joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e5b90
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], ecx
push ebx
push edi
mov edi, edx
test eax, eax
je 0x5e5cb4
test edi, edi
je 0x5e5cb4
cmp dword [edi], 0
je 0x5e5cb4
call fcn.005e6070
mov ebx, eax
test ebx, ebx
je 0x5e5cb4
mov ecx, dword [edi]
lea edx, [ebp - 8]
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
xor esi, esi
push dword [ebp - 0x14]
mov ecx, ebx
mov dword [ebp - 8], 0
call fcn.005e60d0
test al, al
je 0x5e5c88
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x5e5c88
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x5e5c88
push eax
call fcn.0041e7cf
mov esi, eax
add esp, 4
mov eax, dword [edi]
test eax, eax
je 0x5e5c65
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jb 0x5e5c49
push eax
push dword [ebp - 0x18]
push esi
call fcn.0041fb10
add esp, 0xc
jmp 0x5e5c65
push ecx
push 0
push esi
call fcn.00420090
add esp, 0xc
call fcn.0042316f
mov dword [eax], 0x22
call fcn.00422f33
push dword [ebp - 0xc]
push edi
push esi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x5e5c88
push esi
call fcn.0041e1c3
add esp, 4
xor esi, esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x5e5c96
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8

Function at 0x5e6070
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x5e60ba
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x5e60d0
Capabilities:
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
mov esi, edx
mov ecx, dword [ebp + 8]
call fcn.005d8c20
cmp eax, 0x20
jne 0x5e6173
mov dword [ebp - 0x30], 0x208
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], eax
test ecx, ecx
je 0x5e611d
movups xmm0, xmmword [ecx]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [ecx + 0x10]
movups xmmword [ebp - 0x14], xmm0
jmp 0x5e6138
xorps xmm0, xmm0
movups xmmword [ebp - 0x24], xmm0
movups xmmword [ebp - 0x14], xmm0
call fcn.0042316f
mov dword [eax], 0x16
call fcn.00422f33
push esi
push 0
push 0
push 0x2c
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x5e6173
push 0
push ebx
push 1
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
pop edi
test eax, eax
pop esi
setne al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
Function at 0x5e6190
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6036a2
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
push edx
lea edx, [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x2d], 0
call fcn.005e6530
test al, al
je 0x5e62f4
mov ebx, dword [ebp + 0x10]
mov esi, 0x80000
test ebx, ebx
xorps xmm0, xmm0
movlpd qword [ebp - 0x2c], xmm0
cmovne esi, ebx
push esi
mov dword [ebp - 0x1c], esi
call fcn.0041e7cf
mov edi, eax
mov dword [ebp - 0x28], esi
add esp, 4
mov dword [ebp - 0x2c], edi
push 0
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
push esi
push edi
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x5e626a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x5e626a
push 0
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x5e62c8
call fcn.005d8ff0
test ebx, ebx
jne 0x5e626a
push ebx
lea eax, [ebp - 0x1c]
push eax
push esi
push edi
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x5e6235
mov esi, dword [ebp - 0x38]
lea eax, [ebp - 0x24]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
push eax
push esi
push 4
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 4
call ebx
test eax, eax
je 0x5e62c8
mov esi, dword [esi]
push edi
call fcn.0041e1c3
push esi
call fcn.0041e7cf
mov esi, dword [ebp - 0x38]
add esp, 8
mov edi, eax
push 0
push esi
push edi
push 2
push dword [ebp - 0x18]
call ebx
test eax, eax
je 0x5e62c8
mov edx, dword [esi]
mov ecx, edi
push 0
push 0xffff
push dword [ebp - 0x3c]
call fcn.005d86a0
mov bl, al
jmp 0x5e62cb
mov bl, byte [ebp - 0x2d]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x5e62db
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5e62e9
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
call fcn.0041e1c3
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5e63d0
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0xc]
push 0x8003
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.005e6530
test al, al
jne 0x5e6420
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8
push ebx
push esi
xor esi, esi
xor bl, bl
push esi
push dword [edi]
push dword [ebp - 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x5e648b
push esi
lea eax, [ebp - 0x10]
mov dword [edi], esi
push eax
push edi
push 4
push dword [ebp - 8]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x5e648b
push dword [edi]
call fcn.0041e7cf
add esp, 4
mov esi, eax
push 0
push edi
push esi
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x5e648b
mov edx, dword [edi]
mov ecx, esi
push 0
push 0xffff
push dword [ebp - 0x18]
call fcn.005d86a0
mov bl, al
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x5e649b
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 8]
test eax, eax
je 0x5e64a9
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x5e64b6
push esi
call fcn.0041e1c3
add esp, 4
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
pop ebx
xor ecx, ebp
pop edi
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 8

Function at 0x5e6530
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov esi, ecx
mov ebx, edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x5e656a
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x5e658d
push ebx
push 0
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x5e6595
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop esi
xor al, al
pop ebx
pop ebp
ret 4
pop esi
mov al, 1
pop ebx
pop ebp
ret 4
Function at 0x5e6c40
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60379e
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x25c], edx
mov esi, ecx
mov dword [ebp - 0x258], esi
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x248], 0
push eax
lea eax, [ebp - 0x248]
mov dword [ebp - 0x20], 0xf750e6c3
push eax
mov dword [ebp - 0x1c], 0x11d138ee
xor bl, bl
mov dword [ebp - 0x18], 0xc000e585
mov dword [ebp - 0x14], 0xee95c24f
call dword [sym.imp.WINTRUST.dll_CryptCATAdminAcquireContext]
test eax, eax
je 0x5e6e34
push 0
push 0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x244], 0
push eax
push esi
call dword [sym.imp.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle]
mov edi, dword [ebp - 0x244]
test edi, edi
je 0x5e6e34
xorps xmm0, xmm0
push edi
movlpd qword [ebp - 0x250], xmm0
call fcn.0041e7cf
mov esi, eax
mov dword [ebp - 0x24c], edi
add esp, 4
mov dword [ebp - 0x250], esi
push 0
push esi
lea eax, [ebp - 0x244]
mov dword [ebp - 4], 0
push eax
push dword [ebp - 0x258]
call dword [sym.imp.WINTRUST.dll_CryptCATAdminCalcHashFromFileHandle]
test eax, eax
jne 0x5e6d3a
push esi
call fcn.0041e1c3
add esp, 4
jmp 0x5e6e34
xorps xmm0, xmm0
mov dword [ebp - 0x24], 0
lea ecx, [ebp - 0x2c]
movq qword [ebp - 0x2c], xmm0
call fcn.005dc5e0
push 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x244]
push esi
call fcn.005d9cd0
cmp byte [eax + 8], 0
jne 0x5e6d82
lea ecx, [ebp - 0x2c]
call fcn.005dc430
push esi
call fcn.0041e1c3
add esp, 4
jmp 0x5e6e34
push 0x208
lea eax, [ebp - 0x23c]
push 0
push eax
call fcn.00420090
add esp, 0xc
mov dword [ebp - 0x240], 0x20c
push 0
push 0
push dword [ebp - 0x244]
push esi
push dword [ebp - 0x248]
call dword [sym.imp.WINTRUST.dll_CryptCATAdminEnumCatalogFromHash]
mov edi, eax
test edi, edi
je 0x5e6e0e
push 0
lea eax, [ebp - 0x240]
push eax
push edi
call dword [sym.imp.WINTRUST.dll_CryptCATCatalogInfoFromContext]
test eax, eax
je 0x5e6e0e
mov ecx, dword [ebp - 0x25c]
lea eax, [ebp - 0x23c]
push 1
push eax
call fcn.005dc260
mov ecx, dword [ebp - 0x25c]
call fcn.005dc190
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea ecx, [ebp - 0x2c]
mov bl, al
call fcn.005dc430
push esi
call fcn.0041e1c3
add esp, 4
jmp 0x5e6e25
lea ecx, [ebp - 0x2c]
call fcn.005dc430
push esi
call fcn.0041e1c3
add esp, 4
xor bl, bl
test edi, edi
je 0x5e6e34
push 0
push edi
push dword [ebp - 0x248]
call dword [sym.imp.WINTRUST.dll_CryptCATAdminReleaseCatalogContext]
mov eax, dword [ebp - 0x248]
test eax, eax
je 0x5e6e47
push 0
push eax
call dword [sym.imp.WINTRUST.dll_CryptCATAdminReleaseContext]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret
Function at 0x5e88c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x603a3e
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov esi, ecx
call fcn.005dbeb0
test al, al
je 0x5e8900
xor al, al
jmp 0x5e8a6b
call fcn.005dc190
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x5e8a69
push eax
mov ecx, esi
call fcn.005dbc20
push 4
push 1
push 1
push 1
push 0x624390
mov ecx, esi
call fcn.005daa70
test eax, eax
je 0x5e893f
push 4
mov ecx, esi
call fcn.005dad50
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5e8a69
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x20]
movq qword [ebp - 0x20], xmm0
call fcn.005dc5b0
mov ebx, dword [ebp + 8]
mov eax, ebx
and eax, 2
mov dword [ebp - 4], 0
mov dword [ebp - 0x28], eax
je 0x5e898e
push 0
push 0
push 0x62439c
push str._____S
mov ecx, esi
call fcn.005d9660
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5e8a2b
push 9
push 1
push 1
push eax
push 0x6243b8
mov ecx, esi
call fcn.005daa70
test eax, eax
je 0x5e89e8
mov eax, dword [ebp - 0x24]
sub esp, 0xc
mov ecx, esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
push dword [eax + 4]
call fcn.005da510
mov ecx, esi
call fcn.005dc190
push eax
call edi
test eax, eax
jne 0x5e8a2b
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.005dc4e0
and bl, 1
mov ecx, esi
cmp dword [ebp - 0x28], 0
je 0x5e8a39
mov dl, bl
call fcn.005e7dc0
test al, al
jne 0x5e8a2b
push 0
push 0
push 0x62439c
push 0x624388
mov ecx, esi
call fcn.005da270
mov dl, bl
mov ecx, esi
call fcn.005e7cd0
test al, al
je 0x5e8a4b
lea ecx, [ebp - 0x20]
mov bl, 1
call fcn.005dc430
mov al, bl
jmp 0x5e8a6b
call fcn.005e7850
mov dl, bl
mov ecx, esi
call fcn.005e7990
test al, al
jne 0x5e8a2b
lea ecx, [ebp - 0x20]
call fcn.005dc3e0
push eax
mov ecx, esi
call fcn.005dc1c0
lea ecx, [ebp - 0x20]
xor bl, bl
call fcn.005dc430
mov al, bl
jmp 0x5e8a6b
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x5e9570
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x70f200]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push ebx
push 0xfa0
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x5e95ac
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x5e95d7
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push 2
push 2
push dword [ebp - 0xc]
lea ecx, [ebx + 0xfa4]
call fcn.005d9cd0
mov eax, dword [ebp - 0xc]
lea ecx, [ebx + 0xfb0]
push 2
push 2
add eax, 2
push eax
call fcn.005d9cd0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x624284
lea ecx, [ebx + 0xfb0]
call fcn.005dc190
push eax
lea ecx, [ebx + 0xfa4]
call fcn.005dc190
push eax
push str.StringFileInfo_
lea ecx, [ebx + 0xfbc]
call fcn.005dc200
mov ecx, dword [ebp - 4]
mov al, 2
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e1b5
mov esp, ebp
pop ebp
ret 4
Function at 0x4062e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40b508
cmp edx, dword [eax]
je 0x406307
add eax, 8
inc ecx
cmp eax, 0x40b598
jl 0x4062f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40b508]
jne 0x406435
mov eax, dword [0x40ba54]
cmp eax, 1
je 0x40640f
test eax, eax
jne 0x406338
cmp dword [0x40b1b4], 1
je 0x40640f
cmp edx, 0xfc
je 0x406435
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40636f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004037b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004038a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4063b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004038a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40957c
push edi
call fcn.004077b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004037b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004037c0
lea eax, [ebp - 0xa0]
push 0x40955c
push eax
call fcn.004037c0
push dword [esi + 0x40b50c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004037c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00407726
add esp, 0x2c
pop edi
jmp 0x406435
lea eax, [ebp + 8]
lea esi, [esi + 0x40b50c]
push 0
push eax
push dword [esi]
call fcn.004038a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x40b15a
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [pe_dos_header]
mov eax, dword ds:[eax + 0x34]
mov ebp, dword ds:[eax + 0xb8]
jmp 0x40b168
push eax
push ecx
push esi
push ebp
mov eax, dword fs:[0x30]
test eax, eax
js 0x40b14a
mov eax, dword ds:[eax + 0xc]
mov esi, dword ds:[eax + 0x1c]
lodsd eax, dword [esi]
mov ebp, dword ds:[eax + 8]
mov dword [ebx + 0x60], ebp
mov eax, ebp
cmp word [eax], 0x5a4d
jne 0x40b145
add eax, 0x3c
mov ecx, dword [eax]
add ecx, dword [ebx + 0x60]
cmp word [ecx], 0x4550
jne 0x40b145
add ecx, 0x78
mov esi, dword [ecx]
add esi, dword [ebx + 0x60]
add esi, 0x18
lodsd eax, dword [esi]
mov dword [ebx + 0x64], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x68], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x6c], eax
lodsd eax, dword [esi]
add eax, dword [ebx + 0x60]
mov dword [ebx + 0x70], eax
pop ebp
pop esi
pop ecx
pop eax
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7ffe53ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
xor eax, ecx
xor eax, ecx
add al, 0
xor eax, ecx
xor eax, ecx
and al, 0xff
xor eax, ecx
xor eax, ecx
push eax
pop eax
not eax
not eax
add al, 0
push bx
inc esp
inc esp
add al, 0
pushf
popf
push eax
pop eax
push bx
inc esp
inc esp
push es
pop ds
push bx
inc esp
inc esp
push es
pop ds
push bx
inc esp
inc esp
push es
pop ds
add al, 4
sub al, 4
and al, 0xff
not eax
not eax
and al, 0xff
not eax
not eax
push eax
pop eax
push bx
inc esp
inc esp
and al, 0xff
push bx
inc esp
inc esp
and al, 0xff
not eax
not eax
push eax
pop eax
not eax
not eax
push eax
pop eax
pushf
popf
push eax
pop eax
xor eax, ecx
xor eax, ecx
nop
call 0x7ffe5422
pop edx
xor dx, dx
inc esi
dec esi
clc
add edx, 0xd5e0
push eax
pop eax
xor ecx, ecx
and al, 0xff
push bx
inc esp
inc esp
clc
mov cl, 0x1e
push bx
inc esp
inc esp
xor byte [ecx + edx], 0xb
loop 0x7ffe5440
clc
push dword fs:[0x24]
push bx
inc esp
inc esp
pop dword [edx + 0xa]
push es
pop ds
lea esp, [esp]
mov cl, 0xff
add al, 0
xor eax, ecx
xor eax, ecx
push edx
loop 0x7ffe5462
cld
mov dword [edx + 0x11], 0xffffacbb
push bx
inc esp
inc esp
add al, 0
inc esi
dec esi
mov ecx, dword [eax + 0x2c]
add al, 0
add eax, 0
mov dword [edx + 0x1b], ecx
push es
pop ds
xor eax, ecx
xor eax, ecx
mov dword [edx + 0x100], ecx
push es
pop ds
cld
mov dword [eax + 0x2c], esp
add al, 0
not eax
not eax
inc esi
dec esi
push 0
xor eax, ecx
xor eax, ecx
nop
push es
pop ds
push 0
push es
pop ds
not eax
not eax
push 0
cld
and al, 0xff
push 0
add al, 0
push 0x30
cld
push 0x20
add al, 0
add al, 4
sub al, 4
push 0
and al, 0xff
pushf
popf
and bh, 0xff
push 0
not eax
not eax
add edx, 0xffff7f39
inc esi
dec esi
add al, 4
sub al, 4
clc
inc esi
dec esi
push edx
push eax
pop eax
push bx
inc esp
inc esp
push eax
pop eax
push edx
cld
push 0
push es
pop ds
inc esi
dec esi
call dword [edx + 0x820a]
push es
pop ds
nop
push es
pop ds
add esp, 0x3f8
xor eax, eax
xor eax, ecx
xor eax, ecx
stc
inc eax
not eax
not eax
inc esi
dec esi
ret 0xc
Function at 0x68e2e3
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x9bd7f834]
inc ebp
cmc
or byte [edx + 0x6b], 0x52
imul edi, dword [edi], 0xf097b229
mov ebx, 0xa65ca63b
or dword [edx - 0x27cccf84], ebp
jmp 0x7e59aa9d
push edx
test byte [eax - 0x10], ch
xor dh, dl
rcr dword [eax + 0x46], 0xda
cmc
pop es
enter 0xffffffffffffa533, 0x4e
cwde
sbb al, 0xe9
jp 0x68e244
hlt
jp 0x68e301
popal
movsb byte es:[edi], byte [esi]
mov ch, ch
cmp byte [edi + 0x61], cl
jle 0x68e27a
loop 0x68e2d4
xor al, 0x56
jbe 0x68e2fb
fisubr dword [eax - 0x22a827ab]
stosb byte es:[edi], al
mov ecx, 0x59d1e9fa
jns 0x68e36a
and dword [edi - 0x1c], 0x870baa3d
and dword [ebx + 0x43385311], edx
xchg ebx, eax
adc dword [ebx + 0x38], edx
inc ebx
stc
adc edx, dword [edx + 4]
xor esp, dword [ecx + 0x70]
out 0x9e, al
lodsd eax, dword [esi]
or dword [ebp - 0x3547ccd4], eax
dec edi
mov cl, 0x79
xchg edx, eax
aad 0x10
mov byte [ecx + 0x10], dl
out 0x89, eax
adc ecx, 0x9de2a4e3
fst qword [edi]
or ah, byte [ebx - 0x13]
push ebx
xchg esp, eax
jne 0x68e2d6
push edx
invalid
jno 0x68e3de
mov dword [0x87777f3e], eax
test eax, 0x33f0b81a
hlt
fidiv word [eax - 0x6856c0e8]
dec ebp
imul edx, dword [edx], 0xffffffec
jg 0x68e43d
jecxz 0x68e43d
aad 0x8e
sbb ebp, ebp
sub byte [ecx], bh
or eax, 0x1d3f5875
mov dword [0xa27f6378], eax
adc dl, byte [edx]
sub eax, 0x9a02d9ea
push edx
invalid
loop 0x68e43c
sub dh, al
inc edx
in eax, 0xa6
fimul word [edx + 0x4009ce92]
or dword [eax + 0x70], eax
int1
inc eax
jo 0x68e431
stc
push esi
pushfd
jmp 0xe4ee27f0

Function at 0x6d9803
Capabilities:
Encode data using xor

Disassembly:
jae 0x6d9834
jae 0x6d983f
mov eax, 0xc3647f
sub ecx, dword [ebp + 0x5f]
add byte [ebx], ch
dec ebp
pop edi
fstp xword [esi - 0x7cc70804]
test byte [ebp - 0x5eb75e11], al
adc cl, byte [ecx - 0x7e]
pop esi
xchg esi, eax
loop 0x6d9867
push edx
fisttp word [edx + 0x33]
wait
test al, 0xf3
invalid
das
add word [esi], ax
invalid
fnstsw word [edi]
push es
cmp eax, 0x3e72b758
js 0x6d980b
xor al, 0xe
xor dword [edx - 0x59], 0xfffffffe
fild qword [edi - 0x6a]
wait
inc ebx
mov ss, ebx
movsb byte es:[edi], byte [esi]
mov dword [0xe343b38e], eax
in al, dx
dec eax
cmp byte [ebx], dl
arpl word [edx + 0x19], si
jb 0x6d98cf
cmpsd dword [esi], dword es:[edi]
invalid
salc
movsd dword es:[edi], dword [esi]
pop esp
jno 0x6d984f
loope 0x6d982f
adc bl, byte [eax]
xor ax, 0x351e
invd
invalid
test eax, 0xc3b0dcce
xchg esp, eax
invalid
cwde
rcl byte [eax + 0x61]
in eax, dx
jle 0x6d98b3
add byte [edi - 0x532052c1], ch
call 0x2c041ea8
in eax, 0xd8
adc al, 0x1d
inc ebx
sub al, 0x53
mov ecx, 0x6a7e8b4f
invalid