joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x414ac0
Capabilities:
Check for software breakpoints

Disassembly:
xlatb
js 0x414ac5
xchg dword [esp + ecx*8], edi
cmp al, 0xcc
xchg byte [edx - 0xfe80a13], al
test al, 0x9d
lodsd eax, dword [esi]
je 0x414ad6
out 2, eax
jl 0x414ae9
int 0x2f
sub ah, byte es:[ebx + 0x38]
cmp ebp, esp
or eax, 0x99568283
push edi
invalid
lodsd eax, dword [esi]
popfd
das
rcl byte [ebx], cl
bound edi, qword [eax]
push 0xffffffffffffffb7
bound edi, qword [eax]
jge 0x414b4a
lea esp, [edi + 0x1675ecc3]
add al, 0x13
bound ecx, qword [esi]
inc ecx
in al, dx
popfd
mov dword [edx - 0x7d386214], 0x82c79dec
in al, dx
popfd
invalid
popfd
xlatb
ret 0x94ec
Function at 0x10004770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, ecx
cmp eax, 0x11
mov eax, ecx
mov eax, ebx
nop
mov eax, ebx
mov eax, 0xb08c3ed2
mov eax, ecx
cmp eax, 0x31588840
inc eax
nop
inc eax
mov eax, ebx
mov eax, ecx
nop
inc eax
mov eax, ecx
mov eax, ebx
cmp eax, 0xffffffeb
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
mov eax, 0x252e493a
inc eax
cmp eax, 0xbca24110
cmp eax, 0x4e
mov eax, ecx
inc eax
cmp eax, 0xf60a442b
nop
inc eax
cmp eax, 0xefb801d1
mov eax, ecx
mov eax, ebx
nop
cmp eax, 0x5f
mov eax, ebx
nop
inc eax
inc eax
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0xfffffff4
cmp eax, 0x28a8e458
cmp eax, 0x3fed78e4
inc eax
cmp eax, 0xffffffd3
cmp eax, 0xffffff89
mov eax, 0x9c3c5200
mov eax, 0xf52991f9
mov eax, ebx
mov eax, ecx
cmp eax, 0xffffff99
inc eax
inc eax
nop
mov eax, ebx
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
push 0x1002beb4
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, 0x5f36043a
mov eax, ebx
mov eax, ebx
mov eax, ebx
nop
mov eax, ebx
inc eax
mov eax, ebx
cmp eax, 0x4e
inc eax
inc eax
cmp eax, 0xffffffde
nop
nop
mov eax, ecx
mov eax, ecx
mov eax, ecx
inc eax
mov eax, ecx
cmp eax, 4
mov eax, ebx
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x1003e22c], eax
inc eax
cmp eax, 0xde5ac4e2
mov eax, ebx
cmp eax, 0x20
mov eax, ebx
nop
inc eax
mov eax, ebx
inc eax
mov eax, 0xa382fbad
mov eax, ebx
cmp eax, 0x555b5926
mov eax, ebx
inc eax
cmp eax, 0x40011de6
mov eax, ecx
inc eax
nop
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
jne 0x1000491f
push 0x41030
push str.DllWrap
push str.miss
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
nop
mov eax, ecx
mov eax, 0xec3edff6
cmp eax, 0x23
inc eax
mov eax, ecx
mov eax, ebx
inc eax
mov eax, ecx
nop
nop
nop
nop
nop
mov eax, ecx
mov eax, ecx
inc eax
mov eax, ebx
nop
mov eax, 0xc8c9a5ee
mov eax, 0x4130c2cf
push 3
push 2
push 1
call fcn.1000c1f0
add esp, 0xc
cmp dword [0x1003e22c], 0
je 0x10004931
mov dword [ebp - 4], 1
jmp 0x10004938
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1001e770
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001e5e6

Function at 0x407390
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x427738
mov eax, dword fs:[0]
push eax
sub esp, 0x48
mov eax, dword [0x4321c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x40], 0
je 0x4073d0
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x46]
test edx, edx
jne 0x4073dc
mov al, 1
jmp 0x407584
mov dword [ebp - 0x54], 8
call fcn.0040b5c0
movzx eax, ax
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov word [ebp - 0x3c], ax
call fcn.0040b5c0
mov word [ebp - 0x3a], ax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x3a]
push edx
call fcn.0040b5f0
add esp, 8
movzx eax, al
test eax, eax
je 0x407424
xor al, al
jmp 0x407584
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00404df0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
mov esi, eax
lea ecx, [ebp - 0x28]
call fcn.004020b0
add esi, eax
push esi
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x40]
call fcn.0040dbf0
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x40749f
cmp dword [ebp - 0x38], 1
je 0x4074a6
cmp dword [ebp - 0x38], 3
je 0x407540
jmp 0x407558
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x46], 0
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
mov edx, dword [ebp - 0x40]
sub edx, eax
mov dword [ebp - 0x34], edx
je 0x407509
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00409d40
mov ecx, eax
call fcn.00406940
push eax
call fcn.0041181a
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x407509
mov byte [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x30]
jmp 0x407584
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x46]
test edx, edx
jne 0x40752c
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2e]
jmp 0x407584
cmp dword [ebp - 0x34], 0
jne 0x40753e
push 0
push 8
lea ecx, [ebp - 0x28]
call fcn.00409660
jmp 0x407570
mov byte [ebp - 0x2d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2d]
jmp 0x407584
mov byte [ebp - 0x2f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00401400
mov al, byte [ebp - 0x2f]
jmp 0x407584
jmp 0x407437
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd44
mov esp, ebp
pop ebp
ret
Function at 0x10004351
Capabilities:
Encode data using xor

Disassembly:
out 0xd8, al
sub byte [ebx], bl
popal
stosb byte es:[edi], al
mov cl, 0x21
invalid

Function at 0x10004631
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor dword [ebx - 0x3f], 0xa4826088
shl byte [ebx + 0x25bac6c2], 1
mov byte [ebx + 0x50], ch
xor bl, cl
imul edx, dword [eax + 0x32], 0xffffffd9
rcl dword [ebx], 0xba
fnstsw ax
mov ebx, ds
xor al, 0xfb
mov byte [edi - 0x4276ab95], 0xb3
mul bl
cmpsd dword [esi], dword es:[edi]
xlatb
inc edx
mov byte [edi + 0x61], cl
enter 0xffffffffffffed79, 0xffffffffffffffe1
enter 0xffffffffffff95f1, 0x49
invalid
out 0x96, eax
add eax, 0xa74604cf
nop
les esi, [esi]
jae 0x100045e6
add eax, edx
popfd
or al, 0x59
inc ebx
aam 0x28
and ecx, ebp
lahf
pop ebx
adc al, 0x7a
dec esi
xchg ebx, eax
mov dword [0xc5187d26], eax
movsd dword es:[edi], dword [esi]
dec ebp
dec edi
jmp 0x100045f4

Function at 0x100096df
Capabilities:
Encode data using xor

Disassembly:
in eax, 0xb3
fsubr dword [eax + esi*8 + 0x21]
xchg edi, eax
pop edi
das
mov ch, 0xdf
enter 0xffffffffffffb6e0, 7
mov bl, bh
xchg edx, eax
test byte [esi], dh
dec edx
push eax
cmp ecx, dword [ebp + 0x3b811b30]
adc al, 0xd7
sal dword [eax + 0x1d], cl
xor al, 0x7c
imul edi, dword [ecx + 0x2e], 0xd9f3c994
sub dword [edi + 0x1a70837], ecx
sbb ebx, 0x35
xchg ecx, eax
jbe 0x10009692
mov byte [ecx - 0x6b1d5f14], dl
mov word [eax + 0x39], fs
out 0xed, eax
in al, 0x7c
sar dword [ecx + ecx*2 - 0x6f0b0ee4], 0x71
lodsd eax, dword [esi]
sal ch, 0x41
inc ecx
test al, 0x92
insd dword es:[edi], dx
popal
stosb byte es:[edi], al
push cs
mov eax, es
and ebx, ecx
out dx, eax
and esp, dword [esi - 0xcb790cc]
push eax
mov eax, dword [0xb56ea01a]
out 0xd5, al
push edi
or cl, dh
ja 0x100096de
jno 0x10009690
popfd
clc
dec ebx
sbb al, 0x4e
and byte ds:[edi], dh
mov ebp, 0xac172a1e
add dword [ecx + esi*8 + 0x1cc513df], ebx
mov edi, 0x1b282f96
and esi, esp
test byte [ebx], bh
in al, dx
or dword ds:[ebp + edx + 0x10], ecx
push cs
inc eax
adc al, 0x9e
mov dword [ebp - 9], eax
stosb byte es:[edi], al
daa
xchg byte [esi - 0x32], dh
pop eax
mov ebp, 0xc7a2cfda
not dword [ebx - 0x1ee6b405]
popfd
pop ebp
and ecx, dword [eax + 0x6b]

Function at 0x1000a477
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x13
fstp xword ss:[0xcf777f3e]
imul edi, dword [ebx], 0xffffffeb
xlatb
rcr edi, cl
scasd eax, dword es:[edi]
pop edi
maxps xmm7, xmmword [edi - 0xd74aa01]
pop edi
mov edi, 0xf28b55ff
pop edi
mov edi, 0xf28b55ff
add ch, bl
out dx, eax
mov ebp, 0xfbfad6b7
sub al, 0xfc
and cl, cl
in eax, 0xeb
test byte [eax - 0x6c1c24e2], dl
pop es
fcmove st(0), st(1)
xor ebp, 0xfffffff0
insb byte es:[edi], dx
cwde
imul edi, esi, 0x69986c10
in eax, 0x80
aaa
dec esi
outsd dx, dword [esi]
in al, 1
movsd dword es:[edi], dword [esi]
jnp 0x1000a465
div dword [edi + 0x37]
mov dh, 0x75
mov byte [0xafe6d0cb], al
int 0xed
xor al, 0x86
or ch, byte [eax + 0x7a]
adc bl, byte [ebx - 0x7ce50945]
xchg esp, eax
inc esp
mov ebp, 0xbf33b75b
cmp dword [edx - 0x4b], esp
inc ch
xor al, 0x17
daa
pop ebp
mov byte [ecx], ch
push 0xb69e156
push es
cwde
invalid
Function at 0x408926
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
sub ebx, 1
call fcn.00408958
xor dword [esi], ecx
add edi, ebx
inc esi
push 0xcc8bb76c
mov ebx, dword [esp]
add esp, 4
cmp esi, eax
jne fcn.00408926
dec edi
ret
Function at 0x6ea44090
Capabilities:
Hash data using jshash

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0x4e67c6a7
cmp dword [ebp + 8], 0
jne 0x6ea44103
mov eax, 0
jmp 0x6ea44115
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x40
jle 0x6ea440e1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5a
jg 0x6ea440e1
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movsx eax, al
add edx, eax
mov eax, dword [ebp - 4]
shr eax, 2
add eax, edx
add eax, 0x20
xor dword [ebp - 4], eax
jmp 0x6ea440ff
mov eax, dword [ebp - 4]
shl eax, 5
mov edx, eax
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movsx eax, al
add edx, eax
mov eax, dword [ebp - 4]
shr eax, 2
add eax, edx
xor dword [ebp - 4], eax
add dword [ebp + 8], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x6ea440aa
mov eax, dword [ebp - 4]
and eax, 0x1fffff
leave
ret
Function at 0x6ea4593c
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x6ea45967
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x90
je 0x6ea45967
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0xcc
je 0x6ea45967
mov eax, 0
jmp 0x6ea4599d
mov dword [ebp - 4], 1
jmp 0x6ea45990
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
add eax, edx
movzx edx, byte [eax]
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp dl, al
je 0x6ea4598c
mov eax, 0
jmp 0x6ea4599d
add dword [ebp - 4], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jb 0x6ea45970
mov eax, 1
leave
ret

Function at 0x6ea46740
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x6ea40000], 0x5a4d
jne 0x6ea46765
mov ecx, dword [0x6ea4003c]
cmp dword [ecx + 0x6ea40000], 0x4550
lea edx, [ecx + 0x6ea40000]
je 0x6ea46770
ret
cmp word [ecx + 0x6ea40018], 0x10b
jne 0x6ea46765
push esi
movzx eax, word [ecx + 0x6ea40014]
push ebx
movzx esi, word [ecx + 0x6ea40006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x6ea40000
test esi, esi
je 0x6ea467b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x6ea467ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x6ea467ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x6ea467a0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x6ebfe72a
Capabilities:
Encode data using xor

Disassembly:
jmp fcn.6eb71ed5
jmp fcn.6ebd656c
xchg dword [esp + ebp*2 - 0x5befa88], eax
sub ebp, 0x2ae7000b
jno 0x6eb91437
clc
cmp cx, si
not ecx
test si, dx
jmp 0x6ebfb42f
mov bp, 0x77b1
call fcn.6ebae1a6
xor ebx, ecx
test cx, di
add esi, ecx
jmp 0x6eac3fa3
xor ebx, ecx
add esi, ecx
jmp 0x6ea60358
pop ebx
push ebp
mov ebp, 0x71340084
movzx ebp, bp
xchg dword [esp + ebp - 0x80], ebx
pushfd
and ebp, 0x16300041
not ebp
lea ebp, [ebp + 0x1fa20400]
add ebp, ebp
lea ebp, [ebp*2 + 0x6e7a1214]
jo 0x6eb24fb6
push ecx
mov ebp, dword [esp + 8]
mov dword [esp + 8], ebx
mov ecx, 0x623d1c4f
call fcn.6eb60347
mov ebp, 0xb1b7fe8c
dec edi
adc bl, byte [ebp + 0x35c4929a]
xor dword [0x1d4867b9], edx
xchg esp, eax
mov eax, dword [0xefe313e1]
outsd dx, dword [esi]
aaa
mov ah, 0x26
add esi, dword [ebp + 0x1d]
shr byte [edx + ebx*4], 1
pop ss
or dword [ebp - 1], edx
mov dword [0x510fc706], eax
std
test cl, bh
push esp
pop es
pop ebp
sbb bh, bh
loopne 0x6ebfe763
dec edi
sbb al, 0x3d
invalid
pop edx
rcr dword [esp + ebx - 0x4e], cl
adc byte [edi], bh
cmc
outsd dx, dword [esi]
ret 0xd2a4
Function at 0x6edfe050
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec edi
jmp 0x6ed39025
je 0x6ed55c40
mov eax, dword [eax + ecx + 0x7c]
test bx, sp
push ebx
cmp dl, 0x4a
stc
push edi
cmc
mov dword [ebp - 0x10], eax
cmp dx, sp
jmp 0x6ed29121
je 0x6eda1c95
cmp eax, edx
jmp 0x6edfe502
je 0x6ec9f2e1
mov cl, byte [esi + 1]
jmp 0x6ecc82f5
je 0x6ee0dde4
mov eax, dword [edx + ecx + 0x20]
test bl, 0x59
cmp cx, bx
lea eax, [eax + ecx]
xor ebx, ebx
jmp 0x6ec15d13
jle 0x6ee0ddae
lea ebx, [esi + 1]
rol ecx, cl
bt cx, 0x9a
mov ecx, dword [ebp + 8]
cmp ebx, edi
cmp eax, 0x63915604
cmp ebx, edi
jle 0x6ededfcd
jmp 0x6ee0dde1
js 0x6ee0dde4
jmp 0x6ededfd6
mov ecx, esi
test edi, 0x2189011d
sub ecx, eax
cmc
cmp dh, dh
cmp ecx, 0x104
jmp 0x6edeca95
inc esi
test cl, cl
jmp 0x6eda1c8f
mov esi, eax
cmp dl, 0xf2
test cl, cl
je 0x6eda1c95
cmp cl, 0x2e
jmp 0x6ec607e9
mov edi, dword [edx + ecx + 0x18]
cmp dl, ah
test edi, edi
jmp 0x6ec7bb88
jne 0x6ed55c40
mov edx, dword [eax + ecx + 0x78]
mov dword [ebp - 4], edx
test bp, cx
test edx, edx
jmp 0x6ec4847a
mov dword [ebp - 8], 0xffffffff
test sp, 0x53dc
clc
stc
cmp esi, 0xffff
jmp 0x6ed2b3cb
ja 0x6ecfd23d
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
jmp 0x6eda65fd
mov dword [ebp - 0xc], eax
jmp 0x6ec94b72
mov esp, ebp
pop ebp
ret
jae 0x6eda1c95
mov esi, dword [edx + ecx + 0x1c]
stc
cmc
clc
lea eax, [esi + eax*4]
stc
mov eax, dword [eax + ecx]
cmp esp, esi
cmc
test eax, eax
jmp 0x6ec4a71c
je 0x6ed55c40
mov esi, dword [ebp + 0xc]
test si, cx
cmp esp, 0x745002c2
test esi, esi
je 0x6ed55c40
mov eax, 0x5a4d
cmp eax, 0x211947a1
cmp word [ecx], ax
je 0x6edfa979
xor eax, eax
movsx esi, dx
pop esi
jmp 0x6ed3ac39
jmp 0x6ee0dde4
jne 0x6ece133d
mov dword [ebp - 8], eax
jmp 0x6ed861d0
jae 0x6eda1c95
sub edi, edi
clc
cmp di, sp
test ecx, ecx
jmp 0x6ed70cf7
mov eax, dword [ebp - 0xc]
sbb edx, 0x12d64252
mov edx, dword [ebp + 0x10]
cmp eax, 0x40977479
lea esi, [edi + ebx]
clc
cmp eax, 0x3e7e575f
sar esi, 1
cmp ch, al
clc
cmp di, 0x269f
mov eax, dword [eax + esi*4]
test esp, edx
clc
push edx
neg dx
btr dx, bp
mov edx, dword [ebp + 0xc]
test ch, 9
cmc
cmp cl, dl
add eax, ecx
jmp 0x6ee09b65
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x6ed0e395
push ebp
mov ebp, esp
adc cl, 0x23
or ecx, esp
movsx ecx, si
mov ecx, dword [ebp + 8]
test cl, dh
stc
sub esp, 0x114
stc
cmp bl, ch
push esi
jmp 0x6ee09b04
jb 0x6ec57ea7
mov esi, dword [ebp - 0x10]
add esi, edx
cmp ch, 0x86
cmp eax, esi
jae 0x6ec57ea7
lea eax, [eax + ecx]
mov cl, byte [eax]
jmp 0x6ece1330
test ecx, ecx
jmp 0x6ed55c13
call fcn.6edb659e
lea esp, [esp + 4]
test eax, eax
jns 0x6ec84166
lea edi, [esi - 1]
jmp 0x6ec84176
mov eax, dword [ebp + 8]
sbb dx, bx
mov ecx, dword [ebp - 4]
rcl dl, 0x40
shrd edx, esp, 0xda
mov edx, dword [ecx + eax + 0x24]
mov cl, 0x9a
sub cl, 0xd4
lea ecx, [edx + esi*2]
and dl, bh
movzx edx, word [ecx + eax]
mov dword [ebp - 8], edx
adc dh, 0x57
rol ecx, 0x10
xor edx, 0xf822dd7
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
cmp eax, dword [edx + ecx + 0x14]
jmp 0x6ed3be96
Function at 0x4038fc
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x408398]
jne 0x403906
repz ret
jmp fcn.00403dae

Function at 0x461f20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x455015
lea edi, [esi - 0x54015]
push edi
or ebp, 0xffffffff
jmp 0x461f42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461f49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461f38
mov eax, 1
add ebx, ebx
jne 0x461f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x461f50
jne 0x461f6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f50
xor ecx, ecx
sub eax, 3
jb 0x461f80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x461ff2
mov ebp, eax
add ebx, ebx
jne 0x461f8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x461f98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x461fbc
inc ecx
add ebx, ebx
jne 0x461fa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x461f9d
jne 0x461fb9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x461f9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x461fdc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x461fcd
jmp 0x461f3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x461fdc
add edi, ecx
jmp 0x461f3e
pop esi
mov edi, esi
mov ecx, 0x32d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x461ffa
cmp byte [edi], 0
jne 0x461ffa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x461fff
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46206e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x621f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62254]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46202c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x62258]
or eax, eax
je 0x462068
mov dword [ebx], eax
add ebx, 4
jmp 0x462049
call dword [esi + 0x6225c]
popal
jmp 0x4095a4
Function at 0x401230
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.0040aa64
add esp, 0xfffffff8
push 0x402980
add esp, 0xfffffff8
push 0x401210
push 0x412028
call fcn.00402548
add esp, 0x10
mov eax, eax
push eax
call fcn.00410474
add esp, 0x10
add esp, 0xfffffff8
lea eax, [ebp - 4]
push eax
push 0x4120a8
call fcn.00401e74
add esp, 0x10
add esp, 0xfffffff8
push 0x402980
add esp, 0xfffffff8
fld dword [ebp - 4]
sub esp, 4
fstp dword [esp]
add esp, 0xfffffff8
push 0x40121e
push 0x412028
call fcn.00402548
add esp, 0x10
mov eax, eax
push eax
call fcn.004104f8
add esp, 0x10
mov eax, eax
push eax
call fcn.00410474
add esp, 0x10
add esp, 0xfffffff4
push 0x40122a
call sub.msvcrt.dll_system
add esp, 0x10
xor eax, eax
jmp 0x4012d0
leave
ret

Function at 0x407470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
add esp, 0xfffffffc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax + 0x38]
call sub.msvcrt.dll__read
leave
ret

Function at 0x40ab44
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40ab69
mov dword [0x413164], eax
add esp, 0xfffffff8
push 0x40ab08
push eax
call fcn.0040f374
jmp 0x40ab6e
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x40ab84
mov dword [0x41231c], 0x40ac68
jmp 0x40ab8e
mov dword [0x41231c], 0x40ac1c
leave
ret
Function at 0x466e70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4d3008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 0x4d5ed0
xor edx, edx
push esi
mov ecx, eax
push edi
mov edi, dword [ebp + 8]
cmp ecx, fcn.00466e70
je 0x466eab
cmp dword [eax], 0x2f2a2a2f
je 0x466ea8
dec eax
cmp eax, fcn.00466e70
jne 0x466e96
jmp 0x466eab
lea edx, [eax + 4]
mov ecx, dword [edx]
movq xmm0, qword [edx + 4]
xor ecx, 0xfefefdfc
mov eax, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x10
mov word [ebp - 0x18], si
movq qword [ebp - 0x10], xmm0
mov dword [ebp - 8], eax
cmp si, cx
je 0x466ee3
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047044a
mov esp, ebp
pop ebp
ret
mov al, byte [ebp - 0x18]
xor edx, edx
mov byte [ebp - 0x11], al
shr esi, 8
push ebx
mov ebx, 0xc
mov eax, esi
div ebx
lea eax, [esi + 1]
movzx ecx, byte [ebp + edx - 0x10]
xor edx, edx
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 2]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
xor edx, edx
or ecx, eax
lea eax, [esi + 3]
div ebx
shl ecx, 8
movzx eax, byte [ebp + edx - 0x10]
or ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov ebx, 0x19810419
mov cl, byte [ebp - 0x11]
rol eax, cl
mov ecx, 4
xor al, bl
ror eax, 8
ror ebx, 8
loop 0x466f45
mov bl, al
rol eax, 8
mov bh, al
mov al, bl
ror eax, 8
mov al, bh
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
pop ebx
mov dword [edi], eax
xor ecx, ebp
pop edi
mov eax, 1
pop esi
call fcn.0047044a
mov esp, ebp
pop ebp
ret