joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5c43294d
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2ba87cf0
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x571d0f05
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..reloc_1
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2ca06955
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
mov ebx, 0x408e84
mov ecx, 0x32de1485
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, str.wk
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x773b20db
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40689a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068be
xor eax, eax
test eax, eax
je 0x4068d1
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068d1
xor ecx, ecx
jmp 0x4068d4
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4069f7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x406a2e
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a08
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x406a03
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a5f
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x406a41
pop edi
not eax
pop esi
ret 0xc

Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..00cfg
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x17e6239e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3e12590b
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e072
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3ef43925
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4b4b7e44
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x415e34
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x415fae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40edf4]
call fcn.00402af4
mov ebx, eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0040352c
lea eax, [ebp - 0x14c]
push eax
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040ee48
mov eax, dword [ebp - 0x14c]
mov edx, 0x415fc4
call fcn.00403800
je 0x415ede
push dword [ebp - 4]
push 0x415fc4
push 0x415fd0
lea eax, [ebp - 4]
mov edx, 3
call fcn.004037b0
lea eax, [ebp - 8]
mov ecx, 0x415fc4
mov edx, dword [ebp - 4]
call fcn.0040373c
jmp 0x415eeb
lea eax, [ebp - 4]
mov edx, 0x415fd0
call fcn.004036f8
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415f83
mov eax, dword [ebp - 0x148]
add eax, 0xfffffff0
sub eax, 8
jb 0x415f1d
add eax, 0xffffffe8
sub eax, 8
jae 0x415f6c
lea eax, [ebp - 0x11c]
cmp eax, 0x2e
je 0x415f6c
lea eax, [ebp - 0x11c]
cmp eax, 0x415fd4
je 0x415f6c
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036c4
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.0040373c
mov edx, dword [ebp - 0x150]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.KERNEL32.DLL_FindNextFileA
neg eax
sbb eax, eax
neg eax
test al, al
jne 0x415f07
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415fb5
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.004034b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004034b8
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x433072
nop
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x46c97124
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x45e2467d
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xd08f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd1d9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd09002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d0cdff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd09002
lea edx, [esp + 0x14]
push edx
push 0xd23140
call fcn.00d046e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d0d20b
push 0x10
call fcn.00d0d1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd08fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00cf91c0
jmp 0xd08fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d08b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd08ff0
mov ecx, edi
call fcn.00cf92c0
push edi
call fcn.00d0d1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd09021
inc ebx
cmp ebx, 0x20
jb 0xd08f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd0c1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d0c140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d0c140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d0c140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d0c140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd0c230
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x218]
push ebp
mov ebp, dword [esp + 0x218]
push esi
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd0c2d6
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea ecx, [esp + 0x14]
push 0x104
push ecx
push eax
push edx
call edi
mov esi, eax
test esi, esi
jne 0xd0c2ae
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
push ecx
call fcn.00d0c230
mov esi, eax
add esp, 8
test esi, esi
jne 0xd0c2ae
lea edx, [esp + 0x14]
push 0x104
push edx
push eax
mov eax, dword [esp + 0x1c]
push eax
call edi
mov esi, eax
test esi, esi
je 0xd0c27e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
pop edi
je 0xd0c2ce
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0xd0cbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd0cc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd1e87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd0cc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd0cc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x414058
Capabilities:
Encode data using xor

Disassembly:
sar dword [eax - 0x4b], 1
xor ecx, ebx
adc byte [ebp + 0x7b], ah
xchg ebp, eax
jae 0x4140da
clc
xchg edx, eax
sahf
xchg esi, eax
lock add dword [edi + 0x35], 0xb06134b2
adc ebp, ebp
mov dword [0x42e1833b], eax
cmp dword [esi + 0x2ace9b25], ebx
xchg edi, edi
or dh, ch
mov bh, 0x2b
not byte cs:[ebx]
mov esp, ss
xchg ebp, eax
retf 0xd20
sub eax, 0xe46d1745
lodsd eax, dword [esi]
ja 0x4140e6
jb 0x4140f6
movsb byte es:[edi], byte [esi]
or byte [eax - 0x4c1ab04a], al
movsd dword es:[edi], dword [esi]
mov byte [0x5aa8a4e5], al
shr al, 1
in eax, 0xf8
inc edx
push ss
cwde
or ebp, dword [edx]
xor ch, byte [ebx]
inc ebp
pop ecx
sub dword [esi - 0x1a9f842f], edi
pinsrw mm5, ebx, 0xcd
clc
mov ecx, 0xc4d0b400
salc
ficom word [esi]
aaa
nop
ret 0xc19b
or al, 0xe5
add ch, al
inc esi
xor al, byte [edi - 0x74bfdc20]
stc
mov ah, pe_nt_image_headers32
popfd
and dword [ebp - 0x7ba11a5a], 0x2a
push ebp
jno 0x414109
out dx, al
jg 0x414166
outsd dx, dword [esi]
scasb al, byte es:[edi]
imul eax, dword [edi + 0x58585068], 0xffffffe0
stosd dword es:[edi], eax
in eax, 0xa8
pop edx
or eax, 0xd0bcdfb5
add dh, byte [ebp - 0x76]
jne 0x414095
xor ch, dl
mov al, byte [edi + 0x473e5e79]
adc bh, byte [eax]
stosd dword es:[edi], eax
push esi
pushal
mov dword es:[0xa56b1842], eax
mov dword [0xa56b1842], eax
jnp 0x414198
outsb dx, byte [esi]
nop
xchg ebp, eax
in al, 0xbe
fst qword [ebp - 0x6b582a62]
stosb byte es:[edi], al
pushal
invalid
push es
invalid
ja 0x4140e8
pop ebp
jo 0x414130
adc byte [edi + 0x27], dh
invalid
cmp al, 0x65
aam 0x62
popfd
aaa
les ebx, [eax*2 + 0x31bf09e6]
jo 0x414116
jne 0x414150
pop ebp
loopne 0x414119
jmp 0x414185
in ax, 0xf3
fld qword [ecx]
mov eax, dword [0xd8559085]
pop ss
arpl dx, bp
inc ecx
out 0xf0, al
mov bl, 0xb8
cmc
xor bh, byte [edx + eax*2]
add eax, dword [eax*4 + 0x1d8453c]
xor dword [ecx - 0xce9d35b], esp
out dx, eax
rcl dword [ecx], cl
xor al, byte [eax + 0xfc83fd1]
add byte [ecx + 0x32], bh
inc ebp
hlt

Function at 0x45c0fd
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
mov bl, 0x77
xor dh, byte [esi - 0x428651ec]
or byte [ebx], bl
in al, dx
jbe 0x45c10f
invalid
jecxz 0x45c0a9
mov cl, 0xc1
push es
mov edx, 0x28b23bc2
mov dh, 0x28
xchg esp, eax
cwde
mov cl, byte [ebp + 0x37]
push 0x175b42b7
mov bh, 0x42
pop ebx
pop ss
lds edi, [eax + 0x6f569b50]
xor ch, byte [ebx + 4]
push edi
cmp al, byte [esi]
xor al, 0xed
mov dword [0xa709a875], eax
add dword [esi], edx
mov edx, 0x398757ac
stosd dword es:[edi], eax
salc
inc ebx
jns 0x45c188
out 0x88, al
mov ebx, 0x47774434
add bh, ah
fidiv dword [esi]
fnstcw word [ebx]
inc ebp
mov ecx, 0xc3b50bac
in al, 0xa6
inc esp
push eax
inc edi
wait
mov ebx, 0xcf436e50
xchg ecx, eax
jae 0x45c19b
push es
xchg byte [ebx + edx*4 + 0x69], bl
sbb ebp, dword [ebx]
invalid
insb byte es:[edi], dx
push esp
dec eax
inc ebx
jg 0x45c1d2
je 0x45c1d6
sahf
or eax, 0x7506ccaa
cmpsd dword [esi], dword es:[edi]
and dword [eax + 0x50e9d1f3], 0x75
call 0xf265d705
iretd
jmp 0x632e36f0
inc ebx
Function at 0x494220
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x494258
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea edx, [esp + 8]
push edx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x49425c
mov eax, dword [esp + 8]
test eax, eax
pop esi
je 0x494272
mov eax, dword [0x659684]
push 0x6593b8
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, dword [esp]
add esp, 8
ret

Function at 0x49f4b1
Capabilities:
Encode data using xor

Disassembly:
fisttp dword [ebx]
les esi, [esi]
enter 0xffffffffffffeb49, 0x46
popfd
pop eax
pop ds
std
mov ecx, 0x60bbac37
cmpsb byte [esi], byte es:[edi]
dec ebp
inc ebx
add eax, 0xfbd3dfd3
sbb eax, 0xedb6fd73
mov dword [eax + 0x3bc17d68], esi
sbb al, 0x49
push 0x1c3bc17d
dec ecx
out 0xcb, eax
xor esp, 0xcdc9650d
scasd eax, dword es:[edi]
fcom dword [eax]
popal
ror dword [esi], 1
inc ecx
aad 0x97
pop edi
xor eax, 0xc04511ee
test eax, 0xafc53c57
mov ah, 0xc5
add ch, byte [ebp - 6]
dec edi
or dword [ecx + 0x43], edi
dec edi
mov bl, 0x2a
xchg ebp, eax
xor eax, 0xdc4fdd79
std
loope 0x49f4d1
hlt
xchg edi, eax
dec eax
sub ebx, dword [edx - 0x7b418ad6]
or esi, dword [edi]
push ecx
or ebx, esi
cmp al, 0x50
jg 0x49f4da
or ebp, 0x7b
arpl word [eax + 0x593aad7], bx
xchg edi, eax
lcall 0x3117, 0xc5219716
invalid

Function at 0x532bf3
Capabilities:
Encode data using xor

Disassembly:
invalid
sti
jns 0x532c38
inc ebp
inc ebx
jmp 0x532bc2
fdivr dword [esi]
imul ebx, dword [esi - 0x3b38acf7], 0xf4700f38
invalid
jo 0x532c2e
jo 0x532c2e
sbb ebx, edi
xchg edx, eax
mov eax, dword [esi]
xchg ecx, eax
cdq
sub ah, byte [edx + 0x5a]
insd dword es:[edi], dx
sub cl, byte [edx - 0x22]
dec ebx
push eax
int 0x25
rcr byte [esi - 0x77], 1
stosb byte es:[edi], al
rol dword [ebp - 0x546140b], 1
leave
mov byte [0x5f03907], al
insd dword es:[edi], dx
add esi, edx
cmp byte [eax], bl
and al, 0xb6
or edi, esp
mov ebx, 0x6b67a4f9
or cl, bl
dec dword [edx - 0x4aab5d34]
fst dword [ebp - 0x749b4643]
cld
mov ebx, 0x97bad154
cmp dl, bh
add ecx, ebx
cmpsb byte [esi], byte es:[edi]
sub byte [edi + 0x79], al
jnp 0x532cc5
adc esp, dword [ebx + 0x3b494ada]
sub eax, 0x6453cd30
wait
or byte [edi + edi - 0x361978b6], ch
sub dword [edi], edx
add byte [edi + 0x76aa9393], 0xef
pop ecx
outsb dx, byte [esi]
leave
mov dh, 0xf6
mov bh, 0x49
add ebp, edi
retf
cmpsb byte [esi], byte es:[edi]
mov esp, 0x8f503c07
xchg edx, eax
fmul dword [0x8b475f1b]
outsd dx, dword [esi]
xchg ebp, eax
lahf
inc ecx
dec ecx
wait
aas
ror cl, cl
sbb byte [ebp - 0x40bb623], bh
fsubr st(7)
int 3
pop ecx
lds esp, [esi - 0x55302a31]
jns 0x532d16
jmp 0xe5bf263e
Function at 0x57be4e
Capabilities:
Encode data using xor

Disassembly:
dec esp
imul edx, dword [edx - 0x2e], 0xa006d33c
test dword ss:[edi + 0x25261075], edx
leave
les ebx, [ecx - 0x17]
xchg ebp, eax
push eax
ljmp 0x62af
jns 0x57be06
div byte [edx - 0x13]
inc ecx
xchg edi, eax
rol byte [ecx], 1
jbe 0x57bec1
jge 0x57bed5
adc dword [si], eax
add ecx, dword [edx]
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
and ebp, dword [ebx + 0x56ef0e52]
je 0x57beb0
mov edx, 0xe62ea078
in al, dx
inc esp
push 0x11
cmp byte [eax + 0x57], dh
sti
movsd dword es:[edi], dword [esi]
ret 0x28c7
pop esp
sal bl, 1
xchg edi, eax
clc
push esi
xchg dword [esi - 0x71], edx
add esp, ebp
xchg esi, eax
xchg esi, eax
pop esi
adc dword [edx - 0x2d22b706], edx
dec eax
fst st(2)
sbb ah, byte [ecx]
sbb dword [ecx], edx
mul ebx
in al, 0xc0
fstp xword [edx]
sub byte [ebx + ebx*8 + 0x1d3ff768], 0xd2
salc
rcl dh, cl
aaa
xor ecx, dword [esi - 0x5d]
adc ah, byte [esi - 0x18d719d]
mov dl, 0x2d
invalid
Function at 0x57f18d
Capabilities:
Check for software breakpoints

Disassembly:
stc
mov dh, 0xad
imul edi, ebx, 0xffffffc0
cmp al, 0xcc
in al, dx
sub edi, 0x44c63a2d
mov es, esp
mov ebx, ds
cmpsb byte [esi], byte es:[edi]
sub ah, byte [ebx - 0x5b1b6dd7]
invalid
invalid
out 0x9f, eax
push edi
push 0x52
jo 0x57f0bf
xor eax, 0x86135c42
daa
clc
xchg ecx, eax
sbb esp, edi
mov cl, 0xb8
sbb dword [edx + 0x72cef90e], 0xda883998
lcall 0x3998, 0x72cef90e
mov dl, bl
bound ecx, qword [ebp - 0x9a41e6]
add byte [edx + ebp*2 + 0x30], 0xa4
push ecx
out 0xe4, al
mov byte [esi + 0x64], bl
mul byte [esi]
inc ebp
movsb byte es:[edi], byte [esi]
daa
jno 0x57f0fe
out dx, eax
sbb dh, byte [edx]
cli
and eax, 0x32b8a75d
in al, 0x10
xlatb
mov esp, dword [ebx]
imul ebp, dword [eax + 0x33776f93], 0x6e
push ecx
jno 0x57f1b1
jae 0x57f132
push esi
dec edi
pop esp
mov eax, dword [0x5fe0c8ab]
mov ch, 0x17
pop ss
push 0xffffffffffffffa3
fisttp dword [edx]
sti
dec ecx
sub esi, dword es:[ebx + 0x6d713a20]
sub esi, dword [ebx + 0x6d713a20]
xchg edx, eax
aas
jae 0x57f1bf
popfd
push ss
mov dl, 0x96
inc eax
pop es
sub cl, byte [ecx + 0x60]
and eax, 0xc6016259
out dx, al
loop 0x57f1de
xchg edx, eax
xor ebx, ebp
cmp dword [bp - 0x6b2d], ebx
lahf
sub ebx, ebp
push es
jnp 0x57f18c
jae 0x57f147
cdq
push cs
jl 0x57f23b
mov ah, 0x77
push edi
lodsd eax, dword [esi]
xchg ebx, eax
xchg esp, eax
mov ch, 0x16
mov dl, 0xa
dec ecx
in al, 0xc0
ja 0x57f1f6
jbe 0x57f186
invalid
xchg esi, eax
jb 0x57f178
mov gs, word [ecx]
xchg edx, eax
aas
sub esp, dword [ebp - 0x4c]
xor byte [edx], dl
adc bl, 0x94
xchg esp, eax
js 0x57f195
add dl, byte [esi]
push esp
push 0x6d
sbb ebx, eax
push esp
enter 0xffffffffffffb956, 6
rcr byte [edi - 0x4c0d68f2], 0xeb
cmc
jne 0x57f186
ret
mov esi, 0xf7f30eac
xor al, 0x9c
mov al, 0xe6
xor al, 1
xor al, 0x78
push ecx
jb 0x57f287
mov esi, 0xb0d8a493
xor al, 0xb4
dec ebp
invalid
jmp 0x57f288
mov byte [0xe93f6d73], al
shl byte es:[ebx - 0x6d], cl
dec ebx
and al, 0x85
mov esi, 0xadb798a3
push edx
add dword [edx + 0x1b], eax
test byte [esi], dh
dec ebx
push ebx
je 0x57f257
cdq
jns 0x57f2bb
jo 0x57f1ec
retf 0x6516
ja 0x57f291
push esp
daa
jl 0x57f266
inc ebp
mov bh, ah
cld
hlt
cmp ecx, dword [esi - 0x1468f811]
pop edi
loopne 0x57f2cc
inc ebx
sub ah, byte [edi - 0x59]
retf
push eax
loop 0x57f301
or ah, byte [ebx + 0x11]
jecxz 0x57f232
pop es
cmpsb byte [esi], byte es:[edi]
lahf
int 0x26
mov al, 0x28
mov bh, 0xa4
lcall 0x5e5, 0x6dd21321
invalid
mov dh, 0xd7
jo 0x57f25e
sal byte [ecx - 0x76], 1
sbb dl, byte [ebp - 0x45e8366d]
salc
jb 0x57f2cf
or ch, byte [eax - 0x14]
in eax, 0xe2
sub bl, byte [ecx + 0xa]
shr al, cl
push 0x2ae2e5ec
loop 0x57f2fb
pop ecx
or dh, byte [esi]
shr al, cl
retf 0xf8fc
mov esi, 0x74e8028a
popal
and dword [edi + 0x63], edi
xchg esi, eax
pop ecx
jbe 0x57f280
pop eax
or eax, dword [edi - 0x7e]
sbb eax, esp
sbb byte [ebx], 0xc4
mov ebp, 0x43128d81
jae 0x57f2f1
and ebx, dword [edx - 0x3c]
rol edx, cl
cmp byte [esi], cl
inc edx
hlt