joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496b9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x496c04
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x496c21
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x496c8a
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfb6d
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x496c5d
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x496c4d
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x496c84
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496cde
inc edi
cmp edi, ecx
jb 0x496c71
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.004ca50d
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004de3e9
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x496c84
cmp dword [esi + 0x14], 0x10
jb 0x496ced
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x496d07
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004dfb6d
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x496d3d
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x496d2d
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x496d7b
cmp ecx, edx
je 0x496df2
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x496d63
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.004b5add
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004ca63d
mov eax, esi
jmp 0x496cc3
or ecx, 0xffffffff
jmp 0x496d7d
Function at 0x49701d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca50d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x497140
push ecx
lea ecx, [esi + 0x18]
call fcn.004b683d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x497157
push ecx
lea ecx, [esi + 0x24]
call fcn.004b674d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4e047d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0051396d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e05a0
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffc9d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e05b7
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffbad
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4ffb0d
Capabilities:
Encode data using xor

Disassembly:
mov byte [0x2fc90fdd], al
leave
das
lcall 0xc445, 0x2076c88b
sub dh, byte [eax - 0x77]
test byte [ebx + 0x59], 0x67
add dword [eax - 0x13cc74ef], esi
wait
ror dword [esi], 0x99
push ebp
mov al, byte [edx]
mov edi, fs
xor dword [edi + 0x5c7a9463], ecx
jne 0x4ffb10
sbb dword [edi - 7], eax
inc edx
mov edx, 0xbd2e7d90
test cl, ch
dec eax
loope 0x4ffba0
jmp edi
Function at 0x529bad
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d09d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529cd0
push ecx
lea ecx, [esi + 0x18]
call fcn.005493cd
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529ce7
push ecx
lea ecx, [esi + 0x24]
call fcn.005492dd
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x57602d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
push edi
mov edi, ecx
shr edx, 0x10
mov ecx, eax
and ecx, 0xf0
cmp ecx, 0x90
je 0x576068
cmp ecx, 0x80
sal dword gs:[0xc52f5538], 1
or al, 0x48
dec esi
push ecx
pop eax
add eax, 0xa6bd674e
fcompi st(7)
sahf
lds esp, [ecx]
aad 0xee
movsd dword es:[edi], dword [esi]
out dx, al
fiadd word [esi + 0x7c75de77]
je 0x5760f7
add dword [esi], ebx
bound ecx, qword [ebp + ecx*2 + 0x2a0b247f]
scasb al, byte es:[edi]
pop es
jle 0x5760ec
in eax, 0xa4
call esi
sub dword [edx], esi
leave
nop
test esp, esp
movsd dword es:[edi], dword [esi]
into
sub al, 0x67
adc eax, 0xeda66f3f
push ds
jmp 0x296315b7
xor edi, ecx
je 0x57611c
mov eax, dword [0xf86a3c8a]
rcl dl, 0xd5
mov eax, eax
out 0x38, eax
mov cl, 0x81
popfd
pop ebx
xchg ecx, eax
test dh, al
fcmovne st(0), st(0)
jnp 0x57610f
or al, byte [eax]
pop ds
adc ch, byte [edi - 0x49]
sbb ah, byte [edi + ecx*2]
dec edi
dec esp
pop edi
add al, 0xcf
scasd eax, dword es:[edi]
das
xchg esp, eax
into
loopne 0x5760c9
xchg edi, eax
xor esi, esi
and esp, ebp
push cs
push ebp
jo 0x576095
push 0x78
aas
invalid
xchg edi, eax
inc ecx
mov ebx, 0xc6ba1671
lcall 0x28b3, 0xe003ac00
invalid
sub dh, al
sbb dword [ecx + 0x3ebd473f], eax
andps xmm5, xmmword [edx]
sub eax, 0x247f206c
sbb edi, dword [eax + 0x28aa148f]
mov edi, 0xc5d1bb03
lds ebp, [eax + edi + 0x39b6a4f2]
push es
aam 0x9d
aas
cmp dh, byte fs:[ebp - 0x1be6efb4]
push dword [ebx + eax*2 + 0x35]
pop edi
pop esp
xlatb
scasd eax, dword es:[edi]
xchg esp, eax
xor dword [edx + 0x504b24cc], eax
cmpsb byte [esi], byte es:[edi]
mov esi, 0xc391fe95
sar esp, 1
adc byte [ecx + 0x1f], 0xa1
js 0x3d02d21e
jnp 0x5761b7
push eax
pop edx
sbb dword [ebp - 0x2301a115], esi
pop es
dec esp
fdivr st(7), st(0)
invalid
test al, 0xbd
cmp cl, ch
out dx, al
adc eax, 0x416081e9
xchg esi, eax
jno 0x576230
loope 0x57614f
invalid
out 0x9d, al
test dword [ebp - 0x62], 0x695dde50
clc
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x5bca4d
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005eff3d
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5bcb70
push ecx
lea ecx, [esi + 0x18]
call fcn.005dc26d
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x5bcb87
push ecx
lea ecx, [esi + 0x24]
call fcn.005dc17d
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x5bf8bd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov edx, eax
push ebx
push esi
push edi
mov edi, ecx
shr edx, 0x10
mov ecx, eax
and ecx, 0xf0
cmp ecx, 0x90
je 0x5bf8f8
cmp ecx, 0x80
jne 0x5bfa20
jmp 0x5bf900
test dl, dl
jne 0x5bf9c8
popfd
sti
shr bl, 0xf7
fistp dword [eax - 0x61]
dec esi
into
sub byte [ebx - 0x60], 0x4f
push eax
jnp 0x5bf8d5
push eax
adc byte [ebx + 0x53], bl
pop ebx
adc al, 0xb9
or ch, byte [ebx]
pop ds
sbb edx, dword [ecx + 0x64]
invalid
mov byte [0xeaa72a29], al
int3
add dl, dl
xor dl, byte [edi + 0x41]
or bh, byte [edi - 0x50]
xchg edx, ecx
aam 0x67
xchg ebp, eax
mov esi, 0xbb4cab34
pop ss
ja 0x5bf983
xor al, 0xab
dec esp
mov ebx, 0x41b47717
inc ecx
sbb ebx, dword [ecx + 0x34]
das
cmp edx, ebx
inc ecx
xchg ecx, eax
les ebp, [edx]
and cl, bl
jns 0x5bf9ba
inc esp
xor al, 0xda
sbb byte [edi - 0x5e74d7b8], bl
dec esp
mov ch, 0x44
pop ds
mov cl, 0xa5
aam 0x8a
sub byte [edi + 0xc], 0x89
rol dword [ebp - 2], 1
inc edi
adc eax, 0x60d720f8
clc
and bh, dl
pushal
pop ecx
loope 0x5bf9f9
mov bh, 0x94
movsd dword es:[edi], dword [esi]
aas
rcl byte [edi - 0x14]
invalid
popal
cmp dh, ah
mov ecx, edx
lea ebp, [edi]
ret
Function at 0x5ef67d
Capabilities:
Encode data using xor

Disassembly:
push 0xcb430ee1
loop 0x5ef65f
retf
dec esi
retf
fcom qword [ebp + 0x7ffa717d]
push esp
out 0xde, eax
out dx, al
push edi
adc dword [ebx + 0x6a6d70e2], ebp
mov al, 0xa8
invalid
cld
imul esp, dword [ebx], 0x39d36399
salc
sti
xchg edi, eax
inc ebp
adc dword [eax - 0xf], 0xffffffe0
mov ah, 1
sbb dword [ebx - 0x51], ecx
loopne 0x5ef641
add dword [ecx], ebx
dec ebx
scasd eax, dword es:[edi]
add al, 0x5e
test byte [esi + 0x1094af54], dh
xor al, byte [edi]
or byte [ebx], dh
jne 0x5ef6eb
mov byte [0x22dc40d7], al
in al, dx
adc ah, byte [ecx - 0x72]
mov word [eax], cs
xor byte [ecx - 0x6430101d], 0x3d
adc byte [edi + 0x7d], 0x62
jne 0x5ef63d
call 0xf76f35d8
jb 0x5ef6d5
sbb esi, dword gs:[eax]
test dword [edx - 0xb], 0xdce9c4de
jns 0x5ef68b
outsd dx, dword [esi]
call 0x726aec2c
aaa
and al, 0x27
cmp ah, byte [esi + 0x48341625]
dec esp
cmpsb byte [esi], byte es:[edi]
and eax, 0x26483416
dec esp
xor ch, byte [esi + edx*8]
fist word [ebx]
inc dword [ebx + edi*2 - 0x321d04eb]
jb 0x5ef6d5
sbb dword [edi + 0x3d], 0x1fa60f
pop edi
cmp eax, 0x1fa60f
lcall 0x132d, 0x5e019d4b
jne 0x5ef733
popfd
add dword [esi + 0x2d], ebx
adc esi, dword [ebp + 0x39]
adc byte [ebx], cl
adc dword [edx + ecx*2], edx
sub dl, byte [ebx + esi - 0x7c]
ljmp 0xfab0
xor esp, dword [eax + 0x16]
arpl word [ebx - 0x559d021d], dx
mov ebp, 0xd14ee051
pop esi
lodsb al, byte [esi]
sub eax, 0xbb4ecb5
pop esp
cwde
test esi, ebp
sti
inc esi
dec esp
mov dl, ah
pop edi
cmp eax, 0xc1cbf4d3
and esi, dword [ecx - 0x75]
pop es
sub ebx, dword [esi - 0x67]
push edx
imul edx, dword [0xe68c477b], 0x9fa981db
jno 0x5ef75f
jge 0x5ef6f3
jle 0x5ef736
aam 7
leave
in al, 0xbf
wait
pop eax
pop ebx
pop ebp
into
je 0x5ef788
xor eax, 0x2945ea15
adc bl, byte [edx]
rcr byte [esi - 0x6f], 0x74
aad 0x25
pop ebp
stosd dword es:[edi], eax
std
mov eax, dword [0x32fc8be1]
dec esp
jl 0x5ef74d
or byte [edx + 0x2972145a], cl
cmp al, byte [ebx]
fcom qword [edx - 0x1e]
outsb dx, byte [esi]
sti
add bh, bl
fisttp qword [ecx - 0x1e6ee29d]
push ebp
wait
test dword [edi], edi
inc ebp
lea ebp, [ecx + 0x1a]
sar byte [edx], 1
mov al, byte [0x317e146b]
mov edi, 0xc8010901
and byte [ebx], cl
or ecx, ebx

Function at 0x638d0d
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xa933cb59
invalid
mov ds, word [edi + 0x7089ffae]
sahf
xchg ecx, eax
in al, dx
mov dword [0xf6ce9cc8], eax
push ecx
std
js 0x638c97
or ebp, ecx
and al, 0x1a
daa
test eax, 0x916ff6f5
int3
sbb dword [edi], ebp
and eax, dword [ecx - 0x42106f32]
inc ecx
xlatb
jl 0x638cb1
out dx, eax
cmp ebx, ebx
jl 0x638d99
cmp eax, 0x7dfdc10
wait
mov bh, 0x89
movsb byte es:[edi], byte [esi]
push ebp
mov fs, word [ebx + 0x59]
add ecx, dword [edi]
cmpsd dword [esi], dword es:[edi]
fadd dword [edi - 0x57b91c5b]
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
xor al, byte [edi - 0x3a]
adc bh, byte [ecx + 0x23]
retf 0x6f1
ljmp 0xbf8c:0x2f133710
Function at 0x4117af
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
jne 0x411824
mov edx, edi
add edx, dword [edi + 0x3c]
cmp word [edx], 0x4550
jne 0x411824
mov dword [ebp - 0xc], edx
mov eax, dword [edx + 0x78]
add eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [eax + 0x20]
add eax, dword [ebp + 8]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
cmp ecx, dword [edx + 0x18]
jge 0x411824
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx + ecx*4]
add ebx, dword [ebp + 8]
push dword [ebp + 0xc]
push ebx
call fcn.00411580
cmp eax, 1
je 0x411804
inc ecx
jmp 0x4117e2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x24]
add eax, dword [ebp + 8]
xor ebx, ebx
mov bx, word [eax + ecx*2]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp + 8]
mov edx, dword [eax + ebx*4]
add edx, dword [ebp + 8]
jmp 0x411826
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x411830
Capabilities:
Access peb ldr_data

Disassembly:
xor edx, edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov edx, dword [ebx + 0x10]
mov dword [0x412c24], edx
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [0x412c20], ebx
ret

Function at 0x4118e6
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov edi, eax
mov esi, 0x412020
mov ecx, dword [0x4115b8]
shr ecx, 1
dec ecx
mov bl, byte [0x4115bc]
rdtsc
push eax
mov bh, byte [esi]
inc esi
mov byte [edi], bh
inc edi
mov al, byte [esi]
stosb byte es:[edi], al
add byte [edi - 1], bl
inc esi
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
loop 0x411906
rdtsc
pop edx
sub eax, edx
pop edx
push edx
push 0
push 0
push 0x4119dc
call dword [fcn.00411c2a]
push 0x4119a1
push eax
call dword [fcn.00411c3a]
mov dword [fcn.00411c1e], eax
push 0
push 2
push 0x4119da
push 0x4119b0
call dword [fcn.00411c1e]
pop edx
sub edx, eax
ret

Function at 0x8de118
Capabilities:
Encode data using xor

Disassembly:
fcomp dword [ebx + 0x17c61532]
mov al, byte [0xf0400b11]
call 0x38c2e830
ret 0x530c
pushal
call 0x8de11e
pop ebp
sub ebp, 6
sub ebp, 0x4de118
jmp 0x8de17c
mov ebx, dword [esi + 0x486ebe51]
fisub word [edx]
mov ebp, 0x77e2a302
mov byte [esi - 0x10], bh
ja 0x8de100
jle 0x8de16a
invalid
shl dword [edi - 0x17], 1
add al, 0
add byte [eax], al
sub al, byte ds:[ebp - 0x57]
jmp 0x8de185
jmp 0x8de185
mov eax, 0x4de118
add eax, ebp
add eax, 0x93
mov ecx, 0x636
mov edx, 0x353e7c2c
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de19c
jmp 0x8de1af
inc esi
insb byte es:[edi], dx
inc esp
sub al, 0x3c
sub al, 0x2c
inc esp
sub al, 0xe0
add byte [ebp*4 - 0x661d3a24], ch
sub eax, 0xe2c5dcad
cdq
sub eax, 0xd37cec1f
mov ecx, 0x2c680d10
jl 0x8de179
loope 0x8de17b
movsd dword es:[edi], dword [esi]
adc byte [esp + ebp], ch
sub al, 0xad
in eax, dx
aam 0x2c
sub al, 0x2c
das
loope 0x8de176
sub ch, byte [esp + ebp]
sub al, 0x96
add al, 0x2c
sub al, 0x2c
fcmovne st(0), st(6)
das
in al, 0xa7
lodsd eax, dword [esi]
and byte [esp + ebp], ch
sub al, 0x2f
jmp 0x1a742677
Function at 0x410110
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x410128
cmp eax, 0x80010106
jne 0x4101a6
push edi
push esi
push 0x6c3818
push 1
push 0
push 0x6c3808
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x410157
push edi
push str.CoCreateInstance_NetFwMgr_failed:_0x_08lx_n
call fcn.00581470
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push ebx
lea edi, [esi + 4]
push edi
push eax
call edx
mov ebx, eax
test ebx, ebx
jge 0x410180
push ebx
push str.get_LocalPolicy_failed:_0x_08lx_n
call fcn.00581470
add esp, 8
mov eax, ebx
pop ebx
pop edi
pop esi
ret
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
add esi, 8
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x4101a4
push esi
push str.get_CurrentProfile_failed:_0x_08lx_n
call fcn.00581470
mov eax, esi
add esp, 8
pop ebx
pop edi
pop esi
ret

Function at 0x4104a0
Capabilities:
Access firewall policy via inetfwpolicy2

Disassembly:
push esi
push 2
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jge 0x4104b8
cmp eax, 0x80010106
jne 0x41050c
push edi
push esi
push 0x6c3858
push 1
push 0
push 0x6c3848
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
jge 0x4104e7
push edi
push str.CoCreateInstance_NetFwPolicy2_failed:_0x_08lx_n
call fcn.00581470
add esp, 8
mov eax, edi
pop edi
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x48]
add esi, 4
push esi
push eax
call edx
mov esi, eax
test esi, esi
jge 0x41050b
push esi
push str.get_Rules_failed:_0x_08lx_n
call fcn.00581470
mov eax, esi
add esp, 8
pop edi
pop esi
ret
Function at 0x410590
Capabilities:
Access firewall rule properties via inetfwrule

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 4], 0
jne 0x4105a6
mov eax, 0x80004001
pop esi
pop ecx
ret 0xc
push ebx
push ebp
push edi
push str.FPZ_SS1.exe
call fcn.00410050
mov edi, eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00410050
mov ecx, dword [esp + 0x28]
push ecx
mov ebp, eax
call fcn.00410050
mov dword [esp + 0x28], eax
add esp, 0xc
lea ebx, [esp + 0x20]
mov eax, esi
mov dword [esp + 0x10], 0
call fcn.00410510
mov esi, eax
test esi, esi
jge 0x410603
push esi
push str.IsAppEnabled_failed:_0x_08lx_n
call fcn.00581470
add esp, 8
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc
cmp dword [esp + 0x20], 0
je 0x410614
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
pop ecx
ret 0xc
lea edx, [esp + 0x10]
push edx
push 0x6c3878
push 1
push 0
push 0x6c3868
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jge 0x41063e
push esi
push str.CoCreateInstance_NetFwRule_failed:_0x_08lx_n
jmp 0x4106cd
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x20]
push edi
push eax
call edx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x30]
push ebp
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x40]
push 0x100
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x98]
push 6
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xa8]
push 1
push eax
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x88]
push 0xffffffffffffffff
push eax
call edx
mov eax, dword [esp + 0x18]
mov eax, dword [eax + 4]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jge 0x4106d5
push esi
push str.Firewall_Rule_Add_failed:_0x_08lx_n
call fcn.00581470
add esp, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call edi
push ebp
call edi
mov ecx, dword [esp + 0x1c]
push ecx
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4106f8
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
pop ecx
ret 0xc