joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f300
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
cmp esi, 4
jae 0x40f329
test esi, esi
jbe 0x40f358
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
shl edx, 8
xor edx, ebx
xor eax, edx
inc ecx
dec esi
jne 0x40f315
pop esi
pop ebx
ret
push edi
mov edi, 4
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
shl edx, 8
xor edx, ebx
xor eax, edx
inc ecx
dec edi
jne 0x40f32f
cmp esi, 4
pop edi
jbe 0x40f358
add esi, 0xfffffffc
xor ebx, ebx
lea edx, [eax + eax]
mov bl, byte [ecx]
xor edx, ebx
xor eax, edx
inc ecx
dec esi
jne 0x40f349
pop esi
pop ebx
ret
Function at 0x40f430
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x24c
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.MSVCRT.dll_time]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x50]
push 0x200
push edx
push 0xb
push str.CjaB1L7Tl10
mov dword [esp + 0x14], ecx
call fcn.004164a0
mov edx, dword [esp + 0x274]
add esp, 0x14
neg edx
sbb edx, edx
lea eax, [esp + 0x14]
lea ecx, [esp + 4]
and edx, 0xd0026
push eax
push ecx
add edx, 0x20019
push 0
push edx
push 0
push 0
lea eax, [esp + 0x64]
push 0
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40f548
mov eax, dword [esp + 0x25c]
push 0x200
test eax, eax
je 0x40f4bd
lea ecx, [esp + 0x50]
push ecx
push 4
jmp 0x40f4cb
mov eax, dword [esp + 0x254]
lea edx, [esp + 0x50]
push edx
push 0xc
push eax
call fcn.00416530
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + eax + 0x4c], 0
lea edx, [esp]
push ecx
lea eax, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x58]
push 0
push ecx
push edx
mov dword [esp + 0x20], 3
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [esp + 0x10]
jne 0x40f518
cmp dword [esp], eax
jle 0x40f53d
mov edx, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp + 0xc]
lea ecx, [esp]
push eax
push ecx
mov ecx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x58]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x254]
push ebp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_gmtime]
lea eax, [eax + eax*2]
push edi
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0xc]
lea eax, [eax + eax*4]
push ecx
lea eax, [eax + eax*4]
lea eax, [eax + eax*8]
shl eax, 7
add edi, eax
mov dword [esp + 0x10], edi
call esi
mov ebp, dword [esp + 0x268]
add esp, 4
test eax, eax
je 0x40f5f4
lea edx, [esp + 0xc]
push edx
call esi
mov ecx, 9
mov esi, eax
lea edi, [esp + 0x38]
xor eax, eax
mov ax, word [ebp]
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
add ecx, 0x76c
inc edx
cmp eax, ecx
jle 0x40f5c5
mov ax, word [esp + 0x40]
mov word [ebp], cx
mov word [ebp + 2], dx
jmp 0x40f5f0
jne 0x40f5f4
xor eax, eax
mov ax, word [ebp + 2]
cmp eax, edx
jle 0x40f5e0
mov cx, word [esp + 0x40]
mov word [ebp + 2], dx
mov word [ebp + 6], cx
jmp 0x40f5f4
jne 0x40f5f4
mov eax, dword [esp + 0x40]
xor edx, edx
mov dx, word [ebp + 6]
cmp edx, eax
jle 0x40f5f4
mov word [ebp + 6], ax
lea eax, [esp + 0x24]
mov esi, 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ax, word [ebp]
mov cx, word [esp + 0x24]
cmp cx, ax
jbe 0x40f61e
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24c
ret
jb 0x40f653
mov ax, word [ebp + 2]
mov cx, word [esp + 0x26]
cmp cx, ax
jbe 0x40f63a
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24c
ret
jb 0x40f653
mov cx, word [esp + 0x2a]
cmp cx, word [ebp + 6]
jbe 0x40f653
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x24c
ret
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x24c
ret
Function at 0x410610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e078
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
push ecx
lea eax, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0xc], esp
push eax
mov dword [esp + 0x28], 1
call sub.MFC42.DLL_CString::CString_2
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::CString_2
push ecx
mov byte [esp + 0x2c], 3
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.LocFile
call sub.MFC42.DLL_CString::CString_1
push ecx
mov byte [esp + 0x30], 4
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Configuration
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x14]
mov byte [esp + 0x30], 1
push eax
call fcn.004108b0
mov ecx, dword [esp + 0x18]
add esp, 0x14
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea ecx, [esp + 4]
mov dword [0x42a0c8], eax
mov esi, eax
call fcn.004193cc
lea ecx, [esp + 0x28]
mov byte [esp + 0x20], 0
call fcn.004193cc
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0xffffffff
call fcn.004193cc
mov ecx, dword [esp + 0x18]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret

Function at 0x4107e0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x41e0c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x404
lea ecx, [esp]
lea edx, [esp + 4]
xor eax, eax
push ecx
mov ecx, dword [esp + 0x418]
push edx
push eax
mov dword [esp + 0x418], eax
mov byte [esp + 0x10], al
push eax
mov eax, dword [esp + 0x428]
mov dword [esp + 0x10], 0x400
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410875
mov ecx, dword [esp + 0x41c]
lea edx, [esp + 4]
push edx
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x418]
mov dword [esp + 0x40c], 0xffffffff
call fcn.004193cc
xor eax, eax
mov ecx, dword [esp + 0x404]
mov dword fs:[0], ecx
add esp, 0x410
ret
lea ecx, [esp + 0x418]
mov dword [esp + 0x40c], 0xffffffff
call fcn.004193cc
mov ecx, dword [esp + 0x404]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x410
ret
Function at 0x413b30
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x41e2e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x20]
xor edi, edi
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0xc]
push 0x9355
push ecx
mov dword [esp + 0x20], eax
call fcn.00410710
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], eax
call fcn.004193cc
push edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x413bd6
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004193cc
pop edi
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
lea edx, [esp + 0x10]
push ebx
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
mov ebx, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp ebx, edi
je 0x413c64
push 0x104
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413c4a
mov ecx, dword [esp + 0xc]
push 1
push 1
push edi
push edi
push ecx
mov ecx, esi
call fcn.004140b0
mov edx, dword [esi + 0x80]
push edi
push eax
push 0x1013
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x413c64
mov eax, dword [esp + 0x10]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004193cc
mov ecx, dword [esp + 0x34]
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x413b48
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41e2e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0x20]
xor edi, edi
push 0x104
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
call sub.MFC42.DLL_CString::GetBuffer
lea ecx, [esp + 0xc]
push 0x9355
push ecx
mov dword [esp + 0x20], eax
call fcn.00410710
mov eax, dword [eax]
add esp, 8
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], eax
call fcn.004193cc
push edi
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x413bd6
lea ecx, [esp + 8]
mov dword [esp + 0x38], 0xffffffff
call fcn.004193cc
pop edi
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret
lea edx, [esp + 0x10]
push ebx
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
mov ebx, eax
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp ebx, edi
je 0x413c64
push 0x104
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push 0xffffffffffffffff
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413c4a
mov ecx, dword [esp + 0xc]
push 1
push 1
push edi
push edi
push ecx
mov ecx, esi
call fcn.004140b0
mov edx, dword [esi + 0x80]
push edi
push eax
push 0x1013
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x413c64
mov eax, dword [esp + 0x10]
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004193cc
mov ecx, dword [esp + 0x34]
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret
Function at 0x4144f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x41e398
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edi
lea ebx, [edi + 0x60]
test ebx, ebx
je 0x4146fc
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x4146fc
or esi, 0xffffffff
mov eax, dword [edi + 0x80]
push 0
push esi
push 0x100c
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
cmp esi, 0xffffffff
je 0x414557
push 0xf00
push 0
push esi
mov ecx, ebx
call sub.MFC42.DLL_CListCtrl::SetItemState
jmp 0x41452a
mov ebx, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov eax, dword [ebx + 8]
test eax, eax
jle 0x4146fc
push ebp
mov ecx, dword [esp + 0x18]
mov edx, dword [ebx + 4]
lea edi, [ecx*4]
lea ecx, [esp + 0x30]
add edx, edi
push edx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x30]
mov edx, dword [ebx + 4]
xor ecx, ecx
mov dword [esp + 0x28], 0
mov al, byte [eax]
cmp al, 0x2a
mov eax, dword [edx + edi]
sete cl
mov ebp, ecx
lea ecx, [esp + 0x30]
add eax, ebp
push eax
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x30]
call sub.MFC42.DLL_CString::MakeUpper
or esi, 0xffffffff
mov eax, dword [esp + 0x14]
push 0
push esi
push 0x100c
mov ecx, dword [eax + 0x80]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
cmp esi, 0xffffffff
je 0x414698
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x14]
push esi
push edx
lea ecx, [eax + 0x60]
call sub.MFC42.DLL_CListCtrl::GetItemText
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 1
call sub.MFC42.DLL_CString::MakeUpper
mov ecx, dword [esp + 0x14]
push esi
add ecx, 0x60
call sub.MFC42.DLL_CListCtrl::GetItemData
cmp eax, 1
jbe 0x414643
lea edx, [esp + 0x1c]
push 2
push edx
lea ecx, [esp + 0x18]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x2c], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x28], 1
call fcn.004193cc
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x41466d
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.004193cc
jmp 0x4145be
test ebp, ebp
jne 0x414688
mov edx, dword [esp + 0x14]
push 0xf00
push 0x100
push esi
lea ecx, [edx + 0x60]
call sub.MFC42.DLL_CListCtrl::SetItemState
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.004193cc
jmp 0x4146d6
mov eax, dword [ebx + 4]
lea ecx, [esp + 0x30]
mov edi, dword [eax + edi]
add edi, ebp
push edi
call sub.MFC42.DLL_CString::operator_1
mov ecx, dword [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4146d6
mov eax, dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + 0x14]
push 0
test ebp, ebp
sete dl
push edx
push 0
push 0
push eax
call fcn.004140b0
lea ecx, [esp + 0x30]
mov dword [esp + 0x28], 0xffffffff
call fcn.004193cc
mov eax, dword [esp + 0x18]
mov ecx, dword [ebx + 8]
inc eax
cmp eax, ecx
mov dword [esp + 0x18], eax
jl 0x41456f
pop ebp
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 4
Function at 0x415290
Capabilities:
Enumerate network shares

Disassembly:
sub esp, 0x14
push esi
mov esi, dword [esp + 0x20]
movsx eax, byte [esi]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
add esp, 4
cmp al, 0x41
mov byte [esp + 0x20], al
jl 0x41540a
cmp al, 0x5a
jg 0x41540a
cmp byte [esi + 1], 0x3a
jne 0x41540a
mov al, byte [esi + 2]
add esi, 2
cmp al, 0x5c
mov dword [esp + 0x14], esi
jne 0x41540a
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 1
push 1
call sub.MPR.dll_WNetOpenEnumA
test eax, eax
jne 0x41540a
push ebx
push ebp
mov ebx, 0x640
push edi
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebp, eax
mov dword [esp + 0x1c], 0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push ebp
push eax
push ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xffffffff
call sub.MPR.dll_WNetEnumResourceA
cmp eax, 0xea
jne 0x415348
mov eax, dword [esp + 0x14]
push eax
push ebp
mov ebx, eax
call dword [sym.imp.MSVCRT.dll_realloc]
add esp, 8
mov ebp, eax
jmp 0x41530b
test eax, eax
jne 0x4153ea
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x41530b
lea edi, [ebp + 0x10]
mov eax, dword [edi]
test eax, eax
je 0x415379
movsx edx, byte [eax]
push edx
call dword [sym.imp.MSVCRT.dll_toupper]
movsx ecx, byte [esp + 0x30]
add esp, 4
cmp ecx, eax
je 0x415387
mov eax, dword [esp + 0x10]
inc esi
add edi, 0x20
cmp esi, eax
jl 0x41535d
jmp 0x41530b
shl esi, 5
or ecx, 0xffffffff
xor eax, eax
mov edi, dword [esi + ebp + 0x14]
mov edx, dword [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push edx
mov eax, ecx
mov esi, edi
mov edi, edx
mov dword [esp + 0x20], 1
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x24]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
mov ecx, dword [esp + 0x18]
push ecx
call sub.MPR.dll_WNetCloseEnum
push ebp
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x14
ret
xor eax, eax
pop esi
add esp, 0x14
ret
Function at 0x41ca80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 8]
xor ecx, ecx
test esi, esi
jbe 0x41cab9
mov eax, dword [esp + 0x10]
push ebx
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x4297b4]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x41ca95
pop edi
pop ebx
pop esi
ret
mov eax, dword [esp + 0x10]
pop esi
ret
Function at 0x431f60
Capabilities:
Encode data using xor

Disassembly:
jmp 0x431f48
call fcn.004326b6
adc eax, 0xad1ca237
sub eax, 0xfcc24a1c
lodsd eax, dword [esi]
popal
pop edi
sbb byte [ebp - 0x56c6f3f1], 0x5b
shr dword [ecx + ebp*2 + 0x3d], 1
push eax
push eax
adc eax, 0x91cff15b
test eax, 0xa968f637
test eax, 0xadfb4506
cmp dword [esi + 8], ebp
xor eax, 0x200eaa7f
mov esi, 0xb4f15a5
sbb al, 9
xor byte [ebp - 0x77], ah
jp 0x431f7e
cmp al, 0x91
mov eax, 0x68d397f
dec ebx
and al, 0xbd
lodsd eax, dword [esi]
jno 0x431fd3
lodsb al, byte [esi]
xor eax, 0xadb81039
cmp dword [esi], eax
push es
cmpsd dword [esi], dword es:[edi]
sbb byte [ecx + 0x19adb861], dl
push es
les esi, [ebp + 0x3da591d4]
push es
mov al, 0x50
xchg ecx, eax
aaa
inc ecx
popal
cmp dword [eax], 0xa93bc606
in al, dx
mov esp, 0x5b15a596
cmp esp, ecx
popfd
lodsd eax, dword [esi]
adc eax, 0x6a99104
jbe 0x431f9e
lodsd eax, dword [esi]
xor byte [ebp - 0x53], ch
jne 0x43201b
stc
sub edx, ebp
test eax, 0xad915e27
lodsd eax, dword [esi]
retf
or byte [ecx - 0x75d5b57], dl
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
adc eax, 0x91441b4f
inc eax
dec ebp
test eax, 0x4d1bd8c1
jno 0x43200c
fdivr qword [ecx + edx*4]
pop edi
push edx
pop edi
push ecx
mov word [edx - 0x57], fs
pop ebx
enter 0x55e0, 0xffffffffffffff85
stosb byte es:[edi], al
popal
pop edi
push ecx
jg 0x431fd9
invalid
mov ecx, 0x769
call fcn.00442f6d
jmp 0x431f43

Function at 0x4825af
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jne 0x4c7320
pop eax
call fcn.00525a6d
xor eax, dword [ebp + 0xc]
jne 0x474eb3
jmp 0x4b4133
push ebx
push ecx
push edx
push edi
push esi
jmp 0x4b9660
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0x10c]
jmp 0x42025a
mov ecx, dword [ecx]
lea edi, [ebp - 0x104]
push edi
lea edx, [ecx + 0x30]
push dword [edx]
jmp 0x5298ee
push ebp
mov ebp, esp
add esp, 0xfffffef4
jmp 0x43eb7c
pop ecx
push dword [ecx + 0xc]
pop ecx
push dword [ecx + 0xc]
pop ecx
jmp 0x474eb3
jne 0x45c8e1
push dword [ebx + 0x18]
pop dword [ebp - 0x108]
mov esi, dword [ebx + 0x20]
add esi, edi
jmp 0x5229fc
mov edi, dword [ecx + 0x18]
mov ebx, edi
add ebx, dword [ebx + 0x3c]
lea ebx, [ebx + 0x78]
mov eax, dword [ebx + 8]
jmp 0x4b8ab9
mov ebx, dword [ebx]
add ebx, edi
push dword [ebx + 0x10]
pop dword [ebp - 0x10c]
cmp dword [ebp + 0x14], 0
jmp 0x49ba6c
cmp dword [ebp + 8], 0
je 0x4b9672
mov edi, dword [ebp + 8]
jmp 0x4b4136
push dword fs:[0x30]
jmp 0x490649
xor ebx, ebx
mov ax, word [edx + ebx*2]
cmp al, 0x40
jl 0x4ea2d6
cmp al, 0x5b
jmp 0x4ea2ce
jg 0x4ea2d6
add al, 0x20
stosb byte es:[edi], al
inc ebx
test ax, ax
jmp 0x43d0ad
pop edx
test edx, edx
jne 0x4c731e
mov edi, dword [ebp + 0xc]
jmp 0x4b4136
Function at 0x4a9ec0
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebx + 0x32], 0xea34b26c
mov ch, 0xc7
inc esi
or al, 0x56
lodsb al, byte [esi]
xor al, 0x30
and eax, 0xa637b051
into
or byte [ebp - 0x6e8c1b88], ch
popal
xchg dword [ebp + 6], esp
fldcw word [eax - 0x5b]
inc eax
cdq
test eax, 0x1108eea7
jo 0x4a9e6b
lodsd eax, dword [esi]
mov ebp, 0x995611e8
xor byte [eax], dl
test eax, 0x61645c06
cmp dword [edi - 0x72], edi
mov ah, 0x15
dec edi
xor cl, byte [eax - 0x34]
movsd dword es:[edi], dword [esi]

Function at 0x4b8c10
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
push eax
mov ebp, 0xddcdf2aa
invalid
mov al, bh
mov word [ecx + 0x2fd977a7], ds
dec esp
pop ss
sub eax, 0x3f06515d
inc ecx
ja 0x4b8c74
sahf
adc byte [ecx + 0x4cc3b874], bl
daa
call dword [esi - 0x63eb2a24]
mov al, byte [0xfad8b4fe]
mov byte [0xe515b240], al
loop 0x4b8bd2
mov eax, 0xff274cc3
xchg esi, eax
invalid
out 0x23, eax
je 0x4b8c26
in eax, 0x33
push ecx
invalid
xor edx, dword [ecx - 0x10]
fild dword [ecx - 0x5e]
pop ebx
cmp esp, esi
sub ecx, dword [ecx]
mov dh, 0xa9
bound ebp, qword [edx - 3]
xor byte [edx + 0x18c0c28e], cl
inc ebp
mov eax, 0x5a161111
push ss
pop edx
jbe 0x4b8c40
pop ecx
dec eax
in al, dx
add ebx, dword cs:[ebx + 0x2b]
dec esi
cmc
sub dword [ebx + edi*8], ebx
bnd jnp 0x4b8c94
lodsd eax, dword [esi]
je 0x4b8cc0
pop ebp
push dword [esi - 0x5d]
mov dl, 0x1b
or byte [edx + ebp - 0x10], bh
push esp
mov byte [eax + 0x10fabef], 0x3d
adc byte [esi - 0x28], 0x6d
hlt
mov eax, dword [0x9dbd6707]
inc edx
out 0x15, eax
jns 0x4b8cb2
loopne 0x4b8ca4
dec eax
test al, 0x9b
xchg dword [ebx], edx
sub al, 0xe0
mov eax, dword [0xd2a70141]
mov esi, 0xce393e86
cmp esi, ecx
mov gs, word [esi - 0x299775e8]
sahf
mov esi, 0xb53b1d51
test al, 0xe1
sbb byte [edx - 0x41612998], cl
push ecx
sbb eax, 0xe1a8b53b
mov ch, 0xa8
loope 0x4b8d34
jo 0x4b8cb7
xacquire xchg byte [ecx - 0x32], dl
xchg byte [ecx - 0x32], dl
lcall 0x9def, 0xec00f147
cli
cmp byte [edi - 0x5a767b3a], bh
loopne 0x4b8c5b
ljmp 0xe24b:0x55e84b55
in eax, dx
adc eax, 0x938b6290
jns 0x4b8d8f
push esp
inc ebp
por mm5, qword [ebx]
pop ss
hlt
mov ecx, dword [ebp + 0x5b]
mov esi, 0xc458428e
xor eax, 0xd333ecd6
rcl byte [edx + 0x7ec73b4c], cl
hlt
Function at 0x4dd4e0
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x8a91156d
scasd eax, dword es:[edi]
xchg ecx, eax
das
test eax, 0x8761d861
pop ecx
sub eax, 0xf8503705
sub dword [ecx + 0x7f], ecx
sbb al, 0x61
lodsd eax, dword [esi]
inc esi
xor al, 0xc0
test al, 0xd2
test eax, 0xdd28ca92
movsd dword es:[edi], dword [esi]
aaa
mov cs, esp
xor eax, 0x6c90abd1
popal
vaddss xmm5, xmm6, dword [ecx + 0x7c354d4c]
jno 0x4dd52e
movsb byte es:[edi], byte [esi]
lodsd eax, dword [esi]
xor byte [eax + ecx*2 - 2], ah
std
pop eax
push ebp
xchg ecx, eax
xchg ecx, eax
pop ss
movsb byte es:[edi], byte [esi]
movsd dword es:[edi], dword [esi]
xor byte [edi], dl
movsb byte es:[edi], byte [esi]
test eax, 0xf4525f30
cmpsb byte [esi], byte es:[edi]
or dh, byte [ecx + 0x30]
or cl, byte [eax]
xor byte [edx], cl
or byte [edi], bh
aas
xchg ecx, eax
popal
cmp eax, 0xf85172a6
xchg ecx, eax
test eax, 0xad3d3061
adc byte [ebp*4 - 0x3f61f6d7], bh
xor eax, 0xff4430a4
test eax, 0xfc60810a
sub eax, 0x4fa163b8
xchg ecx, eax
popal
loope 0x4dd533
push es
add eax, 0xa5dcfcdc
lodsb al, byte [esi]
outsd dx, dword [esi]
lodsd eax, dword [esi]
jg 0x4dd58f
mul dword [ebx + 0x5554517c]
movsd dword es:[edi], dword [esi]
xor cl, byte [edx]
fisttp qword [eax + 0x3d]
xor bl, ch
jnp 0x4dd5b3
xor eax, 0xad98764
test dh, al
retf 0xc7b7
or al, 0x33
test eax, 0xad3cde0a
sbb al, 0x9b
lodsd eax, dword [esi]
nop
or byte [edi + 0x51a99f38], bl
dec ebx
insd dword es:[edi], dx
insb byte es:[edi], dx
xor byte [edi + edx*2 + 0x39], ch
loope 0x4dd530
and cl, ah
add dword [eax + eax*4 - 0x6f], esp
rcl byte [ecx - 0x11f50e9f]
or ch, dh
sub al, byte [eax - 0x23]
cmp dword [eax + 0x78ad31e1], esp
movsb byte es:[edi], byte [esi]
test al, 0xd9
test eax, 0x4328e3e1
movsd dword es:[edi], dword [esi]
add dword [edi - 0x16], ebx
inc esp
xchg ecx, eax
movsd dword es:[edi], dword [esi]
push ecx
invalid
Function at 0x5561b4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x587f75
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00587c26

Function at 0x587f80
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00587db0

Function at 0x58a625
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0058a178