joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bd5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x41bd6b
pop dword [ebp - 0x38]
mov eax, 0xbaf4da3e
add eax, 0x454ce32d
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0xf85a0234
sub dword [ebp - 0x48], 0xaa07bce9
mov dword [ebp - 0x44], 0xe1964738
add dword [ebp - 0x44], 0x509d050d
mov dword [ebp - 0x40], 0x55f09a99
add dword [ebp - 0x40], 0xf65ba995
mov dword [ebp - 0x3c], 0xf8b6d97e
sub dword [ebp - 0x3c], 0xf8b6d97e
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x7a042f7d
sub dword [ebp - 0x48], 0x591c627
mov dword [ebp - 0x44], 0xeaffab9c
add dword [ebp - 0x44], 0x566cb5d9
mov dword [ebp - 0x40], 0x1d4b4eb
add dword [ebp - 0x40], 0x619ab781
mov dword [ebp - 0x3c], 0x6fc9c991
add dword [ebp - 0x3c], 0x9036366f
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x44c9f
push 0
call eax
mov ecx, 0x4383
xor esi, esi
add esi, eax
mov edi, 0x475600
add edi, dword [ebp - 0x38]
mov edx, 0x1bee4a
add edx, 0x2e597f51
xor dword [ebp - 0x10], 0x56636a4e
mov ebx, dword [edi]
sub dword [ebp - 0x18], esi
xor ebx, edx
xor dword [ebp - 0x18], 0x928176f2
mov dword [esi], ebx
add dword [ebp - 0xc], 0x4f0f6cc9
add esi, 0x2311edb3
add esi, 0xdcee1251
add edi, 0xde59b115
sub edi, 0xde59b111
loop 0x41be79
add eax, 0x51fc3063
sub eax, 0x51fb2f84
mov ebx, eax
add eax, 0xab236076
add eax, 0x54dc9f8f
mov ecx, 0xef7ddd24
add ecx, 0x10c222dc
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x42105f
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x44e8a8
call fcn.00422e90
call main
movzx esi, ax
push 2
call main
pop ecx
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x420f16
xor ebx, ebx
jmp 0x420f49
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x420f12
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x420f12
xor ebx, ebx
cmp dword [eax + 0x400074], 0xe
jbe 0x420f49
cmp dword [eax + 0x4000e8], ebx
setne bl
mov dword [ebp - 0x1c], ebx
call fcn.004279ab
test eax, eax
jne 0x420f5d
push 0x1c
call main
pop ecx
call fcn.00427918
test eax, eax
jne 0x420f6e
push 0x10
call main
pop ecx
call fcn.00428296
and dword [ebp - 4], 0
call fcn.004279c0
test eax, eax
jns 0x420f88
push 0x1b
call main
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov dword [0x457adc], eax
call main
mov dword [0x455a24], eax
call main
test eax, eax
jns 0x420fae
push 8
call main
pop ecx
call fcn.00427eb1
test eax, eax
jns 0x420fbf
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x420fd2
push eax
call main
pop ecx
call fcn.00428714
push esi
push eax
push 0
push 0x400000
call main
mov esi, eax
mov dword [ebp - 0x24], esi
test ebx, ebx
jne 0x420ff4
push esi
call main
call fcn.00426cd7
jmp 0x421029
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
call fcn.00422ed5
ret
call main
jmp 0x420ee8
Function at 0x402e00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x434
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x42c], eax
mov eax, dword [esp + 0x43c]
push ebx
push ebp
mov ebp, dword [esp + 0x440]
push esi
push edi
push eax
mov ecx, ebp
call fcn.0040a030
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x402fbf
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x32]
push edx
mov word [esp + 0x34], cx
call fcn.0040f8c0
add esp, 0xc
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x23a]
push ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], ax
call fcn.0040f8c0
add esp, 0xc
lea esi, [esp + 0x28]
call fcn.00403000
push 0x41dc88
mov edx, esi
push 0x104
push edx
call fcn.0040a9bd
xor eax, eax
lea ebx, [esp + 0x20]
add esp, 0xc
mov byte [esp + 0x14], 0
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov word [esp + 0x25], ax
mov byte [esp + 0x27], al
mov esi, 0x424720
sub ebx, 0x424824
cmp word [esi], 0
je 0x402f37
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x234]
push 0x104
push ecx
call fcn.0040aa6e
add esp, 0xc
push esi
lea edx, [esp + 0x234]
push 0x104
push edx
call fcn.0040a9bd
lea eax, [esp + 0x23c]
add esp, 0xc
push eax
lea edi, [esp + 0x18]
call fcn.004053e0
add esp, 4
test eax, eax
je 0x402f37
mov ecx, 0x14
lea eax, [esi + 0x104]
lea ecx, [ecx]
mov edx, dword [ebx + eax]
cmp edx, dword [eax]
jne 0x402f37
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x402f20
xor eax, eax
mov word [esi], ax
add esi, 0x118
sub ebx, 0x118
cmp esi, 0x424c98
jl 0x402ec4
mov edi, dword [esp + 0x44c]
mov esi, 0x424720
jmp 0x402f60
cmp word [esi], 0
je 0x402f7e
mov ecx, dword [esi + 0x100]
mov dword [0x424714], ecx
push edi
push ebp
mov ecx, esi
call fcn.0040a240
add esp, 8
add esi, 0x118
cmp esi, 0x424c98
jl 0x402f60
push 0x425360
lea edx, [esp + 0x2c]
push 0x104
push edx
call fcn.0040a9bd
add esp, 0xc
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x402fbb
mov dword [esp + 0x10], 2
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x434
ret
Function at 0x4033f0
Capabilities:
Get mac address on windows

Disassembly:
sub esp, 0x3c
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x40]
push ebx
push ebp
push esi
mov esi, edx
mov dword [esp + 0x18], eax
xor eax, eax
xor edx, edx
push 0x288
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0xffffffff
mov word [esp + 0x28], dx
mov dword [esp + 0x2a], eax
mov dword [esp + 0x2e], eax
mov dword [esp + 0x32], eax
mov dword [esp + 0x36], eax
mov dword [esp + 0x3a], eax
mov dword [esp + 0x3e], eax
mov dword [esp + 0x42], eax
mov word [esp + 0x46], ax
xor ebx, ebx
call fcn.0040afc0
mov ebp, eax
add esp, 4
lea eax, [esp + 0x10]
push eax
push ebp
mov dword [esp + 0x18], 0x288
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x403483
push ebp
call fcn.0040b61e
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040afc0
add esp, 8
mov ebp, eax
lea edx, [esp + 0x10]
push edx
push ebp
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x403567
mov eax, ebp
mov dword [esp + 0x14], ebp
test ebp, ebp
je 0x403567
push edi
jmp 0x4034b4
mov eax, dword [esp + 0x18]
inc dword [esp + 0x10]
test esi, esi
je 0x4034cf
mov ecx, dword [eax + 0x194]
mov dword [esi], ecx
mov dx, word [eax + reloc.crypt32.dll_CertDeleteCRLFromStore]
mov word [esi + 4], dx
lea edi, [eax + 0x1ac]
test edi, edi
je 0x403554
lea esp, [esp]
lea edx, [edi + 4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4034e8
sub eax, esi
mov ecx, eax
cmp ecx, 0x10
jle 0x4034fd
mov ecx, 0x10
xor eax, eax
test ecx, ecx
jl 0x40351d
cmp eax, ecx
jne 0x40350e
xor esi, esi
mov word [esp + eax*2 + 0x28], si
movsx si, byte [edx + eax]
mov word [esp + eax*2 + 0x28], si
inc eax
cmp eax, ecx
jle 0x403505
lea eax, [esp + 0x28]
push eax
call fcn.00403630
add esp, 4
test eax, eax
je 0x403545
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + ebx*4]
lea ecx, [esp + 0x28]
push ecx
push 0x10
push eax
call fcn.0040aa6e
add esp, 0xc
mov edi, dword [edi]
inc ebx
test edi, edi
jne 0x4034e0
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
test ebx, ebx
jg 0x403566
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x4034b0
pop edi
mov ecx, dword [esp + 0x1c]
mov dword [ecx], ebx
test ebp, ebp
je 0x40357a
push ebp
call fcn.0040b61e
add esp, 4
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0xc]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a982
add esp, 0x3c
ret
Function at 0x403830
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 0x118
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call fcn.0040f8c0
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x403909
mov eax, dword [esp + 8]
cmp eax, 5
jne 0x4038d5
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4038ae
cmp word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], 4
jb 0x403909
mov esi, 1
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 2
jae 0x4038b8
cmp eax, 1
jne 0x403909
mov esi, 3
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 6
jne 0x403909
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x4038ff
mov esi, 4
mov eax, esi
pop esi
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret
cmp eax, 1
jne 0x403909
mov esi, 5
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040a982
add esp, 0x120
ret

Function at 0x403930
Capabilities:
Get file size

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
push 0
push 0
push 3
push 0
push 3
push closesocket
or edi, 0xffffffff
push eax
or ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, edi
jne 0x403962
or eax, edi
or edx, edi
pop edi
pop esi
pop ebx
add esp, 0x10
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
jne 0x40397b
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
mov edx, ebx
pop ebx
add esp, 0x10
ret

Function at 0x403ac0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x208], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0xa]
push ecx
mov word [esp + 0xc], ax
call fcn.0040f8c0
add esp, 0xc
cmp dword [0x423070], 3
jne 0x403b20
push 0x104
lea edx, [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc88
lea eax, [esp + 4]
push 0x104
push eax
call fcn.0040a9bd
add esp, 0xc
jmp 0x403b2f
lea ecx, [esp]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
lea edx, [esp + 4]
push edx
push 0x41dca8
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [esp + 0x218]
add esp, 0x10
xor ecx, esp
call fcn.0040a982
add esp, 0x20c
ret
Function at 0x405540
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns

Disassembly:
sub esp, 0x9b0
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x9a8], eax
push ebp
mov ebp, dword [esp + 0x9b8]
push esi
push edi
xor eax, eax
push 0x7fe
mov edi, ecx
push eax
lea ecx, [esp + 0x1ba]
push ecx
mov word [esp + reloc.crypt32.dll_CertDeleteCRLFromStore], ax
call fcn.0040f8c0
add esp, 0xc
lea esi, [esp + 0x1b0]
test edi, edi
je 0x40558d
mov esi, edi
lea eax, [esp + 0x20]
xor edx, edx
push eax
push 0x101
mov word [esi], dx
mov dword [esp + 0x14], edx
xor edi, edi
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4055f9
push 0x41deb0
push 0x3ff
push esi
call fcn.0040aa6e
push 0x41ded0
push 0x3ff
push esi
call fcn.0040a9bd
push 0x41ded4
push 0x3ff
push esi
call fcn.0040a9bd
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x9a8]
xor ecx, esp
call fcn.0040a982
add esp, 0x9b0
ret
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
cmp eax, 0xffffffff
je 0x4055ac
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x405691
push ebp
call dword [sym.imp.WS2_32.dll_inet_addr]
push 2
push 4
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_gethostbyaddr]
test eax, eax
jne 0x405691
push 0x41deb0
push 0x3ff
push esi
call fcn.0040aa6e
push 0x41ded0
push 0x3ff
push esi
call fcn.0040a9bd
push 0x41ded4
push 0x3ff
push esi
call fcn.0040a9bd
mov eax, dword [ebx]
add esp, 0x24
test eax, eax
je 0x405677
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx], edi
mov ecx, dword [esp + 0x9b4]
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0040a982
add esp, 0x9b0
ret
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov eax, dword [esp + 0x9c4]
mov edx, 2
push eax
mov dword [esp + 0x18], ecx
mov word [esp + 0x14], dx
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [ebx]
push 0x10
lea ecx, [esp + 0x14]
push ecx
push edx
mov word [esp + 0x1e], ax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4056d7
push 0x41df14
jmp 0x40563a
mov edi, 1
jmp 0x405677
Function at 0x408620
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
cmp byte [esi], 0
je 0x408665
cmp byte [esi + 1], 0
je 0x40866d
mov eax, dword [esi + 4]
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp byte [esi], 0
push ebp
je 0x408682
cmp byte [esi + 1], 0
je 0x408674
mov edx, dword [esi + 4]
push 1
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
sub ebp, dword [esi + 0xc]
mov dword [esp + 4], ebp
jmp 0x40868b
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x1c], ecx
jmp 0x40863e
or eax, 0xffffffff
add esp, 0x18
ret
mov dword [esp + 4], 0
mov ebp, dword [esp + 4]
jmp 0x40868b
mov eax, dword [esi + 0x1c]
mov dword [esp + 4], eax
mov ebp, eax
push edi
mov edi, reloc.crypt32.dll_CertDeleteCRLFromStore
mov dword [esp + 0xc], edi
cmp ebp, edi
jae 0x40869f
mov dword [esp + 0xc], ebp
mov edi, ebp
push ebx
push 0x404
call fcn.0040afc0
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4086bd
pop ebx
pop edi
or eax, 0xffffffff
pop ebp
add esp, 0x18
ret
mov eax, 4
mov dword [esp + 0x18], 0xffffffff
cmp edi, eax
jbe 0x4087d1
jmp 0x4086e0
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ebp, dword [esp + 0xc]
add eax, 0x400
mov dword [esp + 0x14], edi
cmp eax, edi
ja 0x4086f1
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, dword [esp + 0x14]
sub ebp, eax
mov dword [esp + 0x20], eax
cmp ebp, 0x404
jbe 0x40870a
mov ebp, 0x404
cmp byte [esi], 0
je 0x40872f
cmp byte [esi + 1], 0
je 0x4087d1
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push 0
push 0
add ecx, eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x408732
mov dword [esi + 0x1c], eax
cmp byte [esi], 0
mov edi, ebp
je 0x40875a
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 0x20]
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408754
mov byte [esi + 8], 1
mov eax, dword [esp + 0x1c]
jmp 0x408780
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x18]
lea edx, [eax + ebp]
cmp edx, ecx
jbe 0x40876b
sub ecx, eax
mov edi, ecx
mov ecx, dword [esi + 0x14]
push edi
add ecx, eax
push ecx
push ebx
call fcn.00410450
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div ebp
cmp eax, 1
jne 0x4087d1
lea eax, [ebp - 3]
test eax, eax
jl 0x4087bc
dec eax
cmp byte [eax + ebx], 0x50
jne 0x4087ac
cmp byte [eax + ebx + 1], 0x4b
jne 0x4087ac
cmp byte [eax + ebx + 2], 5
jne 0x4087ac
cmp byte [eax + ebx + 3], 6
je 0x4087b2
test eax, eax
jge 0x408790
jmp 0x4087bc
mov edx, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0
jne 0x4087d1
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], eax
jb 0x4086d4
push ebx
call fcn.0040b61e
mov eax, dword [esp + 0x1c]
add esp, 4
pop ebx
pop edi
pop ebp
add esp, 0x18
ret
Function at 0x4096f0
Capabilities:
Get common file path

Disassembly:
cmp dword [esi], 0
push edi
jne 0x4097a3
cmp dword [esi + 4], 0xffffffff
jne 0x4097a3
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
jmp 0x409720
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409720
sub eax, edx
sar eax, 1
movzx eax, word [esi + eax*2 + reloc.crypt32.dll_CertDeleteCRLFromStore]
cmp ax, 0x5c
je 0x409759
cmp ax, 0x2f
je 0x409759
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x409746
mov eax, dword [0x41dc88]
mov dword [edi], eax
push 0x20
call fcn.0040b8c1
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
add esp, 4
mov byte [eax], 0
mov byte [eax + 1], 1
mov byte [eax + 0x10], 0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], 0
mov dword [eax + 0xc], 0
call fcn.004087f0
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
ret 8
mov eax, 0x1000000
pop edi
ret 8

Function at 0x40a4c0
Capabilities:
Get common file path
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
push 0x206
xor esi, esi
lea ecx, [esp + 0x12]
xor eax, eax
push esi
push ecx
mov word [esp + 0x18], ax
call fcn.0040f8c0
add esp, 0xc
cmp edi, esi
je 0x40a5a8
mov eax, 0x41de30
mov dword [esp + 4], esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x40a505
sub eax, edx
sar eax, 1
je 0x40a52f
push 0x41dd1c
lea edx, [esp + 8]
push 0x41de30
push edx
call fcn.0040ac04
add esp, 0xc
jmp 0x40a56a
lea eax, [esp + 0xc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41fff4
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0040a9bd
push 0x41dd1c
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0040ac04
add esp, 0x18
mov eax, dword [esp + 4]
cmp eax, esi
je 0x40a58d
push eax
push 1
push 0x200
push edi
call fcn.0040b59c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b3be
add esp, 0x14
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
mov ecx, dword [esp + 0x214]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040a982
add esp, 0x214
ret
Function at 0x40abbc
Capabilities:
Encode data using xor

Disassembly:
or esp, edi
add al, 0x52
mov edx, 0x3c6495f5
cmpsd dword [esi], dword es:[edi]
dec ecx
xor ch, byte [ebx]
jne 0x40ab85
xor esp, edx
aad 0xc6
cmpsd dword [esi], dword es:[edi]
add ebp, esi
and dword [ecx - 0x21894b86], esp
imul esp, edx, 0
pop esi
pop edx
add byte [edi + 0x43], 0x62
mov al, byte [esi + 0x6275fad7]
add eax, dword [edx + 0x40]
imul edx, dword [0x354e64fa], 0xbddb80e8
sti
invalid
fsubr dword [edi]
je 0x40abe8
cmp ebp, dword [ebp + 0x7a]
rep stosb byte es:[edi], al
wait
lcall 0x1ae5, 0xccc6ffa0
push cs
js 0x40ab7c
hlt
push 0x94743c8e
adc byte [edx + 0x5fbec46], bl
mov al, byte [0x7021d05e]
lodsb al, byte [esi]
mov cl, 0x5a
les ecx, [ebx]
int1
or byte [edi], bl
sbb dl, byte [eax]
test dword [ecx], edi
sub byte [esi - 0x61], ch
mov dword [0xbbc0aac7], eax
mov eax, 0x1373186a
int1
clc
movsd dword es:[edi], dword [esi]
mov ebx, dword [ebx - 0x7bcaeb81]
je 0x40ac0c
ficomp word [ebx + 0x5a]
sal dword [edx + 0x1c228302], 0x16
cli
jbe 0x40ac1f
jo 0x40ac14
inc ebx
lea ebp, [ebx - 0x30]
push ss
arpl word [ecx - 0x6f734fd2], sp
or byte [esp + ebp + 0x55edf1dc], cl
neg dword [esi - 6]
fnstenv [ecx - 0x6b759602]
and eax, 0x13f939e0
fnsave dword [edi + 0x70]
into
mov dh, 0xe9
mov ebp, 0x862aa22b
int 0xa3
lds ecx, [0xfac46b98]
sbb al, cl
and byte [0xe76202fd], bh
bound ebx, qword [eax]
in al, 0x77
dec ecx
xchg ebx, eax
invalid
Function at 0x43ec67
Capabilities:
Encode data using xor

Disassembly:
lahf
mov ecx, 0xfbff7d37
cwde
adc dword [edi], ebx
pop ds
aad 0x4b
ror byte [edi + 0x5a], 1
outsd dx, dword [esi]
mov esp, 0x7db94ae9
inc edx
and esi, ebx
jge 0x43ec3c
mov eax, 0x6c03797f
lds ecx, [eax - 0x61]
stosb byte es:[edi], al
invalid
shl dword [ecx], 0x32
lds eax, [esi - 4]
inc edx
imul eax, dword [edi + 0x31], 0xbb2fef2
adc eax, 0xf8eb8f81
jp 0x43ece4
wait
ret
mov fs, word [ebp + 0x1f3bd2f8]
loopne 0x43ec9a
ror dword [edx - 0x299fd988], 1
adc dword [eax + eax*4 + 0x22f60b1e], esi
scasd eax, dword es:[edi]
ror byte [edx + 0x1d], cl
pop ss
mov al, byte [edi + 0x28]
std
inc esi
pop es
adc eax, 0x400480d3
push ebp
nop
push es
out 0xd8, eax
loopne 0x43ec34
pushfd
pop ss
sahf
xor eax, 0x9a52d568
sub edx, dword [edx]
jecxz 0x43ed39
ror dword [ebx + ecx*2 + 0x75], 1
jp 0x43ed41
inc esi
out 0xe7, eax
fsubr qword [edx + 0x6eeef18d]
retf 0xfed0
pop ebp
cmp al, 0xb0
jno 0x43ec85
mov al, 0x71
sahf
mov ch, 0xfb
shr byte [eax - 0x7371199f], 0x71
cdq
cmp edx, dword [ebp + 0x3e]
fisubr word [esi + 0x47fd7138]
lcall 0x45aa, 0x1e107def
scasd eax, dword es:[edi]
neg dword [ecx + 0x3d9e9ac]
adc al, bh
nop
or byte [ecx + edx*2 + 0x2a752f80], al
add byte [esi + 0x4d], 0x66
inc eax
xor al, 0x19
mov al, byte [0xf030e8ac]
add dword [ecx - 0x5e], ebx
loopne 0x43ece2
xlatb
inc edx
cld
or dword [edx - 0x48], 0xffffff92
psubw mm2, qword [edx + 0x414052e6]
push 0x62
adc dword [esi - 0x4d07a94c], eax
xor ch, dh
mov dl, 0x32
out dx, al
fsubr st(0), st(0)
dec ecx
test al, 0x8e
xor edx, dword [edx - 0x5dbf3fe0]
adc edx, dword [ecx]
pushfd
salc
mov edi, 0x8e231562
in al, dx
mov ah, 0x38
sbb dword [edx - 0x3a7eb938], 0x4724e2e0
xchg ecx, eax
push ds
and dword [esi - 0x44fb2701], 0xb514ab04
and al, 0xa8
loop 0x43ed68
mov ch, 0x24
test al, 0xe2
sti
add ch, bl
push esp
jg 0x43ed71
call esi
salc
or dword [eax - 0x4f], 0xb46ec31e
xor ah, byte [ebp - 0x6d94edd6]
wait
and al, 0xe1
xor al, 0xd6
fstp qword [edi + 0x21]
out dx, al
add byte [edx - 0x102055d], ch
inc edx
sbb esi, dword [edx]
or esi, dword [eax + edx*2 - 0x21fd797c]
jb 0x43ede6
hlt
sahf
dec ebp
push edi
je 0x43ed90
in eax, 0xce
push edx
jmp 0x43ee02
cmpsb byte [esi], byte es:[edi]
mov byte [0x14ab12bb], al
push eax
cmp eax, 0x12a2a28a
jmp 0x43ee64
jmp [esp + edi*4]
Function at 0x4a77fd
Capabilities:
Encode data using xor

Disassembly:
xor esi, dword [edx - 0x10759b42]
mov ch, bh
inc eax
les esp, [edi + ecx]
jae 0x4a77a8
mov dword [0x16443f6f], edi
xlatb
cmp eax, 0x709e529d
int 0xa8
cmc
sbb dword [eax + 0x3e6f63e5], esp
sub al, 0x34
invalid
je 0x4a77ab
test dword [edi + 0x6eaa7768], eax
dec eax
pop edi
or dword [edi], 0xecf318d4
in al, dx
lahf
pop ds
or cl, byte [eax + eax*8]
shl byte [ecx + eax*4 - 0x74f631d9], 0x95
add eax, 0x616846e5
pop edx
in al, 0xbb
or esp, dword [edx + 0x57]
push 0x42ded47e
sbb al, 0xb6
pop ds
in eax, 0x8d
push eax
cmp byte [0x2895e3d2], ah
dec ebx
cdq
mov byte [0xbf6ed89b], al
sal byte [ecx + 0x2b], 1
mov eax, 0x48d16fdc
sbb edx, ecx
xor al, 0xec
aam 0xd
cmp dword [edi - 0x2ffd2017], 0xdc079e25
push ebp
lodsd eax, dword [esi]
sub eax, 0x45aab84c
add al, dh
outsd dx, dword [esi]
mov ah, 2
mov ah, 0x11
movsd dword es:[edi], dword [esi]
jno 0x4a780d
aas
mov ah, 0x31
jmp 0x4a7870
pop esp
add al, 0x3f
xor eax, 0x68b5545e
mov eax, 0x91421f90
jecxz 0x4a78ec
push edi
sahf
rol byte [ebx], 1
mov ch, 0x4e
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
mov ah, 0xbf
mov eax, 0xd29c7a7b
invalid
invalid
cli
mov ah, 0x16
je 0x4a78da
lodsd eax, dword [esi]
clc
add byte [ebx - 0x4a], al
pop ds
pop es
or dh, byte [ecx + ebx*8]
and eax, 0xa43baeb3
and eax, 0x415ec88a
stc
sahf
mov dl, 0x22
invalid

Function at 0x4db267
Capabilities:
Encode data using xor

Disassembly:
bnd jle 0x4db29c
add byte [ebp + 0x7d], bh
sbb byte [ebp + 7], 0xee
xor eax, 0x1c6ec73e
retf 0x2e64
mov al, byte [0x9d388d45]
mov esp, 0x742c59cc
cmp eax, 0x7a5708d0
je 0x4db315
mov al, 0xfe
in eax, dx
sbb edx, edx
inc edx
jae 0x4db2de
adc eax, 0x79a5ffde
add eax, 0xe8cbb9c4
invalid
xchg edx, eax
aaa
push esp
invalid
lodsd eax, dword [esi]
mov byte [0xcbc4976d], al
loopne 0x4db2d8
insd dword es:[edi], dx
out 0xfd, eax
jmp [ebp + 0x1c]
and al, 0x47
aas
pushal
invalid

Function at 0x640d0e
Capabilities:
Encode data using xor

Disassembly:
dec ebp
clc
invalid
mov dword [0x240b6358], eax
cmp esp, dword [ebx]
xchg ebx, eax
or ecx, ebp
sahf
sbb byte [0xb6ba3c68], 0xb8
push esp
call 0xaf5f5fe7
arpl word [ebx], cx
and al, 0x3b
and edx, dword [ebx - 0x7f6116f7]
sbb eax, 0xb6ba3c68
mov eax, 0x52c3e854
sti
scasb al, byte es:[edi]
div byte [esi - 0x60]
add eax, 0xf9a2455f
xor al, 0x8a
or dword [ebx], 0xffffffa0
dec ecx
push es
xchg esi, eax
add eax, 0x216b2d88
mov eax, 0x195895e6
push ds
or dword [edi + ecx - 0x73], esp
dec ecx
jp 0x640d0c
pop ebx
sbb dword [eax - 0x6f], edi
xchg esi, eax
push eax
fisubr dword [esi - 0x682c7aa2]
jae 0x640cea
inc edx
mov byte [ebp + 0x2d94f286], bl
in eax, dx
adc bl, byte [ecx]
jnp 0x640d55
sub dword [ebx + edx], 0x2c
rcr dword [ebx + eax*8], cl
mov ch, byte [ebp - 0x7c]
cmp dword [ecx + 0x72], ecx
pop esi
add edi, dword [ebx]
push es
push edx
sbb al, 0xcc
push edx
sub eax, ecx
retf