joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x10]
push ebx
mov ebx, eax
sub esp, 0x40
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x14], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x401055
mov edx, dword [ebp - 0x10]
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], ecx
call ecx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x24], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x18], eax
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x28], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov edx, dword [ebp - 0x20]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x1c], eax
je 0x40104b
mov ecx, dword [ebp - 0x2c]
call ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x24]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov esi, dword [ebp - 0x14]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov edx, dword [ebp - 0x18]
sub esp, 4
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x1c]
mov dword [esp + 8], edx
mov dword [esp + 0x10], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [ebp - 0x28]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
jmp 0x401048
Function at 0x401820
Capabilities:
Enumerate services
Get process heap flags
Stop service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x38]
push ebx
sub esp, 0x54
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x34]
mov ebx, dword [sym.imp.advapi32.dll_EnumDependentServicesW]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], edx
call ebx
sub esp, 0x18
test eax, eax
jne 0x4018c0
mov edi, eax
xor ecx, ecx
mov eax, dword fs:[0x18]
cmp dword [eax + 0x34], 0xea
je 0x4018f0
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, edi
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
lea eax, [ebp - 0x30]
mov dword [ebp - 0x40], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [esp + 4], 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_ControlService]
mov ecx, dword [ebp - 0x40]
sub esp, 0xc
mov edi, eax
jmp 0x401888
mov ecx, dword [ebp - 0x38]
mov dword [esp + 4], 0
mov dword [esp + 8], ecx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ecx, eax
lea eax, [ebp - 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
mov dword [esp + 0x10], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call ebx
mov ecx, dword [ebp - 0x44]
sub esp, 0x18
test eax, eax
je 0x401888
mov eax, dword [ebp - 0x34]
test eax, eax
je 0x401888
mov dword [ebp - 0x48], ecx
lea ebx, [ecx + 4]
xor esi, esi
mov eax, dword [ebx]
mov dword [esp], 0x68
mov dword [esp + 4], eax
call dbg.output_string
mov dword [esp + 8], 0xf003f
mov eax, dword [ebx - 4]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_OpenServiceW]
sub esp, 0xc
test eax, eax
je 0x4019af
mov edx, eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
call dbg.StopService
mov ecx, dword [ebp - 0x44]
mov edi, eax
mov dword [esp], ecx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
sub esp, 4
test edi, edi
je 0x4019d0
add esi, 1
add ebx, 0x24
cmp dword [ebp - 0x34], esi
ja 0x40195d
mov ecx, dword [ebp - 0x48]
test edi, edi
jne 0x4018c2
jmp 0x401888
mov eax, dword [ebx]
mov dword [esp], 0x69
mov dword [esp + 4], eax
call dbg.output_string
jmp 0x4019b3
Function at 0x4019f0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x2018
call fcn.00402e88
sub esp, eax
mov esi, edx
mov eax, dword [esp + eax]
mov dword [esp + 8], 0xf003f
mov dword [ebp - 0x2018], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.advapi32.dll_OpenSCManagerW]
sub esp, 0xc
test eax, eax
je 0x401bd3
mov ebx, eax
mov dword [esp + 8], 0xf003f
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_OpenServiceW]
sub esp, 0xc
mov dword [ebp - 0x2014], eax
test eax, eax
je 0x401bf0
lea eax, [ebp - 0x2010]
lea edi, [ebp - 0x200c]
mov dword [esp + 4], esi
mov dword [ebp - 0x2010], 0x1000
mov dword [esp + 0xc], eax
mov dword [esp + 8], edi
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_GetServiceDisplayNameW]
sub esp, 0x10
cmp word [ebp - 0x200c], 0
jne 0x401ab0
xor eax, eax
lea esi, [esi]
nop
movzx edx, word [esi + eax]
mov word [edi + eax], dx
add eax, 2
test dx, dx
jne 0x401aa0
cmp dword [ebp - 0x2018], 2
mov dword [esp + 4], edi
jne 0x401b30
mov dword [esp], 0x6f
call dbg.output_string
mov edx, dword [ebp - 0x2014]
mov eax, ebx
call dbg.StopService
test eax, eax
mov dword [ebp - 0x2018], eax
je 0x401b83
mov dword [esp + 4], edi
mov dword [esp], 0x70
call dbg.output_string
mov edx, dword [ebp - 0x2018]
mov eax, dword [ebp - 0x2014]
mov dword [ebp - 0x2018], edx
mov esi, dword [sym.imp.advapi32.dll_CloseServiceHandle]
mov dword [esp], eax
call esi
sub esp, 4
mov dword [esp], ebx
call esi
mov edx, dword [ebp - 0x2018]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6c
call dbg.output_string
mov eax, dword [ebp - 0x2014]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_StartServiceW]
sub esp, 0xc
test eax, eax
mov dword [ebp - 0x2018], eax
je 0x401ba0
mov dword [esp + 4], edi
mov dword [esp], 0x6d
call dbg.output_string
mov edx, dword [ebp - 0x2018]
jmp 0x401afa
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
call dbg.output_error_string
test eax, eax
je 0x401c14
xor edx, edx
jmp 0x401afa
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x34]
call dbg.output_error_string
test eax, eax
jne 0x401b95
mov dword [esp + 4], edi
mov dword [esp], 0x6e
mov dword [ebp - 0x2018], eax
call dbg.output_string
mov edx, dword [ebp - 0x2018]
jmp 0x401afa
mov dword [esp], 0x6a
call dbg.output_string
lea esp, [ebp - 0xc]
xor edx, edx
pop ebx
mov eax, edx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x6b
call dbg.output_string
mov dword [esp], ebx
call dword [sym.imp.advapi32.dll_CloseServiceHandle]
xor edx, edx
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
mov dword [esp], 0x71
mov dword [ebp - 0x2018], eax
call dbg.output_string
mov edx, dword [ebp - 0x2018]
jmp 0x401afa
Function at 0x402540
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_strlen]
mov esi, eax
xor eax, eax
test esi, esi
je 0x402598
cmp byte [ebx + esi - 1], 0xa
je 0x40256c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x406084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x402bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [esp], eax
call dbg.__wine_dbg_get_channel_flags
movzx eax, al
bt eax, esi
jae 0x402d74
mov edx, dword fs:[0x18]
xor eax, eax
mov edi, dword [0x406084]
cmp dword [edx + 0x24], edi
je 0x402c97
test byte [0x403018], 8
jne 0x402d20
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x403028], 8
jne 0x402ce3
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x402c39
cmp esi, 3
jbe 0x402ca2
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov ecx, ebx
mov edi, eax
mov esi, dword [ecx]
add ecx, 4
lea edx, [esi - 0x1010101]
not esi
and edx, esi
and edx, 0x80808080
je 0x402c4a
mov esi, edx
mov dword [esp + 0xc], edi
shr esi, 0x10
test edx, 0x8080
mov dword [esp + 4], 1
cmove edx, esi
lea esi, [ecx + 2]
mov dword [esp], ebx
cmove ecx, esi
mov eax, edx
add al, dl
sbb ecx, 3
sub ecx, ebx
mov dword [esp + 8], ecx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x4051ac]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.2
jmp 0x402c39
mov dword [esp], 0x403028
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x402c10
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x402c10
mov dword [esp], 0x403018
call dbg.__wine_dbg_get_channel_flags
test al, 8
je 0x402bfb
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x402c03
mov eax, 0xffffffff
jmp 0x402c97

Function at 0x402de0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov ebx, dword [eax]
call sym.___p___wargv
mov esi, dword [eax]
call sym.__get_initial_wide_environment
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov edx, dword [eax + 8]
mov eax, dword [edx + 0x3c]
cmp word [edx + eax + 0x5c], 2
sete dl
movzx edx, dl
add edx, 1
mov dword [esp], edx
call sym.__set_app_type
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dbg.wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x6c42496a
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x13bb2f48
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x1001b0f3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001b132
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001b132
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001b132
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001b132
cmp dword [ecx + 0x74], 0xe
jbe 0x1001b132
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001ddaf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001de4c
push ebx
push esi
call fcn.1001dd78
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001dd0c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001ddf9
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001de4b
push edi
push eax
call fcn.1001ed6a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001de19
call fcn.1001c854
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001de4a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001dd0c
add esp, 0x20
test eax, eax
jne 0x1001de38
push edi
call fcn.1001c854
jmp 0x1001de40
push ebx
call fcn.1001c854
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001e0b9
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cc8
push 0x10025cc0
push str.FlsAlloc
push 0x1f
call fcn.1001dfd5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e0ed
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
jmp 0x1001e0f3
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001e137
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025cd8
push 0x10025cd0
push str.FlsGetValue
push 0x21
call fcn.1001dfd5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e16e
push dword [ebp + 8]
mov ecx, esi
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001e176
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025ce0
push 0x10025cd8
push str.FlsSetValue
push 0x22
call fcn.1001dfd5
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001e1b0
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10024150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10023830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1002385d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1002385d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1575f0e
Capabilities:
Check for software breakpoints

Disassembly:
xor ax, ax
lea edx, [edx - 0x69e2627f]
xor cl, bl
mov dword [esp + eax*4 - 0x251c0000], eax
sub al, dl
not cl
ror edx, 0x9c
mul eax
ror cl, 1
or dword [esp + eax - 0x34723f01], edx
inc byte [esp + edx*8 - 0x2b08dce]
neg cl
shl edx, 0x51
not cl
inc eax
div byte [esp + eax*2 - 0x68e47e02]
sub eax, 0xac9e6b88
xor bl, cl
sub ax, 0xcb3b
lea ecx, [esp + ecx + 4]
jnp 0x27a802b

Function at 0x1575f5d
Capabilities:
Check for software breakpoints

Disassembly:
lea edx, [eax*4 - 0xe56c8f3]
sub dx, 0x3ca3
neg ecx
neg dl
dec eax
not edx
dec ecx
sub edx, edx
xor ecx, 0x519611bf
sub ecx, 0xa793bab9
inc al
neg ecx
xor ebx, ecx
call fcn.01881062
pop eax
pop eax
pop ecx
pop eax
jmp fcn.016fbfad
shr ecx, 8
push 0xa218d12d
xor ecx, ebx
inc eax
push 0xd922f83c
dec word [esp + 6]
jge 0x17d986f
xor ecx, 0x760c62b2
shr byte [esp + 2], 6
je 0x18cf632
mov ecx, 0x823aaf24
movzx edx, cl
shr edx, cl
not eax
dec ecx
bt cx, dx
add edx, ecx
mov dword [esi], eax
rol dl, 0xc3
lea eax, [edx + edx + 0x4826fc99]
call fcn.016cf87e
xor byte [esp + 0xe], cl
xor edx, ebx
mov dword [esp], eax
mov dword [esp + 4], ecx
shr al, 0xc7
ror edx, 3
sub dword [esp + 7], ecx
neg edx
xor word [esp + 6], cx
call fcn.0183f2e5
jmp 0x180b69b
push 0xa438f11e
mov dword [esp + 4], ebx
lea esp, [esp + 4]
mov ebx, 0x680e2016
rol bl, 0xa6
bts ebx, ebx
movzx ebx, byte [ebx + ecx - 0x680e20a5]
call fcn.0183201b
mov dword [ebp + edx - 0x1d7a4380], ecx
and al, 8
mov ecx, dword [edx + edi - 0x1d7a4380]
shl dx, 0x4c
lea edi, [edi + edx*4 - 0x75e7fffc]
neg edx
je 0x2776a96
xor ecx, ebx
bswap edx
call fcn.0171df2c
not eax
rol cx, 0x4c
bswap eax
xadd dword [esp + edx - 0x5d651405], edx
push edx
not cx
not eax
xor eax, 0x5378a92
sar cx, 0x69
shr dl, 0x87
adc dl, 0x15
xor ebx, eax
sub ecx, dword [esp]
add esi, eax
ror word [esp], 0xeb
not dword [esp + 4]
pop edx
pop ecx
jmp esi
mov eax, ebp
jp 0x258c247
mov ecx, 0xfc83a7a5
sub edi, 4
mov eax, dword [edi]
xor eax, ebx
btc cx, cx
bts ecx, 0x2c
xor eax, 0xf22f1bb2
mov edx, 0x66227fb5
sar ecx, 0x84
adc ecx, edx
sbb eax, 0x1d2de40c
bswap eax
inc eax
xor ebx, eax
inc ecx
ror ecx, 0x41
sal cl, 0xa6
add ebp, eax
movzx ax, byte [esi + ecx*2 - 0x65eabb80]
rol cl, 0x67
call fcn.015823e7
and ebx, 0xff
call fcn.0251196d
jmp esi
dec edx
lea esp, [esp + 0x18]
jne 0x25c4a9b
pop ebx
mov eax, 0x2636fd30
movzx edx, ax
div eax
not ecx
xor al, 0x21
cwde
jno 0x17946bd
mov edx, dword [esi + 4]
ror dword [esp], 0xdb
push 0x1b24e12e
sal dword [esp + 4], 0xc1
adc esi, 4
xor eax, eax
test edx, edx
push 0x7314aa5
jmp 0x28eb05c
mov dword [ebp - 4], eax
call fcn.024f7563
push 0x4e8f1d98
rol byte [esp], 0x25
add eax, edx
dec word [esp + 1]
js 0x252744e
sub edi, 4
mov ecx, dword [edi]
mov eax, 0x2819e231
btr ax, 0x2e
xor ecx, ebx
inc ecx
jmp 0x1572b6e
mov ebx, 0xc51727b7
movzx ebx, byte [eax]
xor ebx, ecx
jmp 0x1664d03
cmovae bx, ax
mov ebx, dword [esp + ebx - 0x48077d39]
pop edx
pop eax
jb fcn.016576d7
push 0xbbeb129
lea esp, [esp + 0x10]
je 0x15b0615
push 0x1b381f33
jmp 0x1709297
Function at 0x15902a4
Capabilities:
Encode data using xor

Disassembly:
push edx
mov dword [esp + eax - 0x55631001], esi
ret 4
not edx
sar al, 0x81
bswap ecx
cwd
call fcn.016aebf3
adc dl, byte [ecx + 0x18]
inc ecx
js 0x159025c
popal
mov dl, 0xd9
fdivp st(3)
or al, byte [ecx - 0x50]
test ah, ah
mov al, byte [0x641fc0aa]
cli
ja 0x1590309
sub ebx, dword [esi - 0x32412aca]
dec edi
push es
shr dword [ebp + 0x40b54f8a], 0x2d
cmp ch, byte [ecx]
mov dword [edi + 0x1ef2b3a8], ebx
lahf
test al, 0xb3
push ds
xor al, 0xc6
mov eax, 0xfb670dd5
xchg edi, edx
pop edi
xchg esp, eax
pop ds
add ebx, dword [esi + 0x214be109]
cmc
jg 0x15902dd
mov dword [ebx], esi
push edi
inc ecx
ljmp 0xc08
adc dword [ecx], edx
imul byte [esi + 0x3c]
push ss
outsb dx, byte [esi]
cmp al, 0x16
fmulp st(3)
dec ebx
test eax, 0x4629bda9
mov esi, 0x283c197b
mov esi, 0x62ca17dd
aam 0xa9
je 0x15902d1
js 0x1590305
jno 0x1590389
push es
or al, byte [eax + 0x4e]
not eax
or ebx, dword [ebx]
shr byte [esi + 0x29], 1
add dword [edx - 0x77], 0xd01c6e49
dec dx
mov ss, word [eax]
pop ss
adc byte [edi], dl
fstp xword [ebp + 0x5620b73]
and esi, dword [ebx + 0x354a261]
jg 0x15903c5
add edi, dword [edi + 0x7a]
cmp byte [si + 0x4296], bl
iretd
imul eax, dword [esi - 0x51], 0xe86b9238
inc eax
jb 0x1590348
lds ecx, [esi + 0x2e2ab78a]
sub eax, 0x949ca9c7
mov bh, 0x2a
sub eax, 0x949ca9c7
sub byte [ebx], ah
lodsb al, byte [esi]
jae 0x159033b
cdq
movsb byte es:[edi], byte [esi]
mov eax, 0x9f6f868f
invalid
add esi, dword [edi + edx + 0x12]
lea esp, [ecx + 0x210e9586]
or edx, esp
cdq
jae 0x159041f
and ebx, esp
popfd
sti
clc
sub eax, 0xfc8f11a8
sbb bh, byte [ebx + 0x6c]
lodsb al, byte [esi]
add dword [ecx], edi
mov gs, word [esp + ecx*4 - 0x773c4b32]
loopne 0x15903de
int1
push ebp
aaa
xchg edx, eax
int 0xec
sbb byte [edx + 0x5f], 0xe9
fnsave dword [ebp + 0x650d355]
xor eax, 0x615edcf0
jbe 0x15903ec
sub dh, bh
psrlq mm7, mm4
enter 0x76d8, 0x16
jp 0x1590396
lea edx, [esi - 0x36]
dec eax
sbb dh, byte [edx - 3]
or dword [edi + 5], edi
xor bh, byte [eax - 0x6a8ba471]
jp 0x1590486
dec sp
dec esp
and eax, 0xbd53b14b
push edx
inc eax
imul dword [eax + 0x4ac0cd3c]
push ss
retf 0x9022
inc ebp
jbe 0x15904e3
mov al, byte [0xdb14dbd8]
wait
aam 0xdb
nop
jle 0x159048d
fistp dword [ebx + 0x7e90dbd4]
stc
invalid
stosb byte es:[edi], al
jge 0x1590508
insd dword es:[edi], dx
xchg byte [edx + 0x3c], bl
sub ch, cl
sbb ch, bh
stosb byte es:[edi], al
rcl byte [edi - 0x20]
inc esi
dec esp
out dx, eax
adc eax, 0x26ba6713
popal
jmp 0x6b8f9af4
outsd dx, dword [esi]
out 0x33, eax
cmp dword [ebx], ebx
imul edx, dword [ebp + 0x2ff1bf33], 0xffffffca
adc al, 0xf8
invalid