joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4014e1
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
push eax
and esi, 0x300
mov eax, esi
or eax, 9
push eax
push dword [ebp + 0xc]
and edi, 1
push dword [ebp + 8]
call fcn.00406322
xor ebx, ebx
cmp eax, ebx
jne 0x4015c5
test byte [ebp + 0x10], 2
je 0x401543
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4015aa
push 0x105
lea eax, [ebp - 0x214]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x40157f
test edi, edi
jne 0x4015aa
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.004014e1
test eax, eax
jne 0x401588
push 0x105
lea eax, [ebp - 0x214]
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x401558
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.0040663c
test eax, eax
jne 0x4015ba
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4015c5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x4015c5
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405e79
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
and dword [ebp - 0x14], 0
and dword [ebp - 4], 0
push 4
pop eax
mov word [ebp - 0x1e], ax
mov eax, 0x408898
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
mov byte [ebp - 0x20], 1
mov byte [ebp - 0x1f], 0
mov dword [ebp - 0x10], 0x408888
mov dword [ebp - 0xc], 0xc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x405eca
xor eax, eax
jmp 0x405ef7
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0xb7
jne 0x405ef6
lea eax, [ebp - 0x20]
push eax
push 0x80000007
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
je 0x405ef4
xor eax, eax
jmp 0x405ef6
call esi
pop esi
leave
ret 4

Function at 0x405f18
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x42ed78
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x42ed78], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405f57
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405f5b
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
push eax
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406126
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406146
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x40614c
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x40617b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x408974]
mov dword [ebp - 8], eax
mov eax, dword [0x408978]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x4061cb
test edi, edi
jne 0x406188
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x4061c5
Function at 0x406383
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x800
push dword [ebp + 8]
call fcn.00406322
mov esi, dword [ebp + 0x14]
test eax, eax
jne 0x4063f4
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test edi, edi
mov word [esi + 0x7fe], ax
pop edi
jne 0x4063f4
cmp dword [ebp + 0xc], 1
je 0x4063f9
cmp dword [ebp + 0xc], 2
je 0x4063f9
xor eax, eax
mov word [esi], ax
pop esi
leave
ret 0x14

Function at 0x4065cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065f0
xor eax, eax
test eax, eax
je 0x406603
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406603
xor ecx, ecx
jmp 0x406606
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x4082b0]
push ecx
lea eax, [ebp + eax*2 - 0x23c]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40673f
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.00406126
mov edi, eax
cmp edi, 0xffffffff
je 0x406780
test byte [esp + 0x10], 1
push esi
je 0x406769
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x406771
xor eax, eax
inc eax
jmp 0x406782
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406760
test byte [esp + 0x10], 4
jne 0x406780
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x40682a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42edc0
push esi
call fcn.004064b7
push esi
call fcn.0040604f
mov edi, eax
test edi, edi
jne 0x40684b
xor eax, eax
jmp 0x4068a9
push edi
call fcn.004064f4
test byte [0x434a70], 0x80
je 0x406868
movzx eax, word [edi]
test ax, ax
je 0x406847
cmp ax, 0x5c
je 0x406847
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x40688a
push esi
call fcn.004065a5
test eax, eax
je 0x406884
test byte [eax], 0x10
je 0x4068ae
push esi
call fcn.004067b6
push esi
call ebx
cmp eax, edi
jg 0x406875
push esi
call fcn.00406787
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4068a8
Function at 0x406af5
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov dword [0x42f5c0], 0x55004e
mov dword [0x42f5c4], 0x4c
mov edi, 0x400
mov ebp, 0x42f5c0
test esi, esi
je 0x406b4b
push 1
push 0
push esi
call fcn.0040614c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406c6a
cmp eax, edi
jg 0x406c6a
push edi
mov esi, 0x430c10
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406c6a
cmp eax, edi
jg 0x406c6a
push esi
push ebp
push str._ls_ls_r_n
push 0x430010
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x434a0c]
push dword [eax + 0x128]
push esi
call fcn.004068b2
push 4
push 0xc0000000
push esi
call fcn.0040614c
mov ebp, eax
mov dword [esp + 0x18], ebp
cmp ebp, 0xffffffff
je 0x406c6a
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406c63
push edi
push esi
push ebp
call fcn.004061cf
test eax, eax
je 0x406c63
push str._Rename__r_n
push esi
call fcn.004060ac
test eax, eax
jne 0x406c01
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406c36
push 0x4089a4
add eax, 0xa
push eax
call fcn.004060ac
mov ebp, eax
test ebp, ebp
je 0x406c32
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406c23
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406c1d
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x406c38
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
push 0x430010
add eax, esi
push eax
call fcn.00406102
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004061fe
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406c6f
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406c92
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406af5
pop ecx
pop ecx
inc dword [0x434ad0]
ret 8
Function at 0x406c9b
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.0040682a
mov dword [ebp - 8], eax
test bl, 8
je 0x406cd9
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x434ac8], eax
jmp 0x406e5b
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push esi
je 0x406cf4
test eax, eax
je 0x406e07
test bl, 2
je 0x406e07
push edi
mov esi, 0x430410
push esi
call fcn.004064b7
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406d16
push str..
push esi
call ebx
jmp 0x406d1c
push edi
call fcn.004067b6
cmp word [edi], 0
jne 0x406d2c
cmp word [0x430410], 0x5c
jne 0x406d34
push 0x4082b0
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406dfb
cmp word [ebp - 0x22c], 0x2e
jne 0x406d7f
cmp word [ebp - 0x22a], 0
je 0x406dde
cmp word [ebp - 0x22a], 0x2e
jne 0x406d7f
cmp word [ebp - 0x228], 0
je 0x406dde
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.004064b7
test byte [ebp - 0x258], 0x10
je 0x406daa
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406dde
push dword [ebp + 0xc]
push edi
call fcn.00406c9b
jmp 0x406dde
push dword [ebp - 4]
push edi
call fcn.0040673f
test eax, eax
jne 0x406dd6
cmp dword [ebp - 4], eax
je 0x406dce
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push 0
push edi
call fcn.00406c6f
jmp 0x406dde
inc dword [0x434ac8]
jmp 0x406dde
push edi
push 0xfffffffffffffff2
call fcn.004051f2
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406d57
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406e07
xor eax, eax
mov word [ebx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406e5a
cmp dword [ebp - 8], esi
je 0x406e4a
push edi
call fcn.004065a5
test eax, eax
je 0x406e5a
push edi
call fcn.00406787
mov eax, dword [ebp - 4]
or eax, 1
push eax
push edi
call fcn.0040673f
test eax, eax
jne 0x406e52
cmp dword [ebp - 4], esi
je 0x406e4a
push edi
push 0xfffffffffffffff1
call fcn.004051f2
push esi
push edi
call fcn.00406c6f
jmp 0x406e5a
inc dword [0x434ac8]
jmp 0x406e5a
push edi
push 0xffffffffffffffe5
call fcn.004051f2
pop esi
pop edi
pop ebx
leave
ret 8
Function at 0x406e61
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x431414], 0
jne 0x406e9f
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406e75
mov dword [ecx*4 + 0x431410], eax
inc ecx
cmp ecx, 0x100
jl 0x406e70
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406ecc
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x431410]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ead
not eax
pop ebp
ret 0xc
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6357e0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6357e0], eax
test eax, eax
pop ebx
je 0x417cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x6357e0]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x6357dc], eax
call esi
mov ecx, dword [0x6357dc]
mov dword [0x6357e4], eax
test ecx, ecx
je 0x417cc7
test eax, eax
je 0x417cc7
mov eax, 1
pop esi
add esp, 0x50
ret
mov dword [0x6357e0], 0
xor eax, eax
pop esi
add esp, 0x50
ret

Function at 0x43a3cb
Capabilities:
Encode data using xor

Disassembly:
pop es
lahf
and al, 0xa9
xchg edi, eax
iretd
jl 0x43a384
xchg ebx, eax
jne 0x43a44c
adc al, 0xed
cmpsd dword [esi], dword es:[edi]
daa
inc esp
rcr byte [esi], cl
inc ebp
in al, dx
ficom dword [edi - 0x25]
wait
adc byte [esi - 0x1e76e84f], 0x41
push edx
cmp bh, dl
lodsd eax, dword [esi]
shl byte [ecx - 0x3e], cl
xchg ebx, eax
invalid
and dword [ecx + 0x697cdc4a], 0x3466d067
pop es
and byte [edi - 0x386d542e], 0x52
salc
invalid
Function at 0x46802b
Capabilities:
Encode data using xor

Disassembly:
pop edx
mov ebx, 0xae3325a0
add eax, 0x3225954e
dec ebp
in eax, dx
out 0x63, eax
pop ebp
push esp
jp 0x46802c
loop 0x467ff8
movsd dword es:[edi], dword [esi]
mov byte [0xdb0e8804], al
test eax, 0xc9712353
adc eax, 0xd16ab28d
test dword [esi + 1], 0xd47f070a
lea esi, [edx + 0x4ef7d16a]
add dword [edx], ecx
pop es
jg 0x467f9a
enter 0x601, 0x41
popfd
inc ebp
lodsd eax, dword [esi]
xchg dword [ebx], esp
daa
div byte [ebx - 0x56]
and eax, 0x4155080b
xchg edx, eax
popal
test byte [edx + esi*4 + 0x3f1828a], bh
pop edi
enter 0x6368, 0x79
xlatb
jp 0x467fbb
add ebx, dword [edi - 0x38]
push 0x67d77963
jp 0x467fbb
mov ebx, 0xba90c203
sbb byte es:[ebx + 0x4f], 0x61
xchg esi, eax
mov dword [eax], ebx
movsb byte es:[edi], byte [esi]
jae 0x468024
sub dl, byte [ecx]
int1
adc ecx, esi
loope 0x46802e
sbb al, 0xd2
into
inc ecx
push ebp
and ecx, dword [ebx + 0x7c34b60d]
nop
cmp eax, 0xf16cb0f6
fdiv st(3), st(0)
pop esi
sti
sbb bh, bh
and cl, byte [edx + 0x6c]
sahf
leave
ror edx, 1
fbld tbyte [eax + 0x44e1793f]
lodsb al, byte [esi]
add byte [esi - 0x20821af8], 0x99
push esi
and al, cl
xchg edi, eax
cmc
xchg ebp, eax
mul dword [ecx]
xor byte [edx + 0x45706b6d], ah
sub dword [ecx - 0x652da249], ecx
add eax, dword [ecx + 0x17]
push es
mov ch, 0x4d
adc byte [edx + eax*4 - 0x77], ch
and edx, dword [ecx]
arpl word [edi - 0x5f], cx
lea eax, [edx + 0x653d2fbf]
enter 0x636d, 0xffffffffffffff8f
test al, 0x9b
ja 0x467fe0
insd dword es:[edi], dx
arpl word [edi - 0x7d886458], cx
jo 0x468014
je 0x467ff9
shr byte [eax + 0x713388e6], 0x7c
inc ebx
and ah, byte [ecx]
xor byte [ebx + edi*8], bh
aaa
insb byte es:[edi], dx
loopne 0x468057
jmp 0x3ef981b6

Function at 0x46df5a
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
cmp ah, byte [edi - 0x3dda0c4a]
invalid
sahf
jbe 0x46dfd5
scasd eax, dword es:[edi]
xor esp, dword [ebp + 0x1298272f]
jmp 0x46df10
dec ecx
daa
xchg ebx, eax
cdq
mov eax, 0xe2bc7a6b
sub al, 0xf3
jmp 0x46dfd7
mov bl, 0x7a
wait
xor byte [ecx - 0x2c48a210], bl
inc esi
cli
je 0x46df96
invalid
jae 0x46e051
adc byte [ecx + ecx*8 - 0x22a6ea1a], ah
cli
sbb dword [eax + 0x589c8817], 0x32
or bl, byte [esi]
mov al, 0x62
jo 0x46dfbe
push ss
cmp cl, byte [edx + 0x2d]
lcall 0xc4b9, 0xa6f8c4eb
dec eax
lahf
dec edi
std
aam 0x22
rol byte [esi + 0x2f09e535], cl
xchg ecx, eax
cmp eax, 0x9046d487
jmp 0x61c88973
fnstsw word [eax + 0x1b0bceab]
aam 0x43
pop ds
inc esp
test dword [eax], eax
scasd eax, dword es:[edi]
lea ebp, [edi - 0x40774a13]
invalid
mov byte [edi + 0x48eb0f8f], bh
xor byte [esi], ah
aam 0xbb
xor cl, byte [ecx + edi*8]
pop ds
out 0x47, eax
cdq
sbb byte [edi], ah
comiss xmm4, dword [edi - 0x17]
stosd dword es:[edi], eax
aad 0x6d
fstp dword [edx]
loopne 0x46e040
cmp al, 0x2c
pop es
sar byte [ebp - 0x3a3e9c0], 1
and dword [edx + 0x54], ebx
retf
Function at 0x48950e
Capabilities:
Encode data using xor

Disassembly:
invalid
mov edx, 0x606c0ed4
int3
mov bl, 0x42
or esi, dword [esi + 0x2cff7f21]
fsub st(3)
out dx, al
lodsd eax, dword [esi]
jno 0x4894a1
dec ecx
das
ret 0x195a
add al, 0xa5
jecxz 0x489586
and byte [ecx], ch
xor eax, 0x64744cbe
push eax
mov esi, 0x5064744c
dec edi
push esp
and dword [esi], esp
cmc
js 0x489549
bound esp, qword [ecx - 0x457b0df0]
je 0x4894d4
or eax, dword fs:[edx - 0x7c]
outsb dx, byte [esi]
dec esp
jbe 0x4894c0
pop edi
dec ecx
rol edx, 1
sbb edi, edx
dec ecx
xor esi, dword [esi - 0x21816ca3]
mov byte [0xa9c42874], al
pop ebx
loop 0x489516
push edi
invalid
into
lahf
mov cs, word [ecx - 0x15]
adc dword [ebx], 0x1539b71
dec esi
xor ebp, dword [0xe77abcae]
movsb byte es:[edi], byte [esi]
jo 0x489617
xchg ebp, eax
and byte [ebp - 0x35ff8290], 0x1b
adc edx, dword [ecx - 0x3b10691b]
test al, 0xe4
xchg ebp, eax
push edi
dec eax
inc esp
mov al, byte [0xe7f2299a]
inc eax
fistp qword [eax + 0x70]
cdq
inc esi
add byte [esp + esi*2 + 0x12], bh
jo 0x489602
fcomp st(0)
xchg edx, eax
hlt
mov dh, 0xc8
invalid
das
dec esp
adc al, 0xa1
xor byte [eax + 0x2133f5fb], dl
adc byte [ebp - 0x1ed5de75], bh
and dword [eax], edx
mov ebp, 0xe12a218b
xor dword [ecx], ebx
jecxz 0x48960e
test eax, 0x8f1052d9
and eax, 0x505c8af1
jns 0x489698
lodsd eax, dword [esi]
pop edi
retf 0xaca
or eax, 0x4b8d5afd
jbe 0x4896d9
inc ebp
retf
dec ecx
push 0x1d
pushfd
cmp byte [eax + 0x2c], dl
adc ecx, dword [eax + 0x1ab4ab6]
test ebp, edi
aas
xchg esp, eax
dec edx
dec ebx
pop ebp
xlatb
pop esi
and eax, 0x1e62842a
call 0x7688edb3
adc eax, 0xc0d715bd
mov eax, 0x9de55e06
invalid

Function at 0x498d91
Capabilities:
Encode data using xor

Disassembly:
xor eax, dword [edx - 0x3ce20264]
sub byte fs:[ecx + edi*4 - 4], bl
test eax, 0x71bf7147
cmp dword [ecx + 0x1c], edx
fcom dword [eax]
mov al, 0xc5
and ecx, dword [ecx]
je 0x498ddf
mov ch, 0x9c
aam 0x5c
jno 0x498db3
call dword [0x55783d2d]
adc eax, 0x55783d2d
lds edx, [ecx + 0x75]
add eax, 0x6d7c91fa
imul ebp, dword [ecx], 0xd13b1556
wait
int 0x74
mov ah, 0xe2
hlt
xlatb
mov ah, 0x47
std
fsub st(3), st(0)
dec ebx
invalid
Function at 0x628d45
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323b0
cmp edx, dword [eax]
je 0x628d67
add eax, 8
inc ecx
cmp eax, 0x632440
jl 0x628d58
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323b0]
jne 0x628e95
mov eax, dword [0x636d8c]
cmp eax, 1
je 0x628e6f
test eax, eax
jne 0x628d98
cmp dword [0x6322dc], 1
je 0x628e6f
cmp edx, 0xfc
je 0x628e95
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628dcf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629730
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629bc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628e12
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629bc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea3c
push edi
call fcn.0062ba90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629730
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629740
lea eax, [ebp - 0xa0]
push 0x62ea1c
push eax
call fcn.00629740
push dword [esi + 0x6323b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629740
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062ba04
add esp, 0x2c
pop edi
jmp 0x628e95
lea eax, [ebp + 8]
lea esi, [esi + 0x6323b4]
push 0
push eax
push dword [esi]
call fcn.00629bc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret