joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40420f
Capabilities:
Access pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push ebx
call sub.ntoskrnl.exe_RtlImageNtHeader
test ebx, ebx
jne 0x404227
xor eax, eax
jmp 0x40429b
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 1
push ebx
call sub.ntoskrnl.exe_RtlImageDirectoryEntryToData
mov esi, eax
test esi, esi
je 0x404298
mov eax, dword [esi + 0x24]
add eax, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x20]
add edi, ebx
mov ebx, dword [esi + 0x1c]
add ebx, dword [ebp + 8]
xor ecx, ecx
cmp ecx, dword [esi + 0x18]
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
jae 0x404289
jmp 0x404260
mov ecx, dword [ebp - 4]
mov eax, dword [edi + ecx*4]
add eax, dword [ebp + 8]
push eax
push dword [ebp + 0xc]
call sub.ntoskrnl.exe_strcmp
test eax, eax
pop ecx
pop ecx
je 0x404280
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x18]
jb 0x40425d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp ecx, dword [esi + 0x18]
pop edi
jae 0x404298
movzx eax, word [eax + ecx*2]
mov eax, dword [ebx + eax*4]
add eax, dword [ebp + 8]
jmp 0x40429a
xor eax, eax
pop esi
pop ebx
leave
ret 8

Function at 0x404302
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, 0x160
push edi
mov eax, esi
mov word [ebp - 0x10], 0x16
mov word [ebp - 0xe], 0x18
mov dword [ebp - 0xc], 0x4092e4
mov dword [ebp - 8], esi
call fcn.004081c0
mov edi, esp
lea eax, [ebp - 8]
push eax
push esi
push edi
push 2
push 0xffffffffffffffff
call dword [sym.imp.ntoskrnl.exe_ZwQueryObject]
test eax, eax
jl 0x404381
mov eax, dword [edi + 0x5c]
xor esi, esi
mov dword [0x41d710], eax
add eax, 0xfffffff9
je 0x404381
push 7
push str.System
call dword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
add eax, esi
push eax
call dword [sym.imp.ntoskrnl.exe_RtlCompareMemory]
cmp eax, 7
je 0x40437b
mov eax, dword [0x41d710]
inc esi
add eax, 0xfffffff9
cmp esi, eax
jne 0x404351
jmp 0x404381
mov dword [0x41d70c], esi
push 0x40415e
push 0x40414f
lea eax, [ebp - 0x10]
push eax
push 0x404196
call fcn.004041ba
test eax, eax
je 0x404443
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
jl 0x404443
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
mov word [ebp - 0x20], 0x12
mov word [ebp - 0x1e], 0x14
mov dword [ebp - 0x1c], 0x40941c
mov word [ebp - 0x18], 0x18
mov word [ebp - 0x16], 0x1a
mov dword [ebp - 0x14], 0x409400
call dword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
push str.LoadLibraryExA
push 0xffffffffffffffff
call fcn.0040416d
push eax
lea eax, [ebp - 0x18]
push eax
mov esi, 0x4042de
push esi
call fcn.004042a0
push eax
call fcn.0040420f
push str.ZwTerminateProcess
push 0xffffffffffffffff
mov dword [0x41d718], eax
call fcn.0040416d
push eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.004042a0
push eax
call fcn.0040420f
mov dword [0x41d71c], eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov ecx, dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea esp, [ebp - 0x40]
pop edi
pop esi
leave
ret
Function at 0x40444a
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 8], 0x1000
cmp dword [ebp - 8], esi
ja 0x40446a
add esi, 0x1000
mov dword [ebp - 8], esi
test ebx, ebx
je 0x40447a
push 0x24242424
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov esi, dword [ebp - 8]
push 0x24242424
push esi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
je 0x4044aa
lea eax, [ebp - 8]
push eax
push esi
push ebx
push 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
mov dword [ebp - 4], eax
je 0x40445c
jmp 0x4044b1
mov dword [ebp - 4], 0xc0000017
cmp dword [ebp - 4], 0
jl 0x404511
push edi
mov edi, dword [ebx]
lea esi, [ebx + 4]
mov dword [ebp - 4], 0xc0000135
jmp 0x4044fe
movzx eax, word [esi + 0x14]
dec edi
sub eax, 0
je 0x4044e4
dec eax
je 0x4044dd
movzx eax, word [esi + 0x1a]
lea eax, [eax + esi + 0x1c]
jmp 0x4044e9
mov eax, str.hal.dll
jmp 0x4044e9
mov eax, 0x409438
push dword [ebp + 8]
push eax
call sub.ntoskrnl.exe__stricmp
test eax, eax
pop ecx
pop ecx
je 0x404504
add esi, 0x11c
test edi, edi
jne 0x4044c6
jmp 0x404510
mov edi, dword [ebp + 0xc]
and dword [ebp - 4], 0
push 0x47
pop ecx
rep movsd dword es:[edi], dword [esi]
pop edi
test ebx, ebx
je 0x404521
push 0x24242424
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8

Function at 0x40452a
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 4]
movzx eax, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
push esi
xor esi, esi
test ecx, ecx
push edi
jbe 0x40455e
mov edx, dword [eax + 0xc]
cmp dword [esp + 0x14], edx
jb 0x404556
mov edi, dword [eax + 0x10]
add edi, edx
cmp dword [esp + 0x14], edi
jb 0x404560
add eax, 0x28
inc esi
cmp esi, ecx
jb 0x404542
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x405660
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 8]
cmp word [ecx], 0x5a4d
je 0x405674
or eax, 0xffffffff
jmp 0x4056ee
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40566f
push esi
mov esi, dword [eax + 0x78]
add esi, ecx
mov eax, dword [esi + 0x18]
push edi
mov edi, dword [esi + 0x20]
add edi, ecx
test eax, eax
mov dword [ebp - 8], eax
jne 0x40569c
or eax, 0xffffffff
jmp 0x4056ec
and dword [ebp - 4], 0
push ebx
mov ebx, dword [esi + 0x24]
add ebx, ecx
test eax, eax
jle 0x4056db
jmp 0x4056af
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [edi + eax*4]
push dword [ebp + 0xc]
add eax, ecx
push eax
call sub.ntoskrnl.exe_strcmp
test eax, eax
pop ecx
pop ecx
je 0x4056d3
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x4056ac
jmp 0x4056db
cmp word [ebp - 4], 0xffff
jne 0x4056e0
or eax, 0xffffffff
jmp 0x4056eb
movzx eax, word [ebp - 4]
movzx eax, word [ebx + eax*2]
add eax, dword [esi + 0x10]
pop ebx
pop edi
pop esi
leave
ret 8
Function at 0x4065e7
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x16c
push ebx
push edi
xor ebx, ebx
push 0x62
lea eax, [ebp - 0x66]
push ebx
push eax
mov dword [ebp - 4], ebx
mov word [ebp - 0x68], bx
call sub.ntoskrnl.exe_memset
mov edi, dword [ebp + 0xc]
add esp, 0xc
cmp word [edi], 0x5a4d
je 0x40661b
xor eax, eax
jmp 0x4067de
mov ecx, dword [edi + 0x3c]
add ecx, edi
cmp dword [ecx], 0x4550
jne 0x406614
mov eax, dword [ecx + 0x78]
mov edx, dword [ebp + 0x10]
add eax, edi
push esi
mov esi, dword [eax + 0x10]
cmp edx, esi
jb 0x4067db
sub edx, esi
cmp edx, dword [eax + 0x14]
ja 0x4067db
mov esi, dword [eax + 0x1c]
lea edx, [esi + edx*4]
mov esi, dword [edx + edi]
add esi, edi
cmp esi, eax
jb 0x40671b
mov ecx, dword [ecx + 0x7c]
add ecx, eax
cmp esi, ecx
jae 0x40671b
push 0x2e
push esi
call sub.ntoskrnl.exe_strchr
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
je 0x4067db
push 0x104
lea eax, [ebp - 0x16c]
push ebx
push eax
call sub.ntoskrnl.exe_memset
mov eax, edi
sub eax, esi
push eax
lea eax, [ebp - 0x16c]
push esi
push eax
call sub.ntoskrnl.exe_strncpy
lea eax, [ebp - 0x16c]
push str..dll
inc edi
push eax
mov dword [ebp + 0xc], edi
call sub.ntoskrnl.exe_strcat
mov ebx, dword [ebp + 8]
add esp, 0x20
xor esi, esi
lea edi, [ebx + 0x90]
push edi
call sub.ntoskrnl.exe_wcslen
cmp eax, 2
pop ecx
jbe 0x406722
lea eax, [ebp - 0x16c]
push eax
lea eax, [edi - 0x28]
push eax
call sub.ntoskrnl.exe__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x406732
cmp byte [edi + 0x54], 1
jne 0x406732
cmp dword [edi + 0x50], eax
je 0x406732
imul esi, esi, 0xac
mov esi, dword [esi + ebx + 0xe0]
test esi, esi
je 0x4067db
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push esi
call fcn.00405660
push eax
push esi
push ebx
call fcn.004065e7
mov esi, eax
mov eax, esi
jmp 0x4067dd
push edi
call sub.ntoskrnl.exe_wcslen
test eax, eax
pop ecx
jne 0x406732
cmp dword [edi + 0x50], eax
je 0x40673e
inc esi
add edi, 0xac
cmp esi, 0x14
jl 0x4066c2
imul esi, esi, 0xac
lea eax, [ebp - 0x16c]
push eax
add esi, ebx
call sub.ntoskrnl.exe_strlen
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [esi + 0x68]
push eax
call sub.ntoskrnl.exe_memcpy
push 0x64
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x16c]
push eax
call sub.ntoskrnl.exe_strlen
add esp, 0x20
xor ecx, ecx
cmp eax, ebx
jl 0x406799
movsx dx, byte [ebp + ecx - 0x16c]
mov word [ebp + ecx*2 - 0x68], dx
inc ecx
cmp ecx, eax
jle 0x406786
mov word [ebp + eax*2 - 0x68], bx
lea eax, [ebp - 0x68]
push eax
call sub.ntoskrnl.exe__wcsupr
push eax
lea edi, [esi + 0x90]
push edi
call sub.ntoskrnl.exe_wcscat
add esp, 0xc
push edi
push ebx
push ebx
mov byte [esi + 0xe4], bl
push ebx
xor esi, esi
push 0x405926
inc esi
push esi
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
push eax
call fcn.004057e6
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret 0x10
Function at 0x408036
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor edx, edx
xor eax, eax
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jb 0x408043
mov byte [edi + 0x100], dl
mov byte [edi + 0x101], dl
xor ebx, ebx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 8]
movzx ecx, byte [ebx + edi]
movzx esi, dl
movzx eax, byte [esi + eax]
add eax, dword [ebp + 0x10]
add eax, ecx
and eax, 0x800000ff
jns 0x408080
dec eax
or eax, 0xffffff00
inc eax
movzx eax, al
push eax
push ebx
push edi
mov dword [ebp + 0x10], eax
call fcn.00408017
xor edx, edx
lea eax, [esi + 1]
div dword [ebp + 0xc]
inc ebx
cmp ebx, 0x100
jb 0x40805f
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4080a6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov bl, byte [esi + 0x100]
mov al, byte [esi + 0x101]
jbe 0x40814d
push edi
movzx edi, bl
movzx eax, al
jmp 0x4080d6
mov eax, dword [ebp - 8]
lea ebx, [edi + 1]
and ebx, 0x800000ff
jns 0x4080e9
dec ebx
or ebx, 0xffffff00
inc ebx
movzx edi, bl
movzx ecx, byte [edi + esi]
add eax, ecx
and eax, 0x800000ff
jns 0x408100
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + 0x13], al
movzx eax, al
push eax
push edi
push esi
mov dword [ebp - 8], eax
call fcn.00408017
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
movzx edx, byte [edi + esi]
add eax, ecx
mov ecx, dword [ebp - 8]
movzx ecx, byte [ecx + esi]
add ecx, edx
and ecx, 0x800000ff
jns 0x408136
dec ecx
or ecx, 0xffffff00
inc ecx
movzx ecx, cl
mov cl, byte [ecx + esi]
xor byte [eax], cl
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x4080d3
mov al, byte [ebp + 0x13]
pop edi
mov byte [esi + 0x100], bl
mov byte [esi + 0x101], al
pop esi
pop ebx
leave
ret 0xc
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040a7e3
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040a7e3
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040a7e3
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040a7e3
mov dword [0x41203c], eax
call fcn.0040a7e3
test eax, eax
jge 0x402550
push 8
call fcn.0040a7e3
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040a7e3
pop ecx
push 1
call fcn.0040a7e3
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040a7e3
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040a7e3
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040a7e3
jmp 0x402495

Function at 0x40a7e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40a7f2
pop dword [ebp - 0x4c]
mov eax, 0xafad78d2
sub eax, 0xaf6cd0e0
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3d68b
push 0
mov eax, 0xf89d607e
sub eax, 0xf85c7fa6
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x58cd
mov edx, eax
mov ebx, 0xe47a4a66
add ebx, 0x1bc6f15e
add ebx, dword [ebp - 0x4c]
mov edi, 0xeb1d0033
add edi, 0xbd64f767
xor dword [ebp - 0x30], 0x9412b1d1
mov esi, dword [ebx]
sub dword [ebp - 0x34], 0x64a7982c
add esi, edi
sub dword [ebp - 0x38], ebx
mov dword [edx], esi
add dword [ebp - 0x30], 0x5ab54243
add edx, 0xef499a19
sub edx, 0xef499a15
add ebx, 0x36aa2afd
add ebx, 0xc955d507
loop 0x40a84b
add eax, 0xb5cd8f40
sub eax, 0xb5cc3939
mov ebx, eax
add eax, 0x6a69070a
add eax, 0x9596f8fb
mov ecx, 0x5f009cb5
sub ecx, 0x5ec09cb5
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [section..data]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x4016d4
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x4016c3
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x4016ef
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x4016e4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x401731
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x401714
test esi, esi
je 0x40173d
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x401735
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call section..text
push ebx
push 0
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x44afaa
Capabilities:
Encode data using xor

Disassembly:
pop edi
aad 0x7f
jg 0x44aff0
dec eax
adc al, 0x83
jl 0x44af7e
sbb edi, 0x37
dec eax
bound eax, qword [edx]
inc ebx
fisubr word [ebx + 0x7231f72]
xchg edx, eax
xor eax, 0xec4cc99b
xchg ecx, eax
fadd qword [0xf6a49695]
xor dword [esi], esi
or dword [eax - 0x2c], ecx
xchg ebp, eax
xchg esi, eax
movsb byte es:[edi], byte [esi]
div byte [ecx]
or dword ss:[eax - 0x2c], ecx
wait
xor eax, 0x14af7019
je 0x44afa0
mov dword [0x1668904a], eax
or edx, dword [ebp - 0x709951ea]
inc edi
xor bh, 0x11
inc ecx
jp 0x44af84
cmp edx, dword [edi]
mov al, byte [0x8f2f833e]
sub dword ds:[edi], 0xffffff8f

Function at 0x44b25e
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
or edx, dword [esi]
inc eax
salc
dec edx
pop ss
leave
cmc
adc dword [eax + 0x4a], ebx
xchg edi, eax
xor dword [ebp - 0x72de9adb], eax
xchg ebp, eax
sbb bl, ah
xchg ebx, eax
mov al, 0xc3
xadd dword [ebx + eax - 0x6afe7bb9], esi
cmpsd dword [esi], dword es:[edi]
leave
pop esi
pop ecx
jns 0x44b29b
sub al, 5
out dx, eax
jge 0x44b2bb
xor byte [ecx + 0x402a7246], dh
mov cl, 0x46
jb 0x44b2b9
inc eax
das
push ebp
rol dword [esi - 0x34], cl
ja 0x44b28a
sub edi, edi
inc ebp
and dword [esi - 0x39], ecx
invalid
dec esi
mov ebp, 0x44f0a0c2
xchg edx, eax
and ebx, edx
jno 0xb4ece9ab
invalid
add byte [edi], dh
test al, 0xb4
adc al, 0x6b
push ds
mov dl, 0x4e
mov ah, 0x31
movsd dword es:[edi], dword [esi]
dec edi
std
rol esi, 1
outsd dx, dword [esi]
add eax, 0x35eda81
ficomp dword [esi + 3]
mov byte [0x7ad3d0a1], al
xor dh, al
push edx
jecxz 0x44b2f0
jne 0x44b334
salc
lodsb al, byte [esi]
invalid
sal dword [ebp - 0x555e1954], 0xe5
rcr edi, cl
mov ch, 0x87
mov cl, 0xe3
adc eax, 0x4a24b5bc
movsd dword es:[edi], dword [esi]
aam 0x24
scasb al, byte es:[edi]
push eax
mov ecx, 0x35bb777a
jne 0x44b35c
dec ebx
rcl ebx, 1
enter 0xffffffffffffc1fa, 0xffffffffffffffa2
dec eax
mov al, 0xfb
xchg edx, eax
pop esp
out 0xb4, eax
xor al, 0x9c
jp 0x44b351
aad 0x74
sub ah, byte [edi + 0x15]
daa
cdq
jns 0x44b345
add dword [edx + 0xc227697], eax
int1
mov ah, 0xb2
sub ah, byte [edi + 0x57]
push edi
popal
imul esi, edx, 0xffffffca
mov cl, 0xe7
invalid
add byte es:[0xb1156b03], al
xor dword [ebx + 0x20], ebx
mov ch, 0xea
inc ecx
and byte [ecx + 0x1992b8b0], 0x1b
retf 0x3861
popal
cmp byte [ebx + 0x76], cl
pop ds
mov eax, dword [0x28c21ec2]
arpl word [edi + 0x51025fbc], bp
aad 0x29
xchg ecx, eax
mov ch, 0xc2
invalid

Function at 0x44bad0
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
xor edi, edi
call fcn.0044ba10
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
adc eax, sym.imp.SHELL32.dll_CommandLineToArgvW
Function at 0x49319a
Capabilities:
Encode data using xor

Disassembly:
dec esp
and dword [esi], eax
movsb byte es:[edi], byte [esi]
add ah, byte [ecx - 0x3e7ee127]
lcall 0x74fd, 0x3785c482
int1
adc byte [ebp - 0x6575b55f], dh
adc cl, byte [esi - 0x35]
and al, 0x51
dec edx
mov bl, byte [edx + 0x2ecb4e12]
and al, 0x51
pop esp
sbb byte [edx], dl
aaa
movsb byte es:[edi], byte [esi]
out dx, eax
div byte [esp + edi*2]
xchg byte [edi], ah
mov ss, edx
xlatb
in al, dx
xchg edx, eax
aad 0x9d
xor eax, 0xc24eecbf
push edi
mov edi, 0x57c24eec
sal dword [ecx - 0x39], cl
jno 0x4930ec
push edi
pcmpeqd mm1, mm5
std
xor cl, byte [edi + ebp - 0x152b04b5]
xchg edx, eax
xor eax, 0xaec74f62
jae 0x493123
or edi, dword [eax]
cld
xchg edi, eax
mov ebp, ebp
int1
movsd dword es:[edi], dword [esi]
adc al, 0x6c
push es
push 0x67
popfd
in eax, 0x87
and al, 0xeb
jae 0x493101
inc eax
retf
jecxz 0x49311d
int3

Function at 0x4931f2
Capabilities:
Encode data using xor

Disassembly:
popfd
cmp al, 0x8e
invalid
ja 0x493202
xchg edx, eax
out dx, eax
jno 0x493224
mov esp, 0x4bc0a853
add esp, dword [ebx + 0x49]
add edx, dword [eax]
fsub qword [ecx]
rol dword [edx], 1
lodsb al, byte [esi]
jno 0x49325c
adc ah, bl
and ecx, edx
add ch, byte [ecx + esi*2 + 0x7ef26152]
invalid
popal
bnd jle 0x4931d4
daa
cdq
xchg esp, eax
retf
stc
push ebx
sub edx, dword [eax + 0x7a190d72]
les edx, [edi + ecx*2]
and al, byte [edi + edx*8]
inc dword [ecx]
adc bl, 0x80
cmc
nop
push ecx
popal
rol dword [eax + 0x615190f5], cl
push es
xor eax, 0x37963242
sub byte [eax + 0x4dc2c91], dh
out 0xa1, al
and eax, 0xe111f10d
lodsb al, byte [esi]
imul ecx, dword [ecx + edx*8], 0xffffffb7
sar byte [eax - 0xe695fb2], cl
jae 0x493235
and cl, byte [edi + esi*8 + 0x716e81a1]
imul esp, dword [ebp + 0x24], 0x79d0aedf
mov al, 3
das
out dx, al
cmp ah, byte [ecx]
bound edx, qword [edx]
sbb esi, dword [edx - 0x17]
ret
invalid

Function at 0x4e0f9a
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebp + 0x24], edi
lodsb al, byte [esi]
sub al, 0xdb
mov ch, 0x21
push edi
pop eax
fsub st(0)
and eax, dword [ecx + 0x3e47196]
les esp, [ebx]
clc
popal
mov byte [0xae1985d5], al
ljmp 0x5f47
invalid
inc edi
pop edi
aad 0x85
sbb dword [esi - 0x6e08df16], ebp
sub al, 0xa5
andnps xmm4, xmm1
and ah, byte [edx]
xor ah, dh
jg 0x4e0f68
sub byte [edx + 0x6c], 0x87
ja 0x4e0f31
ja 0x4e0f6a
push ss
push ebp
ror dword [edx], 0xee
sbb dl, cl
xchg ecx, eax
neg dword [edi - 0x5c]
mov al, 0xb1
or dl, byte [ecx + 0x7249c83e]
jg 0x4e0fe7
pop es
xchg ecx, eax
pop ebp
mov dl, 6
and ah, byte [ebx + 0x64e91885]
mov ah, 0xe1
popal
in al, dx
sub edi, dword [ebx - 0x5397e496]
adc al, 0xc1
mov byte [0x920a], al
jbe 0x4e0fe8
xor al, byte [edx - 0xc]
das
fidivr word [edi + 0x3f4760b5]
mov ch, 0x60
pushal
inc edi
aas
xlatb
jnp 0x4e1042
and al, 0x8d
xor dl, byte [ecx]
or byte [ebx + 0x41], 0x75
and dh, bh
lea ebx, [eax]
ror byte [ecx + edi], 0x54
test byte [ebp - 0x80], dh
test byte [ecx], dh
jmp [edi]
xor dword [ebp - 0x33dd7b2d], esp
scasd eax, dword es:[edi]
aam 0x72
xchg dword [esp - 0x41], esi
jmp 0x4e1092
fnstenv [edi]
int 0xab
push esi
mov edi, eax
jne 0x4e10c1
add al, 0xf3
into
ret
pop ds
xlatb
adc al, 0x15
retf 0x68fb
Function at 0x4e18d4
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Parse pe header

Disassembly:
push ebx
push esi
push edi
test ecx, ecx
je 0x4e1993
mov ebx, eax
mov esi, edx
mov edi, ecx
xor edx, edx
mov al, byte [esi]
mov dl, byte [esi + 1]
cmp al, 0xa
je 0x4e1916
cmp al, 0xb
je 0x4e1925
cmp al, 0x12
je 0x4e1916
cmp al, 0xc
je 0x4e1934
cmp al, 0xd
je 0x4e1943
cmp al, 0xe
je 0x4e1961
cmp al, 0xf
je 0x4e1977
cmp al, 0x11
je 0x4e1986
mov al, 2
pop edi
pop esi
int3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
je fcn.004e197a
add byte [eax], al
add byte [eax + 0x65d037], ah
aaa
shl byte [ebp], 1
or eax, 0x65d024
inc ebp
hlt
Function at 0x4e2402
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov esi, edx
mov edi, ecx
mov ebp, dword [esp + 0x14]
mov cl, byte [edi]
cmp cl, 0xa
je 0x4e2451
cmp cl, 0xb
je 0x4e2468
cmp cl, 0x12
je 0x4e247f
cmp cl, 0xc
je 0x4e2493
cmp cl, 0xd
je 0x4e24a7
cmp cl, 0xe
je 0x4e24ca
cmp cl, 0xf
je 0x4e24e7
cmp cl, 0x11
je 0x4e24fb
mov al, 2
pop ebp
pop edi
pop esi
pop ebx
jmp fcn.004dda8a
mov eax, ebx
mov edx, dword [esi]
call fcn.004e0f9a
add ebx, 4
add esi, 4
dec ebp
jne 0x4e2451
jmp 0x4e250f
mov eax, ebx
mov edx, dword [esi]
call fcn.004e0f72
add ebx, 4
add esi, 4
dec ebp
jne 0x4e2468
jmp 0x4e250f
mov eax, ebx
mov edx, dword [esi]
call fcn.004e0efe
add ebx, 4
add esi, 4
dec ebp
jne 0x4e247f
jmp 0x4e250f
mov eax, ebx
mov edx, esi
call fcn.004e22aa
add ebx, 0x10
add esi, 0x10
dec ebp
jne 0x4e2493
jmp 0x4e250f
xor ecx, ecx
mov cl, byte [edi + 1]
lea edi, [ecx + edi + 2]
mov eax, ebx
mov edx, esi
mov ecx, dword [edi + 8]
mov ecx, dword [ecx]
push dword [edi + 4]
call fcn.004e2402
add ebx, dword [edi]
add esi, dword [edi]
dec ebp
jne 0x4e24b0
jmp 0x4e250f
mov eax, ebx
mov edx, esi
mov ecx, edi
call fcn.004e22c2
xor eax, eax
mov al, byte [edi + 1]
add ebx, dword [eax + edi + 2]
add esi, dword [eax + edi + 2]
dec ebp
jne 0x4e24ca
jmp 0x4e250f
mov eax, ebx
mov edx, dword [esi]
call fcn.004e4522
add ebx, 4
add esi, 4
dec ebp
jne 0x4e24e7
jmp 0x4e250f
mov eax, ebx
mov edx, dword [esi]
mov ecx, edi
call fcn.004e2e8a
add ebx, 4
add esi, 4
dec ebp
jne 0x4e24fb
pop ebp
pop edi
pop esi
pop ebx
ret 4