joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fb10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x46fb43
push esi
call fcn.0047deb0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x46fb3c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x46fbc9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x46fbb2
mov eax, dword [esi + 8]
test eax, eax
je 0x46fb67
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x46fbae
cmp eax, 2
je 0x46fbb2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x46fb5a
cmp eax, 3
je 0x46fb8d
cmp eax, 1
jne 0x46fb5a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x46fb5a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x46fb5a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0046fbf0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x46fbd8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0046fbf0
add esp, 4
pop esi
ret

Function at 0x470460
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x470481
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x470481
mov eax, dword [eax + 0x44]
test eax, eax
je 0x470481
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4915a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4915ec
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4915ec
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4915d6
push eax
call ebp
test ax, ax
jl 0x4915e4
inc esi
add edi, 4
cmp esi, 6
jb 0x4915c8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004912a0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4953a0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x495400
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x495400
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x495400
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x495400
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x495410
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4961c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x496226
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x496226
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x496207
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4965b0
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4965e8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x4972b0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4972f9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x497770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d17c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00497320
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004973a0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004973a0
lea ecx, [esi + 0xc]
call fcn.004c1a0b
lea ecx, [esi + 0x10]
call fcn.004c1a0b
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00498930
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00498930
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00498930
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004c1a80
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004c1a80
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x49b980
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x544360]
xor edx, edx
cmp eax, edx
jne 0x49b9a6
xor eax, eax
mov byte [eax + 0x544260], al
inc eax
cmp eax, 0x100
jl 0x49b98e
mov dword [0x544360], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x544260
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x49ba37
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x49ba0a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x49b9d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x49bab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x49bb03
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x49baea
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a2490
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4d1bbe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.004a2db0
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x4e4034
call fcn.004c17c1
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x4a2523
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004c17c1
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x4a251c
push 0
mov ecx, eax
call fcn.004995b0
mov dword [esi + 0xc], eax
jmp 0x4a2525
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x4a2525
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x4c3e4e
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4c3e86
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004c1edb
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004c1eb3
jmp 0x4c3e92
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4c5545
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4c5587
call fcn.004cb587
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4c5587
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4c557e
xor eax, eax
jmp 0x4c558f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004c5595
pop edi
pop esi
pop ebx
ret 4

Function at 0x4cbab7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4cbae5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4cbb03
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004cba1d
jmp 0x4cbb03
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4cbb03
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004cba1d
test edi, edi
mov eax, edi
jne 0x4cbaed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
mov ecx, 0x41761893
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x72825418
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x4153e0
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
mov ebp, 0x452c25b9
int 0x10
in eax, dx
and al, 0x63
invalid
inc edx
dec ecx
mov byte [0x7624b8db], al
clc
inc edx
xor ebp, dword [ebx + 0x37ccb16d]
aaa
aaa
pop eax
or ah, byte [edi + 0x4f]
fmul qword [ebp + 0x1cd5ae62]
loopne 0x4153d2
mov ebp, 0xe74794a6
jo 0x415391
push eax
in eax, dx
and al, 0xe6
adc al, byte [ebx + 0x33]
fld xword [edi + 0x1562871d]
mov ecx, 0x5af296c
mov word [edx], ss
out dx, al
mov ebp, 0x42503224
xor ecx, dword [edx - 0x62ccbd0c]
pop ss
popfd
mov esp, 0x3d55af23
pop ds
push eax
inc edx
add eax, 0xccbdafa1
bound ebp, qword [edi - 0x509d3343]
mov ebp, 0xbdaf62cc
int3
Function at 0x419a52
Capabilities:
Encode data using xor

Disassembly:
ret
add dword [esi - 0x5184ef5e], 0xe654d921
std
fst dword [esi - 3]
clc
and edx, esi
cli
xor al, 0x14
push es
cmp edi, edi
loope 0x419a59
xchg edx, eax
out 0x44, eax
pop ecx
adc al, 0x66
movsb byte es:[edi], byte [esi]
pop edi
mov esp, 0x8a9ac52a
jne 0x419a0b
add dword [ecx], 0xeae7bbb3
sub dh, byte [edx + 1]
sbb al, 0x31
pop ds
loopne 0x419ab7
sub byte [eax], dh
and dl, byte [ecx - 0x36743ad3]
or byte [edi + 0x10], bl
or esi, dword [esp + edx*2]
stosd dword es:[edi], eax
mov byte [0x354ba135], al
dec esi
insb byte es:[edi], dx
arpl word [edx - 0x540e751e], bx
jb 0x419a5d
loope 0x419a6d
jo 0x419a6c
ljmp 0xbe82:0x8a9805d1
test al, 0xf2
sub bl, byte [edi + 0x730a374c]
mov eax, 0x84d919fa
mov esp, ebx
pop ds
and dword [ecx + 0x52], esi
test dword [edi - 0x45], eax
std
aad 0x78
or byte [eax + 0x2ba67f4f], bl
xor esp, dword es:[ecx + 0x4cad2ca]
retf 0x9175

Function at 0x44b610
Capabilities:
Accept command line arguments

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
push 0
call esi
cmp eax, 7
jne 0x44b624
push 1
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_RaiseException]
mov al, 2
mov byte [0x661210], al
mov byte [0xa636f4], al
mov eax, 0xd7b0
mov dword [0x661228], ecx
mov word [0xa6374c], ax
mov word [0xa6374e], ax
mov word [0x661624], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x661258], eax
call esi
and eax, 0x80000000
cmp eax, 0x80000000
je 0x44b678
call esi
cmp al, 4
ja 0x44b67e
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x661254], eax
pop esi
ret
Function at 0x461f92
Capabilities:
Encode data using xor

Disassembly:
aam 0xaa
mov byte [0xcc389cc1], al
stc
add dword [ecx], edi
cdq
mov eax, 0x5492a999
push edi
loop 0x461f9b
lodsd eax, dword [esi]
mov al, byte [0x99535fb9]
push ebx
cdq
cmp dh, byte [eax + 0x32f85227]
dec esi
and ebp, dword [ecx]
mov cl, 0xe4
cli
fcom st(4)
fdecstp
cmpsb byte [esi], byte es:[edi]
push ss
sub ecx, dword [edi]
pop eax
inc ecx
lcall 0x7c91, 0xb266847f
dec esi
mov dl, 0x91
jl 0x461f94
jns 0x461f41
pop esi
test dword [eax], edi
aam 0x1e
push ss
pop esp
rol dword [edi - 0x5b09d68f], cl
or dl, bl
salc
jle 0x461f0f
pop ebp
add al, 0x80
xchg edi, eax
xor al, 0x43
cmp esi, esi
jnp 0x461f1a
jl 0x461f4e
mov byte [edx - 0x71d2cc48], bh
or byte [ebp + esi*8 + 0x736e38d4], ch
outsd dx, dword [esi]
enter 0xffffffffffffa6ce, 2
pause
or esp, esi
inc edx
push eax
insb byte es:[edi], dx
or esi, dword [ebp + 0x4d3a2c73]
call 0x827d1e6d
retf
jg 0x462000
inc ecx
fst dword [eax]
push esi
or al, 0xa0
jb 0x461f26
mov eax, 0x3d99199c
jge 0x461fd9
dec edi
push esi
inc ebx
sbb dword [0x60b06bc6], ebp
std
xor edi, esi
adc eax, 0x3323ef25
inc esi
lds ebx, [edx + 0x1051743a]
dec esp
cld
xor eax, dword [esi - 0x3b]
lcall 0xfc4c, 0x1051743a
lodsd eax, dword [esi]
push es
in eax, 0x4e
cwde
mov ecx, 0xa50cbc3
ror byte [eax + 0x62563598], 0xbc
xchg edx, eax
sbb al, 0xb1
cmp dh, byte [edi - 0x75]
pop edi
mov byte [ebx*8 + 0x32ff634d], cl
sar ecx, cl
dec ebp
arpl di, di
xor dl, bl
stc
pop edx
inc esi
movsb byte es:[edi], byte [esi]
pop ebx
sbb al, 0x31
out 0x48, eax
xchg esp, eax
jl 0x461fad
pop ecx
salc
dec esi
xchg byte [esi + esi*8 - 0x78], dl
in al, dx
mov dword [0xf6f818e9], esi
stc
xchg esp, eax
int 0x11
dec esp
add al, dl
inc esi
or ah, byte [esi - 0x74da9063]
aaa
sbb dword [ecx], 0x4e
insb byte es:[edi], dx
mov cl, 0x8b
mov esp, 0x639696f4
cmpsb byte [esi], byte es:[edi]
loopne 0x461fb4
les edx, [esi]
mov bh, 0xd1
or ch, cl
sbb dword [eax + ecx*2 + 0x36], edi
imul edi, dword [ebx + 0x6e], 0xfffffff6
fisub dword [esi + eax*8 + 0x451f2abe]
js 0x46205b
jmp 0xb9a87638
adc ah, byte [ebp - 0xc0626f8]
inc edi
cmpsb byte [esi], byte es:[edi]
mov dword [eax - 0x7e875564], ebp
pop es
sbb dword [edx - 0x65e7a1ec], esi
into
mov ebx, 0xd8ccebda
jecxz 0x4620be
sbb eax, 0x6e4ea127
neg dword [edx + 0xf5b6b01]
movsd dword es:[edi], dword [esi]
pop edi
xor dword [edi], 0x8fe9f272
ret 0xae63
Function at 0x4a3382
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xe1
adc edi, dword [esi]
cld
xchg byte [edi], al
adc dword [ebx - 0x3dc7a6f7], eax
popfd
sar byte es:[ebp + 0x6e], cl
adc al, 0x71
cmp eax, 0xd0bd338e
invalid
jecxz 0x4a3397
rcl byte [edi], 0x7d
std
retf 0x28a6
adc dword [ebx], esi
cli
and byte [edi + 0x23], al
mov dl, 0x90
and eax, 0xf37dff89
jge 0x4a338c
mov byte [edi - 0x1fc70556], cl
movsb byte es:[edi], byte es:[esi]
lds esi, [edx - 0x24]
and ch, bh
jecxz 0x4a3353
sub ebp, dword [edi - 0x626d7d32]
jb 0x4a3384
loopne 0x4a33ff
iretd
mov cl, 0xe2
mov dl, 0x44
imul byte [esi - 0x48]
push edi
push ecx
call 0xb854adc1
adc dword [eax - 0x3aa2fff], ecx
mov byte [ecx], al
rcl byte [ebp - 4]
in al, 0x91
das
xor dh, byte [eax + 0x42]
test al, 0
insb byte es:[edi], dx
ja 0x4a33cf
mov ebp, 0xa819a4bd
or al, 0x72
or dword [esi], 0xf2441938
mov al, 0xf2
das
mov dl, 0x5d
pop ebp
salc
add edx, dword [edx - 0x17]
jmp 0x4a33de
Function at 0x4fb282
Capabilities:
Encode data using xor

Disassembly:
add byte [esi + 0x7840029e], al
mov eax, 0x954ecaf8
les edx, [ebp + 9]
xor ch, byte es:[esi + 0x3e]
lodsb al, byte [esi]
sbb al, 0xd1
out dx, al
mov eax, 0x6c18775b
push ss
invalid
add edx, ecx
rol byte cs:[eax + eax*2 - 0x40cc220f], 0xd6
dec edx
jno 0x4fb226
js 0x4fb2e6
pop ds
mov al, byte [0x7e8dab0f]
xchg ebp, eax
push 0xffffffffffffff8e
dec esp
dec ecx
dec edi
adc byte [esi + 0x18fc478e], 0x2e
in eax, dx
add esp, dword [ecx]
invalid
mov al, 0x96
invalid

Function at 0x501d62
Capabilities:
Encode data using xor

Disassembly:
sub cl, al
fistp word [ecx - 0xfc45255]
inc edi
xor al, bl
sub al, 0xf6
or byte [ecx + 0x20ba9630], 0x6e
and eax, 0x99e1a492
jge 0x501d09
inc ebp
push 0x3c
inc esp
arpl word [esi + 0x38d955ce], cx
or eax, 0x5e613c8a
pop esi
cmp al, 0x61
push 0x7a0827e7
clc
jp 0x501d84
call 0x7e110bdc
ret
insd dword es:[edi], dx
out dx, al
sar byte [ebp - 0x3d], 0xe9
sub al, 6
lodsd eax, dword [esi]
dec ecx
fdiv qword ds:[ecx]
popfd
dec eax
sub byte [ebp + 0x6a], dl
jle 0x501d0b
cmp dword [edx + 0x268ddef9], ebx
fisttp qword [edx]
mov dl, 0x1f
fimul word [ebp - 0x4df522da]
pop ds
push 0xf0a9988a
sbb eax, 0xb704afd0
dec esi
sbb cl, byte [eax - 0x21]
in al, 0x41
cwde
dec edi
jg 0x501d30
scasb al, byte es:[edi]
loopne 0x501d6b
jns 0x501dfa
pop esi
aam 0xc0
out dx, al
int3
Function at 0x5d7342
Capabilities:
Encode data using xor

Disassembly:
ret 0xbcf0
mov dword [0x42d80495], eax
aaa
mov byte [0x1969df9], al
loopne 0x5d73b0
push esi
mov bl, 0x46
jmp 0xa27ec735
lodsd eax, dword [esi]
cmp al, 0x82
bound eax, qword [edx + 0x41]
dec ebp
adc dword [edi], esp
daa
pushfd
mov sp, 0x7a68
and dword [esi - 0x38], esp
stosb byte es:[edi], al
mov al, byte [0xb42692b6]
js 0x5d732c
xor eax, 0x346219e4
jge 0x5d73e5
xor al, 0x46
inc edx
or esp, dword [edx]
les ebx, [eax]
mov ecx, 0x572cb562
inc edx
mov dl, 0x5b
mov dl, 0x52
sbb byte [ebx - 0x7b], cl
xchg ebp, eax
or ah, byte [edx + 0x210ae241]
and ch, byte [edi + edi*2 - 0x73fb28c2]
inc edx
xchg edi, eax
add al, byte [ebx - 0x7662ec9d]
sahf
jae 0x5d740c
pop esp
aam 2
rcl byte [edx + 0x384123a], cl
imul edi, esi, 0xb25e29f7
imul edi, esi, 0xb25e29f7
cmp al, 0x36
mov cl, 0x26
mov al, byte [ebp + ecx*8 - 0x5f]
adc ch, byte [esi - 0x27]
das
mov word [esi], fs
arpl word [edx], sp
and dword [eax], ebx
mov byte [0xed14e572], al
add eax, edx
xchg esi, eax
push es
loop 0x5d7357
ret
push es
iretd
bound esp, qword [ecx - 0x1dc7c97]
outsb dx, byte [esi]
adc byte [edi - 0x26], ah
xor eax, 0x6c66669d
insb byte es:[edi], dx
or bl, cl
and al, dh
and eax, 0xf202ccc2
pop ss
and byte [edi], cl
inc esi
jecxz 0x5d73fe
jno 0x5d7482
mov ah, 0xbb
imul esi, dword [ebx], 0xffffffd3
mov al, 0xe5
sub dh, 0xe2
fisub word [edx]
lds esi, [ecx + 5]
stc
hlt
Function at 0x402fec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
clc
call fcn.00402dc1
inc edi
xchg ebx, eax
xor ah, byte [esi]
mov ax, word [edi + 6]
cmp ax, bx
jbe 0x40301b
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x403015
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x403006
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3

Function at 0x403650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x3a]
test dword [esi + 0x25fffffc], edi
lea eax, [ebp - 0x354]
push eax
call fcn.00402dd1
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00402d86
add esp, 0xc
invalid
invalid
invalid

Function at 0x403d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
push dword [eax]
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
daa
Function at 0x1000fc18
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ecx
push esi
push edi
push dword [0x1009a7b4]
xor edi, edi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x1000fc5e
mov eax, dword [section..data]
cmp eax, section..data
je 0x1000fcb8
test byte [eax + 0x1c], 4
je 0x1000fcb8
cmp byte [eax + 0x19], 2
jb 0x1000fcb8
push dword [eax + 0x14]
mov edx, 0x1000563c
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.10012303
jmp 0x1000fcb8
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
test eax, eax
jne 0x1000fca7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57c
je 0x1000fca7
mov eax, dword [section..data]
cmp eax, section..data
je 0x1000fca3
test byte [eax + 0x1c], 4
je 0x1000fca3
cmp byte [eax + 0x19], 2
jb 0x1000fca3
push dword [eax + 0x14]
mov edx, 0x1000563c
push dword [eax + 0x10]
push 0x11
pop ecx
call fcn.10012303
xor eax, eax
jmp 0x1000fcba
push ecx
mov ecx, esi
call fcn.1000fcbe
push edi
call fcn.1002a776
xor edi, edi
inc edi
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x1002cae7
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 4
mov eax, 0x1009224a
call fcn.100907b8
push dword [0x1009a7b4]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x1002cb1d
cmp dword [esi + 8], 0
je 0x1002cb19
and dword [esi + 8], 0
push ecx
mov ecx, esi
call fcn.1000fcbe
xor esi, esi
test esi, esi
jne 0x1002cb81
push 0x10004e5c
push 0x38
call fcn.10090560
pop ecx
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x1002cb41
mov ecx, eax
call fcn.1001ced6
mov esi, eax
jmp 0x1002cb43
xor esi, esi
test esi, esi
je 0x1002cb56
push esi
push dword [0x1009a7b4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1002cb81
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002cb81
test byte [eax + 0x1c], 4
je 0x1002cb81
cmp byte [eax + 0x19], 2
jb 0x1002cb81
push dword [eax + 0x14]
mov edx, 0x1000dbd4
push dword [eax + 0x10]
push 0xa
pop ecx
call fcn.10012303
mov eax, esi
call fcn.10090786
ret