joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d03
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push dword [ebp + 8]
call fcn.0100297b
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.010029b6
push esi
out 0xe5, al
lea eax, [ebp - 0x18]
mov byte [ebp - 0x18], bl
push eax
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.010029c6
push eax
push esi
push dword [ebp + 8]
call fcn.0100297b
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
cwde
pop ss

Function at 0x1002d83
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.010029c6
push eax
push esi
push dword [ebp + 8]
call fcn.0100297b
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.010029c6
push eax
push esi
push dword [ebp + 8]
call fcn.0100297b
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.010029b6
insd dword es:[edi], dx
invalid

Function at 0x1002e55
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.010029b6
pop es
fldpi
retf 0x858d
Function at 0x100488c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov ebp, 0xfffff904
push es
jne 0x1004929
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0x11
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0xb2
mov byte [ebp - 0x7d7], 0x8b
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.010029c6
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.01002927
add esp, 0xc
jmp 0x100492e
jmp 0x1004a5c
cmp dword [ebp - 0x37c], 0
jne 0x1004b06
mov eax, dword [ebp - 0x748]
mov dword [ebp - 0x7ec], eax
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x7e8], eax
and dword [ebp - 0x7e0], 0
push 0x1000
push 8
push dword [ebp - 0x674]
call dword [ebp - 0x67c]
mov dword [ebp - 0x7e4], eax
push dword [ebp - 0x7e4]
lea eax, [ebp - 0x7ec]
push eax
push dword [ebp - 0x748]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01002b92
add esp, 0x14
mov dword [ebp - 0x7e0], eax
cmp dword [ebp - 0x7e0], 0
je 0x1004af2
lea eax, [ebp - 0x714]
push eax
call fcn.010029c6
pop ecx
push eax
push dword [ebp - 0x7e0]
call fcn.01002a5b
pop ecx
pop ecx
mov dword [ebp - 0x37c], eax
push dword [ebp - 0x7e4]
push 1
push dword [ebp - 0x674]
call dword [ebp - 0x39c]
push dword [ebp + 0x1c]
push dword [ebp - 0xc]
push dword [ebp - 0x540]
push dword [ebp - 0x684]
push dword [ebp - 0x688]
push dword [ebp - 0x3ac]
push dword [ebp - 0x400]
push dword [ebp - 0x54c]
push dword [ebp - 0x678]
lea eax, [ebp - 0x334]
push eax
push dword [ebp - 4]
push dword [ebp + 8]
call dword [ebp - 0x37c]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e187
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov edx, dword [ebp + 8]
xor eax, eax
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
push esi
xor esi, esi
inc ebx
push edi
mov dword [ebp - 0xc], esi
cmp dword [edx + 4], eax
je 0x41e29e
mov ecx, dword [ebp + 0x1c]
xor edx, edx
mov edi, dword [ebp + 0xc]
mov dword [ebp - 8], 0x23
mov byte [ecx], dl
mov ecx, dword [ebp + 0x18]
mov dword [edi], edx
mov edi, dword [ebp + 8]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x10]
mov byte [ecx], dl
push eax
mov ecx, edi
call fcn.00403a3f
push 0x2b
pop ecx
push 0x5e
movzx eax, word [eax]
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x45e773
cmp ax, cx
je 0x45e773
cmp ax, dx
je 0x45e773
cmp ax, word [ebp - 8]
je 0x45e773
lea eax, [esi + 1]
mov ecx, edi
push esi
mov dword [ebp + 0x1c], eax
call fcn.00403a3f
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 0xc]
movzx eax, word [eax]
cmp eax, 0x7b
jne 0x45e820
push pe_nt_image_headers32
lea ecx, [ebp - 0x1c]
call fcn.00406270
mov edx, dword [ebp + 8]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x7d
pop eax
mov ecx, eax
call fcn.0041e2a2
pop ecx
pop ecx
test al, al
je 0x41e29a
push dword [ebp - 0x1c]
push dword [esi*4 + 0x4b11e0]
call fcn.00424a28
pop ecx
pop ecx
test eax, eax
je 0x41e267
inc esi
cmp esi, 0x63
jl 0x41e24c
cmp esi, 0x63
je 0x45e7af
cmp byte [esi + 0x4b1178], 0
jne 0x41e29a
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x1c]
call fcn.0040988f
mov eax, dword [edi]
movzx ecx, al
mov al, bl
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0x41e282
xor al, al
jmp 0x41e293
push 0x2b
pop esi
cmp ax, si
jne 0x45e780
mov eax, dword [ebp + 0x10]
jmp 0x45e79f
cmp ax, cx
jne 0x45e78a
mov eax, dword [ebp + 0x14]
jmp 0x45e79f
cmp ax, dx
jne 0x45e794
mov eax, dword [ebp + 0x18]
jmp 0x45e79f
push 0x23
pop ecx
cmp ax, cx
jne 0x45e7a1
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
mov esi, eax
jmp 0x41e1ce
cmp dword [ebp + 0x1c], 2
jne 0x45e7ca
mov ecx, dword [ebp + 8]
push 2
call fcn.00403a3f
push 0x7d
pop ecx
cmp word [eax], cx
jne 0x45e7ca
push ecx
jmp 0x45e7d8
push 0
lea ecx, [ebp - 0x1c]
call fcn.00404c6d
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x45e7f3
lea ecx, [ebp - 0x1c]
call fcn.0040988f
jmp 0x41e29e
test eax, 0x200
je 0x45e7ff
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x45e80b
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41e282
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0x41e282
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x41e29e
test eax, 0x200
je 0x45e83f
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x45e84b
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0x41e28c
mov ecx, dword [ebp + 0x10]
mov byte [ecx], bl
jmp 0x41e28c
Function at 0x46cf00
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20034
call fcn.00441f50
push ebx
push esi
lea eax, [ebp - 0x20034]
mov esi, edx
push eax
mov edx, 0x7fff
call fcn.0046dde0
lea eax, [ebp - 0x10034]
mov edx, 0x7fff
push eax
mov ecx, esi
call fcn.0046dde0
pop ecx
pop ecx
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
test eax, eax
jne 0x46cf8a
cmp byte [ebp + 8], al
je 0x46cfae
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call fcn.00425232
pop ecx
pop ecx
test eax, eax
je 0x46d06f
lea eax, [ebp - 0x10034]
push eax
lea eax, [ebp - 0x20034]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileW]
jmp 0x46d06f
lea ecx, [ebp - 0x20034]
call fcn.0046e199
test al, al
je 0x46cfae
lea ecx, [ebp - 0x10034]
call fcn.0046e199
test al, al
je 0x46cfb4
cmp byte [ebp + 8], 0
jne 0x46cfed
xor al, al
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x10034]
push eax
lea ecx, [ebp - 0x34]
call fcn.00409cb3
lea ecx, [ebp - 0x34]
call fcn.0046d2c1
mov bl, al
lea ecx, [ebp - 0x34]
neg bl
sbb bl, bl
call fcn.0040988f
add bl, 1
jne 0x46cfae
lea ecx, [ebp - 0x10034]
call fcn.0046e199
test al, al
je 0x46cfae
lea eax, [ebp - 0x20034]
push str..
push eax
call fcn.00429038
lea eax, [ebp - 0x20034]
push eax
call fcn.00424963
xor ecx, ecx
mov word [ebp + eax*2 - 0x20032], cx
lea eax, [ebp - 0x10034]
push eax
call fcn.00424963
xor ecx, ecx
mov dword [ebp - 0x20], 2
add esp, 0x10
mov word [ebp + eax*2 - 0x10032], cx
lea eax, [ebp - 0x20034]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10034]
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0x24], eax
mov eax, 0x614
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
jne 0x46cfae
mov al, 1
jmp 0x46cfb0
Function at 0x46d3a9
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x288
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [esp + 0x10]
mov byte [esp + 0xf], bl
call fcn.0040a961
lea ecx, [esp + 0x30]
call fcn.0040a961
lea ecx, [esp + 0x20]
call fcn.0040a961
lea edx, [esp + 0x10]
mov ecx, esi
call fcn.00403aa2
mov ecx, dword [esp + 0x10]
call fcn.0046e199
test al, al
je 0x46d400
push str..
lea ecx, [esp + 0x14]
call fcn.004033c6
push ebx
lea eax, [esp + 0x24]
push ebx
push eax
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x1c]
call fcn.0040525f
add esp, 0xc
lea eax, [esp + 0x40]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
mov al, 1
mov byte [esp + 0xe], al
cmp esi, 0xffffffff
je 0x46d4a0
cmp al, 1
jne 0x46d4a0
test byte [esp + 0x40], 0x10
jne 0x46d47b
mov byte [esp + 0xf], al
lea ecx, [esp + 0x10]
lea eax, [esp + 0x30]
push eax
call fcn.0040a8c7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x14]
call fcn.00406350
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x14]
call fcn.004033c6
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp eax, 1
jne 0x46d497
lea eax, [esp + 0x40]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
mov al, byte [esp + 0xe]
jne 0x46d433
mov al, bl
mov byte [esp + 0xe], al
jmp 0x46d433
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x46d4ab
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, byte [esp + 0xf]
lea ecx, [esp + 0x20]
call fcn.0040988f
lea ecx, [esp + 0x30]
call fcn.0040988f
lea ecx, [esp + 0x10]
call fcn.0040988f
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402485
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4024c4
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4024c4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4024c4
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4024c4
cmp dword [ecx + 0x74], 0xe
jbe 0x4024c4
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4080a3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408140
push ebx
push esi
call fcn.0040806c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408000
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4080ed
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40813f
push edi
push eax
call fcn.00408cc0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40810d
call fcn.00406b61
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40813e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408000
add esp, 0x20
test eax, eax
jne 0x40812c
push edi
call fcn.00406b61
jmp 0x408134
push ebx
call fcn.00406b61
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40943d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142b8
push 0x4142b0
push str.FlsAlloc
push 0x1f
call fcn.004092fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409471
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
jmp 0x409477
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4094bb
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142c8
push 0x4142c0
push str.FlsGetValue
push 0x21
call fcn.004092fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4094f2
push dword [ebp + 8]
mov ecx, esi
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4094fa
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4142d0
push 0x4142c8
push str.FlsSetValue
push 0x22
call fcn.004092fc
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409534
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41212c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40e990
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40e9bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40e9bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10008ec6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x10008f28
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 8]
push ebx
mov ebx, ecx
test edx, edx
jne 0x10008f38
push 0xd
pop eax
jmp 0x10008f6e
push ebp
push esi
push edi
xor esi, esi
mov edi, edx
mov ecx, edi
lea ebp, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008f44
sub ecx, ebp
lea eax, [ecx + 1]
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10008f3f
push esi
push edx
push 7
push 0
push dword [esp + 0x24]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x1000c3fb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1000c40a
pop dword [ebp - 0x24]
mov eax, 0xf0a80ab4
add eax, 0x1f58b956
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x38e30
push 0
mov eax, 0x4a7c70ab
add eax, 0xc584605d
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x4dce
xor ebx, ebx
add ebx, eax
mov esi, 0xf92dcbb3
sub esi, 0xe92bb7b3
add esi, dword [ebp - 0x24]
mov edi, 0x9e5e8f6b
add edi, 0xb484dc23
sub dword [ebp - 0x20], 0xbf1a4b65
mov edx, dword [esi]
mov dword [ebp - 0x20], 0x56e1eda3
sub edx, edi
xor dword [ebp - 0x14], 0xd669da98
mov dword [ebx], edx
sub dword [ebp - 0x1c], esi
add ebx, 0x85805ece
sub ebx, 0x85805eca
add esi, 4
loop 0x1000c465
add eax, 0x12a0b
mov ebx, eax
add eax, 5
mov ecx, 0x9a2902b8
add ecx, 0x75d6fd48
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x4226cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x4226db
pop dword [ebp - 0x1c]
mov eax, 0x7f8ca5f4
sub eax, 0x7f4a7f19
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x409c2
push 0
mov eax, 0x4e6d8347
add eax, 0xb1d4ced1
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x5329
mov edx, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x1c]
mov edi, 0xe626c4ec
xor dword [ebp - 4], 0xcf2dac79
mov esi, dword [ebx]
add dword [ebp - 0x18], 0x175d1dd4
sub esi, edi
mov dword [edx], esi
sub dword [ebp - 0x14], edi
add edx, 4
add ebx, 0x3f38f3ef
add ebx, 0xc0c70c15
loop 0x422728
add eax, 0x45a27d31
sub eax, 0x45a13dba
xor ebx, ebx
add ebx, eax
add eax, 0x7faff9d8
add eax, 0x8050062d
mov ecx, 0xb6ae6eda
add ecx, 0x49919126
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x4079d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4079e8
pop dword [ebp - 0x28]
mov eax, 0xce134e01
sub eax, 0xcdd2d419
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x42962
push 0
mov eax, 0x3d55f607
add eax, 0xc2eaead1
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x33a53ef
add ecx, 0xfcc6182f
xor edx, edx
add edx, eax
mov edi, 0x413bc4
add edi, dword [ebp - 0x28]
mov esi, 0x73db428c
sub esi, 0x32ab6d47
add dword [ebp - 0x14], ebx
mov ebx, dword [edi]
sub dword [ebp - 0x10], ecx
xor ebx, esi
mov dword [ebp - 0x14], 0x4a69da1c
mov dword [edx], ebx
add dword [ebp - 0x14], ecx
add edx, 0x15cf1c3b
add edx, 0xea30e3c9
add edi, 0x958a48a3
sub edi, 0x958a489f
loop 0x407a43
add eax, 0x1a34b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x39319c83
add ecx, 0xc70e637d
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4e3acd
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
inc dword [edx - 0x31a1de72]
cld
pop edi
mov ebp, 0x14d6fa1
sbb al, byte [eax + 0x2c]
out dx, eax
sahf
enter 0xffffffffffffcf89, 0x7a
cmp eax, 0xeae24754
cmc
outsb dx, byte [esi]
dec edx
cwde
pop esp
les ecx, [eax + 0x66]
mov ss, word [0xbc2e25c0]
pop esp
pop edx
aas
sbb byte [ecx + 0x18], 0xf
push ds
scasb al, byte es:[edi]
aaa
jmp 0x4e3b59
sbb al, 0xd4
cmp ebx, esp
cmpsb byte [esi], byte es:[edi]
scasb al, byte es:[edi]
aad 0xb9
sbb byte [ebx + edx + 0x6d56a585], dl
insb byte es:[edi], dx
mov edi, 0x11d34a8a
mov edi, 0xcb378040
neg byte [ebx + 0x12]
in al, 0xed
shl byte [ebp + 0x4b1ee70e], cl
movsd dword es:[edi], dword [esi]
dec ecx
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
mov dword [0x8786fc53], eax
dec ebp
aaa
pause
mov dl, byte [esi + 0x43]
or bl, dl
nop
lahf
sub al, 0xa6
cmpsb byte [esi], byte es:[edi]
or edi, esi
imul edx, dword [eax + ebp*4 - 0xc], 0x3b
out dx, eax
dec edx
xor eax, 0xa7ef1e17
outsb dx, byte [esi]
add ebp, dword [ecx + 0x4f7917ae]
pop esi
mov edx, 0xe3708655
add ecx, dword [edi + 0x5e]
cmp al, 0xe4
xchg esi, ecx
jo 0x4e3b72
int1
stosd dword es:[edi], eax
arpl word [edx + 0x44], bx
dec ebx
mov dh, 0xfe
bound edx, qword [0x5e747e8a]
ja 0x4e3b44
mov esi, 0xd31eee27
int1
out dx, al
test al, 0x22
je 0xd6ef8d29
into
dec esi
sbb byte [ecx + edx*4 - 0x71], al
scasb al, byte es:[edi]
inc edx
pop eax
invalid

Function at 0x544e3d
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx + 0x30ce1f08], ch
xchg dh, cl
xor esp, dword [edx - 0x65e6a7c3]
mov ebp, 0x34a73899
push esp
invalid

Function at 0x54b53d
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x51
dec ecx
movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx - 0x6362eb3d]
and ah, 0x5b
cmpsb byte [esi], byte es:[edi]
dec edi
outsd dx, dword [esi]
outsb dx, byte [esi]
movsb byte es:[edi], byte [esi]
push ds
mov al, 0xe
push 0xbc00e9c
xor ah, byte [0x9685b3d9]
or al, byte [edi + 8]
test byte [ebx - 0x320af0dc], ah
pop ebp
pop ss
cmpsb byte [esi], byte es:[edi]
mov ebp, 0x158b111
or byte [ebx], bh
add al, 0x99
movsb byte es:[edi], byte fs:[esi]
lodsd eax, dword [esi]
invalid
Function at 0x577c68
Capabilities:
Encode data using xor

Disassembly:
cwde
rcr byte [ebp - 0x7847dbcd], cl
invalid
pushal
loope 0x577c8a
invalid
inc esp
mov byte [0xfad5b19e], al
je 0x577c92
test byte [eax + 0x67], bh
popal
daa
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebx + 0x32]
test byte ss:[ebp - 0x7e4a0afe], dl
in al, 0xec
jno 0x577c38
jbe 0x577c0c
in al, 0x67
jb 0x577c70
in eax, 0xd4
mov al, 0x99
aam 0xb0
cdq
lea ebp, [ebp - 7]
push 0x504130cb
mov dh, 0xc3
jb 0x577cd6
retf
or dword [esi + 0x5d], edi
sbb esi, dword [ecx]
rcl byte [ecx - 0xb3dfb88]
stosb byte es:[edi], al
sub ch, bl
and byte [esp + eax*4 - 0x4dbb6123], bh
jnp 0x577cfa
dec edi
in eax, 0xf1
popal
sar dword [ebx + 0x1e], 1
inc edx
bound ecx, qword [eax]
out 0x27, al
xor ah, byte [ebx - 0x64]
cmp ebp, ebx
mov bl, 0x16
call 0x9bf8af18
das
mov ss, word [eax + ebp - 0x669d6d12]
cld
out dx, al
push es
mov byte [ebp + 0x46], cl
xchg edx, eax
movsb byte es:[edi], byte [esi]
test eax, 0x8bb2586d
xchg dword [eax - 0x19], esp
ror byte [ebp - 0x352f18a5], 1
cli
xlatb
and eax, 0xe76c10e
and al, 0x27
sub ecx, dword [ebp - 7]
push edi
sub esp, dword [ebx - 0x1b]
pop ss
cmc
and eax, 0x54d33d82
test eax, 0x64934744
mov dword [edi], eax
shr dword [edi], 1
mov eax, 0x9756d1cb
xor bl, ch
mov esi, 0x725c38f0
jne 0x577ce9
mov al, 0xe4
salc
popal
xor byte [edi + 0x52], dl
pop esp
add ebx, ebp
invalid
Function at 0x5b861d
Capabilities:
Encode data using xor

Disassembly:
out dx, al
pop ecx
inc eax
out 0x25, eax
in eax, 0x1c
sahf
pop ds
adc esi, dword [edi + 0x69fc9a85]
fdiv qword [esi + 0x4a]
cld
dec eax
xchg edi, eax
inc ebp
test al, 0x2a
xchg ebp, eax
cmp eax, dword [ecx]
jle 0x5b86aa
scasb al, byte es:[edi]
and byte [ebp - 0x24], ch
into
dec esi
fimul dword [eax]
lea eax, [esi]
or byte [esi - 0x65], cl
xor al, 0x81
push ds
invalid
mov ebx, 0x69d02edf
xor ax, 0xae26
mov ah, 0x15
push cs
and esp, ebx
stosb byte es:[edi], al
xor eax, 0xf3c618c0
mov dh, 0x58
invalid
cmp byte [esi], bh
xlatb
sbb byte [eax - 0x12], 0xfb
push cs
in eax, 0
pop ss
xor ch, byte [eax + 0x2e]
xor edx, dword [eax]
clc
adc dword [ebx + 0x273de031], ebx
xchg byte [ebx - 0x77e1392d], al
test al, 0x50
mov esi, 0x91f2f4b8
pushal
mov al, byte cs:[0x1490065e]
mov esi, 0x8a4c1205
jnp 0x5b86e2
loopne 0x5b866c
push ds
sbb al, 0x56
push esi
nop
outsb dx, byte [esi]
test eax, 0xff2244d6
push esi
enter 0x6086, 0xffffffffffffffaa
call dword [esi - 0x38]
xchg byte [eax - 0x56], ah
loop 0x5b864f
inc esi
xor byte [ecx + 0x15], al
daa
mov bl, 0x4f
jne 0x5b86a3
outsb dx, byte [esi]
out 0x33, eax
push eax
push es
js 0x5b8705
loope 0x5b873e
or bh, ch
mov ebx, dword [eax]
cld
jle 0x5b8690
xor ch, 0xf3
jo 0x5b8705
stosd dword es:[edi], eax
sbb eax, 0x12a12026
xor al, ch
invalid
xor eax, 0xbdeb6df5
salc
add byte [eax], ch
pop edx
jecxz 0x5b86d6
xchg ebp, eax
jb 0x5b877b
cmpsb byte [esi], byte es:[edi]
jo 0x5b86e2
scasd eax, dword es:[edi]
push 0x3a22c026
push esi
push 0x4d00d8e0
xchg dword [eax + 0x38], edx
xchg edi, eax
mov eax, dword [0x368badb6]
fistp word [eax + 0xb5f2370]
push 0x76
push ecx
inc esp
loope 0x5b875f
pop ss
jae 0x5b876a
aaa
clc
clc
out 0x1e, al
bound esp, qword [ebx + 0x69]
adc edi, 0xab6588c2
neg esi
out dx, eax
ror byte [ebx], 1
mov bl, 0x23
mov esp, 0xdb71a526
or al, byte [ebp + 0xa]
inc edx
in al, 0x68
in al, dx
in eax, 0x5b
jo 0x5b87a3
xchg ebx, eax
aaa
add al, 0xe4
stosb byte es:[edi], al
cmc
nop
mov edi, 0xad0420ff
salc
ret
jmp dword [eax]
das
ficom dword [eax - 0x3b]
mov esi, ecx
aaa
xchg dword [esi - 0x596d3c21], edi
test al, 0x76
imul dword [ebx - 0x10954d70]
xchg dword [esi], esi
pushal
cdq
cdq
inc dword [ebx + 0x7e]
add byte [esi - 0x31], dh
mov byte [edx - 0x469b8a9d], bh
dec esi
mov esi, 0x2197ca8d
dec ebp
invalid