joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001d82c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100345f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10015ddf
mov dword [ebp - 0x14], eax
cmp dword [0x100373b8], edi
jne 0x1001d91d
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x1001d8aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1001d9fd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1001d9fd
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d9fd
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x100373b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x100373bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x100373c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100373c8], eax
test eax, eax
je 0x1001d91a
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x100373c4], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1001d942
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1001d935
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1001d957
push 4
pop eax
jmp 0x1001d9ff
cmp dword [ebp - 0x14], edi
je 0x1001d957
push dword [0x100373b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1001d93c
mov eax, dword [0x100373c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x1001d9b5
cmp dword [0x100373c8], esi
je 0x1001d9b5
push eax
call ebx
push dword [0x100373c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1001d9b5
test eax, eax
je 0x1001d9b5
call ecx
test eax, eax
je 0x1001d9aa
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1001d9aa
test byte [ebp - 8], 1
jne 0x1001d9b5
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x1001d9e5
mov eax, dword [0x100373bc]
cmp eax, esi
je 0x1001d9e2
push eax
call ebx
test eax, eax
je 0x1001d9e2
call eax
mov edi, eax
test edi, edi
je 0x1001d9e2
mov eax, dword [0x100373c0]
cmp eax, esi
je 0x1001d9e2
push eax
call ebx
test eax, eax
je 0x1001d9e2
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x100373b8]
call ebx
test eax, eax
je 0x1001d9fd
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x1001d9ff
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000ff78
leave
ret
Function at 0x10022762
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10018b4d
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x1002279a
xor eax, eax
jmp 0x100227c6
cmp esi, dword [ebp - 4]
je 0x100227c3
cmp dword [ebp + 0xc], 0
je 0x100227c3
push dword [edi + 0x9c]
call fcn.10022370
push dword [edi + 0x9c]
mov esi, eax
call fcn.10016087
pop ecx
pop ecx
cmp esi, eax
je 0x10022796
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret

Function at 0x422290
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16000]
push edi
or ebp, 0xffffffff
jmp 0x4222b2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4222b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4222a8
mov eax, 1
add ebx, ebx
jne 0x4222cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4222c0
jne 0x4222dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4222c0
xor ecx, ecx
sub eax, 3
jb 0x4222f0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x422362
mov ebp, eax
add ebx, ebx
jne 0x4222fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x422308
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42232c
inc ecx
add ebx, ebx
jne 0x422318
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42230d
jne 0x422329
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42230d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x42234c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42233d
jmp 0x4222ae
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42234c
add edi, ecx
jmp 0x4222ae
pop esi
mov edi, esi
mov ecx, 0x82e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42236a
cmp byte [edi], 0xe
jne 0x42236a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42236f
lea edi, [esi + 0x20000]
mov eax, dword [edi]
or eax, eax
je 0x4223e7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23b94]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23c48]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42239c
mov ecx, edi
jns 0x4223cb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23c4c]
or eax, eax
je 0x4223e1
mov dword [ebx], eax
add ebx, 4
jmp 0x4223b9
call dword [esi + 0x23c50]
popal
jmp section.UPX0
Function at 0x1001000
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0xf003f
mov byte [ebp - 1], bl
push ebx
push str.SystemCurrentControlSetcontrolSessionManagerCheckVerDLLs
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001061
push 1
lea eax, [ebp - 1]
push eax
push 3
push ebx
push str.wsock32.dll
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea ecx, [ebp - 1]
push ecx
push 3
push ebx
push str.winsock.dll
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1001070
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003178
push 0x1002054
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x1004040], eax
xor eax, eax
mov al, byte [0x1004041]
mov dword [0x100404c], eax
mov eax, dword [0x1004040]
shr dword [0x1004040], 0x10
and eax, 0xff
mov dword [0x1004048], eax
shl eax, 8
add eax, dword [0x100404c]
mov dword [0x1004044], eax
call fcn.01002010
test eax, eax
jne 0x10010e4
push 0x1c
call fcn.01001210
add esp, 4
mov dword [ebp - 4], 0
call fcn.01001e30
call fcn.01001e20
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1005080], eax
call fcn.010019d0
mov dword [0x1004020], eax
test eax, eax
je 0x1001117
cmp dword [0x1005080], 0
jne 0x1001121
push 0xffffffffffffffff
call fcn.01001270
add esp, 4
call fcn.01001750
call fcn.01001660
call fcn.01001240
mov esi, dword [0x1005080]
mov al, byte [esi]
cmp al, 0x22
je 0x1001148
cmp al, 0x20
jbe 0x1001175
inc esi
cmp byte [esi], 0x20
ja 0x1001140
jmp 0x1001175
inc esi
cmp byte [esi], 0x22
je 0x1001174
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x100116f
xor eax, eax
mov al, bl
push eax
call fcn.01001600
add esp, 4
test eax, eax
je 0x1001169
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x1001151
cmp byte [esi], 0x22
jne 0x1001175
inc esi
cmp byte [esi], 0
je 0x1001185
cmp byte [esi], 0x20
ja 0x1001185
inc esi
cmp byte [esi], 0
jne 0x100117a
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x10011a9
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.01001270
jmp 0x10011ea
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012b0
Capabilities:
Terminate process

Disassembly:
cmp dword [0x100407c], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x10012ce
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x1004078], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x1004074], bl
jne 0x1001328
cmp dword [0x1005078], 0
je 0x1001316
mov edi, dword [0x1005074]
sub edi, 4
cmp edi, dword [0x1005078]
jb 0x1001316
mov eax, dword [edi]
test eax, eax
je 0x100130b
call eax
sub edi, 4
cmp edi, dword [0x1005078]
jae 0x1001303
push 0x1004014
push 0x1004010
call fcn.01001360
add esp, 8
push 0x100401c
push 0x1004018
call fcn.01001360
add esp, 8
test ebx, ebx
jne 0x100134f
mov dword [0x100407c], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x10019d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [0x1004120], ebx
jne 0x1001a1f
call esi
cmp eax, ebx
mov edi, eax
je 0x10019fd
mov dword [0x1004120], 1
jmp 0x1001a1f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
je 0x1001a15
mov dword [0x1004120], 2
jmp 0x1001a1f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x1004120], 1
jne 0x1001ace
test edi, edi
jne 0x1001a42
call esi
mov edi, eax
test edi, edi
jne 0x1001a42
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp word [edi], 0
mov esi, edi
je 0x1001a5c
add esi, 2
cmp word [esi], 0
jne 0x1001a4a
add esi, 2
cmp word [esi], 0
jne 0x1001a4a
sub esi, edi
push 0
sar esi, 1
push 0
inc esi
push 0
push 0
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebp, eax
test ebp, ebp
je 0x1001abd
push ebp
call fcn.010023c0
add esp, 4
mov ebx, eax
test ebx, ebx
je 0x1001abd
push 0
push 0
push ebp
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x1001aac
push ebx
call fcn.01002370
add esp, 4
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
cmp dword [0x1004120], 2
jne 0x1001b52
test ebx, ebx
jne 0x1001af1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov ebx, eax
test ebx, ebx
jne 0x1001af1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov ebp, ebx
cmp byte [ebx], 0
je 0x1001b06
inc ebp
cmp byte [ebp], 0
jne 0x1001af8
inc ebp
cmp byte [ebp], 0
jne 0x1001af8
sub ebp, ebx
inc ebp
push ebp
call fcn.010023c0
mov dword [esp + 0x14], eax
add esp, 4
test eax, eax
jne 0x1001b2b
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
mov edi, dword [esp + 0x10]
mov esi, ebx
mov ecx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret
Function at 0x1002170
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1a8
xor ecx, ecx
mov eax, 0x1004350
push ebx
mov edx, dword [esp + 0x1b0]
push esi
push edi
push ebp
cmp dword [eax], edx
je 0x1002197
add eax, 8
inc ecx
cmp eax, 0x10043e0
jb 0x1002188
cmp dword [ecx*8 + 0x1004350], edx
lea ebx, [ecx*8]
jne 0x100235b
cmp dword [0x100402c], 1
je 0x1002317
cmp dword [0x100402c], 0
jne 0x10021ce
cmp dword [0x1004030], 1
je 0x1002317
cmp edx, 0xfc
je 0x100235b
lea eax, [esp + 0xb4]
push 0x104
push eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
call ebp
test eax, eax
jne 0x100220b
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea ebp, [esp + 0xb4]
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x100224f
lea edi, [esp + 0xb4]
mov ecx, 0xffffffff
sub eax, eax
push 3
repne scasb al, byte es:[edi]
not ecx
lea ebp, [esp + ecx + 0x7c]
push 0x1003458
push ebp
call fcn.01002c70
add esp, 0xc
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
mov ecx, 6
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x1003438
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 0x1004354]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
lea edi, [esp + 0x14]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x12010
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push eax
call fcn.01002bd0
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
cmp dword [0x1004f70], 0
je 0x100232d
mov eax, dword [0x1004f70]
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x1002337
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebx + 0x1004354]
push 0
lea eax, [esp + 0x14]
mov edi, edx
push eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x1a8
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x44ba10
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
mov dword [esi], 0
mov al, byte [0x66104a]
mov cl, byte [0x66104d]
mov edx, dword [0x661030]
and cl, al
mov eax, dword [0x661034]
mov byte [0x66104d], cl
mov ecx, eax
shr ecx, 2
sub edx, ecx
xor ecx, ecx
mov cl, byte [0x661043]
mov dword [0x661030], edx
mov edx, dword [0x661038]
or edx, 7
invalid

Function at 0x53d949
Capabilities:
Encode data using xor

Disassembly:
sub dword [ebp + esi - 0x7d], 0x55
push esp
mov esp, ebp
aaa
cdq
popfd
and byte [bp - 0x22af], dl
aas
call [esi + 0xab9ece3]
mov byte [edx], cl
pop eax
jno 0x53d981
pop ecx
xor eax, 0xc6112b5d
mov dword [0x579251d1], eax
scasd eax, dword es:[edi]
dec eax
inc edi
leave
mov esi, 0x2fa23f80
int3
sar dl, cl
push esi
pop ecx
rol byte [ecx], 1
invalid
retf 0x7a94
rol byte [ecx], cl
ficom word [eax - 0x53]
jae 0x53d8e6
std
mov ch, byte [ebp + eax + 0x526d6985]
nop
loopne 0x53d97b
retf
sbb eax, 0xc5dd4763
xor eax, 0x96d2b129
or ah, ch
sub dword [ecx - 0x13f7692e], esi
cdq
adc dword [ecx - 0x769437d9], ecx
jns 0x53d93e
dec esp
cmp dword [ebp + 0x3b], ebx
loope 0x53d926
sbb ebx, dword [ebx - 0x2907b468]
salc
retf
Function at 0x589d99
Capabilities:
Encode data using xor

Disassembly:
pushal
pop ebx
mov esp, 0xfc4753f6
mov dh, 0xac
pop eax
daa
js 0x589dca
outsb dx, byte [esi]
ret
cmc
pushfd
je 0x589df8
fdivrp st(5)
pop eax
xor eax, 0xf826cd60
sub esp, dword [edx + ecx*4]
dec ebx
invalid
cmpsb byte [esi], byte es:[edi]
adc al, 0x8d
push es
faddp st(4)
dec ebp
fnop
call 0x410753a7
outsd dx, dword [esi]
ja 0x589df4
mov al, 0x9f
jne 0x589dca
mov bh, dh
movsb byte es:[edi], byte [esi]
xor ebx, eax
fidiv word [ecx + ebx]
pop ebx
adc cl, bl
leave
std
jle 0x589e90
xchg esi, eax
wait
lahf
add eax, 0xba4ce2b0
mov edx, 0x9b17a9be
jle 0x589e6d
invalid
lahf
mov cl, byte [ebx + 0x1a8b762f]
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
test eax, 0x61367eea
xor eax, 0x2404fdd1
cli
add ah, ah
sar dword [esp + ebp], 1
mov esi, 0x7e4c9cb4
xor edi, 0xffffff9e
test dword [ebp + ecx*8 - 0x433faa39], ebp
cwde
xchg dword [ecx + 0x63], esp
in ax, 0xe6
cmpsb byte [esi], byte es:[edi]
cmp al, 0x52
push 0x61
popal
push esp
push eax
jne 0x589e3a
xchg edi, eax
cmp byte [eax - 0x5ad95ec5], bh
cdq
adc eax, 0xf1fb5946
push esi
movsd dword es:[edi], dword [esi]
je 0x589eca
push edi
jno 0x589ece
sbb edx, dword [esi + 0x2761de12]
aam 0xd6
jae 0x589eb7
xor eax, 0x612624be
xor eax, 0x612624be
movsb byte es:[edi], byte fs:[esi]
retf
cmp bh, dl
or byte [edx - 0x2b], ah
stosb byte es:[edi], al
push edi
in al, dx
test al, 0x54
push ecx
inc edx
jnp 0x589f43
mov byte [ecx + 0x74], dh
pop ss
mov ch, 0xc4
sub byte [ebx], bh
invalid
xor dword [esp + eax*8], 0xffffffca
jmp 0x589f48
pop edx
pop ss
jl 0x589f6b
mov bh, 9
mov byte ds:[0xafe73b8c], al
or dword [esi], edi
mov byte [0xafe73b8c], al
sahf
jmp 0x510f973c
faddp st(3)
loop 0x589fc4
sub dh, cl
into
push cs
aam 0x6d
outsd dx, dword [esi]
push ebx
xchg esi, eax
in eax, 0x91
les esp, [ebp + esi*8 + 0x56e2b9e4]
dec esi
invalid
sub eax, 0xb9756266
jne 0x589f82
loop 0x589fdb
add al, 0x66
jb 0x589fc7
lds ebp, [ebx - 0x4a]
leave
mov eax, dword [0xa16e4e6]
cmpsb byte [esi], byte es:[edi]
stc
xchg esi, eax
dec ebp
pop ss
xor al, 0xb5
pop ecx
push es
add byte [ebp + esi*2 - 0x23], al
sbb dword [edx], edi
mov edx, 0x52af0603
enter 0xffffffffffffe05a, 0x29
jp 0x589f72
inc eax
pop ds
xbegin 0x514a589
popfd
add byte [ebx], dh
mov ecx, 0xea4353aa
imul esi, dword [0x716562ea], 0x7104cb99
imul edx, esp, 0xcc49a174
daa
mov ecx, 0xb4e90afe
iretd
Function at 0x65988d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6613b8
cmp edx, dword [eax]
je 0x6598af
add eax, 8
inc ecx
cmp eax, 0x661448
jl 0x6598a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6613b8]
jne 0x6599dd
mov eax, dword [0xa5dd94]
cmp eax, 1
je 0x6599b7
test eax, eax
jne 0x6598e0
cmp dword [0x6612e4], 1
je 0x6599b7
cmp edx, 0xfc
je 0x6599dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659917
lea eax, [ebp - 0x1a4]
push 0x65e9c8
push eax
call fcn.0065a270
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a700
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65995a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a700
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e9c4
push edi
call fcn.0065c5d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65e9a8
push eax
call fcn.0065a270
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a280
lea eax, [ebp - 0xa0]
push 0x65e9a4
push eax
call fcn.0065a280
push dword [esi + 0x6613bc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a280
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65e97c
push eax
call fcn.0065c544
add esp, 0x2c
pop edi
jmp 0x6599dd
lea eax, [ebp + 8]
lea esi, [esi + 0x6613bc]
push 0
push eax
push dword [esi]
call fcn.0065a700
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1025f65
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1025f81
test al, 0x10
jne 0x1025f81
xor eax, eax
inc eax
jmp 0x1025f83
xor eax, eax
pop ebp
ret 4

Function at 0x102ab96
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
mov dword [ebp - 0x14], eax
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
shr esi, 1
xor ecx, ecx
and ebx, 1
and esi, 1
cmp dword [ebp + 8], ecx
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov eax, 0x102aa42
jne 0x102abde
mov eax, 0x102aa09
lea edx, [ebp + 0x10]
push edx
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x102ac0f
call fcn.010a4804
push eax
push 0x1bf012f
mov dword [ebp - 4], eax
call fcn.0107ae44
jmp 0x102ac97
push 0
push esi
push ebx
push dword [ebp + 8]
call fcn.0102aa81
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x1f4
jmp 0x102ac31
cmp dword [ebp - 4], 0x102
jne 0x102ac81
push ebx
push dword [ebp + 0xc]
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.0102aa81
cmp dword [ebp - 4], 0
jne 0x102ac28
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x102ac71
call fcn.010a4804
push eax
mov dword [ebp - 4], eax
push 0x1d5012f
jmp 0x102ac89
cmp dword [ebp - 4], 0
je 0x102ac8e
push dword [ebp - 4]
push 0x1d8012f
jmp 0x102ac89
push dword [ebp - 4]
push 0x1e1012f
call fcn.0107ae44
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc