joyce8/EMBER2024-capa huggingface dataset:
Function at 0x103cb9f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
mov byte [esp + 0x14], ah
push 0x8bee7c88
dec al
call fcn.102d23c7
popfd
stosd dword es:[edi], eax
adc dword [eax - 0x48], 0xffffffd7
xlatb
adc byte [eax - 0x47e7aba0], bl
hlt
pop ecx
mov ecx, dword [edx + 0x18]
test bx, 0x74ce
cmp ecx, dword [ebp - 8]
pushfd
pushfd
pushal
lea esp, [esp + 0x2c]
jbe fcn.102cd952
xadd di, si
sub ecx, 1
sub si, 0xd19c
mov dword [ebp - 4], ecx
xor cl, 0x49
cmp si, 0xe381
adc cl, ah
mov ecx, dword [ebp - 8]
pushfd
pushfd
shl si, cl
shr si, cl
add ecx, dword [ebp - 4]
test ch, 0x99
shr ecx, 1
or si, sp
mov edi, dword [ebx + ecx*4]
movsx si, bl
sbb esi, edi
inc si
not esi
add edi, eax
jmp 0x103cbe8a
bts cx, 0xc
shr bl, 6
add edi, eax
add bl, bl
mov ebx, dword [edx + 0x20]
seto cl
ror ch, 3
shrd ecx, eax, 0xa
add ebx, eax
jmp 0x10424b30
movzx si, al
pushfd
movsx esi, bl
mov esi, dword [ebp + 0xc]
pushfd
mov dword [esp + 0xc], eax
jmp 0x103cbff2
push 0x500fcbcc
mov al, byte [esp]
pushfd
lodsb al, byte [esi]
cmc
sub al, 0xb4
lea esp, [esp + 0x14]
jb 0x1042323b
clc
ror al, 6
cmp cx, di
stc
neg al
jmp 0x102d272e
sub al, 0xbe
sub eax, 0x2d4e2da6
cmpsb byte [esi], byte es:[edi]
sub eax, 0x2d8e2de6
cmpsb byte [esi], byte es:[edi]
sub eax, 0x2de62d1e
dec esi
sub eax, 0x2db62da6
mov esi, 0x62a2e2d
sub eax, 0x2d4e2de6
cmpsb byte [esi], byte es:[edi]
sub eax, 0x2dbe2db6
sub al, byte cs:[esi]
pop esi
sub eax, 0x2db62d5e
pop esi
sub eax, 0x2c062a2e
xchg byte [0x292e2bbe], ch
call int.102d3551
lodsb al, byte [esi]
jl 0x1042323d
add ebp, ebx
jmp [esp + edi*2 - 0x285cba06]
inc ebp
mov dword [0xe17d66d7], eax
or eax, 0x2db51141
push 0xd125e129
push ecx
xchg dword [0xd7420af], ebx
add ebx, esp
pop esp
sar byte [eax], cl
mov cl, byte [edi - 0xd0d02b8]
wait
jnp 0x104231f8
cmp eax, 0xf7d45d5
jae 0x104232cf
in eax, dx
in eax, dx
out 0x38, al
dec eax
and edx, dword [esi - 0x32a9715d]
nop
jp 0x10423208
add byte [edi], dh
scasb al, byte es:[edi]
wait
enter 0xffffffffffffa14d, 0xfffffffffffffffe
mov edi, 0x975420a4
mov cl, 0xb6
dec eax
inc eax
daa
mul byte [edx - 0x27]
inc edi
xor eax, 0xf0e678ad
pop ds
push esp
mov esi, 0x7cb4a1ce
or al, 0xd7
adc al, 0xc2
fld qword [ebx]
invalid
out 0x3b, eax
jbe 0x10423331
cmp eax, dword [edx + esi*4]
inc byte [esi + 0x246c88aa]
stosb byte es:[edi], al
mov byte [esp + 8], ch
lea esp, [esp + 0x28]
jmp 0x102d15a6
invalid
invalid
mov eax, 0xae88fff3
xchg byte [ebx - 0x29], al
fnstenv [ecx - 0x1f]
mov ebp, 0x497135d1
movsd dword es:[edi], dword [esi]
int 5
push edi
daa
or ebx, dword [edx]
hlt
setb cl
pushfd
mov dword [ebp - 8], 0
jmp 0x102d5359

Function at 0x10422118
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], dh
lea esp, [esp + 0x40]
ja 0x102caaed
pushal
lea esp, [esp + 0x20]
jb 0x1035e537
bt ecx, ebx
cmp byte [edi - 1], 0
pushal
pushal
pushfd
lea esp, [esp + 0x44]
jne 0x102ca0a1
shl di, cl
sbb di, bp
Function at 0x10001410
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x10024004]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
mov dword [esp + 0xc], esi
test edi, edi
jns 0x1000147b
cmp dword [0x100244f0], 2
jl 0x100015ca
push edi
push str.ERROR:_invalid_fd_in_check_fd__d_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10001010
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.10018af0
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.WS2_32.dll_select]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 1
nop dword [eax]
test ecx, ecx
je 0x100014ba
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 0x10], edx
sub ecx, eax
imul eax, ecx, 0x3e8
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], eax
jmp 0x100014bc
xor ecx, ecx
mov eax, esi
sub eax, 0
je 0x100014e9
sub eax, 1
je 0x100014dd
sub eax, 1
jne 0x100015ca
push ecx
lea eax, [esp + 0x1c]
push eax
push 0
push 0
jmp 0x100014f3
push ecx
push 0
lea eax, [esp + 0x20]
push eax
push 0
jmp 0x100014f3
push ecx
push 0
push 0
lea eax, [esp + 0x24]
push eax
lea eax, [edi + 1]
push eax
call ebx
mov esi, eax
test esi, esi
jns 0x100015e2
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov eax, dword [eax]
cmp eax, 4
jne 0x1000154a
cmp dword [0x100244f0], 2
mov ecx, dword [ebp + 8]
mov esi, dword [esp + 0xc]
jl 0x10001490
push str.socket_check_fd
push str._s:_EINTR_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10001010
mov ecx, dword [ebp + 8]
add esp, 0xc
jmp 0x10001490
cmp eax, 0xb
jne 0x10001591
cmp dword [0x100244f0], 2
jl 0x100015e4
push str.socket_check_fd
push str._s:_EAGAIN_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10001010
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.10018af0
mov esp, ebp
pop ebp
ret
cmp dword [0x100244f0], 2
jl 0x100015ca
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
push dword [eax]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
add esp, 4
push eax
push str.socket_check_fd
push str._s:_select_failed:__s_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10001010
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.10018af0
mov esp, ebp
pop ebp
ret
je 0x100015fb
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.10018af0
mov esp, ebp
pop ebp
ret
cmp dword [0x100244f0], 2
jl 0x10001622
push str.socket_check_fd
push str._s:_timeout_n
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
add esp, 4
push eax
call fcn.10001010
add esp, 0xc
mov ecx, dword [esp + 0x124]
mov eax, 0xffffff76
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10018af0
mov esp, ebp
pop ebp
ret
Function at 0x1000ab40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], ebx
test esi, esi
je 0x1000acbd
cmp dword [esi], 0
je 0x1000acbd
test ebx, ebx
je 0x1000acbd
cmp dword [esi + 0x1c], 0
je 0x1000ab77
pop esi
mov eax, 0xfffffffc
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.Locked
push 0xbf
push str.D:_a1_slibimobiledevice_srcinstallation_proxy.c
push str.instproxy_lock
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [esi]
mov edx, ebx
push 0
call fcn.10015070
add eax, 5
add esp, 4
cmp eax, 5
ja case.0x1000abb4.4
jmp dword [eax*4 + 0x1000acc8]
or eax, 0xffffffff
jmp 0x1000abda
mov eax, 0xfffffffe
jmp 0x1000abda
mov eax, 0xfffffffd
jmp 0x1000abda
mov eax, 0xfffffffa
jmp 0x1000abda
mov eax, 0xffffff00
push eax
push str.could_not_send_command_plist__error__d
push 0x12b
push str.D:_a1_slibimobiledevice_srcinstallation_proxy.c
push str.instproxy_send_command
call sym.imobiledevice.dll_debug_info_real
add esp, 0x14
push str.Unlocked
push 0xca
push str.D:_a1_slibimobiledevice_srcinstallation_proxy.c
push str.instproxy_unlock
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [esi], 0
je 0x1000acb1
cmp dword [esi + 0x1c], 0
je 0x1000ac37
mov edi, 0xfffffffc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
mov edi, 0xffffff00
jne 0x1000ac96
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1000acb4
push dword [ebp - 4]
mov dword [ebx], esi
call dword [sym.imp.plist.dll_plist_copy]
add esp, 4
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov eax, dword [ebp + 0x10]
push 0
push 0
push ebx
push 0x1000aa80
push 0
push 0
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000acb4
xor edi, edi
mov dword [esi + 0x1c], eax
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x10]
mov edx, ebx
mov ecx, esi
push dword [ebp + 0xc]
call fcn.1000a630
add esp, 8
mov edi, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or edi, 0xffffffff
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000baa0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
adc al, 0x8d
je 0x1000badc
sbb byte [ecx - 0x1017438b], cl
std
invalid
dec esi
or al, 0xf
mov bh, 0xd0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x1000baf0
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x1000bae1
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.1000b89c
bound ecx, qword [edi]
pop ds
in al, 0x8d
inc ebp
test al, 0x50
call fcn.1000b8ac
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.1000b861
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x1000bb8a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.1000b89c
invalid
Function at 0x10014710
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10014721
or eax, 0xffffffff
pop edi
pop ebp
ret
push ebx
push esi
push str.Locked
push 0x34
push str.D:_a1_slibimobiledevice_src_notification_proxy.c
push str.np_lock
mov ebx, 0xffffff00
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [edi + 0x1c], 0
je 0x10014795
push str.callback_already_set__removing
push 0x167
push str.D:_a1_slibimobiledevice_src_notification_proxy.c
push 0x1001ef20
call sym.imobiledevice.dll_debug_info_real
mov esi, dword [edi]
add esp, 0x10
mov dword [edi], 0
push 0xffffffffffffffff
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [edi + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], esi
lea esi, [edi + 4]
mov dword [edi + 0x1c], 0
cmp dword [ebp + 0xc], 0
je 0x100147d9
push 0xc
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100147f5
mov eax, dword [ebp + 0xc]
push 0
push 0
push ecx
push 0x10014660
push 0
mov dword [ecx + 4], eax
mov eax, dword [ebp + 0x10]
push 0
mov dword [ecx], edi
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100147f5
mov dword [edi + 0x1c], eax
xor ebx, ebx
jmp 0x100147f5
push str.no_callback_set
push 0x17c
push str.D:_a1_slibimobiledevice_src_notification_proxy.c
push 0x1001ef20
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
push str.Unlocked
push 0x3f
push str.D:_a1_slibimobiledevice_src_notification_proxy.c
push str.np_unlock
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov eax, ebx
pop ebx
pop edi
pop ebp
ret

Function at 0x10014d50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
test esi, esi
je 0x10014db7
cmp dword [esi], 0
je 0x10014db7
cmp dword [esi + 4], 0
je 0x10014d71
pop esi
mov eax, 0xfffffff6
pop ebx
pop ebp
ret
push edi
push 0xc
mov edi, 0xffffff00
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10014db0
mov eax, dword [ebp + 8]
push 0
push 0
push ecx
push 0x10014ca0
push 0
push 0
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10014db0
mov dword [esi + 4], eax
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x100180d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10018159
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x10018159
cmp dword [esi + 4], 0
push edi
mov edi, 0xffffff00
je 0x10018112
push str.Another_syslog_capture_thread_appears_to_be_running_already.
push 0xbb
push str.D:_a1_slibimobiledevice_src_syslog_relay.c
push 0x1001f978
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1001810b
mov eax, dword [ebp + 0x10]
push 0
push 0
push ecx
push 0x10017f60
push 0
push 0
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001810b
xor edi, edi
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10018160
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x100181e9
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x100181e9
cmp dword [esi + 4], 0
push edi
mov edi, 0xffffff00
je 0x100181a2
push str.Another_syslog_capture_thread_appears_to_be_running_already.
push 0xd7
push str.D:_a1_slibimobiledevice_src_syslog_relay.c
push 0x1001f994
call sym.imobiledevice.dll_debug_info_real
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x10
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x1001819b
mov eax, dword [ebp + 0x10]
push 0
push 0
push ecx
push 0x10017f60
push 0
push 0
mov dword [ecx], esi
mov dword [ecx + 4], ebx
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1001819b
xor edi, edi
mov dword [esi + 4], eax
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x40a0a3
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
invalid
enter 0xffffffffffffbfbf, 0x71
out 0x30, al
add eax, 0xc6bd3a2c
push ss
leave
mov byte [edx - 0x3b], ch
sub dword [esi + 4], ebx
xor byte [ebx - 0x485f434d], dl
std
dec esi
xor ch, al
push ecx
push ss
cmp bl, byte [ebx]
xor byte [eax + 0x7e], ch
fcom dword [ebp - 0x4ace51a1]
jb 0x40a0a7
jnp 0x40a076
rol eax, 1
aaa
aaa
int1
test eax, 0xfe9088df
inc esi
ficom dword [esi + 0x5027fa06]
cdq
mov byte [ebx], ch
push ds
rcr byte [ecx + esi + 0x1335fb00], 0x71
int 0xd1
add bl, bh
xor eax, 0xd1cd7113
xor byte [eax - 0xb752fd3], al
cmp ebx, esp
jg 0x40a151
inc eax
mov bl, 0xcc
mov eax, dword [0xc498c1ff]
and dword [eax - 0x1e65bfeb], ebp
xor byte [ebx - 0x24de5ec7], ah
int3
adc eax, 0xf3e19a40
xor byte [ebx - 0x24de5ec7], ah
movsb byte es:[edi], byte [esi]
push esi
sar ecx, 0x2b
xor cl, ah
or bh, bh
ja 0x40a183
and al, 0x99
inc eax
jo 0x40a0ea
invalid
push cs
jnp 0x40a17e
pop esp
cmp bh, byte [esi - 0x51]
sbb al, 0xc3
loop 0x40a0f9
xchg ecx, eax
xlatb
ror byte ss:[eax], cl
invalid
div dword [edi + 0x73]
or byte [edi - 0x52], 0xc5
dec edi
jns 0x40a0fd
sal edx, 1
jmp 0x40a105
inc edx
pop esi
pop edi
sub eax, 0xe9829bf5
sbb byte [ebx - 0x24e204b7], dh
adc dword [ebx + 0x43], edx
wait
sub cl, 0x18
mov bl, 0x49
sti
sbb eax, 0xe35411db
inc ebx
dec byte [edi + 0x5b]
daa
pushal
push ds
outsb dx, byte [esi]
dec ebp
mov cl, 0x93
mov ah, 0x5a
ficomp word [ebx + 0x49]
dec esi
jg 0x40a13d
aaa
inc ebx
lock and esp, dword [esi + 0x43]
pop es
fiadd word [ecx - 0x46e0d8a6]
shl dword [ebx + ebx + 0xcf21d41], 1
test dword [esi], ecx
mov byte [esi - 0x7f], bh
sbb al, 0xb0
cmp dl, al
cli
or edi, dword [ebx]
jo 0x40a1e6
in eax, 0xe8
add dword [edx - 0x150eccd0], edx
adc ebp, eax
int1
ljmp 0xcb1d
jle 0x40a19a
sbb eax, 0x310dd8cb
dec esi
loope 0x40a1f6
xchg esp, eax
mov edx, 0xce839085
imul ebx, ebx, 0xc9a8b8d0
inc eax
jns 0x40a1e9
add bh, ah
cld
mov cl, 0xdb
or byte [esi - 0x48], dl
jecxz 0x40a226
fisttp dword [eax]
push esi
mov eax, 0xc34837e3
shl dword [eax + 0x2f], cl
jmp 0x40a181
dec eax
ret
fldpi
mov ah, 0xf0
test cl, bh
inc esp
xchg ecx, eax
cld
add ebx, ecx
mov ecx, 0xc76ba35a
arpl cx, di
cli
add eax, 0x5c9a7244
dec eax
jo 0x40a1ce
invalid
arpl bx, di
out dx, al
pop eax
xor edi, dword [ebx]
or dl, byte [eax - 0x50]
jnp 0x40a1ca
xor esp, dword [esi]
cmp al, 0x12
insb byte es:[edi], dx
push 0xc63ded74
loopne 0x40a28a
test al, 0xa8
dec ecx
inc eax
mov ecx, 0x32796d80
ljmp 0x2c5b
jp 0x40a2e3
mov edx, 0xae0f7f4b
xlatb
jns 0x40a2ff
daa
clc
mov byte [edx - 0x3fa78066], cl
push edx
xor esp, eax
pop eax
rcl byte [edx + 0x33], 0xe0
and ebx, ecx
jmp 0x40a27a
push ebx
iretd
cmpsd dword [esi], dword es:[edi]
xor eax, 0x2b596798
cmp esp, ebp
xchg edi, eax
pushal
lodsd eax, dword [esi]
outsd dx, dword [esi]
jge 0x40a2d0
mov dh, 0x45
aam 0x90
imul edi, eax, 0x15
stc
je 0x40a34c
mov bh, 0xe0
pop esi
movsd dword es:[edi], dword [esi]
add eax, 0xf607baf2
ljmp 0xa192
adc eax, 0x2aec67cc
Function at 0x449e10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 5
call sub.MPR.dll_WNetCloseEnum
lea ecx, [esp + 0x18]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x449e54
mov edx, dword [0x64dd2c]
push 0x64da48
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x12]
mov ecx, dword [esp + 0xcc]
and edx, 0xffff
and eax, 0xffff
mov dword [ecx], edx
mov edx, dword [esp + 0x14]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0xe]
and edx, 0xffff
and eax, 0xffff
mov dword [ecx + 8], edx
mov edx, dword [esp + 0xa]
mov dword [ecx + 0xc], eax
mov eax, dword [esp + 8]
and edx, 0xffff
and eax, 0xffff
mov dword [ecx + 0x10], edx
mov edx, dword [esp + 0xc4]
mov dword [ecx + 0x14], eax
mov eax, dword [esp + 0x1c]
lea edi, [eax + edx]
mov eax, edi
cdq
mov esi, eax
mov eax, 0x88888889
xor esi, edx
sub esi, edx
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [ecx + 0x18], edx
lea eax, [edx + edx*2]
lea edx, [eax + eax*4]
xor eax, eax
shl edx, 2
sub esi, edx
mov edx, dword [ecx + 0x20]
test edi, edi
setl al
shl eax, 1
and edx, 0xfffffffd
mov dword [ecx + 0x1c], esi
or eax, edx
pop edi
or al, 1
pop esi
mov dword [ecx + 0x20], eax
mov eax, ecx
add esp, 0xc0
ret

Function at 0x524db0
Capabilities:
Encode data using xor

Disassembly:
push ecx
add byte [edi], cl
scasd eax, dword es:[edi]
shr dword [edx + 2], cl
imul edx, ebx
push 2
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x50bb10]
mulsd xmm0, qword [0xcccccc30]
int3
add eax, 0xe09d8f34
ja 0x524d82
xor al, 0x8f
popfd
loopne 0x524e2d
retf
lodsb al, byte [esi]
in al, 0x33
js 0x524db1
sub byte [edi - 0x1d269e52], bh
xchg edi, eax
xchg ebp, eax
pop ecx
pop es
stosd dword es:[edi], eax
add eax, 0x611f2a3a
dec ebp
dec edi
and eax, 0x1e363c23
test byte [edi - 0x388e5bb9], 0x56
mov esp, dword [ebx + 0x7c]
mov ecx, 0x84a062b6
lodsb al, byte [esi]
adc dword [edx - 0x4c056709], ecx
fdivr qword [ebp + 0x277733c8]
sub al, 0xa4
push esp
pushal
xchg ebp, eax
inc ecx
sti
sbb eax, dword [0x2ef624a3]
je 0x524d80
popaw
invalid
mov esi, 0x40af802f
arpl word [esi], bx
add dword [ebx], 0x56bf7113
lock and byte [ecx + 0x268a42f2], bh
xor eax, 0xdd881032
in eax, dx
xchg esi, eax
xor ebp, dword [esi - 0x5b]
popfd
add byte [edi], bh
xlatb
pushal
cmp edx, ecx
dec ecx
sahf
imul dword [ebp + ebp*8 - 0x21]
xor ebp, dword [esi]
invalid
Function at 0x52ef93
Capabilities:
Encode data using xor

Disassembly:
mov dl, dl
mov dh, 0x31
mov dl, 0x5f
jno 0x52efb9
and edx, dword es:[eax + 0x78]
and edx, dword [eax + 0x78]
test dh, cl
outsb dx, byte [esi]
xchg dword [eax - 0x6f284f71], ebp
je 0x52efd7
mov esi, 0xaf81e2f2
mov al, byte [0x7cff246e]
jg 0x52efed
dec esp
dec esp
test al, 0x72
invalid
jb 0x52efb9
push eax
mov byte [ebx + 0x6d], dh
push edx
scasb al, byte es:[edi]
mov dword [0x95bf138a], eax
cmpsd dword [esi], dword es:[edi]
invalid
dec ebp
pop ebp
push eax
into
mov cl, 0x6c
jne 0x52f021
mov al, byte [0xd4fa8782]
lahf
invalid
mov ah, 0x27
loope 0x52ef9c
in eax, dx
inc esp
and byte [eax], ch
loopne 0x52f021
sub al, ah
sub dl, byte [esi + edx*4 + 0x71]
jo 0x52f065
push esp
xchg esi, eax
jno 0x52f06b
imul ebx, dword [ecx + 0x4d], 0xc8ba6e47
xchg byte [ecx - 0x45147c43], ch
pop ecx
dec ebp
inc edi
outsb dx, byte [esi]
mov edx, 0xbda986c8
sub ebx, 0xffffffba
push cs
or ecx, ecx
mul dword [edx + 0xe814ec4]
sub bh, byte [esi - 0x20]
jle 0x52eff4
fild qword [edi + 0x50]
mov bl, byte [esi + 9]
pop ebx
xor dword [ecx + eax*2 - 2], ebp
shr byte [edi - 0x3bb98180], cl
cmp byte [esi + 0x46], 0xc4
and byte [esi], cl
aam 0xd4
outsd dx, dword [esi]
sbb cl, bh
pushal
xor byte [edi + 6], dh
pop ds
mov cl, byte [ebp + 0x4d3e65fc]
pop edx
cmpsb byte [esi], byte es:[edi]
test al, 1
jb 0x52f012
mov dh, 0x17
xchg esi, eax
scasb al, byte es:[edi]
retf 0x28b3
dec ebx
jle 0x52f096
invalid
jmp 0x52f077
retf 0x2116
in al, dx
or ecx, esi
jno 0x52f01b
dec edi
push 0xffffffffffffffaf
xchg esi, eax
popfd
mov al, byte [0xae949c76]
push eax
in al, 0x5e
mov al, 0xa3
mov al, byte [0x7b5d36fe]
cwde
and dl, 0x1e
scasb al, byte es:[edi]
inc esp
adc bl, byte [edx]
or byte [eax - 0x42], dh
in al, 0x67
dec sp
pop esi
sbb dl, byte [ecx - 0x47]
mov edi, 0x98f50e8
add esp, dword [edi]
mov eax, dword [0xf266579e]
mov cl, 0xaf
mov al, byte [0x140954c2]
xor bl, bh
sbb eax, 0x52372194
add ebx, dword [edi + 0x6eec43ed]
and dword [ebp + 0x6d8c36c0], 0x3a
invalid