joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408bdc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00408b90
test al, al
jne 0x408bfd
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x408c49
xor eax, eax
push ebp
push 0x408c39
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c40
lea eax, [ebp - 0xc]
call fcn.00408bcc
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408f50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x40903f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.00406adc
mov edx, dword [ebp - 8]
mov ecx, 0x409058
xor eax, eax
call fcn.00408e44
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x40900d
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
je 0x408f70
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov al, 0x2f
call fcn.004089fc
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.00404bdc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00407054
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x14]
mov ecx, 2
mov al, 0x60
call fcn.004089cc
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, 0x4045a8
call fcn.004057d8
call fcn.00402eb4
jmp 0x408f70
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.0040322c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409046
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.004031b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004031b8
ret

Function at 0x409120
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40917a
inc esi
xor edi, edi
cmp edi, 1
jne 0x409146
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x409154
cmp edi, 1
jle 0x409154
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00408bdc
test eax, eax
jne 0x40917a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x40917a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x40917a
inc edi
dec esi
jne 0x409136
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x409538
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x78]
xor eax, eax
push ebp
push 0x409628
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409640
push esi
push 0x40964c
push edi
lea eax, [ebp - 8]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4095bc
mov al, 0x62
call fcn.00409184
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x4095d3
push ebx
call sub.user32.dll_TranslateMessage
push ebx
call sub.user32.dll_DispatchMessageA
push 1
push 0
push 0
push 0
push ebx
call sub.user32.dll_PeekMessageA
test eax, eax
jne 0x4095c7
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x5c]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4095d3
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40962f
lea eax, [ebp - 8]
call fcn.00403198
ret

Function at 0x4096e0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
jmp 0x409789
cmp dword [esi + 0x10], 0x1000
jne 0x409775
test byte [esi + 0x15], 1
jne 0x409775
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409734
cmp eax, 2
je 0x409734
cmp eax, 0x10
je 0x409734
cmp eax, 0x20
jne 0x409749
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409749
mov bl, 1
xor ebp, ebp
jmp 0x40975a
mov eax, dword [esi]
add eax, ebp
call fcn.004096d8
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x40974d
test bl, bl
je 0x409775
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409794
mov eax, dword [esi + 4]
cmp eax, edi
je 0x40970c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4049f0
Capabilities:
Get common file path
Get disk information
Get hostname
Get memory capacity
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2160
call fcn.0040fbb0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x44c3c8]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x44c3cc]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x1c], edx
call fcn.004049e0
mov ecx, dword [0x44c3d0]
mov edx, dword [0x44c3d4]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x20
jmp 0x404a60
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov esi, dword [ebp - 0xc]
mov eax, dword [0x45a8c4]
shl esi, 4
add esi, dword [ebp - 0x24]
cmp eax, 0xfa9
jne 0x404a8c
mov dword [0x45a8c0], 0xedeb2e40
jmp 0x404aa7
cmp eax, 0x3eb
jne 0x404aa7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [0x45a350], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x45a8c4], 0x9e6
mov dword [0x45a8bc], 0xf4ea3dee
jne 0x404ae2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x45a8c4], 0x213
jne 0x404b80
push 0
lea eax, [ebp - 0x1960]
push eax
push 0
push 0
push 0
push 0
call ebx
lea ecx, [ebp - 0x960]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x1160]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
lea ecx, [ebp - 0x2160]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_IsBadCodePtr]
lea edx, [ebp - 0x30]
push edx
push 0
lea eax, [ebp - 0x4c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
sub edi, dword [ebp - 4]
cmp dword [0x45a8c4], 0xc
jne 0x404b9e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeMountPointA]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp - 8]
mov edx, edi
shr edx, 5
lea ecx, [eax + edi]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, edi
shl eax, 4
add eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 4]
xor eax, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
sub dword [ebp - 8], eax
sub dword [ebp - 0x14], 1
jne 0x404a60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404bf0
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Get thread local storage value
Read pipe
Set environment variable
Write pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1408
call fcn.0040fbb0
mov eax, dword [0x45a8c4]
mov ecx, dword [0x45a354]
shr eax, 3
test eax, eax
jbe 0x404d0a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTimeFormatA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov edi, edi
cmp dword [0x45a8c4], 0x959
jne 0x404cf0
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
lea ecx, [ebp - 0x1408]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
lea edx, [ebp - 0xc08]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push 0
push 0
push 0
push 0
push 0
push 0
call esi
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, dword [ebp - 4]
push ecx
call fcn.004049f0
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x404c30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x408d7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b540]
jne 0x408d86
repz ret
jmp fcn.0040d03b

Function at 0x40c073
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040a41d
and dword [ebp - 4], 0
cmp dword [0x4515a0], 0
mov ebx, eax
jne 0x40c124
push 0x4024fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c1d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4024f0
push edi
call esi
test eax, eax
je 0x40c1d5
push eax
call fcn.0040a3ab
mov dword [esp], 0x4024e0
push edi
mov dword [0x4515a0], eax
call esi
push eax
call fcn.0040a3ab
mov dword [esp], 0x4024cc
push edi
mov dword [0x4515a4], eax
call esi
push eax
call fcn.0040a3ab
mov dword [esp], 0x4024b0
push edi
mov dword [0x4515a8], eax
call esi
push eax
call fcn.0040a3ab
pop ecx
mov dword [0x4515b0], eax
test eax, eax
je 0x40c124
push 0x402498
push edi
call esi
push eax
call fcn.0040a3ab
pop ecx
mov dword [0x4515ac], eax
mov eax, dword [0x4515ac]
cmp eax, ebx
je 0x40c17c
cmp dword [0x4515b0], ebx
je 0x40c17c
push eax
call fcn.0040a426
push dword [0x4515b0]
mov esi, eax
call fcn.0040a426
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c17c
test edi, edi
je 0x40c17c
call esi
test eax, eax
je 0x40c173
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c173
test byte [ebp - 0xc], 1
jne 0x40c17c
or dword [ebp + 0x10], 0x200000
jmp 0x40c1b5
mov eax, dword [0x4515a4]
cmp eax, ebx
je 0x40c1b5
push eax
call fcn.0040a426
pop ecx
test eax, eax
je 0x40c1b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c1b5
mov eax, dword [0x4515a8]
cmp eax, ebx
je 0x40c1b5
push eax
call fcn.0040a426
pop ecx
test eax, eax
je 0x40c1b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4515a0]
call fcn.0040a426
pop ecx
test eax, eax
je 0x40c1d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c1d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a4c0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x412250], 0
push esi
push edi
jne 0x40a436
call fcn.0040a3a2
test eax, eax
je 0x40a47b
mov eax, dword [0x412250]
cmp eax, 1
jne 0x40a457
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40a47b
jmp 0x40a4bd
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x40a4bd
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40a47f
xor eax, eax
jmp 0x40a4bd
mov eax, dword [esi]
push dword [0x412250]
call edi
mov edi, eax
test edi, edi
je 0x40a4a1
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x40a4bd
lea edi, [esi + 0xff0]
push esi
push dword [0x412250]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x40a4a7
mov eax, esi
pop edi
pop esi
ret
jmp 0x40a422

Function at 0x40a788
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x412120]
jne 0x40a792
repz ret
jmp fcn.0040adba

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x68db1bdb
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1d821d84
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x422c10
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x422d1c
test eax, eax
je 0x422d1c
push esi
push edi
mov ecx, 0x10
mov esi, 0x43dfe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x422d03
lea edi, [eax + 4]
jmp 0x422c67
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x422c7c
mov dword [ebp - 4], 2
jmp 0x422c9d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x422c93
mov dword [ebp - 4], 1
jmp 0x422c9d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x422d13
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x422cd6
mov byte [ecx], 0x3d
jmp 0x422ce2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x422ced
mov byte [ecx], 0x3d
jmp 0x422cf3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x422c64
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d40e
Capabilities:
Encode data using xor

Disassembly:
cmc
aas
stc
mov cl, 0x90
xor eax, 0x60675f01
sub ebx, dword [ebx]
hlt
loop 0x43d3b8
pop ss
and esi, dword [edx*8 + 0x78784bd4]
invalid

Function at 0x451e2e
Capabilities:
Encode data using xor

Disassembly:
aaa
outsd dx, dword [esi]
std
mov bl, 0xe7
xchg esi, eax
ficomp word [eax - 0x76]
loope 0x451e34
mov ah, cl
cli
add al, 0x97
lds ebp, [edi - 0x38]
cmp eax, 0x5e32de44
cmp dh, bl
fld xword [ebx]
les ebx, [ecx - 0x417b1296]
push cs
outsb dx, byte [esi]
fistp qword [eax + 0x61]
test dword [edi - 0x35], 0xe519a14a
xor bl, bl
xor byte [ebx - 0x14], 7
sbb eax, 0x1e8634f6
mov eax, dword ss:[0xed07ef54]
jno 0x451e3c
and ebp, edi
add ebx, dword [edi + 0x9d98b02]
cmp al, 0xae
inc edi
int 0x36
sub eax, 0x6edc8e50
mov ds, esp
outsb dx, byte [esi]
adc al, 0x6b
jne 0x451e7d
in eax, 0xe8
sar dword [ebx - 0x317f5cf], cl
pop ds
sub al, 0x16
jle 0x451e37
xor ah, dh
adc byte [edx + 0x2d], bl
push es
je 0x451e9f
stc
dec ebx
out 7, al
std
jmp 0x451e4e
scasb al, byte es:[edi]
cmp ebx, dword [ebx - 0x12]
hlt
Function at 0x496e85
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
adc dword [ebx - 0x53db8eeb], 0xdc64377a
jns 0x496e77
call dword [ebp - 0xd7e6674]
xchg ebp, eax
mov word [ecx + 0x68f5f281], ds
aad 6
jg 0x496ef8
cmc
push 0x757f06d5
mov ecx, 0x2191c639
sbb bh, byte [ebx + edi*2 + 0x34a02176]
mov ebx, 0xfbd1992b
push eax
test byte [ebx], dh
stosb byte es:[edi], al
mov al, byte [0xf1a7b890]
xchg ecx, eax
and dword [edx], ebx
mov esp, 0xa021767b
xor al, 0xbb
sub ebx, dword [ecx - 0x7baf042f]
xor ebp, dword [edx - 0x58476f60]
int1
dec esp
add dh, bh
call 0xd8e15662
jnp 0x496e6b
jbe 0x496e7d
sbb edi, dword ss:[esi - 0x325962d8]
jns 0x496f1e
inc edx
pop esp
dec eax
mov ecx, 0xe89b3675
sbb edx, ecx
loopne 0x496f0a
sar byte [edx], 4
test eax, 0x7f4cba60
or dword [ecx], ebx
mov edx, 0x19097f4c
cmp ah, ah
cmp byte [ebp + 0x4f984f78], dh
popfd
sub edi, eax
invalid
stc
sub esi, eax
jle 0x496ec3
out dx, al
adc edi, ecx
invalid
fmul dword [edi]
and esp, esp
popal
js 0x496f87
loopne 0x496f0f
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
xchg dword [edi - 0x20], ebx
jmp 0x8a6a3fad
invalid
sbb al, byte [esi + 0x38]
push es
clc
cwde
clc
pop ss
cmp ch, bh
std
clc
out 0x43, eax
aam 0x55
inc eax
add ebp, dword [eax]
sub byte [esi - 0x58], ah
outsd dx, dword [esi]
xchg dword [edx], esi
out dx, eax
mov al, 0x38
and byte [ecx - 0x4f], al
test eax, 0x9771f4f9
mov bl, 0x66
stosd dword es:[edi], eax
mov cl, 0xaf
fldenv [ecx]
sbb edx, ecx
mov ecx, 0x84079fe7
inc esp
mov ss, word [ecx + eax]
push esi
shl dword [edx], cl
dec esp
adc bh, 0xa1
jle 0x496fd7
cmp dword [ebx], ecx
or al, 0xff
inc edi
invalid
aaa
xchg ebx, eax
dec ebp
loopne 0x496fde
xor eax, 0xf8c0678e
sub ebp, dword [esi - 0x1e91008e]
out 0x24, al
sar al, 0x2b
scasb al, byte es:[edi]
jb 0x496fe4
jmp [esi - 0x1f]
outsb dx, byte [esi]
loope 0x497026
out 0x24, al
xlatb
loopne 0x497034
jg 0x49700f
in eax, 0x11
dec esp
mov eax, 0x7a979ec6
push esp
xor dl, byte [eax + 0xeee5c5d]
xor eax, 0x35d0229
mov al, 0xe2
in eax, 0x7d
je 0x496f90
outsb dx, byte [esi]
sub eax, 0x1ed16c2a
push ds
in eax, 0x67
xor dword [edx - 0x80], esi
sub eax, 0xfec76ef2
cwde
mov es, eax
add ah, dl
xchg byte [edi - 0x32], ah
cmpsb byte [esi], byte es:[edi]
sub al, 0xb0
arpl word [eax + 0x68], ax
xor byte [edi + 0x221c66f4], ch
inc eax
push 0x66f4af30
sbb al, 0x22
scasb al, byte es:[edi]
ljmp 0x90ec
in al, dx
nop
mov cl, 0xe6
invalid
Function at 0x60667e
Capabilities:
Authenticate hmac

Disassembly:
mov dh, 0x49
sub eax, 0x75e6e802
cmpsd dword [esi], dword es:[edi]
test byte [esi - 0x7bdd6f94], dh
jmp 0x606659
aam 0xc2
cmc
call dword [eax - 0x57b4d448]
wait
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
mov cl, 0xb1
push esi
arpl word [ebx + 0x2f], di
cmpsb byte [esi], byte es:[edi]
cmpsd dword [esi], dword es:[edi]
xor al, 0xc3
mov ecx, 0x75f17c3f
or ecx, dword [eax]
sub al, 0x66
iretd
test al, 0xbf
cmp esi, 0x4a
dec esi
insb byte es:[edi], dx
dec esi
mov ah, ah
aam 0x3c
je 0x60663c
xor ah, byte [esp + ecx*4]
pop ebp
shr byte [edi - 0x7be81c3a], 1
leave
stosd dword es:[edi], eax
scasd eax, dword es:[edi]
invalid
adc esp, dword [eax - 0x379da980]
sub dh, ch
cmc
js 0x6066d8
sub dh, cl
pop ecx
cmp eax, 0x86406c59
sub esi, dword [ebp - 0x3b3313d5]
add edi, edi
xor dl, byte [esi + 0x462f3f2d]
push esp
or al, 0x36
loopne 0x6066e0
scasb al, byte es:[edi]
ljmp 0xb1a
mov cs, word [eax]
insb byte es:[edi], dx
cmp al, 0x5c
push 0xddeb382e
xchg edx, eax
ror byte [edx + 0x275b6799], 0x5c
mov bl, byte [ecx + 0x5c275b67]
fisttp dword [eax - 0x1f508492]
mov ah, 0xb0
outsb dx, byte [esi]
jnp 0x606692
loopne 0x606699
mov al, 0x4f
dec edi
xor eax, 0xa9b674e2
pop ebp
pop esi
jae 0x6066b2
and dword [0xe797257c], 0x3bfa7d2e
mov al, byte [0x8e0cd91]
and eax, 0x7d2ee797
cli
xchg edi, eax
out 0x2e, eax
jge 0x6066f3
cmp esp, dword [eax + 0x8e0cd91]
add al, 0xa3
movsd dword es:[edi], dword [esi]
mov ebx, 0x6a0df41
js 0x60670e
leave
sub al, 0x58
inc esi
xchg edx, eax
push edx
or dword [esi], eax
pop ds
xchg ecx, eax
mov ecx, eax
test byte [esp + esi*8 + 0x60], al
push ebx
rcl dword [ebx], 0xf8
cmc
push 0x37
or byte [esp + ebp*8], dl
inc ecx
in al, dx
popal
add edi, edi
push ss
cmp byte [eax], bl
dec ebp
fsubp st(0)
jo 0x6066cb
scasb al, byte es:[edi]
dec dh
push ebp
daa
push ds
jne 0x6066e6
jnp 0x6066f4
pop edi
push edi
in eax, dx
wait
pop ebp
mov eax, dword [0xd2864b0e]
jb 0x606748
dec ebp
mov cl, 0x9f
int 0xb1
lahf
or cl, byte [esi - 0x2b]
fadd dword [edi + edi*8 - 0x7409dc10]
cmp al, 0x3f
cmc
dec ebx
adc eax, 0x4bdbafdc
sub cl, byte [esi]
into
str word [ebx]
test byte [esi - 0x442a162], ch
mov cl, 0x39
pushal
jmp 0x606738
Function at 0x628cb9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313e8
cmp edx, dword [eax]
je 0x628cdb
add eax, 8
inc ecx
cmp eax, 0x631478
jl 0x628ccc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313e8]
jne 0x628e09
mov eax, dword [0x639d88]
cmp eax, 1
je 0x628de3
test eax, eax
jne 0x628d0c
cmp dword [0x631310], 1
je 0x628de3
cmp edx, 0xfc
je 0x628e09
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628d43
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006296a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629b30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628d86
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629b30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62da3c
push edi
call fcn.0062ba00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006296a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006296b0
lea eax, [ebp - 0xa0]
push 0x62da1c
push eax
call fcn.006296b0
push dword [esi + 0x6313ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.006296b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b974
add esp, 0x2c
pop edi
jmp 0x628e09
lea eax, [ebp + 8]
lea esi, [esi + 0x6313ec]
push 0
push eax
push dword [esi]
call fcn.00629b30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret