joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e7570
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4e75a2
lea eax, [esi + 4]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop esi
pop ebp
ret

Function at 0x4e7720
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x4e7753
push 0x2e
push edi
call fcn.0048f1c0
add esp, 8
test eax, eax
je 0x4e7751
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x4e8680
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x555da0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e86ad
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x4e86f4
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x4e86fa
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x4e875b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x4e8720
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x4e8787
mov eax, dword [esi + 4]
push 1
push 0x54505a
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x54505b
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x4e8760
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fbb60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx - 4]
jle 0x4fbbca
mov ecx, dword [ebp + 8]
sub ecx, ebx
push esi
mov dword [ebp + 8], ecx
push edi
nop word [eax + eax]
mov esi, dword [ecx + ebx]
lea ebx, [ebx + 4]
mov ecx, eax
mov edi, esi
and edi, 0xffff00ff
and ecx, 0xffff00ff
add edi, ecx
mov edx, esi
movzx ecx, ax
and edx, 0xff00
add edx, ecx
and eax, 0xff00ffff
mov ecx, dword [ebp + 8]
xor edi, edx
and esi, 0xff00ff00
and edi, 0xff00ff
add eax, esi
xor eax, edi
sub dword [ebp + 0x10], 1
mov dword [ebx - 4], eax
jne 0x4fbb80
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4fbbd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jle 0x4fbc43
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
sub ecx, eax
sub dword [ebp + 0x14], eax
push ebx
push esi
mov dword [ebp + 0xc], ecx
push edi
nop word [eax + eax]
mov ebx, dword [ecx + eax]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov ecx, ebx
and ecx, 0xffff00ff
mov edi, esi
and edi, 0xffff00ff
mov edx, esi
add edi, ecx
and edx, 0xff00
movzx ecx, bx
and esi, 0xff00ff00
add edx, ecx
and ebx, 0xff00ffff
mov ecx, dword [ebp + 0x14]
xor edi, edx
and edi, 0xff00ff
add ebx, esi
xor edi, ebx
sub dword [ebp + 0x10], 1
mov dword [ecx + eax - 4], edi
mov ecx, dword [ebp + 0xc]
jne 0x4fbbf0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4fc440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp + 8], 0
lea eax, [ebx + eax*4]
mov edi, eax
sub edi, ebx
add edi, 3
shr edi, 2
cmp ebx, eax
cmova edi, ecx
test edi, edi
je 0x4fc4b4
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [ebx]
lea esi, [esi + 2]
mov ecx, edx
lea ebx, [ebx + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xd
xor cl, al
mov eax, edx
and cl, 7
shr eax, 0x10
xor cl, al
mov eax, edx
mov byte [esi - 2], cl
mov ecx, edx
shr ecx, 5
shr eax, 3
xor cl, al
shr edx, 5
mov eax, dword [ebp + 8]
and cl, 0x1f
xor cl, dl
inc eax
mov byte [esi - 1], cl
mov dword [ebp + 8], eax
cmp eax, edi
jb 0x4fc470
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4fc4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor ecx, ecx
push ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 8], 0
lea eax, [edi + eax*4]
mov ebx, eax
sub ebx, edi
add ebx, 3
shr ebx, 2
cmp edi, eax
cmova ebx, ecx
test ebx, ebx
je 0x4fc52b
push esi
mov esi, dword [ebp + 0x10]
nop
mov edx, dword [edi]
lea esi, [esi + 2]
mov ecx, edx
lea edi, [edi + 4]
shr ecx, 0x10
mov eax, edx
shr eax, 0xc
xor cl, al
mov eax, edx
shr eax, 0x10
and cl, 0xf
xor cl, al
mov eax, edx
shr eax, 0x1c
xor al, dl
mov byte [esi - 2], cl
and al, 0xf
xor al, dl
mov byte [esi - 1], al
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, ebx
jb 0x4fc4f0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40915e
Capabilities:
Encode data using xor

Disassembly:
out 0x30, eax
mov dword [ecx - 0x1f], eax
rcl ch, 1
cmp ebx, dword [ebp - 0x3e207a57]
mov edi, 0xf9098529
lock and dword [ecx - 0x28], ebp
add eax, 0xc9735a90
insb byte es:[edi], dx
mov bl, 0x93
and al, 0xb4
adc byte [ecx + edx*8], ch
mov ch, byte [edi + 0x2d97c017]
ficom word [ecx]
push es
mov ebx, 0x39486988
js 0x409114
imul ecx, dword [ecx + 0x330d22ac], 0x796e8a91
and cl, byte [0x6e8a9133]
jns 0x4090e2
mov ch, byte [esi + 0x79]
sal dword [eax + 0x6d], 0x5f
jo 0x409190
pop edi
cmpsd dword [esi], dword es:[edi]
or ecx, ebp
rcr ecx, 7
imul esi, dword [0x59ac03a9], 0x11b4a65c
test al, 0xe
fstpnce st(1), st(0)
wait
and cl, byte [eax]
in eax, dx
aam 0xf0
ret 0xade4
xor byte [ecx + 0x2147800f], 0x9e
inc ebx
sbb al, 0x31
sbb bh, byte [ecx - 0x764edbf9]
or dword [esi], ebx
out 0x7d, al
mov esi, 0xc5a95865
push ebx
sbb byte [ecx], bl
mov word [edi - 0x7a], ss
ja 0x4091e2
sbb byte [0x87efb379], 0x3e
jb 0x409119
xchg esp, eax
nop
mov dh, 0xca
movsd dword es:[edi], dword [esi]
test byte ss:[ecx], bl
test byte [ecx], bl
xchg ebp, eax
in eax, dx
mov edx, ecx
mov ebp, 0xe16bc95f
loopne 0x40911d
stosb byte es:[edi], al
cwde
fdiv dword [edi + 8]
xor ecx, esi
ret
dec esi
ja 0x40922e
shl dword [edx], 0x77
push cs
sbb dword [ebp + 0x53], ebx
insb byte es:[edi], dx
or dword [eax - 0x67], ebp
pop ebp
jecxz 0x4091a3
jl 0x40925b
jg 0x40925f
sbb edi, dword [0x1a6b2d68]
test dword [ebp - 0x106c8227], ebx
sub eax, edx
int1
cmp dword [ecx + 0x13], ebx
test esp, eax
sub al, byte [esi + ecx + 0x2bd964b1]
mov edx, eax
dec eax
stc
js 0x409211
sub ecx, dword [ecx + 0x78f948c2]
stc
dec ebx
sub dword [ebp + 0x69], 0xb12b8119
rol dword [ebp + 0x78], 1
outsb dx, byte [esi]
cdq
or ecx, ebx
mov dl, cl
stosb byte es:[edi], al
frndint
mov eax, dword [0x4a1b3841]
cmp byte [ebx], bl
dec edx
int 0x49
jb 0x4092a6
sub al, 0x6d
and eax, 0xab63ad46
mov dword [esi + 0x6bdfb961], edx
or dword [edi], edi
cmp byte [eax + 0xa], cl
mov dl, 0x9b
imul esi, dword [ebp - 0x22f04ea8], 0x6c27d737
adc dword [ecx + 0x4c], edi
sub al, 0x63
cdq
cmpsd dword [esi], dword es:[edi]
or al, byte [esi + 0x60]
inc esi
pushal
imul edi, dword [edx], 0xde267712
xor dword [ebp + 0x7d6a8ab7], edi
adc dh, byte [edi + 0x26]
fidiv word [ecx]
mov ebp, 0x7d6a8ab7
scasd eax, dword es:[edi]
imul ecx, dword [edx], 0x3ccbb83f
rcl cl, 1
or esi, esp
popal
mov dword [ecx], eax
imul ebx, dword [ecx], 0xffffffea
push es
mov esp, 0xf15c0939
pop ecx
jecxz 0x40925c
mov bh, 0xea
cmp al, 0xf8
push 0x19
imul edi, dword [eax - 0x79c6adca], 0x184efe00
or bh, byte [eax + 0x3d]
sbb eax, 0xd2ab0ccf
mov cl, byte [ebp + 0x7b]
adc ch, byte [edi + 0x77ad64c1]
add dl, cl
in al, dx
int3
Function at 0x4208f6
Capabilities:
Encode data using xor

Disassembly:
inc ebp
salc
and al, 6
mov eax, dword [0x6891c463]
sub ebp, 0x945aa4d3
pop ss
mov edi, 0xd115ed23
fadd dword [0x6a04c523]
add eax, 0x6a04c523
add eax, 0x6a04c523
and al, 0x47
pop edx
or dword [esp - 0x35], esi
xor cl, bl
scasd eax, dword es:[edi]
cmp eax, 0x5e9142bf
jnp 0x4208de
int1
mov dword [edi - 0x14f30a9e], edi
inc eax
add eax, 0x9a486111
in al, 0x5c
xchg esp, eax
push 0x2ce3a5a9
scasb al, byte es:[edi]
sub byte [esi + 6], dh
inc edi
inc ecx
sal al, cl
shr byte [esi - 0x57ca50c8], cl
jle 0x420993
insb byte es:[edi], dx
insd dword es:[edi], dx
pmuludq mm6, qword [ebx - 0x31986eb0]
ja 0x4209ad
add ah, byte [ebx + 0x343080d5]
dec esi
xchg ebp, eax
invalid
ret 0x45b3
movsd dword es:[edi], dword [esi]
adc ebp, dword [ebx]
loop 0x420962
dec ebx
in eax, 0x10
inc ebx
adc al, 0x5c
xchg ebp, eax
mov dword [0xc793ecc2], eax
sub al, 0x1b
fiadd dword [ecx + 0x7b5122c4]
in eax, 0x7b
adc ch, ah
jnp 0x42097a
jnp 0x4209a9
in al, dx
shl byte [ebx + 0x78], 0xa8
jnp 0x4209ff
dec ebx
jmp 0x4209b7
mov ch, byte [0xf5e06a98]
cmc
in eax, dx
fidivr dword [ebp - 0x1d]
invalid
jecxz 0x4209ad
fisttp qword [edx]
sar dword [edi], 1
sar byte [edi + 0xb16373f], 0x18
push ss
or ebx, dword [eax]
xlatb
mov al, byte [0x41f79ac0]
or ecx, ebx
mov ah, 3
sahf
inc edx
loopne 0x4209eb
add ebx, dword [esi - 0x22dc1fbe]
add al, 0xf5
lcall 6, 0xeffe3ff1
cmp eax, 0x89d3be94
fld qword [esi*8 - 0x1c00e66]
out dx, eax
push es
add byte [0x89d3be94], bh
inc edi
or byte [edx], dl
and dword [ecx - 0x33], ebx
bound ebx, qword [esi]
jae 0x4209a4
mov ch, 0x4d
fcompi st(1)
loopne 0x420a3d
mov al, byte [0xe1b5eed2]
mov ch, 0xe1
sub dword [edx], 0xffffffaa
movsd dword es:[edi], dword [esi]
fnstcw word [ecx]
xchg edi, eax
mov esi, 0x55f3d5e2
xchg ecx, eax
jge 0x420a10
sub dh, byte [0xc72e65f2]
andps xmm0, xmmword [ebp - 0x164c665d]
ret
invalid
sub dword [edi], ecx
xor eax, 0x15a3c555
aas
scasd eax, dword es:[edi]
dec edi
mov ch, 0x76
push edi
add edx, dword [ebx]
int1
mov dword [0xe00284b3], eax
mov edi, 0x9225a3b1
bnd ret
sub byte [0x20406150], al
imul edi, dword [edx + 0x47], 0x751636b0
xor byte [ecx - 0x10], 0xe7
int3
push ss
jne 0x4209c3
jno 0x420a33
out 0xcc, eax
and byte [ebx + 0x75d523b5], al
mov ah, 0xa0
xchg esp, eax
xor esi, dword [edx + esi*4 + 0x5ac30354]
or al, 0x3d
xor eax, 0x16222092
adc esi, dword [ebx + edx*4]
jl 0x420a2c
ror byte [eax], cl
nop
jge 0x420a75
invalid
or eax, 0x15c5d546
inc esp
mov bl, 0x14
push ebp
inc esi
aad 0xc5
adc eax, 0x5514b344
mov dword [0x27b97355], eax
mov ch, 0x93
add eax, 0x4cb395f4
xor eax, 0xc41d4733
inc ecx
movsd dword es:[edi], dword [esi]
jb 0x420a4b
inc esi
sbb byte [ebp + 3], al
ja 0x420acb
push ebx
test byte [edi + 0x53], dl
and eax, 0xd143e563
out 0xe5, al
xor al, 0x7b
cmpsd dword [esi], dword es:[edi]
inc edx
sal edi, 0xe0
add byte [edi + 0x2fd38aa9], 0x2b
hlt
mov ch, al
sti
sbb dword [edi], edx
sub cl, dl
push es
push 0x23
jb 0x420b53
pop eax
out 0x25, al
xlatb
and al, 0x31
push ebx
jbe 0x420a74
out 0xb5, eax
adc eax, 0xb1d4909e
hlt
invalid
Function at 0x45c4ee
Capabilities:
Encode data using xor

Disassembly:
and dword [ecx], eax
inc edi
add dword [edi + 0x69], eax
cld
jns 0x45c4ed
imul edi, esp, 0x6bf6f979
maxps xmm3, xmm4
invalid
stc
imul byte [ebx + 0xf]
pop edi
fmul qword [edi + 0x20a219a4]
nop
push ds
sahf
jge 0x7d698711
pop es
xor edi, eax
jbe 0x45c4f3
inc ecx
push ds
xchg ebx, eax
iretd

Function at 0x47d1ca
Capabilities:
Check for software breakpoints

Disassembly:
jnp 0x47d226
fbld tbyte [ebp + 0x2c6adcd0]
js 0x47d20b
push esp
mov ebp, 0x7387ceb8
dec esi
lds ebx, [edi*2 + 0x171b62e1]
cli
stosd dword es:[edi], eax
jnp 0x47d263
invalid
sahf
jmp edi
fcomp st(7)
pop ebp
call 0x4f541127
xchg ecx, eax
or dl, byte [ebp - 0xb630205]
mov cl, 0x90
fbld tbyte [edx + esi*8]
scasd eax, dword es:[edi]
adc byte [ecx - 0x58], bl
in al, 0x96
add byte [esp + ebx*8 + 0x122332df], ch
and al, ah
add dh, 0xa6
lodsb al, byte [esi]
sub al, 0x49
int1
inc ebx
fstp qword [esi - 0x3f44f21e]
ja 0x47d21a
lodsb al, byte [esi]
invalid
push eax
jne 0x47d298
jbe 0x47d280
sbb byte [edx], dl
xor eax, 0x43b49605
dec edi
stosb byte es:[edi], al
pop ebx
rol byte [ecx + ebp + 0x3e], cl
push esp
aad 5
mov bh, 0xf6
loopne 0x47d1f4
wait
push esi
test byte [esi], 0xcc
sbb eax, 0xe4cc8aea
iretd
test al, 0xec
sahf
cdq
pop ebp
into
push ds
invalid
adc edx, dword [edi]
jle 0x47d2e7
push esp
fld dword [0xc83f147a]
add dl, al
pushfd
invalid
cdq
adc dword ss:[edx + 0x5b], esi
add eax, 0x3541e3df
invalid
sti
push ds
iretd
aaa
pop edi
lodsd eax, dword [esi]
mov bl, 0xf6
fcomp dword [edi]
aas
stosd dword es:[edi], eax
das
lodsd eax, dword [esi]
in al, dx
sbb eax, 0xc2d2f1db
loope 0x47d30f
push ecx
xor bl, al
or eax, 0xd81427fd
add dword [eax - 0x35], esp
sbb dword [edi + 0x3d], ebp
das
sbb eax, 0xcd1d4f17
out 0x53, eax
push ebx
loop 0x47d2ba
fbld tbyte [0xd9f59382]
sbb al, 0x33
inc ecx
push ebp
push 0x1b1435df
and dword [edx], eax
jecxz 0x47d34e
mov eax, dword [0x17d4c712]
je 0x47d2bf
sub al, byte [esi - 0x566e2742]
and cl, byte [esi + 0x3e82c81b]
int3
cmp byte [esi], 0xcc
sbb byte [ebx - 0x5f], al
mov ch, 0x27
add edx, 0x4d
stc
mov ebx, 0x70eb512a
lea esi, [ebx + 0x5103e38e]
mov dword [ecx - 0x6c359a12], ebx
add dword [ebx], esi
out dx, eax
adc ch, bh
cli
cmp bl, byte [ebx]
mov eax, dword [0x784c4a9c]
adc dword [ecx + 0x38887936], edi
xchg ebp, eax
insb byte es:[edi], dx
adc ah, byte [0x9b571a81]
movsd dword es:[edi], dword fs:[esi]
inc eax
sbb edx, edx
mov edi, esi
stosb byte es:[edi], al
sbb ebp, ebp
lodsb al, byte [esi]
test al, 0x68
das
invalid
Function at 0x4072ad
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x46bc7c], 0
jne 0x4072eb
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4072c1
mov dword [ecx*4 + 0x46bc78], eax
inc ecx
cmp ecx, 0x100
jl 0x4072bc
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x407318
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x46bc78]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072f9
not eax
pop ebp
ret 0xc

Function at 0x50201963
Capabilities:
Create thread
Get common file path

Disassembly:
push ebx
add esp, 0xfffffd90
push 0x104
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 0x50201aab
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
jne 0x502019d4
push 0x104
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 0x50201abb
lea eax, [esp + 0x108]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x104]
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x50201aa3
mov byte [esp + 0x208], 0
push 0x50201acf
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
mov byte [esp + 0x23b], 0
push 0x50201adb
lea eax, [esp + 0x23f]
push eax
call sub.kernel32.dll_lstrcatA
push 0x50201ae3
lea eax, [esp + 0x20c]
push eax
call sub.kernel32.dll_lstrcatA
push 0x50201aeb
lea eax, [esp + 0x23f]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [esp + 0x208]
push eax
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x50201b54], eax
lea eax, [esp + 0x23b]
push eax
push ebx
call sub.kernel32.dll_GetProcAddress
mov dword [0x50201b58], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
push 0x5c
lea eax, [esp + 4]
push eax
call sub.msvcrt.dll_strrchr
add esp, 8
mov ebx, eax
mov eax, dword [0x502018d6]
push eax
push ebx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x50201aa3
push 0x50201b50
push 0
push 0
push 0x502018ea
push 0
push 0
call sub.kernel32.dll_CreateThread
add esp, 0x270
pop ebx
ret
Function at 0x10011023
Capabilities:
Terminate process

Disassembly:
jmp 0x1001cb00
jmp fcn.1001cb30
cmp ecx, dword [0x10021054]
jne 0x1001cb0a
repz ret
jmp 0x100110b9

Function at 0x100184c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x100184cf
pop dword [ebp - 0x40]
mov eax, 0x77fe3149
add eax, 0x98035386
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xfe1dbe9a
sub dword [ebp - 0x50], 0xafcb794f
mov dword [ebp - 0x4c], 0xe388917a
sub dword [ebp - 0x4c], 0xb1554535
mov dword [ebp - 0x48], 0x5f6a73a
add dword [ebp - 0x48], 0x46559cf4
mov dword [ebp - 0x44], 0x2d7848d3
sub dword [ebp - 0x44], 0x2d7848d3
lea eax, [ebp - 0x50]
push eax
mov eax, 0x3522a892
sub eax, 0x252086a6
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x4985020c
sub dword [ebp - 0x50], 0xd51298b6
mov dword [ebp - 0x4c], 0xd8d4566f
add dword [ebp - 0x4c], 0x68980b06
mov dword [ebp - 0x48], 0x79275e4e
add dword [ebp - 0x48], 0xea480e1e
mov dword [ebp - 0x44], 0xf2a6b9ea
add dword [ebp - 0x44], 0xd594616
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x37670336
sub eax, 0x2764e146
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3773c
push 0
call eax
mov ecx, 0x329e3e29
sub ecx, 0x329df50c
mov edi, eax
mov ebx, 0x10024a00
add ebx, dword [ebp - 0x40]
mov esi, 0xb6e2c8e4
sub esi, 0x79c3fb5f
mov edx, dword [ebx]
add dword [ebp - 0x30], 0x2533ef2f
xor edx, esi
add dword [ebp - 0x28], ebx
mov dword [edi], edx
mov dword [ebp - 0x24], 0x44c77d6
add edi, 0xf946a639
add edi, 0x6b959cb
add ebx, 0xe1b32ecf
sub ebx, 0xe1b32ecb
loop 0x100185eb
add eax, 0xa8e4ff31
add eax, 0x571c1816
xor ebx, ebx
add ebx, eax
add eax, 0xb6298c3b
add eax, 0x49d673ca
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x43721a
Capabilities:
Encode data using xor

Disassembly:
pop es
mov eax, dword [0x5c602cef]
aad 0x51
wait
push edx
salc
insb byte es:[edi], dx
enter 0xffffffffffff9f6c, 0xffffffffffffffd0
jne 0x43729a
lodsb al, byte cs:[esi]
adc esp, dword [ebx - 0x15b9bd85]
inc esi
ljmp 0x8d5a
adc edi, esp
and al, 0x3f
into
inc ebp
imul ecx
inc edi
leave
ret
inc edi
xchg edi, eax
xor dword [esi], edx
call 0xc6604990
push eax
sub dh, byte [eax - 0x4b]
dec edi
sub dword [edi - 0x12276340], edx
sub al, 0xa6
mov esi, 0x2ecfb7cc
out dx, al
sti
push 0x86f87338
das
enter 0xffffffffffffb427, 0xb
lcall 0xa4ef, 0x3cf6cdd2
mov ebp, 0x5ce16a1d
mov dh, 0x6d
adc bl, cl
sal dword [eax + 0x58], cl
fadd qword [edi + ebp]
call dword [eax - 0x57d072fe]
pop ss
sub bh, byte [ebp + 0x1b6c8544]
and al, 0x8a
add dl, byte [edx]
jl 0x43729a
mov edx, 0x92ea72b9
jo 0x437300
xchg ecx, eax
rcr dword [esp + edi - 0x6ae41744], 1
invalid
cmp al, 0xbc
call 0xdb080817
daa
mov eax, 0x36923cd6
shr byte [ebx - 0x2e], 1
xchg edx, eax
shr byte ss:[ebx - 0x2e], 1
mov ebp, 0x6bc782da
lds ebx, [ebp + esi*4 + 0x3e]
pop ss
les ebx, [edx - 7]
inc esi
or eax, 0xfe3c9dd5
lcall 0x4ebc, 0xaa011743
neg ebp
sub dword [edi], esi
dec esp
mov al, byte [0x992bf7c4]
mov byte [0x1d7d8f86], al
mov eax, dword [0x8eda511f]
xchg esp, eax
jnp 0x43739e
rcr byte [eax - 0x63f95ba9], 0xeb
rol byte [0x4e1ecd8d], cl
cmp ch, byte [edi]
pop ebx
jbe 0x4372f5
pushfd
inc edx
xchg dword [eax], ebp
inc edi
cmp al, 0x67
pop ds
pop ss
fdiv qword [esi - 0x74]
in al, 0xec
jbe 0x437371
push ss
pop dword [edx]
getsec
aaa
jg 0x43739c
iretd
mov ah, 0x37
das
int3
sub esp, dword cs:[ebx + ebp*8]
sub esp, dword [ebx + ebp*8]
jl 0x4373ed
or eax, 0x75686dc2
invalid
ljmp 0xae04:0x5cd36e9d
mov dl, 0xb8
bound eax, qword [esi + eax - 0x3a0bcd23]
sub byte [esp + esi*2 - 0x36789679], 0xe7
lodsb al, byte [esi]
push cs
salc
mov bl, 0xc1
sbb esp, 0xffffffc5
xlatb
xchg esi, eax
add al, 0x12
mov bh, 0xb8
mov cl, 0x2f
jbe 0x4373d7
pop edx
nop
not dword [edi]
insb byte es:[edi], dx
add bh, byte [esi + edi - 0x7783e127]
sub ecx, dword [esi + 0x72]
invalid

Function at 0x49370a
Capabilities:
Encode data using xor

Disassembly:
lahf
mov al, 0xa4
popal
dec esp
shr bh, cl
invalid
mov edi, 0x776d4b7e
or dword [0x9f13d388], ecx
jb 0x493687
dec esp
mov edi, 0xb6929a9a
ret 0x283
mov dl, byte [esi - 0x6ef5ed52]
fcmovu st(0), st(3)
sub byte [ecx + ebp*2], 0x19
mov byte [0xc19b9abf], al
fild dword [eax - 0x5de696d4]
mov edi, 0xe8c19b9a
les ebp, [esi]
dec edi
dec esi
call 0x4e9865bc
jnp 0x493760
test byte [edx + eax], 0x3b
jg 0x4936f3
xor dl, byte [ecx - 0x76a49c80]
wait
imul ebx, dword [esi + ebx*8], 0xfffffff7
mul ebx
invalid
dec ebx
and byte [esi - 0x50dc2fee], ah
xor byte [ebx - 0x14e861d2], dl
aas
push 0x645923bf
test eax, 0xb4a9c053
lahf
and dword [ecx - 0x46bdba03], ecx
popal
leave
inc edx
jnp 0x4936b5
or byte [edi], al
push ebp
mov cl, 0xbb
jmp 0x49371b
push ecx
jle 0x4936e9
pop esi
invalid