joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47be71
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x47beb2
push 0x693cb4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x47bec1
push str.SetFileAttributesTransactedA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x47bec1
push dword [esi]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x685db4]
call edi
jmp 0x47bec3
cmp dword [esi + 4], 0
je 0x47bec1
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8

Function at 0x497aed
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.004f7d11
call fcn.0042fe64
cmp dword [eax + 0x14], 0
jne 0x497b08
mov ecx, esi
pop esi
jmp fcn.00496dcd
pop esi
ret

Function at 0x498e0c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00429b62
call fcn.0042fe64
cmp dword [eax + 0x14], 0
jne 0x498e27
mov ecx, esi
pop esi
jmp fcn.00498604
pop esi
ret

Function at 0x4a2d5b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
push edi
test esi, esi
jne 0x4a2d74
call fcn.0042fe10
mov esi, dword [eax + 0xc]
push 0x6a1bd4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
je 0x4a2db6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4a2db6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x4a2db6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004a2dbf
jmp 0x4a2db8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x5e90ff
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x5e9176
cmp dword [ebp + 0xc], 0
je 0x5e9176
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x5e9126
call fcn.0042fe10
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5e9176
push dword [ebp + 0xc]
mov dword [edi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x5e9176
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x5e9176
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5e9176
mov ecx, dword [edi]
push eax
mov esi, dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push eax
mov ecx, esi
call dword [0x685db4]
mov ecx, edi
call esi
jmp 0x5e9178
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x5fc0f1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.00605c60
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
leave
ret 0x14

Function at 0x64f005
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0064ebfd

Function at 0x64f010
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0064ed87

Function at 0x651873
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0065123b

Function at 0x65232b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.006521ff
Function at 0x401410
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x5c8bb0]
xor eax, esp
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x6c]
xor ecx, ecx
push esi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ecx
push eax
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00405370
add esp, 4
lea esi, [esp + 8]
mov ecx, edi
call fcn.00405410
mov ecx, dword [esp + 0x64]
pop esi
xor ecx, esp
call int.0054a845
add esp, 0x68
ret

Function at 0x401b30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x6c
mov eax, dword [0x5c8bb0]
xor eax, esp
mov dword [esp + 0x68], eax
push esi
lea eax, [esp + 8]
mov esi, edx
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
call fcn.00403e90
add esp, 8
test eax, eax
jne 0x401b9b
pop esi
mov ecx, dword [esp + 0x68]
xor ecx, esp
call int.0054a845
add esp, 0x6c
ret
mov eax, dword [esp + 0x74]
test eax, eax
jbe 0x401bb0
push esi
lea ecx, [esp + 0x14]
call fcn.00405370
add esp, 4
lea esi, [esp + 0x10]
mov ecx, ebx
call fcn.00405410
test edi, edi
je 0x401bce
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, dword [esp + 8]
sete al
mov dword [edi], eax
mov ecx, dword [esp + 0x6c]
pop esi
xor ecx, esp
mov eax, 1
call int.0054a845
add esp, 0x6c
ret

Function at 0x401c30
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x64
mov eax, dword [0x5c8bb0]
xor eax, esp
mov dword [esp + 0x5c], eax
xor eax, eax
push esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
push edi
lea eax, [esp + 8]
mov edi, ecx
push eax
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00404090
add esp, 4
test eax, eax
jne 0x401c8e
pop edi
pop esi
mov ecx, dword [esp + 0x5c]
xor ecx, esp
call int.0054a845
add esp, 0x64
ret
lea esi, [esp + 8]
mov ecx, ebx
call fcn.00405410
mov ecx, dword [esp + 0x64]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call int.0054a845
add esp, 0x64
ret

Function at 0x401cb0
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0x74
mov eax, dword [0x5c8bb0]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
push edi
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x10], 0x6a09e667
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
call fcn.00404180
add esp, 8
test eax, eax
jne 0x401d2f
pop edi
mov ecx, dword [esp + 0x70]
xor ecx, esp
call int.0054a845
add esp, 0x74
ret
mov eax, esi
lea edi, [esp + 8]
call fcn.00404f50
mov ecx, dword [esp + 0x74]
pop edi
xor ecx, esp
mov eax, 1
call int.0054a845
add esp, 0x74
ret
Function at 0x4561c0
Capabilities:
Encode data using xor

Disassembly:
pop ds
int 0xa3
mul byte [edi - 0x1024e014]
fdiv st(3)
sub esp, dword [ebx + 0x44aa232a]
mov ecx, 0x6aaadf2b
stosb byte es:[edi], al
ret 0xbff1
fadd dword [ecx - 0x11]
ret 0xfa0e
mov al, 0x87
jle 0x456144
cmp eax, 0x21ec3f74
inc eax
jg 0x45620c
pop eax
lodsd eax, dword [esi]
xchg dword [ecx - 0x4b], esp
push ds
push cs
sbb dword [eax], ecx
lcall 0x2a67, 0x2975129c
mov dh, 0xc0
cld
cmpsb byte [esi], byte es:[edi]
inc ebp
mov esi, 0x9c33839d
mov cs, word [eax]
jae 0x4561f6
or ecx, edx
lahf
sbb edx, dword [esi]
cld
cli
fdiv qword [eax - 0x20465770]
int 0x2d
leave
rol dword [ebx - 3], 1
dec eax
aad 0x49
mov bl, bh
xchg ebx, eax
and byte [edi + 0x27], dl
and al, 0xa5
div ah
in eax, dx
arpl word [eax], si
mov ah, dl
jge 0x45621d
invalid
xor byte [eax + 0x710c7dd4], cl
inc ecx
jno 0x456254
stc
in eax, 0x71
shr dword [edi + 0x7c85c797], 0x57
mov al, byte ds:[0xf6e46c7c]
pushfd
adc al, 0x6c
push ecx
add eax, 0x5845c619
jae 0x456230
jge 0x4561b3
or al, 0xa9
adc dword [ebx - 0x805798d], esi
push 0x1ec8df23
adc al, 0x14
adc dword [ecx + 0x70507b39], edi
and al, 0xfc
sbb dword [0x73642839], edx
jbe 0x456285
jae 0x4562c5
xor eax, 0x17f346fb
sti
inc esi
pop ss
dec ax
pop esi
ja 0x45624d
mov dword [0x6fa3baa4], eax
mov bl, 0x49
call 0x59e10d85
les eax, [ebx - 0x30]
mov dh, 0xf7
xchg edx, eax
push ds
jl 0x4562f1
das
movsb byte es:[edi], byte [esi]
test al, 0
mov cl, byte [edx]
mov al, byte [0x2bef8a8]
sub dword [eax + eax*2 - 0x2492fb6f], ebp
jmp 0x14cab12b
jns 0x456307
xor edi, ebp
sti
jns 0x456314
xor dword [esi], eax
fsub qword [eax + 0xca7584c]
pop es
sbb al, 0xc6
dec eax
hlt
enter 0xffffffffffffa62a, 0x15
sti
push edi
mov ebp, edi
stosd dword es:[edi], eax
mov al, 0x7f
jg 0x4562e5
outsb dx, byte [esi]
mov ebx, 0x4557e535
push esp
jno 0x456340
push eax
mov edi, 0x7862ab9b
aam 0xef
cdq
stosb byte es:[edi], al
inc eax
invalid
lodsd eax, dword [esi]
mov word [ebx + 0x3619cd7d], es
push ebp
scasb al, byte es:[edi]
invalid
leave
cld
cmp ebx, eax
pop ss
push 0x1d
jg 0x456358
jns 0x4562e0
outsd dx, dword [esi]
leave
fbstp tbyte [edx]
in eax, dx
sub eax, 0xc61aff90
insd dword es:[edi], dx
and byte [ebx + 0x25], bh
enter 0x173e, 0x64
and eax, 0x64173ec8
das
imul dword [edx]
mov ebx, 0xca2391d5
inc byte [ebx + ecx*2 + 0x764927f6]
xchg ebx, eax
wait
idiv dword [ebx - 0x44]
adc ebx, ecx
push ebx
sbb eax, 0x181b006c
fbld tbyte [esp + esi*8 + 0x7e6ee13b]
cdq
inc esi
adc eax, 0x54f902ab
sal ecx, 1
lea ebx, [ebp + 0x1341fd53]
jnp 0x456331
xor al, 0xb
insd dword es:[edi], dx
and ecx, dword [esi - 0x72d7c23c]
hlt
Function at 0x459580
Capabilities:
Encode data using xor

Disassembly:
test byte [0xa9b2a345], al
and byte [edi + ebp*4 + 0x35415d28], 0xae
out 0xb5, al
mov ebp, 0x14567a2b
adc dword [esi - 0xabb4792], 0xe71242e1
sub byte [ebp + 0x41], bl
xor eax, 0xbdb5e6ae
sub edi, dword [edx + 0x56]
adc al, 0x81
xchg esi, eax
outsb dx, byte [esi]
mov eax, 0x42e1f544
adc ah, bh
pop eax
in al, dx
sub byte [esi - 0x36], ch
xchg ecx, eax
outsb dx, byte [esi]
mov byte [0x1929ef1d], al
mov ch, 0x9a
lodsd eax, dword [esi]
fild dword [ebx - 0xb]
sahf
fbld tbyte [edi - 0x750d0e7c]
je 0x459589
insb byte es:[edi], dx
sbb dword [edi - 0x7f], 0x4397113f
sbb edi, ebp
inc edx
pop esp
or edi, ecx
mov bl, 0x62
mov edi, 0xc525d76f
pop ebx
or al, 0x42
jmp 0x722297e8

Function at 0x46a4b0
Capabilities:
Encode data using xor

Disassembly:
dec ebp
lahf
div ebp
pop edx
pop esp
iretd
dec ebx
add eax, dword [esp + edx]
add byte [edx], al
add byte [eax], cl
add byte [ecx + 0x3045167c], dl
pop edx
pushfd
cmp al, 0x3f
add dword [eax], eax
add byte [edx + eax], dh
add byte [ecx], ah
add byte [eax], al
add byte [edx + 0x65], dh
jae 0x46a500
popal
outsb dx, byte [esi]
imul ebp, dword [ebp + 0x2f], 0x64616f6c
imul ebp, dword [esi + 0x67], 0x6961775f
je 0x46a54c
outsb dx, byte [esi]
pop edi
popal
outsb dx, byte [esi]
imul ebp, dword [ebp + 0x2e], 0x6d6c6d78
nop
mov cl, 0x4e
ret
xor dword [eax - 0x79], eax
push es
xor edx, eax
add al, byte [edx + 0x6060985]
sbb byte [ebp - 0x15], cl
ror byte [eax + 0x579c8e36], cl
add sp, word ds:[esi]
jle 0x46a49d
ret 0x308
inc esi
pop edi
inc esp
aam 0x22
push edi
sub al, 0x94
mov ch, 0xc
salc
rcl dword [esi], 0xd8
add dword [ebx - 0x20], edi
sbb byte [ecx + eax*4 - 0x8fdcfb5], bl
loopne 0x46a554
or dword [ebx + 0x30], 0x1e0f702
cmp al, 0x82
xor al, 0xcd
or edx, dword [esi - 0x5a]
aam 0x23
xor byte [ecx*8 - 0x2b59a9f5], 0x23
leave
ficom dword [eax - 0x6e]
or al, 0x8c
push ds
pop ds
test eax, 0x4554a32b
jno 0x46a537
fimul dword [edi + 0x6fccb0c3]
xor al, 0x9f
sti
rol dword [0xc34b15b2], 0x27
add dword [ecx - 0x5b], 0xffffff98
mov byte [0x92313fa8], al
jae 0x46a5e3
pushal
ret 0x52a8
invalid

Function at 0x490100
Capabilities:
Encode data using xor

Disassembly:
or ah, dl
xor eax, 0x62d84efa
and eax, 0xd82510e7
push edi
aad 0x3c
out 0xa0, al
mov edx, 0xfd51a157
dec esi
invalid

Function at 0x490900
Capabilities:
Encode data using xor

Disassembly:
js 0x49087d
in eax, dx
fist dword [edi + 0x5b]
fisubr dword [esi + 0x1b]
add byte [eax - 0x24], dh
add dword [0x71454401], ecx
adc al, 0x6c
or eax, 0x8a3f86ca
jecxz 0x4908c1
ret 0x9150
adc eax, 0x88a1471
salc
push cs
stosd dword es:[edi], eax
mov ch, 0xd6
cli
in eax, dx
fbld tbyte [edi]
jnp 0x4908e1
dec eax
add ch, byte [eax + 0x4f]
mov eax, 0x5dfc3c8f
idiv dword [eax + 0x16]
inc esi
mov dword [0xfa3f47e9], eax
aas
cli
ror dword [edi + 0x1fa3f47e], 1
std
clc
cmpsd dword [esi], dword es:[edi]
xor dword [eax], esi
cmp byte [esp + edi], dh
xor bh, byte [edx]
push es
imul esi, dword [ebp + 0x74746e90], 0x68786474
jo 0x4908e1
invalid
loopne 0x4908a1
lahf
dec eax
push es
mov dword [edi + 0x26], 0xe9d21860
adc dword [ebx + 0x349a64d1], eax
cdq
int3
Function at 0x4aae30
Capabilities:
Encode data using xor

Disassembly:
add al, 0
add byte [eax], al
or al, 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
sbb eax, 0x1f000000
add byte [eax], al
add byte [ecx], bl
add byte [eax], al
add byte [ebx], bl
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
invalid

Function at 0x519340
Capabilities:
Manipulate boot configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
push edi
push ecx
lea edi, [ebp - 0x250]
mov ecx, 0x94
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x5c8bb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
xor eax, eax
mov word [ebp - 0x214], ax
push 0x206
push 0
lea ecx, [ebp - 0x212]
push ecx
call fcn.0054a860
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x519398
xor eax, eax
jmp 0x5194a5
mov dword [ebp - 0x21c], 0x43
jmp 0x5193b3
mov edx, dword [ebp - 0x21c]
add edx, 1
mov dword [ebp - 0x21c], edx
cmp dword [ebp - 0x21c], 0x5a
jg 0x5194a3
mov eax, dword [ebp - 0x21c]
push eax
push str._c:_boot.ini
push 0x208
lea ecx, [ebp - 0x214]
push ecx
call int.00456dd0
add esp, 0x10
mov esi, esp
lea edx, [ebp - 0x214]
push edx
call dword [0x5845cc]
cmp esi, esp
call fcn.0054a2a9
test eax, eax
je 0x51949e
lea ecx, [ebp - 0x240]
call fcn.0051afc0
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x240]
call fcn.0051e910
test eax, eax
jne 0x51943c
mov dword [ebp - 0x248], 0
lea ecx, [ebp - 0x240]
call fcn.0051aff0
mov eax, dword [ebp - 0x248]
jmp 0x5194a5
push 0x59a31c
lea ecx, [ebp - 0x240]
call fcn.0051ec40
test eax, eax
je 0x519481
lea ecx, [ebp - 0x214]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00454c70
mov dword [ebp - 0x24c], 1
lea ecx, [ebp - 0x240]
call fcn.0051aff0
mov eax, dword [ebp - 0x24c]
jmp 0x5194a5
mov dword [ebp - 0x250], 0
lea ecx, [ebp - 0x240]
call fcn.0051aff0
mov eax, dword [ebp - 0x250]
jmp 0x5194a5
jmp 0x5193a4
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x5194d8]
call fcn.0054a2cc
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call int.0054a845
add esp, 0x250
cmp ebp, esp
call fcn.0054a2a9
mov esp, ebp
pop ebp
ret 8
Function at 0x54c52d
Capabilities:
Encode data using xor

Disassembly:
jb 0x54c5a2
out 0x11, eax
pop edi
xchg ecx, eax
test dword [esp + edx*2 - 0x5a], ebx
cmp dword [ebp - 0x11ee36a8], edi
adc esp, dword [edi + 0x27e03e85]
push ebx
mov esi, eax
je 0x54c5ab
cmp al, 0x9b
mov eax, 0xb4d27bc1
mov ah, 0x3e
mov ch, 0xe9
ret
pop esp
in al, 0xd
sbb ebx, ebx
fisub dword [edi]
test dword [eax], ebp
inc ecx
sbb dword [edx], ebx
xor eax, dword [eax + 0x3365ac29]
pop es
cmp dword [esi + 0x38], ecx
invalid
das
adc al, 0xa6
or ch, byte [0x86174369]
xor al, byte [edi + 0x18e5ac45]
xchg byte [edx], dh
xchg dword [ebp - 0x54], eax
in eax, 0x18
mov eax, 0xf11e35c8
enter 0x1e35, 0xfffffffffffffff1
xchg esi, eax
call 0x525993a2
xchg ebx, eax
sub dword [esp + edx], 0xa91524a0
dec ecx
jae 0x54c59a
rcl dword [edi + 0xa658c21]
or ebx, dword [ecx - 0x37]
jbe 0x54c63f
and dword [edi], 0xdde0eb44
clc
cdq
rcl ah, cl
mov eax, dword [0xcd997d39]
xor dh, byte [esi]
jb 0x54c57d
inc esp
in eax, dx
call 0xc96dfb1e
inc ebx
jae 0x54c5e4
xor eax, 0x7343c919
cli
xor dword [ebx + 0x8e6ecd5], edx
xchg edi, eax
jns 0x54c641
push 0x7d4f7d27
pop edx
rcl dword [ebx + 0x3d66cc31]
invalid
invalid
inc ebx
sub eax, 0x74468b53
pushal
adc al, 0x1b
js 0x54c68d
int3
or al, 0x60
sbb byte [ebx - 0x67], ah
mov byte [edx], 0xd6
mov dl, 0x9f
xor eax, dword [ebx + esi*2 - 0x13bbd871]
movsd dword es:[edi], dword [esi]
salc
dec ecx
inc edi
push esi
push edx
sub dword [esi + 0x773766cc], 0x48
aad 0xdb
int3
popal
das
cmpsd dword [esi], dword es:[edi]
mov eax, 0xf66267cd
jno 0x54c6c5
or edi, dword [edi + 0x53]
mov fs, word [esi]
je 0x54c700
or byte [ebx - 0x68], ah
ret 0x961c
inc esi
push cs
push ecx
pushfd
or dl, ah
cmpsb byte [esi], byte es:[edi]
or dword [ebp - 0x69db35e8], ebx
jo 0x54c660
jmp 0x54c6a2
fsub qword [edi]
jp 0x54c708
out dx, eax
rcr dword [edi], 0x14
movsb byte es:[edi], byte [esi]
sub esp, dword [ebx]
cwde
ret 0x2e7e
and al, 0xe8
out dx, eax
push cs
les ebp, [edi - 0xaed5e1c]
jmp 0x736b0faa
out dx, eax
adc al, 0xa7
xor ebp, ebx
sbb al, al
push 0x639ab296
pop esp
loope 0x54c748
xchg esi, eax
mov dl, 0x9a
arpl word [ecx + 0x39], bx
rol dword [edi], 1
test eax, 0x9791324f
retf 0xa7b4
jae 0x54c6b4
xlatb
and al, 0x1f
in al, dx
sub al, 0xe1
outsd dx, dword [esi]
pop edx
rcr dword [ebp + 0x1ce26c69], cl
invalid
and eax, 0x1650c869
jae 0x54c6d7
fstp xword [esi - 0x27]
xor bl, ch
push edx
test byte [esi + 0xc], al
pushal
inc edi
js 0x54c71f
xchg edi, eax
ret
Function at 0x426590
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x4dbba8]
xor edx, edx
cmp eax, edx
jne 0x4265b6
xor eax, eax
mov byte [eax + 0x4dbaa8], al
inc eax
cmp eax, 0x100
jl 0x42659e
mov dword [0x4dbba8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x4dbaa8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x426647
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x42661a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x4265e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4266c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x426713
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x4266fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f2d0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x44f303
push esi
call fcn.0045d680
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44f2fc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x44f389
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x44f372
mov eax, dword [esi + 8]
test eax, eax
je 0x44f327
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44f36e
cmp eax, 2
je 0x44f372
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44f31a
cmp eax, 3
je 0x44f34d
cmp eax, 1
jne 0x44f31a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44f31a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44f31a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0044f3b0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x44f398
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0044f3b0
add esp, 4
pop esi
ret

Function at 0x5172df
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], edx
jmp 0x5172f6
mov eax, dword [ebp + 8]
movzx edx, byte [eax]
movzx esi, byte [eax + 1]
movzx edi, byte [eax + 5]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 2]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 3]
shl edx, 8
xor edx, esi
movzx esi, byte [eax + 4]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 6]
shl esi, 8
xor esi, edi
movzx edi, byte [eax + 7]
shl esi, 8
xor esi, edi
xor esi, dword [ecx + 4]
movzx edi, byte [eax + 8]
movzx ebx, byte [eax + 0xd]
mov dword [ebp - 0x14], esi
movzx esi, byte [eax + 9]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xa]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xb]
shl edi, 8
xor edi, esi
movzx esi, byte [eax + 0xc]
xor edi, dword [ecx + 8]
xor edx, dword [ecx]
shl esi, 8
xor esi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl esi, 8
xor esi, ebx
shl esi, 8
xor esi, eax
xor esi, dword [ecx + 0xc]
mov dword [ebp - 0xc], edi
shr edi, 8
mov ebx, esi
shr ebx, 0x10
mov eax, 0xff
and edi, eax
and ebx, eax
mov ebx, dword [ebx*4 + 0x522a68]
xor ebx, dword [edi*4 + 0x522e68]
mov edi, edx
shr edi, 0x18
xor ebx, dword [edi*4 + 0x522668]
mov edi, dword [ebp - 0x14]
and edi, eax
xor ebx, dword [edi*4 + 0x523268]
mov dword [ebp - 8], esi
xor ebx, dword [ecx + 0x10]
shr esi, 8
mov edi, edx
shr edi, 0x10
and edi, eax
and esi, eax
mov dword [ebp - 4], edi
mov edi, dword [esi*4 + 0x522e68]