joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10417d11
Capabilities:
Encode data using xor

Disassembly:
lea edx, [edx + 0x704f3b87]
cmp dx, cx
xor ebx, edx
cmp dl, 0x29
add ebp, edx
jmp fcn.1079f295
push dword [esp + 4]
popfd
lea esp, [esp + 0xc]
call fcn.1026ab1e
jnp 0x10417cfc
popfd
mov al, byte [0x75543492]
mov edi, 0x981b638b
pop edi
shl edx, 1
mov al, 0xe3
mov al, byte [0x2ebc70fc]
mov edi, 0x7aefb724
mov edi, 0x4f45f337
pop edi
add dword [esi], ebp
outsd dx, dword [esi]
xchg ebx, eax
mov al, byte [0x96a672f4]
pop edi
lodsd eax, dword [esi]
mov bl, 0xc3
mov al, byte [eax - 0x60]
mov byte [0xfda096e2], al
xor bh, ch
pushal
mov edi, 0x722f64ba
mov edi, 0x9f6023b3
pop edi
mov ecx, 0xa0e4cbf2
invalid

Function at 0x104273cc
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov dword [esp + 0xc], 0x87098bc7
pushfd
mov ebx, 0x6af15a9
sub ebx, 0x63ae4154
jno 0x1062373a
adc eax, 0xeb8106af
push esp
inc ecx
scasb al, byte es:[edi]
arpl word [edi], cx
adc dword [ebx - 0x3d], 0x5ce3001f
jecxz 0x10427445
push esi
xor edx, ebp
movsd dword es:[edi], dword [esi]
jns 0x104273d8
sub dword [ebx + 0xef7048c], 0xbab5ed2e
in eax, dx
mov ch, 0xba
inc esi
mov dword [0xf004209e], eax
je 0x10427456
aas
jns 0x1042744d
mov eax, dword [eax + 0x7a55f20f]
xchg ebp, eax
ror byte [ecx], cl
fmul qword [edi + 0x7a]
lds edx, [ecx + 0x2887e8f6]
mov byte [0x2bb0b936], al
xor ch, bh
mov byte [0x8085dc7d], al
mov bl, 0x4e
push ebp
invalid
adc al, 0x3a
salc
cmp dl, dh
jg 0x10427446
insd dword es:[edi], dx
xchg edx, eax
mov dl, 0x10
sbb esi, dword [edi]
adc byte [ebx], bl
aaa
jl 0x104273f5
mov bl, 0xe3
xor ch, byte [ecx - 0x67c0cb22]
fidiv word [edi + edi]
cwde
aam 0xd9
and bl, byte [ebx]
push ds
xchg edx, eax
fadd st(6)
jmp 0xcf60b436
not ebx
setg bl
mov ecx, 0x2ad30f61
mov ecx, dword [esp + 4]
or ebx, 0x6f9f35f6
call fcn.1047a381
Function at 0x104398ce
Capabilities:
Encode data using xor

Disassembly:
add dword [esp + 0x18], 0xeffae5e6
push dword [esp + 0x14]
jns 0x104c6947
leave
or byte [ecx - 0x14e63e8c], dl
invalid
dec edi
cmp eax, 0x4710f40b
test al, 0x20
iretd
jg 0x1011afcf
aam 0x83
lodsb al, byte [esi]
mov ecx, 0x2ab3a6a5
mov ebx, 0x95b64740
jno 0x104c68f5
xor byte [esi - 0x7a3dbb1a], ch
jecxz 0x104c69df
invalid
sbb bl, al
into
invalid
adc eax, 0xd5f83dff
xchg edi, eax
jo 0x104c6a60
inc esp
jae 0x104c699f
pop eax
xor eax, ebx
dec ebp
lea eax, [edi + ebx - 0x6e]
mov dword [edx - 0x2a], esp
insd dword es:[edi], dx
pop esi
adc dh, 0x96
in eax, 6
dec ecx
sub ah, dh
retf
jnp 0x104c6aa3
pop ebp
add esi, ecx
neg bl
pop edi
sub eax, 0x7fa4a1ad
and eax, 0xece65d27
cmp ebp, edi
pop esi
imul ebp, dword [ebp + 0xd], 0x1f05a864
bound esp, qword [ebp - 0x7b]
ljmp 0xc53f
sbb edi, dword [eax]
adc al, byte [0x3694435c]
je 0x104c6ad7
xchg edi, eax
jmp dword [esp + ecx*8]
dec eax
and dword [ebp + 0x34], 0xffffffa0
jmp 0x104c6b1f
pop es
test eax, esi
sbb ecx, dword [eax + 0x5d5d3a6a]
add dword [eax - 0x2ee0bf35], esp
mov al, byte [0xfeba3fb6]
xchg esp, eax
loopne 0x104c6b1a
mov al, byte [0x3d775c35]
mov eax, dword [0x66e23cc9]
xchg ebp, eax
out 0x52, eax
or esi, dword [edx - 0x372666cf]
mov ebp, 0x488a4454
xor eax, 0xbe484c4e
and al, 0x87
scasd eax, dword es:[edi]
mov ah, 0x3a
jl 0x104c6aee
add esp, 0x674885d7
cwde
or al, 7
pop es
mov ah, 0x7b
scasb al, byte es:[edi]
fimul word ss:[eax - 0x4d]
fimul word [eax - 0x4d]
aam 0x6a
push eax
js 0x104c6b22
xchg ebp, eax
dec edx
jle 0x104c6acf
pop esp
mov dl, 0xaf
jg 0x104c6b34
sbb al, ch
mov ah, 0xaa
push edx
and eax, 0x7c878043
pop es
mov cl, byte [eax + 0x26]
pushal
sbb al, 0xf6
xor al, 0xae
hlt

Function at 0x104484c1
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov edi, 0x144d3aa3
push edi
mov esi, dword [esp]
Function at 0x104a5f7d
Capabilities:
Encode data using xor

Disassembly:
shl ax, cl
jmp 0x103c1a11
dec eax
jmp fcn.106205a1
lea esi, [esi - 4]
mov eax, dword [esi]
xor eax, ebx
jmp 0x10166ce9
mov word [ebp + 4], ax
cmovno eax, edx
setnp ah
pushfd
jmp 0x1067a613
inc eax
fdiv dword [0xd92625a8]
mov al, 0x2b
movsd dword es:[edi], dword [esi]
inc edx
pushal
jle 0x104a5f6a
lodsd eax, dword [esi]
push ds
movsd dword es:[edi], dword [esi]
int1
mov ebx, 0x73b91043
pushfd
neg bl
mov dword [esp + 0xc], 0x25c541f2
add ebx, ebx
cmp ebx, 0x2e1b1892
push ebp
or al, 0xf2
inc ecx
lds esp, [0xfb81db03]
xchg edx, eax
sbb byte [ebx], bl
push ebp
call fcn.104f1f4e
add byte [edi], cl
cwde
ret 0x8166
sets dl
and word [esp + 0x14], 0x28e7
jg 0x1072cfb4
push ecx
call fcn.10505daf
and eax, 0xbd63e2bb
mov di, 0xcc60
mov bl, 0x9d
sbb dword [ecx + ecx*4], 0x4b9bc407
jp 0x104a5f4c
sbb al, 0x89
pop es
les ebx, [ebx - 0x515a85b5]
scasb al, byte es:[edi]
mov edx, 0xddc29fa4
and dl, ch
mov bh, 0x10
xchg edi, eax
sub edx, 0xfeaf9826
jae 0x104a600f
shl byte [ebx], 1
insb byte es:[edi], dx
or al, 0x67
and ebp, dword [esp + ecx + 0x67]
mov eax, 0xebd18b2b
pop esi
and dword [eax - 0xc], ebx
cmc
sar byte [ebx + 0x4e], 0x73
mov dl, 0x63
lodsd eax, dword [esi]
sub cl, al
mov eax, dword [0x2690e18a]
pop ds
fcmovu st(0), st(4)
dec ecx
inc ecx
jp 0x104a5f5f
mov dh, 0x58
jne 0x104a6009
sbb byte [ecx], dl
xchg ebx, eax
nop
xchg esp, eax
jge 0x104a5feb
ret
push ds
pop ebx
fcmovne st(0), st(5)
xchg edi, eax
jae 0x104a5f7c
js 0x104a5f9f
inc esp
inc dword [eax]
jnp 0x104a6031
stc
mov edx, dword [eax]
int1
xchg esp, eax
and al, 0xdc
mov ss, word [ebp + eax*8 + 0x147c942e]
outsd dx, dword [esi]
push esp
and byte [ebp + 0x28f9ccb], cl
scasb al, byte es:[edi]
and ecx, eax
invalid
stc
or eax, 0x6da7684b
jecxz 0x104a5fbb
push ecx
add ebx, dword cs:[ecx]
or dh, 0x92
mov edx, 0x653cb364
or byte [esi - 0x70], ah
inc edx
jp 0x104a6051
and byte [ebp + 0x44], 0xf6
push eax
cli
adc al, byte [edi - 0x7d]
outsb dx, byte [esi]
push edx
dec ebx
xor dh, byte [ebx - 0x79]
pop edi
cmp dword [esi], edi
test ebp, 0x82987c25
sal edi, 1
adc dh, ah
jl 0x104a6022
and eax, 0xd182987c
not dword [eax]
out 0x7c, al
mov dword [ebp + 0x3e], 0x3a54884a
imul ebp, dword [ecx + esi*2], 0x80218d83
and eax, 0xad9c11b3
adc dword [ebp + 0x44], 0x55
inc ebp
dec edx
mov byte [edx + edi + 0x69], dl
sub al, 0x71
or dword [ebp - 0x1f7e7fdf], 0xffffffb3
adc dword [ebp + ebp*4 + 0x55445583], ebx
sbb al, 0x3f
invalid
lea esp, [esp + 0x40]
ret
pop dword [ebp]
jmp 0x102ce5ef
mov edx, dword [esp + 0x30]
jbe 0x105ef504
cmp dword [esp + 0x14], 0x521310a8
call int.1077e6b2
lea ebp, [ebp - 2]
jmp 0x100cc925

Function at 0x104b4b02
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], 0xbda02b83
push ebp
pushfd
mov ebp, 0x181f1d0a
mov ebp, dword [esp + 4]
popfd
lea esp, [esp + 0x14]
call fcn.10261ac8
sbb dword [esi], 0xffffff88
arpl word [edi], ax
enter 0x63be, 0x60
mov esp, 0x481226b7
lcall 0xc12a, 0xd92d85cd
cli
mov ah, 0xaa
sahf
pop ebp
push 0x55c698cb
invalid
Function at 0x104d0c97
Capabilities:
Encode data using xor

Disassembly:
add dword [esp], 0xffec39a0
mov ebp, edx
not edx
call fcn.105f909d
cmp esp, ebp
dec dword [ebx - 0x172d0816]
shr al, cl
cmc
adc dword [edx], 0
sub eax, 0x94aa8a0f
xchg edx, eax
cmovg ebx, dword [eax]
daa
add byte [eax], 0xb0
dec esi
adc ecx, dword [edi - 0x792e8476]
xor dl, byte es:[ecx - 0x7a]
mov dword [0x63cf8052], eax
mov bh, 0x56
xchg dword [ecx], edx
mov byte [edi + 0x54f90d92], dl
das
or edx, dword [edi - 0x361dbd4f]
mov dl, 0x7f
push edi
and al, 0x42
sbb dword [edx + edi*2], 0x6f
or esp, dword [esp + 0x7a]
pop esi
and dword [esi - 0x33], esp
std
fimul dword [ebx + 0x44ad0a95]
bound esp, qword [edx]
push eax
and byte [edx + 0x1e], dl
lea esp, [edi]
mov dword [0x6fd4c484], eax
sbb bl, bh
xor al, 0xca
jne 0x104d0cf1
add esp, dword [edx]
jnp 0x104d0ca2
jno 0x104d0c9c
mov ebp, 0x499d6db5
inc esp
lcall 0xd7d0, 0x1f31420c
test byte [ebx - 0x1a], dh
add al, 0x6d
retf 0x5532

Function at 0x105157e3
Capabilities:
Encode data using xor

Disassembly:
bswap esi
not esi
mov dword [esp + 4], esi
add dword [esp + 0xc], 0xff96a9bf
push 0x2e6c109c
push ebx
push ecx
or word [esp + 0x10], si
mov ebx, esi
mov edx, dword [esp + 0x18]
mov edx, dword [edx]
call fcn.1012ac54
xor ebx, edx
das
mov edi, 0x19e907ea
xchg esp, eax
add byte [esi], 0x63
ror byte [ebx], cl
outsd dx, dword [esi]
invalid

Function at 0x1052357a
Capabilities:
Encode data using xor

Disassembly:
not dword [esp + 0x18]
call fcn.1060d1c5
cmp edx, ecx
test al, 0xde
pop edx
xor al, 0xe9
add eax, 0xe710dc9
mov ebp, 0x62425cc9
jmp 0x105235ea
insb byte es:[edi], dx
leave
adc byte [ebp + 0x33], al
jnp 0x10523618
inc ebp
xor edi, dword [ebx + 0x45]
inc edx
clc
inc edi
xchg ecx, eax
nop
sub dword [edx + 0x60], edi
jae 0x105235cf
dec esi
sbb edi, esp
inc esp
invalid
jge 0x105235cc
fldenv [eax + 0x41580d45]
invalid
mov edx, 0x79f7e8b6
xchg edi, eax
mov ch, 0x3b
sal dh, 1
sub al, 0x63
push es
cmp cl, bh
add eax, 0x4e29f286
pop esp
mov byte [ebp - 0x6d], ch
sub edi, dword [ecx - 0x2f]
test eax, 0x4780df8d
invalid

Function at 0x105780d8
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x10], ebp
mov edx, 0xc5a33b6
adc byte [edx + 0xc5a33b6], bh
pushfd
xor edx, edx
and edx, 0x42195573
add dword [esp + 4], 0xef831239
xor dl, 0x22
add dword [esp + 0xc], 0xe40ae
call fcn.107c20e7
wait
jecxz 0x105780db
sub byte [edi - 0x7136fce8], 0xa6
push ss
ficomp dword [ecx - 0x3bd89346]
mov al, 0x44
mov ecx, 0x8e0fc1fa
add al, 0x9d
fnstcw word [ebx + edi*4 + 0x1f]
adc byte [ecx - 0x6943198f], dl
sal byte [ecx + 0x22], 0x62
mov esp, ebp
jno 0x10578127
sub edi, dword [esi]
xchg ecx, eax
inc esp
invalid
Function at 0x105a5601
Capabilities:
Encode data using xor

Disassembly:
call fcn.106bbe1c
call fcn.106bbe1c
call fcn.103eaec1
xchg edx, eax
pop esp
arpl word [ecx + esi*4 - 0x71c7d46d], bp
sbb eax, 0x8e143445
xchg edi, eax
sub byte [ebx - 0x3c314497], al
wait
mov eax, 0xdd723144
xor dword [esi - 0x1e60a86c], ecx
mov fs, ecx
pop ebp
inc esi
mov cl, 0xba
aas
pushal
pop eax
cwde
inc esp
xchg esi, eax
mov dword [ebp + 0x27], ebx
mov cs, word [edi]
rol byte [ebp + 0x54], cl
mov ebx, 0xc9084760
jno 0x105a5600
out dx, eax
or ch, al
jno 0x105a565d
add dword [0x60cb71c4], edx
mov byte [0xa7de44b9], al
mov edx, 0x9c1dbb68
xor byte [0xc7f11f71], ch
sub eax, 0xc7f11f71
jmp 0x11262bf4

Function at 0x105ab499
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x54b61d94
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0xc]
mov esi, dword [esi + ecx - 0x54b61d94]
mov dword [esp + 0xc], ecx
push edi
push esi
mov esi, 0x67092227
mov esi, dword [esp]
lea esi, [esi + ecx*2 - 0x4fe0c371]
add ecx, 0x44cf2415
mov dword [esp], ecx
sub dword [esp + 0x14], 0x66dc0b5b
push ebp

Function at 0x105c7add
Capabilities:
Encode data using xor

Disassembly:
sti
dec dword [edi]
setge byte [esp + 8]
setge byte [esp + 8]
push dword [esp + 0x18]
popfd
lea esp, [esp + 0x1c]
call fcn.1049af8c
imul esp, eax, 0x2f78b894
aad 0x74
mov gs, word [ecx - 0x715b68c6]
in al, dx
add byte [esi - 0xc], cl
mov edx, 0xdd503d62
inc esp
xor eax, 0x55
bound ecx, qword [esi + 0x114dab76]
mov ebx, 0x8c002629
jno 0x105c7b00
dec esi
hlt
xchg esi, eax
add ch, byte [ebp + 0x1d582871]
xor dword [ecx - 0x1e], 0x44fcaa01
out dx, eax
cmp edx, dword [ecx - 0x3e6a44d5]
dec edi
jnp 0x105c7adb
inc ebp
dec edi
pushfd
or dl, byte gs:[ebx + ebx*8 - 0x2fcab151]
test byte [eax], dh
cwde
add ecx, ebp
mov ch, 0x24
pop esi
xchg ecx, eax
and al, 0x93
dec ebx
dec eax
call 0x8afd19a3
loopne 0x105c7bb0
xchg esi, eax
jp 0x105c7b5e
adc ecx, 0xf37e86d0
add al, 0xe5
add al, 0xe5
jge 0x105c7b60
bound edx, qword [esi - 0x4f]
mov dword [0xbc277998], eax
dec esp
push ebx
mov cl, 0xa3
cwde
jns 0x105c7b8c
mov esp, 0x534c64f2
mov ch, 0x75
mov al, 0x7a
mov ecx, 0x7a925a97
wait
cmpsd dword [esi], dword es:[edi]
loopne 0x105c7bf6
test dword [ecx + eax - 0x50], ebx
push esp
jnp 0x105c7b82
sbb eax, 0xee4186b9
out dx, al
test edx, ebp
outsb dx, byte [esi]
dec ebx
sub eax, 0x1e0d4e79
push ds
inc eax
adc dword [ecx + 0x73], esi
jnp 0x105c7b5a
push cs
retf 0x9b54
mov eax, 0xe5515dbe
inc esp
sub cl, byte [eax + ebx*8 - 0x64]
loopne 0x105c7bd4
mov al, byte [0xa5c6ad7d]
mov bh, dh
mov byte [0xd6ec9c12], al
pop ss
push esi
adc bl, byte [esp + ebp*8 + 0x56172ed6]
lcall 0x914e, 0x1f8b4256
out 0x87, eax
adc esp, dword [eax - 0x73]
in eax, dx
retf
jp 0x105c7bf0
sub cl, dh
dec edi
mov ecx, 0x6052605c
mov dword [ebx - 0x2e], ebp
cwde
add al, 0x93
lodsb al, byte [esi]
xlatb
stosb byte es:[edi], al
fcmovnu st(0), st(2)
cmp ch, byte [ecx + 0x278cd5a1]
dec edx
lodsd eax, dword [esi]
cli
cwde
rcl dword [eax - 0x7b], 0xba
adc dh, 0x7b
ja 0x105c7bab
test dword [edx + 0x777bd680], edi
scasb al, byte es:[edi]
loopne 0x105c7bbf
movsd dword es:[edi], dword [esi]
mov edx, 0xa2218507
test byte [ebx - 0x7a46b1fd], ch
leave
sahf
retf
Function at 0x1062fbd7
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x2e3f7e48
cmovg bp, dx
or bp, 0x7c40
mov edx, dword [esp + 0x10]
add dword [esp + 4], 0x4ef4f8
cmp ebp, 0x2ada2215
lea esp, [esp + 4]
ret
jmp fcn.1051738e
mov dh, 0xc6
pushfd
sbb ax, sp
cmovb eax, esp
not al
pop dword [esi]
movsx eax, cx
and ah, 0x15
lea edi, [edi - 4]
mov eax, dword [edi]
test di, cx
xor eax, ebx
lea eax, [eax - 0x29a92ddd]
cmp esp, 0x3c3e0f89
cmp ebx, esi
neg eax
not eax
test ecx, esp
bswap eax
stc
xor ebx, eax
test edx, esp
add ebp, eax
jmp 0x105fd2f2
jb 0x103bdd52
call fcn.1050dc0a
jns 0x1062fc3d
sub bl, bl
inc esi
adc ebp, 0x463fbb69
int 0xb8
inc esp
movsb byte es:[edi], byte [esi]
dec dword [ebx - 0x3dd671cf]
leave
loope 0x1062fb88
sbb al, 0xfc
adc byte [ecx + 0xefde6ba], dh
push cs
cwde
inc esp
xor ecx, dword [eax]
or esp, dword [edi]
mov es, word [esi - 0x44abeca9]
mov ebp, 0x71c95eee
xor byte [esi + 0x5c], dl
call 0x5aafcc8c
in al, dx
jno 0x1062fc79
pop ds
int 0xda
lea ecx, [edx + 0x6259caca]
add byte [ecx + 0x36], ah
daa
and dword [edx + edx + 0xc], esi
pop ss
imul dword [ebx + 6]
pop ss
xchg edi, eax
invalid
mov cl, dl
retf 0x6259
cmp edx, dword [0x78a247dd]
mov edx, 0xcc54b7f
mov esp, 0x17b57792
les eax, [ecx + 0x78]
adc al, 0x4f
inc ecx
sbb eax, ebp
shl byte [ecx + 0x201a66fb], 0xda
cmpsd dword [esi], dword es:[edi]
pop ss
jecxz 0x1062fcab
sti
sbb ah, byte [eax]
fisub dword [edi - 0x3fb51ce9]
and ecx, dword [0xc090f7bc]
wait
shl byte [ebx], 0xd
mov esp, 0x9bc090f7
ja 0x1062fc22
in al, 0xc5
out dx, eax
jg 0x1062fc58
in al, dx
ljmp 0xabf1
mov cl, 0x33
jno 0x1062fc01
popfd
fiadd word [ebx + edx*4 + 0x76]
jge 0x1062fc56
dec ebp
in eax, dx
and al, 0x65
adc esi, dword [ecx + 0x355c2bbd]
dec ebp
mov bh, 0x5a
sbb ecx, dword [ebp + 0x6c]
in eax, dx
push esp
imul esi, dword [ecx + 0x6b803418], 0x41263bea
xchg ecx, eax
sbb dl, byte [edx + 0x66]
invalid
mov edi, 0x5c7c1cef
mov dword [0x41419cb2], eax
mov dl, 0x9c
inc ecx
inc ecx
push es
test byte [edx - 0x55fbd62f], dl
stosd dword es:[edi], eax
xor esi, dword [eax + eax*4 - 0x7e]
push esi
sbb eax, 0x93cd0984
inc edx
lahf
sbb al, 0x13
add byte [esi + 0x63], bl
adc ebp, edi
sti
jnp 0x1062fca5
add ebp, ebp
movsb byte es:[edi], byte [esi]
pushal
push ss
mov ah, ah
int 0xe9
add ebp, edi
test dword [edx], eax
xchg byte [ecx], bl
aaa
stosb byte es:[edi], al
test dword [edi], esi
rol dword [eax - 0x4f1c2706], 0xbf
sub al, 0x67
fsub st(6)
ja 0x1062fd19
adc dword [edx + eax + 0x12], esp
mov ah, 0xdc
mov edx, 0xa1c585bb
inc esp
add ah, byte [0x3a8361df]
sbb eax, 0x3bca2863
call 0x26428c17
hlt
add esi, dword [eax + 0x1a18478e]
sal ebx, 1
sbb al, 0x3c
dec eax
outsd dx, dword [esi]
invalid

Function at 0x106bc8ab
Capabilities:
Check for software breakpoints

Disassembly:
not bp
mov ebp, dword [esp + 0x10]
test dword [esp + 0x20], edx
call fcn.100f268d

Function at 0x10722f6b
Capabilities:
Encode data using xor

Disassembly:
mov ebp, dword [esp + 0x1c]
call fcn.10050da2
Function at 0x107516d8
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x4ff73b28
push ebp
pushfd
xor di, 0xbd4
jbe 0x107516dd
mov ebp, edi
mov edi, dword [esp + 0xc]
mov dword [esp + 0xc], 0xe830908a
xor ebp, 0x1a904f25
cmp bp, 0x6e6
mov ebp, dword [esp + 4]
call fcn.104bfcec
leave
imul esp, dword [eax - 0x69], 0xf607efc8
pop ds
invalid

Function at 0x107bc009
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 0x14]
popfd
lea esp, [esp + 0x20]
call fcn.102cfe90
and al, ch
jns 0x107bc053
mov cl, 0xff
mov edx, 0x78aa018d
cwde
mov ah, 0xa3
mov esi, 0xbdc99136
xor edi, edx
les edi, [eax - 0x10]
jns 0x107bc011
stosd dword es:[edi], eax
in eax, dx
dec esi
iretd
invalid
Function at 0x40eb95
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0040ed45
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x40ec93
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x40ec36
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x40ec79
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x40ec4d
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x40ec68
test al, 0x40
je 0x40ec5f
mov ecx, dword [edi + 0x20]
jmp 0x40ec66
test al, 0x80
je 0x40ec79
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x40ec79
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x40ec05
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret
Function at 0x428fe0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f31bb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004e493e
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x429062
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004e15e4
mov eax, dword [eax]
push 0x64a278
push eax
call fcn.004c11a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004e4bc9
test bl, bl
je 0x429062
push 0x64a278
lea ecx, [esp + 0xc]
call fcn.004e4fa5
push 0x64de08
lea ecx, [esp + 0xc]
call fcn.004e4fa5
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x42909e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004e4bc9
jmp 0x429169
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x429122
lea edx, [esp + 0x7c]
push 0x64de04
push edx
call fcn.004c11a4
add esp, 8
test eax, eax
je 0x429122
lea eax, [esp + 0x7c]
push 0x64de00
push eax
call fcn.004c11a4
add esp, 8
test eax, eax
je 0x429122
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4290b2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004e4bc9
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4
Function at 0x42a3c0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4f331b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x658194]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x42a4f8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x42a426
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e4bc9
xor eax, eax
jmp 0x42a56f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.004e4d52
push esi
lea ecx, [esp + 0xc]
call fcn.004e4fe1
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x64de40
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x42a54d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push 0x64de38
push closesocket
call fcn.004768c0
test eax, eax
jne 0x42a54d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push 0x64de24
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.004768c0
test eax, eax
jne 0x42a54d
lea eax, [esp + 0x14]
push 0x64de1c
push eax
call fcn.004c2360
mov esi, eax
add esp, 8
test esi, esi
jne 0x42a52c
lea ecx, [esp + 0x14]
push 0x64de18
push ecx
call fcn.004c22e0
mov esi, eax
add esp, 8
test esi, esi
jne 0x42a52c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x42a52f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.004e4d02
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x42a43e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.004e4bc9
xor eax, eax
jmp 0x42a56f
mov byte [esi], 0
push 0x64de14
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.004e4bc9
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4