joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100220f1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWABDLLPath
xor edi, edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
cmp esi, edi
jne 0x100221c4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push ebx
lea eax, [ebp - 4]
push eax
push edi
push edi
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], edi
je 0x100221b7
push dword [ebp - 4]
call fcn.100012ea
mov ebx, eax
mov dword [ebp - 0xc], ebx
cmp ebx, edi
je 0x100221b7
lea eax, [ebp - 4]
push eax
push ebx
push edi
push dword [ebp - 8]
call esi
mov esi, eax
cmp esi, edi
jne 0x100221ad
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, edi
je 0x100221a5
push 0x1002d282
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10022195
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call eax
test eax, eax
jne 0x1002218b
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x100221ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x10022198
push 0x7f
pop esi
cmp esi, edi
je 0x100221ad
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100221ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp - 0xc]
call fcn.100012ff
jmp 0x100221ba
push 8
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret 0xc
Function at 0x10022434
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push edi
push 0x57
pop ebx
xor eax, eax
push 6
pop ecx
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
cmp edx, 0x129803f0
je 0x100224a9
cmp edx, 0x132e03f0
je 0x10022499
cmp edx, 0x13c403f0
je 0x10022489
cmp edx, 0x142803f0
jne 0x1002262d
mov dword [ebp + 0x10], 0x1002d26e
mov dword [ebp - 0x14], 0x19
jmp 0x100224b7
mov dword [ebp + 0x10], 0x1002d273
mov dword [ebp - 0x14], 0x6e
jmp 0x100224b7
mov dword [ebp + 0x10], 0x1002d265
mov dword [ebp - 0x14], 0x50
jmp 0x100224b7
mov dword [ebp + 0x10], 0x1002d278
mov dword [ebp - 0x14], 0x8f
mov edi, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push 0x1002d2f4
push edi
push esi
call fcn.100223d9
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1002262c
push 0x1002d2fb
push edi
push esi
call fcn.100223d9
push 0x1002d314
push edi
push esi
mov dword [ebp - 0x20], eax
call fcn.100223d9
push 0x1002d30f
push edi
push esi
mov dword [ebp - 0x18], eax
call fcn.100223d9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x10022550
push esi
call edi
lea eax, [eax + eax + 6]
push eax
call fcn.100012ea
mov ebx, eax
test ebx, ebx
je 0x10022545
push 0x1002d4e0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
push ebx
call fcn.100012ff
push esi
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call esi
jmp 0x10022556
mov esi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x1002d305
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.100223d9
mov ebx, eax
test ebx, ebx
je 0x100225f4
push ebx
call edi
cmp eax, 1
jbe 0x100225f4
shr eax, 1
push eax
mov dword [ebp - 0x10], eax
call fcn.100012ea
xor edi, edi
mov dword [ebp - 0xc], eax
cmp eax, edi
je 0x100225f1
mov ecx, ebx
call fcn.10010d6b
test eax, eax
je 0x100225e9
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp + 0x18]
lea eax, [ebp - 0x10]
push edi
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
je 0x100225e9
mov eax, dword [ebp - 8]
add eax, 2
push eax
call fcn.100012ea
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x100225e0
push dword [ebp - 8]
push dword [ebp - 4]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
shr eax, 1
add esp, 0xc
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0xc]
call fcn.100012ff
push ebx
call esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x2c]
push dword [ebp + 8]
call fcn.10021a4d
xor edi, edi
mov ebx, eax
cmp dword [ebp - 0x1c], edi
je 0x10022613
push dword [ebp - 0x1c]
call fcn.100012ff
cmp dword [ebp - 0x18], edi
je 0x1002261d
push dword [ebp - 0x18]
call esi
cmp dword [ebp - 0x20], edi
je 0x10022627
push dword [ebp - 0x20]
call esi
push dword [ebp - 0x24]
call esi
pop esi
pop edi
mov eax, ebx
pop ebx
leave
ret 0x14
Function at 0x10022b13
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0x208
call fcn.100012ea
xor ebx, ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebx
cmp eax, ebx
jne 0x10022b3f
push 8
pop eax
jmp 0x10022c1f
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push eax
push ebx
push dword [ebp + 8]
mov edi, 0x104
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea esi, [edi - 1]
jmp 0x10022bab
cmp eax, ebx
jne 0x10022b89
push 0x1002d6f0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
push 0x1002d6f0
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
je 0x10022bb1
inc dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
mov dword [esp + 0x30], edi
push dword [esp + 0x28]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x10022b65
jmp 0x10022bbc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10022816
push edi
push dword [esp + 0x18]
mov dword [esp + 0x18], ebx
push ebx
jmp 0x10022c07
lea eax, [esp + 0x1c]
push eax
push 0x20019
push ebx
push dword [esp + 0x20]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10022bf0
push dword [ebp + 0xc]
push dword [esp + 0x20]
call fcn.10022b13
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0x10]
push edi
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x10022bc8
push dword [esp + 0x14]
call fcn.100012ff
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10023700
Capabilities:
Decompress data using aplib

Disassembly:
sub esp, 0x14
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0xc]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x24]
mov al, byte [esi]
push edi
xor ebx, ebx
mov byte [ecx], al
add ecx, 1
xor edi, edi
add esi, 1
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], esi
lea ecx, [ecx]
mov eax, ebx
sub ebx, 1
test eax, eax
jne 0x10023746
movzx edx, byte [esi]
add esi, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + 7]
mov eax, edx
shr eax, 7
and eax, 1
add edx, edx
test eax, eax
je 0x10023903
mov eax, ebx
sub ebx, 1
test eax, eax
mov dword [esp + 0x20], ebx
jne 0x10023778
movzx edx, byte [esi]
add esi, 1
mov ebx, 7
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], ebx
mov eax, edx
shr eax, 7
and eax, 1
add edx, edx
test eax, eax
mov dword [esp + 0x1c], edx
je 0x10023848
mov eax, ebx
sub ebx, 1
test eax, eax
jne 0x100237a4
movzx edx, byte [esi]
add esi, 1
mov dword [esp + 0x14], esi
lea ebx, [eax + 7]
mov eax, edx
shr eax, 7
and eax, 1
add edx, edx
test eax, eax
je 0x100237f6
xor edi, edi
lea ebp, [edi + 4]
mov eax, ebx
sub ebx, 1
test eax, eax
jne 0x100237c9
movzx edx, byte [esi]
add esi, 1
lea ebx, [eax + 7]
mov eax, edx
shr eax, 7
and eax, 1
add edx, edx
sub ebp, 1
lea edi, [eax + edi*2]
jne 0x100237b7
test edi, edi
mov dword [esp + 0x14], esi
je 0x100237ee
mov eax, ecx
sub eax, edi
mov al, byte [eax]
jmp 0x1002390c
mov byte [ecx], 0
jmp 0x1002390e
movzx ebp, byte [esi]
mov edi, ebp
and edi, 1
add esi, 1
add edi, 2
shr ebp, 1
mov dword [esp + 0x14], esi
je 0x10023832
test edi, edi
je 0x1002383a
mov eax, ecx
sub eax, ebp
mov al, byte [eax]
mov byte [ecx], al
add ecx, 1
sub edi, 1
jne 0x10023810
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], ebp
mov edi, 1
jmp 0x10023917
mov dword [esp + 0x10], 1
mov dword [esp + 0x28], ebp
mov edi, 1
jmp 0x10023917
lea ecx, [esp + 0x14]
call fcn.10023680
test edi, edi
jne 0x1002388e
cmp eax, 2
jne 0x10023889
lea ecx, [esp + 0x14]
call fcn.10023680
test eax, eax
mov ecx, dword [esp + 0x18]
je 0x100238f0
nop
mov edx, ecx
sub edx, dword [esp + 0x28]
add ecx, 1
sub eax, 1
mov dl, byte [edx]
mov byte [ecx - 1], dl
jne 0x10023870
mov dword [esp + 0x18], ecx
jmp 0x100238f0
sub eax, 3
jmp 0x10023891
sub eax, 2
mov ecx, dword [esp + 0x14]
movzx edx, byte [ecx]
add ecx, 1
shl eax, 8
add eax, edx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.10023680
cmp esi, 0x7d00
jb 0x100238ba
add eax, 1
cmp esi, 0x500
jb 0x100238c5
add eax, 1
cmp esi, 0x80
jae 0x100238d0
add eax, 2
test eax, eax
mov ecx, dword [esp + 0x18]
je 0x100238ec
mov edx, ecx
sub edx, esi
mov dl, byte [edx]
mov byte [ecx], dl
add ecx, 1
sub eax, 1
jne 0x100238d8
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], esi
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
mov edi, 1
jmp 0x10023917
mov al, byte [esi]
add esi, 1
mov dword [esp + 0x14], esi
mov byte [ecx], al
add ecx, 1
xor edi, edi
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x10], 0
je 0x10023730
pop edi
pop esi
mov eax, ecx
sub eax, dword [esp + 0x24]
pop ebp
pop ebx
add esp, 0x14
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d7a
nop
nop
sub eax, 0x403d20
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x407eab
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417400]
jne 0x407eb5
repz ret
jmp fcn.0040dcc7

Function at 0x40accc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417400]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004062c0
and dword [ebp - 0x14], 0
cmp dword [0x448e30], 0
mov dword [ebp - 0x18], eax
jne 0x40ad7f
push 0x402228
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40ae27
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40221c
push ebx
call edi
test eax, eax
je 0x40ae27
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x40220c
push ebx
mov dword [0x448e30], eax
call edi
push eax
call esi
push 0x4021f8
push ebx
mov dword [0x448e34], eax
call edi
push eax
call esi
push 0x4021dc
push ebx
mov dword [0x448e38], eax
call edi
push eax
call esi
mov dword [0x448e40], eax
test eax, eax
je 0x40ad7f
push 0x4021c4
push ebx
call edi
push eax
call esi
mov dword [0x448e3c], eax
mov eax, dword [0x448e3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40add8
cmp dword [0x448e40], ecx
je 0x40add8
push eax
call esi
push dword [0x448e40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40add8
test ebx, ebx
je 0x40add8
call edi
test eax, eax
je 0x40adcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40adcf
test byte [ebp - 8], 1
jne 0x40add8
or dword [ebp + 0x10], 0x200000
jmp 0x40ae0b
mov eax, dword [0x448e34]
cmp eax, dword [ebp - 0x18]
je 0x40ae0b
push eax
call esi
test eax, eax
je 0x40ae0b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40ae0b
mov eax, dword [0x448e38]
cmp eax, dword [ebp - 0x18]
je 0x40ae0b
push eax
call esi
test eax, eax
je 0x40ae0b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x448e30]
call esi
test eax, eax
je 0x40ae27
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40ae29
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407eab
leave
ret
Function at 0x4147e0
Capabilities:
Access the windows event log
Connect pipe
Delete directory
Delete file
Get common file path
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
mov eax, 0x1414
call fcn.0040eba0
cmp dword [0x7f891c], 0x37
jne 0x4148b4
push 0x40347c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoA]
push 0
lea eax, [esp + 0xc18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
lea ecx, [esp + 8]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [esp + 0x818]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x40348c
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push 0
lea edx, [esp + 0x418]
push edx
push 0x4034a0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
mov eax, dword [0x7f8d30]
mov edx, dword [0x7f8400]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1414
ret
Function at 0x414f00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [0x7f891c]
sub esp, 0x484
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatA]
mov ebp, 0x2443831
cmp eax, 0x47
jne 0x414f86
xor eax, eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x78]
push ecx
push 0x403790
mov dword [esp + 0x6c], 0
call esi
xor eax, eax
push eax
mov dword [esp + 0x56], eax
mov dword [esp + 0x5a], eax
mov dword [esp + 0x5e], eax
mov word [esp + 0x62], ax
lea eax, [esp + 0x94]
push eax
push 0x4037e4
xor edx, edx
lea ecx, [esp + 0x5c]
push ecx
push edx
push edx
mov word [esp + 0x68], dx
call edi
dec ebp
mov eax, dword [0x4484f8]
mov dword [0x7f891c], eax
jne 0x414f25
mov dword [esp + 0x20], 0x764d11c7
mov dword [esp + 0x4c], 0x26b44f20
mov dword [esp + 0x24], 0x1f33c7de
mov dword [esp + 0x10], 0x2e56cff9
mov dword [esp + 0x28], 0x6cde8df8
mov dword [esp + 0x14], 0x796abd53
mov dword [esp + 0x34], 0x3ce56ad4
mov dword [esp + 0x1c], 0x581868fc
mov dword [esp + 0x18], 0xc596c70
mov dword [esp + 0x3c], 0x6d5e9115
mov dword [esp + 0x30], 0x22f372d9
mov dword [esp + 0x40], 0x2ad541d0
mov dword [esp + 0x38], 0x7a5f7c43
mov dword [esp + 0x2c], 0x28d520e
mov dword [esp + 0x48], 0x73f3bc07
mov dword [esp + 0x44], 0x51f578e1
add dword [esp + 0x4c], 0x73e38130
mov eax, 0x3a9c3a87
mul dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add dword [esp + 0x24], 0x6b053f58
add dword [esp + 0x20], 0x2818faf9
add dword [esp + 0x4c], 0x3ab2fc3
sub dword [esp + 0x20], 0x30ad2d47
sub dword [esp + 0x20], 0x4442fc9b
sub dword [esp + 0x28], 0x2285667
add dword [esp + 0x4c], 0x262c99c6
sub dword [esp + 0x14], 0x4dc74448
mov eax, 0x53cf4e1b
mul dword [esp + 0x24]
mov eax, dword [esp + 0x24]
add dword [esp + 0x24], 0x1b067f32
mov eax, 0x67698c83
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub dword [esp + 0x28], 0x7674af1e
mov eax, 0x173863dd
mul dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, 0x3d786fdd
mul dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, 0x38471b91
mul dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, 0x45f07edf
mul dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
add dword [esp + 0x18], 0x6fea1ecd
sub dword [esp + 0x34], 0x32f1f16e
add dword [esp + 0x34], 0x6e380599
sub dword [esp + 0x18], 0x3ca08c1e
add dword [esp + 0x30], 0x154e8e1
add dword [esp + 0x14], 0x53bb032d
sub dword [esp + 0x14], 0x11166d6c
sub dword [esp + 0x18], 0x2a6a1594
add dword [esp + 0x14], 0x4fb1fe05
mov eax, 0x4b3ce8e6
mul dword [esp + 0x34]
mov eax, dword [esp + 0x34]
add dword [esp + 0x3c], 0x1bc84bb6
sub dword [esp + 0x30], 0x687c0c2b
add dword [esp + 0x48], 0x36e578c2
sub dword [esp + 0x10], 0x7b5e58ec
mov eax, 0x38d0a1fb
mul dword [esp + 0x48]
mov eax, dword [esp + 0x48]
sub dword [esp + 0x40], 0x15793cf4
mov edx, dword [0x4484ec]
mov dword [0x7f8d30], edx
call fcn.00414b40
pop edi
xor eax, eax
pop esi
pop ebp
mov esp, ebp
pop ebp
ret 0x10
Function at 0x455949
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
push ds
add dh, cl
inc edi
sal edx, 1
ret
ror eax, cl
enter 0x5d06, 0xffffffffffffffa0
mov esi, 0xc9c811ee
jnp 0x4558d2
and bh, byte [ecx + 0xe10f08d]
push cs
sar dword [eax - 0x4e], 1
pop esi
mov esp, 0x51bccbb7
pop ebp
sub ch, 0x7e
test byte [edi], dh
mov bh, 0xcb
mov esp, 0xed805d51
jle 0x45585f
aaa
jle 0x4558b8
add al, 0x36
std
or al, 0x94
daa
popal
test byte es:[ecx], ah
mov dl, byte [edi + 0x3274d195]
mov byte [0xd3883ed0], al
xor al, 0x97
add dl, al
retf 0xf2ff
jge 0x4558d2
scasd eax, dword es:[edi]
lds edx, [eax - 0x3d8f5ed8]
mov eax, dword [0x4ee642fc]
adc eax, 0x223d8b53
pop eax
sahf
invalid
mov dl, 0x1a
dec ebp
pushal
jno 0x455990
mov word [esi + 0xd], ds
cmp al, 0xe3
sbb al, 0x4c
dec edx
jae 0x4558f8
test al, 0xe1
sal byte [ecx - 0x34], cl
xor ebx, dword [eax]
jb 0x4558fb
mov byte [eax - 0x3f], bh
pop ecx
xchg ecx, eax
lea esp, [eax - 0x49d4a6f1]
mov al, 0x67
je 0x4559c2
or eax, 0x6b82756d
scasd eax, dword es:[edi]
and edi, dword [ecx + 0x67]
je 0x4559dd
cmp eax, 0x2aa8465b
cdq
cmp al, 0x19
dec eax
stosb byte es:[edi], al
fisub word [ecx + 0xf64d257]
and dword [ebx], esp
test al, 0xe0
mov ah, 0xc1
push edx
jno 0x455946
rcl dword [edx + 0x71], 0xb2
cmpsb byte [esi], byte es:[edi]
mov cl, 8
mov byte [0xec61e617], al
mov eax, gs
push cs
sbb eax, 0x41615a9f
salc
dec esp
and ebx, dword [esi - 0x330d8812]
dec edx
adc eax, eax
sbb dh, byte [esi - 0x5e674cc3]
out 0x51, al
cmp ebp, eax
cld
mov ah, 0xa4
pop ebx
push esi
mov dh, 0x99
sahf
wait
pushal
pop es
adc eax, 0x8b770379
mov al, 0xe1
outsd dx, dword [esi]
inc esp
sub edi, ecx
loop 0x455a19
pop ecx
or eax, 0x4eceadae
sub eax, 0xa192726e
enter 0xfffffffffffff9fd, 0xfffffffffffffff5
imul ebx, edx, 0x590c9f56
lahf
sahf
wait
push cs
mov ah, 0xaf
mov esp, 0x27df2c0
push ss
insd dword es:[edi], dx
sar ch, 3
sub eax, eax
xchg ebp, eax
sbb byte [ebx - 0x50], 0xee
mov eax, dword [0xcdb19e7b]
jnp 0x45599f
mov cl, 0xcd
add eax, 0x34bbea22
pop eax
xor al, 0x58
cmc
mov dl, 0x4c
fld qword [ebx]
insd dword es:[edi], dx
arpl word [ebp - 0x3b], si
arpl sp, di
and byte [ebx + esi - 0x2a030d24], bl
fisub dword [edx + 0x2d]
mov eax, 0xa72823b6
cld
aad 0xda
bound ebp, qword [0x2823b6b8]
cmpsd dword [esi], dword es:[edi]
jae 0x455a07
das
call 0xf4b28490
push ebx
mov eax, dword [0x450b7783]
push es
outsb dx, byte [esi]
scasd eax, dword es:[edi]
mov byte [0xdd1eafac], al
xchg byte [ebx + 0x4e], bl
cmp al, 0x51
xchg byte [eax], bh
and dword [ebp - 0x2bc492ca], 0x7bd7040c
jb 0x4559ff
mov dh, 0xff
add ebp, edx
jbe 0x455a33
push ds
jp 0x455a80
mov edx, 0xe1357432
cld
aaa
ja 0x455a5e
dec esp
dec ebp
int3
and byte [ebp + ebp*2 - 0x5a035e5b], cl
cmp dword [ecx + 0x2c131c9], edx
adc bl, byte [ebx - 0x1c]
ret
Function at 0x468d96
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov edx, 0xee20fbb
cmp byte [edi + 0x60], 0xb8
pushal
inc edi
mov cl, 0xbf
fidiv word [edx]
xchg esi, eax
outsd dx, dword [esi]
jbe 0x468d73
inc eax
mov dword [0xb093cd69], eax
in eax, dx
or dword [edx], esp
dec ebp
out 0xe0, al
fild word [edx]
pushal
outsd dx, dword [esi]
mov cl, 0x5e
xchg ebx, eax
imul edx, eax, 0xaf9a5d92
jle 0x468d63
and al, 0xd7

Function at 0x605cf6
Capabilities:
Encode data using xor

Disassembly:
pop ecx
movsd dword es:[edi], dword [esi]
int 0xb2
invalid
ja 0x605cf4
cmp al, 0x77
sub dword [ecx], edi
mov byte [edi + 0x73], 0x3d
cmp dword [ebx + 0x23944951], 0xb55a746
or eax, dword [esi + 0x6a]
int 0x35
push esp
pop ds
ja 0x605d06
sub dword [edi], ecx
sbb al, 0xe0
jg 0x605d11
cmpsd dword [esi], dword es:[edi]
leave
sbb bh, dh
and byte [edi + ebp*2 - 0x1e], 0x91
outsd dx, dword [esi]
loop 0x605c8a
insb byte es:[edi], dx
pop es
adc al, 0xd4
inc esp
xchg esp, eax
aad 0xe9
jns 0x605c88
mov dl, 0x1a
jne 0x605d2d
push cs
push cs
lodsb al, byte [esi]
loop 0x605d76
jp 0x605d42
jecxz 0x605d87
lahf
salc
jo 0x605ccc
jae 0x605cf2
add dword [eax + 0x757a5da], 0x800b3da7
push ecx
sbb eax, 0xf8e63135
xlatb
fnstenv [ebx + ecx + 0x3b]
mov bl, 0x7a
adc ecx, edi
rol esp, 0xb1
aad 5
or dword [edx + 0x72], ebp
iretd
insb byte es:[edi], dx
int 0x12
sub bh, 0x59
xchg edi, eax
xchg edx, eax
js 0x605d2a
adc dword [ecx - 0x243ed327], ebp
xor ecx, dword [ecx]
dec ebx
xchg ebx, eax
or dword [ebx - 0x6d], ecx
loop 0x605de0
sbb dword [eax + 0x29], 0xffffffe1
or byte [edx - 0x34], ah
stosd dword es:[edi], eax
xor dword [ecx], eax
clc
cmp ecx, ecx
add esp, edi
stosb byte es:[edi], al
mov al, byte [0xc40f44b1]
popal
and dl, byte [edi + 0x23]
xor dword [edi + eax*8], edi
sub al, dl
cmp dword [ebx - 0xc], 0xffffff8b
inc esi
xchg byte [esi - 0x3146bfbf], bl
jp 0x605e36
jnp 0x605da1
mov eax, dword [esi - 0x7a]
sahf
inc ecx
inc eax
mov ecx, 0xcb7f7ace
cwde
jl 0x605e06
retf
xchg dword [eax + 2], ebp
add eax, dword [edx - 0x749dad56]
inc ebp
jnp 0x605dab
sub byte [edx + 0x458b6252], 0x7b
in al, 0xbf
cdq
or al, 0xaf
add ah, bh
sbb eax, 0xafcd402f
mov edi, 0x2af0c99
out 0x1d, eax
das
inc eax
int 0xaf
int1
add ecx, 0xf2a91a7e
dec ebp
or ecx, dword [ebp + 0xf]
mov eax, dword [eax]
mov ecx, 0xfa3e11e5
in eax, 0x11
cli
jg 0x605dec
sahf
jnp 0x605dbf
invalid
jae 0x605db3
mov ebp, 0x667c07ee
mov cl, 0xdb
js 0x605dd2
push ecx
out dx, eax
pop ebp
daa
call 0x5b409623
push es
dec dword [esi + 0x76]
wait
inc eax
xchg esp, eax
sal byte [eax], 1
cmp eax, dword [esi + 0x34cb73fa]
das
cli
jae 0x605dda
retf
xor al, 0x2f
adc byte [ebp + 0x48], bl
out dx, al
jae 0x605e0e
adc al, 0x73
ljmp 0x6fd1
pop ss
cdq
xor al, 0x27
mov dword [0x891de2a2], eax
push eax
mov bh, byte cs:[0xb86ab50e]
add al, 0x31
insd dword es:[edi], dx
fmul qword [ecx + ebx*4 + 0xd]
jl 0x605e0c
cdq
or eax, 0xbfa0bc7c
cmp cl, byte [ebx]
add esi, dword [edi]
mov al, byte [0x30b3abf]
aaa
jp 0x605e4c
or ch, byte [ebp + 0x755bfd76]
ror dword [edx - 0x2d], 0x81
test al, 0xa
mul bh
sub al, 0xb1
insb byte es:[edi], dx
aam 0x27
invalid