joyce8/EMBER2024-capa huggingface dataset:
Function at 0x586780
Capabilities:
Encode data using xor

Disassembly:
pop edi
mov eax, 0x62185ba1
inc ebx
invalid
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd4000]
push edi
or ebp, 0xffffffff
jmp 0x5867a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5867a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x586798
mov eax, 1
add ebx, ebx
jne 0x5867bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5867cc
jne 0x5867eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867eb
dec eax
add ebx, ebx
jne 0x5867d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5867b0
add ebx, ebx
jne 0x5867e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x58683d
xor ecx, ecx
sub eax, 3
jb 0x586803
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x586872
sar eax, 1
mov ebp, eax
jmp 0x58680e
add ebx, ebx
jne 0x58680e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867dc
inc ecx
add ebx, ebx
jne 0x58681c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5867dc
add ebx, ebx
jne 0x586829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x58681e
jne 0x58683a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x58681e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x58685c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x58684e
jmp 0x58679e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x58685c
add edi, ecx
jmp 0x58679e
pop esi
mov edi, esi
mov ecx, 0x70e7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x58687a
cmp byte [edi], 0x11
jne 0x58687a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x58687f
lea edi, [esi + 0x17f000]
mov eax, dword [edi]
or eax, eax
je 0x5868f7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x186558]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x18667c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5868ac
mov ecx, edi
jns 0x5868db
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x186684]
or eax, eax
je 0x5868f1
mov dword [ebx], eax
add ebx, 4
jmp 0x5868c9
call dword [esi + 0x186680]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x586928
cmp al, 0xef
ja 0x58691b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5868fd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x58690a
mov ebp, dword [esi + 0x186688]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x58695c
sub esp, 0xffffff80
jmp 0x4e665b
Function at 0x10002d80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.1000b2dd
add esp, 4
test eax, eax
jne 0x10002e08
mov ecx, dword [ebp + 8]
push ecx
push 2
push 1
lea edx, [ebp - 4]
push edx
call fcn.1000b4ef
add esp, 0x10
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov al, byte [ebp + ecx - 4]
mov byte [edx], al
mov ecx, 1
imul edx, ecx, 0
movsx eax, byte [ebp + edx - 4]
cmp eax, 0xd
jne 0x10002de0
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov byte [ecx], 0
mov edx, 1
imul eax, edx, 0
movsx ecx, byte [ebp + eax - 4]
cmp ecx, 0xa
jne 0x10002dfd
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov byte [edx], 0
jmp 0x10002e08
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10002d8d
mov esp, ebp
pop ebp
ret
Function at 0x100040c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x40
push 0x16b5fff
mov ecx, dword [0x10027c20]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret

Function at 0x100040f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push eax
push 0x40
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp + 8]
call fcn.10005070
mov ecx, eax
call fcn.100010b0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x10004127
mov dword [ebp - 4], 1
jmp 0x1000412e
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10015227
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1001509d
Function at 0x40de6b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x415048]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00409a23
and dword [ebp - 0x14], 0
cmp dword [0x416cac], 0
mov dword [ebp - 0x18], eax
jne 0x40df1e
push 0x4122f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40dfc6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4122e4
push ebx
call edi
test eax, eax
je 0x40dfc6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4122d4
push ebx
mov dword [0x416cac], eax
call edi
push eax
call esi
push 0x4122c0
push ebx
mov dword [0x416cb0], eax
call edi
push eax
call esi
push 0x4122a4
push ebx
mov dword [0x416cb4], eax
call edi
push eax
call esi
mov dword [0x416cbc], eax
test eax, eax
je 0x40df1e
push 0x41228c
push ebx
call edi
push eax
call esi
mov dword [0x416cb8], eax
mov eax, dword [0x416cb8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40df77
cmp dword [0x416cbc], ecx
je 0x40df77
push eax
call esi
push dword [0x416cbc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40df77
test ebx, ebx
je 0x40df77
call edi
test eax, eax
je 0x40df6e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40df6e
test byte [ebp - 8], 1
jne 0x40df77
or dword [ebp + 0x10], 0x200000
jmp 0x40dfaa
mov eax, dword [0x416cb0]
cmp eax, dword [ebp - 0x18]
je 0x40dfaa
push eax
call esi
test eax, eax
je 0x40dfaa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40dfaa
mov eax, dword [0x416cb4]
cmp eax, dword [ebp - 0x18]
je 0x40dfaa
push eax
call esi
test eax, eax
je 0x40dfaa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x416cac]
call esi
test eax, eax
je 0x40dfc6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40dfc8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404558
leave
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x10a94ebe
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x535d63e8
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
mov esi, eax
test eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x484270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5a000]
push edi
or ebp, 0xffffffff
jmp 0x484292
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x484299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x484288
mov eax, 1
add ebx, ebx
jne 0x4842ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4842a0
jne 0x4842bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4842a0
xor ecx, ecx
sub eax, 3
jb 0x4842d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x484342
mov ebp, eax
add ebx, ebx
jne 0x4842db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x4842e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x48430c
inc ecx
add ebx, ebx
jne 0x4842f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4842ed
jne 0x484309
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4842ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48432c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48431d
jmp 0x48428e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48432c
add edi, ecx
jmp 0x48428e
pop esi
mov edi, esi
mov ecx, 0x124b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48434a
cmp byte [edi], 0x16
jne 0x48434a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48434f
lea edi, [esi + 0x81000]
mov eax, dword [edi]
or eax, eax
je 0x4843c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x954c0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x95534]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48437c
mov ecx, edi
jns 0x4843ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9553c]
or eax, eax
je 0x4843c1
mov dword [ebx], eax
add ebx, 4
jmp 0x484399
call dword [esi + 0x95538]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4843f8
cmp al, 0xef
ja 0x4843eb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4843cd
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4843da
mov ebp, dword [esi + 0x95540]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48442c
sub esp, 0xffffff80
jmp 0x4205e0
Function at 0x451933
Capabilities:
Encode data using xor

Disassembly:
and edi, eax
push ss
imul eax, ecx, 0x90a87c99
dec edx
pop edi
mov ecx, 0xadc13cb0
loope 0x4519a0
loop 0x451923
cdq
xchg edx, eax
outsb dx, byte [esi]
out 0xe, al
dec edx
or al, 0x3d
dec esp
daa
push esp
dec ecx
popal
sbb byte [0x529ae3a1], dh
xor al, 0x78
test al, 0x51
test al, 0xe8
and dword [ecx], ecx
stosb byte es:[edi], al
cmp al, 0x5c
jnp 0x45194a
cmp ah, dh
add ch, byte [ecx]
sbb bh, ah
retf 0xd264
fldenv [edi - 0x24]
int3

Function at 0x5817f5
Capabilities:
Encode data using xor

Disassembly:
sbb edi, eax
xchg dword [esp + ecx*8 + 0x6b84eb1a], ebp
in eax, dx
popfd
nop
int3
xor eax, 0x8d44379
jecxz 0x581745
invalid
mov ebp, 0x5298538
add dword [eax + 0x3d], eax
cmp al, 0x74
ret
jne 0x58173f
rcr edi, cl
fdivr st(0), st(0)
add cl, bh
mov bh, 0x9b
xor byte [esi], bl
mov bh, 0xc3
jne 0x581732
pop es
js 0x581807
hlt
std
nop
pop ebp
xchg edx, eax
push 0xd73f4d7d
jmp 0x581782
dec byte [ebp - 0xa1073e4]
ficomp word [esi + 0x59]
mov edi, 0x7ec3647e
invalid
je 0x581777
loopne 0x581798
popfd
imul ebp, ebp, 0x2c1ce230
xor dl, ah
sbb al, 0x2c
push es
jne 0x5817b8
cmp al, 0xd0
out 0xf, al
fcomp dword gs:[esi + 0x1dc211b9]
dec esp
sub eax, edx
int3
add al, 0x99
scasd eax, dword es:[edi]
xor eax, 0x14999388
cmp dword [ecx - 0x5f4cfc94], ecx
mov bl, 0xa0
push ebx
mov al, 0xc6
or al, 0xf1
int1
jle 0x581801
loopne 0x5817d8
xor dword [edi - 0x4f], 0xf61ce6b1
cmp dl, byte [ecx]
jno 0x581814
adc dword [ecx - 3], esi
jb 0x5817df
pop esp
or edi, 0xafd3b5b9
jne 0x58186a
shr dword [edi - 0x5fb2b78b], cl
int 0x85
and byte [esi + 0x69], bl
shr dword [ecx + 0x40], cl
aas
xor al, 0x38
sbb cl, byte [ecx*8 - 0x95502d3]
pop ebx
dec ebp
mov al, byte [0x5e2085cd]
imul edx, ebx, 0x343f4069
cmp byte [edx], bl
or al, 0xcd
sub eax, 0x5bf6aafd
mov dword [ecx - 0x7bad9eff], eax
sti
loop 0x58181e
pop esp
push eax
enter 0xffffffffffffec69, 0x68
mov word [edi], es
int3
in al, dx
push 0x3ecc078c
xor al, 6
push ebp
js 0x581872
add ebx, esi
scasb al, byte es:[edi]
jp 0x58180c
fdiv qword [edx]
fsubr qword [esi]
loopne 0x581830
in eax, dx
shr dword [ebp + 0xe], 1
int 0xe9
sub al, 0xce
pushfd
pop eax
xor dword [edx + esi*4 + 0x424cc654], edi
inc edx
loop 0x581844
clc
dec eax
stc
inc eax
pop esp
repe scasb al, byte es:[edi]
sub edx, dword [ebx]
std
cmp edx, dword [edi]
mov esp, 0x83997d9e
les ecx, [esp + eax*8 - 0x47]
sub eax, 0x68dd2c87
or bh, byte [ecx + 0x5a]
add cl, byte [esi]
invalid
Function at 0x5cb1a5
Capabilities:
Encode data using xor

Disassembly:
sbb byte [edx + 0x2a0f6e67], 0xf0
jae 0x5cb200
shl dword [ebx], 1
or esi, esi
test byte [ebx + eax*2 + 0x23b00b2f], 0x73
salc
adc dword [0x5e9fba2e], 0xfcbaf395
or dl, dl
add dword [edx], eax
jae 0x5cb1bc
adc eax, 0x5e9fba2e
xchg ebp, eax
mov edx, 0x1d20afc
add dh, byte [ebx - 0xf]
add bh, byte [edx - 0x5a]
bound edi, qword [ebp - 0x6d]
sar dword [ebp + 0x5a102711], 0x4f
mov ebp, 0x5a102711
dec edi
adc bl, byte [eax]
and eax, 0xa2c8155c
lahf
cmc
test byte [edx], ch
stosb byte es:[edi], al
and byte [ebx], ch
mov ebp, 0x3af6bbeb
lodsb al, byte [esi]
daa
and cl, 0x84
cdq
xor al, byte [ecx + 0x1f]
loop 0x5cb1d2
in eax, dx
pmullw mm4, qword [edx]
xor al, 0x23
xor eax, 0x1d332143
push 0xffffffffffffffe5
xchg ebp, eax
adc edx, 0xbe869270
mov ch, 0x8e
invalid
xor ebx, dword [0x8195e56a]
sal byte [eax - 0x6e], cl
xchg byte [esi - 0x2d21714b], bh
jl 0x5cb1c8
rcr dword [edx - 0x52deaa3c], 0x38
and eax, ebp
cmp al, 0x95
push edi
sub al, 0xa0
sar byte [0xc3456d91], cl
jge 0x5cb284
sbb byte [edx - 0x16ae606], bh
fsub dword [ecx]
xchg ecx, eax
sbb eax, 0xe143cfd3
lodsb al, byte [esi]
add dword [edi], ecx
fnstsw word [esi - 2]
aas
mov al, byte [0x5f68a1a9]
push ebp
inc ecx
sal dword [edx], cl
test edi, esp
cmc
inc dword [esi]
adc edi, eax
in al, dx
invalid
out dx, eax
test edi, 0x9d2c407d
xor eax, 0xc5912d82
das
das
int 0xf
int 0x87
outsb dx, byte [esi]
mov ah, 0x21
imul esi, dword [eax], 0x21a10296
push esp
adc esi, dword [ebp + 0x3314f9f]
xlatb
mov ch, 0x49
add dword [edi - 0x71c6bef0], ebx
iretd
Function at 0x64ec09
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64f2f0
push 0x64eb60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0xa51f8c], 0xffffffff
or dword [0xa51f90], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa51f88]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa51f84]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa51f94], eax
call fcn.0064ecef
cmp dword [0x651280], ebx
jne 0x64ebf3
push 0x64ecec
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064ecda
push 0x65100c
push 0x651008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa51f80]
pop ds
movsd dword es:[edi], dword [esi]
add byte [ecx + 0x458d9445], cl
xchg esp, eax
push eax
push dword [0xa51f7c]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x651004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64ec86
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64ec5a
cmp al, 0x22
jne 0x64ec4c
cmp byte [esi], 0x22
jne 0x64ec63
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64ec6d
cmp al, 0x20
jbe 0x64ec5f
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64ec91
movzx eax, word [ebp - 0x2c]
jmp 0x64ec94
cmp byte [esi], 0x20
jbe 0x64ec63
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64ec86
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401738
Capabilities:
Terminate process

Disassembly:
adc dl, byte [ebx]
sbb edx, dword [edx + 0x19181716]
sbb bl, dl
nop
nop
mov eax, ebp
nop
push edi
nop
nop
nop
nop
nop
nop

Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
push esi
mov esi, dword [ebp - 0x7f]
push esi
cmp al, byte [ebp - 0x78]
inc ebp
mov byte [edx + 0x78], ch
push eax
sbb al, byte [eax]
mov dword [eax], ebp
add bl, cl
dec ebp
or byte [ebx + 0x40c06a15], cl
add byte [eax + 0x51], dl
add edx, 0x40
repne lodsb al, byte [esi]
aam 0x40
add byte [edx + 0xb], dl
adc eax, 0x409080
mov eax, dword [0x74e702ac]
pop edx
les edx, [eax*4 + 0xc0f3ac0]
pushfd
push esp
rol byte [eax], cl
call dword [sym.imp.MSVCRT.dll_printf]
sbb dword [ebx + 8], 0xffffffdb
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
nop
nop
nop
nop
nop
nop
nop
nop
psrad mm2, qword [eax - 0x1357aac3]
push ebp
test al, 0xec
sub esp, 0x67
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x33], eax
call fcn.00406a00
mov dword [0x410ba0], eax
mov dword [esp], eax
or eax, dword [ecx]
rcr eax, cl
mov eax, dword [esi - 0x66]
test ebp, ebp
mov ebx, dword [ebx + 0x75]
inc eax
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
call fcn.00405970
shr dword [edi], 1
mov al, byte [0xbe1e0000]
cmp al, 8
add byte [ebp + 0x186fc7], dl
add byte [eax], al
add byte [ebx + 0x4117ecd4], cl
add byte [ecx + 0x60d7bc56], cl
jl 0x401f3b
or eax, 0x3b74c085
mov eax, dword [0x412c24]
stosd dword es:[edi], eax
retf 0xc803
lea ebx, [eax]
invalid
Function at 0x406a00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
nop
mov esi, dword [edx + 0x28]
nop
movzx ecx, word [edx + 0x26]
xor edi, edi
jmp 0x4069f6
xor eax, eax
lodsb al, byte [esi]
nop
cmp al, 0x61
nop
jl 0x406a20
nop
nop
jmp 0x406a10
sub al, 0x20
nop
jmp 0x406a20
nop
jmp 0x406a30
ror edi, 0xd
jmp 0x406a3e
add edi, eax
jmp 0x406a51
dec ecx
nop
jne 0x4069ec
nop
nop
push edx
nop
mov edx, dword [edx + 0x10]
mov eax, dword [edx + 0x3c]
add eax, edx
nop
jmp 0x406a76
push edi
nop
jmp 0x406a86
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
jmp 0x406a99
je 0x406c78
jmp 0x406aab
add eax, edx
push eax
nop
jmp 0x406abd
mov ebx, dword [eax + 0x20]
nop
add ebx, edx
mov ecx, dword [eax + 0x18]
nop
jmp 0x406ad8
test ecx, ecx
nop
jmp 0x406ae8
je 0x406c52
nop
jmp 0x406af9
dec ecx
xor edi, edi
nop
jmp 0x406b09
mov esi, dword [ebx + ecx*4]
nop
jmp 0x406b19
add esi, edx
xor eax, eax
jmp 0x406b2b
ror edi, 0xd
jmp 0x406b3f
lodsb al, byte [esi]
nop
jmp 0x406b52
add edi, eax
nop
cmp al, ah
jmp 0x406b65
jne 0x406b1b
jmp 0x406b76
nop
jmp 0x406b83
add edi, dword [ebp - 8]
nop
cmp edi, dword [ebp + 0x24]
nop
jne 0x406ac6
jmp 0x406ba1
jmp 0x406baf
pop eax
jmp 0x406bbe
mov ebx, dword [eax + 0x24]
jmp 0x406bd2
add ebx, edx
jmp 0x406be6
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
jmp 0x406bff
add eax, edx
jmp 0x406c13
mov dword [esp + 0x24], eax
jmp 0x406c25
pop ebx
pop ebx
nop
popal
nop
pop ecx
jmp 0x406c3d
pop edx
nop
push ecx
jmp eax
nop
jmp 0x406c67
pop eax
jmp 0x406c78
nop
jmp 0x406c8d
pop edi
nop
pop edx
mov edx, dword [edx]
jmp 0x406ca0
jmp 0x4069e1