joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450af0
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0xac7620], edx
push ebx
push esi
push edi
push ebp
jbe 0x450cf7
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0xac7520
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x450cf7
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x450b59
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x450b6a
push 2
push 0
push edx
call fcn.00450630
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x450c06
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x450c3f
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x450bcd
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x450bbb
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x450ba2
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x450c35
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x450b8d
jmp 0x450c3f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x450c35
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x450c3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x450ce6
cmp dword [esp + 0x10], 0
je 0x450c98
cmp dword [esp + 0x10], 5
jne 0x450c7b
mov dword [0x478c60], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x478c64], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00454570
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x450cc2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x450cc2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x478c60], 0x1c
mov dword [0x478c64], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x478c60], 9
mov dword [0x478c64], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x451580
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.0044fc30
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [esp + 0x1014]
push ebp
cmp dword [0xac7620], esi
jbe 0x4516cd
mov eax, esi
mov ecx, esi
and eax, 0xffffffe7
and ecx, 0x1f
sar eax, 3
mov edx, dword [eax + 0xac7520]
test byte [edx + ecx*8 + 4], 1
je 0x4516cd
push 1
push ebx
push esi
call fcn.00450630
mov dword [esp + 0x1c], eax
add esp, 0xc
cmp eax, 0xffffffff
je 0x4516bd
push 2
push ebx
push esi
call fcn.00450630
add esp, 0xc
cmp eax, 0xffffffff
je 0x4516bd
mov ecx, dword [esp + 0x101c]
mov ebp, ecx
sub ebp, eax
test ebp, ebp
jle 0x451663
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x400
push 0x8000
rep stosd dword es:[edi], eax
push esi
call fcn.004511a0
add esp, 8
mov edi, eax
mov eax, 0x1000
cmp ebp, eax
jge 0x451626
mov eax, ebp
push eax
lea eax, [esp + 0x18]
push eax
push esi
call fcn.00450af0
add esp, 0xc
cmp eax, 0xffffffff
je 0x451642
sub ebp, eax
test ebp, ebp
jg 0x45161b
jmp 0x451657
cmp dword [0x478c64], 5
jne 0x451655
mov dword [0x478c60], 0xd
mov ebx, eax
push edi
push esi
call fcn.004511a0
add esp, 8
jmp 0x4516a0
jge 0x4516a0
push 0
push ecx
push esi
call fcn.00450630
add esp, 0xc
push esi
call fcn.00450980
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sbb ebx, ebx
cmp ebx, 0xffffffff
jne 0x4516a0
mov dword [0x478c60], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x478c64], eax
mov eax, dword [esp + 0x10]
push 0
push eax
push esi
call fcn.00450630
add esp, 0xc
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x478c60], 9
pop edi
pop esi
pop ebx
add esp, 0x1004
ret
Function at 0x455fe0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x479ba8], ebx
jne 0x45602f
call esi
cmp eax, ebx
mov edi, eax
je 0x45600d
mov dword [0x479ba8], 1
jmp 0x45602f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x456025
mov dword [0x479ba8], 2
jmp 0x45602f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x479ba8], 1
jne 0x4560de
test edi, edi
jne 0x456052
call esi
mov edi, eax
test edi, edi
jne 0x456052
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x45606c
add esi, 2
cmp word [esi], 0
jne 0x45605a
add esi, 2
cmp word [esi], 0
jne 0x45605a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x4560cd
push ebp
call fcn.0044ed20
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x4560cd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x4560bc
push ebx
call fcn.0044cfb0
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x479ba8], 2
jne 0x456162
test ebx, ebx
jne 0x456101
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x456101
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x456116
inc ebp
cmp byte [ebp], 0
jne 0x456108
inc ebp
cmp byte [ebp], 0
jne 0x456108
sub ebp, ebx
inc ebp
push ebp
call fcn.0044ed20
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x45613b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x459740
Capabilities:
Set environment variable

Disassembly:
sub esp, 4
cmp dword [esp + 8], 0
push ebx
push esi
push edi
push ebp
je 0x45997e
mov edx, dword [esp + 0x18]
push 0x3d
push edx
call fcn.0045a910
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x45997e
cmp ebp, dword [esp + 0x18]
je 0x45997e
cmp byte [ebp + 1], 1
sbb eax, eax
mov ecx, dword [0x478c88]
neg eax
mov dword [esp + 0x10], eax
cmp dword [0x478c8c], ecx
jne 0x45979d
push ecx
call fcn.004599f0
add esp, 4
mov dword [0x478c88], eax
cmp dword [0x478c88], 0
jne 0x45984d
cmp dword [esp + 0x1c], 0
je 0x4597d4
cmp dword [0x478c90], 0
je 0x4597d4
call fcn.004567d0
test eax, eax
je 0x45984d
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [esp + 0x10], 0
je 0x4597e5
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x478c88], 0
jne 0x459819
push 4
call fcn.0044ed20
add esp, 4
mov dword [0x478c88], eax
test eax, eax
jne 0x45980e
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x478c88]
mov dword [eax], 0
cmp dword [0x478c90], 0
jne 0x45984d
push 4
call fcn.0044ed20
add esp, 4
mov dword [0x478c90], eax
test eax, eax
jne 0x459842
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, dword [0x478c90]
mov dword [eax], 0
mov esi, dword [0x478c88]
sub ebp, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
push ebp
push edx
call fcn.00459990
add esp, 8
mov edi, eax
test edi, edi
jl 0x4598b5
cmp dword [esi], 0
je 0x4598b5
cmp dword [esp + 0x10], 0
je 0x4598ac
lea ebx, [esi + edi*4]
mov eax, dword [ebx]
push eax
call fcn.0044cfb0
add esp, 4
cmp dword [ebx], 0
je 0x459899
mov eax, dword [ebx + 4]
add ebx, 4
inc edi
mov dword [ebx - 4], eax
cmp dword [ebx], 0
jne 0x45988a
shl edi, 2
push edi
push esi
call fcn.0044f700
add esp, 8
test eax, eax
je 0x4598fd
jmp 0x4598f8
mov edx, dword [esp + 0x18]
mov dword [esi + edi*4], edx
jmp 0x4598fd
cmp dword [esp + 0x10], 0
jne 0x459974
test edi, edi
jge 0x4598c6
neg edi
lea eax, [edi*4 + 8]
push eax
push esi
call fcn.0044f700
add esp, 8
test eax, eax
jne 0x4598e8
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
lea ecx, [eax + edi*4]
mov edx, dword [esp + 0x18]
mov dword [ecx], edx
mov dword [ecx + 4], 0
mov dword [0x478c88], eax
cmp dword [esp + 0x1c], 0
je 0x45996a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.0044ed20
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x45996a
mov edi, dword [esp + 0x18]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x10], 1
sbb eax, eax
lea ecx, [ebp + ebx]
mov byte [ecx], 0
lea ecx, [ecx + 1]
and eax, ecx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.0044cfb0
add esp, 4
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x470090
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
push esi
mov ebx, dword [esp + 0x118]
push edi
test ebx, ebx
je 0x470103
push ebx
call fcn.004701c0
add esp, 4
test eax, eax
jne 0x4700d1
xor eax, eax
pop edi
mov dword [0x478c64], 0xf
mov dword [0x478c60], 0xd
pop esi
pop ebx
add esp, 0x10c
ret
add bl, 0x40
lea eax, [esp + 0x10]
mov byte [esp + 0xc], bl
push eax
lea ecx, [esp + 0x18]
lea ebx, [esp + 0x10]
mov byte [esp + 0x11], 0x3a
mov byte [esp + 0x12], 0x2e
mov byte [esp + 0x13], 0
push ecx
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x470113
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4701b2
inc eax
cmp eax, 0x104
ja 0x4701b2
mov edx, dword [esp + 0x120]
test edx, edx
jne 0x470164
mov ecx, dword [esp + 0x124]
cmp ecx, eax
jg 0x47013f
mov ecx, eax
push ecx
call fcn.0044ed20
add esp, 4
mov edx, eax
test edx, edx
jne 0x470183
xor eax, eax
pop edi
mov dword [0x478c60], 0xc
pop esi
pop ebx
add esp, 0x10c
ret
cmp dword [esp + 0x124], eax
jge 0x470183
xor eax, eax
pop edi
mov dword [0x478c60], 0x22
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, edx
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret

Function at 0x4701c0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
sub esp, 4
test eax, eax
jne 0x4701d4
mov eax, 1
add esp, 4
ret
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0x5c
mov byte [esp + 3], 0
add al, 0x40
mov byte [esp], al
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x470206
cmp eax, 1
je 0x470206
mov eax, 1
add esp, 4
ret
xor eax, eax
add esp, 4
ret
Function at 0x470d60
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x470d96
cmp byte [esp + 5], 0x3a
jne 0x470d96
xor eax, eax
mov al, byte [esp + 4]
push eax
call fcn.0044f280
add esp, 4
lea esi, [eax - 0x40]
mov eax, esi
pop esi
add esp, 0x104
ret
Function at 0x4033d7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x407018]
jne 0x4033e1
repz ret
jmp fcn.004038cc
Function at 0x10130930
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x66
push 1
adc ebp, dword [ecx]
out 0x1b, eax
inc eax
mov ah, 0xd3
aam 0xc
out 0x9b, al
adc al, 0xc5
cmp al, byte [eax + 0x1bdf743e]
mov ch, 0x66
push 1
adc ebp, dword [ecx]
out 0x1b, eax
popfd
mov bh, ah
sbb esi, dword [ebp - 0x1223edce]
adc bl, ah
in eax, dx
adc bl, ah
in eax, dx
imul edi, dword [ebx - 0x1188584d], 0xffffffb0
jne 0x10130966
stosd dword es:[edi], eax
call 0xb7473cc3
mov eax, dword [0x3914c3ea]
push ebx
or ebp, dword [edi + 0xb]
mov esi, 0x4141156a
push 0x459ad978
lahf
je 0x1013096b
fistp word [ebx]
mov ch, 0x66
push ebx
les ebx, es:[0x66b5c896]
fild qword [ecx - 0x60]
imul edx, dword [edx], 0x57744112
mov al, byte [0x41121269]
je 0x101309c4
mov dl, 0xa7
ja 0x1013090a
sbb eax, 0x85df66b5
mov ch, 0x2c
and eax, dword [eax - 0x38]
invalid
out dx, eax
stosd dword es:[edi], eax
jnp 0x10130a34
mov edi, 0xa6df77a7
ret 0x75ee
bound ebx, qword [ebx + 0x4c5366e5]
inc eax
scasb al, byte es:[edi]
invalid
Function at 0x101768a0
Capabilities:
Encode data using xor

Disassembly:
fadd st(5), st(0)
jmp 0xbd578c0f
push 0x69
test eax, 0xf9bfe62e
out dx, eax
jp 0x1017679c
invalid
stosd dword es:[edi], eax
call 0xb74b9b23
mov eax, dword [0xb51c80cb]
fild word [ebp - 0x4500304c]
mov ch, 0x66
fild word [ebp - 0x4500304c]
sal byte [esi + 0x2f], 1
cmp byte [esi], 0x8c
fistp word [ebx]
mov ch, 0x66
xor eax, 0x242ea6a7
sbb byte [esi + 0xb1bdf66], dh
in eax, 0xef
mov edi, ds
sbb esi, dword [ebp - 0x5958ca9a]
and al, 0x18
mov dh, 0x66
fistp word [ebx]
or ebp, dword [esi]
in eax, 0xef
inc eax
dec ebx
out dx, eax
add eax, dword [ebx + 0x381be006]
sub esp, ebx
adc ebx, edi
outsb dx, byte [esi]
loopne 0x10176765
rcl al, 0x17
jb 0x10176778
test dword [edx - 0x5c164ae3], ecx
and al, 0x40
mov ah, 0xd3
cmpsd dword [esi], dword es:[edi]
jnp 0x101767b3
push 0xdf66b529
sbb edx, dword [ebx]
les edi, [ecx + 0x77]
imul ebx, edi, 0xffffffe7
xor dword [ebx], 0x3381e8ab
stosd dword es:[edi], eax
call 0xb74b9b83
xor al, 0xa7
xor al, 0xa7
mov eax, dword [0x792bdccf]
ja 0x10176852
sbb al, 0x9d
jns 0x101767a6
push ds
mov ch, 0xf1
sub al, 0x24
cmp byte [ebx], ch
out 3, eax
pop esp
out 0xd9, al
sbb eax, ebp
sbb al, 0x9f
jns 0x10176897
xor esi, dword [edi]
mov eax, dword [0x3284ded1]
push es
cli
sub ebx, dword [ecx]
or bh, bl
sbb esi, dword [ebp + 0x3e802f66]
mov edi, ds
sbb esi, dword [ebp - 0x2df79d9a]
int1
xor al, 0x24
inc edx
mov ah, 0xb7
jb 0x10176862
invalid
invalid
popfd
and dword [eax - 0x5c164ae2], ebx
sub byte [eax + 0x35], al
invalid
fbld tbyte [esi - 0x175d3b66]
xor dword [ebx], 0x614b77c8
fsubp st(0)
xor dword [ebx], 0x3381e8ab
stosd dword es:[edi], eax
call 0xb74b9c33
xor al, 0xa7
mov eax, dword [0x402434f2]
sub dword [0xee6825a9], esi
cmp dh, ch
imul sp, word [esi*8 - 0x516e5716], 0xa592
aad 0xf5
loop 0x1017689e
sub al, 5
mov ecx, 0x616907c7
add eax, 0x6907c7b9
popal
fidivr word [edx + 0x12]
sub ch, byte [ebx - 0x54cc7e18]
call 0xb74b9c63
xor al, 0xa7
mov eax, dword [0x402434f2]
sub dword [0xee6825a9], esi
cmp dh, ch
test eax, 0x3aee6825
cmc
imul sp, word [esi*8 - 0x516e5716], 0xa592
aad 0xf5
jecxz 0x101768ce
sub al, 5
mov ecx, 0x6168d7c7
add eax, 0x68d7c7b9
popal
fidivr word [edx + 0x12]
sub ch, byte [ebx - 0x54cc7e18]
call 0xb74b9c93
xor al, 0xa7
mov eax, dword [0x402434f2]
sub dword [0xee6825a9], esi
cmp dh, ch
imul sp, word [esi*8 - 0x516e5716], 0xa592
aad 0x95
jecxz 0x101768fe
sub al, 5
mov ecx, 0x6168a7c7
fidivr word [edx + 0x12]
sub ch, byte [ebx - 0x54cc7e18]
call 0xb74b9cc3
xor al, 0xa7
mov eax, dword [0x402434f2]
mov ah, 0xeb
js 0x101768e9
or byte [edx + 0x1b], bl
mov ch, 0x33
Function at 0x10178360
Capabilities:
Encode data using xor

Disassembly:
test dword [edi + ecx*8 + 0x76d0bb6f], esi
das
cmp byte [esi], 0x8c
fistp word [ebx]
mov ch, 0x66
xor eax, 0x646f2aa7
adc ch, byte [edx]
mov ah, byte [esi - 0x20984e9f]
sbb esi, dword [ebp - 0x628e120f]
dec eax
mov byte [edi], dl
mov ch, 0xf2
sub eax, 0xb74f0b24
lds esi, [eax + 0xb384966]
dec edi
pushfd
stosd dword es:[edi], eax
mov dh, 0x66
invalid
xor dword [ebx], 0x3381e8ab
xor al, 0xa7
mov eax, dword [0x402834f2]
mov ah, 0xe7
js 0x10178309
js 0x1017835a
sbb dword [ebp - 0x5e58cbcd], esi
and al, 0x24
aas
cmpsd dword [esi], dword es:[edi]
push cs
inc eax
mov dh, 0xc3
mov byte [0x343381e8], al
xor al, 0xa7
mov eax, dword [0x3f2424f2]
cmpsd dword [esi], dword es:[edi]
push cs
in al, dx
popfd
mov esp, eax
js 0x10178407
xor esi, dword [edi]
mov eax, dword [0x3f2424f2]
cmpsd dword [esi], dword es:[edi]
pop es
fcomp qword [ebp - 0x26132a95]
cmp al, 0xdf
xor dword [ebx], 0x3381e8ab
stosd dword es:[edi], eax
call 0xf8c2b72f
xor dword [ebx], 0xf2a1a734
xor al, 0xa7
mov eax, dword [0xc42424f2]
sbb al, 0x1f
dec edx
adc ch, byte [edx]
stosd dword es:[edi], eax
call 0xb74bb743
xor al, 0xa7
mov eax, dword [0x40242cf2]
mov esp, 0xa86b2aeb
or eax, 0xe7da8557
cmpsb byte [esi], byte es:[edi]
idiv byte [esi + 0x6a]
and byte [ebp - 0x3c], al
mov byte [0xa2c4754f], al
call 0xb74bb763
xor al, 0xa7
mov eax, dword [0x3914c3ea]
push ebx
sti
cmpsb byte [esi], byte es:[edi]
add ch, byte [edi - 0x12]
jb 0x10178464
mov ebp, 0xaac82b45
add esp, dword [ebx - 0x3ad1e909]
int1
and byte [edi + ebx], ch
outsd dx, dword [esi]
push 0x4c
push esi
jnp 0x10178481
push cs
invalid
push ebp
xor byte [eax - 9], al
scasd eax, dword es:[edi]
sbb al, 0xb5
push 0x5d
fldcw word [ecx - 0xc]
adc dword [edi + 0x59], 0xffffffef
movsb byte es:[edi], byte [esi]
stc
mov dh, bl
cmpsb byte [esi], byte es:[edi]
sti
jle 0x1017848b
pop esp
mov ebp, 0x5dde3f3
hlt
insb byte es:[edi], dx
push 0xe0628ed9
int 0x4e
aaa
mov bl, 0x66
cmp eax, 0xa2c49aa7
call 0xf8c2b7d7
xor dword [ebx], 0x3381e8ab
stosd dword es:[edi], eax
call 0xb74bb7e3
xor al, 0xa7
xor al, 0x28
cmp bh, byte [ecx]
push ebx
sub eax, dword [eax - 0x4c]
out 0x2a, eax
insb byte es:[edi], dx
test al, 9
fild word [ecx - 0x7e1754cd]
xor ebp, dword [ebx - 0x54cc7e18]
call 0xb74bb813
xor al, 0xa7
xor ebp, dword [ebx + 0x343381e8]
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x382434f2]
push ebx
jmp 0x10178440

Function at 0x10178a90
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x71ef594d]
mov ah, 0x97
outsd dx, dword [esi]
lodsb al, byte [esi]
inc ebp
imul dword [edi - 0x54]
inc eax
push edi
adc ch, byte fs:[ebx]
outsd dx, dword [esi]
outsd dx, dword [esi]
lodsb al, byte [esi]
inc ebp
imul dword [edi - 0x54]
inc eax
sub eax, 0x3381df3d
push ss
mov ch, 0xc4
enter 0x40cb, 0x61
fsubp st(0)
xor dword [ebx], 0x3381e8ab
stosd dword es:[edi], eax
call 0xf8c2bdcf
xor dword [ebx], 0x8a1a734
xor al, 0xa7
mov eax, dword [0xa7b85b08]
ja 0x10178ac3
invalid
mov ebp, 0xe0202ff1
jbe 0x10178a01
push ss
mov eax, 0xb5a6f0ef
ret
xor al, 0xa7
mov eax, dword [0x402834f2]
mov ah, 0xe7
js 0x10178a39
push 0x33b5166b
Function at 0x10179500
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xa7
mov eax, dword [0x5363ecf2]
pop ecx
out dx, eax
outsb dx, byte [esi]
inc eax
invalid

Function at 0x10179990
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xa7
mov eax, dword [0xb51c80cb]
fild word [ebp - 0x4490304c]
sal byte [esi + 0x2f], 1
cmp byte [esi], 0x8c
fistp word [ebx]
mov ch, 0x66
xor eax, 0x802aeaa7
push cs
invalid

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
jmp 0x403a1c
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405220], eax
mov dword [0x4051a8], 0x403098
mov dword [0x4051a4], 2
jmp 0x403a4c
mov dword [0x4051ac], 0
mov dword [0x4051b0], 0
mov dword [0x4051a0], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051b4], eax
mov dword [0x4051c8], 0x40426e
mov dword [0x4051c0], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051b8], eax
mov dword [0x4051cc], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051bc], eax
push 0x4051a0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.justam
push 0x40426e
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405218], eax
push 5
push dword [0x405218]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405218]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x403b1f
push 0
push 0
push 0
push 0x4051d0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x403b4c
push 0x4051d0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4051d0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x403b1f
mov eax, dword [0x4051d8]
jmp 0x403b59
call 0x402be1
ret
Function at 0x401d60
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x45255b
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.0044fb01
push 4
mov dword [esp + 0x24], 0
call fcn.0042900e
mov edi, eax
add esp, 4
test edi, edi
je 0x401de2
call fcn.0044fd7c
mov dword [edi], eax
call fcn.0044fc51
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0044fac2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x401dd7
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.0044faea
jmp 0x401de4
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x402480
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x452be8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
mov eax, dword [0x468dc0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov esi, edx
xor ebx, ebx
push 0xffffffffffffffff
push ebx
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
call fcn.00401e90
mov eax, esi
mov dword [esp + 0x34], ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4024d6
sub eax, edx
sar eax, 1
push eax
push esi
lea esi, [esp + 0x18]
call fcn.004029b0
push 0xffffffffffffffff
push ebx
xor edx, edx
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
push eax
mov ecx, edi
mov word [edi + 4], dx
call fcn.00401e90
cmp dword [esp + 0x28], 8
jb 0x40251f
mov eax, dword [esp + 0x14]
push eax
call fcn.00429048
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x2c
ret