joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x414f90
sub esp, 0x6c
mov eax, dword [0x694158]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.00401343
mov ebx, eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x18], ebx
call fcn.004026e4
add esp, 4
mov edi, 0x4b814e
cmp byte [esp + 0x84], 0
movups xmm0, xmmword [eax]
movups xmmword [esp + 0x4c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [esp + 0x5c], xmm0
movq xmm0, qword [eax + 0x20]
movq qword [esp + 0x6c], xmm0
mov eax, dword [eax + 0x28]
mov dword [esp + 0x74], eax
mov dword [esi + 8], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
jne 0x415006
mov edi, dword [ebx + 8]
lea eax, [esp + 0x20]
push eax
call fcn.004026e4
mov ecx, edi
add esp, 4
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415018
sub ecx, edx
push 1
lea ebx, [ecx + 1]
push ebx
call fcn.00403387
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x415122
test ebx, ebx
je 0x415048
push ebx
push edi
push ebp
call fcn.00405759
add esp, 0xc
lea eax, [esp + 0x4c]
mov dword [esi + 8], ebp
push eax
push 0
push str.false
call fcn.004031a2
mov dword [esi + 0x10], eax
lea eax, [esp + 0x58]
push eax
push 0
push str.true
call fcn.004031a2
add esp, 0x18
mov dword [esi + 0x14], eax
cmp byte [esp + 0x84], 0
je 0x4150f5
lea eax, [esp + 0x4c]
mov byte [esp + 0x10], 0x2e
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0
push eax
push 1
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x24]
movlpd qword [esp + 0x28], xmm0
push eax
call fcn.00403cc9
movzx eax, word [esp + 0x28]
xorps xmm0, xmm0
mov word [esi + 0xc], ax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x30]
mov byte [esp + 0x28], 0x2c
push eax
push 1
lea eax, [esp + 0x30]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x38]
movlpd qword [esp + 0x3c], xmm0
push eax
call fcn.00403cc9
movzx eax, word [esp + 0x3c]
add esp, 0x28
jmp 0x415109
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
movzx eax, word [eax]
mov word [esi + 0xc], ax
mov eax, dword [ecx + 0x34]
movzx eax, word [eax]
mov ecx, dword [esp + 0x78]
pop edi
mov word [esi + 0xe], ax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00403085
add esp, 0x6c
ret 8
call fcn.004010aa
int3
Function at 0x496ee4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00401dc0
mov eax, dword [0x694158]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00405ede
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x496f26
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x497082
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00406041
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x697ca8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00403292
mov ecx, dword [esi*4 + 0x697ca8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x49707b
cmp eax, dword [edi + ecx + 0x24]
jne 0x49707b
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x49707b
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00403292
add esp, 0x14
test edx, edx
jl 0x49707b
jg 0x496ff1
test eax, eax
jb 0x49707b
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x49707b
jl 0x49700b
cmp dword [ebp - 0x1008], eax
ja 0x49707b
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x497029
test ebx, ebx
je 0x497062
cmp ecx, edi
jae 0x497062
mov al, byte [ecx]
cmp al, 0xd
jne 0x497043
lea eax, [edi - 1]
cmp ecx, eax
jae 0x49704f
cmp byte [ecx + 1], 0xa
jne 0x49704f
inc ecx
jmp 0x49704f
movzx eax, al
movsx eax, byte [eax + 0x694cb8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x497029
cmp edx, ebx
jne 0x497029
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x497080
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00403085
leave
ret
Function at 0x49b7a1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x694158]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49b7ec
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049bc63
test al, al
jne 0x49b7e6
sub edx, 2
cmp edx, edi
jne 0x49b7cc
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49b80e
lea eax, [edi + 2]
cmp edx, eax
je 0x49b80e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049b39a
add esp, 0x10
jmp 0x49b908
push esi
lea ecx, [ebp - 0x255]
call fcn.0049bc63
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49b851
push dword [ebp - 0x25c]
jmp 0x49b7fe
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49b88e
cmp word [ebp - 0x226], 0
je 0x49b8af
cmp word [ebp - 0x226], ax
jne 0x49b88e
cmp word [ebp - 0x224], 0
je 0x49b8af
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049b39a
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49b8fb
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49b868
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49b8e3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49b908
push 0x49ad82
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.00405592
add esp, 0x10
jmp 0x49b8d8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403085
leave
ret
Function at 0x4a761c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x697ca8]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4a765f
cmp word [esi], dx
jne 0x4a765f
or byte [edi + eax + 0x28], 4
jmp 0x4a7664
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x4a77b7
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4a7797
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x4a76a6
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x4a76dc
cmp eax, edx
jae 0x4a76e8
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4a767e
jmp 0x4a77b7
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4a7793
cmp dword [ebp - 0x14], 0
je 0x4a7793
mov eax, dword [ebx*4 + 0x697ca8]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4a776b
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x4a7734
mov word [esi], cx
jmp 0x4a7767
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x697ca8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x697ca8]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x697ca8]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x4a77b7
pop ebx
cmp word [ebp - 4], bx
jne 0x4a777c
cmp esi, dword [ebp + 0xc]
jne 0x4a777c
mov word [esi], bx
jmp 0x4a77b4
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040194c
add esp, 0x10
cmp word [ebp - 4], bx
je 0x4a77b7
push 0xd
jmp 0x4a77b0
mov ecx, dword [ebx*4 + 0x697ca8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x4a77ae
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x4a77b7
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x43b64d
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
inc eax
call fcn.0043b674
and eax, eax
xor dword [edx], esi
or ecx, ecx
inc edx
sub ecx, 0x4a9719d8
mov ecx, eax
cmp edx, ebx
jne fcn.0043b64d
add eax, eax
ret
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x4e4b6e
Capabilities:
Encode data using xor

Disassembly:
add byte [eax], al
test eax, eax
je 0x4e4bc4
push 0
add byte [eax], al
add eax, dword [eax]
add byte [eax + 0x11], ch
mov es, word [eax]
std
idiv byte [ecx - 0x6f2cff1c]
in eax, 0xc9
fyl2xp1
retf 0x3ea7
and eax, 0x4d81bb66
movsb byte es:[edi], byte [esi]
pop edx
invalid

Function at 0x52789b
Capabilities:
Encode data using xor

Disassembly:
fbstp tbyte [ebp - 0x10504e18]
popfd
into
sbb al, 0x19
jmp 0xb1571373
cmp eax, 0x6b857873
push esp
push esi
ja 0x527884
mov ebp, dword [0x2e19a4ea]
fsub st(6)
pop ecx
pop ss
idiv dword [ebx + 0x58]
xor ecx, dword [edi]
invalid
Function at 0x60460b
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcb2969a1
wait
test dword [edi + 0x1d408cf7], eax
cli
sbb ecx, dword [ecx - 0x63]
lodsb al, byte [esi]
popal
sar dword [eax - 0x11], 0x48
mov al, cl
sbb bl, byte [ebp + 0x1e]
test dword [edx + edx*4], ebp
mov eax, dword [0x942b6a9a]
scasd eax, dword es:[edi]
fcom dword [ecx]
jl 0x60455c
jp 0x604618
dec ecx
sbb ebp, dword [ecx + 6]
push 0xcc983fb0
invalid
dec edx
push edx
bound esp, qword [ecx]
loope 0x60465e
outsb dx, byte [esi]
sti
pop ebp
inc esi
test al, 0xc2
cmp dword [ebp - 0x77], ebx
dec edx
jnp 0x604596
jmp 0x8b3c20cd
and edi, dword [ecx - 0x46]
add ch, byte [edx + 0x7b]
and ch, byte [ebx + 0x52]
dec ebp
push 0xffffffffffffffff
idiv byte [esi]
in al, 0x8b
mov edx, 0x227b6a02
imul edx, dword [edx + 0x4d], 0x6a
push esi
in al, 0x8b
mov esi, dword [eax + esi*2 - 0x3c]
jne 0x604609
je 0x60468b
les esi, [ebp - 0x15]
in al, dx
cmpsb byte [esi], byte es:[edi]
mov byte [0x5bfa3d6e], al
dec edx
inc edx
mov esi, 0x67b8740b
sub eax, esi
jg 0x6045e9
movsd dword es:[edi], dword [esi]
sar al, 1
or cl, ch
adc al, 0xd7
xchg dword [ebx + 0x49], ecx
jno 0x604618
xlatb
cmp ch, bh
dec esp
jecxz 0x604651
js 0x54e162a1
mov byte [edx + 0x1c], bl
adc dword [ebp + eax + 0x2f], 0x8a6a52bd
inc ebp
add eax, 0x6a52bd2f
mov dh, bl
inc ebp
pop ebx
sbb dword [ebx - 0x42], ebp
out dx, eax
mov edx, 0x22748543
imul edi, dword [esi - 0x7abc4511], 0x74
and bl, byte [edx + 0x540f818e]
mov esi, 0x8543baef
je 0x60467b
lcall 0x9e38, 0x540f818e
lodsd eax, dword [esi]
dec ebp
insd dword es:[edi], dx
adc eax, esi
pop edi
cmp edi, dword [eax]
cmp dh, ch
hlt
cmp byte [esi + 0x136d4dad], bl
invalid
or al, 0xa8
mov esp, edi
test eax, 0x28015307
dec esp
je 0x604641
jl 0x6046f3
push 0x7c
or ebx, dword [ecx + 0x71]
ret 0xfebb
jl 0x604698
pop ecx
jno 0x604652
mov ebx, 0xfefc0dfe
xchg esp, eax
hlt
mov edx, 0xd9f20d98
hlt
pop ecx
xor eax, 0x272238ad
nop
in al, 0xd8
add dl, dl
ror ebx, 0xa5
cmp al, 0x13
pop ebx
retf 0x1d3b

Function at 0x6049e2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa3786d94
jp 0x604a46
adc al, 0xf2
cli
ret
wait
xor byte [edx + 0x71], 0x4a
mov bl, 0xda
mov bl, 0xda
mov byte [edi + 0x6e], bh
xor eax, dword [esi + 0xc]
inc esi
popfd
or edi, esi
jb 0x604a53
sti
stosd dword es:[edi], eax
push ebp
sbb al, 0x1b
push eax
adc esp, dword [ebx]
dec ecx
or al, byte [edx]
push edx
sub al, bl
or al, 0x6b
sub dword [ecx], edi
mov esi, 0x4abce7e7
mov byte [edi - 0x4b], al
test eax, 0x9c71cb45
fcom st(1)
int 0xd
sbb byte [ebx + edi*2], al
iretd
Function at 0x64d08b
Capabilities:
Encode data using xor

Disassembly:
xor byte [edi - 0x415ba1da], al
sahf
sbb byte [edx], bl
lodsd eax, dword [esi]
pop esi
movsb byte es:[edi], byte [esi]
mov esi, 0xad1a189e
mov dh, 0x14
dec edx
and al, 0xbd
sub ecx, dword [esi - 0x3b36d41c]
aaa
jl 0x64d0b8
and ebp, ebp
sub al, byte [ecx]
push esi
invalid
mov esi, 0x86212af8
push edi
test byte [ecx - 0x68d9fd96], 0x2a
xlatb
jl 0x64d102
inc eax
into
cmp esp, dword [edx + 0x34]
jne 0x64d0ef
int1
inc edi
je 0x64d08e
popal
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
out 0xa4, eax
add dword [ebx - 0x6ae486a9], ebx
inc edi
aam 0x1d
push esp
invalid
dec ebp
inc eax
pop esp
and cl, byte [edi + ebx*8 + 0x3b5824a]
jne 0x64d0d6
xchg esp, eax
cli
mov bl, 0x27
in eax, 7
add dword [esi + 0x21], esi
jbe 0x64d125
mov byte [di + 0x3b], 0xaa
and esp, dword [ebx - 0x7e]
add al, 0x24
add ebp, dword [esp + esi*4 + 0x7f]
cmp eax, 0xfbb2d794
push 0x468d68b
je 0x64d18b
nop
push esi
xlatb
add dh, byte [ebp + ebp*8 - 0x4f]
and ebx, dword [ebx + 0x3a]
cmpsb byte [esi], byte es:[edi]
jno 0x64d138
mov cl, 0x68
aaa
sbb dh, byte [ecx + 0x67]
aad 0xb4
stc
mov ebx, 0x2551c856
mov ecx, 0x2c60202
push 0x34
enter 0x2551, 0xffffffffffffffc7
rol dword [edx], 2
mov byte [edx], 0x36
push 0x34
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
cmp al, 0xbc
jbe 0x64d0ff
mov ah, 0x5b
pop ebx
xor cl, byte [0xb8044e87]
xchg ebx, eax
mov ebp, 0xe25caec2
push esp
sbb al, ah
mov dword [eax], edx
or eax, dword [edi + esi]
daa
xchg edi, eax
adc byte [edi + 0x243c5882], 0x4d
xor byte [edi], bh
test byte [edx + 0x2f], bl
enter 0xffffffffffff8e95, 0xffffffffffffffcf
mov ah, 0xea
xchg ebp, eax
enter 0xfffffffffffff1aa, 0x5d
ret 0x5cae
stosb byte es:[edi], al
int1
pop ebp
jl 0x64d154
xor ebp, ebx
imul ebx, dword [ecx + 0x265bf735], 0x64
inc edx
out dx, al
pop ss
div ecx
je 0x64d10c
cmp byte [ecx + ebp*8 + 0x18], 0x98
std
outsb dx, byte [esi]
ret 0x677d
jl 0x64d177
sbb byte [eax + 0x7dc26efd], bl
xlatb
sbb cl, bh
push esp
mov eax, dword [0xf7053755]
xchg ecx, eax
cdq
push eax
jmp 0x64d14a
Function at 0x403ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, 0xffffffff
test ecx, ecx
mov esi, dword [ebp + 8]
je 0x403af9
xor al, byte [esi]
movzx edx, al
shr eax, 8
mov edx, dword [edx*4 + section..data]
inc esi
xor eax, edx
dec ecx
jne 0x403ae4
xor eax, 0xffffffff
pop esi
leave
ret 0xc

Function at 0x413200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.EYZtqSKO
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x413222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413218
mov eax, 1
add ebx, ebx
jne 0x41323b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413230
jne 0x41324c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413230
xor ecx, ecx
sub eax, 3
jb 0x413260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4132d2
mov ebp, eax
add ebx, ebx
jne 0x41326b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41329c
inc ecx
add ebx, ebx
jne 0x413288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41327d
jne 0x413299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41327d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4132bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4132ad
jmp 0x41321e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4132bc
add edi, ecx
jmp 0x41321e
pop esi
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x41331b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x130b0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1311c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4132d9
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13124]
or eax, eax
je 0x413315
mov dword [ebx], eax
add ebx, 4
jmp 0x4132f6
call dword [esi + 0x13120]
mov ebp, dword [esi + 0x13128]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41334f
sub esp, 0xffffff80
jmp section.WZqkObwJ
Function at 0x44a880
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.HKEY_CLASSES_ROOTCLSIDD2073C44_AB4F_11D0_A732_00A0C9082637
mov edi, eax
call fcn.0044a810
mov esi, dword [sym.imp.USER32.dll_GetKeyboardType]
add esp, 4
mov ebx, eax
push 0
call esi
cmp eax, 7
je 0x44a8f5
push 1
call esi
mov esi, eax
mov eax, dword [esp + 0xc]
and esi, 0xff00
test eax, eax
je 0x44a8cf
mov eax, dword [0x652dd4]
push 0x652b08
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0xc]
push ecx
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, 0xd00
je 0x44a8eb
cmp esi, 0x400
jne 0x44a8f5
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
pop edi
mov eax, ebx
pop esi
pop ebx
pop ecx
ret

Function at 0x45c481
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx], esi
invalid
push ecx
jmp 0x45c4bb
into
jge 0x45c3cd
out 0x82, al
and byte [edi + 0x3f], ah
je 0x45c43f
inc edx
outsd dx, dword [esi]
pop esi
jge 0x45c471
fstp qword [esi]
push esp
and ch, bl
push 0x7c
cmp byte [ebx - 0x41], al
xor dword [ecx - 0x52c3af6e], edi
jno 0x45c4dc
dec eax
nop
mov edi, 0x87dba69
jge 0x45c47b
fmul dword [eax]
cwde
xchg esi, eax
movsd dword es:[edi], dword [esi]
mul esp
clc
xchg ecx, eax
push 0x8890c135
mov bl, bh
mov bl, bh
rcl dword [edi + ebp], 0x70
sbb al, byte [eax]
aad 0x9c
jp 0x45c4fb
sbb edi, eax
sub byte [ebp + esi*2 - 0x475f9b43], 0xe8
fdivp st(6)
into
xchg esi, eax
mov ss, word [0x408223f5]
jl 0x45c448
and cl, byte [ecx - 0x312e5f2b]
sbb byte [eax + 0x43], bh
js 0x45c4ef
xchg ecx, eax
adc ah, 0x82
in al, dx
and byte [edi + 0x4149977f], dh
outsd dx, dword [esi]
inc edi
cmp edx, dword [eax + 0x36]
loope 0x45c463
loope 0x45c463
pop eax
stosb byte es:[edi], al
cdq
add byte [edx - 0x37836202], ah
or eax, 0xb8f83b09
scasd eax, dword es:[edi]
loop 0x45c4aa
and ebp, ebp
xchg edi, eax
xchg esp, eax
pop ss
pop edx
push eax
scasb al, byte es:[edi]
add dh, bh
push ecx
sub eax, 0x381529c8
or byte [eax - 0x7e15269a], ah
inc edi
add eax, 0xf3939a5d
sub dword [0x66a00838], edx
fldl2e
add dword [edi + 5], 0xf3939a5d
invalid
pop ss
jmp 0x4ca753df
mov ah, 0x18
jge 0x45c4d7
mov eax, 0xa0d957ad
xor eax, 0x85736d85
salc
in al, 0x80
xor al, 0x83
sar bh, cl
in eax, dx
js 0x45c55f
mov al, byte [0xad025a7c]
mov eax, 0x1ea4edf0
invalid
add dword [ebp + 0x646404c6], edx
jmp 0x45c5b6
call [ebx - 0x6fa324af]
sub al, 0x39
invalid
sbb al, 0xfa
movsb byte es:[edi], byte [esi]
cmp al, 0x2a
mov ecx, 0xea0e8424
xor eax, 0x9f293f3d
and byte [ecx + 0x5d], bh
jl 0x45c553
loopne 0x45c53d
dec edi
mov dh, 0xc9
bound esp, qword [edx]
invalid
clc
add ch, ah
mov ecx, 0x51543277
sbb dword [esi + 0x45], 0xc8688991
push eax
nop
invalid
Function at 0x5817f1
Capabilities:
Encode data using xor

Disassembly:
push esi
xchg edx, eax
pop ecx
mov ebp, 0xd632b485
mov ch, 0x53
xor cl, byte [esi + 0x3582e7f0]
stc
mov ecx, 0x548ddf9
das
leave
sub byte [edi], ah
pushal
mov ebp, 0xdd78a6a2
fcomp st(7)
in eax, dx
xor al, cl
jb 0x581833
sub byte [esi - 0x6d], ch
sub dword [ecx], esp
cmp dh, byte [ecx + 0x59]
inc ecx
sahf
in al, dx
push ebx
pop es
call 0xc89633b4
enter 0xffffffffffff93c0, 0xfffffffffffffff6
or ecx, esi
jnp 0x5817ba
enter 0xffffffffffff93c0, 0xfffffffffffffff6
or ecx, esi
jnp 0x5817ba
cdq
shr dword [edx - 0x48], 0x5b
adc ebx, esp
sti
sub dword [esi + 0x33], eax
jnp 0x581884
xchg esp, eax
inc ecx
call 0x45c50625
cdq
int3
popfd
dec ecx
dec ecx
sbb al, 0xe2
mov al, 0xc5
push ss
aam 0x91
je 0x58184b
and dword [esi + 0x351e25fe], eax
mov ecx, dword [ecx + 0x65bafbbc]
add dword [edx + edi], 0x5163fc34
push ecx
jae 0x5818cb
xchg esp, eax
cmp al, 0x78
aas
inc ebx
adc dword [edx + eax*4], eax
cmp al, 0xf8
push esi
loop 0x581851
add eax, 0xc848edc8
movsd dword es:[edi], dword [esi]
adc ebp, esp
sahf
in al, dx
or eax, 0x57bd79ba
mov dword [eax - 0x44d04f58], eax
faddp st(4)
add al, 0x4c
in al, 0x1f
add dword [esi + 0x1dd99367], esi
dec ebp
and al, 0x69
and eax, 0x73494a09
mov cl, 0x4b
sal byte [0xe35b4ea6], 1
imul esp, dword [0x73494a09], 0x35d04bb1
cmpsb byte [esi], byte es:[edi]
dec esi
pop ebx
jecxz 0x581892
push ebp
cmc
pop ecx
jg 0x5818f0
arpl word [ebp - 0x65], sp
push 0x4843e89c
movsb byte es:[edi], byte [esi]
test eax, 0xb4151983
int1
aaa
sbb dword [ebx + 1], eax
invalid
xchg dword [ebx + 0xb], eax
aaa
inc ebx
or esi, dword [edi]
mov dword [ebx + 0x3b], eax
xchg edx, eax
cmp dword [edx - 0x18423c86], edx
lfs ebx, [ecx - 0x29]
xor esp, dword [eax]
imul esi, ecx, 0xffffffaf
loope 0x5818ca
adc al, 0x36
invalid
push esi
popfd
sub eax, 0x1acc0965
mov cl, 0x14
iretd

Function at 0x603a3c
Capabilities:
Encode data using xor

Disassembly:
repne lodsd eax, dword [esi]
ror dword [ebp + 0x4c], 1
cdq
adc dword [esi - 0x19ae691b], ecx
push edi
in eax, 0x96
push ecx
out 0x57, al
popal
aaa
jmp 0x4ebaa6b9
les edi, [edi + 0x57]
jmp 0xdcab4178
xlatb
xlatb
mov esi, 0xdd72df2a
mov al, 0x83
jb 0x6039f4
mov ebx, 0xe655a5d1
rcr dword [esi + ecx*2 + 0xf], 0x86
push ss
mov fs, word [edi + 0x44cc7baa]
lodsb al, byte [esi]
lcall 0x70d9, 0x3de6f24e
mov ss, word [esp + eax*8]
jo 0x6039ef
adc al, 0xc4
dec edx
push cs
ja 0x603abf
cmp al, 0xca
xor bh, al
jno 0x6039f7
out 0x14, al
jg 0x603a00
sbb byte [esp + 0xfe177b], 0xfc
jecxz 0x603a2c
push 0xb0df3cd3
add dh, dl
rcr al, 0xb2
sbb dword [edi], 0xffffffba
jne 0x603a85
test byte [edx], ah
pop esi
loop 0x603a5f
jmp 0x5d4335d
scasb al, byte es:[edi]
aam 0x8c
and byte [ecx + 0x3850c420], ah
inc ebp
stc
xor edx, dword [esi]
push edx
fstp st(6)
sub byte [eax + 0x62], dh
add cl, dl
popfd
aas
mov al, 2
pop ds
pushfd
das
insb byte es:[edi], dx
mov bl, 0xb9
out dx, eax
cmp eax, 0x76ca8184
push ecx
sahf
dec ebx
into
push 0x5c
mov ebp, esi
in eax, 0xb
fnstcw word [edx - 0x1dca646d]
push esp
sbb al, ch
or dword [edi], ebp
pop edx
insd dword es:[edi], dx
push ds
outsd dx, dword [esi]
iretd