joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465460
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
lea eax, [esp + 0x4c]
mov ebx, dword [esp + 0x70]
mov edx, dword [esp + 0x74]
mov dword [esp + 0x1c], 4
mov edi, dword [esp + 0x78]
mov ebp, dword [esp + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x80]
mov dword [esp], ebx
mov dword [esp + 0x18], 0x270f
mov dword [esp + 0x20], eax
lea eax, [esp + 0x48]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebp
mov dword [esp + 4], edx
mov dword [esp + 0x4c], 0
call method.std::time_get_char__std::istreambuf_iterator_char__std::char_traits_char_____._M_extract_num_std::istreambuf_iterator_char__std::char_traits_char_____std::istreambuf_iterator_char__std::char_traits_char_____int__int__int__unsigned_int__std::ios_ba
sub esp, 0x28
mov ebx, eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x465540
mov ecx, dword [esp + 0x48]
lea esi, [ecx + 0x64]
lea eax, [ecx - 0x76c]
test ecx, ecx
mov ecx, dword [esp + 0x88]
cmovs eax, esi
mov dword [ecx + 0x14], eax
cmp edx, 0xffffffff
sete al
test ebx, ebx
mov esi, eax
setne al
mov ecx, esi
and cl, al
mov byte [esp + 0x38], cl
jne 0x465578
cmp ebp, 0xffffffff
sete al
test edi, edi
je 0x465518
test al, al
jne 0x465550
mov ebx, esi
cmp bl, al
jne 0x465528
mov eax, dword [esp + 0x84]
or dword [eax], 2
mov eax, dword [esp + 0x34]
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0x84]
or dword [eax], 4
jmp 0x4654f3
mov ebx, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], ebx
jb 0x465518
mov eax, dword [edi]
mov dword [esp + 0x38], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x38]
cmp eax, 0xffffffff
sete al
jmp 0x465518
mov eax, dword [ebx + 0xc]
xor esi, esi
cmp dword [ebx + 8], eax
jb 0x46550a
mov eax, dword [ebx]
mov dword [esp + 0x3c], edx
mov ecx, ebx
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x38]
cmove esi, eax
mov eax, 0
cmovne eax, ebx
mov dword [esp + 0x34], eax
jmp 0x46550a
Function at 0x4658a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xb0]
mov ecx, dword [esp + 0xa0]
mov ebx, dword [esp + 0xa4]
mov edi, dword [esp + 0xa8]
add eax, 0x6c
mov dword [esp + 0x34], ecx
mov esi, dword [esp + 0xac]
mov dword [esp], eax
call method.std::__timepunct_char__const_std::use_facet_std.__timepunct_char____std::locale_const_
mov dword [esp + 0x44], 0
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x48]
mov dword [esp + 0x48], edx
mov edx, dword [eax + 0x4c]
mov dword [esp + 0x4c], edx
mov edx, dword [eax + 0x50]
mov dword [esp + 0x50], edx
mov edx, dword [eax + 0x54]
mov dword [esp + 0x54], edx
mov edx, dword [eax + 0x58]
mov dword [esp + 0x58], edx
mov edx, dword [eax + 0x5c]
mov dword [esp + 0x5c], edx
mov edx, dword [eax + 0x60]
mov dword [esp + 0x60], edx
mov edx, dword [eax + 0x2c]
mov dword [esp + 0x64], edx
mov edx, dword [eax + 0x30]
mov dword [esp + 0x68], edx
mov edx, dword [eax + 0x34]
mov dword [esp + 0x6c], edx
mov edx, dword [eax + 0x38]
mov dword [esp + 0x70], edx
mov edx, dword [eax + 0x3c]
mov dword [esp + 0x74], edx
mov edx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x78], edx
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp], ecx
mov ecx, ebp
mov dword [esp + 4], ebx
mov dword [esp + 0x18], 7
mov dword [esp + 0x10], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], esi
call sym.__ZNKSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE24_M_extract_wday_or_monthES3_S3_RiPPKcjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
mov ebp, eax
mov ebx, edx
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x4659f0
mov eax, dword [esp + 0xb8]
mov edx, dword [esp + 0x40]
mov dword [eax + 0x18], edx
cmp ebx, 0xffffffff
sete dl
test ecx, ecx
setne al
and al, dl
mov byte [esp + 0x34], al
jne 0x465a28
cmp esi, 0xffffffff
sete al
test edi, edi
je 0x4659d0
test al, al
jne 0x465a00
cmp dl, al
jne 0x4659de
mov eax, dword [esp + 0xb4]
or dword [eax], 2
add esp, 0x8c
mov eax, ebp
mov edx, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov eax, dword [esp + 0xb4]
or dword [eax], 4
jmp 0x4659af
mov esi, dword [edi + 0xc]
xor eax, eax
cmp dword [edi + 8], esi
jb 0x4659d0
mov eax, dword [edi]
mov byte [esp + 0x34], dl
mov ecx, edi
call dword [eax + 0x24]
movzx edx, byte [esp + 0x34]
cmp eax, 0xffffffff
sete al
jmp 0x4659d0
mov eax, dword [ecx + 0xc]
xor edx, edx
cmp dword [ecx + 8], eax
jb 0x4659c2
mov eax, dword [ecx]
mov byte [esp + 0x3f], dl
mov ebp, 0
mov dword [esp + 0x38], ecx
call dword [eax + 0x24]
movzx edx, byte [esp + 0x3f]
mov ecx, dword [esp + 0x38]
cmp eax, 0xffffffff
movzx eax, byte [esp + 0x34]
cmovne ebp, ecx
cmove edx, eax
jmp 0x4659c2
Function at 0x468610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, ecx
push edi
push esi
push ebx
sub esp, 0x9c
mov eax, dword [esp + 0xbc]
mov edx, dword [esp + 0xc0]
mov esi, dword [esp + 0xb0]
mov ebx, dword [esp + 0xb4]
mov dword [esp + 0x3c], eax
lea eax, [edx + 0x6c]
mov edi, dword [esp + 0xb8]
mov dword [esp], eax
call method.std::__timepunct_wchar_t__const_std::use_facet_std.__timepunct_wchar_t____std::locale_const_
mov edx, dword [esp + 0xc0]
mov dword [esp + 0x54], 0
mov eax, dword [eax + 8]
mov ecx, dword [eax + 0x48]
mov dword [esp + 0x58], ecx
mov ecx, dword [eax + 0x4c]
mov dword [esp + 0x5c], ecx
mov ecx, dword [eax + 0x50]
mov dword [esp + 0x60], ecx
mov ecx, dword [eax + 0x54]
mov dword [esp + 0x64], ecx
mov ecx, dword [eax + 0x58]
mov dword [esp + 0x68], ecx
mov ecx, dword [eax + 0x5c]
mov dword [esp + 0x6c], ecx
mov ecx, dword [eax + 0x60]
mov dword [esp + 0x70], ecx
mov ecx, dword [eax + 0x2c]
mov dword [esp + 0x74], ecx
mov ecx, dword [eax + 0x30]
mov dword [esp + 0x78], ecx
mov ecx, dword [eax + 0x34]
mov dword [esp + 0x7c], ecx
mov ecx, dword [eax + 0x38]
mov dword [esp + 0x80], ecx
mov ecx, dword [eax + 0x3c]
mov dword [esp + 0x84], ecx
mov ecx, dword [eax + 0x40]
mov eax, dword [eax + 0x44]
mov dword [esp + 0x88], ecx
mov ecx, ebp
mov dword [esp + 0x8c], eax
lea eax, [esp + 0x54]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp], esi
mov dword [esp + 4], ebx
xor bx, bx
mov dword [esp + 0x18], 7
mov dword [esp + 8], edi
mov dword [esp + 0xc], eax
call sym.__ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE24_M_extract_wday_or_monthES3_S3_RiPPKwjRSt8ios_baseRSt12_Ios_I
sub esp, 0x24
mov ecx, eax
movzx esi, dx
mov eax, edx
mov dword [esp + 0x4c], edx
mov edx, ebx
mov ebx, dword [esp + 0x54]
mov ebp, ecx
mov dword [esp + 0x48], ecx
or edx, esi
test ebx, ebx
jne 0x468780
mov ebx, dword [esp + 0xc8]
mov esi, dword [esp + 0x50]
mov dword [ebx + 0x18], esi
cmp ax, 0xffff
sete bl
test ecx, ecx
setne al
and al, bl
mov esi, eax
jne 0x4687a8
cmp word [esp + 0x3c], 0xffff
sete al
mov ecx, eax
test edi, edi
je 0x468762
test al, al
jne 0x468790
cmp bl, cl
jne 0x468770
mov eax, dword [esp + 0xc4]
or dword [eax], 2
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 0x1c
mov esi, dword [esp + 0xc4]
or dword [esi], 4
jmp 0x46873d
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jae 0x4687d0
movzx eax, word [eax]
cmp ax, 0xffff
sete cl
jmp 0x468762
mov eax, dword [ecx + 8]
cmp eax, dword [ecx + 0xc]
jae 0x4687e8
movzx eax, word [eax]
cmp ax, 0xffff
mov ebx, 0
mov ebp, 0
cmove ebx, esi
cmovne ebp, ecx
jmp 0x46874f
mov eax, dword [edi]
mov dword [esp + 0x3c], edx
mov ecx, edi
call dword [eax + 0x24]
mov edx, dword [esp + 0x3c]
jmp 0x46879b
mov eax, dword [ecx]
mov dword [esp + 0x44], edx
mov dword [esp + 0x40], ecx
call dword [eax + 0x24]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
jmp 0x4687b3
Function at 0x485540
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, ecx
sub esp, 0x1c
mov edi, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
jmp 0x485563
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x485581
mov ecx, ebx
call method.std::__basic_file_char_.fd__
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp], eax
call sym._read
mov ebp, eax
cmp eax, 0xffffffff
je 0x485558
add esp, 0x1c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x4498e0
Capabilities:
Get disk information

Disassembly:
popal
sbb ebx, edi
xor eax, eax
mov word [ecx + 0x16], ax
mov edx, dword [esi + 0x138]
mov dword [ecx + 0x5a], edx
mov eax, dword [esi + 0x13c]
mov dword [ecx + 0x5e], eax
mov dx, word [esi + 0x140]
mov word [ecx + 0x62], dx
test dword [esi + 0x70], 0x2000
je 0x449924
fld dword [esi + 0x15c]
fstp dword [ecx + 0x28]
mov eax, dword [esi + 0x234]
mov dword [ecx + 0xfc], eax
cld
add byte [eax], al
invalid
test dword [esi + 0x70], 0x400
je 0x449937
cmp byte [ecx + 0x18], 0x10
jne 0x449937
mov byte [ecx + 0x18], 8
test dword [esi + 0x70], 0x4000
je 0x449944
or byte [ecx + 0x19], 2
test dword [esi + 0x70], 0x600000
je 0x449951
and byte [ecx + 0x19], 0xfd
test byte [esi + 0x70], 0x40
je 0x449975
mov al, byte [ecx + 0x19]
cmp al, 2
je 0x449962
cmp al, 6
jne 0x449975
cmp dword [esi + 0x1ec], 0
je 0x449975
cmp byte [ecx + 0x18], 8
jne 0x449975
mov byte [ecx + 0x19], 3
test byte [esi + 0x70], 4
je 0x449985
cmp byte [ecx + 0x18], 8
jae 0x449985
mov byte [ecx + 0x18], 8
mov al, byte [ecx + 0x19]
mov dl, 1
cmp al, 3
je 0x449998
test al, 2
je 0x449998
mov byte [ecx + 0x1d], 3
jmp 0x44999b
mov byte [ecx + 0x1d], dl
test dword [esi + 0x6c], 0x400000
je 0x4499a9
and al, 0xfb

Function at 0x4499a0
Capabilities:
Get disk information

Disassembly:
inc eax
add byte [ebp + eax + 0x24], dh
sti
mov byte [ecx + 0x19], al
mov al, byte [ecx + 0x19]
test al, 4
je 0x4499b3
add byte [ecx + 0x1d], dl
test dword [esi + 0x70], 0x8000
je 0x4499d5
cmp al, 2
je 0x4499c4
test al, al
jne 0x4499d5
add byte [ecx + 0x1d], dl
test dword [esi + 0x70], 0x1000000
je 0x4499d5
or al, 4
mov byte [ecx + 0x19], al
test dword [esi + 0x70], 0x100000
je 0x4499f4
mov al, byte [esi + 0x64]
cmp byte [ecx + 0x18], al
jae 0x4499e9
mov byte [ecx + 0x18], al
mov al, byte [esi + 0x65]
cmp byte [ecx + 0x1d], al
jae 0x4499f4
mov byte [ecx + 0x1d], al
mov al, byte [ecx + 0x18]
imul byte [ecx + 0x1d]
mov byte [ecx + 0x1e], al
cmp al, 8
pop esi
Function at 0x4d7c80
Capabilities:
Encode data using xor

Disassembly:
add byte [esi + 0x51], 0xe9
cdq
dec esi
jno 0x4d7cee
sbb bh, 0x70
cld
les edx, [ebp + 0x32c089b2]
mov ebx, 0x9638e281
sub ebp, dword [esi + 0x5c]
or al, 0x56
into
adc al, 0xc0
pop esi
mov eax, 0x5642077
test dword [ebx], esi
shl bh, 0xb6
aad 0x82
mov ah, 0x44
aaa
cdq
cmp cl, byte [edi]
int 0x1c
dec edx
inc edi
sub dword [ecx + 0x26d29ed5], eax
inc ebx
call 0xfb8a2425
bnd retf
lodsb al, byte [esi]
nop
mov bh, 0xef
sbb dword fs:[edx], esp
mov edi, 0xaa549895
xchg ebp, eax
cwde
push esp
stosb byte es:[edi], al
xor eax, 0x80ac5039
call 0xae954801
imul eax, edx, 0x61
adc byte [ebp - 0x164b9fa4], bl
test al, 0x99
stosb byte es:[edi], al
sbb eax, 0x2d8debd1
and eax, 0xa2a57c7
sbb edi, dword [esi - 0x23d54b2d]
inc esp
mov dword [0x140577bd], eax
push es
xlatb
ja 0x4d7ce6
or bh, byte [bp + di + 0x334d]
rol byte [esi + ecx*8 + 0xa5ee227], 1
jb 0x4d7d4b
movsb byte es:[edi], byte [esi]
push es
sbb byte [ecx - 0x62], 0x87
inc esp
jns 0x4d7d52
clc
sub bh, 0x59
push ecx
dec esp
retf 0x830f
test eax, 0x14757c45
movsd dword es:[edi], dword [esi]
clc
aas
sbb dh, byte [edx + ebp*8 + 0x63]
test cl, dh
sub al, 0x9e
or ah, byte [edi]
dec ecx
retf 0xb739

Function at 0x5ea599
Capabilities:
Encode data using xor

Disassembly:
add edi, esp
shufps xmm2, xmmword ss:[0x56090cb6], 0xba
xchg esi, eax
mov eax, 0x5146658e
fcomp dword [eax + 0x53]
xor al, 0x80
push esp
pop esp
xchg dword [edi], ecx
imul ecx, ebp, 0xd13bc500
salc
int 0
lds edi, [ebx]
rcl esi, 1
add dl, dh
cld
and ebx, dword [eax]
sbb ch, byte [0x39799ce6]
stosd dword es:[edi], eax
xor ch, dl
scasd eax, dword es:[edi]
mov ebx, 0x8b213c77
outsb dx, byte [esi]
cdq
fimul word [ebx]
dec esp
sahf
xchg edx, eax
jno 0x5ea4f9
cmp eax, 0xd40e2ff2
xor ch, byte [edi + 0x74]
mov dh, 0xb
sbb eax, 0x9e4b1260
je 0x5ea4dc
or ebx, dword [0x9e4b1260]
pop ecx
push ds
or eax, eax
mov bh, 0xd2
fbld tbyte [0x6ecba07e]
dec edi
push cs
daa
xchg edi, eax
push es
aas
retf
jle 0x5ea524
sub al, 0xd2
aas
lodsd eax, dword [esi]
inc ebx
jmp 0xcb8f16cb
Function at 0x5edb2c
Capabilities:
Encode data using xor

Disassembly:
lcall 0xafaa, 0xcbbacc69
int1
inc ebp
dec ebp
fdiv st(7), st(0)
stc
fnstcw word [esi]
xchg ecx, eax
bound ebp, qword [ecx + 1]
retf
jg 0x5eda4c
in eax, 0x71
sub ecx, dword [ecx]
push ebx
dec ecx
jno 0x5eda94
or dword [ebx + 0x49], edx
arpl word [edi + 0x11665f93], bp
cvtps2pd xmm1, qword [edi - 0x1a]
sal byte [eax + 0x5e24ce50], cl
out 0xca, eax
xor dword [edi + 0x43], edx
test dword [edi + eax*8], 0x570f2cdd
inc esi
jae 0x5eda66
push ebp
lahf
shr byte [ecx + 0x5b], 0x96
test dl, dh
dec ebp
scasb al, byte es:[edi]
mov ch, 0xa9
cmp byte cs:[ebp - 0x21], 0xc3
iretd
call 0xf80ec6e7
jp 0x5eda65
outsb dx, byte [esi]
out 0xa7, al
les esi, [ebx + ebp + 0x2834995d]
mov edx, esi
cmp bl, byte [esp]
out 0xf7, eax
insd dword es:[edi], dx
dec esp
cmpsd dword [esi], dword es:[edi]
xchg ebp, eax
mov esp, dword [ecx - 0x2fcb7582]
movsb byte es:[edi], byte [esi]
les esp, [ebx + 6]
adc edi, dword [ecx]
test al, 0x88
lea esi, [esi + 0x224a9da7]
cmp byte [ebp + 0x7d], cl
wait
imul ebp, edi, 0xffffffb1
push ecx
hlt
pop ebp
jg 0x5edac8
pop edi
and byte gs:[ebx + 0x36fcf5f3], 0x10
push 0xffffffffffffff9f
ror dh, cl
invalid

Function at 0x5eff78
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop ds
loopne 0x5effca
insd dword es:[edi], dx
and eax, 0xfe01b5c
iretd
jge 0x5eff56
sub dh, dh
adc edi, eax
Function at 0x63692c
Capabilities:
Encode data using xor

Disassembly:
arpl dx, sp
out dx, al
mov al, 0xed
daa
or ecx, edi
stosd dword es:[edi], eax
lcall 0xac9e, 0x94ba1518
ja 0x6368ad
pop eax
and eax, 0x6a56e1a4
xor esp, ecx
and cl, byte [edx + edx]
pop ecx
fdivr st(7), st(0)
stosd dword es:[edi], eax
sbb eax, 0xc39a0f70
movsd dword es:[edi], dword [esi]
retf 0x4d02
mov ah, 0xc5
jge 0x63688b
add dh, byte [ecx - 0x59c917a7]
mov esp, 0x6cb17d8c
call 0x8d200f11
jge 0x63688e
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
inc ebx
cli
int3
mov byte [esi + 0x120ad613], ah
jne 0x6368d3
cmp al, 0xa8
pushal
sub al, 0x48
cmc
pop ebp
xchg esi, eax
xchg ebx, eax
pop eax
out 0x11, eax
and byte [edi], ch
jl 0x6369c0
jg 0x6368cf
jae 0x6368d6
pop eax
jle 0x636964
add byte [esi], bl
lodsd eax, dword [esi]
invalid
adc al, 0xe6
adc al, 0x9d
and ecx, dword [ecx + esi*8 + 0x3f]
add dword [eax - 0x7f], ebx
cmp ah, cl
mov esp, 0xdeb2fd60
cmp dword [edx + ecx*4 - 0x7b807dd1], 0x7c
invalid
push edx
push eax
jno 0x6369fc
push esi
aad 0x44
inc esp
cmpsb byte [esi], byte es:[edi]
pop ds
and ebp, dword [eax]
fidivr word [ebp*4 + 0xd559e4a]
pop ss
cmp ch, byte [ebx + eax*4]
invalid
sar ah, 1
sub al, 0xc8
xchg esp, eax
jb 0x636a5d
pop ebp
jno 0x636a20
push ds
inc ecx
sbb eax, 0x64b3cdae
pop ebp
cmp al, 0x87
fnstcw word [esi + ecx - 0x43e622a2]
mul byte [0xe8036e39]
xchg ecx, eax
sub eax, 0x39d8be4f
cmp dword [esi + 3], ebp
call 0xbeb29795
fdivr dword [ecx]
xor ch, byte [ebp + 0x2b384aa]
dec esp
adc eax, 0x1d6ff408
jmp 0x636a80
nop
lodsb al, byte [esi]
mov cl, byte [0x5c046f7b]
and al, 0x3f
adc bl, byte [eax + edi*4]
int 0x26
xor eax, 0xfd390de2
jbe 0x636ab4
in eax, dx
mov edi, 0x4d5a3dd
loop 0x636ab6
jge 0x6369c9
jg 0x636a50
jae 0x6369c6
xor ch, ch
and byte [ecx + edx + 0x3b], bh
pop esp
sub dword [ebx + 0x75ceb7ad], 0x5def418c
stosd dword es:[edi], eax
lodsd eax, dword [esi]
mov bh, 0xce
jne 0x6369de
inc ecx
out dx, eax
pop ebp
fstp qword [edx - 0x7ace75d0]
mov byte [esi + eax*4 + 0x5d519835], dh
ljmp 0xc8d
xchg byte [0xea5d5198], dh
lodsd eax, dword [esi]
and al, 0x4d
insd dword es:[edi], dx
lea ecx, [esp + edi*4]
add byte [ebx], dl
or eax, 0xd2f25fe5
ficom dword ds:[ebx + 0x2bdfc9c8]
xor cl, bl
mov cl, 0x94
aad 0xdd
inc edx
mov cs, esi
into
lahf
pop edi
call [edi - 0x5c]
je 0x636a4c
cmp dword [ebx + 0x33], ebx
mov ch, 0xda
shr bh, 0x15
mov cl, 0xb0
pxor mm4, qword [edx + ecx*8 + 0x34]
test byte [ecx + ebp*4], dh
pop esp
push edx
cdq
mov eax, 0x5b49b8a6
dec ecx
nop
fcom qword [eax]
jl 0x636afb
or dl, byte [ebp + 0x36]
xor edi, ebp
test eax, 0x4f6c8714
clc
hlt
loop 0x636a78
invalid
push ecx
fist word [edi - 0x43]
outsb dx, byte [esi]
inc eax
cmp byte [ebx - 0x4be10fca], ch
pop esp
or eax, 0x2da8ddfc
bound esi, qword [ecx - 0x33783f3c]
imul ebx, dword [ecx - 0x33], 0xffffffa9
fdiv st(7), st(0)
push 0xb7517c83
xor al, 0xdb
out dx, eax
in eax, dx
dec edi
adc eax, dword [ebx - 0x13]
push 0x3db38b5c
jp 0x636b07
pop ebx
mov al, byte [0xd0ac6d07]
jmp dword [eax - 0x5ff2deb1]
Function at 0x401190
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c48
call fcn.004316a0
mov eax, dword [0x45c1a8]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x14], 0
jbe 0x401380
mov dword [ebp - 0x1c3c], 0x1c2e
mov dword [ebp - 4], 0
jmp 0x4011d8
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 4]
mov byte [ebp + eax - 0x1c38], cl
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c3c]
jae 0x4011e5
jmp 0x4011c2
mov dword [ebp - 0x1c44], 0
mov ecx, dword [ebp - 0x1c44]
mov dword [ebp - 4], ecx
jmp 0x401203
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x1c3c]
jae 0x401283
mov ecx, dword [ebp - 4]
movzx ecx, byte [ebp + ecx - 0x1c38]
add ecx, dword [ebp - 0x1c44]
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx edx, word [eax + edx*2]
add ecx, edx
mov eax, ecx
xor edx, edx
div dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c44], edx
mov eax, dword [ebp - 4]
mov cl, byte [ebp + eax - 0x1c38]
mov byte [ebp - 0x1c45], cl
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x1c44]
mov cl, byte [ebp + eax - 0x1c38]
mov byte [ebp + edx - 0x1c38], cl
mov edx, dword [ebp - 0x1c44]
mov al, byte [ebp - 0x1c45]
mov byte [ebp + edx - 0x1c38], al
xor ecx, ecx
jne 0x401240
jmp 0x4011fa
mov dword [ebp - 0x1c40], 0
mov edx, dword [ebp - 0x1c40]
mov dword [ebp - 0x1c44], edx
mov eax, dword [ebp - 0x1c44]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x14]
sub edx, 1
mov dword [ebp + 0x14], edx
test ecx, ecx
je 0x40137b
mov eax, dword [ebp - 4]
add eax, 1
xor edx, edx
div dword [ebp - 0x1c3c]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movzx eax, byte [ebp + eax - 0x1c38]
add eax, dword [ebp - 0x1c44]
xor edx, edx
div dword [ebp - 0x1c3c]
mov dword [ebp - 0x1c44], edx
mov ecx, dword [ebp - 4]
mov dl, byte [ebp + ecx - 0x1c38]
mov byte [ebp - 0x1c46], dl
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c44]
mov dl, byte [ebp + ecx - 0x1c38]
mov byte [ebp + eax - 0x1c38], dl
mov eax, dword [ebp - 0x1c44]
mov cl, byte [ebp - 0x1c46]
mov byte [ebp + eax - 0x1c38], cl
xor edx, edx
jne 0x4012e6
mov eax, dword [ebp - 4]
movzx eax, byte [ebp + eax - 0x1c38]
mov ecx, dword [ebp - 0x1c44]
movzx edx, byte [ebp + ecx - 0x1c38]
add eax, edx
cdq
idiv dword [ebp - 0x1c3c]
movzx eax, byte [ebp + edx - 0x1c38]
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 0x1c40]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x1c40]
mov byte [eax], dl
mov ecx, dword [ebp - 0x1c40]
add ecx, 1
mov dword [ebp - 0x1c40], ecx
jmp 0x4012a2
mov eax, dword [ebp + 0x10]
jmp 0x401382
xor eax, eax
mov ecx, dword [ebp - 8]
call fcn.00431690
mov esp, ebp
pop ebp
ret
Function at 0x413570
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x413595
xor eax, eax
jmp 0x4135b4
push 8
push 1
push 0
push 0
lea ecx, [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x4135af
xor eax, eax
jmp 0x4135b4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4284b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x428506
call fcn.004499c7
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x428506
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x4284fc
xor eax, eax
jmp 0x42861f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x428536
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x428536
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x42861c
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x428563
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0042962f
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x42861c
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4285ac
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x4285ac
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x4285a6
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0042962f
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x42860c
and dword [ebp + 0xc], 0
jmp 0x42860c
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x42860c
push 0xc
call fcn.0043f6fe
mov esi, eax
test esi, esi
pop ecx
je 0x4285ee
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4285f0
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x428607
push dword [ebp - 8]
call fcn.0043ef95
jmp 0x42860c
call fcn.0043ef6c
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x428571
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc