joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407459
Capabilities:
Get common file path
Query environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
lea eax, [ebp - 8]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_time]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
pop ecx
mov edx, eax
pop ecx
mov edi, 0x40dde4
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp - 0x20c]
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor edi, edi
cmp edx, edi
je 0x4074cd
push edx
call dword [sym.imp.MSVCRT.dll_asctime]
cmp eax, edi
pop ecx
je 0x4074cd
push eax
lea eax, [ebp - 0x20c]
push str._n_s::
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov ebx, 0x104
lea eax, [ebp - 0x10c]
push ebx
push eax
push str.TMPDIR
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
test eax, eax
jne 0x4074ff
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40750d
lea eax, [ebp - 0x10c]
push 0x40d558
push eax
call esi
lea eax, [ebp - 0x10c]
push str.jusched.log
push eax
call esi
push edi
push 0x80
push 4
push edi
push 2
lea eax, [ebp - 0x10c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407591
push 2
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push edi
push eax
lea edi, [ebp - 0x20c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x20c]
not ecx
dec ecx
push ecx
push eax
push ebx
call esi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push 0
push eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push dword [ebp + 8]
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407596
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x409350
push 0x4080f6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 0x94
push 0x24
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xa0], 2
jne 0x407635
cmp dword [ebp - 0xac], 5
jb 0x407635
mov dword [ebp - 4], esi
push 0x40d568
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xb4], eax
cmp eax, esi
je 0x40762c
push 0x40d574
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40762c
mov dword [ebp - 0x1c], 1
or dword [ebp - 4], 0xffffffff
call fcn.00407647
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407808
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 1
push esi
push 0x40d5e4
push 0x80000002
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407869
lea eax, [ebp - 8]
push edi
push eax
lea eax, [ebp - 0x208]
push eax
push esi
push esi
push str.ITCONFIG
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x407869
movzx esi, byte [ebp - 0x208]
mov eax, esi
pop esi
leave
ret

Function at 0x407881
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
xor esi, esi
mov dword [ebp - 4], 0x200
call fcn.0040786e
test eax, eax
jne 0x407925
call fcn.00404f5d
test eax, eax
je 0x407925
lea eax, [ebp - 0xc]
push eax
push 1
push esi
push 0x40d618
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407928
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
push 0x40d640
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xc]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
pop edi
jne 0x407928
mov dword [ebp - 8], esi
call fcn.00407596
test eax, eax
je 0x40791a
lea eax, [ebp - 8]
push 4
push eax
lea eax, [ebp - 0x20c]
push dword [ebp - 4]
push eax
call fcn.0040765d
mov eax, dword [ebp - 8]
add esp, 0x10
jmp 0x407920
mov eax, dword [ebp - 0x20c]
cmp eax, 0x64
jne 0x407928
push 1
pop esi
mov eax, esi
pop esi
leave
ret

Function at 0x40792d
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 2
push 0
push 0x40d658
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407964
push 0x40d680
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x407966
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREJavaSoftJava_UpdatePolicy
push 0x80000001
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x64
mov dword [ebp - 0xc], 0x200
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4079f9
call fcn.00407596
test eax, eax
je 0x4079cc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.00407721
add esp, 0x10
jmp 0x4079d5
mov eax, dword [ebp - 8]
mov dword [ebp - 0x210], eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x210]
push eax
push 3
push esi
push str.EnableAutoUpdateCheck
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret
Function at 0x4081ca
Capabilities:
Encode data using xor

Disassembly:
cmp esi, 0x8d30
jno 0x40814c
xchg edx, ebx
imul ebx, edi, 0xda141608
dec ebx
test bh, cl
cmp ecx, 0xf989
mov esi, ecx
push 0x75dc02
push 0x68728b
inc dl
cmp ebp, 0x43cb
ja 0x408176
mov bh, 0xc8
neg dh
xchg bl, dh
call 0x4081ca
mov edi, ecx
inc edx
mov ebx, 0x5b72aa3e
push 0x1da40
pop ebp
lea edx, [0xcf30a0ff]
xor ebp, 0x1d6c3
movzx esi, cl
xchg ecx, eax
push 0xb998b
bswap edx
pop esi
imul ecx, ecx, 0xb9a362e
mov dh, 0xa4
sub ebp, esi
add ebp, 0xb998a
test dl, dh
js 0x4081c2
sbb ecx, 0x621829c7
xchg dl, bl
cmp ebp, 0x618
jae 0x408198
pop ebp
cmp eax, 0x40023d32
jae 0x4081e0
bswap edi
cmp esi, 0x6b7f11a6
imul edx, ebx, 0xb2aad77e
je 0x4081ec
dec ebx
movzx eax, si
imul eax, edx, 0xfe0c6d5
mov bl, 0x9b
adc dh, 0x51
push 0xfffff8b7
cmp dh, 0xe1
pop edx
add edx, 0x749
xor edx, edi
mov ebx, edx
cmp ebx, esi
jne 0x40820a
mov edx, ecx
imul edx, esi, 0x9180fc98
xchg edx, edx
dec edx
mov edx, 0x2c
imul edx, edx, 0x29d0
push 0xfff22018
dec al
pop eax
add eax, 0xddfe8
mov eax, edx
test esi, 0xf504de50
xor eax, 0x72fc0
lea edx, [0xf825cbc0]
xchg ebx, eax
test dh, 0x29
sbb ebx, 0xb21df6e2
lea edi, [eax]
lea esi, [edi]
add eax, 0x5bd69f6e
jbe 0x408258
mov eax, eax
bswap edi
mov ecx, esi
neg dh
xchg eax, edx
mov esi, 0x87231f53
or bh, ch
mov ecx, 0
dec edx
imul eax, esi, 0x3108f909
xor eax, 0xa98313ae
bswap edx
imul esi, edx
mov eax, 0xffff42a3
xor eax, 0xdf73
imul ebx, ecx
xor eax, 0x61a9
lea ebx, [0xbe00f7a4]
xadd ecx, eax
mov eax, 0xadb259ae
add ecx, 0x388
mov al, 0x8b
imul edx, eax, 0xcf91298e
mov ebx, 0xb7b740e8
cmp ecx, 0x365
jb 0x40826b
movd mm4, ebp
jo 0x4082c2
imul esi, edi, 0x555fad0e
jmp 0x4082c7
cmp esi, ebx
push esi
bswap esi
pop ecx
jno 0x4082d4
mov esi, 0x159be490
movd esi, mm4
mov ah, ah
and al, 0x89
add esi, 0x408d7
adc bl, dh
sub esi, 0x37960
jmp 0x4082f1
push 0x381f4
add al, 0x4d
je 0x4082fc
mov bh, 0x53
mov ebp, 0x5ce003ab
inc dh
cmp ecx, 0x2fc1
xchg cl, al
or al, 0xf3
push 0x7e8fcc
test edx, 0x67e7f3b5
push esi
imul ebp, esi
ret
Function at 0x94b2a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x305000]
push edi
jmp 0x94b2ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x94b2c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94b2b0
mov eax, 1
add ebx, ebx
jne 0x94b2d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x94b2e4
jne 0x94b303
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94b303
dec eax
add ebx, ebx
jne 0x94b2f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x94b2c8
add ebx, ebx
jne 0x94b2ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x94b355
xor ecx, ecx
sub eax, 3
jb 0x94b31b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x94b38a
sar eax, 1
mov ebp, eax
jmp 0x94b326
add ebx, ebx
jne 0x94b326
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94b2f4
inc ecx
add ebx, ebx
jne 0x94b334
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x94b2f4
add ebx, ebx
jne 0x94b341
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x94b336
jne 0x94b352
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x94b336
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x94b374
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x94b366
jmp 0x94b2b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x94b374
add edi, ecx
jmp 0x94b2b6
pop esi
mov edi, esi
mov ecx, 0x9d4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x94b392
cmp byte [edi], 0x16
jne 0x94b392
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x94b397
lea edi, [esi + 0x541000]
mov eax, dword [edi]
or eax, eax
je 0x94b40f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x54b874]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x54b978]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x94b3c4
mov ecx, edi
jns 0x94b3f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x54b97c]
or eax, eax
je 0x94b409
mov dword [ebx], eax
add ebx, 4
jmp 0x94b3e1
call dword [esi + 0x54b98c]
mov ebp, dword [esi + 0x54b980]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x94b443
sub esp, 0xffffff80
jmp 0x42f51d
Function at 0x410849
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x419004]
jne 0x410853
repz ret
jmp fcn.00410a09

Function at 0x412ad3
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004119b7
and dword [ebp - 4], 0
cmp dword [0x43e108], 0
mov ebx, eax
jne 0x412b84
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412c35
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x412c35
push eax
call fcn.00411945
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43e108], eax
call esi
push eax
call fcn.00411945
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43e10c], eax
call esi
push eax
call fcn.00411945
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43e110], eax
call esi
push eax
call fcn.00411945
pop ecx
mov dword [0x43e118], eax
test eax, eax
je 0x412b84
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411945
pop ecx
mov dword [0x43e114], eax
mov eax, dword [0x43e114]
cmp eax, ebx
je 0x412bdc
cmp dword [0x43e118], ebx
je 0x412bdc
push eax
call fcn.004119c0
push dword [0x43e118]
mov esi, eax
call fcn.004119c0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412bdc
test edi, edi
je 0x412bdc
call esi
test eax, eax
je 0x412bd3
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412bd3
test byte [ebp - 0xc], 1
jne 0x412bdc
or dword [ebp + 0x10], 0x200000
jmp 0x412c15
mov eax, dword [0x43e10c]
cmp eax, ebx
je 0x412c15
push eax
call fcn.004119c0
pop ecx
test eax, eax
je 0x412c15
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412c15
mov eax, dword [0x43e110]
cmp eax, ebx
je 0x412c15
push eax
call fcn.004119c0
pop ecx
test eax, eax
je 0x412c15
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43e108]
call fcn.004119c0
pop ecx
test eax, eax
je 0x412c35
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412c37
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xd65058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd651a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd6507e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6506a
add dl, dl
jne 0xd65089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd650dc
xor eax, eax
add dl, dl
jne 0xd65096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd6517d
add dl, dl
jne 0xd650a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd650b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd650bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd650c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd650d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd65075
mov eax, 1
add dl, dl
jne 0xd650ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd650f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd650e1
sub eax, ebx
mov ebx, 1
jne 0xd65128
mov ecx, 1
add dl, dl
jne 0xd6510e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd65119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd65105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd65075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd6513f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd6514a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd65136
cmp eax, 0x7d00
jae 0xd6516d
cmp eax, 0x500
jb 0xd65168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd65075
cmp eax, 0x7f
ja 0xd65170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd65075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd6519e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd65075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x455ed5
Capabilities:
Encode data using xor

Disassembly:
push ecx
cmpsd dword [esi], dword es:[edi]
dec eax
out 0xd4, eax
retf 0xbbc6
mov bl, 0xe1
int 0xcf
fisttp dword [esi - 0xe]
les ebp, [ebp - 0x3afad327]
lds eax, [ebp + 0x27]
invalid
add ebx, eax
and byte [edx + 0x41010e1], ch
ja 0x455eb7
mov ah, 0xcb
cli
xchg edx, eax
xchg dl, ch
jo 0x455e88
clc
mov al, ch
leave
mov dword [edx], edx
cmpsd dword [esi], dword es:[edi]
mov ecx, 0x7ac3d6cd
dec esp
cmpsd dword cs:[esi], dword es:[edi]
pop edx
cwde
mov ecx, 0x835e6a3f
inc ebp
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
pop edx
call 0xfc910f91
rcr edx, 0xd2
insd dword es:[edi], dx
nop
pop ebx
bound eax, qword [edi - 0x3a]
add bh, byte [ecx + 0x5e]
pop esi
fcomp qword [ebx + 0x5a]
cmp edi, dword [esp + ebx*8]
mov dword [0xd7806f9d], eax
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
shl byte [edx], 0x43
jb 0x455f3a
or bh, byte [edx - 0xcaf1026]
aad 0x15
call 0x59f72841
xor ch, dh
push 0xfffffffffffffffd
fidiv dword [eax]
test dword [edi + 0x61], ebx
sbb dword [ebx + 0x5c44f4f1], ebx
sbb ebp, dword [edi + eax*2 - 0x24]
or dword [0x5ad5d4e2], ebx
invalid

Function at 0x481882
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
add dword [edx + ecx*4 - 0x62d79884], eax
out dx, al
mov word [eax], cs
add eax, 0x1a68fa9d
jg 0x4818a8
shl byte [esp + edx*4 + 0x77], 1
salc
mov ebx, 0xd87883d2
jg 0x48190f
cmp dword [eax - 0x28], 0x7f
outsd dx, dword [esi]
fdivrp st(1)
cli
add byte [0x3e94bda0], bh
cmp eax, 0x3e94bda0
push edx
push edx
lcall 0xf849, 0x8c43c6d4
std
jb 0x4818c9
push edx
and dword [edx + 0x31], esi
bound ebp, qword [eax + edx*8 - 0x76e9c950]
rcr byte [edx], 1
xchg ebx, eax
fldcw word [edx]
sub al, 0x1f
out dx, eax
out 0xea, al
xor dl, al
xor byte [edi - 0x30], ch
xor esp, 0x5f
adc byte [ebx - 0x35], al
aas
je 0x48189b
test dword [esi], 0x670d645b
invalid
jb 0x4818a4
invalid

Function at 0x496b53
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x67ecb2a7
or dword [ebx + eax*4], 0xffffffbe
sahf
jl 0x496bc6
push 0xffffffffffffff9e
sub byte [edi], al
in al, dx
sbb cl, ch
outsb dx, byte [esi]
push edx
mov ebp, 0x6ea40d53
stc
cmpsd dword cs:[esi], dword es:[edi]
test eax, 0x9f95cde4
mov al, byte [ebx]
pop ds
xor cl, dl
lahf
xchg esp, eax
cmc
adc al, byte [ecx + 0xefbafd1]
leave
lds edi, [ebp + 0x31]
cmp byte [edi - 0x53d2d701], cl
mov cl, 0x47
xchg edi, eax
mov bh, 0x1a
adc esp, ebp
pop ebp
jns 0x496b65
jmp 0x5406bdd8
fsubp st(3)
push ebp
in al, 0x6a
adc ch, byte [esi + 0x6e]
invalid
jl 0x496c24
jecxz 0x496b9f
push cs
hlt
hlt
Function at 0x624a16
Capabilities:
Encode data using xor

Disassembly:
xor edx, ebx
mov dh, 0
adc eax, 0xd44fadeb
xor al, 0xaa
div dword [eax]
int3
ret 0xa0b5
sbb eax, 0xb2cc0476
mov ecx, 0x806c961f
loop 0x624a2e
out 0x64, eax
xor al, 0xbe
int1
pushfd
loopne 0x624a5d
ja 0x624a6a
adc bl, byte ds:[edi + 0x40328672]
adc bl, byte [edi + 0x40328672]
jb 0x6249b6
xor al, byte [eax + 0x22]
and esi, ebx
mov eax, dword [0xadb718d5]
and ah, byte [ecx]
fisub word [ecx - 0x5248e72b]
pushfd
les esi, [edx - 0x7657fe94]
and eax, 0xbe94b7a7
pushal
cmpsb byte [esi], byte es:[edi]
mov dl, 0xf7
sbb al, 0x72
ffree st(5)
aam 0xb6
xor byte [ebp - 0x6a9d6b80], ch
jb 0x624a2b
fisttp word [edx + esi*4 - 0x5b593bca]
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
xor eax, 0xaa527032
add eax, 0xb8b33230
aas
jae 0x624a0a
popal
mov cs, word [ebp - 0x2d]
ret

Function at 0x629cf5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323c0
Function at 0x10001f80
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10009098]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
pop esi
test eax, eax
jne 0x10001fe4
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10001fe4
xor al, al
jmp 0x10001fee
cmp dword [ebp - 0x11c], 5
seta al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006470
mov esp, ebp
pop ebp
ret

Function at 0x10006740
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1000677e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x10006776
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x10006780
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x10006766
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10006850
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10006866
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10006881
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x1001160
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102cc8a
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x1057620]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
push 0
call fcn.010071c2
mov dword [esp + 0x20], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [esp + 0x20], 6
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x1001209
lea eax, [esp + 0x28]
mov dword [esp + 0x28], str.bad_locale_name
push eax
lea ecx, [esp + 0x10]
call fcn.01007704
push 0x1055744
lea eax, [esp + 0x10]
mov dword [esp + 0x10], vtable.std::runtime_error.0
push eax
call fcn.01009204
push eax
push esi
call fcn.01005bf1
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x1c
ret 4

Function at 0x1001b80
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x102cd28
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1057620]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x1057620]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0x10]
sub esp, 0x18
mov ecx, esp
push 0xffffffffffffffff
push 0
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push eax
mov byte [ecx], 0
call fcn.01002870
push dword [ebp + 0xc]
lea eax, [esp + 0x2c]
push dword [ebp + 8]
push eax
call fcn.01001a80
add esp, 0x24
mov dword [esp + 0x38], 0
cmp dword [eax + 0x14], 0x10
jb 0x1001bfd
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.01007704
cmp dword [esp + 0x24], 0x10
mov dword [esi], vtable.std::runtime_error.0
jb 0x1001c26
push dword [esp + 0x10]
call fcn.01008275
add esp, 4
mov ecx, dword [ebp + 8]
mov eax, esi
mov dword [esi + 0xc], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esi], vtable.std::_System_error.0
mov dword [esi + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.010076be
mov esp, ebp
pop ebp
ret 0xc