joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b738
Capabilities:
Packed with generic packer

Disassembly:
add bh, bh
mov byte [eax], al
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc byte [eax], 0
adc byte [edi + 0x6e], cl
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x43b742
push 0x69676e61
outsb dx, byte [esi]
pushfd
imul eax, dword [ecx], 0xff000098
cwde
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f110011], al
outsb dx, byte [esi]
push ebx
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
inc ebx
push 0x65676e61
jl 0x43b6e1
inc ebx
add byte [eax - 0x5f010000], ah
add bh, bh
mov al, byte [0x1ff0000]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc al, byte [eax]
adc byte [edi + 0x6e], cl
add byte [eax], al
push ebx
push 0x56657261
imul ebp, dword [edi + 0x6c], 0x6f697461
outsb dx, byte [esi]
pushfd
imul eax, dword [ecx], 0xff0000a8
test al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc eax, dword [eax]
or al, 0x4f
outsb dx, byte [esi]
push esp
jns 0x43b7ed
inc ebx
push 0x65676e61
sal byte [edi + 0x43], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xb8
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax + 0xb00043], bh

Function at 0x43b744
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax - 0x80000000], al
adc al, byte [eax]
adc byte [edi + 0x6e], cl

Function at 0x43b799
Capabilities:
Packed with generic packer

Disassembly:
add bh, bh
mov byte [eax], al
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc byte [eax], 0
adc byte [edi + 0x6e], cl
inc esi
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x43b742
push 0x69676e61
outsb dx, byte [esi]
pushfd
imul eax, dword [ecx], 0xff000098
cwde
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f110011], al
outsb dx, byte [esi]
push ebx
insb byte es:[edi], dx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
inc ebx
push 0x65676e61
jl 0x43b6e1
inc ebx
add byte [eax - 0x5f010000], ah
add bh, bh
mov al, byte [0x1ff0000]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc al, byte [eax]
adc byte [edi + 0x6e], cl
add byte [eax], al
push ebx
push 0x56657261
imul ebp, dword [edi + 0x6c], 0x6f697461
outsb dx, byte [esi]
pushfd
imul eax, dword [ecx], 0xff0000a8
test al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
adc eax, dword [eax]
or al, 0x4f
outsb dx, byte [esi]
push esp
jns 0x43b7ed
inc ebx
push 0x65676e61
sal byte [edi + 0x43], 1
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
sub al, 0xb8
inc ebx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc byte [eax + 0xb00043], bh
Function at 0x43b7af
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax + 0x44d80042], al
inc eax
add byte [eax - 2], al
inc ecx
add al, ah
inc esp
inc eax
add ah, dl
inc esp
inc eax
add byte [edx + eax*2], bl
inc eax
add byte [eax], bh
inc edx
inc eax
add byte [edx + ebx*8 + 0x43], dl
add byte [ebx + ebx*4], dh
inc ecx
add byte [eax], cl
add dword [edx], eax
push eax
lcall 0x42, 0x1e00041
test al, 0
inc edx
add al, dh
add dword [edx], eax
call 0x1c43f9ef
add eax, 0x2000042
inc edx
add al, bh
add dword [edx], eax

Function at 0x43b7f8
Capabilities:
Packed with generic packer

Disassembly:
and al, 5
inc edx
add byte [ecx + ebx*8 - 0x1743ffbd], bh
fld dword [ebx]
mov esp, 0x100043e8
in al, 0x43
add byte [ebx + ebx*8 - 0x2417ffbd], ah
inc ebx
add byte [0x73754354], dl
adc eax, 0x73754354
je 0x43b886
insd dword es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x53], 0x44657661
imul esp, dword [ecx + 0x6c], 0xc08b676f
sub al, 0xb8
inc ebx
add byte [edi], al
adc eax, 0x73754354
je 0x43b8a3
insd dword es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x53], 0x44657661
inc edx
add al, bl
inc esp
inc eax
add byte [eax - 2], al
inc ecx
add al, ah
inc esp
inc eax
add ah, dl
inc esp
inc eax
add byte [edx + eax*2], bl
inc eax
add byte [eax], bh
inc edx
inc eax
add byte [edx + ebx*8 + 0x43], dl
inc ebx
add byte [ebx + ebx*4], dh
inc ecx
add byte [eax], cl
add dword [edx], eax
push eax
lcall 0x42, 0x1e00041
test al, 0
inc edx
add al, dh
lock add dword [edx], eax
call 0x1c43fac3
add eax, 0x2000042
inc edx

Function at 0x43b83e
Capabilities:
Packed with generic packer

Disassembly:
imul esp, dword [ecx + 0x6c], 0xb7d0676f
inc ebx
add al, bh
mov dl, 0x43
add byte [edx], al
add byte [edi], al
inc esp
imul esp, dword [ecx + 0x6c], 0x73676f
add byte [eax], al
nop
movsb byte es:[edi], byte [esi]
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
clc
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 0xb8

Function at 0x43b855
Capabilities:
Packed with generic packer

Disassembly:
imul esp, dword [ecx + 0x6c], 0xb7d0676f
inc ebx
add al, bh
mov dl, 0x43
add byte [edx], al
add byte [edi], al
inc esp
imul esp, dword [ecx + 0x6c], 0x73676f
add byte [eax], al
nop
movsb byte es:[edi], byte [esi]
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
clc
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 0xb8

Function at 0x43b862
Capabilities:
Packed with generic packer

Disassembly:
imul esp, dword [ecx + 0x6c], 0xb7d0676f
inc ebx
add al, bh
mov dl, 0x43
add byte [edx], al
add byte [edi], al
inc esp
imul esp, dword [ecx + 0x6c], 0x73676f
add byte [eax], al
nop
movsb byte es:[edi], byte [esi]
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
clc
mov eax, 0x43
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
in al, 0xb8
Function at 0x43b87a
Capabilities:
Packed with generic packer

Disassembly:
inc ebx
add byte [eax - 0x7c000000], dh
mov bh, 0x43
add byte [eax + 0x44d80042], al

Function at 0x43b8a2
Capabilities:
Packed with generic packer

Disassembly:
and al, 5
inc edx
add byte [ecx + ebx*8 - 0x1743ffbd], bh
fld dword [ebx]
mov esp, 0x100043e8
in al, 0x43
add byte [ebx + ebx*8 - 0x2417ffbd], ah
inc ebx
add byte [0x73754354], dl
adc eax, 0x73754354
je 0x43b886
insd dword es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x53], 0x44657661
imul esp, dword [ecx + 0x6c], 0xc08b676f
sub al, 0xb8
inc ebx
add byte [edi], al
adc eax, 0x73754354
je 0x43b8a3
insd dword es:[edi], dx
inc esi
imul ebp, dword [ebp + 0x53], 0x44657661
inc edx
add al, bl
inc esp
inc eax
add byte [eax - 2], al
inc ecx
add al, ah
inc esp
inc eax
add ah, dl
inc esp
inc eax
add byte [edx + eax*2], bl
inc eax
add byte [eax], bh
inc edx
inc eax
add byte [edx + ebx*8 + 0x43], dl
inc ebx
add byte [ebx + ebx*4], dh
inc ecx
add byte [eax], cl
add dword [edx], eax
push eax
lcall 0x42, 0x1e00041
test al, 0
inc edx
add al, dh
lock add dword [edx], eax
call 0x1c43fac3
add eax, 0x2000042
inc edx

Function at 0x43b8c7
Capabilities:
Packed with generic packer

Disassembly:
add al, bh
add dword [edx], eax
and al, 5
inc edx
add byte [ecx + ebx*8 - 0x1743ffbd], bh
inc ebx
add byte [eax], dl
in al, 0x43
add byte [ebx + ebx*8 - 0x2417ffbd], ah
inc ebx

Function at 0x43b8e3
Capabilities:
Packed with generic packer

Disassembly:
add byte [edi], cl
push esp
inc esi
imul ebp, dword [ebp + 0x53], 0x44657661
imul esp, dword [ecx + 0x6c], 0xb8f8676f
inc ebx
add byte [edi], al
andps xmm0, xmmword [esi + 0x69]
insb byte es:[edi], dx
push ebx
popal
jbe 0x43b968
inc esp
imul esp, dword [ecx + 0x6c], 0xb8a4676f
inc ebx
add byte [eax], ch
mov eax, 0x150043
pop es
inc esp
imul esp, dword [ecx + 0x6c], 0x1373676f
add byte [eax + 0x30004010], ah
add byte [eax], al
inc eax
in eax, 0x43
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x430a0002], al
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x69754774
mov al, byte fs:[0x34004010]
add byte [eax], al
push dword [eax + eax]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
add eax, dword [eax]
adc byte [ebp + 0x66], al
popal
jne 0x43b9cf
je 0x43b9aa
outsb dx, byte [esi]
add byte [eax], al
add byte [0x61460d00], 0x76
outsd dx, dword [esi]
add byte [eax - 0x80000000], al
push es
Function at 0x43b965
Capabilities:
Packed with generic packer

Disassembly:
js 0x43b9db
outsb dx, byte gs:[esi]
jae 0x43b9d4
outsd dx, dword [esi]
outsb dx, byte [esi]
mov al, byte [0x14004010]
loop 0x43b9b7
add ah, dh
in eax, 0x43
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x440d0004], al
popaw
jne 0x43b9fa
je 0x43b9d6
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x43ba02
jb 0x43ba02
mov cl, 0x43
add byte [eax], al
add bh, bh
dec eax
out 0x43, al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x460d0005], al
popal
jbe 0x43ba23
jb 0x43ba1f
je 0x43ba1d
dec esp
dec esp
imul ebp, dword [esi + 0x6b], 0x40843073
add byte [eax], ch
loop 0x43ba07
add byte [esi], dl
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46080006], al
add byte [esi], 0
or byte [esi + 0x69], al
insb byte es:[edi], dx
add byte [eax], cl
inc esi
imul ebp, dword [ebp + 0x4e], 0xa0656d61
adc byte [eax], al
dec eax
dec esi
popal
insd dword es:[edi], dx
mov al, byte gs:[0x48004010]
add byte [eax], al
dec dword [eax]
dec eax
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x460d0007], al
invalid
insb byte es:[edi], dx
invalid
add byte [eax], al
add byte [edi], 0
or eax, 0x656c6946
dec esi
popal
insd dword es:[edi], dx
dec esp
popal
bound esp, qword [ebp + 0x6c]
insb byte es:[edi], dx
jo 0x43b9b9
inc ebx
add byte [eax + eax], dl
push dword [esi]
inc ebx
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x46090008], al
add byte [eax], al
or byte [eax], 0
or dword [esi + 0x69], eax
insb byte es:[edi], dx
push esp
jns 0x43ba9a
inc esi
imul ebp, dword [ebp + 0x54], 0x73657079
jl 0x43ba3e
jae 0x43baa9
adc byte [eax], al
push eax
add byte [eax], al
call dword [eax]
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
inc eax
add byte [eax], dl
add bh, bh
push eax
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
add byte [ecx], 0
add byte [eax], al
or dword [eax], eax
or eax, 0x656c6946
push esp
jns 0x43babe
dec ecx
outsb dx, byte [esi]
js 0x43b9f5
adc byte [eax], al
pop esp
add byte [eax], al
call [eax + eax]
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f0d000a], al
imul eax, dword [edx + 0x75], 0x74
je 0x43bae5
outsd dx, dword [esi]
outsb dx, byte [esi]
dec esp
popal
bound esp, qword [ebp + 0x6c]
test al, 0xab
inc ebx
add byte [eax], ah
add bh, bh
pushal
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
invalid
add byte [eax + 0x4f07000b], al
jo 0x43bb0e
invalid
outsd dx, dword [esi]

Function at 0x43b9e8
Capabilities:
Packed with generic packer

Disassembly:
dec eax
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x460d0007], al
imul ebp, dword [ebp + 0x4e], 0x4c656d61
Function at 0x46a407
Capabilities:
Get number of processors

Disassembly:
call 0xa5ec4937
mov esi, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x258], 1
xor edx, edx
push ebp
push fcn.0046a5eb
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, esi
mov eax, dword [ebp - 4]
call 0x4c9fa1
add dword [ebp - 0xc], 4
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00461b54
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.00417fd8
lea edx, [ebp - 0x20]
mov eax, dword [0x48f518]
mov eax, dword [eax]
xor ecx, ecx
call 0x4b54e3
mov ebx, eax
mov eax, ebx
call 0x4b42e8
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x48]
jge 0x46a409
mov eax, ebx
call 0x4b42f7
mov edx, eax
mov eax, dword [ebp - 4]
call 0x4c96b1
invalid
invalid
mov eax, ebx
call 0x4b42d4
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x4c]
jge 0x46a429
mov eax, ebx
call 0x4b42e3
mov edx, eax
mov eax, dword [ebp - 4]
call 0x4c9705
mov eax, ebx
call 0x4b4310
mov edi, eax
mov eax, ebx
call 0x4b42fd
add edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
add eax, dword [ebp - 0x14]
cmp edi, eax
jge 0x46a463
mov eax, ebx
call 0x4b432f
mov edi, eax
mov eax, ebx
call 0x4b431c
add edi, eax
mov eax, dword [ebp - 4]
sub edi, dword [eax + 0x4c]
mov dword [ebp - 0x14], edi
mov eax, ebx
call 0x4b4316
mov edi, eax
mov eax, ebx
call 0x4b436b
add edi, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
add eax, dword [ebp - 0x18]
cmp edi, eax
jge 0x46a49d
mov eax, ebx
call 0x4b4335
mov edi, eax
mov eax, ebx
call 0x4b438a
add edi, eax
mov eax, dword [ebp - 4]
sub edi, dword [eax + 0x48]
mov dword [ebp - 0x18], edi
mov eax, ebx
call fcn.0044aab0
cmp eax, dword [ebp - 0x18]
jle 0x46a4b3
mov eax, ebx
call 0x4b435c
mov dword [ebp - 0x18], eax
mov eax, ebx
call fcn.0044aae4
cmp eax, dword [ebp - 0xc]
jle 0x46a4c9
mov eax, ebx
call 0x4b43a6
mov dword [ebp - 0xc], eax
push 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x4c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
call 0x4d21fb
push eax
call fcn.00471751
call fcn.00470ec6
mov edx, dword [ebp - 4]
sub eax, dword [edx + 0x25c]
cmp eax, 0xfa
jbe 0x46a519
mov eax, esi
test eax, eax
je 0x46a511
xor eax, eax

Function at 0x46a50c
Capabilities:
Get number of processors

Disassembly:
sub eax, 4
mov eax, dword [eax]
cmp eax, 0x64
setl al
jmp 0x46a51b
test al, al
je 0x46a598
cmp dword [0x48b948], 0
je 0x46a598
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1016
call fcn.004717ca
cmp dword [ebp - 8], 0
je 0x46a598
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x1018
call fcn.004717e2
cmp dword [ebp - 8], 0
je 0x46a55c
mov bl, 2
jmp 0x46a577
lea edx, [ebp - 0x20]
mov eax, dword [0x494c90]
call 0x4d752d
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x14]
invalid
Function at 0x477a22
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
inc esi
add al, 0x66
mov dword [ebx + 4], eax
movzx eax, word [esi + 6]
mov word [ebx + 6], ax
movzx eax, word [esi + 8]
mov word [ebx + 8], ax
movzx eax, word [esi + 0xa]
mov bh, 0x46
or ah, byte [esi - 0x77]
inc ebx
or cl, byte [ebx - 0x717f3ba]
pop es
add byte [ecx + 0x468b0c43], cl
adc byte [ecx + 0x468b1043], cl
adc al, 0x89
inc ebx
adc al, 0x8b
inc esi
sbb byte [ecx - 0x48f0e7bd], cl
inc esi
sbb al, 0x66
mov dword [ebx + 0x1c], eax

Function at 0x47908e
Capabilities:
Packed with generic packer

Disassembly:
jae 0x479103
ja 0x479101
jb 0x4790f8
or eax, 0x6f4e7273
dec edi
jbe 0x479101
jb 0x479115
jb 0x479109
invalid

Function at 0x47e4db
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
add byte [eax], al
mov edx, ebx
ror dword [ebx - 0x24f71739], cl
pop es
add byte [ebx + 0x70b789f0], cl
add dword [eax], eax
add byte [ecx + 0xffe6], al
add byte [ecx], al
mov bh, 0x74
add dword [eax], eax
add byte [ecx - 0x49], ch
je 0x47e4ff
add byte [eax], al
add eax, 0x46080884

Function at 0x47e6a6
Capabilities:
Access peb ldr_data

Disassembly:
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov ecx, 0xc
mov eax, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov esi, dword [ebx + 0x110]
mov eax, esi
call 0x4f57fd
sub eax, 0xffffffd7
pop ebp
loop 0x47e6cf
push edx
push eax
mov eax, esi
call 0x4f5844
jno 0x47e6de
add byte [ebp + 0x558bf04d], cl
cld

Function at 0x4815e5
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
xor dword [ebp - 0x10], edx
add dword [ebp - 0x14], 4
mov ecx, dword [ebp - 0x10]
and edx, 0xff
xor ecx, dword [edx*4 + 0x48c7ec]
mov eax, dword [ebp - 0x10]
shr eax, 0x18
invalid
invalid

Function at 0x481721
Capabilities:
Encode data using xor

Disassembly:
dec eax
add byte [ebx - 0x173e0fbb], cl
or byte [0xffff], ah

Function at 0x481a3f
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x173e0fbb], cl
adc byte [0xffff], ah

Function at 0x4850a3
Capabilities:
Accept command line arguments

Disassembly:
push dword [edx]
mov dword fs:[edx], esp
cmp eax, 0x80020009
jne 0x485106
mov eax, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 4]
call fcn.004897f2
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0xc]
call fcn.00489801
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x10]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 8]
push eax
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x484658]
call 0x508ccf
mov esi, eax
Function at 0x4850b0
Capabilities:
Accept command line arguments

Disassembly:
push dword [edx]
mov dword fs:[edx], esp
cmp eax, 0x80020009
jne 0x485106
mov eax, dword [ebx + 0x1c]
push eax
lea eax, [ebp - 8]
mov edx, dword [ebx + 4]
call fcn.004897f2
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0xc]
call fcn.00489801
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebx + 0x10]
push eax
lea eax, [ebp - 0x10]
mov edx, dword [ebx + 8]
push eax
push 0
xor ecx, ecx
mov dl, 1
mov eax, dword [0x484658]
call 0x508ccf
mov esi, eax

Function at 0x4850db
Capabilities:
Accept command line arguments

Disassembly:
call fcn.00489814
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4846b4]
call 0x508d7b
mov esi, eax
cmp byte [ebp + 8], 0
je 0x485119
mov eax, ebx
mov edx, dword [0x408090]
cmp dword [ebp - 4], 0

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401000
Capabilities:
Hide graphical window
Terminate process

Disassembly:
call fcn.00401209
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push 0
push 0x401027
push 0
push 0x64
push eax
call dword [sym.imp.USER32.DLL_DialogBoxParamA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x401209
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push str.HIDmon
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateMutexA]
test eax, eax
je 0x401231
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x401231
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
ret
Function at 0x10002e01
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10002e10
pop dword [ebp - 0x34]
mov eax, 0x3769368c
add eax, 0xd896f784
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x606c0304
add dword [ebp - 0x44], 0xede64247
mov dword [ebp - 0x40], 0xf2364d1c
sub dword [ebp - 0x40], 0xc00300d7
mov dword [ebp - 0x3c], 0x1c86a7a2
sub dword [ebp - 0x3c], 0xd03a6374
mov dword [ebp - 0x38], 0xfbab042a
add dword [ebp - 0x38], 0x454fbd6
lea eax, [ebp - 0x44]
push eax
mov eax, 0x12f5a19a
sub eax, 0x2f5460a
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0xe9ea11c2
add dword [ebp - 0x44], 0x8a885794
mov dword [ebp - 0x40], 0xe6f56600
add dword [ebp - 0x40], 0x5a76fb75
mov dword [ebp - 0x3c], 0x94f5dacd
sub dword [ebp - 0x3c], 0x31866e61
mov dword [ebp - 0x38], 0xb1e09714
add dword [ebp - 0x38], 0x4e1f68ec
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xe4cbded3
sub eax, 0xd4cb835f
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x38b5e
push 0
call eax
mov ecx, 0x21caf240
add ecx, 0xde355e5a
mov edi, eax
mov ebx, 0x9c692625
sub ebx, 0x8c686e25
add ebx, dword [ebp - 0x34]
mov esi, 0x4159f3ec
sub dword [ebp - 0x24], 0xf02cc328
mov edx, dword [ebx]
add dword [ebp - 4], ebx
xor edx, esi
xor dword [ebp - 0x10], 0x70d22a09
mov dword [edi], edx
sub dword [ebp - 0x18], edx
add edi, 0xba3b7f57
sub edi, 0xba3b7f53
add ebx, 0xcc8d8cdc
add ebx, 0x33727328
loop 0x10002f2c
add eax, 0x1353b
mov ebx, eax
add eax, 0x7c98b782
sub eax, 0x7c98b77d
mov ecx, 0x9a2478fe
sub ecx, 0x8a2478fe
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x1005b746
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1005b785
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005b785
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005b785
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1005b785
cmp dword [ecx + 0x74], 0xe
jbe 0x1005b785
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1005cac0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005caed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005caed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1005ce10
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10067620
push 0x10067618
push str.FlsAlloc
push 0x1f
call fcn.1005d0f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005ce44
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1005ce4a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1005ce8e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10067630
push 0x10067628
push str.FlsGetValue
push 0x21
call fcn.1005d0f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005cec5
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1005cecd
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10067638
push 0x10067630
push str.FlsSetValue
push 0x22
call fcn.1005d0f3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005cf07
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1005fdce
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005fe6b
push ebx
push esi
call fcn.1005fe6e
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1005fcd2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005fe18
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005fe6a
push edi
push eax
call fcn.100600cc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005fe38
call fcn.1005e3c0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005fe69
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1005fcd2
add esp, 0x20
test eax, eax
jne 0x1005fe57
push edi
call fcn.1005e3c0
jmp 0x1005fe5f
push ebx
call fcn.1005e3c0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret