joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423d35
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
sbb al, 0xd8
shr dword [esi], cl
or eax, 0xcbcd7d24
sal byte [esi + 0x34caf9a5], 0xff
pop es
mov gs, word [ecx + 0x714d7650]
xor dword gs:[ebp - 0x1f], ecx
neg dword [eax]
call 0x4b3019bd
in eax, dx
dec edx
push ss
fsubr dword [ecx]
mov edi, 0x9577d05f
jbe 0x423cca
inc ecx
test al, 0xd2
aad 0x19
pushfd
sbb eax, 0xab2c071a
dec ecx
fist dword [edi + 0x72]
push ecx
cmpsd dword [esi], dword es:[edi]
push ebx
xchg cl, bh
in al, 0x98
mov eax, dword [0x45edd0c5]
dec esp
rcr byte [ecx - 0x3f7c4288], 0x31
in al, dx
rcr bh, cl
popfd
dec eax
sub edx, edx
sbb dword [eax], edx
xchg ecx, eax
fdiv dword [edx - 0x7c92086f]
imul eax, dword [ebp - 0x2571f55b], 0x63986cf3
mov al, 0x56
push esi
push esi
xor eax, 0x58665756
ror ecx, 1
cwde
sbb esi, esi
jge 0x423ceb
jecxz 0x423d8b
push ecx
ret
pop edx
ffree st(7)
call 0xbc69deb5
mov eax, dword [0xd16487d9]
add esi, dword [edi - 7]
out dx, eax
daa
or ebp, edi
jmp 0xc4ff38e3

Function at 0x431f15
Capabilities:
Encode data using xor

Disassembly:
inc esi
mov edi, 0x97d39ae7
ljmp 0x6522
test al, 0xb8
outsd dx, dword [esi]
loope 0x431f44
push edi
push ds
jae 0x431eca
lds esi, [ebx + 0x12]
jae 0x431ede
loopne 0x431e91
cmp dword [ebp + 0x779154c3], esi
lcall 0x5d16, 0x4c9e96f
pop es
add dword [ebx], esi
fisttp qword [edi]
lodsd eax, dword [esi]
sal esp, cl
inc edi
or dh, al
shl byte [edx + 0x42], 1
sar byte [0xadb620c5], 0xc7
mov ecx, 0x8c011072
sbb eax, 0x4d31da67
test byte [ebx + ebp*2 + 0x7f], bh
pop es
pop ds
iretd
and byte [edi + eax*8 - 0x61f4a0a1], ch
lds edx, [esi - 0x33]
sub al, 0x5e
push esi
int 0xf3
sub al, 0x5e
mov eax, 0x156a0b17
aaa
jns 0x431ec0
js 0x431f22
fidiv word [edi + 0x5759261e]
push ss
aaa
je 0x431f1d
mov ah, byte [edi + ebp*8 + 0x11]
sti
xchg edi, eax
invalid
ret 0x1460

Function at 0x44b810
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
mov dword [esi], 0
mov eax, dword [0x65bd8c]
push eax
call sub.IMM32.dll_ImmGetContext
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
mov dword [0x65bd8c], eax
call edi
test ax, ax
push 0x10
setne bl
call edi
test ax, ax
jge 0x44b84c
push es
or dword [esi], 0x2000000
push 0x11
call edi
test ax, ax
jge 0x44b85b
or dword [esi], 0x4000000
push 0
call dword [sym.imp.COMCTL32.dll_ImageList_Destroy]
test bl, bl
je 0x44b86d
or dword [esi], 0x657520
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x5648dc
Capabilities:
Encode data using xor

Disassembly:
jno 0x564957
dec edx
cwde
and eax, 0x466c48a0
invalid
pop esp
inc eax
sub byte [ecx + 0x58], al
imul ebx, esp, 0xffffffc5
jo 0x5649da
dec eax
cld
mov dh, 0xe7
xchg byte [edx + 0x3e], ch
push ebp
adc al, 0xdb
jns 0x564984
sbb al, 0xe2
or byte [ebx + 0x7849cee5], al
sal edx, 1
call 0xbdacdd87
push esi
invalid
jp 0x56498b
fsub st(2), st(0)
pop esi
ret
std
invalid
xor al, 0x4f
mov byte [0x371897d], al
cld
pop eax
mov edi, gs
dec edi
add al, 0xeb
and ebp, dword [eax + 0xf0b039]
movsd dword es:[edi], dword [esi]
mov ecx, 0x3c4793bb
lahf
cmp dword [edx], ebp
fsub qword [0xf5bb4a1c]
or al, 0x59
pop ds
dec edx
mov ebx, 0x1f590cf5
outsb dx, byte [esi]
or byte [ebx - 0xc], ch
xchg esp, eax
dec esp
or dl, byte [esi - 0x589ec41]
cli
jp 0x5649ba
pop eax
mov al, 0xc1
jbe 0x5649eb
cmp bl, dl
push ebx
adc bl, byte [0x9c7543dd]
or al, 0x22
pop esi
cmc
mov byte [0x1ef6d96c], al
and al, 0xcc
push ds
shr byte [esi + esi - 0x5e], 1
dec eax
or dword [ebx + 0x3c], ebx
aad 0x75
test eax, 0x7bfd4364
mov ah, 0x3f
hlt
Function at 0x591185
Capabilities:
Encode data using xor

Disassembly:
adc dh, byte [ecx + 0x197981f7]
jns 0x5910e5
mov al, byte [0x59df2000]
popal
mov eax, 0x873e9290
xor dword [edx + esi*4 - 0xf], ecx
jns 0x5910c5
in eax, 0xb5
out 0xf3, eax
cmp dh, ah
lodsb al, byte [esi]
pop ds
mov byte [0x32c80013], al
lds edx, [edx]
insb byte es:[edi], dx
in al, 0x34
cmp al, 0x34
mov al, pe_nt_image_headers32
invalid
bound ecx, qword [ebx - 0x73]
hlt
mov al, byte [0xbebf7e31]
aaa
sbb al, 0x40
in al, dx
insd dword es:[edi], dx
mov al, byte [0x13014fb0]
or eax, dword [esi + 0x65]
xor ebx, esp
out dx, eax
fsub st(7), st(0)
jnp 0x591110
jge 0x59115f
mov esi, esp
xchg edx, eax
loop 0x5910ca
mov ebp, 0x8d3906b2
adc byte [ebp - 0x6f168e13], dh
xor byte [ecx - 0x70], cl
push eax
push 0xc0f0b041
wait
mov al, byte [0xd01a011]
adc dh, byte [0x4821a387]
jmp 0x591125
or eax, 0xa3873512
and dword [eax - 0x15], ecx
mov ebp, 0x285ba041
and al, 0xfd
ja 0x5911e5
out 0x43, eax
ret
mov ch, 0xce
mov bh, 0x32
loopne 0x5911cb
and al, ah
test edx, esi
add eax, 0x619d80b2
invalid
sbb byte [ebp - 0xa4b019f], 0x2c
mov bh, 0x4e
adc eax, dword [eax]
popal
cdq
jnp 0x5911a7
xchg dword [eax + ebp*2 + 0x3e], esi
cmc
in eax, 0x9f
lahf
rcr byte ds:[ebx], 1
test esp, edx
not byte [ecx + 0x4c0483b6]
pop edx
xchg esp, eax
jl 0x591209
mov eax, dword [0xd5e1a011]
loope 0x591191
mov cl, 0x35
jno 0x591141
xchg ebx, eax
sbb dl, byte [edi - 0xe5087cf]
xor dword [eax - 0x51], edi
int1
xor byte [edi - 0x36], bh
enter 0xffffffffffffac1e, 0xffffffffffffffb5
mov al, 0xec
push ds
lodsb al, byte [esi]
mov ch, 0xb0
in al, dx
rcl dword [eax - 0x3c], 0x60
fldcw word [ebp + 0x1ad45671]
test eax, 0x10cb6d1e
push ss
nop
or byte [ebp - 0x22], bh
lcall 0x8544, 0x959d1d7e
push eax
adc eax, 0x4cd9a324
popal
push eax
and dword [edi], eax
mov al, 0xe0
xchg edx, eax
adc eax, 0x4340ff01
mov eax, dword [0xb115fa46]
jo 0x5911ba
inc eax
sub al, 0x6c
stosd dword es:[edi], eax
js 0x59125c
inc esp
aaa
and byte [ebp + 5], bh
mov al, 0xcf
je 0x591284
pop ebx
sbb dword [esi - 0x4dbf2ecc], 0xee21b78a
xchg ebp, eax
jno 0x5911c3
invalid
jb 0x5912ae
rcl byte ss:[eax + 0x36], cl
in al, 0xea
sub byte [esi + 0x30], 0x29
test dword [edi + 0x636d5ebb], edi
retf 0x2a18
push esp
push 0xaedfbbd6
push ds
fdiv dword [ecx + 0x6f]
shl dword [esi + 0x794f0dc1], cl
js 0x591237
mov eax, 0x4f4175ee
or al, 0x63
hlt
int1
popal
invalid
Function at 0x5ac99d
Capabilities:
Encode data using xor

Disassembly:
push ebx
nop
ffreep st(5)
out dx, al
xlatb
imul eax, dword [edx - 0x374fade0], 0x982a45ff
xchg ecx, eax
fistp dword [edx + 0x31bbd66]
out 0x96, eax
int3
mov cl, 0xe1
cli
je 0x5aca0f
je 0x5ac92a
fnsave dword [edx - 0x47a4bf3f]
sahf
and byte [esi + 0x66f413e], cl
wait
cld
fsub dword [ecx + 0x36c17584]
movq qword [ecx - 0x67ec0e20], mm7
rcl byte [0x44bcb1e2]
jne 0x5aca16
ficom dword [edx - 8]
popal
jecxz 0x5aca20
in al, dx
loopne 0x5ac9f3
rcl dword [eax]
mov al, byte fs:[0x57ddc8a0]
les esi, [ebx]
jle 0x5aca4f
sal dword [edi], 1
scasd eax, dword es:[edi]
xor al, 0xf0
and dword [ecx + 0x10d341f0], esp
les ebx, [ecx]
rcl byte [ecx]
ljmp 0x96e0
add eax, 0x256096e0
lea eax, [eax + 0x58]
out 0xf2, eax
dec ebp
popal
sub ebx, eax
out dx, eax
cmp al, 0x94
dec ecx
dec edi
pop edi
push cs
jo 0x5aca4c
int1
xchg ebx, eax
push 0xb0737532
jae 0x5ac9c1
add byte [ebx + 0x662da1de], ah
mov eax, 0x67dd5034
call 0x2a91bae8
iretd
mov ax, 0x5034
push eax
frstor dword [edi - 0x18]
invalid
sub cl, bh
adc al, 0x40
and esp, dword [ecx - 0x29035ee8]
cmpsb byte [esi], byte es:[edi]
xor dword [edi], ecx
invalid
adc byte [edx], ah
out 0x2d, eax
clc
and edx, esi
test byte [esi], al
push es
call 0x855ac3b9
jp 0x5aca19
int1
mov dword [0x970dcdb], eax
jo 0x5aca57
aad 0x3e
push esi
push esi
cmp al, 0x49
and dword [edi + ebx - 0x58], ebp
xor bl, bh
mov cl, 0x15
arpl bx, di
loopne 0x5aca9a
add edx, dword [ecx - 0x5f]
xchg ebx, eax
sbb byte ds:[eax + 0x40], 0xff
sbb byte ds:[eax + 0x40], 0xff
inc esp
fimul word [ecx - 0x3b]
adc dh, ah
push ebx
fiadd word [ebp + 0x1722c21d]
inc ebp
and eax, 0xbb4093b3
dec ebx
sub dl, ah
add al, 0xa7
pushal
xchg dl, ch
mov esi, 0x8d208138
cmp byte [edi - 0x19], bh
int1
mov ss, word [eax + 0x54d1551b]
push esp
loope 0x5acad0
mov byte [0x581a3d31], al
fdivr dword [ecx + 0x71]
or eax, dword [edx + 0x27beec66]
sbb bl, byte [eax - 0x28]
jl 0x5aca40
jno 0x5aca94
or eax, dword [edx + 0x27beec66]
push ebx
mov edx, edx
jo 0x5acae3
lcall 0x9415, 0x99e8a94b
ja 0x5aca38
adc byte [eax + 0x41], ah
push es
xchg ebp, eax
js 0x5aca64
inc ebp
mov al, byte [0x22aa4001]
push esp
xor dl, ch
add byte [ebp - 0x72], al
inc eax
shr dword [edx - 0x4f4f958b], 1
mov ecx, 0x89708190
and byte [ecx + esi*4 + 0xf5d8759], dh
nop
xor dword [eax - 0x77], 0x59b1b420
xchg dword [ebp + 0xf], ebx
pop ebp
nop dword [edi + 0x10]
scasd eax, dword es:[edi]
insb byte es:[edi], dx
inc esi
mov al, 0x30
pop ds
dec edi
adc byte [edi + 0x30b0466c], ch
jl 0x5acae9
jle 0x5acad9
lea esi, [edx - 0x40]
aaa
add ecx, ebp
push 0x8a060ebc
add al, 0xa
xor eax, 0x2ca4bdab
movsd dword es:[edi], dword [esi]
inc ebx
invalid
sal byte [edi], 1
jmp 0xf17331f

Function at 0x5af702
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
sub eax, 0x1c7ca796
xchg ebx, eax
wait
dec ecx
inc ebx
je 0x5af746
invalid
mov edx, 0xa00a4110
xor byte [edx], dh
and byte [esi - 0x403c9a5b], 0xad
in eax, 9
invalid
pop ax
inc ecx
pop dword [ecx]
push eax
sar ecx, 0xe9
sal dword [ecx], 1
xlatb
ficom dword [ebp - 0x56355e54]
test eax, 0xc47e4543
Function at 0x5e53e5
Capabilities:
Encode data using xor

Disassembly:
neg byte [esp + esi*4]
mov bl, 0xc6
dec esi
dec edx
sbb eax, 0xeddee7de
sar byte [edx + 0x1cb40f37], 1
jae 0x5e541f
mov dl, 0xde
pop edx
mov byte [ecx - 0x14], bl
jg 0x5e540c
xor byte [ebp - 0x3e179140], bh
out 0x15, al
stosb byte es:[edi], al
dec esi
leave
jle 0x5e545e
mov esi, 0x5d368fab
inc esi
xchg byte [ebx], al
xor dword [edx], edi
out dx, eax
cmp ch, bh
xor al, 0x81
jae 0x5e5417
outsd dx, dword [esi]
call 0x1d3972e5
mov dl, byte [esi]
cmp ebp, dword [edx]
idiv dword [edi + 0x70cedbd8]
ret 0xdb1e
stc
inc edx
mov cl, 0x7f
sbb bl, byte [edx + 0x26fcab8f]
scasd eax, dword es:[edi]
or dl, dl
iretd
mov bl, 0x4d
lcall 0x8e32, 0x4a2c07d5
inc edx
out dx, eax
fimul word [edx]
invalid
shr edi, 0x86
lds edx, [edi - 0x72]
mov ch, 0xf2
stosd dword es:[edi], eax
dec ebp
lcall 0x5b6c, 0xf56cc643
ja 0x5e543f
jge 0x5e54d0
pop ds
push ds
cmc
adc eax, 0x5f2e460c
push cs
outsd dx, dword [esi]
out dx, eax
out dx, eax
inc ebx
xchg edi, eax
sbb dh, dh
ficomp dword [ebx - 0x55]
call 0x6f93e394
jno 0x5e54a6
jne 0x5e542d
sbb esi, ecx
or al, byte [ecx + 0x30]
mov ebp, 0x9fb4938a
pxor mm5, qword [eax]
aam 0x24
dec edi
jns 0x5e54dc
inc ebx
mov dh, 0xdf
lahf
sahf
xchg edx, eax
retf
call dword [edi]
adc ch, dh
pushfd
or al, 0x7a
jmp 0xd4ba4f22
into
int 0xb8
pop edx
fistp qword [edx + 0x33]
pop es
sbb al, 0x74
sub eax, 0xaee3ff69
fdiv dword [ebx]
xor byte [ecx + 0x72], bh
or al, 0xb5
jnp 0x5e54d3
jmp ebx
pushfd
outsd dx, dword [esi]
pop eax
jle 0x5e54ac
push 0xa11a46a9
or dword [ebx + 0x7c], edx
ja 0x5e5576
xchg edx, eax
add dh, byte [eax]
inc esi
push 0x62d8f89a
salc
fisub dword [ecx]
test al, 0x6c
pop ecx
out dx, al
or eax, esp
sub ecx, dword [esi - 0x7e]
cmp eax, 0x9cb6dfe4
sub esp, dword [eax]
or bl, ch
into
cmp ch, byte [esi - 0x3f6f87d8]
loope 0x5e5538
xor dword [esi], ebp
dec edx
sub al, 0x7e
test dword [ecx], esp
push 0x6c
stosb byte es:[edi], al
mov es, word [esi + 0x22a60259]
mov dword [0x9f188484], eax
invalid
adc eax, ebx
push 0x46
xor byte [ebp + ecx*8 + 0x20a45c8], dh
hlt
cld
shl dword [ebp + 0x410a389b], 0x3b
mov bl, 0x22
iretd
mov fs, word [ecx]
stosb byte es:[edi], al
mov ch, byte [ecx - 0x6e]
stosb byte es:[edi], al
push esp
popal
das
sbb dword [ecx - 0x9c14d3a], eax
out dx, eax
stosb byte es:[edi], al
jb 0x5e554e
call eax
jp 0x5e55b8
scasb al, byte es:[edi]
mov al, byte [0x2202387c]
lodsd eax, dword ds:[esi]
and al, dh
not bh
push ebp
out dx, eax
push ecx
in al, 0xc0
pop esi
mov ebx, 0xb3be859a
movsd dword es:[edi], dword [esi]
jae 0x5e55ef
fsub dword [esi]
test eax, 0xa10be7d4
cwd
out dx, al
pop ebx
stosd dword es:[edi], eax
pop ss
push 0x17
in eax, 0xe8
dec esi
pop edi
push es
pop edi
mov esp, 0x87aaf222
fisttp dword [esi - 0x23c4fa87]
rol dword [edx + 0x7ce5ebcd], 0x15
inc edi
lodsb al, byte [esi]
xchg edx, eax
inc edi
mov bl, 0x32
xchg esi, eax
scasb al, byte es:[edi]
rcr dword [esi], 0xa1
invalid
in al, dx
test al, 0xcb
add byte [ecx], bl
jp 0x5e5595
mov dword [0xa9365180], eax
push es
xchg ebp, eax
sti
jmp 0x5e55b2
Function at 0x5f2fd1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec ebx
fbld tbyte [edx]
mov dh, 0x78
aas
dec ebp
fisubr word [edx + 0x2c3a4eeb]
invalid

Function at 0x610f85
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x864
mov eax, dword [0x4a2f50]
xor eax, esp
mov dword [esp + 0x860], eax
push ebp
push 0x46
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call 0x65fd65
add esp, 0xc
push 0x104
lea ecx, [esp + 0x260]
push ecx
push 0
call dword [fcn.00475410]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea edx, [esp + 0x274]
push edx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 8], ebp
jne 0x61100d
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x860]
xor ecx, esp
call 0x65cf2c
add esp, 0x864
ret
push ebx
push esi
push edi
push 0
push 0
push 0
push ebp
call dword [fcn.00475404]
call fcn.00610eb5
mov ebx, dword [0x475408]
push 0
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x47c]
push ecx
push ebp
or esi, 0xffffffff
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
jne 0x611108
shr edx, 2
je 0x6110d3
lea esp, [esp]
mov ecx, dword [edi]
mov eax, ecx
xor eax, esi
and eax, 0xff
mov dword [esp + 0x10], eax
mov eax, esi
mov esi, dword [esp + 0x10]
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 8
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4a65f0]
mov esi, ecx
shr esi, 0x10
xor esi, eax
shr eax, 8
and esi, 0xff
xor eax, dword [esi*4 + 0x4a65f0]
shr ecx, 0x18
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 4
test edx, edx
mov esi, eax
jne 0x611065
sub edx, 1
push 0
mov dword [esp + 0x14], edx
lea edx, [esp + 0x14]
push edx
push 0x400
lea eax, [esp + 0x47c]
push eax
push ebp
call ebx
mov edx, dword [esp + 0x10]
cmp edx, 0x400
lea edi, [esp + 0x470]
je 0x611059
test edx, edx
je 0x611134
jmp 0x611115
movzx ecx, byte [edi]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4a65f0]
sub edx, 1
add edi, 1
test edx, edx
jne 0x611115
sub edx, 1
mov dword [esp + 0x10], edx
push 0x104
lea edx, [esp + 0x64]
push edx
call dword [fcn.00475400]
push 0x47da8c
lea eax, [esp + 0x64]
push eax
call dword [fcn.00475424]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
lea ecx, [esp + 0x78]
push ecx
call dword [fcn.0047540c]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x611186
mov eax, 1
jmp 0x6111db
push 0
push 0
push 0x690
push ebp
call dword [fcn.00475404]
push 0
lea edx, [esp + 0x14]
push edx
push 0x48
lea eax, [esp + 0x24]
push eax
push ebp
call ebx
lea ebx, [esp + 0x18]
mov edi, 0x47daa8
mov eax, ebx
call fcn.0060c905
mov ecx, dword [esp + 0x14]
mov edi, dword [fcn.00475414]
push ecx
call edi
push ebp
call edi
mov edx, ebx
push edx
call 0x65d3d8
xor ecx, ecx
add esp, 4
cmp eax, esi
setne cl
mov eax, ecx
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call 0x65cf2c
add esp, 0x864
ret
Function at 0x627795
Capabilities:
Encode data using xor

Disassembly:
inc ebp
and eax, 0x2e736ed3
insd dword es:[edi], dx
pop ds
salc
iretd
or eax, 0x4da656d3
pop ebx
mov ah, 0x18
fcom dword [ebx]
wait
jge 0x62770e
ljmp 0x119:0x686c80cd
xor dword [eax + 0x60], ecx
push 0xace31776
mov bl, 0xcd
add byte [esi + 0x1987097b], cl
ret 0x8e5c
wait
loope 0x627805
fsubr dword [ebp - 0x49]
pop edx
cld
pop ss
cmp al, bh
mov cl, 0x52
cmp byte [ebx + 0x3cd718d8], al
adc esi, dword [edx - 0x59]
ja 0x62777c
shl dword [esi], cl
test al, 0x67
lahf
sub eax, 0x8af4f059
int1
mov ebp, 0xd6c62df3
and byte [ebx - 0x3b], 0x8e
not dword [esi]
lea ebp, [ebp + 0x6d884dfe]
xchg ebx, eax
pop esp
jle 0x62775b
push 0xffffffffffffffe2
mov ebx, 0x909baf2d
in al, dx
pop ss
mov ebp, 0x8c128da5
rcl esp, 1
inc ebx
jne 0x627804
cmp ch, dl
test dh, dh
inc ecx
mov bl, 0xa6
retf
lcall 0x318a, 0x80dc1595
xchg ebp, eax
adc eax, 0x318a80dc
in eax, 0x3f
test dword [ebx + 0x71], eax
mov ch, 0x6f
jecxz 0x627815
mov byte [0x382c2694], al
xchg esp, eax
sub al, 0x38
sub byte [eax + ecx - 0x32159a53], bh
cmpsb byte [esi], byte es:[edi]
or byte [ebp - 0x5932159b], ch
xor byte [eax - 0x63121547], 0x93
arpl word [eax - 0x5f960c98], bx
cwde
shl esi, cl
loope 0x62781b
out 0x62, eax
xchg esi, eax
adc ebx, dword [ebp + 0x38]
pop esp
xchg edi, eax
mov ebx, 0xb1638d3b
sub byte [0x9b26cfd6], 0xf2
inc ebp
arpl di, bp
mov ecx, 0x3b8f1d40
push ecx
pop ss
cli
mov cl, 0x9d
jmp 0xbc0d6950

Function at 0x62bfb5
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
sal dword [edx + 0x22593047], cl
add edi, edi
imul eax, dword [ecx + 0x1add8f1], 0xffffff90
insb byte es:[edi], dx
dec eax
test dword [0xab64498], edx
inc edx
xor esi, dword [ebx - 0xcfffe8b]
adc al, 3
push esi
scasd eax, dword es:[edi]
add eax, 0x234b1243
inc ebx
scasd eax, dword es:[edi]
inc ebx
lcall 0x6f91, 0x63954d33
sub eax, ebp
and bh, ah
inc esp
invalid
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x401c66
pop dword [ebp - 0x20]
mov eax, 0x401c66
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x209d7322
sub dword [ebp - 0x30], 0xd24b2dd7
mov dword [ebp - 0x2c], 0x7a532c55
add dword [ebp - 0x2c], 0xb7e01ff0
mov dword [ebp - 0x28], 0xedb30685
add dword [ebp - 0x28], 0x5e993da9
mov dword [ebp - 0x24], 0x751278cf
add dword [ebp - 0x24], 0x8aed8731
lea eax, [ebp - 0x30]
push eax
mov eax, 0x3d05a343
sub eax, 0x3cc572ef
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xfb6fe4fe
sub dword [ebp - 0x30], 0x86fd7ba8
mov dword [ebp - 0x2c], 0x609c225f
sub dword [ebp - 0x2c], 0x1f2fc0ea
mov dword [ebp - 0x28], 0x2dd26596
add dword [ebp - 0x28], 0x359d06d6
mov dword [ebp - 0x24], 0x50766015
sub dword [ebp - 0x24], 0x50766015
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x778244e
add eax, 0xf8c80bde
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3957a
push 0
call eax
mov ecx, 0x4efeda06
sub ecx, 0x4efe8694
xor ebx, ebx
add ebx, eax
mov edi, 0x407000
add edi, dword [ebp - 0x20]
mov edx, 0xfe14dc20
xor dword [ebp - 0x10], ecx
mov esi, dword [edi]
xor dword [ebp - 0xc], edx
sub esi, edx
xor dword [ebp - 4], 0xa8b7386a
mov dword [ebx], esi
add dword [ebp - 0x1c], ebx
add ebx, 0x3512f24
sub ebx, 0x3512f20
add edi, 0x727db43e
add edi, 0x8d824bc6
loop 0x401d79
add eax, 0xa844a38a
sub eax, 0xa84362ef
mov ebx, eax
add eax, 0x54bf8a83
add eax, 0xab407582
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.100892c0
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x2800
call fcn.00403160
mov al, byte [0x405838]
push ebx
push esi
push edi
mov byte [esp + 0xc], al
mov ecx, 0x9ff
xor eax, eax
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x2810]
lea ecx, [esp + 0x2814]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [esp + 0x10]
push edx
push eax
call sub.MSVCRT.dll_vsprintf
mov edi, 0x405010
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [0x482864]
lea ecx, [esp + 0xc]
push ecx
push 0x3f1
push edx
call fcn.004010a0
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0x2800
ret