joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54b810
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe0000]
push edi
or ebp, 0xffffffff
jmp 0x54b832
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x54b839
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54b828
mov eax, 1
add ebx, ebx
jne 0x54b84b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x54b85c
jne 0x54b86c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x54b86c
dec eax
add ebx, ebx
jne 0x54b868
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x54b840
xor ecx, ecx
sub eax, 3
jb 0x54b884
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x54b8f6
sar eax, 1
mov ebp, eax
jmp 0x54b88f
add ebx, ebx
jne 0x54b88f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x54b89c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x54b8c0
inc ecx
add ebx, ebx
jne 0x54b8ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x54b8a1
jne 0x54b8bd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x54b8a1
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x54b8e0
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x54b8d1
jmp 0x54b82e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x54b8e0
add edi, ecx
jmp 0x54b82e
pop esi
mov edi, esi
mov ecx, 0x3c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x54b8fe
cmp byte [edi], 0xdb
jne 0x54b8fe
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x54b903
lea edi, [esi + 0x149000]
mov eax, dword [edi]
or eax, eax
je 0x54b97b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x14b9d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x14ba14]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x54b930
mov ecx, edi
jns 0x54b95f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x14ba18]
or eax, eax
je 0x54b975
mov dword [ebx], eax
add ebx, 4
jmp 0x54b94d
call dword [esi + 0x14ba1c]
popal
jmp 0x4013b4
Function at 0x1094058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x10941a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x109407e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109406a
add dl, dl
jne 0x1094089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10940dc
xor eax, eax
add dl, dl
jne 0x1094096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x109417d
add dl, dl
jne 0x10940a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10940b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10940bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10940c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10940d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1094075
mov eax, 1
add dl, dl
jne 0x10940ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10940f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10940e1
sub eax, ebx
mov ebx, 1
jne 0x1094128
mov ecx, 1
add dl, dl
jne 0x109410e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1094119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1094105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1094075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x109413f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x109414a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1094136
cmp eax, 0x7d00
jae 0x109416d
cmp eax, 0x500
jb 0x1094168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1094075
cmp eax, 0x7f
ja 0x1094170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1094075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x109419e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1094075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x4012b0
Capabilities:
Allocate or change rwx memory
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push edx
push dword [ebp + 8]
mov esi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x401342
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401342
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x401342
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
test esi, esi
je 0x401342
push 0x40
push 0x1000
push esi
push 0
mov dword [0x40546c], 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x40546c], eax
test eax, eax
je 0x401342
pop edi
mov dword [0x405480], esi
pop esi
mov dword [0x405474], ebx
mov dword [0x405478], 0x405028
mov dword [0x405470], 0x64
mov dword [0x405484], 0
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40ac30
Capabilities:
Encode data using xor

Disassembly:
jne 0x40ac3a
mov edi, ecx
mov eax, dword [ecx - 4]
dec edx
jmp 0x40ac3c

Function at 0x42449c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov byte [esp + 4], dl
mov dword [esp], eax
xor ebx, ebx
mov eax, dword [esp]
test eax, eax
jo 0x4244b7
sub eax, 4
mov eax, dword [ecx]
test eax, eax
jne 0x4244bf
mov al, 1
jmp 0x4244e9
mov eax, dword [esp]
movzx eax, word [eax]
mov word [esp + 6], ax
lea eax, [esp + 6]
call 0xfc41c510
test al, al
jne 0x4244e3
cmp word [esp + 6], 0x5f
je 0x4244e3
xor eax, eax
jmp 0x4244e5
mov al, 9
xor al, 1
test al, al
or eax, 0xa885
add byte [eax + 0x404247c], al
je 0x42454d
mov eax, dword [esp]
test eax, eax
je 0x424502
sub eax, 4
mov eax, dword [eax]
mov edi, eax
sub edi, 2
jl 0x1424596
inc edi
mov esi, 2
mov eax, dword [esp]
movzx eax, word [edx + esi*2 - 2]
mov word [eax + 8], ax
mov dword [esp + 8], eax
call 0xe041c558
test al, al
jne 0x424561
cmp word [ebp + 8], 0x5f
je 0x424541
cmp word [esp + 8], 0x2e
je 0x424541
xor eax, eax
jmp 0x424543
mov al, 1
test al, al
je 0x424598
inc esi
dec edi
jne 0x424513
jmp 0x424598
mov eax, dword [esp]
test eax, eax
je 0x424558
sub dword [eax - 0x76ff76dc], 0xfffffff8
sub edi, 2
add byte [ecx + 0x2ef83f8], cl
jl 0x424586
inc edi
mov esi, 2
mov eax, dword [esp]
movzx eax, word [eax + esi*2 - 2]
mov word [esp + 0xa], ax
lea eax, [esp + 0xa]
loopne 0x4245d5
jg 0x42457a
invalid
inc dword [eax + eax*8 - 0x7c99f38b]
jl 0x4245a8
or bl, byte [edi + 0x74]
add al, 0x33
shr bl, 2
je 0x42458c
xor eax, eax
jmp 0x42458e
mov al, 1
test al, al
je 0x424598
invalid
mov eax, ebx
add esp, 0xc
pop edi
pop esi
pop ebx
ret
invalid

Function at 0x425230
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp]
pop edx
pop edi
pop esi
pop ebx
ret
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
wait
cli
mov ebx, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [esi]
add eax, edi
push eax
push ebx
call 0xf8415120
test eax, eax
jne 0x42525d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
jge 0x425228
add al, 0

Function at 0x425268
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov dh, dl
mov edi, eax
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
mov word [esi + edi], es
push eax
push ebx
call sub.kernel32.dll_WriteFile
test eax, eax
add eax, edi
inc ebp
cld
Function at 0x42de34
Capabilities:
Encode data using xor
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
mov ebx, eax
push edx
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42dea6
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x42de88
push dword fs:[eax]
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040a940
push eax
call sub.kernel32.dll_LoadLibraryW
lea eax, [ebp - 8]
xor eax, dword [eax + 0x6459595a]
mov dword [eax + 0x2de8f68], edx
add bl, bl
loop 0x42de5e
insd dword es:[edi], dx
inc bl
jmp fcn.004093fc
invalid

Function at 0x45f048
Capabilities:
Execute syscall

Disassembly:
or al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add dword [eax - 0x7ffffff0], esp
mov edi, 0x75442aff
jo 0x45f0ab
imul esp, dword [ebx + 0x61], 0x8d736574
inc eax
add byte [ebp - 0x75], dl
in al, dx
test dl, dl
je 0x45f057
add esp, 0xfffffff0
call fcn.00408634
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [eax + ecx - 0x77]
dec eax
or al, 0x84
sal byte [edi + ecx - 0x18], cl
sbb eax, 0x64fffa96
syscall
add byte [eax], al
add byte [eax], al
add esp, 0xc
pop ebp
ret 0x208
add byte [ebp - 0x75], dl
in al, dx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
mov dword [ebp - 4], eax
mov al, byte [0xe79fd0]
call fcn.00489830
insb byte es:[edi], dx
cmpsd dword [esi], dword es:[edi]
add al, byte [eax]
mov esi, eax
xor edx, edx
push ebp
push 0x45f122
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [esi + 8]
dec ecx
cmp ebx, 0
jl 0x45f107
mov eax, dword [esi + 8]
cmp eax, ebx
ja 0x45f0e9
call fcn.004fab8c
mov eax, dword [esi + 4]
mov eax, dword [eax + ebx*4]
cmp edi, dword [eax + 4]
jne 0x45f161
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
call fcn.004015d0
jmp 0x45f129
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45f129
mov eax, dword [0x679fd0]
mov ecx, dword [eax + 8]
call fcn.00408c10
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
sti
add byte [edx + ebp - 0x75], bh
inc esi
or dword [ebx], edi
ret

Function at 0x47f53c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp dword [sym.imp.kernel32.dll_VirtualAlloc]
push ebp
mov ebp, esp
push ebx
salc
push edi
mov edi, 0x679ff0
cmp dword [edi], 0
jne 0x47f5b8
push 0x40
push 0x1000
push 0x1000
push 0
jmp 0x4151a8
Function at 0x491980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, dword [ecx - 0x7740d75]
lea eax, [ebp - 8]
mov edx, dword [0x4537f2]
call 0xff40b030
xor eax, eax
push ebp
push 0x491a6b
and al, 0xff
xor byte [ecx + ecx*4 + 0x20], ah
mov eax, ebx
mov edx, dword [0x49dbcc]
call fcn.00408274
test al, al
je 0x4919e1
mov edx, ebx
mov eax, dword [edx + 4]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4919cd
sub eax, 4
mov eax, dword [edx]
dec eax
push eax
mov eax, dword [edx + 8]
push eax
mov ecx, dword [ebp - 0xc]
mov eax, edi
mov edx, esi
call fcn.00491878
jmp 0x491a4d
mov eax, ebx
mov edx, dword [eax]
not dword [edx]
mov dword [ecx - 0x10], eax
xor eax, eax
push ebp
push 0x491a46
push dword fs:[eax]
movsb byte es:[edi], byte [esi]
mov dword [eax], esi
jmp 0x491a2a
pop edx
pop eax
pop ecx
mov dword fs:[eax], edx
push 0x491a4d
cmp byte [ebp - 0x10], 0
je 0x491a47
mov dl, 1
mov eax, dword [ebp - 0xe]
mov eax, dword [eax]
call dword [ecx - 4]
ret
mov cl, 0x39
idiv edi
jmp 0x491a35
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x491a70
lea esp, [ebp - 8]
mov edx, dword [0x45b7f0]
call 0x3cb10c
ret
Function at 0x4b43dc
Capabilities:
Encode data using xor

Disassembly:
inc esp
add al, 0x9b
int3
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
lea ebx, [ebp - 0x14]
lea ecx, [ebp - 0x18]
lea eax, [ebp - 0x10]
mov esi, edx
add esi, 0xdeadbeef
add esi, dword [ebp - 0xc]
mov dword [eax], esi
mov esi, dword [eax]
mov dword [ebx], esi
mov esi, dword [eax]
mov dword [ecx], esi
mov esi, dword [ebp - 8]
mov dword [ebp - 4], esi
test byte [ebp - 4], 3
jne 0x5b461a
cmp edx, 0xc
setle byte [ebx - 0x75000000]
add byte [eax], al
mov esi, dword [ebp - 4]
add byte [ebx + 0x368bfc75], cl
mov esi, dword [ebp - 4]
mov esi, dword [esi]
add eax, 0xfc759b30
mov esi, dword [esi + 4]
add dword [ebx], esi
mov dh, byte [ebp - 4]
mov esi, dword [esi + 8]
add dword [ecx], edi
mov esi, dword [ecx]
sub dword [eax], esi
mov esi, dword [ecx]
shl esi, 4
mov edi, dword [ecx]
shr edi, 0x1c
or esi, edi
xor dword [eax], esi
mov esi, dword [ebx + 1]
xor dword [ebx - 0x74ccd6d0], ecx
xor cl, al
out 2, al
mov ebp, dword [eax]
shr edi, 0x1a
or esi, esi
xor dword [ebx], esp
mov esi, dword [ecx + 0x338b3001]
sub dword [ecx], esi
mov esi, dword [ebx]
shl esi, 8
mov edi, dword [ebx]
shr edi, 0x18
or esi, edi
xor dword [ecx], esi
mov esi, dword [eax]
adc dword [ebx], edx
mov esi, dword [ecx]
sub dword [eax], esi
mov esi, dword [ecx]
shl esi, 0x10
mov edi, dword [ecx]
shl edi, 0x10
or esi, edi
xor dword [eax], esi
mov esi, dword [ebx]
add dword [ecx], esi
mov esi, dword [eax]
sub dword [ebx], esi
mov esi, dword [eax]
shl esi, 0x13
mov dword [eax], edi
shr edi, 0xd
or esi, edi
xor dword [ebx], esi
mov esi, dword [ecx]
add dword [eax], esi
mov esi, dword [ebx]
sub dword [ecx], esi
mov esi, dword [ebx]
shl esi, 4
mov edi, dword [ebx]
shr edi, 0x1c
or esi, edi
xor dword [ecx], esi
mov esi, dword [eax]
add dword [ebx], esi
sub edx, 8
add dword [ebp - 4], 0xc
cmp edx, 0xc
jg 0x4b4422
cmp edx, 0xc
ja case.default.0x4b44d6
invalid
and al, 0x95
invalid
inc esp
dec ebx

Function at 0x4bac84
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
add byte [eax], cl
add al, 3
or ah, cl
mov ah, 0x4b
or byte [eax], al
add dword [ebx + edx*2], eax
insb byte es:[edi], dx
test byte [edx], 0
sbb al, byte [ebx + 0x4b]
add al, 1
add byte [ebx], cl
inc ebx
outsd dx, dword [esi]
jl 0x4bad20
add dword [eax], ecx
add eax, 0xe5646ec9
Function at 0x4e36fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax - 0x7b]
sal byte [ebp + ecx + 0x33], cl
leave
mov dword [edx + 0xc], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0x44], ecx
mov dword [edx], ecx
lea eax, [ebp - 0x18]
mov edx, dword [0x804b4d60]
in al, dx
add byte [ecx - 0xe], bh
push dword [ebx]
rcl byte [ebp + 0x68], 0x91
aaa
dec esi
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
push ebx
lea eax, [ebp - 0x18]
mov edx, dword [0x4b4d60]
call fcn.0040b10c
mov ecx, eax
mov eax, dword [ebp - 0x1c]
mov edx, dword [0x401300]
call fcn.004c2f70
mov ebx, eax
test bl, bl
je 0x4e3775
mov eax, dword [ebp - 0x10]
call fcn.004359a8
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004e6c90
xor eax, eax
pop edx
pop ecx
pop ecx
insb byte es:[edi], dx
mov dword [eax], edx
push 0x4e3698
lea eax, [ebp - 0x18]
mov edx, dword [0x4b4d60]
call fcn.0040b10c
ret

Function at 0x4e3b8c
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ecx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
invalid

Function at 0x4fb354
Capabilities:
Get number of processors

Disassembly:
inc ebp
clc
xor eax, eax
rcr byte [edx], 0x59
pop ecx
je 0x4fb2e3
adc byte [eax + ebp*2 - 0x4d], ch
dec edi
add bl, al
jmp fcn.004093fc

Function at 0x521794
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x52179a
ret
Function at 0x524530
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
mov dword [ebp - 4], eax
cld
push 0
call sub.Gfi32.dll_CreateCompatibleDC
mov dword [ebp - 0x18], eax
push 0
call sub.Gfi32.dll_CreateCompatibleDC
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x52467e
push dword fs:[eax]
mov dword fs:[eax], esp
pop dword [ebp - 0x34]
shr byte [edx + 0x18], 1
mov eax, dword [ebp - 4]
push eax
call 0xfe4153b8
test bl, bl
je 0x524592
push 0
push 1
push 1
mov eax, dword [ebp + 0x78]
push eax
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041d280
mov dword [ebp - 0x10], eax
jmp 0x5245f4
push 0
call sub.user_2.tll_GetDC
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x5245a7
enter 0xfffffffffffffed1, 0xffffffffffffffff
push dword [ebx]
rcl byte [ebp + 0x68], 0xe9
inc ebp
push edx
add byte [edi + edi*8 + 0x30], ah
xor eax, eax
push ebp
push 0x5245e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00415290
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x5245d4
call fcn.00524478
xor eax, eax
pop esi
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5245f4
mov eax, dword [ebp - 0x14]
push eax
push 0
call sub.user_2.tll_ReleaseCapube
ret
cmp dword [ebp - 0x10], 0
je 0x52465e
or eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.Gfi32.dll_SeldcdObjec
mov ebx, eax
mov eax, dword [ebp - 0x10]
inc eax
mov edx, dword [ebp - 0x1c]
push eax
call sub.Gfi32.dll_SeldcdObjec
mov esi, eax
push 0xcc0020
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x1c]
push eax
call sub.Gfi32.dll_StretahBlt
test ebx, ebx
je 0x524650
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.Gfi32.dll_SeldcdObjec
test esi, esi
je 0x52465e
push esi
mov eax, dword [edi - 0x3c]
push esp
call sub.Gfi32.dll_SeldcdObjec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x524685
mov eax, dword [ebp - 0x18]
push eax
call fcn.005152f0
mov eax, dword [ebp - 0x1c]
shr al, 1
jae 0x524687
out dx, eax
inc ebx
jmp fcn.004093fc
invalid
Function at 0x53405c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x672360]
mov edx, dword [edx]
call dword [edx]
xor eax, eax
aad 0x68
adc al, byte [edx + 0x53]
add byte [edi + edi*8 + 0x30], ah
mov dword fs:[eax], esp
cmp dword [0x67a5fc], 0
jle 0x534085
dec dword [0x67a5fc]
cmp dword [0x67a5f8], 0
pinsrw mm5, word [eax + 1], 0
add byte [ebx + 0x67a5fc3d], al
add byte [eax], al
jne 0x5341f8
mov eax, dword [0x67a5b8]
push eax
call 0xc0414de0
xor eax, eax
mov dword [0x67a5f9], eax
xor eax, eax
mov dword [0x467a538], eax
adc eax, eax
jecxz 0x5340f8
cmpsd dword [esi], dword es:[edi]
add byte [bp + di], dl
shl byte [ebx + 0x67a540], 0x33
add byte [bp + di], dh
shl bl, 0x45
cmpsd dword [esi], dword es:[edi]
add byte [bx], dh
shl byte [ebx + 0x67a548], 0x33
shl byte [ebx + 0x67a54c], 0x73
shl byte [edx + 0x6aa550], 0x33
shl byte [ebx + 0x67a5d4], 0x33
shl byte [ebx + 0x67a558], 0x23
ret 0x4ca3
shl byte [ebx + 0x672560], 0x33
shl byte [ebx + 0x67a564], 0x13
shl byte [ebx + 0x67a528], 0x33
shl byte [ebx + 0x67a56c], 0x33
shl bl, 0x70
movsd dword es:[edi], dword [esi]
add byte [bp + di], dh
loopne 0x5340c0
je 0x5340c4
out 0, eax
adc eax, eax
mov dword [0x4067a578], eax
xor eax, eax
mov dword [0x67a57c], eax
xor esp, eax
mov dword [0x67a580], eax
xor eax, eax
mov dword [0x4066a584], eax
inc eax
aaa
shl byte [ebx + 0x66a598], 1
xor eax, eax
mov dword [0x66a58c], eax
xor eax, eax
mov dword [0x67a590], eax
xor eax, eax
and edx, dword [ebp - 0x3fccff99]
mov dword [0x67a498], eax
aaa
loopne 0x534106
pushfd
movsd dword es:[edi], dword [esi]
add byte [bp + si], dh
shl dword [edi + 0x67b5a1], 0x33
enter 0xffffffffffffa4ab, 0xffffffffffffffa5
add byte [bp + di], dh
shl byte [ebx + 0x67a5a8], 0x31
shl byte [edx + 0x67a5ac], 0x33
shl byte [ebx + 0x67a5b0], 0x33
shl byte [ebx + 0x67a5b4], 0x33
shl byte [ebx + 0x67a5b8], 0x37
shl byte [ebx + 0x4067a5fc], 0x33
shl dword [ebx + 0x67a5c0], 0x33
shl byte [ebx + 0x67a5c4], 0x33
shl byte [ebx + 0x67a588], 0x33
shl bl, 0xcc
mov eax, dword [0xc1330067]
mov dword [0x67a5d0], eax
xor eax, eax
mov dword [0x67a1d4], eax
mov dl, 0xc0
mov dword [0x67a5d8], eax
xor esp, eax
mov dword [0x27a5dc], eax
xor eax, eax
mov dword [0x67a7e0], eax
xor eax, eax
mov dword [0x67a564], eax
xor eax, eax
and ebp, eax
movsd dword es:[edi], dword [esi]
outsd dx, dword [esi]
xor byte [ebx], 0xc0
mov dword [0x67a5ac], eax
xor eax, eax
mov dword [0x867a5f0], eax
jae 0x5341c4
or byte [bp + di - 0x38], dh
pop edx
pop ecx
pop ecx
mov byte fs:[eax], dl
push 0x534219
mov eax, dword [0x676360]
mov edx, dword [edi + edi*8]
push edx
add al, 0xc3
stc
in eax, 0xc1
in eax, dx
invalid
Function at 0x5361a8
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x43df18]
call fcn.0040b030
xor eax, eax
push ebp
push 0x53632d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x67236c], 0
jne 0x5361fd
mov ecx, dword [0x672fc8]
mov dl, 1
mov eax, dword [0x41ce14]
call fcn.0042ad64
call fcn.004094dc
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.004078e0
mov eax, ebx
call fcn.0040a740
mov dword [ebp - 0x24], eax
mov esi, 0x53633c
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call int.0040da94
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x536242
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x536297
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x536290
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.0040aa1c
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
lea edx, [ebp - 0x58]
mov ecx, 0x10
call fcn.0040a9e0
mov eax, dword [ebp - 0x60]
pop edx
call fcn.00423ee8
test eax, eax
jne 0x536290
mov ebx, 0x15
jmp 0x53629c
mov ebx, 0x10
jmp 0x53629c
mov ebx, 0x15
xor eax, eax
push ebp
push 0x5362ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x67377c]
movzx eax, word [eax]
or ax, 8
call fcn.0040735c
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [0x67236c]
call fcn.00535fcc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5362f1
call fcn.0040734c
ret