joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425d1e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00418afb
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x425d56
xor eax, eax
jmp 0x425d82
cmp esi, dword [ebp - 4]
je 0x425d7f
cmp dword [ebp + 0xc], 0
je 0x425d7f
push dword [edi + 0x9c]
call fcn.0042592c
push dword [edi + 0x9c]
mov esi, eax
call fcn.00416a15
pop ecx
pop ecx
cmp esi, eax
je 0x425d52
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x46bb10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x4d000]
push edi
or ebp, 0xffffffff
jmp 0x46bb32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46bb39
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46bb28
mov eax, 1
add ebx, ebx
jne 0x46bb4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46bb40
jne 0x46bb5c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46bb40
xor ecx, ecx
sub eax, 3
jb 0x46bb70
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46bbe2
mov ebp, eax
add ebx, ebx
jne 0x46bb7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x46bb88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x46bbac
inc ecx
add ebx, ebx
jne 0x46bb98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46bb8d
jne 0x46bba9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46bb8d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46bbcc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46bbbd
jmp 0x46bb2e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46bbcc
add edi, ecx
jmp 0x46bb2e
pop esi
mov edi, esi
mov ecx, 5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46bbea
cmp byte [edi], 0x30
jne 0x46bbea
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46bbef
lea edi, [esi + 0x69000]
mov eax, dword [edi]
or eax, eax
je 0x46bc67
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6e4f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6e52c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46bc1c
mov ecx, edi
jns 0x46bc4b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6e530]
or eax, eax
je 0x46bc61
mov dword [ebx], eax
add ebx, 4
jmp 0x46bc39
call dword [esi + 0x6e540]
mov ebp, dword [esi + 0x6e534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46bc9b
sub esp, 0xffffff80
jmp 0x4010b0
Function at 0x401940
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jg 0x4019a7
mov edx, dword [0x410268]
inc esp
cld
rol dword [eax], cl
movsb byte es:[edi], byte [esi]
sal byte [ebp + 5], cl
mov esi, 0x41024c
mov edx, dword [0x87cc37]
fcmovnbe st(0), st(2)
mov edx, dword [0x3d414040]
jne 0x40196e
mov edx, dword [0x654117ba]
test ecx, ecx
mov ecx, 0x40d3d9
je 0x40197c
mov ecx, str.HEAD
adc al, 0xa1
lcall 0x4477, 0x500041ef
inc eax
inc ecx
add byte [eax + 0x56], dl
push edx
push ecx
mov ebx, dword [eax - 0xbf2ad0]
push 0x40d31c
push 0x800
push ecx
call fcn.00408680
inc eax
add byte [eax], ch
or byte [eax], al
add byte [ecx - 0x18], dl
fisubr word [eax + eax]
add esp, 0x24
jmp 0x401a24
push ds
adc eax, 0x16de40
mov edi, 0x413840
test dl, dl
jne 0x401960
fxch st(0)
rol dword [eax], cl
mov edx, dword [0x41025d]
inc ebp
cld
rol dword [eax], cl
test edx, edx
jne 0x4019cf
mov esi, 0x698fd4
add byte [0x410278], dl
test edx, edx
mov edx, dword [0x82414040]
jne 0x4019e5
cmp eax, 0x4117e47a
add byte [ebx - 0x3f46fe07], al
pop ds
inc eax
add byte [edx], bh
add eax, 0x4036bc13
cmp ecx, 1
mov ecx, 0x401fc0
cmp al, byte [0x4036bc13]
add byte [eax + 0x410270a1], ah
add byte [edi + 0x50], dl
mov eax, dword [0x411804]
mov eax, dword [0x304044]
rcl dword [esi + 0x52]
push ecx
loopne 0x401995
xor al, dl
inc eax
add byte [eax + 0x78], ch
rol dword [eax], cl
push 0x800
push ecx
call fcn.00408680
add esp, 0x2c
cmp eax, 0xa500
jb 0x401a38
xchg ebx, eax
sal ebx, cl
add al, ch
sbb edi, ebp
invalid
mov eax, dword [0x410258]
mov ebx, 0xcf000002
inc ecx
add byte [ebx - 0x30fffffe], bh
cmp eax, ebx
jl 0x401aa7
mov eax, dword [0x410260]
cmp ebx, dword [0x40d37020]
add byte [ebp + eax - 0x48], dh
rcl bl, 0x40
add byte [ebx + 0x40d03015], cl
add byte [edx - 0x70], dl
push 0x40ba44
mov word [edx + edi*2 - 0x7cffbf3f], es
salc
or al, 0xb
cmp eax, 0xb140f530
adc ecx, 0x5c
xor edi, dword [esp]
scasb al, byte es:[edi]
cmp byte [eax + 2], ah
inc ecx
add bh, dh
ror dword [ecx - 0x7d], 1
add eax, 0xec0d8901
pop ss
inc ecx
add byte [eax + esi*2 - 0x5f], bh
add al, byte cs:[ecx - 0x69]
lea ecx, [ecx + eax + 1]
push ecx
call dword [0x40e35c]
add esp, 4
test eax, eax
jne 0x401a3b
mov edx, dword [sym.imp.MSVCRT.dll__iob]
adc eax, sym.imp.MSVCRT.dll__iob
jne 0x401ac2
stc
inc eax
add byte [ebx + 0x745240e9], al
jmp 0x80dc3b
in eax, 0x5d
inc esp
mov ebp, ebx
xor al, dl
xchg edx, eax
add byte [ebx + 0x420a8af0], cl
mov byte [ebx - 0x13], cl
test byte [ecx], bh
test eax, 0x851580f6
pop ss
inc ecx
add byte [ebx - 0x7fd8ff3], cl
add byte [ebx + 0x41382035], cl
add byte [ebp - 0x2e74fdc4], cl
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
retf 0xe183
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add dword [0x758b5678], 0xc
push esi
lea eax, [ebp + 0x60]
push 0x78
push eax
push esi
call fcn.004086e0
mov ecx, dword [ebp + 8]
and edx, dword [0xfa40c046]
xchg ebp, eax
push ecx
insd dword es:[edi], dx
arpl word [eax + 0x68], ax
aam 0x40
or dword [edx - 1], edx
adc eax, sym.imp.MSVCRT.dll_fprintf
mov eax, dword [0x41c9ac]
stosb byte es:[edi], al
les edx, [eax*4 - 0x5cf0764d]
push 0x400754
push ebp
adc eax, sym.imp.MSVCRT.dll_printf
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
rol dword [eax], 0x5e
Function at 0x406d27
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x406c33
movzx ecx, word [edx + 0x26]
xor edi, edi
nop
mov esi, dword [edx + 0x28]
nop
jmp 0x406c4c
xor eax, eax
nop
lodsb al, byte [esi]
nop
jmp 0x406c60
cmp al, 0x61
nop
jl 0x406c73
nop
nop
sub al, 0x20
jmp 0x406c73
ror edi, 0xd
add edi, eax
nop
dec ecx
nop
jmp 0x406c88
jne 0x406c3e
nop
push edx
nop
push edi
nop
mov edx, dword [edx + 0x10]
nop
jmp 0x406c9e
mov eax, dword [edx + 0x3c]
add eax, edx
mov eax, dword [eax + 0x78]
test eax, eax
je 0x406eba
nop
jmp 0x406cbc
nop
jmp 0x406ccb
add eax, edx
nop
mov ebx, dword [eax + 0x20]
jmp 0x406ce2
push eax
jmp 0x406ced
mov ecx, dword [eax + 0x18]
nop
add ebx, edx
nop
jmp 0x406d04
test ecx, ecx
jmp 0x406d13
je 0x406eb8
nop
jmp 0x406d24
xor edi, edi
nop
jmp 0x406d35
dec ecx
jmp 0x406d43
mov esi, dword [ebx + ecx*4]
add esi, edx
nop
jmp 0x406d59
xor eax, eax
lodsb al, byte [esi]
jmp 0x406d67
ror edi, 0xd
nop
jmp 0x406d7c
add edi, eax
cmp al, ah
jmp 0x406d8a
jne 0x406d59
nop
jmp 0x406d9e
nop
add edi, dword [ebp - 8]
nop
jmp 0x406dad
cmp edi, dword [ebp + 0x24]
jmp 0x406dbf
jne 0x406d04
nop
jmp 0x406dd3
jmp 0x406de4
pop eax
nop
jmp 0x406df8
mov ebx, dword [eax + 0x24]
nop
add ebx, edx
nop
jmp 0x406e10
mov cx, word [ebx + ecx*2]
nop
jmp 0x406e29
mov ebx, dword [eax + 0x1c]
add ebx, edx
jmp 0x406e3f
mov eax, dword [ebx + ecx*4]
jmp 0x406e55
add eax, edx
mov dword [esp + 0x24], eax
jmp 0x406e6a
pop ebx
nop
jmp 0x406e7c
pop ebx
jmp fcn.00406e8f
pop eax
nop
pop edi
pop edx
nop
jmp 0x406ecf
mov edx, dword [edx]
nop
jmp 0x406ee5
jmp 0x406c24

Function at 0x40a3d0
Capabilities:
Terminate process

Disassembly:
push ebp
imul edi, dword [ebx + ecx*4 + 0x45], 8
mov eax, dword [eax + 0x14]
test eax, eax
je 0x40a410
mov esi, dword [esp + ecx + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
aam 0x8b
xor eax, sym.imp.KERNEL32.dll_GetLastError
test eax, 0x75c08576
push 0x8c25dfc
add bh, bh
pop edx
add eax, 0xb7fc80
pop esi
pop ebp
add dword [eax], ecx
add byte [edi - 0x40], bl
pop ebp
ret 8
pop edi
rcr byte [ebp - 0x3e], 8
add byte [eax + 0x4e3b], bh
mov eax, 0x4e3b
pop ebp
ret 8
Function at 0x401a9e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8170d0]
jne 0x401aa8
repz ret
jmp fcn.00402bd6

Function at 0x40f8a5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403626
and dword [ebp - 4], 0
cmp dword [0x8192fc], 0
mov ebx, eax
jne 0x40f956
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40fa07
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40fa07
push eax
call fcn.004035b4
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x8192fc], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x819300], eax
call esi
push eax
call fcn.004035b4
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x819304], eax
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x81930c], eax
test eax, eax
je 0x40f956
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004035b4
pop ecx
mov dword [0x819308], eax
mov eax, dword [0x819308]
cmp eax, ebx
je 0x40f9ae
cmp dword [0x81930c], ebx
je 0x40f9ae
push eax
call fcn.0040362f
push dword [0x81930c]
mov esi, eax
call fcn.0040362f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40f9ae
test edi, edi
je 0x40f9ae
call esi
test eax, eax
je 0x40f9a5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40f9a5
test byte [ebp - 0xc], 1
jne 0x40f9ae
or dword [ebp + 0x10], 0x200000
jmp 0x40f9e7
mov eax, dword [0x819300]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40f9e7
mov eax, dword [0x819304]
cmp eax, ebx
je 0x40f9e7
push eax
call fcn.0040362f
pop ecx
test eax, eax
je 0x40f9e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x8192fc]
call fcn.0040362f
pop ecx
test eax, eax
je 0x40fa07
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40fa09
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x810d96
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
cmp esi, 0x5026c
jne 0x810e33
mov dword [ebp - 4], 0x20
add dword [ebp - 4], 0x20
push 0x8193e0
mov byte [0x8193e0], 0x6b
mov byte [0x8193e1], 0x65
mov byte [0x8193e2], 0x72
mov byte [0x8193e3], 0x6e
mov byte [0x8193e4], 0x65
mov byte [0x8193e5], 0x6c
mov byte [0x8193e6], 0x33
mov byte [0x8193e7], 0x32
mov byte [0x8193e8], 0x2e
mov byte [0x8193e9], 0x64
mov byte [0x8193ea], 0x6c
mov byte [0x8193eb], 0x6c
mov byte [0x8193ec], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 8]
push eax
push 0x40
push dword [0x8197a4]
push dword [0x8196ec]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
inc esi
cmp esi, 0x36edcb
jl 0x810d9e
pop esi
leave
ret
Function at 0x81100d
Capabilities:
Clear file content
Create pipe
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x8197a4]
push ebx
mov ebx, dword [0x8196ec]
push esi
xor esi, esi
mov dword [ebp - 0x10], eax
cmp eax, 0x5dd
jne 0x811033
push esi
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
mov eax, dword [ebp + 8]
push dword [eax]
call fcn.00810f37
cmp dword [0x8197a4], 0x2f
pop ecx
jne 0x811098
push edi
xor eax, eax
mov word [ebp - 0xc], ax
lea edi, [ebp - 0xa]
stosw word es:[edi], ax
mov word [ebp - 4], ax
lea edi, [ebp - 2]
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0xc]
push dword [ebp - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
push ebx
mov ebx, dword [ebp - 0x10]
call fcn.00810f81
cmp dword [0x8197a4], 0x568
pop ecx
jne 0x8110b5
push esi
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
pop esi
pop ebx
leave
ret
Function at 0x811485
Capabilities:
Set file attributes

Disassembly:
sub esp, 0x804
mov eax, dword [0x8170d0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, 0x13ba1f
xor esi, esi
cmp dword [0x8197a4], 0xbf9
jne 0x8114b5
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleDisplayMode]
cmp dword [0x8197a4], 0x3dc
mov dword [0x819798], 0x8e55ceaa
jne 0x8114e0
push esi
push str.Yoxafemaxo_hohomu
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
dec edi
jne 0x8114a2
cmp esi, 0x8465cd
jne 0x8114fa
mov eax, dword [0x818780]
add eax, 0xa231
mov dword [0x8197a4], eax
cmp dword [0x8197a4], 0x141
jne 0x811527
push str.Debiluluyi_domuni_catuca_goherajoxaneh_tobo
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
or dword [0x81946c], 0xffffffff
mov dword [0x819468], 0xec58acac
inc esi
cmp esi, 0x125483c
jl 0x8114e3
call fcn.008110b9
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00401a9e
add esp, 0x804
ret 0x10
Function at 0x6de482
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
ror edx, cl
mov ebp, esp
neg dh
add edx, ecx
mov edx, dword [ebp + 8]
test eax, 0x3078d9e
lea esp, [esp - 0x114]
cmc
cmp edi, esp
push esi
cmc
cmp ecx, 0x308580b6
test edx, edx
je 0x93c14f
mov esi, dword [ebp + 0xc]
cmp eax, ebp
test ebp, 0x258468a6
test esi, esi
jmp 0x7358af
je 0x93c14f
mov eax, 0x5a4d
cmp word [edx], ax
jmp 0x93c149

Function at 0x7015ac
Capabilities:
Encode data using xor

Disassembly:
push ebx
movzx ebx, bp
lea ebp, [ebx*8 - 0x12df12c5]
dec ebx
lea ebp, [ebx + edi - 0xf18f]
dec edx
call fcn.008b35a5
push eax
mov eax, 0x408ff19c
bswap eax
not eax
push ecx
push eax
jmp 0x933d3e
pushfd
pop eax
mov dword [esp], eax
mov eax, 0xe631d622
or eax, eax
push ebp
shr eax, 0x81
push edx
mov edx, 0xcf357d23
add al, al
push edi
xor eax, 0x57c002cf
sar edx, 0xb7
mov edi, edx
lea edi, [esp + eax - 0x7318eb2e]
push ebp
mov ebp, 0x53bff09c
dec edx
jl 0x6d6151
mov cl, 0x6b
shl bl, 0x62
sub dl, dh
or al, 0xce
jl 0x933d52
rcl byte [ecx + 0x3b]
loope 0x933dc7
test dword [edi], edx
mov esp, 0x223c1697
push ss
cmp al, 0x22
xor edx, esi
sar dword [edi - 0x2f], 0x49
push ss
nop dword [ebx - 0x5a00a593]
add byte [ebp + 0x1d], dl
nop dword [edx + 0x40]
jae 0x933d5c
rcr byte [eax - 0x293f8a72], 1
xchg esi, eax
call 0x76543537
jmp 0x933d84
dec edi
cmp al, 0xf4
std
call [edi + 0x65]
outsb dx, byte [esi]
mov ah, byte [edi]
dec ecx
add dword [edi], edx
loope 0x933e00
mov word [ecx], cs
popal
fcomp qword [edi]
inc edx
push esp
xor eax, 0x117d9790
jg 0x933e1c
and dword [0x5028fd48], esi
jae 0x933e4e
adc eax, dword [0x565ad164]
and ah, byte [ebx + ebp*2 + 0x669ace8d]
adc byte [ecx + 0x17], 0xfa
cmp byte [edx + 0x41], al
inc ecx
clc
mov dl, byte ss:[eax]
adc al, 0x20
in al, 0xf8
xchg edx, eax
xchg ebp, eax
mov al, byte [edx + 0x47b78a59]
mov bh, 0x47
mov dl, cl
xor ah, bl
or al, 0x13
lodsd eax, dword [esi]
test eax, 0x1c22bd31
lodsb al, byte [esi]
sbb al, 0xac
add byte [edx - 5], ah
mov dword [0xb56a338a], eax
xor ebp, dword [edx - 0x4b]
in eax, 0x1f
je 0x933e0f
clc
push eax
push esp
sbb al, 0xc4
adc bh, ah
scasd eax, dword es:[edi]
out dx, al
pop edi
movsd dword es:[edi], dword [esi]
sbb al, 0xe1
aaa
invalid
inc ebx
fdiv dword [esi - 0x542b3bc2]
push cs
out 0x22, al
push eax
jbe 0x933ec2
cmp dword [ebp + edi*8 + 0x2f], 0x18
mov esp, 0xa3ed553c
mov dword [0xa5e8398c], eax
aad 0xbc
out dx, eax
out dx, eax
mov al, byte [0xfe4ae43]
jge 0x933e94
sbb dword [ecx + 0x10f25ac1], eax
pop ss
jecxz 0x933e23
adc ecx, eax
pop ss
invalid
mov ebx, 0x71ec9cd8
jecxz 0x933ebf
pop esi
push ss
add byte [ebx - 0xf1f9e3c], ah
popal
loopne 0x933e87
xor ah, byte [ebx + 0x4a]
and al, 0x6c
jl 0x933ea1
cmpsb byte [esi], byte es:[edi]
jge 0x933f12
add dword [edi + 0x27], ebp
xor edi, eax
rsm
mov ch, 0x56
shr dword [ecx + 0x28566844], 1
adc dword [edx], ebp
xchg esi, eax
wait
pop ecx
cwde
invalid
popfd
pushfd
mov dh, 2
mov edi, 0x7d0ed4e7
add bh, byte [edi + 0x7d0ed4e7]
mov esi, 0x3867ed04
cmc
cmp byte [edi - 0x6fb5035c], 0xe1
retf 0xf5ce
inc ebx
jmp 0x19c467c3
Function at 0x702221
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test ebp, ebp
mov dword [esp], 0xc0026d19
lea esp, [esp + 4]
je 0x702281
movzx eax, byte [ecx]
push 0x1a16fd95
push 0xc795f12f
push 0x8ba368aa
xor eax, edx
and eax, 0xff
mov eax, dword [eax*4 + 0x6acd84]
inc word [esp + 0xa]
shr edx, 8
xor edx, eax
inc ecx
shl dword [esp + 8], 0x9a
xor edx, 0xa1b09327
ror word [esp + 4], 0x48
dec dword [esp + 8]
dec ebp
lea esp, [esp + 0xc]
jne 0x702236
push 0x7435e526
not edx
mov dword [edi], edx
lea esp, [esp + 4]
jmp fcn.006fd3fd

Function at 0x75add4
Capabilities:
Encode data using xor

Disassembly:
lea edx, [ebp - 0x80]
mov dword [esp], 0x9319ce1b
mov edi, 0x4fa5440f
and edx, 0xfffffffc
sub edx, ecx
not di
not edi
mov esp, edx
not edi
not di
push esi
pushfd
mov esi, eax
add di, 0x8d2b
or di, di
mov edi, edx
push 0x9d319c39
cld
push 0xc937d6a2
call fcn.0095685b
or dword [ebx + edx*8 + 0x33], ebp
pop ecx
xor ebp, dword [ebp + 0x63]
xor dword [ebx + ecx - 0x16486209], 0xa71815f7
sbb esi, dword [ecx + 0x77]
dec edx
adc al, 0xf3
mov ecx, 0xb8688628
or cl, byte fs:[ecx + edi*4]
aam 0x95
push es
mov dh, 9
dec ecx
cwde
rol esi, cl
add dword [esi], ebp
push esi
xlatb
jns 0x75addf
dec esi
cmp ah, al
mov edx, 0x75ebb567
scasb al, byte es:[edi]
sub byte [esi + 0x75682468], al
mov bl, 0x79
iretd

Function at 0x75c6d6
Capabilities:
Encode data using xor

Disassembly:
xor cl, bl
add cl, 0x9f
rol cl, 1
neg cl
add cl, 0xaa
ror cl, 1
call fcn.008aa700
sbb al, 6
in eax, dx
invalid

Function at 0x8a9394
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
push 0x3c355391
test edx, edx
jmp 0x8afc4b
lea esp, [esp + 0xc]
call fcn.0074b148
mov edi, dword [ebp]
mov edx, dword [ebp + 4]
add ebp, 4
jmp 0x6769da
lea esp, [esp + 4]
je 0x8afca7
push ebx
movzx ebx, byte [edi]
xor ebx, eax
push 0x97be5083
sal word [esp + 2], 0x8a
and ebx, 0xff
add dword [esp], 0x1c8c2105
mov ebx, dword [ebx*4 + 0x6f54d0]
shr eax, 8
xor eax, ebx
inc edi
xor eax, 0xde3e0506
and byte [esp], 0x85
dec edx
push 0x63bc30a1
lea esp, [esp + 8]
jne 0x8afc56
mov ebx, 0xeca1c692
push ebx
mov ebx, dword [esp + 4]
lea esp, [esp + 8]
not eax
push 0xa7b54705
mov dword [ebp], eax
lea esp, [esp + 4]
jmp fcn.00955b12
Function at 0x942ad7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x55b946ae
call fcn.0093a1c0
fnstcw word [edx - 0x40]
xor edx, dword [ecx - 0x7ed5ff18]
jp 0x6a88ff
or byte [ecx + 0x79dae8d2], dh
pop eax
mov al, byte [0x80f37943]
jmp 0xcc4828ee
mov edx, dword [ebp]
lea edi, [esi + esi*8 - 0x385676fa]
lea ebp, [edi + ebp - 0x71eca456]
mov esi, edx
not edi
mov edi, ebp
jmp fcn.00686969
or eax, dword [eax]
and edx, ebp
add byte [ebx - 0xce7dfdf], ah
fnstcw word [ebx - 0x5ae17c8]
push eax
ret 0x11a1
sub eax, 0x369a96c4
xchg ebx, eax
inc ecx
bnd jle 0x8a34d2
shl dword [esi + 0x4e], 0x9b
stc
inc esp
scasb al, byte es:[edi]
or eax, 0x810e0ad1
and esp, esp
salc
insd dword es:[edi], dx
mov dword [eax], esi
inc ecx
syscall
inc ecx
push esp
pushfd
dec ecx
mov esp, 0xba0fd404
div dword ss:[ebx]
dec esp
mov esp, dword [esp + 8]
dec eax
mov dword [esp + 8], 0x3863440b
push dword [esp]
popfd
dec eax
lea esp, [esp + 8]
call fcn.007063bc
mov esi, 0xbd95adb4
jmp 0x6ce05b
mov eax, dword [ebp + ebx*4]
call fcn.0094262a
cmpsb byte [esi], byte es:[edi]
fcmovnu st(0), st(3)
dec ebp
push ecx
fnstcw word [0x105ce70f]
xor ebp, dword [ecx]
mov edi, ebx
jne 0x8a351b
stosd dword es:[edi], eax
inc ebp
nop
invalid
sal edx, 2
sar eax, 0x1e
sbb word [esp + 1], 0xdb88
mov eax, ebp
shr dword [esp], 0x10
add eax, edx
mov dword [ebp - 4], eax
test ebx, ebx
lea esp, [esp + 4]
je 0x6a8922
mov eax, 0xb7969123
jmp 0x8a356e
mov dword [esp + edx - 0x48bffffc], 0x3d2077ac
mov dword [esp + ebp - 0x79cc6e0a], esi
and ax, 0xafb4
mov dword [esp + edx - 0x48bffffc], ebx
rol dx, 0xa5
mov dword [esp + edx - 0x48c00000], 0xb8a5650f
mov ebp, edi
mov ebx, ecx
xor edx, 0xb50203b7
mov edx, ebx
js 0x93659e
Function at 0x402a90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [eax + 0x70], 0
mov dword [eax + 0x4c], ecx
jne 0x402aa3
mov dword [eax + 0x70], 1
mov dword [eax + 0x54], ecx
mov edx, ecx
sub edx, dword [eax + 0x54]
cmp edx, 0x2710
jge 0x402ab8
cmp edx, 0xffffd8f0
jge 0x402abd
mov dword [eax + 0x54], ecx
jmp 0x402ac1
test edx, edx
js 0x402adc
mov edx, dword [eax + 0x50]
add dword [eax + 0x54], edx
push esi
push edi
mov edi, ecx
sub edi, dword [eax + 0x54]
pop edi
pop esi
js 0x402ad7
add edx, ecx
mov dword [eax + 0x54], edx
jmp fcn.004024a0
ret

Function at 0x402c50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
mov eax, dword [0x4191b4]
xor eax, esp
mov dword [esp + 0x198], eax
push edi
xor edi, edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov dword [esi], vtable.CTcpSocket.0
mov dword [esi + 0x38], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, vtable.CBuffer.0
mov dword [esi + 0x2c], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], eax
lea eax, [esp + 8]
push eax
push 0x202
mov dword [esi + 0x58], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
push edi
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push edi
lea ecx, [esi + 0x18]
push ecx
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esp + 0x19c]
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x14], edi
pop edi
xor ecx, esp
mov dword [esi + 0x64], 0xffffffff
mov eax, esi
call fcn.00406955
mov esp, ebp
pop ebp
ret