joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058cd
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40590c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40590c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40590c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40590c
cmp dword [ecx + 0x74], 0xe
jbe 0x40590c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x410e98
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x410f35
push ebx
push esi
call fcn.00410e61
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040e8c2
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x410ee2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410f34
push edi
push eax
call fcn.00411539
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x410f02
call fcn.0040f501
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x410f33
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040e8c2
add esp, 0x20
test eax, eax
jne 0x410f21
push edi
call fcn.0040f501
jmp 0x410f29
push ebx
call fcn.0040f501
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x411c3f
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419c78
push 0x419c70
push str.FlsAlloc
push 0x1f
call fcn.00411b5b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411c73
push dword [ebp + 8]
mov ecx, esi
call dword [0x4171f0]
call esi
jmp 0x411c79
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x411cbd
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419c88
push 0x419c80
push str.FlsGetValue
push 0x21
call fcn.00411b5b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411cf4
push dword [ebp + 8]
mov ecx, esi
call dword [0x4171f0]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x411cfc
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x419c90
push 0x419c88
push str.FlsSetValue
push 0x22
call fcn.00411b5b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x411d36
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x4171f0]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x416900
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41692d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41692d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x404a07
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
xor byte [eax + ecx], 0x2c
inc eax
cmp eax, 0x19
jb 0x404a06

Function at 0x404b3c
Capabilities:
Encode data using xor

Disassembly:
add byte [esp + ecx + 0x33], dh
rol byte [eax + 0x402c0834], 0x83
inc eax
cmp eax, 0x42

Function at 0x404db5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0xa1
daa
inc ebp
add byte [ebx], dh
lds ecx, [ecx - 0x5e9b03bb]
sub al, 0
add byte [eax], al
mov ecx, dword [0x45505c]
movaps xmm0, xmmword [0x4431e0]
push edi
movups xmmword [ebp - 0x24], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x45454c
mov eax, dword [0x45456c]
mov dword [ebp - 0x14], 0x495e7870
invalid

Function at 0x404eb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov eax, dword [0x2c]
mov ecx, dword [0x45505c]
movaps xmm0, xmmword [0x443170]
push edi
movups xmmword [ebp - 0x20], xmm0
inc ebp
loopne 0x404e57
or al, 0x88

Function at 0x404ec9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
dec ebp
cld
mov eax, 0x453fcc
xor ecx, ebp
pop eax
cmp byte [ebx], dl
lodsd eax, dword [esi]
call fcn.00422626
leave
ret
inc ebp
loopne 0x404e57
or al, 0x88
mov edi, 0x45439c
mov eax, dword [0x4543b8]
mov dword [ebp - 0x10], 0x4842490c
mov dword [ebp - 0xc], 0x4245435c
mov word [ebp - 8], 0x2c58
cmp eax, dword [ecx + 4]
jg 0x404f06
jmp 0x404ef7
mov ecx, dword [ebp - 4]
push esi
add dword [ecx + 0x43b8de3a], 0x45
add byte [esi - 0x18], dl
salc
add dword [eax], eax
cmp dword [0x4543b8], 0xffffffff
pop ecx
jne 0x404ef9
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00403fdb
push 0x4412ce
call fcn.00422234
push esi

Function at 0x40635a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x45505c]
movaps xmm0, xmmword [0x442fd0]
push edi
movups xmmword [ebp - 0x20], xmm0
mov ecx, dword [eax + ecx*4]
mov edi, 0x4543c8
mov eax, dword [0x4543e4]
mov dword [ebp - 0x10], 0x490c5542
mov dword [ebp - 0xc], 0x435c4842
pop esp
inc ebx
mov dword [ebp - 8], 0x2c584245
cmp eax, dword [ecx + 4]
jg 0x4063b1
jmp 0x4063a2
pop esi
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004226b6
leave
ret
push esi
mov esi, 0x4543e4
push esi
call fcn.004225e0
cmp dword [0x4543e4], 0xffffffff
pop ecx
jne 0x4063a1
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.004040dd
push 0x4414bf
call fcn.004222c1
push esi
call fcn.00422596
pop ecx
pop ecx
jmp 0x4063a1
Function at 0x4092c5
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edx
inc ebp
add byte [edi], cl
adc dword [ebp - 0x54], eax
mov dword [ebp - 0x14], 0x5f45480c
movaps xmm0, xmmword [0x443250]
movups xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x10], 0x554d405c
movaps xmm0, xmmword [0x443010]
movups xmmword [ebp - 0x34], xmm0
mov dword [ebp - 0xc], 0x49414d62
movaps xmm0, xmmword [0x443100]
movups xmmword [ebp - 0x24], xmm0
mov byte [ebp - 8], 0x2c
cmp eax, dword [ecx + 4]
jg 0x409320
jmp 0x409311
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop esp
cmp byte [ebx], dl
lodsd eax, dword [esi]
call fcn.00422839
leave
add cl, cl
ret

Function at 0x409c64
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
sub esp, 0x244
mov eax, dword [0x452764]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword fs:[0x2c]
mov ecx, 0x8f
push esi
push edi
mov esi, 0x442c50
lea edi, [ebp - 0x244]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x45505c]
movsw word es:[edi], word [esi]
mov ecx, dword [eax + ecx*4]
mov edi, 0x453d50
mov eax, dword [0x4549e4]
cmp eax, dword [ecx + 4]
jg 0x409cbc
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00422872
add cl, cl
add dword [ecx + 0x49e4de3a], 0x45
add byte [esi - 0x18], dl
aad 0x8a
add dword [eax], eax
cmp dword [0x4549e4], 0xffffffff
pop ecx
jne 0x409caf
invalid
invalid

Function at 0x40bc62
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
jl 0x40bc5e
jl 0x40bcab
inc ebp
add byte [esi - 0x75], dl
mov esi, ecx

Function at 0x40bca4
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
invalid

Function at 0x40bcb6
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi - 0x9c0], eax
lea edi, [edx]

Function at 0x40bcc6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [edx]
mov bh, 0x8d
cmp cl, byte [ebx + 0x13388002]
mov eax, dword [edx]
cmp byte [eax], 0x13

Function at 0x40bce1
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
and ecx, ebp
xor ecx, eax
mov eax, ecx
and al, 1
invalid

Function at 0x428c72
Capabilities:
Access peb ldr_data

Disassembly:
push ecx
push ecx
push 0x4268ed
push dword fs:[0]
mov eax, dword [0x452764]
xor eax, esp
mov dword [esp + 8], eax
mov dword fs:[0], esp
mov eax, dword [esp + 0x30]
mov ebx, dword [eax + 8]
mov ecx, dword [esp + 0x2c]
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x29202126
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x47364f1
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x10172110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x10]
jbe 0x1017b0f1
bts di, di
neg bh
mov edi, dword [edx + 0x24]
sbb bx, 0x871a
and cl, 5
add edi, eax
btc bx, bp
btr cx, 5
mov ebx, dword [edx + 0x20]
ror cl, cl
shr ch, 2
shrd cx, ax, 0xa
add ebx, eax
mov cl, 0x1c
btc cx, ax
mov dword [ebp - 8], 0
sub cx, 0x2d01
mov ecx, dword [edx + 0x18]
stc
push ebp
cmp ecx, dword [ebp - 8]
jmp 0x10172c15
adc ch, ch
clc
btr cx, 0xf
mov ecx, dword [esi + 0x7c]
clc
jne 0x10177f75
push 0x40f77559
add ecx, edx
bt dx, 2
clc
mov dword [ebp - 0x10], ecx
movzx cx, al
mov ecx, dword [ebp + 0xc]
call fcn.1016f88a
push 0x9519f2da
lea esp, [esp + 0x2c]
je 0x1017b3ec
sbb cl, 0xde
pushfd
bts cx, cx
jmp 0x10174ac4
call fcn.10170978
lea esp, [esp + 0x38]
jno 0x10172f0b
je 0x1017b3ec
bt si, si
mov esi, dword [eax + 0x3c]
push edi
sar dx, cl
add esi, eax
dec dl
btr dx, si
not dl
pushal
mov edx, dword [esi + 0x78]
pushfd
test edx, edx
jmp 0x1016f9f7
jmp 0x1017759e
add edx, eax
sub esp, 0xfffffffc
jp 0x1016e0b0
movsx cx, al
mov ecx, dword [esi + 0x7c]
clc
add ecx, edx
push edi
cmc
jmp 0x1017096e
push edi
lea esp, [esp + 8]
and al, 8
jbe 0x1017b3ec
shl si, cl
mov edi, 0x8e8b0cd8
bsr esi, ecx
sub ecx, 1
pushfd
sal si, 3
mov dword [ebp - 4], ecx
clc
rcl cl, 1
inc di
rol edi, 8
mov ecx, dword [ebp - 8]
rcr di, 1
add ecx, dword [ebp - 4]
bsr si, dx
pushfd
or si, 0xe6a7
call fcn.10172141
push ecx
sbb byte [edi], 0xee
not byte [ebx]
and byte [ebp - 9], 0x26
pop eax
lodsd eax, dword [esi]
jp 0x101775a0
pop esp
xchg ebx, eax
invalid
pushfd
pushfd
cmp bl, 7
add ecx, edx
stc
bt si, dx
jmp 0x1017ae58
mov dword [ebp - 0x10], ecx
cmp dx, 0xeafb
cmp al, cl
cmp ah, bh
sub cx, sp
mov ecx, dword [ebp + 0xc]
pushfd
push dword [esp]
cmc
cmp ecx, 0xffff
jmp 0x100cc194
Function at 0x422e8a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4cd3f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0041fce3
mov dword [ebp - 0x14], eax
cmp dword [0x4cec84], edi
jne 0x422f7b
push 0x800
push edi
push 0x4269c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x422f08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42305b
push 0x4269c4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x42305b
push 0x4269dc
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42305b
push eax
call ebx
push 0x4269e8
push esi
mov dword [0x4cec84], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4269f8
push esi
mov dword [0x4cec88], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x426a0c
push esi
mov dword [0x4cec8c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec94], eax
test eax, eax
je 0x422f78
push 0x426a28
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4cec90], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x422fa0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x422f93
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x422fb5
push 4
pop eax
jmp 0x42305d
cmp dword [ebp - 0x14], edi
je 0x422fb5
push dword [0x4cec84]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x422f9a
mov eax, dword [0x4cec90]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x423013
cmp dword [0x4cec94], esi
je 0x423013
push eax
call ebx
push dword [0x4cec94]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x423013
test eax, eax
je 0x423013
call ecx
test eax, eax
je 0x423008
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x423008
test byte [ebp - 8], 1
jne 0x423013
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x423043
mov eax, dword [0x4cec88]
cmp eax, esi
je 0x423040
push eax
call ebx
test eax, eax
je 0x423040
call eax
mov edi, eax
test edi, edi
je 0x423040
mov eax, dword [0x4cec8c]
cmp eax, esi
je 0x423040
push eax
call ebx
test eax, eax
je 0x423040
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4cec84]
call ebx
test eax, eax
je 0x42305b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x42305d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041cde9
leave
ret
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x9aa390
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x65c00d
lea edi, [esi - 0x25b00d]
push edi
or ebp, 0xffffffff
jmp 0x9aa3b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9aa3b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9aa3a8
mov eax, 1
add ebx, ebx
jne 0x9aa3cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9aa3c0
jne 0x9aa3dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9aa3c0
xor ecx, ecx
sub eax, 3
jb 0x9aa3f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x9aa462
mov ebp, eax
add ebx, ebx
jne 0x9aa3fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x9aa408
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x9aa42c
inc ecx
add ebx, ebx
jne 0x9aa418
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x9aa40d
jne 0x9aa429
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9aa40d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x9aa44c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x9aa43d
jmp 0x9aa3ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x9aa44c
add edi, ecx
jmp 0x9aa3ae
pop esi
mov edi, esi
mov ecx, 0x1880
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x9aa46a
cmp byte [edi], 0x11
jne 0x9aa46a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x9aa46f
lea edi, [esi + 0x5a6000]
mov eax, dword [edi]
or eax, eax
je 0x9aa4de
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ad02c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ad084]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9aa49c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ad08c]
or eax, eax
je 0x9aa4d8
mov dword [ebx], eax
add ebx, 4
jmp 0x9aa4b9
call dword [esi + 0x5ad088]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x9aa50f
cmp al, 0xef
ja 0x9aa502
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x9aa4e4
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x9aa4f1
mov ebp, dword [esi + 0x5ad090]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x9aa543
sub esp, 0xffffff80
jmp 0x40ec9c
Function at 0x4269c9
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x426a08
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x426a08
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x426a08
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x426a08
cmp dword [ecx + 0x74], 0xe
jbe 0x426a08
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x438db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1ee44a8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1ee44b2
pushal
call 0x1ee44b8
pop ebp
sub ebp, 0x10
sub ebp, 0x1ae44a8
jmp 0x1ee44ce
mov eax, 0x1ae44a8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ca
mov edx, 0x5e75b302
xor byte [eax], dl
inc eax
dec ecx
jne 0x1ee44e5
jmp 0x1ee44f8
mov edi, ecx
mov dword [ebx + 0x202023e], ecx
add ebx, 0xfffffffa
add al, byte [edx]
add al, byte [ecx]
iretd
Function at 0x4056b2
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x445190], 2
jl 0x4056d7
movaps xmm0, xmmword [0x432480]
movaps xmmword [0x43de90], xmm0
movaps xmm0, xmmword [0x432470]
movaps xmmword [0x43dea0], xmm0
push esi
mov esi, dword [esp + 8]
mov ecx, esi
call fcn.00405a83
xor edx, edx
mov ecx, dword [esi + 0xf4]
mov eax, dword [edx + 0x432450]
mov dword [edx + ecx], eax
add edx, 4
cmp edx, 0x20
jl 0x4056e5
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
xor dword [ecx + 8], eax
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0x10]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop esi
ret 0xc

Function at 0x405e07
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x405e39
test dl, 7
je 0x405e39
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43deb0]
inc edx
mov dword [ebp + 0xc], edx
sub esi, 1
jne 0x405e19
cmp esi, 8
jb 0x405ec9
push edi
mov edi, esi
shr edi, 3
xor ebx, dword [edx]
sub esi, 8
mov edx, dword [edx + 4]
mov ecx, edx
shr ecx, 0x18
mov eax, edx
shr eax, 0x10
movzx eax, al
mov ecx, dword [ecx*4 + 0x43deb0]
xor ecx, dword [eax*4 + 0x43e2b0]
mov eax, edx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43e6b0]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x43eeb0]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x43f2b0]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43f6b0]
movzx eax, dl
mov edx, dword [ebp + 0xc]
add edx, 8
mov dword [ebp + 0xc], edx
xor ecx, dword [eax*4 + 0x43eab0]
movzx eax, bl
xor ecx, dword [eax*4 + 0x43fab0]
mov ebx, ecx
sub edi, 1
jne 0x405e48
pop edi
test esi, esi
je 0x405ee5
movzx ecx, byte [edx]
movzx eax, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x43deb0]
inc edx
sub esi, 1
jne 0x405ecd
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0xc

Function at 0x406052
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push 0x20
pop ebp
cmp dword [esi], 2
jne 0x4060a9
mov eax, dword [esi + 4]
push edi
push ebx
push ebx
push ebx
push ebx
mov dword [esp + 0x44], eax
lea eax, [esp + 0x20]
push eax
push 4
lea eax, [esp + 0x4c]
push eax
push ebp
push dword [esp + 0x58]
call fcn.0040672c
mov dword [esi + 4], ebx
mov edx, ebx
mov edi, ebx
movzx eax, byte [esp + edx + 0x10]
mov ecx, edx
and ecx, 3
shl ecx, 3
shl eax, cl
xor edi, eax
inc edx
cmp edx, ebp
jb 0x40608f
mov dword [esi + 4], edi
pop edi
cmp dword [esi], 3
jne 0x4060d5
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
add esi, 4
push eax
push ebp
push esi
push ebp
push dword [esp + 0x54]
call fcn.0040672c
push ebp
lea eax, [esp + 0x10]
push eax
push esi
call fcn.0041e680
add esp, 0xc
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 8