joyce8/EMBER2024-capa huggingface dataset:
Function at 0x583df2
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x41afecc9
stosd dword es:[edi], eax
sbb eax, 0x96c807a
sub bl, ch
clc
push edx
leave
xor dh, byte [edx]
fcomp st(4)
jg 0x583df8
fcomp dword [ebp + 0x65660a98]
adc al, 0xdc
push ss
aam 0x9e
lds ecx, [edx]
pop ebp
push edi
dec esi
pop ebx
cmpsb byte [esi], byte es:[edi]
mov ebx, 0xe96d6e7c
loop 0x583e95
int3
shl byte [eax - 0x7df74da6], cl
pop ebx
invalid

Function at 0x5d7ccf
Capabilities:
Encode data using xor

Disassembly:
retf 0x8338
fild dword [edi - 0x52d6378f]
or dword [ecx + 0x55318040], 0x125c2c39
push edi
xor dword [edi - 0x73], eax
sbb dword [eax + eax*4 + 0x3a408a38], 0xf6e2d0dc
or eax, 0x5e753875
loopne 0x5d7d41
sbb eax, 0xaaa522c0
or ah, byte [edx - 0x457388d3]
cmp edx, ecx
in eax, 0x32
jno 0x5d7d25
mul edi
test al, 0xb1
salc
rcl ebx, 1
mov dword [0x1630aa5b], eax
inc ecx
jle 0x5d7ccb
pop ss
sbb byte [eax], dh
push ss
jb 0x5d7d8b
mov ch, 0x24
cmpsb byte [esi], byte es:[edi]
mov bh, 0xf7
xchg ebp, eax
adc ecx, 0xacdc5664
push esi
fsubr qword [ebp + ebp*4 + 0x21d09d20]
invalid
lodsb al, byte [esi]
lodsd eax, dword [esi]
and byte [ebp + 0x328c21d0], bl
int1
push ds
idiv byte [eax - 0x71]
jno 0x5d7d28
das
enter 0xffffffffffffa721, 0xffffffffffffffbe
jmp 0x5d7da1
ret 0xbf07
cmpsd dword [esi], dword es:[edi]
or al, 0x3b
xchg ebp, eax
in eax, 0x6a
mov al, 0x2f
loope 0x5d7d95
inc dword [esi - 0x50]
pop esp
add al, 0xc1
cmp al, 0x71
adc al, 0x65
push es
nop
sub al, 0x9a
jle 0x5d7e17
dec esp
push edx
xor al, 0xaa
test byte [ebx], dh
test dword [ecx], ebx
cwde
rcr edx, 0xe3
mov cl, 0xff
test eax, 0x238f451e
scasb al, byte es:[edi]
cmp al, dh
xor eax, esp
inc edi
loope 0x5d7dac
sbb dword [eax - 0x4e1c253f], ebx
jmp [ecx + 0x238f451e]
popfd
mov dl, 0xd
salc
and dword [edx - 0x53146288], edi
sbb esp, 0x18
dec ebp
outsd dx, dword [esi]
sbb dword [eax + 0x3f], esp
mov al, 0xe2
adc edi, dword [esi - 0x6fda75eb]
out dx, eax
push ds
scasd eax, dword es:[edi]
and eax, 0xaf1eef90
push ebx
mov esi, eax
inc ebp
lodsd eax, dword [esi]
or dword [ecx + 0x220a89b], esi
mov al, 0xde
mov edx, 0x79f093cc
push edi
or al, 0x1b
adc al, 0x17
jo 0x5d7d95
aam 0x54
sub dword [ebx + 0x1f400712], edi
mov bl, 6
stosb byte es:[edi], al
and eax, 0xde01b937
and dh, byte [ecx]
jge 0x5d7e77
adc al, 0xe3
mov ch, 0xc5
add bl, ah
pop esp
push 0xffffffffffffff82
inc esp
jle 0x5d7dd9
enter 0xffffffffffffae70, 0xffffffffffffffc4
add cl, bl
sub dword [ecx], ecx
invalid
sub eax, dword [ecx + eax*8 - 0x72]
push ecx
fmul st(0), st(0)
push ebp
invalid
Function at 0x5e28f0
Capabilities:
Encode data using xor

Disassembly:
and cl, byte [esi - 0x4efe577f]
pop edi
xor dword [edx - 0x5c], 0xa0e553a6
jle 0x5e2812
mov dword [0xe1f640ec], eax
and al, 0x9b
cmc
add eax, 0xe1aa315c
scasd eax, dword es:[edi]
aaa
fbstp tbyte [eax - 0x30]
in eax, dx
lahf
mov esi, dword [ebx - 0x51]
mov eax, dword [ecx - 0x60377044]
mov ss, word [ebp + 0x35be09c4]
rcr ch, 1
push 0x110e03d2
invalid
push cs
adc esp, eax
in al, 0x78
rcr byte [eax], 1
or al, 0x51
js 0x5e2868
sbb byte [ecx + edx*2], cl
aas
inc esp
add ah, byte [0x8d879ab2]
push ebx
sub esp, dword [edi + 0x22]
cmp al, 0x89
jo 0x5e2850
jecxz 0x5e28e7
and edx, ebx
jo 0x5e2919
mov al, 0xf7
loopne 0x5e2896
mov bh, 0xae
inc edx
push ds
dec ebx
bound esi, qword [ebp - 0x6f]
mov eax, dword [0x9566960f]
mov cl, byte [ebx - 0x60]
mov ah, 0x5f
pop eax
and dword [edx - 0x48], esp
rol dh, cl
add cl, 0x92
fisttp qword [edx + esi*8]
bnd jnp 0x5e2924
sti
jns 0x5e2925
imul esi
sbb byte [ecx], bh
and dword [ebp + edi - 0x408d5e5a], edx
pop ebp
invalid
clc
fst dword [eax - 0x5b0b2fa1]
test byte [esi + ecx*4 + 0x3f9a05b1], dh
mov cl, 5
invalid
aas
loope 0x5e2965
mov cl, 5
lcall 0x8773, 0x476ee13f
inc edi
jae 0x5e2881
mov gs, word [ecx]
push esp
sbb byte [esi - 0x20], bl
movsd dword es:[edi], dword [esi]
jne 0x5e2892
rcr dword [0xe1e8e0b1], cl
cmp al, 0x49
adc ebx, edx
push edx
outsd dx, dword [esi]
sub dword [ebp + 0x27], esp
jg 0x5e2969
dec edi
and esi, dword [eax + 0x4ecfdf0f]
and al, 0xeb
mov edi, 0x114eaee1
cli
invalid
invalid
invalid

Function at 0x5e886f
Capabilities:
Encode data using xor

Disassembly:
push eax
scasb al, byte es:[edi]
jae 0x5e88eb
xor al, 0x30
and byte [edi], bl
mov edi, 0xc5d97d9e
dec esi
aad 0x4a
salc
mov bh, 0xf9
xchg byte [ecx + 0x51c2c1ba], dh
clc
mov edx, 0xf851c2c1
ja 0x5e88fc
iretd
pop edx
cmp esi, dword [esi - 0x5d9ce640]
mov edi, 0x76bfdd7b
iretd
arpl word [edx - 0x40228441], sp
jbe 0x5e887d
sahf
ja 0x5e8917
jnp 0x5e88b5
fstp xword [ebx*2 + 0x256e6030]
xor byte [ecx - 0x53], bh
sbb ebp, dword [eax - 0x3dacfe69]
pop ebp
xor byte [eax + 0x6e], ah
and eax, 0x1bad7930
test al, 0x97
xchg edi, eax
add dword [ebx - 0x3e], edx
loope 0x5e88b3
sal dword [ecx + 0x3977d013], 0x28
movsb byte es:[edi], byte [esi]
leave
loopne 0x5e8871
jo 0x5e88ed
xor al, 0x4f
inc ebx
int 0xdb
inc eax
jl 0x5e8884
jp 0x5e88bf
pop ebp
jnp 0x5e88a1
popal
add eax, 0x4c19801d
ret
dec esi
dec edi
out dx, al
lahf
or eax, 0x512a6195
invalid
sub byte [eax - 0x7d66627], bh
in al, 0x64
jp 0x5e88a6
push eax
pop edx
int3
cmc
pop ecx
mov esp, 0x758b00e5
sbb dword [edx - 0x258fd8d1], edi
in eax, 0xc3
fisubr word [ebx + 0x51]
mov byte [ebx - 0x7f12641a], cl
cmp eax, 0xbe726e30
mov ch, 0x98
inc edi
push 0xb83cd328
dec ebp
insd dword es:[edi], dx
push ecx
movsb byte es:[edi], byte [esi]
test bl, 0xea
invalid
Function at 0x5ffa9b
Capabilities:
Encode data using xor

Disassembly:
ror dword [esi - 0x74], 0xe7
adc eax, 0x778d1cdd
inc ecx
lea ecx, [eax]
out 0x15, eax
fstp qword [ecx*4 + 0x88d4177]
sahf
cmp ch, cl
xor dword [ecx], ecx
cmp esi, edi
clc
loope 0x5ffa98
stosb byte es:[edi], al
sub ecx, eax
loopne 0x5ffb19
mov byte [edi + 0x35], cl
and eax, 0xfd4f1f70
std
mov edi, 0x57a4217f
sub eax, 0x610920a3
cli
mov edi, 0x1e60155e
or bh, 0x26
mov esp, 0x76477a45
fcomp dword [edx]
jne 0x5ffb25
adc al, 0x70
inc ecx
and edi, esi
call 0xbb716a1d
test dword [ebx - 0x7f], edx
loop 0x5ffabd
and dh, al
jmp 0x16308cc0
dec edi
pushal
mov edx, dword [ebp + 0x54]
in al, 0xd9
les eax, [ecx - 0x46]
lea esp, [ecx + eax + 0x8e0d8d9]
push esp
lodsd eax, dword [esi]
rcl dword [ecx + 0xf3eca9e]
mov ss, word [ebp - 0x75]
inc ecx
mov ebp, ebp
adc esp, dword [esi - 0x10]
add eax, 0x8d0b4248
pop eax
cmpsb byte [esi], byte es:[edi]
adc byte [ebp + 0x7d321b84], 0x62
mov edx, 0xd901a48d
add ecx, ebx
fsub st(0)
or byte [ebp + ebp*4 - 0x2f], dl
xchg ecx, eax
sahf
retf 0xf3e
xor bh, byte [ebp + 0x62]
mov al, byte [0x91d18d7b]
sub byte [ecx + 0x230c5d11], al
adc al, 0x65
and byte [eax], bh
jle 0x5ffb22
in al, dx
xor dword [ebx + esi - 0x41], esi
adc edi, dword [edi - 0x5d17cebd]
or dword [eax], 0xc128b5c6
movsd dword es:[edi], dword [esi]
sbb dword [eax], ecx
dec ecx
sbb dword [eax], ecx
in eax, 0x42
push ebp
rcl dword [esp + eax*8], 0x9b
xor edx, ecx
push eax
xor eax, 0x237da06d
jne 0x5ffb5b
jo 0x5ffb46
mov dword [0x27d6874e], eax
dec ecx
invalid

Function at 0x5fffc0
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
mov cl, 0xcc
mov al, byte ds:[0x26951701]
inc ecx
add dword [edi], edx
xchg ebp, eax
inc ecx
pop edx
sbb bh, byte [edx + 0x5d]
inc ebp
xor al, al
rcl dword [ebp + 0x17ab002c]
salc
int3
lea eax, [ecx]
js 0x5fff6a
xchg esp, eax
loop 0x5fff6f
jl 0x5fffdf
and dword [esi + 0x42ff38bd], edx
sub dword [edi], edx
push esi
jo 0x5fff72
sal dword [edx*8 + 0x19e189], 0x37
lodsb al, byte [esi]
fsub qword [ebp + eax*4 - 0x5c887f10]
inc ebx
neg bl
pop edx
rcl byte [ecx + 0x1e10afbe], 0x79
xchg ecx, eax
mov esi, 0x791e10af
xchg ecx, eax
mov esi, 0x791e10af
inc edi
insb byte es:[edi], dx
push ecx
add esi, dword [ecx]
inc ecx
add dl, byte [ebp + 2]
out 0xf0, eax
and dl, 0xb
inc ebp
lea eax, [esi + ecx*2]
ja 0x5fffa6
invalid
mov byte [0xcc01b938], al
inc esp
adc byte [ebp - 0x13], ah
or al, 1
xor eax, 0x4085a1c2
leave
cdq
mov cl, 0x5a
xor byte [eax], 1
push edx
mov eax, dword [0xee5da348]
mov edi, 0x7cb89c69
cld
jbe 0x5ffffd
ljmp 0x5ed5:0x34e022b
Function at 0x603e40
Capabilities:
Encode data using xor

Disassembly:
adc dword [edx - 0x4e9e5b0a], ecx
rol byte [0x50c44ef1], 1
fnstsw word [edi + 7]
mov esp, 0x93908068
mov al, byte [0x25227259]
jno 0x603e43
xchg ebp, eax
test dword [ebx + 0x77783db6], 0x7989d544
not dword [ebx]
in eax, 0x30
movsd dword es:[edi], dword [esi]
popfd
xlatb
sal dword [ecx + 0x48], 0xea
lds ebx, [0x8cf4f676]
jp 0x603e3f
ljmp 0x8cf4:0xf6761dc5
cmp ebp, dword [ebx]
and ecx, edi
adc byte [0x1c39c011], ah
test eax, 0xb650c20
lodsb al, byte [esi]
mov dl, 0x65
inc ecx
loope 0x603dbc
mov al, 0x48
dec eax
ja 0x603ded
pushfd
cmp al, 0x61
mov dl, 0x79
jno 0x603e1b
mov es, word [eax]
loope 0x603e2f
inc esi
or edx, dword [ecx + 0x47]
inc edi
sub byte [eax], ah
xchg ecx, eax
test byte [esi], 0xdd
sal dword [ecx - 0x10], cl
jge 0x603e7a
xor ecx, eax
invalid
sar ecx, 0x98
jecxz 0x603e9f
adc bh, cl
int 0x46
jo 0x603e0b
push edx
pop es
jg 0x603e4a
cdq
ret
jae 0x603de7
faddp st(6)
faddp st(6)
sal dword [edx + 0x30], cl
push eax
imul eax, esp, 0x1c
cmp dword [ecx + 0x6906e1c0], 0x30
jne 0x603e8f
les ebx, [ebx + eax*4]
mov ecx, 0x6906e1c0
xor byte [ebp + 0x3a], dh
or dword [edi + esi*2 + 0x73], 2
mov eax, dword [0x23ff]
cmpsd dword [esi], dword es:[edi]
js 0x603e92
invalid
jp 0x603eb7
sub al, 0x40
daa
xor dword [ebp + 0x28], edi
jbe 0x603ecb
cmp dl, byte [edx - 0x7f]
xor eax, 0xd4a09727
and byte [ebx + 0x70008180], bl
add dword [eax], 0x72d3970
nop
mov ebx, 0xcec2fe80
cmp dword [0xbb906607], ebp
cmp dh, 0xc2
into
int3
mov cl, 0xb2
invalid
push ecx
invalid
imul edx, eax, 1
aaa
xchg ecx, eax
popal
and dword [ebp + 0x40], edi
inc ecx
int3
Function at 0x60459f
Capabilities:
Encode data using xor

Disassembly:
pop ecx
dec eax
sub al, 0xa7
add ah, byte [edi + 0xfd572e1]
fmul qword [ebx]
aad 0xc
outsb dx, byte [esi]
xchg dword [eax + ebx*2], edx
sbb byte [esp + eax*2 - 0x66], dl
sbb eax, 0x31f3736b
scasd eax, dword es:[edi]
mov byte [0xc4b0bea3], al
dec ebx
push ss
jl 0x6045c7
adc ecx, dword [ebx + eax + 0x71e4c7f6]
rcr byte [edx], cl
cli
jno 0x60459b
sbb bh, dl
dec edx
or al, 0x55
mov cl, bl
cmp eax, 0xaf09c4a1
pop ss
xchg ebp, eax
or ebx, dword [edi]
xchg ecx, eax
arpl word [esi], cx
jg 0x604635
mov bh, 0xa2
cmpsd dword [esi], dword es:[edi]
dec ecx
xchg ecx, eax
imul esp, esp, 0x7a383111
pop es
pop es
fstp dword [ecx + 0x49]
aaa
xchg ebp, eax
mov byte [0xc40972b7], al
sub ebx, dword [esi + 0x26]
and byte [edx + eax*4], 0x90
xchg ecx, eax
xor eax, 0x1e608fbd
fld qword [edx - 0x2fcd98f5]
cmp byte [0x117695cf], 0xd5
jp 0x6045ea
ja 0x604614
adc dword [eax + 0x51], edx
push eax
push ecx
invalid
aam 0x70
scasd eax, dword es:[edi]
or dword [eax], 0x76
push ss
mov byte [esi], bl
xor byte [eax - 0x2f], bh
mov edi, 0x644e1272
or al, 0x90
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0xd1324fbd]
outsb dx, byte [esi]
add al, 0xff
aam 0x1f
sub al, 0x11
in eax, dx
inc esi
les esi, [esi]
rcr byte [ecx + esi*4 + 0x43], 1
xchg esp, eax
push ss
adc ch, ch
les eax, [edi + 0x3749521d]
cmp ch, ch
das
and al, byte [ebp + edi*4 + 0x1b23c7eb]
stc
arpl word [ebp - 0x756f27e], di
xchg ebp, eax
loopne 0x6046d5
add byte [ebx + 0x10], cl
imul edi, dword [esp + esi + 0x47], 0x98b46b1f
or dword [esi + 0x4bd1e938], esp
and dl, byte [eax + 0x75a33844]
in eax, 0xd3
fld1
rcl dword [esi - 0x3e7cd3a0], 0xb6
inc ebp
sub byte [ebp - 0x7b67088], al
xor dword [ecx], ebp
dec ebp
hlt
outsd dx, dword [esi]
adc eax, 0xde401440
in al, dx
invalid
Function at 0x7c85dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x7d2378
cmp edx, dword [eax]
je 0x7c85ff
add eax, 8
inc ecx
cmp eax, 0x7d2408
jl 0x7c85f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x7d2378]
jne 0x7c872d
mov eax, dword [0xbd78d0]
cmp eax, 1
je 0x7c8707
test eax, eax
jne 0x7c8630
cmp dword [0x7d22a4], 1
je 0x7c8707
cmp edx, 0xfc
je 0x7c872d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x7c8667
lea eax, [ebp - 0x1a4]
push 0x7cddb8
push eax
call fcn.007c8fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.007c9450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x7c86aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.007c9450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x7cddb4
push edi
call fcn.007cb320
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x7cdd98
push eax
call fcn.007c8fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.007c8fd0
lea eax, [ebp - 0xa0]
push 0x7cdd94
push eax
call fcn.007c8fd0
push dword [esi + 0x7d237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.007c8fd0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x7cdd6c
push eax
call fcn.007cb294
add esp, 0x2c
pop edi
jmp 0x7c872d
lea eax, [ebp + 8]
lea esi, [esi + 0x7d237c]
push 0
push eax
push dword [esi]
call fcn.007c9450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x402dc0
Capabilities:
Encode data using xor

Disassembly:
test ch, al
add byte [eax], al
add byte [eax], al
cmp dword [0x4102ac], 0x27
add byte [eax], al
cmp dword [0x4102ac], 0x27
jle 0x402e87
aam 0xf4
aad 0x40
add bh, bh
xchg edi, eax
xor dword [edx], ecx
add al, 0xdf
fisttp dword [ebx + 0x40d034bb]
add byte [ebp + 0x680f7fff], al
loopne 0x402dbd
inc eax
out dx, al
jmp [edx]
call int.0040b590
push edx
cmpsb byte [esi], byte es:[edi]
push edi
inc edx
lodsb al, byte [esi]
fnop
add bh, bh
salc
add esp, 0x10
add ebx, 4
cmp ebx, 0x24
jb 0x8d402ddb
loope 0x402e69
pop ss
inc ecx
add byte [eax - 0x40], al
je 0xaa406a57
push 0x6926d5a8
push eax
call dword [0xc1eea4]
mov edi, ebx
cmp dword [edi + 0x75ff8508], 0xffffffed
push 0x40708c
call dword [sym.imp.MSVCRT.dll_perror]
add esp, 4
call 0x70562dbf
sar dword [edi], 0x2c
insb byte es:[edi], dx
aad 0x40
add byte [edi + 0x65], dl
adc eax, sym.imp.MSVCRT.dll_fprintf
mov ebx, dword [0xfc180]
sub dword [ebx + 8], 0x33
test byte [ebp - 0x5e295a0a], 0xc8
or eax, dword [ecx]
mov eax, 0x40eb4a68
mov esi, 0x15756427
mov ebx, dword [ecx + 0x4102ac]
mov edx, dword [0x26410bc8]
xor esp, ecx
add eax, 0xe0117dd4
jmp 0x402f2a
fmul qword [0x40c210]
invalid

Function at 0x403a90
Capabilities:
Encode data using xor

Disassembly:
nop
push ebp
mov ebp, esp
sbb ah, ch
adc al, 0x56
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x403ad5
mov eax, dword [esi + 0x824]
test eax, eax
je 0x403a8f
mov eax, dword [0x4102b4]
test eax, eax
cmovge ecx, dword [edx + 0x36]
add byte [eax], al
dec eax
mov dword [0x41ebb4], eax
jle 0x403b22
mov cl, 0
cmp dword ds:[0x1d02b4], 1
jne 0x403ad7
mov eax, dword [esi + 0x10]
mov dword [0x41fd05], eax
invalid
jmp 0x403afb
mov ecx, dword [esi + 0x10]
fisubr dword [esi]
add byte [eax], al

Function at 0x404f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsb byte es:[edi], byte [esi]
mov ebp, esp
mov eax, eax
or bh, al
add byte [eax], al
add eax, dword [eax]
add byte [ebx - 0x467a94bb], cl
jne 0x404f7e
mov ecx, dword [0x4102dc]
or dword [ebp + 0xc], ecx
mov eax, ecx
mov ecx, dword [ebp + 0x10]
test dword [ebp - 0x347a948b], esp
je 0x404f8f
mov eax, dword [edi + 0x20]
mov dword [ebp + 0x10], edx
push ebx
jecxz 0x404fb5
adc al, 0x56
rol byte [ebp - 0x74fc8a25], 1
pop eax
ror byte [ebx + 0xdece50], 1
add byte [eax], al
cmp edi, dword [ebx - 0x70]
adc eax, 0x23780111
jae 0x405022
inc esp
or al, 0x2a
mov eax, 0x24166e1
aas
Function at 0x4053b7
Capabilities:
Inspect section memory permissions

Disassembly:
mov ecx, dword [esp + 4]
xor eax, eax
test ecx, 0x4000000
je 0x4053ca
mov eax, 0x200
push esi
mov esi, ecx
and esi, 0x20000000
push edi
mov edx, 0x40000000
mov edi, 0x80000000
je 0x4053e8
test edx, ecx
je 0x4053e8
test edi, ecx
jne 0x405416
test esi, esi
je 0x4053f5
test edx, ecx
je 0x4053f5
or eax, 0x20
jmp 0x405419
mov esi, ecx
and esi, edx
je 0x405404
test edi, ecx
je 0x40540d
or eax, 4
jmp 0x405419
test edi, ecx
je 0x40540d
or eax, 8
jmp 0x405419
test esi, esi
je 0x405416
or eax, 2
jmp 0x405419
or eax, 0x40
pop edi
pop esi
ret

Function at 0x43b63b
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop esi
dec ebx
sub esp, 4
mov dword [esp], 0xc0479d61
mov edi, dword [esp]
add esp, 4
and ebx, ebx
call fcn.0043b67c
mov ebx, 0xb20871c6
xor dword [edx], esi
and edi, ebx
inc edx
sub edi, 0x546e1b38
add ebx, 0x6a5db62
cmp edx, ecx
jne fcn.0043b63b
sub edi, edi
mov edi, edi
sub ebx, ebx
ret
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417c36
mov eax, dword [0x6367f0]
test eax, eax
je 0x417c2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6367f0], eax
test eax, eax
pop ebx
je 0x417cd1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
Function at 0x423c48
Capabilities:
Encode data using xor

Disassembly:
xor ch, byte [ebp - 9]
stosd dword es:[edi], eax
push ss
rcr byte [ebx + 0x3d4e8b79], 1
mov ecx, dword [esi + 0x3d]
mov dl, 0xc7
scasd eax, dword es:[edi]
xor ecx, dword [edi - 0x32]
mov byte [0x75d77ff1], al
clc
mov esi, 0x4e743850
add dl, al
inc eax
scasd eax, dword es:[edi]
mov dword [0x11ee7438], eax
test al, 0x4a
wait
jns 0x423c06
or ebx, dword [ebx + 0x76]
outsb dx, byte [esi]
aas
aas
ror byte [edi], 0x3f
mov ah, al
xchg ebx, eax
pop ss
clc
les ecx, [edx - 0x29ac6db1]
dec edi
xchg edx, eax
push ebx
salc
xor byte [ecx], bh
loope 0x423cb6
push ebp
bound esp, qword [ebx - 5]
sti
or edi, dword [ecx + 0x23649b03]
inc ecx
pop ds
and eax, dword fs:[ecx + 0x1f]
cmpsd dword [esi], dword es:[edi]
push edi
mov esp, 0x97b300bf
enter 0xffffffffffffe077, 0xffffffffffffff9c
fld qword [ecx - 0x12]
pushal
jg 0x423c2d
mov esp, 0xaf1622e6
imul eax, dword [edx - 0x40c17415], 0x39
push dword [edi]
jns 0x423c38
adc eax, dword [ebx + 0x7c]
loopne 0x423bfe
or al, 0xa8
and byte [ecx], bl
pop esi
out dx, eax
mov dh, 0x51
shr dword [edx + 0x4cbc6a42], cl
test dl, 0xd3
sal byte [edi], cl
imul esi, ebx, 0x3c
mov edi, 0xc7990ca5
pop eax
xchg esi, eax
aas
ja 0x423c43
outsd dx, dword [esi]
scasb al, byte es:[edi]
sub al, 0xf9
pushal
into
lcall 0xf58, 0x26fe043c
cmpsd dword [esi], dword es:[edi]
nop
pop edi
push ebp
mov edx, 0x81ca01eb
dec edx
scasd eax, dword es:[edi]
loopne 0x423c5b
mov ebx, 0xa16afe0f
mov dh, 0xe9
mov dh, 0x9a
arpl word [eax - 0x63], dx
push eax
popfd
std
mov ebp, 0xd212d0c0
dec edi
stosb byte es:[edi], al
test al, 0xc3
rcr dword [edx - 0xc001b2], cl
or byte [eax + 0x36], dh
sub al, byte [esi - 0x70]
and al, 0x87
out 0xbe, eax
lea edi, [edx - 0x79]
cmp bl, byte [eax]
test al, 0xdd
add al, 0xef
xchg esi, eax
adc esi, dword [eax]
mov bh, pe_nt_image_headers32
inc edx
ret 0xfbeb
Function at 0x43c834
Capabilities:
Encode data using xor

Disassembly:
cpuid
nop
in al, 0xa8
fsubr dword [esi + 0x4b]
pushal
mov esi, 0x5684db45
push ss
rcr dword [esi + edx*2 + 0x34ecabc6], cl
mov esi, dword [edi]
aaa
loopne 0x43c818
ficom word [edi + 0x71a1798]
adc al, 0x82
push edi
mov byte [0x90adac6b], al
out 0x3f, al
mov dh, 0x62
push esp
sbb dword [edi + 0x36], ebx
jp 0x43c779
lodsd eax, dword [esi]
sub eax, 0xd380f67c
invalid
call 0xd5ec665
cmp dword [edi + 0x2e], ebx
pop edx
invalid
dec esp
aad 0x3c
dec edi
out 0x64, eax
cmp bl, 0x26
cli
or bh, byte [esi + 0x566c75f8]
cld
and bh, byte [esi + 0x43]
mov edi, 0x1786eb52
imul eax, esi, 0x4b
invalid
dec ebx
jmp 0x43c7b7
dec ebx
out 0xf4, al
pop eax
or ebx, ebp
cmp dword [edi], edi
wait
sbb dword [esi + eax + 0x3937cb0a], esp
stosb byte es:[edi], al
daa
outsd dx, dword [esi]
cmp eax, 0x4014b99b
cmp ah, byte [edi - 0x1436f813]
push ebx
push ebx
fisubr word [edi - 0x1e]
xchg byte [edx - 0x74316299], cl
mov ss, word [0x7892bb06]
cmpsb byte [esi], byte es:[edi]
mov ecx, dword [esi - 0x6d44f9eb]
js 0x43c80b
xor ah, byte [edi - 0x28a5f93f]
mov dl, cl
loopne 0x43c892
stc
mov bl, 0x38
into
mov edx, 0x7d8f97d7
jge 0x43c857
or eax, dword [edi - 0x2a]
fldcw word [ebx]
inc esp
xchg ebp, eax
and dh, byte [edi - 0x7d]
inc esi
push esp
lodsb al, byte [esi]
div ebx
loope 0x43c82f
sub al, 2
and ebx, ebx
arpl word [edx + 0x48], di
mov ebx, 0x5c2b304a
xor al, 0x79
je 0x43c8d4
sub dh, byte [esi + 0x5322ca81]
and cl, byte [edx + ebp*2]
dec edx
out dx, eax
ljmp 0x4bc6
jae 0x43c85d
retf
Function at 0x629421
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6333c8
cmp edx, dword [eax]
je 0x629443
add eax, 8
inc ecx
cmp eax, 0x633458
jl 0x629434
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6333c8]
jne 0x629571
mov eax, dword [0x637d9c]
cmp eax, 1
je 0x62954b
test eax, eax
jne 0x629474
cmp dword [0x6332f4], 1
je 0x62954b
cmp edx, 0xfc
je 0x629571
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x6294ab
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629e00
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a290
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6294ee
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a290
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ed54
push edi
call fcn.0062c160
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629e00
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629e10
lea eax, [ebp - 0xa0]
push 0x62ed34
push eax
call fcn.00629e10
push dword [esi + 0x6333cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629e10
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c0d4
add esp, 0x2c
pop edi
jmp 0x629571
lea eax, [ebp + 8]
lea esi, [esi + 0x6333cc]
push 0
push eax
push dword [esi]
call fcn.0062a290
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret