joyce8/EMBER2024-capa huggingface dataset:
Function at 0x86f603
Capabilities:
Encode data using base64
Read .ini file

Disassembly:
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ebx, eax
cmp esp, esp
neg ebx
jmp 0x579427
sbb ebx, ebx
jmp 0x654f19
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push 0x46ae4c
jmp 0x52efd8
call sub.MFC42u.dll_CString::CString_5
mov byte [ebp - 4], 1
sbb ax, 0xe707
test ecx, 0x788e651b
mov eax, 0x46c11c
cmp dword [edi + 0x60], ebx
jmp 0x760ccb
mov dword [ebp - 4], ebx
jmp 0x90b35b
jne 0x6bb3ce
mov eax, 0x46c124
jmp 0x6bb3ce
push dword [ebp - 0x14]
jmp 0x66c088
xor esi, 0xb131cb83
jb fcn.00681714
mov esi, dword [esp + 0x10]
mov dword [esp + 0x10], 0x601eb6c5
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.0079131a
je 0x5d6a20
lea ecx, [ebp - 0x14]
call sub.MFC42u.dll_CString::CString_5
lea eax, [ebp - 0x14]
setle cl
push eax
bswap cx
cmovo ecx, eax
mov ch, dl
push 0x3eb
bswap ecx
mov ecx, edi
movsx ecx, dx
mov ecx, edi
jmp 0x6e4e17
call sub.MFC42u.dll_CWnd::GetDlgItemTextW
push dword [ebp - 0x14]
call fcn.0042ba41
pop ecx
clc
test ebp, edi
test eax, eax
jne 0x861731
lea ecx, [ebp - 0x10]
jmp 0x684fa5

Function at 0x89c6cf
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + ecx - 0x6c8884b4], ecx
lea esi, [0x80fece]
mov eax, dword [edi + ecx - 0x6c8884b4]
inc ecx
bts ecx, ecx
mov edx, 0x55206b16
lea edi, [edx + edi - 0x55206b12]
push ecx
sbb ecx, ecx
xor eax, ebx
sub eax, 0xb5a2ffab
shl dword [esp + edx - 0x55206b12], 0x44
ror eax, 2
neg edx
sbb eax, ecx
xor dl, 0x25
bts cx, dx
jae 0x9f06a5
cmp dword [esp + ecx*2 - 8], esp
loope 0x89c770
cmp byte [ecx], 0xc0
cwde
cmpsb byte [esi], byte es:[edi]
push cs
leave
lds ebx, [edi + 0x11]
invalid
invalid
neg eax
xor dword [esp + ecx*4 - 0x1fffc], edx
call fcn.006259df
Function at 0x8a552f
Capabilities:
Authenticate hmac
Contain obfuscated stackstrings

Disassembly:
push edi
not di
mov edi, ecx
jmp 0x92fc5f
xor eax, 0xb4a6173b
call fcn.006996b6
mov cx, word [eax + edx - 0x1175a1]
bts dx, dx
lea esi, [edx + esi - 0x1175a5]
rol dl, 0x83
mov word [esi + edx - 0x11751d], cx
mov dword [esp + edx*2 - 0x22ea3a], edx
add edx, dword [esp + edx*8 - 0x8ba8e8]
lea ebp, [ebp + edx*4 - 0x8ba8ec]
mov ecx, edx
xor ecx, edx
mov eax, dword [ebp + edx - 0x22ea3a]
pop ecx
xor eax, ebx
neg eax
bt ecx, ecx
xor dx, cx
shl edx, 0xa2
not eax
sub ecx, edx
imul ecx, ecx
add edx, edx
dec eax
neg edx
sbb dl, dh
jl 0x89fa28
pop esi
pop ss
loopne 0x8a54cf
ficom dword [ebx]
jns 0x8a54f2
rol eax, 1
cld
push cs
mov edi, 0x5f60dc30
or bh, byte [edi + 7]
pop edi
jmp 0x7523a2a6
ret 0x444c
aas
daa
mov dh, 0xcd
cmp bl, byte [edx + 0x703ab8aa]
cli
mov esi, 0xf2f355da
mov esi, 0xdd0255d8
movsb byte es:[edi], byte [esi]
popal
mov ch, 5
stc
sub ah, byte [ebx + ebx*8 - 0x6a]
mov eax, dword [esi + 0x29e89d69]
cmp eax, 0xfb93a08b
xor dword [edi - 0x72bfc1a2], eax
fisttp word [ebp - 0x463908b9]
test esi, 0x3fb75ab9
call fcn.0062ec0a
push ebp
mov ebp, esp
stc
sub esp, 0x6c
sar ah, 0x15
shl ah, 0xb0
mov eax, dword [0x487010]
test edx, 0xa23d80aa
stc
xor eax, ebp
cmp dx, bp
test si, si
clc
mov dword [ebp - 4], eax
clc
stc
cmp ecx, edi
and dword [ebp - 0x64], 0
jmp 0x9686b8
call esi
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
jmp 0x749f02

Function at 0x8a7d57
Capabilities:
Read .ini file

Disassembly:
mov ecx, 0x8ead9c00
movzx edx, byte [esi]
mov eax, ecx
sar cx, 0x88
adc esi, 1
shr eax, cl
sal ecx, cl
dec eax
xor dl, bl
dec eax
sar eax, 0x23
sbb dl, cl
bt ax, 0x17
ror dl, 1
cwde
push ecx
xor dl, 1
rol cl, 0x85
rol dword [esp + eax*8], 0x1e
bts ax, 2
sbb dl, 0xa
neg dword [esp + eax*2 - 8]
not dl
pop eax
bt eax, 0x30
push ecx
xor bl, dl
jmp loc.00431b09
push 0x7a151429
push edi
mov ebx, dword [esp + 4]
mov dword [esp + 0x10], 0xe85ec223
mov ebx, dword [esp + ebx - 0x7a15141d]
call fcn.004fbb56
jmp 0x7fc8e0

Function at 0x8a828f
Capabilities:
Read .ini file

Disassembly:
xor word [esp + ecx - 0x3ffffff1], dx
pop ecx
pop ecx
pop ecx
pop eax
pop ecx
js fcn.0050f018
push ecx
pushfd
mov ecx, 0x7383238a
lea ecx, [ecx + ecx - 0x4ad25e78]
sub cl, ch
or cx, 0xfd3c
lea ecx, [ecx*8 - 0x176fdcc9]
call fcn.0041712d
push edx
call fcn.00665087

Function at 0x8b222c
Capabilities:
Read .ini file

Disassembly:
inc byte [esp + eax*2 + 7]
add edi, edx
pop edx
pop eax
pop ecx
jmp fcn.0050f018

Function at 0x8ba07c
Capabilities:
Read .ini file

Disassembly:
inc dl
imul ecx, ecx
or ecx, ecx
ror dl, 1
xor bl, dl
or eax, dword [esp + 0x10]
cwde
lea edx, [esp + edx + 0x14]
sbb eax, 0xe81bf133
add ecx, 0xcf9f7f06
and ecx, eax
mov ax, word [edx + eax - 0x17e40ecc]
movzx edx, cl
lea ebp, [ebp + ecx - 0xc00c06]
mov word [ebp + ecx - 0xc00c04], ax
movzx eax, word [esp + ecx - 0xc00bf4]
mul al
or edx, eax
pop ecx
pop eax
pop edx
pop ecx
pop ecx
jns fcn.00732732
push esi
call fcn.005e20b8
Function at 0x8baec6
Capabilities:
Read .ini file

Disassembly:
call fcn.00876cc9
lea eax, [eax + edx*2 + 0x41edf514]
lea edx, [edx - 0x3aea5f60]
neg ecx
dec ecx
xor ebx, eax
jmp 0x6a890b
pop edx
sub eax, 0xd8812b8f
add cl, 2
add cl, cl
not eax
dec eax
btc cx, cx
neg eax
movzx edx, cl
lea ecx, [edx + ecx - 0x4146f975]
rol eax, 1
bt dx, dx
shl edx, 0xb2
jae 0x77e6d7

Function at 0x8d84ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x850cd494
call fcn.0098e715

Function at 0x8e6d2c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x10]
mov esi, ebx
cmovp di, si
lea edi, [esp + 0x4c]
movsd dword es:[edi], dword [esi]
jmp 0x9c42f7
mov dword [esp + 8], 0xadd78842
lea esp, [esp + 8]
call fcn.008d84ad
mov dword [esp + 0x60], eax
adc ax, 0x3532
movsx eax, sp
lahf
push ebx
shr bx, 0x23
push esi
or al, 0x3c
push edi
and ax, bx
mov eax, dword [0x487010]
sub esi, 0xd01ebd00
bts bx, ax
xor eax, esp
movsx edi, bp
mov di, 0x9db9
mov si, cx
push eax
bswap di
lea eax, [esp + 0x78]
cmovs di, bp
mov dword fs:[0], eax
jmp 0x5f5fc4

Function at 0x8f148d
Capabilities:
Read .ini file

Disassembly:
fdivr st(7)
push ebx
call fcn.005c71d8
aaa
enter 0xffffffffffffbc18, 0x33
or dh, byte [edi + 0x665cff50]
inc esp
push ebp
aas
sub eax, 0x7800b3b7
lahf
loop 0x8f1447
add bl, dh
mov edx, edi
sahf
sar byte [ecx], 0x35
and eax, 0x1d8096e2
dec esp
xchg esi, eax
cmp cl, 0x3e
adc eax, 0x332e3f60
add ch, byte [edx + 0x7f]
mov bh, 0x1c
test al, 0xa3
outsd dx, dword [esi]
mov al, 0xe7
invalid

Function at 0x8f8e4d
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get file attributes

Disassembly:
mov dword fs:[0], eax
cmp esp, 0xbf1f4501
test sp, 0xf9a7
sub ebx, ebx
cmp dword [edi], ebx
jmp 0x94bc54
push ebp
mov ebp, esp
movsx eax, di
test ebx, ebp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x46496c
movsx eax, bx
sar eax, cl
mov eax, dword fs:[0]
cmp ebx, edx
clc
stc
push eax
sbb ax, 0x718e
lea esp, [esp - 0x6fc]
mov eax, dword [0x487010]
xor eax, esp
mov dword [esp + 0x6f4], eax
push ebx
btc ax, bx
adc ah, 0x11
push esi
bsf ax, si
adc eax, 0xbe01debe
mov eax, dword [0x487010]
cmc
xor eax, esp
stc
push eax
nop
lea eax, [esp + 0x708]
test sp, 0x6f98
jmp 0x57856e
je 0x828805
cmp byte [edi + 0x1444], bl
jmp loc.004141cc

Function at 0x91c024
Capabilities:
Read .ini file

Disassembly:
mov dword [ebp], ecx
mov edx, dword [esi]
mov dword [esp], 0x19b5cbb7
mov ecx, dword [esp]
movzx eax, word [esp + ecx*4 - 0x66d72edc]
lea esi, [esi + ecx*2 - 0x336b976a]
mov byte [esp + ecx*2 - 0x336b976c], 0x93
dec al
xor edx, ebx
btc ecx, 0xb1
adc dword [esp + eax*2 - 0x1976c], ecx
inc cl
dec edx
sub word [esp + ecx*2 - 0x336f976f], cx
bswap edx
rol al, 0xe1
sbb ecx, dword [esp + ecx - 0x19b7cbb8]
xchg word [esp + eax*2 - 0x196da], ax
lea edx, [edx + eax*2 + 0x25a15334]
inc word [esp + eax*4 - 0x37db6]
pop ecx
cbw
ror edx, 1
neg eax
add cx, cx
xor ebx, edx
xor cx, 0xedae
adc edi, edx
mov edx, eax
jmp fcn.0050cb56
Function at 0x91cacb
Capabilities:
Authenticate hmac
Read .ini file

Disassembly:
lea ecx, [edx + edx*8 - 0x3bf33af8]
dec eax
sub edx, dword [esp + edx*2 - 0x3ffe0240]
shl dword [esp + edx*2 - 0x3ffe2e7a], 0x5c
not eax
setp cl
mov dword [esp + edx - 0x1fff173d], edx
neg dword [esp + edx - 0x1fff173d]
xor ebx, eax
sar dl, cl
add dl, dh
adc edi, eax
pop ecx
sal ecx, cl
jp fcn.0050f018
mov edx, 0x1b914fb2
mov ecx, dword [edx + esi - 0x1b914fb2]
neg dx
bswap edx
lea esi, [esi + edx - 0x4eb09117]
movzx eax, dl
xor ecx, ebx
sub dx, dx
rol ecx, 2
bt dx, dx
rol eax, 0x23
mul dx
lea ecx, [ecx + edx*2 + 0x2d4f70f]
sar eax, 0x63
bswap ecx
inc ecx
xor ebx, ecx
xadd ax, dx
adc edi, ecx
ror dx, 0x47
sub dx, ax
add eax, dword [ebp + eax*8]
btc dx, dx
sub dl, 0xa6
mov edx, dword [edx + ebp - 0x4eb00057]
push 0x4f2c4332
mov cl, byte [ebp + 8]
ror byte [esp + 3], 0x22
xor dword [esp], 0xd53b2230
ror dword [esp], 0xa8
adc ebp, 6
shld eax, edx, cl
mov ecx, 0x663af133
mov dword [ecx + ebp - 0x663af133], eax
mov dword [esp + ecx - 0x663af133], edi
ret
mov dword [esp + eax*2 - 0x17c], eax
inc byte [esp + eax*4 - 0x2f6]
ror cl, 1
ror dx, 0x6a
setae dl
xor bl, cl
lea ecx, [esp + ecx + 4]
cwde
rol eax, 0x57
adc al, byte [ecx + eax - 0x5f000000]
mov ecx, edx
not dword [esp]
and word [esp + 1], cx
sbb esi, 2
mov word [esi], ax
add ecx, edx
neg dl
xor ecx, ecx
lea ebp, [ebp + ecx*2 - 4]
lea eax, [edx + edx*4 - 0x49e4b367]
and eax, eax
or dword [esp + ecx*2], 0x3791e9a3
mov eax, dword [ebp + ecx*2]
xor eax, ebx
inc dl
rol edx, 0xbc
xor eax, 0x3416b397
neg dx
sal dl, 1
not eax
or byte [esp + edx*2 - 0x3ffe023e], dl
js 0x4e37a2
mov edx, 0xec8b2b21
mov eax, edx
call fcn.006b5166
jmp 0x8e7652

Function at 0x922dd8
Capabilities:
Read .ini file

Disassembly:
add esi, edx
pop edx
pop edx
pop edx
pop ecx
jmp fcn.00732732

Function at 0x92407a
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 4], 0x4571d66f
lea esp, [esp + 4]
call fcn.004303c5
mov ecx, 0x450b0d69
bound esp, qword [eax + 0x19147c17]
or al, 0x9a
xor al, 0x88
out dx, al
xchg esi, eax
xchg esp, eax
sti
inc esi
test byte [ecx - 0x73], cl
arpl word [ecx + 0x4afc7b1e], di
push 0xffffffffffffffeb
dec edx
mov dl, byte [esi + esi*2 + 0x43ab2650]
mov al, 0xfc
mov dl, 0x44
imul esi, dword [ebx + 0x67], 0x5b
or ebp, dword [ecx - 0xd]
mov eax, dword [ebp - 0x5c326fba]
fdiv dword [edi - 0x18]
cmp dword [esi], ebp
xchg byte [esi], ch
sbb dword [esp + edx*8], ebp
mov bl, 0x88
invalid
Function at 0x92b39d
Capabilities:
Read .ini file

Disassembly:
mov dword [ebp + edx*8 - 0x220], eax
xor ecx, edx
setge cl
ror cl, cl
jl fcn.00732732
mov ecx, 0x24057838
mov eax, ecx
ror eax, cl
fstp dword [edi + ecx - 0x24057838]
ror cx, 0xc3
lea edx, [ecx*2 - 0x78c32ff3]
btr edx, ecx
lea ebp, [ebp + ecx*2 - 0x480a1e12]
mov edx, dword [ecx + ebp - 0x24050f07]
xor edx, ebx
bswap edx
ror ax, 9
neg edx
not cx
xor ecx, eax
sar eax, 0x9c
inc edx
shr ecx, cl
xor eax, 0x8a2323bf
ror edx, 2
lea ecx, [ecx*2 + 0x290103be]
xor ebx, edx
jmp 0x6b7630
add esi, edx
add eax, eax
btc ecx, ecx
jmp esi
mov dword [esp + 0x10], 0xdf6beadc
mov ebx, dword [esp + ebx + 0x46914ff8]
popfd
lea esp, [esp + 0xc]
call fcn.009dd1bc
call fcn.009a7346
mov eax, 0x691bba88
mov dx, word [ebp + eax - 0x691bba88]
sal eax, 0x86
movzx ecx, al
lea ebp, [ecx + ebp + 2]
movzx eax, byte [esi + eax - 0x46eea200]
sub cx, 0xe90c
and ecx, ecx
not ecx
adc esi, 1
xor al, bl
sar cl, 0x65
rol ecx, 0x93
call fcn.00990f7e
inc edx
shr ah, 1
push eax
movsb byte es:[edi], byte [esi]
invalid
pushfd
shl ebx, 0xa4
jne 0x85d116
mov edx, 0x6a16a827
push edx
movsx ecx, dl
lea ebp, [edx + ebp - 0x6a16a82b]
ror dl, cl
call fcn.00540833
lea edx, [edx + edx*2 - 0x6b6152db]
rol eax, 2
shr dl, 0x81
neg edx
lea eax, [eax + ecx - 0x55112677]
call fcn.006eb6dd
sbb ebp, ecx
bswap ecx
pop edx
jmp 0x5cb191

Function at 0x935c3f
Capabilities:
Read .ini file

Disassembly:
push esi
jmp 0x8787f8
mov dword [ebp + 0x414], eax
push 0x38
mov eax, 0x462025
jmp 0x8b9ded
mov dword [ebp - 0x30], ebx
jmp 0x53a6e9
call fcn.0045c174
mov eax, dword [sym.imp.SocksCapExDLL32.dll_Ordinal_218]
cmovno esi, eax
bswap bx
push dword [eax]
setns bh
mov ebx, ecx
movsx esi, dx
jmp 0x999e8c
push ebp
shr al, 0xb3
xor ebp, eax
clc
sub esp, 0x414
xor al, 0x37
sal ah, 0xb1
bt ebp, 0x20
lea ebp, [esp - 4]
movzx ax, bl
mov eax, dword [0x487010]
test dl, 0x3f
cmc
stc
xor eax, ebp
jmp 0x5c176c
mov esi, 0x3f0
jmp 0x550c5f

Function at 0x93ccc4
Capabilities:
Read .ini file

Disassembly:
neg eax
dec ecx
sub dword [esp + ecx - 0x461c842b], edx
sub dword [esp + ecx - 0x461c842e], 0x11059424
lea eax, [eax + ecx - 0x1cef65fe]
lea esp, [esp + 0xc]
call fcn.004303c5
add eax, 0xc837f134
mov ecx, dword [esp + 8]
movsx edx, byte [esp + ecx - 0x303513b3]
bswap eax
xor ecx, edx
sbb ecx, 0x89ae678f
and ecx, edx
not eax
xor dword [esp + ecx - 0x461c842f], ecx
rol eax, 1
ror dx, 0xc4
not eax
neg byte [esp + ecx - 0x461c8432]
jg 0x8c598f

Function at 0x94316d
Capabilities:
Read .ini file

Disassembly:
mov dword [esp + edx - 0x1c270000], 0x79372bb5
mov dword [ebp + edx*2 - 0x384e0000], ecx
mov ecx, eax
cbw
pop ecx
Function at 0x956568
Capabilities:
Read .ini file
Resolve function by parsing pe exports

Disassembly:
rol eax, 1
rol edx, 0xbe
not eax
bswap eax
xchg dl, cl
lea eax, [ecx + eax - 0x51836967]
ror eax, 1
or ecx, 0x33a4700
lea eax, [eax + ecx*2 + 0x4b033b6]
sbb dx, 0x6219
bswap eax
lea edx, [ecx + edx*8 + 0x7193a409]
xor edx, 0x1eb8e601
xor ebx, eax
lea ecx, [ecx*4 - 0x207e99d1]
sal dx, cl
setb cl
adc esi, eax
and edx, 0x8bac298f
movzx ecx, word [ecx + edi - 0x5c7a8200]
movsx eax, dl
rol edx, 0x57
lea edi, [edi + edx - 0x4155fe]
mul edx
xor edx, edx
xor cx, bx
xor cx, 0x3f06
sar al, 0x64
jns 0x957d79
pushfd
mov esi, 0xf99c118
push 0xfb977d9a
mov esi, dword [esp + esi - 0xf99c108]
mov dword [esp + 0x10], 0xd0310cce
push dword [esp + 4]
popfd
lea esp, [esp + 0x10]
call fcn.0090f702
mov eax, dword [edi]
mov edx, 0x5e1e4632
lea edi, [edx + edi - 0x5e1e462e]
mov ecx, edx
sar cx, 0xe9
xor eax, ebx
bt ecx, edx
inc eax
rol eax, cl
sar edx, cl
setp dl
or edx, edx
not eax
sets cl
jg 0x7668d1
stc
jmp 0xa3a528db
mov edx, 0xddbc34b9
dec esi
out dx, eax
dec eax
jg 0x95663e
inc ecx
dec eax
jg 0x9565a2
sbb dword [eax], ebx
mov esi, 0x52dfaec0
mov bl, 0
outsb dx, byte [esi]
and bl, byte [eax]
mov dh, 0x80
cmp ecx, dword [esi - 0x6b03c0ae]
cmc
jmp 0x956631
mov edi, 0x8b10633f
push esp
and al, 0x10
inc esp
and al, 0x10
movsd dword es:[edi], dword [esi]
pop ds
fmul dword [ebp - 0x25eb6b75]
fild qword [edi + 0x72]
jb 0x956628
mov edx, 0x55ffc6d0
and eax, edx
neg cx
btc edx, eax
bt eax, eax
setb dl
inc cx
sub edx, 0x8b0926af
dec eax
xor cx, 0xbb2
xor bx, cx
ror eax, 0x4f
cwd
add edx, eax
lea ebp, [edx + ebp - 0x74f70000]
setl dl
btr eax, 0x92
mov word [ebp + edx - 0x74f6ff00], cx
movsx ecx, al
jb fcn.00732732
call fcn.0062b4cd
invalid

Function at 0x960916
Capabilities:
Encode data using xor

Disassembly:
and esi, 0x880fd593
mov esi, dword [esp + 8]
mov dword [esp + 8], 0x2dd9231c
push dword [esp + 4]
Function at 0x96eeba
Capabilities:
Read .ini file

Disassembly:
rol ax, 1
add ecx, dword [esp + edx - 0x6df4bfc0]
push ecx
neg ax
neg word [esp + edx - 0x6df4bfb9]
xor bx, ax
lea ebp, [edx + ebp - 0x6df4bfca]
lea edx, [edx - 0x42ecce]
mov dword [ebp + edx - 0x6db1d2f8], eax
movzx eax, word [esp + edx - 0x6db1d2f8]
dec byte [esp + edx - 0x6db1d2f7]
push edx
pop ecx
pop ecx
pop eax
pop eax
pop ecx
jno fcn.00732732
fcmove st(0), st(4)
fidivr word [esi - 0x6b5aee93]
lahf
insb byte es:[edi], dx
add al, 0x48
add al, 0x92
add eax, 0xa5008269
add byte [eax], 0xa5
xchg edx, eax
arpl word [eax + 0x6b], bp
cmp edx, dword [eax]
jae 0x96ef12
invalid

Function at 0x973563
Capabilities:
Read .ini file

Disassembly:
jl 0x9734b2
cdq
jbe 0x6762e1
std
dec ebx
jl 0x6762e8
mov esi, 0xc38233e8
retf 0xa896
out 0xfd, al
mov ebx, esi
arpl word fs:[eax - 0x11], si
out dx, eax
pushal
lcall 0x3ae6, 0xfeaf1935
inc ebp
sub al, byte [edi]
push edi
aaa
push cs
or eax, 0xa68175a
enter 0x76e4, 0x53
sbb dword [0x65a6ce32], esp
cmp al, 0x6e
sub byte [ecx], al
pop ss
mov eax, dword [0x39ff6667]
mov bh, 0x4a
and al, byte [eax]
ja 0x67630b
add dword [ebp + 0x8ef9cdc], esp
xor al, byte [esi]
jecxz 0x676326
ret 0xcf5a
retf 0x5aad
imul ecx, dword [esp + edx*2 - sym.SocksCapEx.exe_Ordinal_381]
lea esi, [esi + edx - 0x200004]
inc cl
mov dword [edx + esi - 0x200000], eax
not ecx
movzx eax, cx
add dword [esp + ecx - 0x4a780045], 0x4304b0f
pop ecx
ja fcn.0050f018
ret 0xf458
xor bl, dl
lea edx, [esp + edx + 0xc]
mov ax, word [ecx + edx - 0xded0080]
lea ebp, [ecx + ebp - 0xded0082]
mov word [ecx + ebp - 0xded0080], ax
mov dword [esp + ecx*8 - 0x6f6803fc], ecx
neg ecx
neg word [esp + 8]
pop eax
pop edx
pop ecx
jp fcn.009a708b
bound ebp, qword [0xf8c9b82f]
add ch, 0xe5
adc eax, 0xc69d70f7
add al, 0x7e
cmp dword [ecx + edi + 0xc], 0xffffffe6
jno 0x973521
invalid
dec edx
salc
aam 0x20
sbb al, 0x81
inc esi
jle 0x973577
pop ecx
add dh, byte [edi]
cmp dword [esi], ebp
cmp dword [ebx], esi
mov ebx, 0x19a86cc6
inc edx
fiadd dword [edi - 0x177bb19]
inc edi
and eax, 0x25364b91
pop edi
leave
add eax, 0x361d15a4
dec ecx
and dword [edx - 0x4f01b4b9], edx
nop
and dl, ah
mov bh, bh
mov esi, 0x78c204ad
mov bl, 0x90
jp 0x973566
fsubr dword [0x9c551e40]
mov ebp, 0x5b943719
sbb dword [edi], esi
xchg esp, eax
pop ebx
or ebp, 0xe399f38f
sub ebp, 0x10b98f14
call fcn.0083fe9a
bswap edx
rol cx, 0x2f
xor ebx, edx
push eax
rol al, 0x44
sal cx, 5
adc edi, edx
inc al
rol eax, 0x17
sub dword [esp + ecx], 0xed1b5ebc
lea ebp, [ebp + ecx*4 - 1]
pop ecx
rol eax, cl
movzx eax, byte [ebp + ecx - 0x12e4a0ea]
adc ecx, 0x3dae1b2a
movzx edx, cl
xor al, bl
btc cx, cx
rol al, 1
xor cl, dh
not cx
xadd dl, cl
dec al
bts dx, cx
xor al, 0x81
neg al
bt edx, 0x10
xor al, dl
sar edx, cl
shr dl, 0xc6
bts edx, ecx
xor bl, al
push ecx
jmp 0x90f9c9
pop ds
leave
in al, dx
dec dword [edi]
retf 0xc166

Function at 0x9793b1
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
pushfd
mov edx, 0xd9882225
push ebp
call fcn.005b5ec7

Function at 0x97a902
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov dword [esp + 4], 0x459076d9
lea esp, [esp + 4]
call fcn.004303c5
Function at 0x98b637
Capabilities:
Encode data using base64
Encode data using xor
Read .ini file

Disassembly:
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x48e62c]
jmp 0x89713f
call esi
test eax, eax
jmp 0x9c2d67
mov dword [esp], ebx
pushfd
mov ebx, 0xe236c69c
push edi
movzx edi, bx
lea ebx, [ebx*8 - 0x27410455]
lea edi, [ebx + ebx*4 - 0x1165d97c]
lea edi, [esp - 8]
movzx esi, bl
ror ebx, 0xfc
push ecx
shl bx, 0x2c
mov ecx, 0
neg bx
call fcn.0096d7bb
call fcn.004b8920
mov ecx, 0xfb17e902
movzx eax, cl
mov edx, dword [edi + eax*2 - 4]
shr cx, 0xc3
setae al
lea edi, [eax + edi + 3]
rol al, 0x66
xor edx, ebx
neg ecx
lea edx, [eax + edx - 0x730bda4c]
or cx, cx
shl eax, 0xb9
rol edx, 3
inc ax
sets cl
setnp al
inc edx
xadd ecx, eax
cbw
jne 0x9d2bbd
mov edx, dword [edi]
mov eax, 0x1c3d8923
lea ecx, [eax + eax + 0x2e190a34]
or cx, cx
lea edi, [edi + eax*4 - 0x70f62488]
xor edx, ebx
add ecx, 0x580e120
bswap edx
ror edx, 1
btc ax, cx
imul eax, eax
lea edx, [edx + eax*2 - 0x67e9d3d8]
setae al
push eax
pop ecx
neg edx
xor edx, 0x2089401b
lea eax, [ecx + 0x6f275fad]
neg ecx
dec edx
btc cx, cx
rol cl, 0x43
xor ebx, edx
shl cx, 0xad
setbe cl
add esi, edx
mov cx, word [ebp]
bt eax, 0xa8
adc ebp, 1
movzx edx, ax
shl al, 0xc2
movzx edx, byte [edi + edx - 0xf1ad]
call fcn.009846ef
push edi
jmp 0x627460
jne 0x98b733
and dword [0x48e62c], eax
movsx esi, bx
pop esi
pop edi
jmp loc.00416e98
xor edx, 0x57bcbe85
not ax
lea ecx, [eax + ecx*8 - 0xad0d678]
btr ecx, 0x10
lea edx, [ecx + edx + 0x6c4bdf17]
xor ebx, edx
add esi, edx
mov ecx, dword [ebp + ecx - 0x215e398f]
shr eax, 0x66
jb 0x41604f

Function at 0x9a91dc
Capabilities:
Read .ini file

Disassembly:
pop edx
mov ecx, dword [edi]
mov eax, 0x3609c229
xadd al, ah
lea edi, [edi + eax*2 - 0x6c1253d2]
movsx edx, al
or dx, ax
xor ecx, ebx
lea eax, [eax + 0x3abde90d]
ror al, 0x21
sbb ecx, 0x998ea2b5
sar edx, 0x7a
ror ecx, 3
lea edx, [edx*8 - 0x74efca7e]
neg ecx
bswap ecx
rol ecx, 1
dec ax
rol al, 0xa2
cwde
xor ecx, 0xf7b735a1
lea eax, [eax*4 - 0x36e3dcf8]
xor ebx, ecx
cwd
add esi, ecx
xor dl, 0x9c
cdq
not edx
mov ebp, dword [ebp + edx]
seto al
jl fcn.00732732
Function at 0x9d4d04
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
ja 0x901468
lea edx, [eax*4 + 0x13aca318]
mov dword [esp + edx - 0x13aca31c], esi
ret
adc esi, eax
pop edx
pop eax
jmp fcn.0068f3ca
xor ebx, eax
sal ecx, cl
jae 0x7d510e
xor bl, dl
lea edx, [esp + edx + 8]
call fcn.0073c4a7
pop ecx
dec eax
ror byte cs:[edi], 0x3b
fcom qword [eax + 0x1b757d3f]
xor bh, byte [ecx + 0x61770bbf]
add byte [edi + 0x629e188f], dh
inc eax
push esp
add ebp, dword [esi - 0x40]
fsub st(6)
mov eax, dword [0xdc3fbf34]
insd dword es:[edi], dx
jmp 0x6236d0
dec dword [esi + 0x5e4a7ace]
add byte [edi + 0x47c041e8], dl
inc edi
aaa
dec edx
ror byte [ebx + 0x324e7a65], cl
add dl, ah
nop
std
xchg dword [ebx], ebp
jg 0x6236fb
add al, 0x11
xchg ecx, eax
xchg ecx, eax
sti
mov byte [esi], dl
and al, 0x60
adc dh, dh
add byte [ebx - 0x1f], ch
pop ss
imul esp, ecx, 0x17
daa
dec eax
jne 0x6236d6
jecxz 0x62377c
lahf
or eax, 0xade71c1c
invalid
sbb ebp, ecx
scasb al, byte es:[edi]
mov esi, 0x28da747d
ret 0xe606
xor eax, 0x2226e30b
or cl, ch
xor byte [esp + edx - 0x4b8927fb], dl
rol eax, 1
neg eax
ror cx, 0x23
sub byte [esp + edx - 0x4b8927f9], 0x19
bswap eax
dec ecx
jle 0x623695
push edx
pushfd
mov edx, 0x6f36a926
neg dx
jb 0x7cdccc
sub esi, 4
mov eax, 0x4a060588
lea ecx, [eax + eax*2 + 0x65053b02]
mov ecx, dword [esi + eax - 0x4a060588]
xor ecx, ebx
movsx edx, ax
lea ecx, [ecx + eax - 0xd8bb7d]
sar dl, 0xc7
js 0x9ba67c
mov edx, dword [ecx + edx*2 - 0x40f55400]
mov ecx, eax
sub esi, 4
neg cx
dec ecx
setp al
mov dword [esi], edx
mov edx, ecx
jg 0x4dc513
jne fcn.0050f018
ja 0x5f7d5d
not al
xor bl, al
shr dl, 0x43
lea ebp, [ebp + ecx - 6]
mov dword [ebp + ecx*4 - 8], eax
jns fcn.0050cb56
cwd
rol ecx, 2
bts eax, edx
lea ecx, [eax + ecx + 0x798fd599]
or dx, dx
add edx, edx
lea edx, [edx + eax*8 + 0x571f1a25]
neg ecx
xor ebx, ecx
add ebp, ecx
ror al, 0xa1
mov edx, dword [edi + eax - 0x4a0605c4]
inc al
neg al
lea edi, [edi + eax - 0x4a060537]
div al
mov ecx, eax
push edx
popfd
jmp ebp
sub byte [ebp + ebp + 0x13ee4cd9], dh
sub eax, 0x2ba7df32
shl dh, cl
adc esp, dword [edx - 0x51]
sub eax, 0x8925e0af
mov dword [ebp + edx*2 - 0xba2c], ecx
lea edx, [edx*4 + 0x4b87eeb2]
mov eax, dword [edi + edx - 0x4b89630a]
setl byte [esp + edx - 0x4b89630a]
lea edi, [edi + edx - 0x4b896306]
push edx
lea ecx, [edx + 0x52351d3f]
inc cl
xor eax, ebx
not dword [esp + edx - 0x4b896307]
jbe 0x9d4ca3
inc byte [esp + edx - 0x4b896309]
shl dx, cl
ror eax, 1
ror ecx, 0xb9
jb 0x6aa8c9
push 0xa78d7d13
not word [esp]
pushfd
mov dword [esp + 0xc], 0x3f2b8b00
lea esp, [esp + 0xc]
call fcn.0099cbdc
stosb byte es:[edi], al
xor al, 0xce
pop ds
rol byte [eax - 0x5a1abdf6], cl
wait
mov dword [0xaf684b9a], eax
sub ah, byte [edx]
fnstenv gs:[edx - 0x7e]
insd dword es:[edi], dx
in eax, 0xf0
jns 0x9d4ced
lcall 0xc765, 0x34f68479
invalid