joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c834
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x45c83c
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45c969
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, dword [ebx + 4]
mov edx, 0x45c980
call fcn.00403d00
mov edx, dword [ebp - 4]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 8]
mov ecx, dword [ebx + 0x10]
mov edx, 0x45c990
call fcn.00403d00
mov edx, dword [ebp - 8]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0xc]
mov ecx, dword [ebx + 0x2c]
mov edx, 0x45c9a0
call fcn.00403d00
mov edx, dword [ebp - 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x10]
mov ecx, dword [ebx + 0x28]
mov edx, 0x45c9b4
call fcn.00403d00
mov edx, dword [ebp - 0x10]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x14]
mov ecx, dword [ebx + 0x30]
mov edx, 0x45c9d0
call fcn.00403d00
mov edx, dword [ebp - 0x14]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x18]
mov ecx, dword [ebx + 0x24]
mov edx, 0x45c9e4
call fcn.00403d00
mov edx, dword [ebp - 0x18]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push dword [ebx + 0xc]
push dword [ebx + 8]
lea eax, [ebp - 0x20]
call fcn.0040a368
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov edx, 0x45ca04
call fcn.00403d00
mov edx, dword [ebp - 0x1c]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
fld xword [ebx + 0x18]
add esp, 0xfffffff8
fistp qword [esp]
wait
lea eax, [ebp - 0x28]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.00457f90
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x45ca18
call fcn.00403d00
mov edx, dword [ebp - 0x24]
mov eax, dword [esi]
mov ecx, dword [eax]
call dword [ecx + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c970
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.00403a58
ret

Function at 0x45ca2c
Capabilities:
Initialize winsock library

Disassembly:
push ebx
add esp, 0xfffffe70
mov ebx, eax
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x45ca8a
lea eax, [ebx + 4]
lea edx, [esp + 4]
mov ecx, 0x101
call fcn.00403c64
lea eax, [ebx + 8]
lea edx, [esp + 0x105]
mov ecx, 0x81
call fcn.00403c64
mov ax, word [esp + 2]
shr ax, 8
mov word [ebx + 0xc], ax
mov ax, word [esp + 2]
and ax, 0xff
mov word [ebx + 0xe], ax
call sub.wsock32.dll_WSACleanup
jmp 0x45ca97
lea eax, [ebx + 8]
mov edx, 0x45caa8
call fcn.00403a88
add esp, 0x190
pop ebx
ret
Function at 0x45cac8
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffe30
mov ebp, edx
lea eax, [esp + 0x40]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, ebp
call fcn.00403a34
push 0x40
lea eax, [esp + 4]
push eax
call sub.wsock32.dll_gethostname
push esp
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x45cb22
mov esi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x45cb16
push dword [edi]
call sub.wsock32.dll_inet_ntoa
mov edx, ebp
call fcn.00408c34
inc ebx
mov edi, dword [esi + ebx*4]
test edi, edi
jne 0x45cb07
call sub.wsock32.dll_WSACleanup
add esp, 0x1d0
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x466b20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x466bf8
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x47c874], 0
jne 0x466bdc
lea eax, [ebp - 4]
mov edx, 0x466c10
call fcn.00403acc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00403e78
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x466bdc
mov eax, ebx
call fcn.00402748
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x466bd5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x466bbf
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x466c20
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x466bbf
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x47c874], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466bdc
mov eax, dword [ebp - 0xc]
call fcn.00402760
ret
mov ebx, dword [0x47c874]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466bff
lea eax, [ebp - 4]
call fcn.00403a34
ret
Function at 0x475c00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
add edi, 0xfffffffc
xor eax, eax
push ebp
push 0x475d4a
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x475d2f
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [edi]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea edx, [ebp - 8]
mov eax, dword [edi]
call fcn.00408c34
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, 0xfffffff4
call fcn.00403acc
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
mov eax, dword [edi]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0xc]
mov eax, dword [edi]
call fcn.00408c34
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.00403acc
push 0x475d60
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x14]
mov eax, 8
call fcn.00408428
push dword [ebp - 0x14]
push 0x475d70
mov eax, dword [ebp + 8]
push dword [eax - 0x10]
push 0x475d7c
mov eax, dword [ebp + 8]
push dword [eax - 0xc]
lea eax, [ebp - 0x10]
mov edx, 6
call fcn.00403d74
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
mov edx, dword [ebp - 4]
call fcn.0046ae94
mov esi, eax
push ebx
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x475cf3
mov edx, 2
mov eax, esi
call fcn.0046a0d4
jmp 0x475cff
mov edx, 1
mov eax, esi
call fcn.0046a0d4
mov edx, dword [esi + 0x14]
mov eax, esi
call fcn.0046a120
mov eax, dword [ebp + 8]
push eax
push 5
push ebx
call sub.user32.dll_GetWindow
mov edx, esi
call fcn.00475c00
pop ecx
push 2
push ebx
call sub.user32.dll_GetWindow
mov ebx, eax
test ebx, ebx
jne 0x475c2e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475d51
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00403a58
ret
Function at 0x475d80
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x14]
xor eax, eax
push ebp
push 0x475f47
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov eax, dword [ebp - 8]
call fcn.00408c48
mov dword [ebp - 4], eax
call sub.user32.dll_GetDesktopWindow
mov ebx, eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.user32.dll_GetClassNameA
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408c34
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.user32.dll_GetWindowTextA
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00408c34
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
call fcn.0046c06c
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
call fcn.004300a4
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0046ae64
push 0x475f60
mov eax, ebx
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x1c]
mov eax, 8
call fcn.00408428
push dword [ebp - 0x1c]
push 0x475f70
push dword [ebp - 0x10]
push 0x475f7c
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403d74
mov ecx, dword [ebp - 0x18]
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
xor edx, edx
call fcn.0046aeb0
mov esi, eax
push ebp
push 5
push ebx
call sub.user32.dll_GetWindow
mov edx, esi
call fcn.00475c00
pop ecx
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
xor edx, edx
call fcn.0046b134
call fcn.0046aa74
mov eax, dword [edi]
mov ebx, dword [eax + 0x2fc]
mov eax, dword [ebx + 0x254]
xor edx, edx
call fcn.0046b134
mov edx, eax
mov eax, ebx
call fcn.0046c17c
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
call fcn.0046c134
xor edx, edx
call fcn.0046a398
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
call fcn.004300ac
mov eax, dword [edi]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x254]
call fcn.0046ae10
lea edx, [ebp - 0x20]
call fcn.00408388
lea eax, [ebp - 0x20]
mov edx, 0x475f88
call fcn.00403cbc
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [edi]
mov eax, dword [eax + 0x300]
mov eax, dword [eax + 0x1f0]
xor edx, edx
call fcn.004691d4
pop edx
call fcn.0046914c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f4e
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403a58
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403a58
ret
Function at 0x4773c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x47750c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x60c]
mov esi, dword [eax + 0x34]
mov edx, dword [esi + 4]
mov eax, dword [ebx + 0x2f8]
call fcn.0042fc0c
mov edx, dword [esi + 0x10]
mov eax, dword [ebx + 0x300]
call fcn.0042fc0c
mov edx, dword [esi + 0x2c]
mov eax, dword [ebx + 0x314]
call fcn.0042fc0c
mov edx, dword [esi + 0x28]
mov eax, dword [ebx + 0x318]
call fcn.0042fc0c
mov edx, dword [esi + 0x30]
mov eax, dword [ebx + 0x324]
call fcn.0042fc0c
mov edx, dword [esi + 0x24]
mov eax, dword [ebx + 0x328]
call fcn.0042fc0c
push dword [esi + 0xc]
push dword [esi + 8]
lea eax, [ebp - 4]
call fcn.0040a368
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x338]
call fcn.0042fc0c
fld xword [esi + 0x18]
add esp, 0xfffffff8
fistp qword [esp]
wait
lea eax, [ebp - 8]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.00457f90
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x33c]
call fcn.0042fc0c
cmp byte [esi + 0x35], 0
je 0x477491
mov edx, 0xff00
mov eax, dword [ebx + 0x340]
call fcn.0042fd68
jmp 0x4774a1
mov edx, 0xc0c0c0
mov eax, dword [ebx + 0x340]
call fcn.0042fd68
cmp byte [esi + 0x36], 0
je 0x4774b9
mov edx, 0xff00
mov eax, dword [ebx + 0x344]
call fcn.0042fd68
jmp 0x4774c9
mov edx, 0xc0c0c0
mov eax, dword [ebx + 0x344]
call fcn.0042fd68
cmp byte [esi + 0x34], 0
je 0x4774e1
mov edx, 0xff00
mov eax, dword [ebx + 0x348]
call fcn.0042fd68
jmp 0x4774f1
mov edx, 0xc0c0c0
mov eax, dword [ebx + 0x348]
call fcn.0042fd68
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477513
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403a58
ret
Function at 0x47751c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor edx, edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x477622
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x60c]
mov ebx, dword [eax + 0x2c]
mov edx, dword [ebx + 0x10]
mov eax, dword [esi + 0x2e8]
call fcn.0042fc0c
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebx + 8]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, dword [ebx + 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x24]
mov ecx, 3
mov eax, 0x477638
call fcn.0040917c
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x354]
call fcn.0042fc0c
mov edx, dword [ebx + 0x14]
mov eax, dword [esi + 0x358]
call fcn.0042fc0c
mov edx, dword [ebx + 0x20]
mov eax, dword [esi + 0x368]
call fcn.0042fc0c
mov edx, dword [ebx + 0x1c]
mov eax, dword [esi + 0x36c]
call fcn.0042fc0c
mov edx, dword [ebx + 0x24]
mov eax, dword [esi + 0x378]
call fcn.0042fc0c
mov edx, dword [ebx + 0x28]
mov eax, dword [esi + 0x37c]
call fcn.0042fc0c
mov edx, dword [ebx + 0x34]
mov eax, dword [esi + 0x390]
call fcn.0042fc0c
mov edx, dword [ebx + 0x38]
mov eax, dword [esi + 0x394]
call fcn.0042fc0c
mov edx, dword [ebx + 0x30]
mov eax, dword [esi + 0x398]
call fcn.0042fc0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477629
lea eax, [ebp - 4]
call fcn.00403a34
ret
Function at 0x402ea9
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
and esi, 0x300
push eax
mov eax, esi
and edi, 1
or al, 9
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406374
xor ebx, ebx
cmp eax, ebx
jne 0x402f8c
test byte [ebp + 0x10], 2
je 0x402f0a
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 8], ebx
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x402f71
lea eax, [ebp - 0x214]
push 0x105
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x402f46
test edi, edi
jne 0x402f71
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.00402ea9
test eax, eax
jne 0x402f4f
lea eax, [ebp - 0x214]
push 0x105
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x402f1f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004068d4
test eax, eax
jne 0x402f81
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x402f8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x402f8c
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405ab5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
ror byte [ebp - 0x65243], 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
push ebx
stosd dword es:[edi], eax

Function at 0x405ad2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00404b9c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
invalid
movsd dword es:[edi], dword [esi]
xchg esp, eax

Function at 0x405b2d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
invalid
invalid
invalid
Function at 0x406544
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00404b83
add esp, 0xc
mov dword [ebp - 0x730], eax
and dword [ebp - 0x6fc], 0
push 1
pop eax
test eax, eax
je 0x406c64
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x406739
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
mov byte [ebp - 0x77a], 4
and byte [ebp - 0x779], 0
mov byte [ebp - 0x778], 0xb8
mov byte [ebp - 0x777], 0xc1
mov byte [ebp - 0x776], 0xa7
mov byte [ebp - 0x775], 0xab
mov byte [ebp - 0x774], 0x89
mov byte [ebp - 0x773], 0x94
mov byte [ebp - 0x772], 0x9c
mov byte [ebp - 0x771], 0x89
mov byte [ebp - 0x770], 0x9a
mov byte [ebp - 0x76f], 0x96
mov byte [ebp - 0x76e], 0xdb
mov byte [ebp - 0x76d], 0xbd
mov byte [ebp - 0x76c], 0x92
mov byte [ebp - 0x76b], 0x97
mov byte [ebp - 0x76a], 0x9e
mov byte [ebp - 0x769], 0x88
mov byte [ebp - 0x768], 0xa7
mov byte [ebp - 0x767], 0xb8
mov byte [ebp - 0x766], 0x94
mov byte [ebp - 0x765], 0x96
mov byte [ebp - 0x764], 0x96
mov byte [ebp - 0x763], 0x94
mov byte [ebp - 0x762], 0x95
mov byte [ebp - 0x761], 0xdb
mov byte [ebp - 0x760], 0xbd
mov byte [ebp - 0x75f], 0x92
mov byte [ebp - 0x75e], 0x97
mov byte [ebp - 0x75d], 0x9e
mov byte [ebp - 0x75c], 0x88
mov byte [ebp - 0x75b], 0xa7
mov byte [ebp - 0x75a], 0xa8
mov byte [ebp - 0x759], 0x82
mov byte [ebp - 0x758], 0x88
mov byte [ebp - 0x757], 0x8f
mov byte [ebp - 0x756], 0x9e
mov byte [ebp - 0x755], 0x96
mov byte [ebp - 0x754], 0xa7
mov byte [ebp - 0x753], 0x88
mov byte [ebp - 0x752], 0x82
mov byte [ebp - 0x751], 0x96
mov byte [ebp - 0x750], 0x88
mov byte [ebp - 0x74f], 0x89
mov byte [ebp - 0x74e], 0x8d
mov byte [ebp - 0x74d], 0xd5
mov byte [ebp - 0x74c], 0x9f
mov byte [ebp - 0x74b], 0x97
mov byte [ebp - 0x74a], 0x97
mov byte [ebp - 0x749], 0xfb
lea eax, [ebp - 0x77c]
push eax
call fcn.00404bce
pop ecx
mov al, byte [ebp - 0x12c]
mov byte [ebp - 0x778], al
push 0x30
lea eax, [ebp - 0x77c]
push eax
call fcn.00404bce
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.00404b2f
add esp, 0xc
lea eax, [ebp - 0x504]
mov dword [ebp - 0x3a0], eax
jmp 0x406b36
cmp dword [ebp - 0x6fc], 1
jne 0x4067ea
and byte [ebp - 0x78c], 0
and byte [ebp - 0x78b], 0
mov byte [ebp - 0x78a], 0xa0
and byte [ebp - 0x789], 0
mov byte [ebp - 0x788], 3
mov byte [ebp - 0x787], 0x3b
mov byte [ebp - 0x786], 0x33
mov byte [ebp - 0x785], 0x3c
mov byte [ebp - 0x784], 0x30
mov byte [ebp - 0x783], 0x3a
invalid
invalid
Function at 0x10011953
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x10011962
pop dword [ebp - 0x3c]
mov eax, 0x83da8eb
sub eax, 0xf83c8f89
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3994f
push 0
mov eax, 0x148a6c2d
sub eax, 0x488eadd
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xffce8347
add ecx, 0x31c528
mov edx, eax
mov ebx, 0x5343e5fa
sub ebx, 0x43412ffa
add ebx, dword [ebp - 0x3c]
mov esi, 0xbbdc3622
add dword [ebp - 0x2c], ebx
mov edi, dword [ebx]
sub dword [ebp - 0x24], 0x448e31f
xor edi, esi
sub dword [ebp - 0x30], 0x3fc462e9
mov dword [edx], edi
xor dword [ebp - 0x18], ecx
add edx, 0x1a7ca994
sub edx, 0x1a7ca990
add ebx, 0xb58b4533
add ebx, 0x4a74bad1
loop 0x100119bb
add eax, 0xb60847bf
add eax, 0x49f8ccd0
xor ebx, ebx
add ebx, eax
add eax, 0x4b87bf76
add eax, 0xb478408f
mov ecx, 0x4ad18d12
add ecx, 0xc52e72ee
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4554b0
Capabilities:
Encode data using xor

Disassembly:
and ch, ch
pop ebp
popal
rcr dword [ebp + 0x43], cl
pop ebp
inc ebx
xor byte [edi], dl
test al, 0x76
push esp
pop edi
imul eax, dword [esi - 8], 0x43
sub ebp, dword [ebp - 0x3918ec5]
mov dl, 0x2d
mov esi, 0x8f58963b
inc esi
je 0x4554b5
lds esi, [ebx + ebx + 0x7dc3c169]
sbb eax, 0x38e12ae
aam 0x7e
dec edi
ret 0xd2bc

Function at 0x4597a0
Capabilities:
Execute syscall

Disassembly:
sbb al, 0xe3
frstor dword [eax - 0x18]
and esp, ebx
add dword [ecx - 0xd6af231], edi
pop esp
or ebx, ecx
push 0xfb7ff4ac
sub bh, dl
mov dl, byte [ebx]
sbb al, 0xbe
int3
mov esp, 0x5c97c0e2
and ebp, esp
and ebx, dword [esi + 0x53]
rol dword [ecx], 0xde
jmp 0x54f20aa6
sbb ah, bl
cmpsd dword cs:[esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
or al, 2
movsb byte es:[edi], byte [esi]
push edx
jl 0x45974d
nop
add bh, byte [edx + 0x63c35933]
outsd dx, dword [esi]
xchg ebp, eax
mov esi, fs
test byte [ebp + 0x500c8ebc], bh
mov ebp, 0x74d3171b
mov al, byte [0x237948c]
pushfd
mov al, 0x54
adc eax, 0x368b62c
scasb al, byte es:[edi]
arpl si, sp
loop 0x4597ad
inc ebp
mov ah, byte [ebx - 0x23]
je 0x459808
jns 0x4597a4
jae 0x45978b
sbb dword [ebx + edx*8], edi
das
out dx, al
syscall
mov dword [0xa2b5bbec], eax
xchg ebp, eax
cmp eax, 0x1c833cd0
push ebx
cld
pop esp
cld
dec edi
inc edi
dec esp
adc byte [edi], ah
stosd dword es:[edi], eax
push edx
sbb al, byte [edx]
mov eax, dword [0xb2c15ca3]
in eax, 0x4f
ret 0xf0bc
xor edi, eax
adc byte [0x219f31c3], dh
mov ch, 0x6c
jae 0x459884
xchg edx, eax
invalid
fidivr word [edi]
xlatb
clc
push edi
xor ebp, dword [edx - 0x303ef34d]
and ebp, dword [edi + 0x51]
invalid

Function at 0x55502c
Capabilities:
Encode data using xor

Disassembly:
inc edi
inc edi
invalid
cld
pushal
sbb dword [edx - 0x78aa0a10], esi
js 0x554ff7
push 0x53
ret 0x41fa
or eax, dword [esi]
push ebx
lock dec byte [esi + 0x7d]
jnp 0x555013
add edx, ebx
outsb dx, byte [esi]
jmp 0x5550ae
or dword [eax + eax*8 - 0x5a], ebp
push eax
or eax, 0x46843474
xor al, 0x84
inc esi
salc
mov al, dl
push cs
test al, 0xce
in al, dx
and eax, 0x7bf35838
sti
rcl dword [edi + 0x2360113b]
pop esp
or bl, dl
mov dword [ebp + ebp*2 - 0x36], esp
cwde
mov ch, byte [ecx - 0x65]
push ecx
xchg ebx, eax
js 0x5550b5

Function at 0x5fb6e8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x5fb711
cmpsb byte [esi], byte es:[edi]
mov dh, 0x73
add al, 0xc0
wait
push ds
jnp 0x5fb712
sti
out 0xd2, eax
push ds
das
push edx
jmp 0x5fb6cc
push es
std
xor al, byte [esi - 0x57]
aaa
rol byte [ebx + 0x3417a697], cl
xchg byte [edi + 0x32], al
div edx
lahf
mov dl, 0x56
add al, 0xc9
cmp eax, 0x23cc8faa
inc edi
add ch, 0xe8
mov es, word [edx - 0x3b25fd67]
adc dword [edx], eax
ja 0x5fb710
in eax, 0x62
xchg esi, eax
or eax, 0xd3ef86c9
mov bl, 0x18
mov byte [0xe050bcc7], al
push esp
inc esi
pushal
cmp esp, esp
adc eax, 0x55725b32
xor bl, byte [edx - 0x4dc57519]
jb 0x5fb74a
cmp al, byte [edi + 0x6919ef8a]
imul ebx, dword [eax], 0x58
mov edx, 0x1670f7a3
retf 0x143b
Function at 0x402800
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x4028f7
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x402876
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x402844
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4029b0
call fcn.00402888
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x40294f
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x402908
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x4029b0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.00402440
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x4029ab
jmp 0x4029b0
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret