joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c77b0
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea edi, [ebp - 0x30]
mov ecx, 0xc
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x100e4364]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 4
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100c792c
mov dword [ebp - 0x28], 0x1c
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 8]
push ecx
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x100c7919
cmp dword [ebp - 0x28], 0x10
jb 0x100c78fd
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp esi, esp
call fcn.100ca423
cmp dword [ebp - 0x1c], eax
jne 0x100c78fd
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.100ca423
cmp dword [ebp - 0x20], eax
je 0x100c78fd
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100c7884
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0x80
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
shl edx, 2
mov esi, esp
push edx
push 0
mov eax, dword [0x100f6d74]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp esi, esp
call fcn.100ca423
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov edx, dword [ebp + 8]
cmp dword [edx], 0
jne 0x100c7882
jmp 0x100c7919
jmp 0x100c78dd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [eax + 8]
cmp edx, dword [ecx + 4]
jb 0x100c78dd
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
shl ecx, 1
shl ecx, 2
mov esi, esp
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [0x100f6d74]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
cmp esi, esp
call fcn.100ca423
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x100c78c7
jmp 0x100c7919
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
shl eax, 1
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [edx], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
add edx, 1
mov eax, dword [ebp + 8]
mov dword [eax + 8], edx
mov dword [ebp - 0x28], 0x1c
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 8]
push edx
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100c7803
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100ca423
push edx
mov ecx, ebp
push eax
lea edx, [0x100c7958]
call fcn.100ca3cf
pop eax
pop edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100c9941
add esp, 0x30
cmp ebp, esp
call fcn.100ca423
mov esp, ebp
pop ebp
ret
Function at 0x100c7970
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.100c77b0
add esp, 4
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x100c7a3b
mov dword [ebp - 4], 0
jmp 0x100c79cc
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
cmp ecx, dword [eax + 8]
jae 0x100c7a3b
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 4]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100ca423
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100c7a39
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100ca423
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100c75d0
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100ca423
jmp 0x100c79c3
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ca423
mov esp, ebp
pop ebp
ret

Function at 0x100c7a50
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x100c7afb
mov dword [ebp - 4], 0
jmp 0x100c7a83
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x100c7ade
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100ca423
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100c7adc
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100ca423
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100ca423
jmp 0x100c7a7a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x100f6d74]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100ca423
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ca423
mov esp, ebp
pop ebp
ret
Function at 0x100c7b10
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10110fd0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100c7b73
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100ca423
test eax, eax
jne 0x100c7b9e
mov eax, 0xa
jmp 0x100c7ca0
cmp dword [ebp + 0xc], 0
je 0x100c7bea
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x100c7be8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x100c7c26
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x100c7c11
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
jmp 0x100c7c26
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100ca423
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100ca423
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100ca423
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x100c7cc4]
call fcn.100ca3cf
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100ca423
mov esp, ebp
pop ebp
ret
Function at 0x100c8390
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x10110fcc]
mov dword [ebp - 4], eax
jmp 0x100c83b7
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x100c83d0
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x100c83ce
mov eax, dword [ebp - 4]
jmp 0x100c8454
jmp 0x100c83af
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100ca423
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100c8451
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x100c8413
mov edx, dword [ebp - 4]
mov eax, dword [0x10110fcc]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10110fcc], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100ca423
mov esp, ebp
pop ebp
ret

Function at 0x100c8940
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0xcccccccc
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x100c8990
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x100c8990
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x100c8990
xor eax, eax
jmp 0x100c89d1
mov dword [ebp - 4], 1
jmp 0x100c89a2
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x100c89cc
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x100c89ca
xor eax, eax
jmp 0x100c89d1
jmp 0x100c8999
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Get graphical window text
Log keystrokes via application hook

Disassembly:
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x400
push 0x41c8c0
push eax
mov dword [0x41d0c0], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0
push dword [esp + 0xc]
push 0x401bc0
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
mov dword [0x41c8bc], eax
nop dword [eax + eax]
push 0
push 0
push 0
push 0
call esi
test eax, eax
jne 0x401c50
push dword [0x41c8bc]
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
pop esi
ret 0x10

Function at 0x402f56
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4154e4
push str.FlsAlloc
push 0
call fcn.00402ed6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x402f88
push dword [ebp + 8]
mov ecx, esi
call fcn.00402613
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x402fca
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x415514
push str.FlsSetValue
push 3
call fcn.00402ed6
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x402ffe
mov ecx, esi
call fcn.00402613
call esi
jmp 0x403004
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x410b52
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
mov edx, dword [ebp + 0xc]
push ebx
sar ecx, 6
push esi
push edi
imul edi, eax, 0x30
mov eax, dword [ecx*4 + 0x41d850]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x410b93
cmp byte [edx], 0xa
jne 0x410b93
or byte [eax + edi + 0x28], 4
jmp 0x410b98
and byte [eax + edi + 0x28], 0xfb
lea eax, [edx + ecx]
mov ebx, edx
mov dword [ebp - 8], eax
mov esi, edx
cmp edx, eax
jae 0x410c89
mov al, byte [ebx]
cmp al, 0x1a
je 0x410c6a
cmp al, 0xd
je 0x410bc1
mov byte [esi], al
inc esi
inc ebx
jmp 0x410c5f
lea eax, [ebx + 1]
cmp eax, dword [ebp - 8]
jae 0x410be1
cmp byte [eax], 0xa
jne 0x410bd6
push 2
mov byte [esi], 0xa
pop eax
jmp 0x410bdc
xor eax, eax
mov byte [esi], 0xd
inc eax
add ebx, eax
inc esi
jmp 0x410c5f
push 0
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410c58
cmp dword [ebp - 0x14], 0
je 0x410c58
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x41d850]
test byte [eax + edi + 0x28], 0x48
je 0x410c2f
mov dl, byte [ebp - 1]
cmp dl, 0xa
jne 0x410c1f
mov byte [esi], dl
jmp 0x410c5b
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x41d850]
mov byte [eax + edi + 0x2a], dl
jmp 0x410c5b
cmp byte [ebp - 1], 0xa
jne 0x410c41
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x410c41
mov byte [esi], 0xa
jmp 0x410bde
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00411549
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x410c5c
mov byte [esi], 0xd
inc esi
mov edx, dword [ebp + 0xc]
cmp ebx, dword [ebp - 8]
jb 0x410baa
jmp 0x410c89
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x41d850]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x410c84
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x410c89
mov cl, byte [ebx]
mov byte [esi], cl
inc esi
sub esi, edx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410c94
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 8]
and eax, 0x3f
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
sar ecx, 6
imul edi, eax, 0x30
mov dword [ebp - 8], ecx
push 0xa
mov eax, dword [ecx*4 + 0x41d850]
pop ebx
mov edx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp + 0xc]
test esi, esi
je 0x410cd8
cmp word [edx], bx
jne 0x410cd8
or byte [edi + eax + 0x28], 4
jmp 0x410cdd
and byte [edi + eax + 0x28], 0xfb
lea eax, [edx + esi*2]
mov ebx, edx
mov dword [ebp - 0xc], eax
mov esi, edx
cmp edx, eax
jae 0x410e31
mov dword [ebp - 0x10], 0xd
movzx eax, word [ebx]
cmp eax, 0x1a
je 0x410e11
cmp ax, word [ebp - 0x10]
je 0x410d16
mov word [esi], ax
add esi, 2
add ebx, 2
jmp 0x410e06
lea eax, [ebx + 2]
cmp eax, dword [ebp - 0xc]
jae 0x410d3c
push 0xa
pop ecx
cmp word [eax], cx
jne 0x410d2c
push ecx
pop eax
push 4
jmp 0x410d31
push 0xd
pop eax
push 2
mov word [esi], ax
pop eax
add ebx, eax
jmp 0x410e00
push 0
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x410df7
cmp dword [ebp - 0x18], 0
je 0x410df7
mov ecx, dword [ebp - 8]
push 0xa
mov eax, dword [ecx*4 + 0x41d850]
test byte [edi + eax + 0x28], 0x48
pop eax
je 0x410dc3
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x410d87
mov word [esi], ax
jmp 0x410dbb
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ecx*4 + 0x41d850]
mov word [ebp - 0x20], dx
push 0xa
mov byte [edi + eax + 0x2a], dl
mov ecx, dword [ecx*4 + 0x41d850]
mov al, byte [ebp - 0x1f]
pop edx
mov byte [edi + ecx + 0x2b], al
mov ecx, dword [ebp - 8]
mov eax, dword [ecx*4 + 0x41d850]
mov byte [edi + eax + 0x2c], dl
mov edx, dword [ebp + 0xc]
add esi, 2
jmp 0x410e06
cmp word [ebp - 4], ax
jne 0x410dd8
mov edx, dword [ebp + 0xc]
cmp esi, edx
jne 0x410dd8
mov word [esi], ax
add esi, 2
jmp 0x410e06
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00411549
mov edx, dword [ebp + 0xc]
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x410e03
jmp 0x410dfa
mov edx, dword [ebp + 0xc]
push 0xd
pop eax
mov word [esi], ax
add esi, 2
mov ecx, dword [ebp - 8]
cmp ebx, dword [ebp - 0xc]
jb 0x410cf6
jmp 0x410e31
mov ecx, dword [ecx*4 + 0x41d850]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x410e28
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x410e31
mov cx, word [ebx]
mov word [esi], cx
add esi, 2
sub esi, edx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50e4c2
Capabilities:
Encode data using xor

Disassembly:
fst st(0)
fst dword [eax]
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xa9a87a6e]
rol edi, cl
sub dword [ebx + ecx*4 + 0x3c6f4f81], esi
mov ebp, dword [edx + 0x1b201c95]
mov ah, 0x3e
adc ebx, dword [edx + ecx]
pushfd
imul dword [edx - 0x144a04ef]
enter 0x209b, 0xffffffffffffffff
pop ecx
mov eax, 0xd681ab85
pushal
sbb edx, dword [edx + 0x7b]
push ebp
lcall 0xb462, 0x52461b05
les edi, [edx]
daa
in eax, 0x20
sbb byte [edi - 0xc], dh
fsub qword [edx]
fdivr st(2)
ja 0x50e4f1
movsd dword es:[edi], dword [esi]
mov ebx, 0x32809b59
fisttp qword [eax]
push 0x2b
push eax
imul esp, dword [esp], 0xffffffa0
frstor dword [eax]
sub eax, dword [edx - 0x5f5ddca7]
lodsd eax, dword [esi]
xchg edx, eax
nop
invalid

Function at 0x524a28
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffffd5fd, 0x7b
je 0x524a7a
shrd ecx, ebx, 0x19
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xlatb
test al, 0xd4
pop ebx
sbb al, 0x5f
out 0xb8, eax
fsubr dword [esi - 0x73]
add dword [eax + 0x5d], esp
imul ecx, edx, 0xffffffad
push ebp
call 0x9f08c40f
sbb dl, dl
aas
xor bl, byte [0x1fc00107]
rcl byte [esi + 0xf445458], cl
xor byte [ebx + 0x61], al
add bl, 0x24
mov eax, 0xc66212e1
push 0x3313e40f
sahf
jne 0x524a88
cld
fidiv dword [eax - 0x760977]
mov edx, edx
mov esi, esi
mov ecx, ecx
mov esi, esi
mov ebx, ebx
mov ebx, ebx
mov ecx, ecx
cmp ecx, 0x4c1
jle 0x524a54
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x5a56e3
Capabilities:
Encode data using xor

Disassembly:
push 0x2c
pop esp
mov dword [ecx + edi*8 + 0x2f], ecx
adc ah, byte [ebx + 0x4ca85c28]
cmp ecx, ebp
sub dword [0xf71d0ef5], ebp
jge 0x5a573b
inc ebx
mov esi, 0xfc6f7d0
aas
in al, 0x9d
scasd eax, dword es:[edi]
sar dword es:[ebx + 0x17], 0x9d
push ebx
sub edx, dword [ecx - 0x2a]
xor dword [ebp - 0x22], ebx
mov esi, 0x3139ff36
repne cmpsd dword [esi], dword es:[edi]
push ecx
or dword [0xf6bd7e50], 0xd02fcf
aas
fnstcw word [ecx]
mov cl, 0x1f
fucompi st(4)
movsd dword es:[edi], dword [esi]
jl 0x5a5703
invalid
sar dword [ecx], 0xb7
push ebp
fcmove st(0), st(7)
jp 0x5a579e
jg 0x5a5797
scasd eax, dword es:[edi]
sub eax, 0x3577258d
wait
xor al, bh
not byte [esi - 0x20]
lodsd eax, dword [esi]
adc bl, byte [esi + 0x72]
int1
enter 0xffffffffffff9c0d, 0xffffffffffffffec
pop esi
sub bl, cl
outsb dx, byte [esi]
xor edx, edx
in eax, dx
cmp dh, byte [eax]
invalid
push esp
invalid
sub al, byte [esi + 0x3b]
sub ebp, esp
int3
mov edi, 0xe88f9cad
pop ebp
jne 0x5a575d
jno 0x5a57fa
rcl byte [edx + ebp*2]
out dx, al
mov dword [ecx], ecx
cld
int 0x3f
or eax, 0xe3d34dbd
test byte [ebp + 7], ch
pop eax
cdq
js 0x5a578f
adc eax, 0xf65f9e8e
rol esp, 0xef
fnop
les ecx, [ecx + 0x3d]
sbb bh, ch
sbb ah, byte [ebp + 0x3edfd8a9]
pop edi
xor dword [eax + 0x4057ef15], esi
js 0x5a580d
sar eax, 1
sar byte [0x7c045e4], 0xd9
inc ebp
pop esp
int3
test edi, ecx
xchg edx, eax
xchg edi, eax
pop eax
xchg esi, eax
jmp dword [edi - 0x61]
invalid

Function at 0x5b75a8
Capabilities:
Encode data using xor

Disassembly:
fisttp dword [ecx - 0x76247613]
leave
mov esp, ebp
pop ebp
ret
nop
push ebp
mov ebp, esp
sub esp, 0x578
push esi
push edi
jmp 0xc61a46
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x56], al
and byte [eax], ah
jo 0x5b7578
mov cs, ebx
sar dword [ebp - 0x44], 1
loopne 0x5b757f
test bh, bl
lodsd eax, dword [esi]
jb 0x5b7605
fild qword [ebp + 0x28587265]
jnp 0x5b7592
sub byte [ebx - 0x1e], bh
stosd dword es:[edi], eax
sub cl, bh
or dword [ebx - 0x6b], edx
xchg esi, eax
jecxz 0x5b756f
scasd eax, dword es:[edi]
fidiv word [ebx + 0x2721592c]
daa
test eax, 0x79643cc2
wait
mov eax, dword [0xb4ec6917]
mov dl, 0x7a
pop edi
xor al, 0x9a
scasd eax, dword es:[edi]
pop ecx
mov dword [0x5ebeb539], eax
push 0x83f217ad
cmp eax, 0xaecdd36e
fisubr dword [eax + 0x4a]
outsb dx, byte [esi]
test dword [ecx], ebx
loop 0x5b75bf
div dword [ebx - 7]
inc ebx
adc eax, 0xbb170170
add dh, byte [esi - 0x3730c81e]
sti
cmp eax, 0xc965214e
push ebp
nop
rcr ah, 0x97
shl ebx, 1
add dword [edi], eax
shr dword [edx - 0x152dc85c], cl
sub al, 0xa5
and eax, 0xd75ecd3b
jnp 0x5b75ad
jno 0x5b766f
adc al, byte gs:[eax - 0x14689c81]
pop edi
jno 0x5b7616
mov bl, 0x88
mov esi, edx
shl dword [edi], cl
cmp ebx, dword [edx - 0x46]
aas
jmp 0xb3dbf1c1
and byte [edx + 7], dl
cld
stosb byte es:[edi], al
adc dword [edx + 0x2e], esi
aad 0x2d
inc edi
rep outsb dx, byte [esi]
and byte [edx - 0x354935f4], dl
arpl word [ebx + 0xec76490], cx
mov dl, 0xa7
or esi, dword [ebx - 0x3d]
retf 0xde0
Function at 0x5ef229
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor bh, bl
add eax, 0x6d6e9350
insd dword es:[edi], dx
insd dword es:[edi], dx
sub byte [ebx + 0x51], bh
call 0x77dfc1ba
xchg esi, eax
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x691fac12]
mul byte [eax - 0x4e]
or byte [esi], dl
rcl bl, cl
aas
jnp 0x5ef223
mov esi, 0x70d3175a
pushfd
frstor dword [bp + 0x58]
xchg edx, eax
adc byte [esi + 0x4cafb6e8], bh
xchg ebx, eax
xchg esp, eax
int3