x27bcb7e4]
and eax, 0xda99eca
scasb al, byte es:[edi]
jmp 0x63d7cc
push ds
retf
cmc
and al, 0x24
push ss
and al, 0x16
call 0xe80a2f78
fsubr qword [ebx + 0x5f]
mov dl, 0xdf
sbb bl, byte [esi]
mov byte [eax + 0x3b], ch
bound ebx, qword [0xda643e88]
loopne 0x63d7db
push 0x881d623b
invalid
or esp, esp
mov bh, 0xcb
outsb dx, byte [esi]
dec ebx
salc
xor al, 0x1c
mul dword [edx]
inc edi
sbb al, 0x4b
shr dword [ebx - 0x6b], 0xca
mov dword [esi - 0x1832ddde], 0xd9ea3a45
and cl, ch
out 0x45, eax
cmp ch, dl
invalid
je 0x63d7e7
mov ah, 0x33
lcall 0xf99b, 0xec4b1efa
test eax, 0x59f0ab3c
clc
inc edi
xchg esi, eax
jle 0x63d871
sbb dword [ebp - 0x6970ab8], edx
wait
loopne 0x63d864
cmp ecx, ebx
sti
dec ecx
pop edx
push ebp
xlatb
cwde
cdq
and dword [esi + eax*8 + 0x24], edi
sbb dword [esi + eax*2 - 0x12817405], esi
js 0x63d7ca
push 0x2f
aam 0xc7
les edi, [ecx + 0x68]
lcall 0xa702, 0xf9dd8b3e
mov ebx, 0x6bc77ff7
pop edx
ret
div dword [ebx - 0x10]
mov al, 0x14
call 0xef1ae4cf
test eax, 0xebc60b1a
sbb al, 0x87
movsd dword es:[edi], dword [esi]
mov edi, dword [eax]
push esp
pop ss
pop es
insd dword es:[edi], dx
aaa
push ebp
cmp eax, 0xc4910ec9
nop
and byte [ebx], ch
pop ecx
pushfd
jne 0x63d8a4
invalid
sub cl, cl
lodsb al, byte [esi]
mov ebp, 0x2bc8f4bb
in al, 0x8b
sti
sbb bh, byte [ebx]
rcr byte [edi + 0x74fcbd3e], cl
sub cl, byte [eax - 0x4ed194d3]
ljmp 0x8838:0xbf5e9786