joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408a28
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
jne 0x408a42
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408ab3
mov ecx, esi
call fcn.004089e2
test al, al
je 0x408a7d
mov eax, 0x4e20
cmp dword [ebp + 0xc], eax
jbe 0x408a7d
push eax
push dword [ebp + 8]
mov ecx, esi
call fcn.00408a28
jmp 0x408ab6
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x408a94
call ebx
cmp eax, 0x6d
jne 0x408a94
xor eax, eax
jmp 0x408ab6
cmp dword [esi + 0xc], 0
jne 0x408aae
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x408aae
call ebx
cmp eax, 0x21
jne 0x408aae
push edi
jmp 0x408a71
or eax, 0xffffffff
jmp 0x408ab6
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408dc9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a670
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x408e0d
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a5bc
test al, al
je 0x408e0d
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x408e15
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a670
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x408e64
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.0040a5bc
test al, al
je 0x408e64
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x409051
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a670
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00409e12
movzx eax, word [eax]
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x409087
cmp ax, 0x20
je 0x409087
push 0
push edi
call esi
test eax, eax
jne 0x4090b6
push edi
call fcn.0040902d
test al, al
jne 0x4090c9
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.0040a5bc
test al, al
je 0x4090c9
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x4090c9
cmp byte [ebp + 0xc], 0
je 0x4090c5
push dword [ebp + 0x10]
push edi
call fcn.00408e15
xor eax, eax
jmp 0x4090e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4090de
cmp eax, 3
je 0x4090de
xor eax, eax
inc eax
jmp 0x4090e1
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x40d77d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041a670
push ebx
xor ebx, ebx
cmp byte [0x440878], bl
je 0x40d802
cmp word [0x437818], bx
je 0x40d802
push esi
push 0x437818
lea esi, [ebp - 0x1008]
call fcn.0040d740
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40d802
push dword [ebp + 8]
call fcn.0041a32f
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40d807
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041a670
cmp byte [0x440878], 0
je 0x40d8ae
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.0040d740
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40d8ae
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d8a5
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40d889
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00410792
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x4102a4
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x410e06
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi], ebp
jbe 0x410e81
push ebx
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x410da8
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x410e5d
push str.CreateThread_failed
push 0x4325ac
call fcn.00406381
pop ecx
pop ecx
mov ecx, 0x4325ac
call fcn.00401000
push 2
mov ecx, 0x4325ac
call fcn.004062f8
mov dword [edi], ebx
inc dword [esi + 0x84]
mov eax, dword [0x44e58c]
test eax, eax
je 0x410e77
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebp
add edi, 4
cmp ebp, dword [esi]
jb 0x410e16
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x4110ad
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4110e8
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4110cf
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4110e0
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4110ea
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4110c5
xor eax, eax
pop edi
pop esi
ret

Function at 0x4112c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4112c1
mov dword [ebp - 8], eax
clc
add ecx, 0x28
dec edx
jne 0x4112b2
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041106d
lcall 0xa845, 0x8d87f86e
push eax
call fcn.0041107d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00411032
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41135b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041106d
int3
Function at 0x411518
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
invalid
inc ebp

Function at 0x41172d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x411744
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411762
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4117c0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4117a7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4117b0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4117ba
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41179c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411726
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41180d
dec eax
je 0x411804
sub eax, 3
je 0x4117fb
mov dword [ebp - 4], 0x40
jmp 0x41182a
mov dword [ebp - 4], 4
jmp 0x411810
mov dword [ebp - 4], 0x20
jmp 0x411810
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41185c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4117dc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041106d
dec edi
cmp eax, 0x75ff34eb
adc al, 0x6a
add dword [esi - 1], edx
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
Function at 0x41176d
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
inc ebp
or al, 0x66
cmp eax, dword [edi + 6]
jne 0x411744
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x411762
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
push dword [ebx]
ror byte [ecx - 0x3e7443bb], cl
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x4117c0
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x4117a7
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x4117b0
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x4117ba
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x41179c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x411726
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x41180d
dec eax
je 0x411804
sub eax, 3
je 0x4117fb
mov dword [ebp - 4], 0x40
jmp 0x41182a
mov dword [ebp - 4], 4
jmp 0x411810
mov dword [ebp - 4], 0x20
jmp 0x411810
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x41185c
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x4117dc
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0041106d
dec edi
cmp eax, 0x75ff34eb
adc al, 0x6a
add dword [esi - 1], edx
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
Function at 0x10010730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1001073f
pop dword [ebp - 0x2c]
mov eax, 0x1001073f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x845dc9a
sub dword [ebp - 0x3c], 0xb9f3974f
mov dword [ebp - 0x38], 0xfbc75bb
add dword [ebp - 0x38], 0x2276d68a
mov dword [ebp - 0x34], 0x1936119a
sub dword [ebp - 0x34], 0xcce9cd6c
mov dword [ebp - 0x30], 0x46555546
sub dword [ebp - 0x30], 0x46555546
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x3649a2e8
sub eax, 0x2647f2d8
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x42035794
add dword [ebp - 0x3c], 0x326f11c2
mov dword [ebp - 0x38], 0xfbff0b09
sub dword [ebp - 0x38], 0xba92a994
mov dword [ebp - 0x34], 0x9312fff
sub dword [ebp - 0x34], 0xa5c1c393
mov dword [ebp - 0x30], 0x3123154d
add dword [ebp - 0x30], 0xcedceab3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x49c32b97
sub eax, 0x39c17b83
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ba83
push 0
call eax
mov ecx, 0xe04aab72
add ecx, 0x1fb5921f
xor esi, esi
add esi, eax
mov edx, 0x1002b000
add edx, dword [ebp - 0x2c]
mov ebx, 0x720fadae
sub ebx, 0x6c95e320
add dword [ebp - 0x10], eax
mov edi, dword [edx]
add dword [ebp - 0x10], edx
add edi, ebx
mov dword [ebp - 0x14], 0x439612ca
mov dword [esi], edi
xor dword [ebp - 0x28], 0xe06d2c63
add esi, 0x5175bc9d
add esi, 0xae8a4367
add edx, 0x6cb53c8b
add edx, 0x934ac379
loop 0x10010858
add eax, 0xe917
xor ebx, ebx
add ebx, eax
add eax, 0xc1646a85
sub eax, 0xc1646a80
mov ecx, 0xdc54071e
add ecx, 0x33abf8e2
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.2508asqk]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.2508asqk]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.2508asqk]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.2508asqk]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.2508asqk]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.2508asqk]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x61b480
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c1000]
push edi
or ebp, 0xffffffff
jmp 0x61b4a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x61b4a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b498
mov eax, 1
add ebx, ebx
jne 0x61b4bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x61b4cc
jne 0x61b4eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4eb
dec eax
add ebx, ebx
jne 0x61b4d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x61b4b0
add ebx, ebx
jne 0x61b4e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x61b53d
xor ecx, ecx
sub eax, 3
jb 0x61b503
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x61b572
sar eax, 1
mov ebp, eax
jmp 0x61b50e
add ebx, ebx
jne 0x61b50e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4dc
inc ecx
add ebx, ebx
jne 0x61b51c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x61b4dc
add ebx, ebx
jne 0x61b529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x61b51e
jne 0x61b53a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x61b51e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x61b55c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x61b54e
jmp 0x61b49e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x61b55c
add edi, ecx
jmp 0x61b49e
pop esi
mov edi, esi
mov ecx, 0xb69
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x61b57a
cmp byte [edi], 9
jne 0x61b57a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x61b57f
lea edi, [esi + 0x219000]
mov eax, dword [edi]
or eax, eax
je 0x61b5f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x21b960]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x21b99c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x61b5ac
mov ecx, edi
jns 0x61b5db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x21b9a0]
or eax, eax
je 0x61b5f1
mov dword [ebx], eax
add ebx, 4
jmp 0x61b5c9
call dword [esi + 0x21b9a8]
mov ebp, dword [esi + 0x21b9a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x61b62b
sub esp, 0xffffff80
jmp 0x4059fc
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x10013c81
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10013c90
pop dword [ebp - 0x44]
mov eax, 0x243fe40c
sub eax, 0x143ea77c
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3a6e7
push 0
mov eax, 0x9415ffc6
add eax, 0x7bebe196
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x4ef45dfe
add ecx, 0xb10be84c
mov ebx, eax
mov edi, 0x409503e5
sub edi, 0x309221e5
add edi, dword [ebp - 0x44]
mov edx, 0x5572b7bd
add dword [ebp - 0x10], edi
mov esi, dword [edi]
add dword [ebp - 0x34], 0xb9d6c86d
xor esi, edx
xor dword [ebp - 0xc], 0x486d6d97
mov dword [ebx], esi
mov dword [ebp - 0x10], 0xdb70ebe5
add ebx, 4
add edi, 0x70ad6750
sub edi, 0x70ad674c
loop 0x10013ce9
add eax, 0xcfe5374e
add eax, 0x301bd4ad
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x987b606b
add ecx, 0x77849f95
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x515c13
Capabilities:
Encode data using xor

Disassembly:
je 0x515c91
loopne 0x515c5d
inc edi
int3
sbb byte [esp + esi - 0x3e], bl
and eax, 0x997d2278
push esi
add ecx, ebp
push ecx
aaa
push ecx
xor al, 0x76
jae 0x515c99
mov ecx, 0xa2f0067f
fsub dword [ebx + 0x7d6593b8]
xchg edi, edx
cmp ecx, dword [ebx]
or eax, 0x7e38ad2

Function at 0x55dfbb
Capabilities:
Encode data using xor

Disassembly:
inc edx
mov bl, 0x19
xlatb
out 0x7c, eax
inc eax
jl 0x55dfc2
xchg ebx, eax
rcr cl, cl
push cs
push edx
xor byte [edx], ch
jno 0x55df7b
xchg ebp, eax
invalid
sub eax, 0xd84accbc
add al, 0xec
outsd dx, dword [esi]
pop ebp
sub bl, byte [ebx + edx*8]
or esi, dword [edx]
mov eax, 0x8752227d
push eax
cmp eax, 0xb908c056
jo 0x55df80
test ah, dl
idiv dword [edx + ebx*8 - 5]
xchg ecx, eax
movsb byte es:[edi], byte [esi]
ret

Function at 0x56d2bb
Capabilities:
Encode data using xor

Disassembly:
jnp 0x56d1c3
fild dword [edi]
pop ebp
fcmovnbe st(0), st(5)
adc ebx, dword [esi]
in al, 4
push es
jg 0x56d217
dec edi
mov bl, 0x3d
pop es
retf 0xae59
sbb eax, 0xbe178c27
sbb ebx, dword [eax - 0x4b]
mov bh, 0x28
or esp, dword [edx + 0x13]
daa
add al, 0x22
pop ebp
push esp
cmp dword [edx + 0x7189274], esi
cmp eax, 0xef32ed30
jne 0x56d1bf
out 0xad, eax
mov byte [0xc4fb0ca1], al
dec esp
cmp eax, 0x30d30d5b
in eax, dx
lahf
sbb byte [ebp - 0x63], cl
xchg edi, eax
in eax, dx
invalid
pop esp
jg 0x56d227
mov al, 0x12
int3
insd dword es:[edi], dx
pop ss
push ebx
invalid
adc al, 0x9e
xor bl, ch
rdmsr
sar byte [esp + esi], 1
xor ebp, ebx
xchg esi, eax
scasd eax, dword es:[edi]
push ds
mov dword [esi], esp
push esp
push edx
enter 0x2761, 0xffffffffffffff84
aam 0x38
push edi
not byte [ebx - 0x64578d45]
push ebx
jb 0x56d2b7
mov esi, 0x427fcbc6
rcl dl, 1
sbb byte [ecx + ebx*4 - 0x19], ah
pop ss
jb 0x56d26e
xchg esi, eax
jge 0x56d2f9
int 0xae
lea esi, [edx - 0xf]
xchg esp, eax
outsd dx, dword [esi]
mov ebx, 0xdf0c9882
lea esi, [esi]
int 2
or byte [ebx + edx*8], 0x24
movups xmmword [esi + ebx*4], xmm1
sbb byte [eax + 0x368ddf0c], 0xcd
add al, byte [edx + 0xf24d30c]
adc dword [esi + ebx*4], ecx
add esi, dword [edx + 0x2c]
xor eax, 0x5abc6de2
call dword [ebx]
add ebx, eax
mov ebp, 0xa43b613a
inc esp
iretd
Function at 0x5a91d6
Capabilities:
Encode data using xor

Disassembly:
das
push cs
inc esi
imul edx, dword [eax + 0x55db236d], 0xffffffb8
loopne 0x5a920f
sub ecx, dword ss:[ebp + ebx - 0x35c0ff0]
mov dword [0xa8447b6d], eax
xchg byte [edx], bh
jg 0x5a9256
das
salc
pop ecx
inc edx
jp 0x5a9227
mov bh, 0xc1
jno 0x5a91f5
inc eax
jecxz 0x5a91fd
not dword [esi - 0x2e]
loopne 0x5a91e2
jecxz 0x5a924f
push edx
mov byte [0x89ee2015], al
rcl dword [edi + ebp - 0x290b297f]
pop ebx
or cl, ch
movsb byte es:[edi], byte [esi]
mov dword [0x95640e68], eax
out dx, al
insb byte es:[edi], dx
retf
das
adc esi, 0x85bd6f4
jmp 0xec335bf
push eax
mov ebx, 0x55fd237d
or byte [esi + 0x40], 0x73
push ds
mov ebp, 0xcd982dc
jl 0x5a92b0
pop eax
int 0x3c
imul esp, dword [esi], 0xadfc1e6e
mov eax, dword [0xa611a3be]
into
xor byte [0x9a47f6ff], ch
enter 0xfffffffffffff4c2, 0x62
aas
sar byte [eax + 0x6170ab96], cl
ret 0x62f4
stosd dword es:[edi], eax
jo 0x5a92ba
aam 9
mov esp, 0xcf176ff3
dec edi
jl 0x5a9248
and ebp, dword ss:[eax - 0x23ec9246]
cmpsd dword [esi], dword es:[edi]
cld
shl dword [eax], 0x87
hlt
and eax, 0xc6f3d0b1
inc ecx
mov dh, 0xf
lds ecx, [ebx]
inc edi
push ds
or eax, dword [edi + 0x1e]
push 0xffffffffffffffbe
test al, 0x1b
mov dl, byte [edi + esi - 0x21]
wait
ret

Function at 0x633755
Capabilities:
Encode data using xor

Disassembly:
sahf
sbb eax, 0xf6c45735
fimul word [esi - 0x547e8bf0]
arpl word [ebx], si
xor eax, dword [edi]
xor eax, dword [edi]
xor dword [ebx - 5], 0xffffffcf
add esi, eax
outsb dx, byte [esi]
mov es, word [esi - 0x1a6cef86]
cld
add al, 0xc3
insb byte es:[edi], dx
rcl byte [edx + 0x6b]
arpl word [eax + 0x77731e3e], dx
xchg esi, eax
enter 0x70e2, 0x35
adc ecx, dword [ecx + esi*8 + 0x6183d981]
jge 0x633748
invalid
inc eax
iretd