joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100761e0
Capabilities:
Encode data using xor

Disassembly:
sub cl, ah
rol byte [edi - 0x200e6b07], cl
inc ebx
and eax, 0x3aa1db5a
sbb al, 0x82
invalid
imul eax, ebx, 0xfd5f31b5
into
salc
adc eax, 0x9ce75d8
aas
int 0xd3
sbb dword [ecx + edx*2 + 0x7e], ebx
dec esi
adc al, 0xa4
movsb byte es:[edi], byte [esi]
or al, 0xee
mov edi, 0x2b4ea023
push edi
and dl, dl
je 0x10076124
push ebx
insb byte es:[edi], dx
fucomp st(3)
lodsd eax, dword [esi]
lds edx, [ebp - 0x6cb27936]
iretd
mov ah, 0x94
pop esp
pop edx
int1
dec edi
loop 0x1007616f
mov al, byte [0xe107cb36]
inc dword [ecx + 0x1d]
fisubr dword [0x7de96837]
jne 0x10076234
mov esp, fs
xor ebp, dword [eax + edi]
pop eax
rcr dword [eax + 0x7bb5e9e1], 1
jmp 0x10076159
outsb dx, byte [esi]
call 0x63988359
int3
pop ebx
xor al, 0x73
jle 0x1007619d
mov esp, 0x3f1975d5
jne 0x10076202
aas
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
or cl, dl
arpl word [ebp + 0x28], dx
lea ecx, [ebp + 0x36b06b02]
push ecx
leave
test dword [edi - 0x54], ebp
xor ch, byte [eax - 0x755f88c1]
mov dl, bh
add edx, edi
cdq
wait
and al, 0xa8
xlatb
xchg esp, eax
jb 0x100761e7
push esp
sub eax, 0x8504db3d
jg 0x100761d2
outsd dx, dword ds:[esi]
mov bl, 0xec
popal
shl byte [esi], 1
aam 0x5e
pop esi
xchg ch, al
ljmp 0x73b
jmp 0x1007621e

Function at 0x10076ab0
Capabilities:
Encode data using xor

Disassembly:
sahf
ljmp 0x721f:0xce767245
leave
movsb byte es:[edi], byte [esi]
popfd
loop 0x10076ab1
arpl word gs:[edi - 0x16c8ad62], ax
aaa
and ah, byte [ebx + 0x6ceb3234]
pop edx
xchg dword [esi + 0x6dd0958a], edi
popfd
push ebx
sal edx, cl
jg 0x10076b0b
push 0xffffffffffffffcf
loope 0x10076a71
wait
or al, 0xc9
xor al, 0xb9
pop eax
xchg ecx, eax
scasb al, byte es:[edi]
xchg ecx, eax
je 0x10076ad5
pop ecx
push esi
jg 0x10076b0f
ja 0x10076b21
inc ebp
push edx
mov edi, 0x2dd91573
or dl, dl
invalid
in eax, 0x60
xchg ecx, eax
jmp 0x3492d74f
cmp al, 0x6c
mov esp, dword [edi + ecx*8]
mov byte [0x374e519a], al
int1
mov al, 0xa1
invalid
stosb byte es:[edi], al
pushfd
add bh, byte [ebx - 0x1e]
jb 0x10076b66
out 0xc0, al
lds eax, [edx + 2]
inc ebx
add al, 0x6d
sbb dword [esi - 0x76d44298], ecx
push ss
cmp al, 0xe0
ljmp 0x3e4d
cmp esi, dword [eax - 0x36a35295]
inc eax
cmp al, 0x95
mov dl, 0xc6
invalid
Function at 0x1007dcb0
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
leave
xchg ecx, eax
cmp ah, byte [ebx]
mov bh, 0x27
rcr dword [ebx - 0x49], cl
sub byte [ecx], ah
cmp ax, 0xb2a4
dec eax
push es
bound ebp, qword [esi + 0x21d31d9c]
sbb eax, 0xa1b221d3
mov dl, 0xa1
xchg ecx, eax
or dword [edi], edi
cdq
in al, dx
xchg esp, eax
sub dl, 0xab
mov dword [bp - 1], ecx
xor byte [esi + 0x5c], dl
pop eax
add edi, dword gs:[ecx]
and ecx, esp
adc dword [edx + 0x5d1ac4cd], esi
jge 0x1007dc0e
test dword [0x37537462], 0xb0a661d8
dec ecx
sbb cl, ah
sub dword [ebx + 0x33], ebx
jne 0x1007dbf6
push ebp
or al, 0xbc
in eax, dx
pop ebx
sub al, 0x2e
mov ecx, 0x203c7d98
pop ss
dec ebp
dec esp
jp 0x1007dc0b
ret 0xc42a
ficom word [ebx - 0x53]
fimul dword [edi - 0x74d2aefa]
mov al, 0x68
push dword [ebx]
jle 0x1007dc51
xor edi, dword [esi - 0x6e]
xchg ebp, eax
inc esi
sbb dword [ebp - 0x7f6b4dbe], esp
out 0x3d, al
mov cl, 0x17
cmp ch, 0x73
jo 0x1007dcbc
ja 0x1007dcf6
int 0xa5
retf
or dword [esi], esp
xor dl, ch
mov ch, 0x53
out 0x7e, al
xor dh, byte [ebp - 0x4ea7ec58]
inc edx
salc
xor dword ss:[eax - 0x22], ebp
invalid

Function at 0x10082210
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0xbfc4a53a]
mov cl, 0xea
or cl, byte [edi]
push ebx
lds ebx, [ecx + 0x1e]
add dword [edx + 0x6a], 0x65e8949f
mov edx, 0x410712c0
cmp edi, ecx
popfd
mov bl, 0x8a
inc ebp
cmp cl, bl
pop eax
sub eax, 0x1d04c126
ret
xchg edi, eax
mov edi, 0xd3424e6a
mov eax, 0xbec89e13
loop 0x100821cd
jp 0x100821cd
sbb dl, bh
in eax, 0x70
jnp 0x10082263
mov ebx, 0x6367423c
jbe 0x1008225c
mov ebp, 0xe220e791
jo 0x10082246
mov cs, edi
insb byte es:[edi], dx
mov cl, 0x81
pushfd
rcl dword [esi], cl
mov ebp, 0xbf4769f0
rcr byte [eax - 0x23a5a4e6], cl
std
invalid
fdiv st(5), st(0)
pushal
pushfd
cmp al, 0x30
adc dword [edi], eax
outsb dx, byte [esi]
in eax, dx
sbb edx, ebx
push edx
mov cl, 0x26
xor al, 0x82
xor al, 0x5a
jb 0x1008223d
test dword [ecx + ebx*4 + 0x48d73b04], edx
xchg esp, eax
cdq
add al, 0x3b
xlatb
dec eax
rol ebx, 1
popfd
test ecx, ebx
mov dl, 5
in eax, dx
cli
fiadd word [ecx + 0x7fa1289f]
mov ebx, 0xbc4548f1
sub byte [ebx + 0x43], ah
pop edx
ret
int 0x90
stosb byte es:[edi], al
stc
mov dword [0x812f96e3], 0x5fae13d0
mov edi, 0xc643fa8a
fidivr word [ecx + 0x7a]
cwde
int3

Function at 0x10089ec0
Capabilities:
Encode data using xor

Disassembly:
add dword [esi + edi*4 + 0x28], esp
mov dh, 0xe9
xchg ebp, ebp
or byte [ebp - 0x7cefc19e], cl
or bh, dh
fnclex
inc ecx
invalid
Function at 0x1008aba0
Capabilities:
Encode data using xor

Disassembly:
bound ebp, qword cs:[esi]
movsb byte es:[edi], byte ds:[esi]
lodsd eax, dword [esi]
fstp dword [esi + 0x3de4b8ed]
test al, 6
aam 0xd3
mov al, 0x4f
jle 0x1008ac27
stosb byte es:[edi], al
insb byte es:[edi], dx
mov bh, byte [ebp - 0x6b]
mov ebp, 0x9b603fe4
cmp byte [esi + 0x74], ch
fdiv dword [edx - 0x27]
mov fs, edx
pop esi
adc esp, esp
mov ah, 0x99
outsb dx, byte [esi]
push ecx
dec ebx
imul ecx, edi, 0x5f5fa370
sub bh, byte [edi]
mov esi, 0xa800bffa
sar byte [esi - 0x70], 0xca
mov bh, 0xd6
daa
cmpsd dword [esi], dword es:[edi]
sbb dword [esi + 0x4b], esp
add byte [edx - 0x7190ad3], ch
xchg ecx, eax
xor byte [esi - 0x7eb6c9dc], bh
cmp ah, byte [ebx - 0x68]
cmc
loop 0x1008abdd
lodsb al, byte [esi]
xor dword [ecx + 0x52c953b6], ecx
push ebx
leave
push edx
mov esp, 0x44912a32
out 0xd9, al
push ds
xor bh, ah
aad 3
pop edi
xchg ebp, eax
sub eax, 0xab33c650
mov dword [0x10f1e76d], eax
cwde
dec ebx
das
mov ah, 0x3e
in eax, dx
popal
fiadd word [ebp*4 + 0x35256751]
add dword [ecx], ebx
aad 0x8b
wait
adc al, 0xe2
sub dword [eax + 0x6f8cefe1], edi
inc eax
add al, 0xad
push ecx
and eax, 0xd5190135
mov ebx, dword [ebx - 0x47d61dec]
loope 0x1008ac25
mov word [edi + 0x40], gs
jle 0x1008abfd
cmp al, 0xd6
add esi, ebp
push ds
xchg ecx, eax
outsb dx, byte [esi]
inc esi
fild qword [edx + 0xf]
push cs
je 0x1008ac2e
push esp
outsd dx, dword [esi]
mov dword [ebp - 0x1a98c7d3], edi
push ss
push edi
pop eax
jbe 0x1008ac00
jno 0x1008ac9e
or eax, 0xd4e961f8
invalid
insb byte es:[edi], dx
invalid
Function at 0x100a18b0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100a18ec
cmpsb byte [esi], byte es:[edi]
in al, dx
push ecx
and byte [edx - 0x3154e842], 0x6a
fnsave dword [esi]
sub dword [edi - 0xf], esp
imul esp, dword [edx], 0xffffffe8
or byte [ebx - 0x4a8c61b9], ch
js 0x100a1881
adc byte [0xf4758160], dl
jg 0x100a1931
loope 0x100a18fc
mov ah, 0x19
cmp eax, dword [esp + ebx*2]
outsb dx, byte [esi]
add dh, dh
invalid
sbb byte [esi + 0x112de985], cl
in eax, dx
sahf
int1
cmp byte [edi + 0x2be75546], cl
pop dword [esi + 0x55]
out 0x2b, eax
mov byte [edi - 0x5e2ac2e4], cl
mov esp, 0x812b7a38
add eax, 0xd53a9de1
cmp al, 0x87
cmp byte [ecx - 0x74], ah
fnstsw word [esi - 0x65]
xor byte [edx - 0x93e01d1], ah
scasd eax, dword es:[edi]
aas
mov eax, dword [0xfbd86192]
lodsd eax, dword [esi]
push ss
loopne 0x100a1911
ret
clc
outsd dx, dword [esi]
inc edi
adc bh, byte [ebx + 0x52]
imul ebx, esi, 0x62
into
jo 0x100a18f7
jle 0x100a1946
inc esp
dec edx
movsd dword es:[edi], dword [esi]
pushfd
add bh, byte [ebp - 0x17]
ljmp 0x251f:0xcf4f7876

Function at 0x100a9d70
Capabilities:
Encode data using xor

Disassembly:
dec byte [eax]
push edi
mov byte [0xa949c71e], al
js 0x100a9dad
push edi
mov esi, 0x50e41346
rcr dword ss:[0x46da7589], 1
fst qword [edi + 0x7b5250fa]
mov ebx, dword [esi - 0x23]
or al, 0xfd
mov cl, 0x58
aad 0xae
adc al, 0xbe
lodsd eax, dword [esi]
or dword [esi], edx
invalid
cmc
adc al, 0x6c
mov byte [esi + 9], cl
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
lodsd eax, dword [esi]
inc esp
je 0x100a9df7
mov dword [edx + 0x7f704c5c], esp
mov byte [0x7f704c5c], al
dec esp
jo 0x100a9e3e
lea ebx, [eax + 0x6b]
cmp dh, byte [esi - 0x4aca252e]
cmp esp, 0x10
sub ah, byte [ebx*4 + 0x6a96d7ca]
jno 0x100a9e25
cmp al, 0x52
xor bl, cl
pop esi
out dx, eax
dec edx
pop ebx
jle 0x100a9dba
test dword [edi], edi
xchg byte [esi], dh
pushal
dec ebx
bound esi, qword [esi - 0x7a]
sub esi, ebp
popal
xor edx, eax
fidiv word [esi + edx*2]
jmp 0xbbd7cae4
sub cl, byte [ebx + 0x72]
inc esp
pop edx
cmp dword [ecx + 0x50], 3
xor al, 0x76
xor byte [eax - 0x79], dh
out 0x6e, eax
pop ebx
push 0x56a950cd
sbb edi, 0xffffffa1
dec edx
loopne 0x100a9dbc
push ecx
out 0xe, eax
imul edi, dword [edx + 0x74], 0x47
xchg esp, eax
xor ebp, dword [ebx]
jl 0x100a9e39
sbb byte [eax + 0x2956b931], 7
sub dword [edi], eax
ret
Function at 0x100b6c50
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x2ab31ee9
retf 0xeaf0
adc dword [eax + 0x1f14b386], eax
mov dword [0x2c6c6a95], eax
dec esp
or dword [eax - 0x2da4d05a], ebp
in al, 0xd7
sahf
mov eax, 0x469ee1fc
cmc
mov dh, 0x2a
or dword [eax + 0x49343a61], 0x2653daae
stosd dword es:[edi], eax
push cs
in eax, 0xdf
mov ch, 0x86
sbb al, 0x10
scasb al, byte es:[edi]
xor cl, al
imul edx, dword [ecx + 0x29f2e8f2], 0x2d981f35
mov al, byte [0x1058f046]
fscale
push esi
jnp 0x100b6c5b
invalid
push cs
das
sbb byte [ebp + esi + 0x7e0a2263], bl
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
push esi
jb 0x100b6c8e
mov ebp, 0xdae350ed
and eax, eax
sbb dword [esi], esp
jns 0x100b6c43
cdq
loop 0x100b6cad
imul ebp, dword [edi], 0xa1d68c83
outsb dx, byte [esi]
ja 0x100b6cf7
inc ebp
sbb eax, 0x6c0ad92c
xchg ecx, eax
in al, 0xeb
rcl dword [eax - 0x21d0d4f1], 0xb0
mov esi, 0x6ab255e
fistp dword [ebp - 0x431b40fa]
push fs
sal dword [esi], 1
das
push 0xf9b7624d
idiv dword [esi - 0x36f3dca9]
and byte [esi + 0x28], ch
sar dword [edi], 0x48
xor byte [ebp + ebx*4 + 0x2b49d976], dh
xor al, 0xd2
xor al, 0xd2
invalid

Function at 0x100b9220
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x82fa51f2
invalid
or byte [edi], 0x50
or byte [edi], cl
test eax, 0x12ff0e5e
clc
fmul dword [esi + 0x57224d56]
sal dword [esi], cl
insd dword es:[edi], dx
xor bl, 0xdb
fsubr dword [ebx]
bound eax, qword [edi + ebx*4 - 0x7f]
nop
test eax, 0x5724c91e
daa
inc dword [ebx - 0x6eba8684]
imul esp, edx, 0x86973f1f
jae 0x100b921d
pop ebp
test dl, ch
test eax, 0x490df863
dec byte [ebp + 0x18e3f014]
jg 0x100b9219
cwde
jl 0x100b928b
or cl, bh
invalid
mov edi, 0x3b16895d
Function at 0x10638058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x106381a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1063807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063806a
add dl, dl
jne 0x10638089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x106380dc
xor eax, eax
add dl, dl
jne 0x10638096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1063817d
add dl, dl
jne 0x106380a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106380b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106380bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106380c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x106380d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10638075
mov eax, 1
add dl, dl
jne 0x106380ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x106380f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x106380e1
sub eax, ebx
mov ebx, 1
jne 0x10638128
mov ecx, 1
add dl, dl
jne 0x1063810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10638119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10638105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10638075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1063813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1063814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10638136
cmp eax, 0x7d00
jae 0x1063816d
cmp eax, 0x500
jb 0x10638168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10638075
cmp eax, 0x7f
ja 0x10638170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10638075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1063819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10638075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100c7600
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x100c77e4
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5d000]
push edi
or ebp, 0xffffffff
jmp 0x100c762a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x100c7631
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100c7620
mov eax, 1
add ebx, ebx
jne 0x100c7643
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x100c7654
jne 0x100c7673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100c7673
dec eax
add ebx, ebx
jne 0x100c7660
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x100c7638
add ebx, ebx
jne 0x100c766f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x100c76c5
xor ecx, ecx
sub eax, 3
jb 0x100c768b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x100c76fa
sar eax, 1
mov ebp, eax
jmp 0x100c7696
add ebx, ebx
jne 0x100c7696
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100c7664
inc ecx
add ebx, ebx
jne 0x100c76a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x100c7664
add ebx, ebx
jne 0x100c76b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100c76a6
jne 0x100c76c2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100c76a6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x100c76e4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x100c76d6
jmp 0x100c7626
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x100c76e4
add edi, ecx
jmp 0x100c7626
pop esi
mov edi, esi
mov ecx, 0x1f2e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x100c7702
cmp byte [edi], 0xa
jne 0x100c7702
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x100c7707
lea edi, [esi + 0xc4000]
mov eax, dword [edi]
or eax, eax
je 0x100c7776
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc7000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc703c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x100c7734
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc7040]
or eax, eax
je 0x100c7770
mov dword [ebx], eax
add ebx, 4
jmp 0x100c7751
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100c77a7
cmp al, 0xef
ja 0x100c779a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100c777c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100c7789
mov ebp, dword [esi + 0xc7044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x100c77db
sub esp, 0xffffff80
jmp 0x10001460
Function at 0x643eb8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6684b0]
jne 0x643ec2
repz ret
jmp fcn.0064688e

Function at 0x6473bf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00642dc6
and dword [ebp - 4], 0
cmp dword [0x66966c], 0
mov ebx, eax
jne 0x647470
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x647521
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x647521
push eax
call fcn.00642d54
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x66966c], eax
call esi
push eax
call fcn.00642d54
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x669670], eax
call esi
push eax
call fcn.00642d54
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x669674], eax
call esi
push eax
call fcn.00642d54
pop ecx
mov dword [0x66967c], eax
test eax, eax
je 0x647470
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00642d54
pop ecx
mov dword [0x669678], eax
mov eax, dword [0x669678]
cmp eax, ebx
je 0x6474c8
cmp dword [0x66967c], ebx
je 0x6474c8
push eax
call fcn.00642dcf
push dword [0x66967c]
mov esi, eax
call fcn.00642dcf
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x6474c8
test edi, edi
je 0x6474c8
call esi
test eax, eax
je 0x6474bf
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x6474bf
test byte [ebp - 0xc], 1
jne 0x6474c8
or dword [ebp + 0x10], 0x200000
jmp 0x647501
mov eax, dword [0x669670]
cmp eax, ebx
je 0x647501
push eax
call fcn.00642dcf
pop ecx
test eax, eax
je 0x647501
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x647501
mov eax, dword [0x669674]
cmp eax, ebx
je 0x647501
push eax
call fcn.00642dcf
pop ecx
test eax, eax
je 0x647501
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x66966c]
call fcn.00642dcf
pop ecx
test eax, eax
je 0x647521
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x647523
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x648185
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [0x667818]
mov edx, ecx
add edx, 0xc82
mov dword [0x667814], edx
add ecx, 0x594
mov dword [0x667818], ecx
mov dword [ebp - 0x10], eax
call fcn.006494d2
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov esi, dword [eax + esi + 0x78]
mov dword [0x667818], 0x431
mov edi, edx
add edi, dword [eax + esi + 0x20]
mov ebx, dword [eax + esi + 0x24]
mov dword [0x667814], 0x835
mov eax, dword [eax + esi + 0x18]
cmp eax, 0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x6482f7
jmp 0x648259
xor eax, eax
mov ecx, dword [ebp - 0x2c]
add ecx, 2
mov edx, dword [ebp - 0x30]
add edx, 1
mov esi, dword [ebp - 0x18]
cmp edx, esi
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], eax
jb 0x648269
jmp 0x6482f7
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x40]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x45], bh
mov byte [ebp - 0x46], cl
je 0x6482bc
jmp 0x64828f
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov esi, dword [ebp - 0x24]
mov edi, dword [esi + ecx*4]
mov dword [0x667814], 0x10b3
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edx
jmp 0x64822e
mov al, byte [ebp - 0x45]
cmp al, 0
setne cl
mov edx, dword [ebp - 0x44]
add edx, 1
mov ah, byte [ebp - 0x46]
and ah, cl
cmp edx, 0x20
setb cl
and ah, cl
test ah, 1
mov dword [ebp - 0x3c], edx
jne 0x64822e
mov al, byte [ebp - 0x46]
test al, 1
jne 0x6482c8
jmp 0x648205
mov eax, dword [ebp - 0x2c]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov ecx, dword [edx + ecx*4]
mov dword [0x667818], 0x1788
mov edx, dword [ebp - 0x1c]
add edx, ecx
mov dword [0x667814], 0x2f88
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
add esp, 0x3c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x648463
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x667818], 0x322f
mov dword [0x667814], 0x1eed
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
jmp 0x648498
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop ebp
ret
mov eax, dword [ebp - 0x2c]
mov ecx, eax
add ecx, 1
mov dl, byte [eax + 0x64a62b]
mov dh, byte [eax + 0x64a5fc]
sub dh, dl
mov byte [ebp + eax - 0x20], dh
cmp ecx, 0xe
mov dword [ebp - 0x2c], ecx
jne 0x648498
lea eax, [ebp - 0x20]
mov dword [0x667818], 0x1698
mov dword [ebp - 0x34], eax
call fcn.00649079
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.00648734
xor ecx, ecx
cmp eax, 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ecx
je 0x648490
mov dword [0x667814], 0x18cd
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [0x667814], 0x21d
mov dword [esp], eax
mov ecx, dword [ebp - 0x24]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.00648324
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [0x667814], 0xce7
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov dword [0x667818], 0xffffe9f4
mov edx, dword [ebp - 0x28]
mov dword [edx + 0x18], ecx
mov ecx, dword [ebp - 0x3c]
mov dword [edx + 0x38], ecx
cmp ecx, 0
mov dword [ebp - 0x30], eax
je 0x648490
mov dword [0x667814], 0xb81
mov eax, dword [ebp - 0x3c]
add eax, 0x149e
mov dword [ebp - 0x30], eax
jmp 0x648490
Function at 0x6488dd
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x667820], 0
mov byte [0x667824], 0
mov dword [0x667814], 0xe49
mov dword [0x66781c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x64893f
xor eax, eax
mov dword [0x667814], 0x22ed
mov dword [0x66781c], 0
mov dword [ebp - 0x20], eax
jmp 0x64897b
mov eax, dword [ebp - 0x1c]
mov dword [0x667814], 0x707
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x667818], 0x1742
mov eax, dword [0x66781c]
add eax, 1
mov dword [0x66781c], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x64893f
jmp 0x648924
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x667828], 0
mov dword [0x667814], 0x1eed
mov edi, dword [0x667820]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x667828], esi
mov dword [0x667814], 0x4119
mov eax, esi
cdq
idiv ecx
mov dword [0x667820], edx
mov dword [0x667818], 0xa88
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x667824], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov cl, byte [0x667824]
mov esi, dword [0x667820]
mov byte [ebx + esi], cl
mov dword [0x667814], 0x11d0
mov esi, dword [0x66781c]
add esi, 1
mov dword [0x66781c], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x64897b
mov dword [0x667818], 0x1d4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret