joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a24e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x41a29d
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
jmp 0x41a2a5
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41b2c5
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x41b300
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x41b2e7
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x41b2f8
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x41b302
inc edi
add eax, 0x28
cmp edi, esi
jb 0x41b2dd
xor eax, eax
pop edi
pop esi
ret

Function at 0x41b482
Capabilities:
Enumerate pe sections

Disassembly:
js 0x41b4c0
add edi, eax
movzx eax, word [edi + 0x14]
lea esi, [eax + edi + 0x18]
mov dword [ebp - 0x44], esi
call fcn.0041b285
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
sysexit
movzx eax, word [edi + 6]
lea eax, [eax + eax*4]
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.0041b285
adc esi, ebp
stosd dword es:[edi], eax
mov ch, 0x66
mov eax, dword [edi + 6]
cmp ax, bx
cmp eax, ebx
jbe 0x41b4df
lea ecx, [esi + 0xc]

Function at 0x41c190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041b263
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0041b295
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041b24a
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0041b285
scasd eax, dword es:[edi]
push 0x468efcf
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x41d448
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041b285
and edi, ebx
pop esi
xchg esp, eax
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0041b285
mov dl, 0x4b
rcr byte [ecx + ecx*2], 0x8b
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41d472
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41d472
call fcn.0041b285
test eax, 0x8b4148ed
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041b285
jg 0x41d4fa
add al, 0x3a
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
jne 0x41d4ba
call fcn.0041ba85
add eax, 0x434270
add byte [eax], dl
add byte [eax], al
je 0x41d4ec
call fcn.0041d2f6
sub dword [0x45fe68], 1
jne 0x41d4e7
lea eax, [ebp - 4]
push eax
push dword [0x45fe6c]
call fcn.0041d448
call fcn.0041d4f0
mov esp, ebp
pop ebp
ret
add byte [ebx], dh
lds ecx, [ecx + 0x76e8fc45]
std
invalid
Function at 0x4020cd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.004234eb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402118
push 0x80004005
call 0x400e9d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.004234eb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402148
push 0x80004005
call 0x400e9d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.004234eb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x402175
push 0x80004005
call 0x400e9d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004018cd
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004018cd
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x417e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x410
lea eax, [esp + 0x208]
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea ecx, [esp + 0x210]
push ecx
call edi
push str.system.ini
lea edx, [esp + 0xc]
mov esi, eax
push 0x104
push edx
push esi
push str.shell
push str.boot
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea edx, [esp + 8]
push edx
call edi
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_StrCmpNIW]
test eax, eax
je 0x417f2d
push str.install.exe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x417f2d
pop edi
xor eax, eax
pop esi
add esp, 0x410
ret
pop edi
mov eax, 1
pop esi
add esp, 0x410
ret

Function at 0x429be5
Capabilities:
Encode data using xor

Disassembly:
aam 0x35
std
dec ecx
push ebp
wait
xor eax, 0x9b5549fd
test eax, 0xeefe0f12
stosd dword es:[edi], eax
xchg esp, eax
sub eax, 0x1b97a7c5
test al, 0x39
pop ebx
js 0x429be6
invalid

Function at 0x42d666
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
adc edi, dword [edx - 0x4e]
or dword [esi + 0x581bcb7b], 0x7ebd0095
test byte [esi - 0x7685f396], dh
xchg ebx, eax
fdivr dword [ebx]
orps xmm0, xmmword [esi - 0x559cf8c5]
mov word [ebx], ds
adc ah, byte [esi - 0x29]
mov dh, 0x6a
or al, 0x7a
mov dword [ebx + 0x560f3bd8], edx
xchg byte [ebx], bh
pop es
arpl word [edx + 0x66121b8c], bp
xlatb
cmp dl, bh
fistp dword [edx]
and al, 0xd6
sub ecx, dword [esi + 0x25]
mov ah, 0xe7
mov dl, 0x65
adc esi, dword [eax + ebp*8 - 0x1457e7c0]
inc edx
pop eax
lodsb al, byte [esi]
inc ecx
les esp, [edx + edi - 0x559e0f45]
and al, byte [eax + 0x186bc252]
inc ebx
inc edx
cmc
adc dword [eax - 0x786d58de], ecx
add dh, byte [edx + 0x129a0841]
pushfd
xor ah, byte [ebx + 0x793a6c7b]
xchg esi, eax
add al, 0x6d
test byte [edx - 0x410c7031], 0x93
lcall 0x3193, 0x498b5a73
mov dh, 0x61
js 0x42d675
std
stosb byte es:[edi], al
sti
push eax
and ebx, esi
jmp 0x737493f2
Function at 0x4306dd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.00451afb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x430728
push 0x80004005
call fcn.0042f4ad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.00451afb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x430758
push 0x80004005
call fcn.0042f4ad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.00451afb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x430785
push 0x80004005
call fcn.0042f4ad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0042fedd
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0042fedd
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43111d
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call fcn.00451afb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x431177
push 0x80004005
call fcn.0042f4ad
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call fcn.00451afb
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4311aa
push 0x80004005
call fcn.0042f4ad
mov edx, dword [eax]

Function at 0x44751d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0046893b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447568
push 0x80004005
call fcn.004462ed
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0046893b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x447598
push 0x80004005
call fcn.004462ed
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0046893b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4475c5
push 0x80004005
call fcn.004462ed
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
and byte [edx + 0x79], ch
Function at 0x45e3fd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call fcn.0047f81b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e448
push 0x80004005
call fcn.0045d1cd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call fcn.0047f81b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e478
push 0x80004005
call fcn.0045d1cd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call fcn.0047f81b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45e4a5
push 0x80004005
call fcn.0045d1cd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0045dbfd
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0045dbfd
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x469793
Capabilities:
Encode data using xor

Disassembly:
add byte [edi - 0x5049e502], 0x86
sub eax, 0x72d71b0d
invalid
jbe 0x4697cc
inc edx
push es
call 0x6f67ff5d
add al, 0x48
xchg ebp, eax
jne 0x469724
mov cl, 0x58
aam 0xaa
inc dx
push ebx
inc ecx
push esi
and ebp, ebx
and ebp, dword [ebx + 0x1e7238c]
adc esi, dword [esi + 0x10552a37]
xchg edi, eax
push ebx
xor cl, byte [ecx + 0xd]
jnp 0x469786
push edx
jecxz 0x469766
xor esi, dword [ecx - 0x589eedd]
xor eax, 0xd1365157
inc ebp
push ebp
mov esi, 0x72d5c75c
cmpsb byte [esi], byte es:[edi]
push es
das
pop esi
xor dword [ebx], eax
add bh, byte [edi]
stosd dword es:[edi], eax
xchg esi, eax
jmp 0x4697a5
invalid
ret
Function at 0x48cb3d
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call int.004adf5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cb88
push 0x80004005
call fcn.0048b90d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call int.004adf5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cbb8
push 0x80004005
call fcn.0048b90d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call int.004adf5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48cbe5
push 0x80004005
call fcn.0048b90d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.0048c33d
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.0048c33d
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48d57d
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d8ec
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x59cfc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x14c], eax
call int.004adf5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d5d7
push 0x80004005
call fcn.0048b90d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 4], 0
call int.004adf5b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x48d60a
push 0x80004005
call fcn.0048b90d
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0x13c], edi
push esi
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 1
call fcn.0048d4bd
mov eax, dword [ebp - 0x134]
cmp dword [eax - 0xc], 0
mov byte [ebp - 4], 2
jne 0x48d6a8
add eax, 0xfffffff0
mov byte [ebp - 4], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d65c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [ebp - 4], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x48d67c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x134]
call fcn.0048c93d
add esp, 8
push 5
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x134]
invalid
invalid
Function at 0x4a3dfd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x53d7e1
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x59cfc8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x54ee24
call 0x4c521b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e48
push 0x80004005
call fcn.004a2bcd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
call 0x4c521b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3e78
push 0x80004005
call fcn.004a2bcd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [ebp - 4], 1
call 0x4c521b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4a3ea5
push 0x80004005
call fcn.004a2bcd
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi + 0x20], eax
push 0x79
push 0x54ee88
lea ecx, [esi + 8]
mov byte [ebp - 4], 2
call fcn.004a35fd
push 0x2f
push 0x54ee58
lea ecx, [esi + 0xc]
call fcn.004a35fd
fldz
xor edi, edi
fstp qword [esi + 0x18]
lea ecx, [esi + 0x30]
push ecx
mov dword [esi + 0x10], edi
mov dword [esi + 0x24], edi
call dword [0x54e240]
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], 0x32
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afc6e
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x90a5f1f6
xchg edx, eax
push 0x27
xchg esp, eax
scasd eax, dword es:[edi]
xlatb
in eax, dx
xor dword [esi], 0xffffffd5
in eax, dx
xchg ebp, eax
mov eax, dword [0x2eb2cf33]
arpl word [ecx], cx
out 0xf0, eax
dec ebx
fadd dword [ecx]
dec esp
or dh, dl
invalid

Function at 0x4b8e6d
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
and al, 0x2a
inc esp
jge 0x4b8e53
in al, dx
xor byte [ebx + 0x13], bh
inc esp
fist word [edi - 0x65]
pop esi
inc edx
invalid
xchg esp, eax
push ds
sbb eax, 0x9c978842
mov edi, 0x539a0fd8
push esi
inc edx
sbb byte [ebx], bl
adc al, 0x76
imul eax, edx, 0x24
loop 0x4b8e92
inc ebp
pop edi
add al, 0xb0
xsavec [edx - 0x74ddccb4]
and dh, byte [ecx + esi - 0x77]
pop ds
rol byte [edx + 0x64ee12ea], cl
push 0xd2b48933
xor dword [ecx - 0x157d2de1], ecx
adc ch, dh
push 0xd2b48933
imul ebx, dword [ebx], 0xd2714e07
and eax, eax
jae 0x4b8e57
dec esp
push esp
pushfd
popal
xlatb
cmp bl, byte [esi]
mov ecx, dword [esi + eax*8 - 0x727a5f9e]
je 0x4b8ee1
lea esi, [edi - 0x1b]
fucomi st(0)
sbb al, 0xa1
xchg ebp, eax
pop es
in eax, 0xdb
call 0x7e12fdd
dec ebx
pop ds
adc dh, al
xor si, word [ebp - 0x44]
xchg ebp, eax
jl 0x4b8eb7
test al, 0x79
bound ecx, qword [edi - 0x3244004e]
xlatb
mov cs, word [edi + 0x39d098cc]
xor byte [edi + 0x66], ah
mov cs, word [ebx - 0x3f]
sub byte [ebx - 0x3e], cl
insb byte es:[edi], dx
adc al, 0x2f
jmp 0x4b8ecc
shr dword [eax], 0x4b
ret 0x146c
Function at 0x226178e0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x22617ac2
pushal
mov esi, section.sect_1
lea edi, [esi - 0x10000]
push edi
jmp 0x2261790a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x22617911
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22617900
mov eax, 1
add ebx, ebx
jne 0x22617923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x22617934
jne 0x22617953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22617953
dec eax
add ebx, ebx
jne 0x22617940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x22617918
add ebx, ebx
jne 0x2261794f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x226179a5
xor ecx, ecx
sub eax, 3
jb 0x2261796b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x226179da
sar eax, 1
mov ebp, eax
jmp 0x22617976
add ebx, ebx
jne 0x22617976
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22617944
inc ecx
add ebx, ebx
jne 0x22617984
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x22617944
add ebx, ebx
jne 0x22617991
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x22617986
jne 0x226179a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x22617986
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x226179c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x226179b6
jmp 0x22617906
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x226179c4
add edi, ecx
jmp 0x22617906
pop esi
mov edi, esi
mov ecx, 0x9a00
jmp 0x22617a07
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x22617a07
cmp ecx, 4
jb 0x22617a0c
mov eax, dword [edi]
sub al, 6
jne 0x22617a07
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
sub ecx, 4
stosd dword es:[edi], eax
sub ecx, 1
jae 0x226179e4
lea edi, [esi + 0x15000]
mov eax, dword [edi]
or eax, eax
je 0x22617a54
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x17000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1703c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x22617a12
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x17040]
or eax, eax
je 0x22617a4e
mov dword [ebx], eax
add ebx, 4
jmp 0x22617a2f
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x22617a85
cmp al, 0xef
ja 0x22617a78
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x22617a5a
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x22617a67
mov ebp, dword [esi + 0x17044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ff]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x22617ab9
sub esp, 0xffffff80
jmp 0x22603d83