joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031abe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.1001d730
mov eax, dword [0x10040080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.1002b352
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x10031b00
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x10031c5c
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.1003e760
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x1005ef08]
push dword [eax + edi + 0x24]
push dword [eax + edi + 0x20]
push ebx
call fcn.100332ac
mov ecx, dword [esi*4 + 0x1005ef08]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [ecx + edi + 0x20]
jne 0x10031c55
cmp eax, dword [ecx + edi + 0x24]
jne 0x10031c55
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [ecx + edi + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10031c55
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100332ac
add esp, 0x14
test edx, edx
jl 0x10031c55
jg 0x10031bcb
test eax, eax
jb 0x10031c55
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x10031c55
jl 0x10031be5
cmp dword [ebp - 0x1008], eax
ja 0x10031c55
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x10031c03
test ebx, ebx
je 0x10031c3c
cmp ecx, edi
jae 0x10031c3c
mov al, byte [ecx]
cmp al, 0xd
jne 0x10031c1d
lea eax, [edi - 1]
cmp ecx, eax
jae 0x10031c29
cmp byte [ecx + 1], 0xa
jne 0x10031c29
inc ecx
jmp 0x10031c29
movzx eax, al
movsx eax, byte [eax + 0x10040330]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x10031c03
cmp edx, ebx
jne 0x10031c03
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x10031c5a
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.1001ceaa
leave
ret
Function at 0x10032744
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1005ef08]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10032784
cmp byte [ebx], 0xa
jne 0x10032784
or byte [edi + eax + 0x28], 4
jmp 0x10032789
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10032888
mov dl, byte [eax]
cmp dl, 0x1a
je 0x1003286b
inc eax
cmp dl, 0xd
je 0x100327b5
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100327db
cmp eax, ecx
jae 0x100327e9
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x1003279d
jmp 0x10032888
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10032866
cmp dword [ebp - 0x10], 0
je 0x10032866
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x1005ef08]
test byte [eax + edi + 0x28], 0x48
je 0x10032840
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x1003282b
mov byte [esi], dl
jmp 0x1003283c
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1005ef08]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10032888
cmp byte [ebp - 1], 0xa
jne 0x1003284f
cmp esi, ebx
jne 0x1003284f
mov byte [esi], 0xa
jmp 0x10032887
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.100332ca
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10032888
mov byte [esi], 0xd
jmp 0x10032887
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x1005ef08]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10032885
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10032888
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10032891
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x1005ef08]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100328d7
cmp word [ebx], dx
jne 0x100328d7
or byte [eax + edi + 0x28], 4
jmp 0x100328dc
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10032a3f
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10032a1f
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x1003291d
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10032953
cmp eax, edx
jae 0x10032961
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100328f8
jmp 0x10032a3f
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10032a1a
cmp dword [ebp - 0x18], 0
je 0x10032a1a
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x1005ef08]
test byte [eax + edi + 0x28], 0x48
je 0x100329f0
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x100329b4
mov word [esi], cx
jmp 0x100329eb
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x1005ef08]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x1005ef08]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x1005ef08]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10032a3f
pop eax
cmp word [ebp - 4], ax
jne 0x10032a00
cmp esi, ebx
jne 0x10032a00
mov word [esi], ax
jmp 0x10032a3c
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.100332ca
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10032a3f
push 0xd
pop eax
jmp 0x100329fb
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x1005ef08]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10032a39
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10032a3f
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10035648
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100356e5
push ebx
push esi
call fcn.10035611
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1002eee6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10035692
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100356e4
push edi
push eax
call fcn.1002ee08
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100356b2
call fcn.1002eb8a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100356e3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1002eee6
add esp, 0x20
test eax, eax
jne 0x100356d1
push edi
call fcn.1002eb8a
jmp 0x100356d9
push ebx
call fcn.1002eb8a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10038120
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1002b93b
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1003818f
cmp esi, dword [ebp - 4]
je 0x1003818a
cmp dword [ebp + 0xc], 0
je 0x1003818a
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10038167
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.10037c72
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10038191
xor eax, eax
inc eax
jmp 0x10038191
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x100381f6
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10040080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1002b93b
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1002b93b
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1003826d
cmp word [ecx], dx
je 0x1003826d
mov eax, dword [0x1006554c]
push edi
dec eax
push eax
push 0x10065438
call fcn.10038195
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x100382e0
cmp word [eax], dx
je 0x100382e0
mov eax, dword [edi]
test eax, eax
je 0x10038291
cmp word [eax], dx
je 0x10038291
lea eax, [ebp - 0x10]
push eax
call fcn.10037b78
jmp 0x1003829a
lea eax, [ebp - 0x10]
push eax
call fcn.10037c13
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1003830a
mov eax, dword [0x10065434]
push dword [ebp - 0x14]
dec eax
push eax
push 0x10065128
call fcn.10038195
add esp, 0xc
test al, al
je 0x1003830a
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x100382d5
cmp word [eax], di
je 0x100382d5
lea eax, [ebp - 0x10]
push eax
call fcn.10037b78
pop ecx
jmp 0x1003830c
lea eax, [ebp - 0x10]
push eax
call fcn.10037c13
jmp 0x100382d2
mov eax, dword [edi]
test eax, eax
je 0x100382f7
cmp word [eax], dx
je 0x100382f7
lea eax, [ebp - 0x10]
push eax
call fcn.10037b2d
pop ecx
jmp 0x1003830a
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x100383d5
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1003801a
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100383d5
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x100383d5
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x100383d5
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10038362
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.100314bf
test ebx, ebx
je 0x100383d0
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.100314bf
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100383d5
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x100383d5
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1003c3df
add esp, 0x10
xor eax, eax
inc eax
jmp 0x100383d7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ceaa
leave
ret
Function at 0x1003c851
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1003c7cd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1003c9c0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1003c9c0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1003c975
jg 0x1003c8ad
test eax, eax
je 0x1003c96b
push 1
push 0x1000
call fcn.1002d4e0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1003c8d0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1003c962
push 0x8000
push ebx
call fcn.1003c6fe
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1003c8f9
jg 0x1003c8f4
cmp ecx, 0x1000
jb 0x1003c8f9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1002e143
add esp, 0x10
cmp eax, 0xffffffff
je 0x1003c93e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1003c8f4
jl 0x1003c925
test ecx, ecx
jne 0x1003c8e6
push dword [ebp - 0xc]
push ebx
call fcn.1003c6fe
push esi
call fcn.1002eb8a
add esp, 0xc
xor ebx, ebx
jmp 0x1003c9ce
cmp byte [edi + 0x24], 0
je 0x1003c955
cmp dword [edi + 0x20], 5
jne 0x1003c955
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1003c960
mov ebx, dword [edi + 0x18]
jmp 0x1003c962
xor ebx, ebx
push esi
call fcn.1002eb8a
pop ecx
jmp 0x1003c9ce
test ecx, ecx
jg 0x1003c937
jl 0x1003c975
test eax, eax
jae 0x1003c937
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.100332ca
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1003c995
cmp byte [edi + 0x1c], 0
je 0x1003c937
jmp 0x1003c9c6
push ebx
call fcn.10035fbf
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1003c937
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1003c9ce
cmp byte [edi + 0x1c], 0
je 0x1003c9cb
mov ebx, dword [edi + 0x18]
jmp 0x1003c9ce
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.100332ca
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1003e690
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003e6bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003e6bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4059bd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40fba0
cmp edx, dword [eax]
je 0x4059df
add eax, 8
inc ecx
cmp eax, 0x40fc30
jl 0x4059d0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40fba0]
jne 0x405b0d
mov eax, dword [0x41f1f0]
cmp eax, 1
je 0x405ae7
test eax, eax
jne 0x405a10
cmp dword [0x40faec], 1
je 0x405ae7
cmp edx, 0xfc
je 0x405b0d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x405a47
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004067c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00405e80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x405a8a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00405e80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40841c
push edi
call fcn.00406940
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004067c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004067d0
lea eax, [ebp - 0xa0]
push 0x4083fc
push eax
call fcn.004067d0
push dword [esi + 0x40fba4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004067d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004068b0
add esp, 0x2c
pop edi
jmp 0x405b0d
lea eax, [ebp + 8]
lea esi, [esi + 0x40fba4]
push 0
push eax
push dword [esi]
call fcn.00405e80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..retplne
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x6459422a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
mov ecx, 0x39a63c18
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10007340
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov byte [0xbd4b3629], al
dec ebx
invalid
invalid
xchg ebx, eax
xchg edx, edi
shr dword [edx], 1
dec ecx
loop 0x100072f4
mov bl, 0xa7
jle 0x100072ec
cld
or al, 0x80
inc ecx
pop es
jmp fcn.10007314

Function at 0x10007cb0
Capabilities:
Encode data using xor

Disassembly:
push edi
add ecx, eax
test dword [esi], edx
pop ss
wait
bound edx, qword [ecx + 0x61405ea2]
loopne 0x10007ca3
dec ebp

Function at 0x10008e50
Capabilities:
Encode data using add xor sub operations

Disassembly:
in al, 0xa3
sbb ebx, dword [esi + esi*2 + 0x29f24ae2]
nop
add dword [ecx + 0x5b8f718a], ecx

Function at 0x10008e60
Capabilities:
Encode data using add xor sub operations

Disassembly:
sub al, 0xf9
mov ebp, 0xf215a720
sub dh, bl
dec ebp

Function at 0x10008ec0
Capabilities:
Encode data using xor

Disassembly:
dec eax
arpl word [ebp + 0x5b081f8a], bp
lea edi, [eax - 0x24]
xchg esi, eax
leave
fucomp st(0)
loope 0x10008e72

Function at 0x100094d0
Capabilities:
Encode data using xor

Disassembly:
mov esp, dword [eax]
lea esi, [ecx - 0x14]
push esi
loope 0x10009491
iretd

Function at 0x1000a200
Capabilities:
Encode data using xor

Disassembly:
or dl, byte [ecx + 0x26]
rcr dword [esp + ebp*2], 1
ja 0x1000a18e
mul ebx
push cs
mov dword [0xb43476f], eax
xchg ebp, eax
jle 0x1000a1aa
Function at 0x11bf3194
Capabilities:
Encode data using xor

Disassembly:
jmp 0x11bf319e
pushal
call 0x11bf31a4
pop ebp
sub ebp, 0x10
sub ebp, 0x1bf3194
mov al, byte [esp + 0x28]
cmp al, 1
je 0x11bf31c8
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x11bf31d1
mov eax, 0x1bf3194
add eax, ebp
add eax, 0x63
mov ecx, 0x5be
mov edx, 0xdcee8c14
xor byte [eax], dl
inc eax
dec ecx
jne 0x11bf31e8
jmp 0x11bf31fb
lahf
fstp dword [edi + 0x1414289d]
adc al, 0x95
aad 0xec
adc al, 0x14
adc al, 0x17
fldcw word [edx + edx - 0x51ebebec]
adc al, 0x14
adc al, 0xae
cmp al, 0x14
adc al, 0x14
jecxz 0x11bf320d
pop ss
fcomp qword [edi + 0x14141895]
adc al, 0x17
rcr dword [ecx - 0x6217cf90], 1
adc byte [eax], dh
cdq
jo 0x11bf325b
call 0x8def42cd
js 0x11bf32a1
inc ebx
adc al, 0x7c
xor dword [edx + 0x38151573], esp
xor byte [eax + edx - 0x3c], bh
add bh, dh
cld
adc dword [esp + edx], edx
adc al, 0xfd
and byte [esp + edx], dl
adc al, 0x99
jo 0x11bf327e
call 0xb0ef6af0
clc
lahf
xchg ecx, eax
sbb al, 0x14
adc al, 0x14
lahf
sbb dword [eax], 0x9f141414
cdq
add al, 0x14
adc al, 0x14
aad 0xfd
push ss
and eax, 0x10d69716
pop ebp
sbb edx, dword [ecx - 0x14141420]
lahf
cmp byte [eax], dh
cdq
jo 0x11bf32ab
adc dh, dl
sbb byte [edi + ebx*4], dl
adc al, 0x9f
cwde
xor byte [eax], dl
adc al, 0x14
adc al, 0x7c
js 0x11bf32f8
inc ebx
adc al, 0x7c
xor dword [edx + 0x38151573], esp
xor byte [ebp - 4], al
adc dword [esp + edx], edx
adc al, 0xfd
sub edx, dword [esi]
adc al, 0x14
inc ecx
lahf
clc
jmp 0x11bf3304
adc al, 0x9f
test eax, 0x1414141c
xchg ebp, eax
in eax, 0x8e
das
jb 0x11bf3319
xchg ebp, eax
in eax, 0x8e
das
jb 0x11bf331f
daa
frstor dword [edi]
invalid
jmp 0x11bf3337
test eax, 0x3debebeb
inc eax
sub eax, 0x12d59716
xchg edi, eax
invalid
jmp 0x11bf3364
lahf
clc
inc edx
inc ebx
inc ecx
lahf
popal
sbb byte [edi - 0x5917e397], bl
xchg esp, eax
sahf
adc dl, byte [ebp + 0x141415d2]
adc al, 0x9c
adc edx, dword [ebp + 0x141415d3]
adc al, 0xaf
xchg ebp, eax
rcl dword [0xaf141414], cl
push ss
adc al, 0x14
adc al, 0x16
invalid
jle 0x11bf337a
adc al, 0x14
daa
aam 0x16
invalid
adc eax, 0xc6161414
sbb edx, dword [ecx + 0x14141411]
sahf
add dl, byte [edx + 6]
mov byte [edi], 0xd4
push ss
invalid
Function at 0x5ca024
Capabilities:
Packed with generic packer

Disassembly:
stc
jmp 0x5ca02b
pushal
clc
jae 0x5ca031
pop ss
push edx
call 0x5ca03a
aad 0xd7
in eax, dx
leave
pop esi
jmp 0x5ca044
add esi, 0xffffffca
jmp 0x5ca052
cmp dword [esi], 0
clc
jmp 0x5ca05a
je 0x5ca0ee
jae 0x5ca064
std
out dx, eax
mov ecx, esi
jmp 0x5ca070
out dx, eax
add esi, 4
jmp 0x5ca07d
mov edx, dword [esi]
jmp 0x5ca086
add edx, esi
stc
jb 0x5ca08e
sbb esp, esi
lcall 0x3306, 0xeb04468b
add bl, byte [esi - 0x7ef0ccdc]
sub bh, byte [ebp - 0x7f]
dec ecx
in eax, 0xeb
or byte [ebp + 0x36], al
adc al, 0x97
sub al, bl
lea edx, [edx - 0x7d]
ret 0xeb04
mov eax, dword [esi + 4]
jmp 0x5ca099
sub dword [edx], 0xe549817d
jmp 0x5ca0a9
add edx, 4
jmp 0x5ca0b6
sub eax, 1
clc
jae 0x5ca0bf
push 0x850ffbc4
int3
jne 0x5ca091
jmp 0x5ca0c9
add esi, 8
jmp 0x5ca0d2
sub dword [ecx], 1
stc
jmp 0x5ca0d9
jne 0x5ca073
jb 0x5ca0e3
jle 0x5ca06f
mov ebx, esi
jmp 0x5ca0e9
fsubp st(3)
add cl, byte [edx + 0xee847]
add byte [eax], al
call 0x5ca0fc
jmp 0x5ca0f2
popal
stc
jb 0x5ca0f7
mov ecx, 0xff3f14e9
dec dword [eax]
dec ebp
int 0xa8
add dword [ebx + eax*4], 0xd490fbe5
clc
or ch, al
dec ebp
outsb dx, byte [esi]
sbb dword [ebx - 0x7f7a5734], 0xd69d053
dec ebp
cmp dh, bh
insb byte es:[edi], dx
bound eax, qword [ebp - 0x5a317e67]
int1
invalid
jmp 0x5be010