joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40345f
pop dword [ebp - 0xc]
mov eax, 0x40345f
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x41cce0d1
sub dword [ebp - 0x1c], 0xf37a9b86
mov dword [ebp - 0x18], 0x6641a8e8
add dword [ebp - 0x18], 0xcbf1a35d
mov dword [ebp - 0x14], 0x91e77057
sub dword [ebp - 0x14], 0x459b2c29
mov dword [ebp - 0x10], 0xe605de5f
add dword [ebp - 0x10], 0x19fa21a1
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x635bce5d
sub dword [ebp - 0x1c], 0xeee96507
mov dword [ebp - 0x18], 0x19c1def8
add dword [ebp - 0x18], 0x27aa827d
mov dword [ebp - 0x14], 0xc3064d07
sub dword [ebp - 0x14], 0x5f96e09b
mov dword [ebp - 0x10], 0xa6fb1497
sub dword [ebp - 0x10], 0xa6fb1497
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x39eba
push 0
call eax
mov ecx, 0x53ee
xor edi, edi
add edi, eax
mov ebx, 0xc3ea03
sub ebx, 0x830003
add ebx, dword [ebp - 0xc]
mov esi, 0x7c956635
sub esi, 0x49af17a0
mov edx, dword [ebx]
xor dword [ebp - 8], 0x3a228e4f
sub edx, esi
mov dword [ebp - 8], 0x23985bf1
mov dword [edi], edx
add edi, 4
add ebx, 0x165ce057
sub ebx, 0x165ce053
loop 0x40356e
add eax, 0x5ee296cf
sub eax, 0x5ee15444
mov ebx, eax
add eax, 0x7a9610fe
sub eax, 0x7a9610f9
mov ecx, 0x2df8bc67
add ecx, 0xd2474399
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x405a2a
Capabilities:
Terminate process

Disassembly:
call main
jmp 0x405a34
push 0x14
push 0x40a748
call fcn.00405c00
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.MSVCR120.dll___crtGetShowWindowMode]
movzx ebx, ax
mov dword [ebp - 4], esi
mov eax, dword fs:[0x18]
mov edx, dword [eax + 4]
mov edi, esi
mov esi, 0x40ca80
mov ecx, edx
xor eax, eax
lock cmpxchg dword [esi], ecx
test eax, eax
je 0x405a7b
cmp eax, edx
jne 0x405a64
xor esi, esi
inc esi
mov edi, esi
jmp 0x405a7e
xor esi, esi
inc esi
cmp dword [0x40ca84], esi
jne 0x405a90
push 0x1f
call sub.MSVCR120.dll__amsg_exit
pop ecx
jmp 0x405acb
cmp dword [0x40ca84], 0
jne 0x405ac5
mov dword [0x40ca84], esi
push 0x40722c
push 0x40721c
call sub.MSVCR120.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x405acb
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x405be2
mov dword [0x40c72c], esi
cmp dword [0x40ca84], esi
jne 0x405aee
push 0x407218
push 0x407204
call sub.MSVCR120.dll__initterm
pop ecx
pop ecx
mov dword [0x40ca84], 2
test edi, edi
jne 0x405afb
xor eax, eax
mov ecx, 0x40ca80
xchg dword [ecx], eax
cmp dword [0x40ca88], 0
je 0x405b1f
push 0x40ca88
call main
pop ecx
test eax, eax
je 0x405b1f
push 0
push 2
push 0
call dword [0x40ca88]
mov eax, dword [sym.imp.MSVCR120.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x405b6e
test cl, cl
je 0x405b3b
test edi, edi
jne 0x405b6e
mov al, byte [esi]
test al, al
je 0x405b4b
cmp al, 0x20
ja 0x405b4b
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405b3b
push ebx
push esi
push 0
push 0x400000
call main
mov dword [0x40c730], eax
cmp dword [0x40c734], 0
jne 0x405bc7
push eax
call dword [sym.imp.MSVCR120.dll_exit]
cmp cl, 0x22
jne 0x405b7f
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.MSVCR120.dll__ismbblead]
pop ecx
test eax, eax
je 0x405b92
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x405b2c
cmp dword [0x40c72c], 0
jne 0x405bdb
call dword [sym.imp.MSVCR120.dll__cexit]
mov eax, dword [0x40c730]
mov dword [ebp - 4], 0xfffffffe
call fcn.00405c45
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x40c1d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004079db
mov dword [ebp - 0x14], eax
cmp dword [0x43cd20], esi
jne 0x40c2cb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c258
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c3ab
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c3ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43cd20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43cd24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43cd28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43cd30], eax
test eax, eax
je 0x40c2c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43cd2c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c2f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c2e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c305
push 4
pop eax
jmp 0x40c3ad
cmp dword [ebp - 0x14], esi
je 0x40c305
push dword [0x43cd20]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c2ea
mov eax, dword [0x43cd2c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c363
cmp dword [0x43cd30], edi
je 0x40c363
push eax
call ebx
push dword [0x43cd30]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c363
test eax, eax
je 0x40c363
call ecx
test eax, eax
je 0x40c358
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c358
test byte [ebp - 8], 1
jne 0x40c363
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c393
mov eax, dword [0x43cd24]
cmp eax, edi
je 0x40c390
push eax
call ebx
test eax, eax
je 0x40c390
call eax
mov esi, eax
test esi, esi
je 0x40c390
mov eax, dword [0x43cd28]
cmp eax, edi
je 0x40c390
push eax
call ebx
test eax, eax
je 0x40c390
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43cd20]
call ebx
test eax, eax
je 0x40c3ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c3ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403b45
mov esp, ebp
pop ebp
ret
Function at 0x406a7a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x468124], 0
jne 0x406ab8
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a8e
mov dword [ecx*4 + 0x468120], eax
inc ecx
cmp ecx, 0x100
jl 0x406a89
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ae5
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x468120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ac6
not eax
pop ebp
ret 0xc

Function at 0x431002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x7d634e52
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x545b3b50
test eax, eax
nop
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401016
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x4010a6
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x4010a3
push 0x5c
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x4010a3
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40107c
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x401075
test ebp, ebp
je 0x401075
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x40107c
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x40109d
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x40109d
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x40102e
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x401bc8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x401bd7
pop dword [ebp - 0x2c]
mov eax, 0x401bd7
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x8df81bc0
add dword [ebp - 0x3c], 0xc05a298b
mov dword [ebp - 0x38], 0xb828f45
add dword [ebp - 0x38], 0x26b0bd00
mov dword [ebp - 0x34], 0x971a87f9
sub dword [ebp - 0x34], 0x4ace43cb
mov dword [ebp - 0x30], 0xf7c1b18d
add dword [ebp - 0x30], 0x83e4e73
lea eax, [ebp - 0x3c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x1d837d46
sub dword [ebp - 0x3c], 0xa91113f0
mov dword [ebp - 0x38], 0x22e44bd6
add dword [ebp - 0x38], 0x1e88159f
mov dword [ebp - 0x34], 0xcc0118ab
sub dword [ebp - 0x34], 0x6891ac3f
mov dword [ebp - 0x30], 0xdaf601c6
sub dword [ebp - 0x30], 0xdaf601c6
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x4c0b1429
sub eax, 0x4bcaa329
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3807b
push 0
call eax
mov ecx, 0xb4931ed6
sub ecx, 0xb492d104
xor edx, edx
add edx, eax
mov edi, 0xa366d978
sub edi, 0xa325d978
add edi, dword [ebp - 0x2c]
mov esi, 0x6aea8652
xor dword [ebp - 0x14], 0x4031e665
mov ebx, dword [edi]
xor dword [ebp - 0x28], esi
sub ebx, esi
sub dword [ebp - 8], eax
mov dword [edx], ebx
add edx, 0xd54bd8c2
add edx, 0x2ab42742
add edi, 0x5f294a90
sub edi, 0x5f294a8c
loop 0x401ceb
add eax, 0x12a1b
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x105dfe70
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x105e005d
pushal
mov esi, section.UPX1
lea edi, [esi - 0x360000]
push edi
or ebp, 0xffffffff
jmp 0x105dfe9a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x105dfea1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105dfe90
mov eax, 1
add ebx, ebx
jne 0x105dfeb3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x105dfec4
jne 0x105dfee3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105dfee3
dec eax
add ebx, ebx
jne 0x105dfed0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x105dfea8
add ebx, ebx
jne 0x105dfedf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x105dff35
xor ecx, ecx
sub eax, 3
jb 0x105dfefb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x105dff6a
sar eax, 1
mov ebp, eax
jmp 0x105dff06
add ebx, ebx
jne 0x105dff06
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105dfed4
inc ecx
add ebx, ebx
jne 0x105dff14
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x105dfed4
add ebx, ebx
jne 0x105dff21
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x105dff16
jne 0x105dff32
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x105dff16
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x105dff54
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x105dff46
jmp 0x105dfe96
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x105dff54
add edi, ecx
jmp 0x105dfe96
pop esi
mov edi, esi
mov ecx, 0x6e8b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x105dff72
cmp byte [edi], 0x28
jne 0x105dff72
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x105dff77
lea edi, [esi + 0x5d4000]
mov eax, dword [edi]
or eax, eax
je 0x105dffef
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5ed074]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5ed1a4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x105dffa4
mov ecx, edi
jns 0x105dffd3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5ed1a8]
or eax, eax
je 0x105dffe9
mov dword [ebx], eax
add ebx, 4
jmp 0x105dffc1
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x105e0020
cmp al, 0xef
ja 0x105e0013
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x105dfff5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x105e0002
mov ebp, dword [esi + 0x5ed1ac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x105e0054
sub esp, 0xffffff80
jmp 0x10105b82
Function at 0x418060
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x4180d8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call fcn.00418010
push str.WavePad_Internal
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
test esi, esi
mov dword [esp + 4], eax
je 0x4180b6
mov ecx, dword [0x4c9abc]
push 0x4c97ac
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov ecx, eax
pop esi
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
test ecx, ecx
setne al
add esp, 8
ret
xor ecx, ecx
xor eax, eax
test ecx, ecx
setne al
pop esi
add esp, 8
ret

Function at 0x4506fe
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
scasb al, byte es:[edi]
lahf
sub al, 3
inc ecx
inc edx
or al, 0xff
dec ebx
mov edi, 0x1e27bb4a
pop ebx
mov eax, 0x33fc0a12
jl 0x450779
dec dword [ebx - 0x41]
dec edx
mov ebx, 0xb85b1e27
adc cl, byte [edx]
cld
xor edi, dword [esp + 0x59]
pop ecx
test al, 0x4d
dec eax
push esp
stosb byte es:[edi], al
jo 0x4506ff
int 0xf5
retf 0x4e4f
cwde
mov dword [0x619fc26f], eax
pop ss
add dword [ecx + eax*4 + 0x10], ebx
cdq
cmp al, 0xcf
xor eax, 0x45cbbf01
invalid
sub edx, esp
sub esi, edi
js 0x450706
daa
adc al, 0x2f
sal dword [eax - 0x2a7b8b6c], 1
test al, dh
fnstsw word [edi + 0x3e]
leave
xor al, 0x1f
jae 0x450745
mov dword [esi - 0x39], edi
fcmove st(0), st(0)
push es
xor al, 0x99
dec esp
inc edx
add byte [esi + edx*4 + 0x3c], bl
add al, bh
in eax, 0x9d
cmp ebx, esi
mov ebx, 0x131340ac
js 0x450827
iretd
sub al, 0x99
lcall 0x5380, 0xda6044ea
mov ss, word [edx]
adc byte [ebx - 0x72], 0x12
inc edx
jg 0x4507c8
movsd dword es:[edi], dword [esi]
sub al, 0x13
in eax, dx
stosb byte es:[edi], al
adc cl, bh
ret
mov edi, 0xcdc515cd
int1
or ebp, dword [ecx]
or eax, 0x5d7ded68
xchg ebx, eax
add dl, 0xcb
out dx, al
std
mov eax, dword [0x5fdd3d1a]
loope 0x4507c1
ljmp 0x9ff:0x808f6dd5
Function at 0x466811
Capabilities:
Encode data using xor

Disassembly:
test byte [ebx + 0xde6cfa2], ah
rcl dword [esi - 0x6833d7c], cl
push es
iretd
push esp
ja 0x46673a
arpl word [0x7ba017a7], sp
invalid
je 0x4667a6
mov eax, 0x2712b7a1
movsb byte es:[edi], byte [esi]
test al, 0x94
sub al, 0x99
imul ebx, dword [eax + ecx*4 - 0x1261fef0], 0x54
cmp dword [edi + 0x6bcdc3fe], ebx
lodsd eax, dword [esi]
and dword [esi - 0x4349ceb], esp
sub al, 0x78
frstor dword [esi]
add al, 0x4d
adc eax, 0xe08f0533
outsd dx, dword [esi]
je 0x4668a7
sbb edi, dword [edi]
popfd
outsb dx, byte [esi]
xchg esp, eax
or dword [eax], edx
das
adc ah, byte [edi + 0x64]
cld
push es
js 0x466854
pushal
xor dword [ecx + 0x617a581d], 0xffffffb7
xor esi, dword [edi + 0x2b]
jp 0x4668b7
mov bh, 0x33
ja 0x466885
aaa
cmc
xor byte [ecx + 0x40aaf8a4], ch
js 0x4668c8
jge 0x4668ae
sbb eax, 0x9aaa6f7a
pushal
je 0x4668ae
dec ebx
mov ch, 0x55
loope 0x466897
invalid
push cs
and eax, 0x2b21f2a5
xor byte [ebx - 0x5022dab], bl
cdq
pop esi
nop
cwde
adc al, 0x4c
dec esp
sti
xor byte [ebx - 0x55c71fdf], dh
add dword [esi + 0x62], edi
and eax, dword cs:[ebp + 0x14b4b9dd]
mov ecx, 0x44d214b4
sub bh, byte [ecx]
mov ah, 0x14
rol byte [ebx + esi*8 + 0x2a], cl
cmp esi, esi
fnsave dword [edi + 0x15262ba1]
mov byte [0x213aa19d], al
push edi
and eax, 0x55b2e7f2
neg ch
mov bh, 0xa1
sub esp, dword [esi]
adc eax, 0x3aa19da2
and dword [edi + 0x25], edx
mov eax, dword [0x2557213a]
out 0xb2, eax
push ebp
mov dl, 0x55
adc al, 0x30
imul ecx, dword [edi], 0x29cadcac
stosb byte es:[edi], al
adc al, 0xe4
loopne 0x4668be
lock xor dh, byte [eax + 0x4b4abdfe]
push ebp
js 0x4668f6
rcr byte [esi], 1
iretd
inc ebx
lodsd eax, dword [esi]
je 0x466922
fnstenv [eax]
cli
test eax, 0xfb0c48
and al, 0x5a
jp 0x4668a6
push 0xffffffffffffffac
cmp edx, dword [edx]
mov esp, 0xd8c0fa58
pushal
out dx, eax
and byte [edi + 0x52126b2b], 0xd2
pushfd
and esi, dword [ebx - 0x1673ed2f]
or al, 0x1f
add dword [esi], 0x52bcda55
test al, 0xaa
ficom word [eax]
push es
push ebp
fidivr dword [edx + edx*2 + 0x10deaaa8]
adc al, 0xd2
add ebp, eax
xor eax, 0xb6e43f3d
imul edx, dword [esi - 0x20254a88], 0x3d
xor al, 0x30
loop 0x4669b4
pop es
sbb byte [ebp - 0x624e771], ch
pop edi
cld
push 0xb
leave
add bh, byte [ebx + ebp*4 + 0x340aaedc]
add eax, 0xf80b51a9
stosd dword es:[edi], eax
add al, 0xca
mov eax, dword [0xe0e8c8ce]
nop
or dword [esi + 0x49dbb17e], ebp
cmp ecx, ecx
xor dword [esi + 0x21], edi
inc eax
dec eax
pushal
and edx, dword [eax + 0x5e94a524]
invalid
sub byte [eax], cl
mov bl, 0x21
xor al, 0xd6
and bl, byte [ecx]
out dx, al
dec esp
mov al, byte ss:[0xff7474d7]
pop ds
push ecx
push eax
sub ch, ch
sal dword [edi - 0x139cbb5b], 1
adc ch, byte [edx + 0x43bbb4e0]
pop ecx
enter 0xffffffffffffd06a, 0x43
mov ah, 0xc9
inc ebp
aad 0x41
add ecx, ebp
sal dword [esi], 0xc2
sub edi, dword [edx - 0x7e8b211d]
adc eax, 0x850f6869
jmp 0x1945ccab
Function at 0x47d851
Capabilities:
Check for software breakpoints
Encrypt data using rc4 prga

Disassembly:
xchg esp, eax
lodsd eax, dword [esi]
mov al, 0x2b
mov dword [0xd44fa60b], eax
dec ecx
xchg edx, eax
aas
mov dword [edx - 1], ecx
sub eax, 0x8b623f01
outsd dx, dword [esi]
invalid

Function at 0x4bcaad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6370
cmp edx, dword [eax]
je 0x4bcacf
add eax, 8
inc ecx
cmp eax, 0x4c6400
jl 0x4bcac0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6370]
jne 0x4bcbfd
mov eax, dword [0x4cacfc]
cmp eax, 1
je 0x4bcbd7
test eax, eax
jne 0x4bcb00
cmp dword [0x4c629c], 1
je 0x4bcbd7
cmp edx, 0xfc
je 0x4bcbfd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bcb37
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bcb7a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1c7c
push edi
call fcn.004bf7f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd4a0
lea eax, [ebp - 0xa0]
push 0x4c1c5c
push eax
call fcn.004bd4a0
push dword [esi + 0x4c6374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd4a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf764
add esp, 0x2c
pop edi
jmp 0x4bcbfd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c6374]
push 0
push eax
push dword [esi]
call fcn.004bd920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40cea0
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x815030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ed02d4]
push ebx
mov ebx, dword [0x2ecfff4]
push esi
mov esi, dword [0x816060]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cee1
push str.duxafodaz
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ed02d4]
mov dword [0x2ecfff0], esi
cmp eax, 0x114e
jne 0x40cf06
call dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2ed02d4]
cmp eax, 0x2f
jne 0x40cf34
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsA]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push edi
push ebx
call fcn.0040cd50
mov ecx, dword [esp + 0x438]
add esp, 8
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret