joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e0310
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x11c
test eax, eax
jne 0x100e0334
lea eax, [esp + 0x18]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA_1]
test eax, eax
je 0x100e0392
jmp 0x100e0356
mov edx, dword [esp + 0x124]
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x100e0392
mov cl, byte [edx]
mov byte [esp + 0x19], 0x3a
mov byte [esp + 0x18], cl
lea edx, [esp + 8]
lea eax, [esp]
push edx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x20]
push ecx
push edx
mov byte [esp + 0x2a], 0
call dword [sym.imp.kernel32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x100e0392
mov eax, dword [esp]
mov edx, dword [esp + 4]
mov ecx, 0xa
call fcn.100e3a30
add esp, 0x11c
ret
or eax, 0xffffffff
add esp, 0x11c
ret

Function at 0x100e0490
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
xor esi, esi
call dword [sym.imp.kernel32.dll_GetCurrentDirectoryA_1]
test eax, eax
je 0x100e04cd
lea ecx, [esp + 4]
push ecx
call fcn.100e1970
lea edx, [esp + 8]
push eax
push edx
call fcn.100e1f70
add esp, 0xc
pop esi
add esp, 0x104
ret
mov eax, esi
pop esi
add esp, 0x104
ret

Function at 0x100e04f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [esp + 0x11c]
push ebp
push esi
push edi
push eax
call fcn.100e2690
mov esi, dword [esp + 0x138]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], edx
test ebp, ebp
je 0x100e05de
test ecx, ecx
je 0x100e05de
inc ecx
push ebx
push ecx
call fcn.100e3947
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100e3920
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100e0572
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push ebx
push ebp
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x100e05c6
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x20]
push edx
push eax
push 0
push esi
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
je 0x100e05b3
cmp eax, 0xea
jne 0x100e05bb
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
push ebx
call fcn.100e3909
mov eax, dword [esp + 0x18]
add esp, 4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x114
ret
pop edi
pop esi
mov eax, edx
pop ebp
add esp, 0x114
ret
Function at 0x100e05f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.kernel32.dll_GetStartupInfoA_1]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x100e0631.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x100e0631.2
jmp dword [eax*4 + 0x100e06bc]
mov word [esp + 0x48], di
jmp 0x100e066a
mov word [esp + 0x48], 2
jmp 0x100e066a
mov word [esp + 0x48], 3
jmp 0x100e066a
mov word [esp + 0x48], 4
jmp 0x100e066a
mov word [esp + 0x48], 7
jmp 0x100e066a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.kernel32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x100e06b4
cmp dword [esp + 0x70], edi
je 0x100e06a0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.kernel32.dll_CloseHandle_1]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x100e0ab0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x100e0b2f
push edi
call fcn.100e1970
add esp, 4
test eax, eax
jbe 0x100e0b2f
test esi, esi
je 0x100e0aed
cmp esi, 0xffffffff
je 0x100e0aed
push esi
call dword [sym.imp.kernel32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x100e0b71
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x100e0b1b
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x100e0b2f
jmp 0x100e0b2a
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x100e0b2f
mov ebp, 1
test esi, esi
je 0x100e0b71
cmp esi, 0xffffffff
je 0x100e0b71
test ebp, ebp
jne 0x100e0ba8
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x100e0b7e
call edi
test eax, eax
je 0x100e0b71
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x100e0ba8
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x100e0b59
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x100e0b71
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x100e0ba8
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x100e0b8b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call fcn.100e1970
inc eax
push eax
call fcn.100dbaf0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
Function at 0x402694
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004030d4
test esi, esi
jne 0x4026ca
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403198
jmp 0x4026e8
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004025a8
mov edi, eax
test esi, esi
je 0x4026e8
cmp dword [ebx], 0
je 0x4026e8
dec esi
jmp 0x4026d1
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f58
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x402fb9
cmp word [0x406208], 0xd7b2
jne 0x402f81
cmp dword [0x406210], 0
jbe 0x402f81
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x40505c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x402fe0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x405020], 0
jne 0x402fd5
push 0
push 0x405054
push 0x40505c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403cc8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403d2e
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403208
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.0040276c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403d18
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d35
lea eax, [ebp - 0x10]
call fcn.004030d4
ret
Function at 0x404460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
mov byte [ebp - 1], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0x18]
mov eax, dword [eax + 0xc]
cmp eax, 2
je 0x404482
mov byte [ebp - 1], 1
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0x4044c8
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, ecx
mov esi, edx
test esi, esi
jl 0x4044e4
inc esi
xor edx, edx
mov cl, byte [eax + edx]
xor cl, 0x1f
mov byte [edi + edx], cl
mov ecx, edx
inc edx
dec esi
jne 0x4044d5
mov eax, ecx
pop edi
pop esi
ret

Function at 0x404590
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ecx, 9
mov ebp, esp
push 0
push 0
dec ecx
jne 0x404598
push ebx
push esi
push edi
mov eax, 0x404550
call fcn.00403f28
xor eax, eax
push ebp
push 0x404d8b
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x404d66
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00404460
test al, al
je 0x4045de
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x404d70
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00402694
mov eax, dword [ebp - 0x18]
call fcn.00403420
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x40666c], eax
xor eax, eax
push ebp
push 0x404d55
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
mov eax, dword [0x4050c8]
neg eax
push eax
mov eax, dword [0x40666c]
push eax
call sub.kernel32.dll_SetFilePointer
mov eax, dword [0x4050c8]
call fcn.00402464
mov dword [0x406678], eax
xor eax, eax
push ebp
push 0x4046ab
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x406674
mov eax, dword [0x4050c8]
push eax
mov eax, dword [0x406678]
push eax
mov eax, dword [0x40666c]
push eax
call sub.kernel32.dll_ReadFile
lea eax, [ebp - 0x20]
mov edx, dword [0x406678]
call fcn.004031d8
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.004042f8
mov edx, dword [ebp - 0x1c]
mov eax, 0x406680
call fcn.00403128
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4046b2
mov eax, dword [0x406678]
call fcn.00402484
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404d92
lea eax, [ebp - 0x48]
mov edx, 0xd
call fcn.004030f8
ret
Function at 0x401303
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
mov dword [0x4030c4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [eax + 8], ebx
push ebp
mov dword [0x4030cc], ebx
mov dword [0x4030c0], ebx
mov dword [0x4056ec], ebx
mov byte [0x4030d0], bl
mov dword [0x4047cc], ebx
mov dword [0x4030d4], ebx
call fcn.004010bf
push 4
mov eax, dword [0x4051f8]
push 0x3000
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x4047d0], eax
cmp eax, ebx
jne 0x40136e
push 0x403064
push 0xa4
call dword [0x4047b4]
call fcn.004012c7
mov dword [esp + 0x10], eax
cmp eax, 0x100
je 0x4014ba
cmp dword [0x4047c0], 0
je 0x4013d5
mov eax, dword [0x4030c4]
mov edx, dword [eax + 0x10]
cmp edx, dword [0x4030d4]
jae 0x4013d5
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0x28b]
add ecx, edx
push ecx
push 0x1402
push 0x111
push 0x404
push dword [eax + 0x173]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x4030c4]
add dword [eax + 0x10], 0x3e00
cmp dword [esp + 0x10], 0x100
jge 0x40140f
push dword [esp + 0x10]
call dword [0x4047b8]
mov eax, dword [0x4047d0]
mov cl, byte [esp + 0x10]
inc dword [0x4030d4]
mov byte [eax + ebx], cl
inc ebx
cmp ebx, dword [0x4051f8]
jne 0x40136e
xor ebx, ebx
jmp 0x40136e
mov ecx, 0x3e
mov eax, dword [esp + 0x10]
sub eax, 0x101
cdq
idiv ecx
mov esi, eax
mov ecx, dword [esp + 0x10]
imul eax, eax, 0xffffffc2
lea ebp, [eax + ecx - 0xfe]
movsx eax, word [esi*2 + 0x403020]
push eax
call fcn.00401097
add esp, 4
mov ecx, dword [esi*4 + 0x4051e0]
add ecx, eax
mov esi, ebx
add ecx, ebp
mov edi, ebx
sub edi, ecx
jns 0x40145a
add edi, dword [0x4051f8]
test ebp, ebp
jle 0x4014a1
mov dword [esp + 0x10], ebp
mov ecx, dword [0x4047d0]
movzx eax, byte [ecx + edi]
push eax
call dword [0x4047b8]
mov ecx, dword [0x4047d0]
inc dword [0x4030d4]
mov dl, byte [ecx + edi]
inc edi
mov byte [ecx + esi], dl
inc esi
cmp esi, dword [0x4051f8]
jne 0x401491
xor esi, esi
cmp edi, dword [0x4051f8]
jne 0x40149b
xor edi, edi
dec dword [esp + 0x10]
jne 0x401462
add ebx, ebp
cmp ebx, dword [0x4051f8]
jl 0x40136e
sub ebx, dword [0x4051f8]
jmp 0x40136e
xor esi, esi
cmp dword [0x4047c0], esi
je 0x401528
mov eax, dword [0x4030c4]
mov edx, dword [eax + 8]
test edx, edx
je 0x401528
cmp dword [eax + 0x18], esi
je 0x40151c
mov ecx, dword [eax + 0xc]
push esi
lea ebx, [esp + 0x18]
push ebx
push edx
push dword [ecx + 0x28f]
push dword [ecx + 0x187]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401503
mov eax, dword [0x4030c4]
mov ecx, dword [esp + 0x14]
cmp dword [eax + 8], ecx
je 0x40151c
mov eax, dword [0x4030c4]
mov eax, dword [eax + 0xc]
add eax, 0x18b
push eax
push 0x9c
call dword [0x4047b4]
mov ecx, dword [0x4030c4]
mov edx, dword [ecx + 8]
add dword [ecx + 0x14], edx
push 0x8000
mov eax, dword [0x4047d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret 4
Function at 0x40f15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40f168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40f14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40f145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40f145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret

Function at 0x40f1d2
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
jmp edx
mov ecx, dword [ebx + 0x28]
cmp ecx, 1
je 0x40f1c1
mov ecx, ebx
sub ecx, dword [ebx + 4]
xor cx, cx
mov dword [ebx + 0x24], ecx
add ecx, dword [ebx + 8]
mov esi, ecx
mov ecx, dword [ebx + 0xc]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 4
cmp edx, ecx
jl 0x40f1f5
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [ebx + 0x24]
add ecx, dword [ebx + 0x1c]
mov esi, ecx
mov ecx, dword [ebx + 0x20]
xor edx, edx
mov eax, dword [ebx + 0x10]
xor dword [esi + edx], eax
add edx, 4
cmp edx, ecx
jl 0x40f285
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov dword [ebx + 0x28], 1
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x24]
add edx, ecx
pop ebx
pop ebx
pop ebx
pop ecx
pop eax
pop edi
pop esi
mov dword [esp + 0x34], edx
jmp edx
Function at 0x4ea3bf
Capabilities:
Check http status code

Disassembly:
retf
jbe 0x4ea37a
dec edx
ja 0x4ea3de
mov eax, 0x1485f85f
invalid
mov cl, byte gs:[eax]
pushfd
invalid

Function at 0x53be27
Capabilities:
Encode data using xor

Disassembly:
clc
xchg ebx, eax
lodsb al, byte [esi]
mov dword [0xa1b4c73a], eax
retf
call 0x79588c50
test byte [ebx + esi*4], bh
xchg dword [edi], ebx
stc
sub eax, 0xc587b68d
inc edx
cmp cl, byte fs:[edi + 0x5d]
in eax, dx
dec ecx
dec ebp
push edx
xchg ebp, eax
xchg ebx, eax
pop ecx
xor ecx, edx
jbe 0x53be42
pop esi
stosb byte es:[edi], al
jge 0x53bde8
ror dword [edx - 0x3df49757], cl
mov dword [0x19041405], eax
lds edx, [eax + 0x57]
xlatb
pushfd
cmpsb byte [esi], byte es:[edi]
push edx
push ebx
retf

Function at 0x565f93
Capabilities:
Encode data using xor

Disassembly:
push ss
inc edi
push ds
fcmovu st(0), st(5)
dec eax
xlatb
xor ch, byte [ecx - 0x4f]
add byte [edi], cl
add dword [ecx], 0x5000ad1d
jg 0x565f3b
sbb eax, 0x7f5000ad
dec ebx
insb byte es:[edi], dx
xor esp, dword [ebp + 0x16ba26b4]
mov cl, bh
push ebp
js 0x565edc
and byte [eax], dh
shl dword [eax + 0x6e1d3806], 0xdc
outsb dx, byte [esi]
invalid
fsubr qword [ebp - 0x22]
mov ah, byte [edi + 0x1c]
mov dh, 0x26
popfd
xor ecx, dword [edx + 0x4a993bc4]
and eax, esi
inc edi
out dx, al
mov eax, 0x5ade6448
push esi
add dword [edx + edi - 0x66], ebp
add ah, byte [edx + edi*2]
and eax, 0x1c85cf8a
cmp al, ch
je 0x565fa6
mov dword [0x6d178d2c], eax
retf
mov eax, 0x7fc599d5
sar dword [0x6779d4cf], 8
xchg esp, eax
inc eax
cld
ret
fdivr qword [eax + ebx*2 - 0x675f09a]
jbe 0x565eea
xchg edi, edx
dec edx
inc dword [edx + 0x62]
add cl, al
jns 0x565fd3
mov ah, 0x84
sub byte [ebx], al
xchg ebx, eax
adc al, 0xf8
clc
mov eax, 0x19298af7
in al, 0x44
mov bh, cl
or dword [ebx - 0x58], edi
ror dword [esi + edx*8], cl
xor dword [esi], eax
js 0x565faa
psubusb mm1, qword [ecx - 0x716ad39b]
pop es
mov es, word [edi]
fcom dword [esi - 0x56]
jecxz 0x565f58
and eax, 0xb13f4d20
popfd
adc bl, bh
dec eax
loop 0x565fb9
xor cl, byte [ebp + 0x5c]
pop eax
mov ch, 0xba
and al, 0xd8
fst dword [ebx + 8]
pop es
push ebx
or byte [esi], bh
pop es
pop ebx
pop es
out dx, al
push 0xfffffffffffffffc
pop eax
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
wait
das
jb 0x565f71
cwde
mov ah, 0xa8
push esp
test al, 0x54
and ch, byte [ebx + 0x57]
sub ecx, ecx
jnp 0x56602a
xor al, 0x30
sub al, 5
mov dword [0x59642929], eax
mov bl, 0xe2
sbb ch, byte [ecx + esi*2]
sbb eax, dword [eax]
in al, 0xbb
in al, dx
lahf
and byte [edi + edi*4 + 0x68c40688], cl
mov ebx, 0x8c209fec
mov edi, 0x68c40688
cwde
retf
in al, 0x87
fdivr qword [eax]
invalid
Function at 0x5d8723
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x9c27a5b2
mov byte [0x539a2f9a], al
push ebx
je 0x5d86ea
cmp dword [edi + 0x56e7acbc], eax
and byte [eax], al
cmp eax, 0x4531df6f
aam 0x5a
loopne 0x5d874a
adc edx, dword [esi - 0x3ec19aeb]
pop ss
xchg esi, eax
adc eax, 0x17c13e65
out 0x9f, eax
scasd eax, dword es:[edi]
aad 0x55
jmp 0xb6c0f2a2
fucomp st(7)
in al, dx
xlatb
cmp al, 0xd8
inc edx
and ebp, esp
lahf
test eax, 0x222f4ae5
mov esi, 0x42d52305
pop ebp
loopne 0x5d8736
neg byte [edx]
outsb dx, byte [esi]
pushal
adc edx, esp
scasd eax, dword es:[edi]
add dword cs:[edx], ebx
push esp
wait
invalid

Function at 0x5d96b7
Capabilities:
Encode data using xor

Disassembly:
rcr ebx, 1
shl byte [ebp - 0x34], 1
dec ebx
xor eax, 0x47ee913a
in eax, dx
mov ah, 0x7f
xchg ecx, eax
mov dl, 0x94
mov eax, 0xec51c39a
pop ds
out 0x5b, eax
dec ebx
xchg ecx, eax
add bl, byte ds:[eax]
loop 0x5d9753
xor al, byte [edx + 0x4a8588c1]
movhps xmm2, qword [ecx]
jecxz 0x5d972d
sub dl, byte [ebx + 9]
inc dword [edi - 0x5910991]
cmc
xchg byte [edx], ah
pushfd
sub byte [0x9de6adb4], 0xbb
sbb byte [ecx + 0x2b], dh
xor al, dh
aad 0x34
mov dword [0xc1efb355], eax
lahf
dec esi
dec edx
pushal
lahf
sub edx, ebp
mov cl, 0x85
add eax, 0xdaa12218
jle 0x5d96ee
fidivr dword [esi - 0x24]
xchg ebx, eax
cmp dword [eax + 0x3e834f62], edx
mov ch, 0xa4
sbb cl, byte [esi]
mov dword [0x42cd8a9a], eax
movsd dword es:[edi], dword [esi]
lodsd eax, dword [esi]
into
push eax
invalid
push ss
outsd dx, dword [esi]
int1
xchg ebp, eax
jp 0x5d970f
jmp 0x5d972e
out 0xaa, eax
loop 0x5d9772
xor ecx, dword [ebx - 0x31]
and al, 0x11
sub eax, 0xe73561e7
sub dword [esi + 0x3c], edx
pop edi
adc al, 0xf5
cmp bl, dh
and dword [ebx - 0x20df27e8], esi
adc dword [edx - 0x7f], esi
jns 0x5d97a1
push edi
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
das
outsd dx, dword [esi]
test byte [edx], bh
push ebx
pop es
push ecx
inc edi
nop
and eax, 0x6584000
or bh, byte [esi]
mov eax, dword [0x185c199a]
stosb byte es:[edi], al
hlt
pushal
dec byte [ebx + 0x26]
dec ebx
or dword es:[ebx - 0x26], esp
les esi, [edx - 0x6b]
adc byte [edx - 0x69], bl
add ecx, eax
inc esi
push esi
pop eax
test eax, 0x3c2c1165
inc esp
inc esi
jnp 0x5d97c6
push ss
push 0xe42c4dae
pop ecx
adc byte [edi + ecx], cl
and eax, 0x2c61aa3e
test dword [edx - 0x35], ecx
lcall 0xb7c7, 0x4ed96cc1
out 0x4f, eax
sbb ecx, dword [eax]
sbb dword cs:[ecx + 0x7d], esp
push ebx
sbb esi, dword [edx + 0x4f552f0a]
invalid
Function at 0x405e97
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x43e74c], 0
jne 0x405ed5
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405eab
mov dword [ecx*4 + 0x43e748], eax
inc ecx
cmp ecx, 0x100
jl 0x405ea6
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x405f02
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x43e748]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x405ee3
not eax
pop ebp
ret 0xc

Function at 0x40daa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.AntiKill
lea edi, [esi - 0xa000]
push edi
or ebp, 0xffffffff
jmp 0x40dac2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40dac9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40dab8
mov eax, 1
add ebx, ebx
jne 0x40dadb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40dad0
jne 0x40daec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40dad0
xor ecx, ecx
sub eax, 3
jb 0x40db00
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40db72
mov ebp, eax
add ebx, ebx
jne 0x40db0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40db18
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40db3c
inc ecx
add ebx, ebx
jne 0x40db28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40db1d
jne 0x40db39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40db1d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40db5c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40db4d
jmp 0x40dabe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40db5c
add edi, ecx
jmp 0x40dabe
pop esi
mov edi, esi
mov ecx, 0x188
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40db7a
cmp byte [edi], 0
jne 0x40db7a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40db7f
lea edi, [esi + 0xb000]
mov eax, dword [edi]
or eax, eax
je 0x40dbf7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xe4f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xe570]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40dbac
mov ecx, edi
jns 0x40dbdb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xe574]
or eax, eax
je 0x40dbf1
mov dword [ebx], eax
add ebx, 4
jmp 0x40dbc9
call dword [esi + 0xe578]
popal
jmp 0x402687