joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404904
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437df4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x404a27
push ecx
lea ecx, [esi + 0x18]
call fcn.00424124
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x404a3e
push ecx
lea ecx, [esi + 0x24]
call fcn.00424034
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44dc14
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00481104
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd37
push ecx
lea ecx, [esi + 0x18]
call 0x46d434
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd4e
push ecx
lea ecx, [esi + 0x24]
call int.0046d344
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x493570
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
lea eax, [ebp - 0x198]
push edi
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0044a210
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 8], 1
call edi
lea ecx, [ebp - 4]
mov esi, eax
push ecx
push 0x2000000
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4935f0
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push 4
push edx
push 0x18
push eax
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
test eax, eax
je 0x4935e6
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x4935f0
call edi
jmp 0x4935f0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0xb7b999

Function at 0x496f94
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.004ca484
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4970b7
push ecx
lea ecx, [esi + 0x18]
call fcn.004b67b4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4970ce
push ecx
lea ecx, [esi + 0x24]
call fcn.004b66c4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b66b4
Capabilities:
Encode data using xor

Disassembly:
adc bh, ah
jae 0x4b66fb
int1
dec edi
and dl, al
popfd
xchg ecx, eax
loop 0x4b6708
rcl dword [ecx - 0x125f46bc], cl
adc dword [ebx + ebx*2 - 0x5bd92dd4], esi
add ebp, dword [edx]
adc ah, byte [eax - 0x55]
jmp 0x4b6707
cli
stc
inc eax
test byte [esi], dh
xor byte [edi - 0x15cf1556], dh
xor dl, ch
cmp eax, 0xa41703c0
jg 0x4b6748
jno 0x4b66fb
dec ebp
mov dl, 0x46
jo 0x4b66df
push ds
mov byte [0xb29629f7], al
xchg byte [esi + 0x10324ae6], bl
cwde
in al, dx
and ah, byte [esi + 0x930f780]
jb 0x4b66d6
mov al, byte [0x81aa8753]
ja 0x4b670c
xchg dword [edx + 0x6c007781], ebp
stosb byte es:[edi], al
xor dword [edi], 0xf1269d6c
insb byte es:[edi], dx
popfd
int1
jmp 0x80cb56ca
je 0x4b6786
mov eax, dword [0xcb152a2]
and byte [eax - 0x6e7f9cff], dl
retf 0xa18b
sub dl, byte [eax - 0x589d3949]
and byte [edi + 0x1da4dc17], 0x12
xlatb
mov eax, 0x7833dde9
outsb dx, byte [esi]
invalid

Function at 0x4e03f4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138e4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e0517
push ecx
lea ecx, [esi + 0x18]
call 0x4ffc14
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e052e
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb24
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4fef54
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jg 0x4fefd5
mov cl, 0x21
rol dword [ebx + 0x63e5bf84], 6
sbb dl, byte [edi]
fisub word [edx]
pop ebx
and eax, 0x20ad0fb
push cs
xor dword [edi], esi
int3
nop
mov eax, 0x7db3147d
mov esp, 0x3be41d7d
mov ah, 0x8b
xor dword [0x77b727b0], ecx
insd dword es:[edi], dx
sub dword [eax + 0x2d], ebx
xchg ebx, eax
or eax, esp
clc
nop
invalid
stosd dword es:[edi], eax
and edx, edi
push ds
lcall 0xb718, 0xbaef255b
rcr dword [edx], 0x65
jp 0x4fef78
stc
shl dword [edx + 0x7d20599b], cl
and dword [ecx], esi
and ebx, eax
fst dword [eax - 0xf6b8492]
arpl word [0xe0e038c9], bp
xor al, 0xf2
or byte [edx + 0x67], cl
dec ebp
or dh, byte [ecx + edi*2 - 0x18b2d66e]
inc ecx
lahf
inc edi
inc ebp
push esi
sub al, 0x15
invalid

Function at 0x4ffd04
Capabilities:
Encode data using xor

Disassembly:
sub dh, dh
push 0xb9de5ac5
add cl, byte [ebx - 0x40160178]
mov ch, 0x3b
les edx, [ebx]
and dl, bl
div byte [ecx + 0x42]
inc edx
xchg ebx, eax
inc eax
and al, 0xd
mov al, 0x21
sub byte [ecx - 0x1304ffb0], ch
fidiv dword [ecx + 0x5faecffe]
wait
pop esi
xor byte [eax + 3], cl
and dword [ebx], esi
or ecx, dword [ebx + 0x67e1dbff]
fdisi8087_nop
cmpsd dword [si], dword es:[di]
fdisi8087_nop
cmpsd dword [si], dword es:[di]
adc eax, 0x2be07bef
lcall 0x37e8, 0xc198ff4a
cli
jo 0x4ffce7
aaa
popfd
fld dword [edi]
popfd
mov esi, 0x9a01fef2
mov fs, word [edx + 0x72c729b1]
insb byte es:[edi], dx
sub bh, byte [esi + 0x328b890a]
fisttp word [eax - 0x19b41e24]
clc
inc ecx
sub ebx, dword [eax - 0x1ca25d2a]
cmp al, byte [ecx + 0x766a4ae]
dec edi
outsd dx, dword [esi]
wait
push ss
pushfd
pop ds
jge 0x4ffcd2
pop ebp
mov cl, 0xdd
cdq
inc edi
push edi
pushal
sbb dh, byte [eax]
jnp 0x4ffd9c
push ds
test byte [edx - 0x5bf0a2f], ch
add byte [ebx + 0xa511511], ch
hlt
xchg edx, eax
cmp al, 0xb3
imul ecx, dword [ebp + esi + 0x73a14c01], 0x31
adc esp, dword [ebx + 0x29]
dec esp
push es
js 0x4ffdd8
rcr ch, cl
adc dword [ebx + edx*4 - 0x20], 0x5318f785
push dword [edi + 0x1a124d91]
ret 0xd0dc
add ecx, dword [ecx]
sahf
xor dword [edx], ebx
int1
inc ecx
inc edx
out dx, eax
invalid
Function at 0x529b24
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d014
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529c47
push ecx
lea ecx, [esi + 0x18]
call fcn.00549344
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529c5e
push ecx
lea ecx, [esi + 0x24]
call fcn.00549254
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x578805
Capabilities:
Encode data using xor

Disassembly:
push ss
cmpsb byte [esi], byte es:[edi]
leave
ret 0x7e27
or al, 0x5f
pop edi
push esp
inc ebp
jp 0x5787a2
add esi, 0x5a
mov eax, dword [0xb652a212]
jae 0x578872
sahf
ficomp word [eax + 0x5a]
retf 0x2291
invalid
mov ch, 0xd7
xchg edi, eax
sal byte [edx], cl
xor dl, dh
xor esp, dword [ecx + 0x23]
push 0x114db2a5
cli
xchg esi, eax
mov esi, 0xfdb54188
mov byte [ecx - 0x4b], al
std
pushal
jb 0x578860
fimul dword [esi + 0x58fab332]
cmp dword [ebx - 0x3e], eax
or ebx, esp
xor eax, 0xc635e552
push esp
aam 0xac
push esi
in eax, dx
clc
js 0x57884b
xlatb
xchg ebx, eax
cwde
mov eax, dword [0x48786e85]
sal dh, cl
xchg edi, eax
jae 0x5788bc
outsb dx, byte [esi]
out 0xda, al
mov ebx, 0x24e03273
jle 0x5788b2
mov edi, 0xb0c6a017
in eax, 3
push ss
dec esp
sub cl, byte [eax + 0x3a]
in al, dx
fild word [ebx]
pop edi
mov word [esi - 0x19e98947], ss
dec ecx
xchg esi, eax
mov ecx, 0x49e61676
dec ch

Function at 0x57b6f4
Capabilities:
Encode data using xor

Disassembly:
aam 7
cmc
fld qword [edi]
loop 0x57b70c
cmc
jns 0x57b771
mov esi, 0xb0c432e1
movsd dword es:[edi], dword [esi]
invalid
cmp edi, dword [eax + 0x78]
inc ecx
invalid
sub al, 0x96
ret 0x38cb

Function at 0x5c225a
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x27d2c94a
or dl, byte [eax - 0x221627f3]
dec edi
imul esp, dword [ebp - 8], 0x4b1dbe1f
sbb eax, 0xeb64262c
pushfd
cwde
nop
invalid
Function at 0x605d74
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00639264
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x605e97
push ecx
lea ecx, [esi + 0x18]
call fcn.00625594
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x605eae
push ecx
lea ecx, [esi + 0x24]
call 0x6254a4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x60b6fe
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xfb741047
je 0x60b6fb
mov ecx, ebx
sbb byte [edi - 0x6ff14e7f], bl
pop ebp
mov ecx, 0xffccfddb
xor cl, byte [edi + 0x6b698563]
dec edi
fmul qword [edx - 0x606d1384]
or dword [ecx - 0xd], ecx
push ecx
cwde
invalid
Function at 0x639394
Capabilities:
Authenticate hmac

Disassembly:
leave
cmp al, byte [0xa6aa5248]
insd dword es:[edi], dx
xchg dword [eax], ebx
shr byte [ebx], 9
scasb al, byte es:[edi]
stosb byte es:[edi], al
sti
pop esp
mul dword [eax - 0x7dbe595]
sbb eax, 0x955be64f
aam 0x5c
mov ds, word [ebx + 0x33]
mov dh, 0x31
aam 0x57
jnp 0x639420
jl 0x63942a
xchg esp, eax
insd dword es:[edi], dx
mov esi, 0x858ab138
mov byte [edx + 0x49749e89], cl
movsb byte es:[edi], byte [esi]
lahf
int1
aas
mov byte [0xe26be821], al
imul ecx, dword [edx - 0x11], 0x748dd4d1
salc
sbb al, 0x1b
push ebp
invalid
jbe 0x63944d
xchg esi, eax
cdq
push es
popal
xchg ebp, eax
or ah, ah
mov dh, byte [edx]
cmpsd dword [esi], dword es:[edi]
or byte [eax], bh
out dx, eax
invalid
pushfd
fmul qword [ecx - 0x6e239fa1]
pushal
cmp byte [0x312b0e17], ah
mov dword [edi + 0x60], ebx
fcom qword [ecx + 0x17253860]
push cs
sub esi, dword [ecx]
adc byte [edx], dl
inc ebx
adc al, 0x36
out 0xaa, al
mov edi, 0x24a7eaf5
stc
je 0x6393e1
adc eax, 0xbaa9e396
jl 0x639497
mov eax, 0x447ae4b6
push 0x62d610a0
int1
mov esi, 0x28d89ec6
pop esp
jp 0x6394c6
jg 0x63941e
scasd eax, dword es:[edi]
pop esi
mov cl, 0xb8
imul edi, dword [edx - 0x6928ea92], 0xffffffb4
push ebx
mov edx, 0x27b85bd7
or dword [edx], ebp
pop ebp
mov bl, 0x30
add al, 0x81
or edx, dword [edx + 0x77b6c8fb]
xchg dl, al
dec ebp
mov bh, 0x14
push esi
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
xchg edx, eax
sti
enter 0x77b6, 0xffffffffffffff86
ret 0xb74d
mov byte [edx + 0x4b], cl
pop esi
xchg esp, eax
cmp edi, dword [ebp - 0x21bec8f4]
xchg edi, eax
mov ah, 4
inc edi
sbb al, 0xe
ficom word [edi + 0x1c4704b4]
push cs
clc
popfd
fist dword [ecx - 0x2c]
inc eax
loop 0x639470
sahf
int1
and ch, ch
faddp st(0)
les esp, [edi]
mov ebx, 0xef9570ab
pop ebp
aam 0xb3
adc bh, byte [eax]
push cs
pop ds
mov cl, byte [esi - 0x7f8a9de]
out dx, al
pop si
into
pmuludq mm5, mm2
jp 0x6394d3
ja 0x639487
movsb byte es:[edi], byte [esi]
jg 0x63947d
cmp eax, 0x6ba74af6
salc
xor cl, byte [eax + 0x7dfed18d]
sub eax, dword [ecx - 0x23b5fd35]
xor dl, byte [ecx + 0x2eba51ce]
test byte [eax - 0x77a46b4a], bl
pop esp
xchg edi, eax
adc eax, 0x4cf66467
invalid

Function at 0x64cd4d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654390

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x69b1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0069b140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0069b140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0069b140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0069b140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x69bbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x69bc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6ad87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x69bc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x69bc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x422492
Capabilities:
Clear file content

Disassembly:
push edi
pop edi
push ebp
push esp
pop ebp
sub esp, 0x18
push ebx
push esi
push edi
sub ebx, ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.0041b644
mov dword [ebp - 0x18], eax
and eax, edx
add esp, 0x10
mov dword [ebp - 0x14], edx
cmp eax, 0xffffffff
je 0x42251a
push 2
push ebx
push ebx
push dword [ebp + 8]
call fcn.0041b644
mov ecx, eax
and ecx, edx
add esp, 0x10
cmp ecx, 0xffffffff
je 0x42251a
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
sub esi, eax
sbb edi, edx
js 0x4225af
jg 0x4224f3
cmp esi, ebx
jbe 0x4225af
mov ebx, 0x1000
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
test eax, eax
jne 0x422526
call fcn.00417a38
mov dword [eax], 0xc
call fcn.00417a38
mov eax, dword [eax]
pop edi
pop esi
pop ebx
leave
ret
push 0x8000
push dword [ebp + 8]
call fcn.00422648
pop ecx
pop ecx
mov dword [ebp - 8], eax
or edi, edi
jl 0x422546
jg 0x422542
cmp esi, ebx
jb 0x422546
push ebx
pop eax
jmp 0x422548
push esi
pop eax
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.00419d82
add esp, 0xc
cmp eax, 0xffffffff
je 0x422592
cdq
sub esi, eax
sbb edi, edx
js 0x422569
jg 0x422538
test esi, esi
jne 0x422538
mov esi, dword [ebp - 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00422648
pop ecx
pop ecx
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub ebx, ebx
jmp 0x422618
call fcn.00417a4b
cmp dword [eax], 5
jne 0x4225a7
call fcn.00417a38
mov dword [eax], 0xd
or esi, 0xffffffff
mov dword [ebp - 0xc], esi
jmp 0x42256c
cmp edi, ebx
jg 0x422624
jl 0x4225b9
cmp esi, ebx
jae 0x422624
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041b644
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x42251a
push dword [ebp + 8]
call fcn.00421802
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
neg eax
sbb eax, eax
neg eax
dec eax
cdq
mov dword [ebp - 0x10], eax
and eax, edx
mov dword [ebp - 0xc], edx
cmp eax, 0xffffffff
jne 0x422624
call fcn.00417a38
mov dword [eax], 0xd
call fcn.00417a4b
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov esi, dword [ebp - 0x10]
and esi, dword [ebp - 0xc]
cmp esi, 0xffffffff
je 0x42251a
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp + 8]
call fcn.0041b644
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
je 0x42251a
xor eax, eax
jmp 0x422521

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx