joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440400
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov edi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x3c]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebp + eax + 2], 0
lea eax, [eax + 2]
jne 0x440420
mov esi, eax
sar esi, 1
and eax, 8
mov ecx, esi
xor ecx, 4
lea ebx, [ecx + eax]
add eax, ecx
inc eax
test eax, eax
jns 0x440448
mov eax, 0xffffffff
jmp 0x44044f
lea eax, [ebx*2 + 2]
push eax
call fcn.004095a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [ebp]
test dx, dx
je 0x440492
add ebp, 2
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [ebp]
add ebp, 2
test dx, dx
jne 0x440480
mov word [ecx], 0
mov ecx, ebx
and ecx, 0xfffd
and esi, 2
mov edx, esi
xor edx, 2
imul edx, ecx
or ebx, 2
imul ebx, esi
lea ecx, [ebx + edx]
mov word [esp + 8], cx
lea ecx, [ebx + edx]
add ecx, 2
mov word [esp + 0xa], cx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0xbb3487aa
mov edx, 0x17855
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x44cb7856]
mov ebp, edx
and ebp, 0x10818
mov esi, ecx
and esi, 0x83140727
or esi, ebp
mov ebp, esi
and esi, 0x80050a3f
xor esi, 0x3b79bd98
or esi, ebx
xor ebx, 0xb82482bf
xor ebp, 0x80040267
or ebp, ebx
and esi, ebp
add esi, 0xd5e01514
mov ebx, esi
and ebx, 0x19
xor esi, 0x99
lea ebx, [esi + ebx*2]
inc bl
mov byte [esp + ecx + 0x44cb7856], bl
inc ecx
dec edx
cmp ecx, 0xbb3487b1
jne 0x440520
mov esi, dword [esp]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x4405e4
xor edx, edx
mov ebx, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x3174e150
je 0x4405b0
inc edx
cmp ecx, edx
jne 0x4405a0
jmp 0x4405e4
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x4405e4
mov edx, esp
lea esi, [esp + 0x10]
push edi
push dword [esp + 0x4c]
push edx
push esi
push dword [esp + 0x54]
push dword [esp + 0x54]
push 0x18
push ecx
push dword [0x44d3a0]
mov edi, eax
call fcn.0043dc10
add esp, 0x24
mov esi, eax
mov eax, edi
push eax
call fcn.004095b0
add esp, 4
mov eax, esi
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x440620
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x44063b
mov eax, 0xffffffff
jmp 0x44063e
add eax, 0xa
push eax
call fcn.004095a0
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x440681
add esi, 2
nop
nop
nop
nop
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x440670
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 2], cx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0x40
mov ecx, esp
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0xfcfdfafb
mov word [esp + 0x24], 0
mov byte [esp + 0x26], 0
mov ecx, 0xbb3487aa
mov edx, 0x17855
nop
nop
nop
movzx ebx, byte [esp + ecx + 0x44cb7876]
mov edi, edx
and edi, 0x10818
mov esi, ecx
and esi, 0x83140727
or esi, edi
mov edi, esi
and esi, 0x80050a3f
xor esi, 0x3b79bd98
or esi, ebx
xor ebx, 0xb82482bf
xor edi, 0x80040267
or edi, ebx
and esi, edi
add esi, 0xd5e01514
mov edi, esi
and edi, 0x19
xor esi, 0x99
lea ebx, [esi + edi*2]
inc bl
mov byte [esp + ecx + 0x44cb7876], bl
inc ecx
dec edx
cmp ecx, 0xbb3487b1
jne 0x4406f0
mov esi, dword [esp + 0x20]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x4407a9
xor edx, edx
mov edi, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x1ce638e1
je 0x440780
inc edx
cmp ecx, edx
jne 0x440770
jmp 0x4407a9
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x4407a9
lea edx, [esp + 0x20]
lea esi, [esp + 8]
push edx
push esi
push 8
push ecx
push dword [0x44d3a0]
mov edi, eax
call fcn.0043dc10
add esp, 0x14
mov esi, eax
mov eax, edi
push eax
call fcn.004095b0
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4407bf
mov eax, dword [esp + 0x40]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4407d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov edi, dword [ebp + 0xc]
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov edx, 0x17855
nop
nop
nop
nop
movzx ecx, byte [esp + eax + 0x44cb7856]
mov esi, edx
and esi, 0x10818
mov ebx, eax
and ebx, 0x83140727
or ebx, esi
mov esi, ebx
and ebx, 0x80050a3f
xor ebx, 0x3b79bd98
or ebx, ecx
xor ecx, 0xb82482bf
xor esi, 0x80040267
or esi, ecx
and ebx, esi
add ebx, 0xd5e01514
mov ecx, ebx
and ecx, 0x19
xor ebx, 0x99
lea ecx, [ebx + ecx*2]
inc cl
mov byte [esp + eax + 0x44cb7856], cl
inc eax
dec edx
cmp eax, 0xbb3487b1
jne 0x440800
mov eax, dword [esp]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x4408b8
xor edx, edx
mov esi, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x9c142cda
je 0x440890
inc edx
cmp ecx, edx
jne 0x440880
jmp 0x4408b8
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x4408b8
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 0x14
push ecx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x20
test edi, edi
je 0x4408c2
mov ecx, dword [esp + 8]
mov dword [edi], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4408d1
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4408e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov ebx, 0x17855
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x44cb7856]
mov esi, ebx
and esi, 0x10818
mov ebp, eax
and ebp, 0x83140727
or ebp, esi
mov esi, ebp
and ebp, 0x80050a3f
xor ebp, 0x3b79bd98
or ebp, edi
xor edi, 0xb82482bf
xor esi, 0x80040267
or esi, edi
and ebp, esi
add ebp, 0xd5e01514
mov esi, ebp
and esi, 0x19
xor ebp, 0x99
lea ecx, [esi*2]
add ecx, ebp
inc cl
mov byte [esp + eax + 0x44cb7856], cl
inc eax
dec ebx
cmp eax, 0xbb3487b1
jne 0x440910
mov eax, dword [esp]
mov edi, dword [0x44d398]
test edi, edi
je 0x4409d1
xor esi, esi
mov ebx, dword [0x44d39c]
nop
nop
nop
nop
nop
cmp dword [ebx + esi*8], 0x5b126fe8
je 0x4409a0
inc esi
cmp edi, esi
jne 0x440990
jmp 0x4409d1
mov ebx, dword [ebx + esi*8 + 4]
cmp ebx, eax
je 0x4409d1
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x30
cmp eax, 0x103
jne 0x440ab9
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov ecx, 0x17855
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x44cb7856]
mov esi, ecx
and esi, 0x10818
mov edx, eax
and edx, 0x83140727
or edx, esi
mov esi, edx
and edx, 0x80050a3f
xor edx, 0x3b79bd98
or edx, edi
xor edi, 0xb82482bf
xor esi, 0x80040267
or esi, edi
and edx, esi
add edx, 0xd5e01514
mov esi, edx
and esi, 0x19
xor edx, 0x99
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x44cb7856], dl
inc eax
dec ecx
cmp eax, 0xbb3487b1
jne 0x440a00
mov eax, dword [esp]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x440ab1
xor edx, edx
mov esi, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4c697c35
je 0x440a90
inc edx
cmp ecx, edx
jne 0x440a80
jmp 0x440ab1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440ab1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x18
test eax, eax
js 0x440ab9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x440ad0
xor ecx, ecx
cmp eax, 0xc0000011
je 0x440ace
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ae0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov edx, dword [esp + 0x2c]
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov ebx, 0x17855
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x44cb7856]
mov esi, ebx
and esi, 0x10818
mov ebp, eax
and ebp, 0x83140727
or ebp, esi
mov esi, ebp
and ebp, 0x80050a3f
xor ebp, 0x3b79bd98
or ebp, edi
xor edi, 0xb82482bf
xor esi, 0x80040267
or esi, edi
and ebp, esi
add ebp, 0xd5e01514
mov esi, ebp
and esi, 0x19
xor ebp, 0x99
lea ecx, [esi*2]
add ecx, ebp
inc cl
mov byte [esp + eax + 0x44cb7856], cl
inc eax
dec ebx
cmp eax, 0xbb3487b1
jne 0x440b10
mov eax, dword [esp]
mov ebx, dword [0x44d398]
test ebx, ebx
je 0x440bdc
xor edi, edi
mov ebp, dword [0x44d39c]
nop
nop
nop
nop
nop
cmp dword [ebp + edi*8], 0xa2545bf7
je 0x440bab
mov ecx, edi
xor ecx, 1
and edi, 1
lea edi, [ecx + edi*2]
cmp edi, ebx
jb 0x440b90
jmp 0x440bdc
mov ebx, dword [ebp + edi*8 + 4]
cmp ebx, eax
je 0x440bdc
lea eax, [esp + 8]
push 0
push 0
push edx
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 0x24
push ebx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x30
cmp eax, 0x103
jne 0x440cc9
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov ecx, 0x17855
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax + 0x44cb7856]
mov esi, ecx
and esi, 0x10818
mov edx, eax
and edx, 0x83140727
or edx, esi
mov esi, edx
and edx, 0x80050a3f
xor edx, 0x3b79bd98
or edx, edi
xor edi, 0xb82482bf
xor esi, 0x80040267
or esi, edi
and edx, esi
add edx, 0xd5e01514
mov esi, edx
and esi, 0x19
xor edx, 0x99
lea edx, [edx + esi*2]
inc dl
mov byte [esp + eax + 0x44cb7856], dl
inc eax
dec ecx
cmp eax, 0xbb3487b1
jne 0x440c10
mov eax, dword [esp]
mov ecx, dword [0x44d398]
test ecx, ecx
je 0x440cc1
xor edx, edx
mov esi, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x4c697c35
je 0x440ca0
inc edx
cmp ecx, edx
jne 0x440c90
jmp 0x440cc1
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x440cc1
push 0
push 0
push dword [esp + 0x2c]
push 0xc
push ecx
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x18
test eax, eax
js 0x440cc9
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x440cd7
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x440ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0x3c]
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
cmp word [edi + ebx], 0
lea ebx, [ebx + 2]
jne 0x440d00
add ebx, 0xfffffffe
and ebx, 0xfffe
mov word [esp + 8], bx
add ebx, 2
mov word [esp + 0xa], bx
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0xfcfdfafb
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0xbb3487aa
mov edi, 0x17855
nop
nop
nop
movzx ebp, byte [esp + eax + 0x44cb7856]
mov ecx, edi
and ecx, 0x10818
mov ebx, eax
and ebx, 0x83140727
or ebx, ecx
mov ecx, ebx
and ebx, 0x80050a3f
xor ebx, 0x3b79bd98
or ebx, ebp
xor ebp, 0xb82482bf
xor ecx, 0x80040267
or ecx, ebp
and ebx, ecx
add ebx, 0xd5e01514
mov ecx, ebx
and ecx, 0x19
xor ebx, 0x99
lea ecx, [ebx + ecx*2]
inc cl
mov byte [esp + eax + 0x44cb7856], cl
inc eax
dec edi
cmp eax, 0xbb3487b1
jne 0x440d70
mov eax, dword [esp]
mov edi, dword [0x44d398]
test edi, edi
je 0x440e24
xor ecx, ecx
mov ebx, dword [0x44d39c]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + ecx*8], 0x40915fe0
je 0x440e00
inc ecx
cmp edi, ecx
jne 0x440df0
jmp 0x440e24
mov edi, dword [ebx + ecx*8 + 4]
cmp edi, eax
je 0x440e24
lea eax, [esp + 0x10]
push esi
push eax
push edx
push dword [esp + 0x4c]
push 0x10
push edi
push dword [0x44d3a0]
call fcn.0043dc10
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4a3f24
Capabilities:
Create a process with modified i/o handles and window
Create pipe
Create process on windows
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
xor ebx, ebx
mov dword [ebp - 0x17c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404580
xor eax, eax
push ebp
push 0x4a4118
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x1c], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CreatePipe
xor eax, eax
push ebp
push 0x4a40e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x68]
xor ecx, ecx
mov edx, 0x44
call fcn.00402c80
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x3c], 0x101
mov word [ebp - 0x38], 0
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle_1
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebp - 4]
call fcn.00404590
push eax
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, ebx
call fcn.00404590
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
jne 0x4a4012
mov eax, 0x4a412c
call fcn.004a3e98
jmp 0x4a40c6
xor eax, eax
push ebp
push 0x4a40bf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
call fcn.004040d0
push 0
lea eax, [ebp - 0x14]
push eax
push 0xff
lea eax, [ebp - 0x178]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_ReadFile
cmp eax, 1
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x14], 0
jbe 0x4a407e
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x178], 0
lea eax, [ebp - 0x17c]
lea edx, [ebp - 0x178]
mov ecx, pe_nt_image_headers32
call fcn.00404340
mov edx, dword [ebp - 0x17c]
lea eax, [ebp - 0x18]
call fcn.00404398
mov eax, dword [0x4a9840]
mov eax, dword [eax]
call fcn.00475fc0
test bl, bl
je 0x4a4094
cmp dword [ebp - 0x14], 0
jne 0x4a4028
push 0xffffffffffffffff
mov eax, dword [ebp - 0x78]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a40c6
mov eax, dword [ebp - 0x74]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x78]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a40ef
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00404124
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
Function at 0x419410
Capabilities:
Get disk information

Disassembly:
sub esp, 8
mov eax, dword [0x4d1030]
mov edx, dword [0x4d1034]
mov dword [esp + 4], 0
push 0x4d1064
lea ecx, [eax + eax]
or ecx, edx
mov dword [esp + 4], ecx

Function at 0x449b1c
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
shr ch, 1
jle 0x449b14
xchg cl, bl
push es
jnp 0x449ac4
test byte [edx + 0x6a], ah
push ds
push 0x1e
jle 0x449b95
cmc
imul ecx, dword [eax - 0x31], 0x3b9da5b8
cld
lcall 0x4133, 0xe932f29a
xor byte [ecx - 0x57], 0xc7
pop es
insb byte es:[edi], dx
in eax, dx
cmp dword [ecx + 0x4a9044a3], ecx
inc esp
nop
dec edx
js 0x449bb7
jo 0x449ad2
push es
mov dl, 0xd2
loopne 0x449b43
outsb dx, byte [esi]
xchg esi, eax
shl byte [ebp + 6], 1
jge 0x449b25
dec edi
mov dh, 0xd5
iretd
out dx, al
inc ebx
mov byte [0x554df763], al
aaa
rol byte [ebx], cl
out 0xe5, eax
retf
mul dword [edx - 0x7b9fbd6d]
push eax
clc
xlatb
out dx, al
idiv byte [ebx + 0x39]
fst dword [esi - 0x7a78297e]
wait
mov ebp, 0x1f177cf6
cmp ecx, ebx
xchg esi, eax
adc dh, 0x87
test dword [ebx + 0x177cf6bd], ebx
pop ds
loop 0x449b5d
dec ebx
lodsd eax, dword [esi]
inc esi
mov edx, 0xf3815c6f
xlatb
add bl, byte [ebx - 0x11]
pop ebx
out dx, eax
add esp, eax
mov esi, 0xc3416f0c
jns 0x449ba2
xchg edx, eax
xor bl, byte [ecx - 0x3543cb82]
sti
aad 0x4e
cdq
jle 0x449bd9
mov esp, 0x4ed5fbca
pop eax
mov byte [0xdf203248], al
jecxz 0x449bef
lea edi, [edi + 6]
inc esi
mov edx, 0x92b67346
inc esi
jae 0x449b70
xchg edx, eax
loop 0x449b7c
in eax, dx
jb 0x449be3
aad 0x39
arpl word [edx + ebp*2], bp
mov dword [eax], esp
inc eax
test ecx, 0x9238e793
out 0x3e, eax
jae 0x449c1c
ret
invalid
jge 0x449c2c
sbb al, 0x7a
mov al, 0x53
push esi
ljmp 0xe36c
lcall 0x4143, 0xefce36c
insb byte es:[edi], dx
jecxz 0x449bee
push cs
inc ebx
inc ecx
test dh, bh
pop dword [eax]
adc al, 0xfc
mov esp, 0x7ddff35c
xor dh, byte [edx + 0x578d7a10]
adc byte [edx - 0x73], bh
push edi
xor cl, byte [0x23527fb8]

Function at 0x461ce0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov byte cs:[ebp + 0x3dedee4], ch
fst st(2)
pop esi
push ds
jns 0x461c5f
rcr dword [esi - 0x65], 1
outsd dx, dword fs:[esi]
inc edx
pushal
and ch, dh
loop 0x461cc4
invalid
pop edi
daa
Function at 0x4c6ecd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4d13a0
cmp edx, dword [eax]
je 0x4c6eef
add eax, 8
inc ecx
cmp eax, 0x4d1430
jl 0x4c6ee0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4d13a0]
jne 0x4c701d
mov eax, dword [0x4d6dd0]
cmp eax, 1
je 0x4c6ff7
test eax, eax
jne 0x4c6f20
cmp dword [0x4d12c8], 1
je 0x4c6ff7
cmp edx, 0xfc
je 0x4c701d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c6f57
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c78b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c7d40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c6f9a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c7d40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4cce24
push edi
call fcn.004c9c10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c78b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c78c0
lea eax, [ebp - 0xa0]
push 0x4cce04
push eax
call fcn.004c78c0
push dword [esi + 0x4d13a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c78c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c9b84
add esp, 0x2c
pop edi
jmp 0x4c701d
lea eax, [ebp + 8]
lea esi, [esi + 0x4d13a4]
push 0
push eax
push dword [esi]
call fcn.004c7d40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42b9e0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, 1
mov dword [esp + 0xc], eax
mov dx, word [0x485778]
mov ax, dx
add eax, 0xc1543f86
mov dx, ax
mov word [0x485778], dx
mov eax, dword [0x4999f8]
mov esi, esp
mov dword [esi], eax
mov dword [esp + 8], ecx
call fcn.0042b8a0
mov dx, word [0x4856ce]
mov cx, dx
or ecx, 0x7128
mov dx, cx
mov word [0x4856ce], dx
mov dword [esp], 1
mov byte [esp + 7], al
call fcn.0045656d
int3
Function at 0x43aa20
Capabilities:
Hash data with md5

Disassembly:
push esi
sub esp, 8
mov dword [esp + 4], ecx
mov eax, dword [0x48e170]
mov edx, eax
inc edx
mov dword [0x48e170], edx
mov edx, dword [0x489188]
shl edx, 6
and eax, edx
cmp eax, 0xdb7e868f
mov dword [esp], ecx
jge 0x43aa5e
mov eax, dword [0x490f74]
or eax, 0xe18f250a
mov dword [0x490f74], eax
mov eax, dword [esp]
mov dword [eax], 0
mov ecx, dword [0x49465c]
not ecx
or ecx, 0x202b7bdc
mov edx, dword [0x48a160]
and edx, ecx
mov dword [0x48a160], edx
mov dword [eax + 4], 0
mov si, word [0x486a1e]
mov cx, si
and ecx, 0xc519
mov si, cx
mov word [0x486a1e], si
mov dword [eax + 8], 0x67452301
mov ecx, dword [0x496e6c]
mov edx, 0xaf165374
sub edx, ecx
mov ecx, dword [0x48d9a8]
or edx, ecx
or edx, 0x8aba3ca2
mov dword [0x48d9a8], edx
mov dword [eax + 0xc], 0xefcdab89
mov ecx, dword [0x48d9d0]
and ecx, 0x3c4122cb
cmp ecx, 0x83d4c020
jl 0x43aafa
mov eax, dword [0x48bbdc]
add eax, 0xd001c602
mov dword [0x48bbdc], eax
mov eax, dword [esp]
mov dword [eax + 0x10], 0x98badcfe
mov ecx, dword [0x48fc94]
xor ecx, 0xb555bceb
mov dword [0x48fc94], ecx
mov dword [eax + 0x14], 0x10325476
mov ecx, dword [0x492dcc]
inc ecx
mov dword [0x492dcc], ecx
imul ecx, ecx, 0xaa4efc10
xor ecx, 0x9246
mov dx, word [0x482ac6]
mov si, dx
or esi, ecx
mov dx, si
mov word [0x482ac6], dx
add esp, 8
pop esi
ret