joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415e91
Capabilities:
Encode data using xor

Disassembly:
iretd
push esi
inc edi
pushal
cld
sbb eax, 0x4ee38c0a
dec edi
test al, 0xd4
ljmp 0xf936
and esi, dword [eax + 0x505749c]
test byte [ecx], 0x3a
je 0x415e3b
dec ebp
imul esi, dword [edi], 0xd060b4eb
cli
loop 0x415ecd
out 0x2d, al
out 0x2d, al
imul edi, dword [ecx], 0xbc00f32b
push ebp
mov word [edx + 0x494985b7], cs
xchg esp, eax
pop ebx
shl byte [eax + edx*8 + 0x35], 0xdc
and eax, 0xc74cd881
enter 0x1af4, 0xffffffffffffffa2
sti
pop ecx
cmpsb byte [esi], byte es:[edi]
pushfd
cmpsb byte [esi], byte es:[edi]
jl 0x415e74
jl 0x415ef5
popal
pushfd
cmc
mov dh, 0x60
sbb ebx, dword [ebp + 5]
inc ebp
pop esp
xor esp, ebp
cmc
sti
lds ebx, [edx + eax]
call 0x306b90bc
pop edi
mov word [edi - 0x5ab5ddfc], ds
inc edi
ja 0x415e75
in al, dx
mov word [ecx + 0x15ea0563], es
or ebp, ebx
arpl word [0xeb0b15ea], ax
lds ecx, [0xde6a5d77]
cmp eax, 0x57b91dac
mov dh, 0x2d
xchg ebp, eax
sub esi, dword [eax - 0x1555e003]
arpl word [ecx - 0x22], cx
mov edx, 0x9bbc55b9
js 0x415f29
cld
pop es
fidivr word [esi]
loop 0x415ea7
xchg ebx, eax
or eax, 0x2cf45fb6
in al, dx
sub eax, 0x4cb74b93
dec ebx
mov bh, 0x4c
xor edi, dword [ecx*8 + 0x10004749]
mov edi, 0xaea9e344
push ds
rol byte [ebp - 0x1d], cl
sbb bl, byte [ecx]
and dh, byte [ecx]
aam 0x3c
rcr dword [0x3ea52d03], cl
pop esp
mov bl, 0x4f
invalid

Function at 0x416da8
Capabilities:
Encode data using xor

Disassembly:
dec ebx
movsd dword es:[edi], dword [esi]
fcompi st(1)
mov edx, 0x456344ac
mov word [ecx], es
sahf
adc al, 0xb2
or bh, cl
xorps xmm6, xmm0
in eax, 0x39
mov al, 0x61
fldenv ss:[ebx]
xchg ebp, eax
sbb edi, esp
mov bl, 4
mov bl, dl
test dword [eax - 0x1e], edx
pushal
push 0xa8801454
dec ebp
mov cl, 0x30
push ecx
dec ebp
cmp dword [0x1c9b2c74], esp
jne 0x416db8
aam 0x5c
mov ch, 0x10
inc edi
add al, 0xf5
dec ebp
and dh, bl
sbb dword [eax + 0x71], ebp
enter 0x5b70, 0xffffffffffffff90
invalid

Function at 0x45f9a0
Capabilities:
Encode data using xor

Disassembly:
pop es
push esp
inc ecx
sbb dword [ecx], ebp
pop ds
push es
not dword [edi - 0x72f3ef52]
cli
aam 0xa7
push dword [0xf6ff30c0]
sbb al, 0x4c
pop ds
xor al, 0x41
cmp bl, ah
out dx, al
xchg esi, eax
mov ebx, 0x6f3775ff
dec esi
invalid
jns 0x45f9c3
xchg esp, eax
jo 0x45f9c7
mov al, byte [0x717c9fa7]
add al, 0x7e
sbb eax, ebx
cmc
jg 0x45f96b
cmpsb byte [esi], byte es:[edi]
lodsb al, byte [esi]
mov dword [edi - 0x6c5ab9b2], 0x1510c2eb
mov bh, 0x92
push ebx
xor byte [ecx - 0x2c], dl
invalid
aam 0xc6
jecxz 0x45fa08
adc eax, dword [ebp + 0x77]
js 0x45fa49
cld
mov ecx, 0x8b82843f
fcomp dword [edx]
mov edi, 0x10f0aff0
sub al, 0x9f
push edi
mov ebp, ecx
aad 0xdd
xchg ebp, eax
cmp bh, ah
xor eax, 0xe2503026
pop eax
add eax, 0x31fcbd5c
test al, 0x99
mov ebp, 0x99a831fc
xchg byte [ecx + 0x3778d891], bl
test al, 0xcd
xor al, 0xf0
inc esp
loop 0x45f9eb
push edx
cld
into
xchg ebx, eax
sbb eax, 0xce203d14
cwde
or dword [ebp - 0x23], eax
sbb dh, cl
inc ebp
fstp qword [edx]
int1
jp 0x6fba3289
xor al, 6
call dword [eax - 0x203a6355]
fist dword [ecx - 0x40]
inc ebx
cmpsd dword [esi], dword es:[edi]
sub dh, 0x12
sub al, 0xf7
inc esp
add eax, 0x624bb51e
invalid
insb byte es:[edi], dx
Function at 0x46053e
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx + 0x74], dl
push ds
sub eax, 0x75528644
xchg byte [edx + 0x75], dl
loope 0x4604ca
add dh, byte [0xd5b5a2ba]
and eax, 0xc2ab8dd5
invalid
jg 0x4604d0
or eax, 0x25a2702f
inc ecx
push ebx
sub dword [edi], 0xffffff8e
xchg ebp, eax
mov dword [0x5a735abe], eax
scasd eax, dword es:[edi]
adc byte [esi + 0x69a629c0], 0x50
inc esi
cmp byte [0xff22f588], al
inc edi
adc byte [ebx - 0x46], cl
shl byte [0x45f8b385], 1
xor eax, 0xf025005c
jne 0x460540
push esp
adc byte [eax - 0x539f7600], bh
fidiv dword [ebx - 0x40]
invalid

Function at 0x4620a2
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0xb83725be
imul edx, dword [ebp + 0x6716d438], 0xf69359c6
fmul dword [ebx - 0x1ab851d7]
invalid

Function at 0x4a8dd9
Capabilities:
Encode data using xor

Disassembly:
pop edx
dec esp
out 0x86, eax
adc dword [esp + edx*2], esp
fcmovnu st(0), st(1)
push esi
mov bh, 0x99
das
dec ebp
adc al, 0x95
sahf
cdq
mov ss, word [edi + eax*2 + 0x53ba4095]
and al, 0x43
cmp dword [edx], 0x61
test al, 0x15
xor al, dh
je 0x4a8de0
imul esi, dword [ebx], 0xffffffca
and al, 0x4e
jecxz 0x4a8e7c
int1
cmpsd dword [esi], dword es:[edi]
out 0xe4, al
imul ebp, dword [edi + 0x4899d7aa], 0xd843275
scasb al, byte es:[edi]
mov esi, 0x9d580299

Function at 0x53c17c
Capabilities:
Encode data using xor

Disassembly:
int3
push ecx
sub byte [ebx - 0xe], al
jno 0x53c105
rol dword [esi], 0x36
pop edi
adc dword [eax], esp
rol byte [ebx + 0x2b], cl
jbe 0x53c178
dec edi
xor al, 0xe2
xchg edx, eax
ror dword [eax + 0x31], 1
not dword [ecx - 0x80]
and edx, esi
enter 0xffffffffffff9037, 0xffffffffffffffe8
lahf
loop 0x53c1cc
dec ecx
mov ch, 0x13
xlatb
and ah, byte [ecx]
push cs
mov esi, 0x41c19b50
loopne 0x53c1da
jae 0x53c21f
int3
push 0xd897e177
sbb edx, 0xffffffab
dec esi
jle 0x53c236
xor dword [si], esp
dec edx
sar dword [ebp + 0x18], cl
popfd
scasd eax, dword es:[edi]
invalid
xor esi, dword [ecx + 0x7fca06bc]
aaa
add dword [esi - 0xd3167ce], esi
adc eax, 0x373ae1ce
dec ebp
jmp 0x53c1f0
lds edi, [ebx - 0xf]
sar dword [ebx - 0x36d4de58], 1
add eax, 0x8c59e616
rcl esi, 0x22
xchg dword [eax + 0x57c7ffed], edx
mov dh, byte [ecx + 0x1f]
imul ebp, dword [edi + ebp*2], 0xd
adc ch, byte [ebx]
jl 0x53c1b8
mov al, byte [0xc9e7defd]
pop es
std
mov bl, 0xa9
jecxz 0x53c1c0
push esi
add byte [edi + 0x6413049d], 0xaa
xchg dword [ebp - 0x559becfc], ebx
scasd eax, dword es:[edi]
add dword [ebp + ebp*2 - 0x19], edx
mov cl, 0x19
inc ecx
push esp
push esp
insd dword es:[edi], dx
out 0xb1, eax
sbb dword [ecx + 0x54], eax
lahf
iretd
and byte [edi], al
out 0xc0, al
mov al, 0x1e
add dh, ah
add byte [esi + 0x62f8c405], 8
jbe 0x53c234
add eax, 0xb127411d
fbld tbyte [ecx]
add ebp, dword [edi + 6]
fcmovnbe st(0), st(4)
mov eax, dword [0x830a917e]
pop ecx
push edi
jle 0x53c227
movsb byte es:[edi], byte [esi]
xor dword [edx + 0x10bc88ed], esp
and al, byte [ebp]
dec ebp
mov ebx, 0x3023dd2e
push esp
inc esi
stosb byte es:[edi], al
fucomi st(7)
cwde
aaa
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
pop edi
or eax, 0xe1e53807
jne 0x53c25c
ret 0x914a
Function at 0x53e4c2
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
test bh, ah
inc ebx
mov bh, 0x81
test dword [ebp + 0x71b31a67], 0x250fe1b2
out 0x41, eax
outsd dx, dword [esi]
and dword [ebx + 0x76], ebx
jnp 0x53e4af
jo 0x53e537
out 0x1e, al
push ss
mov byte [edi], bl
inc ecx
or dword [ecx], ebp
add dword [ebx + 0x1a39d23f], edx
invalid
and dl, byte [eax]
imul ebp, dword [eax], 0xa1bb55bb
invalid

Function at 0x55e76a
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0x41e713d
jbe 0x55e766
push ebx
pop ecx
invalid
adc ecx, dword [ebp + 0x70]
and dword [ecx], edx
adc esi, ebx
push edi
invalid
lahf
and al, 0x7c
invalid
adc esi, ebx
push edi
rcr byte [edi + 0x39f07c24], cl
or byte [ebx + 0x7067a10c], ch
mov esp, dword [edx - 0x14861e0c]
cwde
xor byte [ebx + 0x24], ah
jne fcn.0055e76a
inc edi
inc ecx
push eax
and dword [eax], esp
outsb dx, byte [esi]
xchg byte [ebx + 0x54d29ba6], bh
scasb al, byte es:[edi]
cmp eax, 0x83c1eaf8
jg 0x55e80a
jno 0x55e7bb
and dword [ebx + 0x1f], ebp
jns 0x55e80d
imul ebx, dword [edi], 0x79
outsd dx, dword [esi]
int 0xbf
cmp eax, 0x3d474895
dec esi
leave
xchg edx, eax
mov dword [0x6121aed7], eax
pop es
mov esi, 0x22e67c7a
loope 0x55e798
mov al, bh
pop ss
jb 0x55e741
mov dh, 0xa7
cmpsd dword [esi], dword es:[edi]
ljmp 0xa6d1:0xe737e11a
test dl, al
mov ds, eax
push ds
int3
dec ecx
push esi
invalid
xlatb
and dword [eax + 0x66], edx
push ds
mov al, 0xb2
shr bh, cl
mov bh, 0x57
push edi
xchg ecx, eax
jl 0x55e817
adc dh, cl
loopne 0x55e802
les edx, [ecx + 0x15800d87]
outsd dx, dword [esi]
and ebx, edi
call 0x2b89df9b
add byte [esi + 0x33ade099], 0xfd
outsb dx, byte [esi]
mov ecx, 0xe06ffd0
xor eax, 0xbb096644
std
and ch, cl
and eax, 0x108bc401
sbb eax, 0x96baa84b
sub byte [ecx - 0x47c9636a], bl
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x5948ec
Capabilities:
Encode data using xor

Disassembly:
xor bl, cl
sub ah, cl
out dx, al
adc dword [edi], ecx
mov ah, 0x2c
push ebp
pop ebx
dec edx
xchg edi, eax
dec edx
invalid
sbb dword [esi + 0x39], ecx
pop ds
jne 0x5947ef
cmp eax, 0xd18624e8
or dword [esi + 0x51], ebx
jbe 0x594819
fcmove st(0), st(1)
mov ch, byte [ebx - 0x7a229bd7]
inc edi
invalid
fld qword fs:[ebp + 0x289ff047]
jge 0x59478c
nop
outsb dx, byte [esi]
out 0xd4, al
aad 4
adc esp, dword [0xe4d15486]
out dx, al
mov bh, 0x9b
xor edi, ebp
std
invalid
sbb eax, esp
cmp byte [edi - 0x42f4f062], dl
jmp 0xf07ef5e2
jle 0x594832
test eax, 0x2bd7c506
or dword [esi], esi
or eax, 0xce01c16
xlatb
sub ecx, dword [ecx]
or eax, 0xce01c16
sub eax, 0xaf77ea7e
popal
jbe 0x5947eb
xchg edx, eax
add dword [ebx - 0x2aa30fd], edx
push dword [edx]
jp 0x594801
cdq
fisub dword [ebp - 0x5eeb6a90]
outsd dx, dword [esi]
in eax, 0x6f
add eax, 0x2db5c129
sub cl, byte [eax + 0x44fe6b8e]
inc esp
sahf
cmc
pop ebp
jno 0x594840
adc ebx, esp
inc edi
daa
mov ebx, 0xc76c344b
jle 0x594845
pop ebp
out dx, al
sbb eax, 0x84b22fa8
pop ds
hlt
sub eax, 0x9bc7be82
out dx, al
jae 0x594875
dec esi
outsd dx, dword [esi]
jnp 0x594921
das
sub eax, 0x3c8f271a
dec edi
sbb eax, 0xc35c602f
invalid
push edx
and byte [edi - 0x7c736dca], dh
sbb cl, byte [eax - 0x2eec3fb5]
xlatb
shr byte [eax], 5
shl ecx, 1
push cs
bound eax, qword [eax + esi*2 - 0x74]
ljmp 0xa495

Function at 0x5d1da2
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
push eax
jno 0x5d1d9b
pushfd
mov byte [eax - 0x3148a5c5], ah
pop edx
hlt
push cs
adc byte [ebx + esi*2], dh
cmp byte [edi + 0x5d31b9b2], bl
jb 0x5d1dca
jne 0x5d1d4c
add byte [ecx + ebx*4], ch
dec ebx
scasb al, byte es:[edi]
in al, 0xb4
into
add dword [ecx - 0x376bf6f6], esp
jle 0x5d1d6f
adc dword [ecx + 0x93f2f0e], eax
mov al, 0x56
ror dword [eax + edx*8], 0x4d
xor dword [ecx], edi
aam 0x98
sub eax, 0xb0aae3fd
iretd
popal
salc
pop ecx
pop ebx
out 0xdb, eax
pop ds
aas
ja 0x5d1d4b
outsb dx, byte [esi]
daa
ja 0x5d1e1f
push ebx
add eax, 0x285fb182
cmp edi, dword [edx - 0x25db54f7]
jbe 0x5d1d39
out dx, eax
dec edx
mov ebp, 0x45ba8f2b
lcall 0x254, 0x46e8386a
jb 0x5d1dc3
push esp
add dh, byte [edx - 4]
pushal
pop esp
or eax, 0xcc5a5f28
sub dl, bl
ror bl, 1
fisub word [ecx]
mov edi, 0x98fc1eee
dec edx
iretd
sub byte [edi + 0x5a], bl
int3
sbb eax, 0x25611c44
sti
arpl word [ebx], bp
xor eax, 0x1f0996c6
inc eax
invalid

Function at 0x63ad2a
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
push ss
mov dl, 0xc
leave
mov byte [0x5c15d2f2], al
pop esp
pop esp
cmpsd dword [esi], dword es:[edi]
out 0x9a, al
push edx
jle 0x63ad40
pushfd
movsb byte es:[edi], byte [esi]
jns 0x63adb3
add al, 0x6d
pop esp
xchg esi, eax
ret
jle 0x63ad21
invalid
cmpsb byte [esi], byte es:[edi]
Function at 0x40690e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x42f764], 0
jne 0x40694c
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406922
mov dword [ecx*4 + 0x42f760], eax
inc ecx
cmp ecx, 0x100
jl 0x40691d
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406979
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x42f760]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40695a
not eax
pop ebp
ret 0xc

Function at 0x401440
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0xbbeaf81f
xor ebx, 0xbfeaf81f
jmp 0x4014f0
mov edx, 0xa919783e
xor edx, 0xa919783a
mov ecx, 0x25135daf
xor ecx, 0x25136daf
mov eax, 0x500
ror eax, 0x1c
push edx
push ecx
push eax
mov edx, dword [ebp - 0xb4]
rol edx, 4
rol edx, 0xa
mov dword [ebp - 8], edx
push ebx
call fcn.00401644
push esi
pop ecx
mov ebx, eax
test ebx, ebx
je 0x4014f0
sub ebx, 0x86b78ac7
mov dword [ebp - 0x10], ebx
ret
Function at 0x4017f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xe8
mov esi, esp
mov dword [esi + 0xc], ebp
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dl, byte [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
mov al, byte [ebp + 0x14]
vmovsd xmm0, qword [ebp + 0xc]
mov edi, esp
mov dword [esi + 0xd4], edi
mov dword [esi + 0xe0], 0xffffffff
lea edi, [esi + 0xd8]
mov dword [esi + 0xdc], 0x405900
mov ebx, dword fs:[0]
mov dword [esi + 0xd8], ebx
mov dword fs:[0], edi
and dl, 1
mov byte [esi + 0xd3], dl
and al, 1
mov byte [esi + 0xd2], al
vmovsd qword [esi + 0xc8], xmm0
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xbc], 0x40f1e760
mov dword [esi + 0xb8], 0
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0xa0]
call fcn.004059c0
sub esp, 4
mov byte [esi + 0x9f], 0
mov dword [esi + 0xe0], 0
mov eax, esp
mov dword [eax], str.xtnhuvfqhkcdasrpxycwsgyxdzqrulaogpyenozwimv
lea ecx, [esi + 0x84]
call fcn.004059c0
sub esp, 4
jmp 0x4018c6
mov dword [esi + 0x7c], 0x40f231b0
mov dword [esi + 0x78], 0
mov byte [esi + 0x77], 0
mov dword [esi + 0x6c], 0x40c9b200
mov dword [esi + 0x68], 0
mov byte [esi + 0x67], 1
mov dword [esi + 0x5c], 0x40a74800
mov dword [esi + 0x58], 0
mov dword [esi + 0x54], 0x200
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x3c]
call fcn.004059c0
sub esp, 4
jmp 0x401921
mov dword [esi + 0xe0], 2
mov eax, esp
mov dword [eax], str.chwdgqgibskldwjscvtzujbvdpnvntitzupanjcqoqddfryzxibqeuvccubsnbzizqikuqvpetgrusxklr
lea ecx, [esi + 0x24]
call fcn.004059c0
sub esp, 4
jmp 0x401943
lea ecx, [esi + 0x24]
lea eax, [esi + 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
call fcn.00405ae0
mov byte [esi + 0x13], al
lea ecx, [esi + 0x24]
call fcn.00405ab0
lea ecx, [esi + 0x3c]
call fcn.00405ab0
mov al, byte [esi + 0x13]
test al, 1
jne 0x401978
jmp 0x40199c
mov dword [esi + 0x20], 0x10
cmp dword [esi + 0x20], 0
jle 0x401997
mov eax, dword [esi + 0x20]
add eax, 0xffffffff
mov dword [esi + 0x20], eax
jmp 0x40197f
jmp 0x40199c
mov dword [esi + 0x1c], 0x30
cmp dword [esi + 0x1c], 0
jle 0x4019bb
mov eax, dword [esi + 0x1c]
add eax, 0xffffffff
mov dword [esi + 0x1c], eax
jmp 0x4019a3
mov ecx, dword [esi + 0x14]
mov dword [esi + 0xe0], 1
mov eax, esp
mov dword [eax], str.aimyspgesqdavhnmxfs
call fcn.004059c0
sub esp, 4
jmp 0x4019dd
lea ecx, [esi + 0x84]
call fcn.00405ab0
lea ecx, [esi + 0xa0]
call fcn.00405ab0
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0xd8]
mov dword fs:[0], ecx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x18
Function at 0x402ba0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
inc esi
add eax, 0x7a
or edi, 0xff
mov esi, 0x37
and ebx, 0xae
sub edi, 0x5e
imul edx
sbb edx, 0x45
sbb edi, 0x4b
sbb edi, 0x9c
not edx
rol eax, 0xcf
not eax
not edx
neg edx
rcr edx, 0x7d
sbb esi, 0xf6
inc esi
or ebx, 0xe5
mov esi, 0x23
imul esi
not esi
mov edi, 0x7b
not ebx
inc eax
bswap edx
neg ebx
inc esi
rcl eax, 0x35
imul edx
or edx, 0x3b
rcl esi, 0xb2
inc edi
rol eax, 0xcd
dec esi
neg ebx
dec edi
imul edi
imul edi
rcr edx, 0x88
and edx, 0x3c
bswap edx
ror ebx, 0x89
not edx
neg edx
dec edx
dec edx
imul eax
or esi, 0x13
rcr edx, 0xba
xor ecx, ecx
xor edi, edi
bswap esi
add edi, 0x69
imul eax
mov eax, 0xf8
mov esi, 0xf4
rcr esi, 0x63
neg eax
rcl esi, 0xaa
not ebx
imul eax
bswap eax
imul edi
add eax, 0x80
imul ebx
add eax, 0x46
imul esi
not esi
inc edx
and edx, 0xc2
or edi, 0x10
add edi, 0x90
sbb eax, 0x5c
add ebx, 0xd0
bswap eax
and edx, 0x75
neg edi
neg edx
bswap eax
and edx, 0xf0
rcr esi, 0x82
rcr esi, 0x8f
bswap edx
neg ebx
dec ebx
not eax
or ebx, 0xf9
ror esi, 0x12
inc edi
imul esi
sub esi, 0x70
sub eax, 0xd2
bswap edi
add edx, 0x97
bswap esi
ror edx, 0xaa
inc eax
add ebx, 0x4e
inc edx
add esi, 0x63
imul ebx
mov ecx, dword [ebp + 0xc]
not edi
or esi, 0x89
rcr edx, 0x62
not esi
bswap edx
sbb esi, 0xc9
sub edx, 0x2b
ror ebx, 0x4c
sub edx, 0xa8
sub edx, 0x33
bswap edi
inc edi
rcl esi, 0xf4
rcl edx, 0x8d
imul edx
and edx, 0x5c
or eax, 0xcd
neg eax
and esi, 0x46
dec eax
imul esi
rcl edx, 0x67
rol edx, 0x35
inc ebx
or eax, 0x4a
or esi, 0xc1
rcr ebx, 0x4a
imul edx
rcl edx, 0x54
sbb ebx, 0x2a
imul edi
inc edx
or ebx, 0x21
and edx, 0x1a
neg eax
mov esi, 0xbd
imul eax
rol edx, 0x13
inc esi
add esi, 0xa3
not eax
dec eax
rol edx, 0x45
bswap edi
dec edx
inc esi
not edi
neg edi
inc ebx
not eax
mov edi, dword [ebp + 8]
xor ebx, esi
mov esi, eax
xor eax, esi
xor ebx, ebx
xor ebx, ebx
mov eax, esi
xor ebx, ebx
xor esi, eax
mov eax, ebx
xor ebx, esi
xor esi, esi
mov ebx, eax
not byte [edi]
mov ebx, eax
xor ebx, esi
xor esi, esi
xor esi, ebx
mov eax, eax
mov eax, ebx
xor esi, ebx
mov eax, eax
xor ebx, ebx
sub byte [edi], 0x89
xor esi, ebx
xor eax, eax
mov eax, ebx
xor ebx, ebx
xor ebx, ebx
mov eax, esi
mov ebx, esi
xor esi, esi
xor esi, eax
add byte [edi], 0x57
xor ebx, ebx
mov ebx, eax
xor esi, eax
mov esi, ebx
mov eax, ebx
mov eax, eax
mov esi, ebx
mov eax, esi
xor eax, eax
imul byte [edi]
inc edi
loop 0x402d5b
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40725e
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40729d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40729d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40729d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40729d
cmp dword [ecx + 0x74], 0xe
jbe 0x40729d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40e698
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40e735
push ebx
push esi
call fcn.0040e661
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040e5f5
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40e6e2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e734
push edi
push eax
call fcn.0040cffb
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40e702
call fcn.0040d049
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40e733
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040e5f5
add esp, 0x20
test eax, eax
jne 0x40e721
push edi
call fcn.0040d049
jmp 0x40e729
push ebx
call fcn.0040d049
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40f944
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a70
push 0x418a68
push str.FlsAlloc
push 0x1f
call fcn.0040f803
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f978
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
jmp 0x40f97e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40f9c2
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a80
push 0x418a78
push str.FlsGetValue
push 0x21
call fcn.0040f803
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40f9f9
push dword [ebp + 8]
mov ecx, esi
call dword [0x416130]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40fa01
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x418a88
push 0x418a80
push str.FlsSetValue
push 0x22
call fcn.0040f803
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40fa3b
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x416130]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x414e00
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x414e2d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x414e2d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x40226a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push edi
mov byte [ebp - 0x104], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 4], 0
mov eax, 0x4021d6
sub eax, 0x401cf5
mov dword [ebp - 4], eax
push 8
push 0x408008
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406350
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
push 0x401cf5
lea eax, [ebp - 0x104]
push eax
call fcn.00406464
add esp, 0xc
push 0x100
push 0
lea ecx, [ebp - 0x104]
push ecx
call fcn.00406890
add esp, 0xc
call fcn.00401d3d
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406464
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
jmp 0x40648a
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0x10]
jge 0x40654c
mov edx, dword [ebp - 0xc]
add edx, 1
and edx, 0x800000ff
jns 0x4064ac
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0xc], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp - 0x10]
add edx, ecx
and edx, 0x800000ff
jns 0x4064ce
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0xc]
mov cl, byte [eax]
mov byte [ebp - 4], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
mov cl, byte [eax]
mov byte [edx], cl
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov al, byte [ebp - 4]
mov byte [edx], al
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x10]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x40651d
dec edx
or edx, 0xffffff00
inc edx
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 4], al
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp - 4]
and eax, 0xff
xor edx, eax
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0x14]
mov byte [ecx], dl
jmp 0x406481
mov esp, ebp
pop ebp
ret