joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d618
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x44d67f
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x44d69c
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x44d705
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004965e8
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x44d6d8
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x44d6c8
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x44d6ff
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d759
inc edi
cmp edi, ecx
jb 0x44d6ec
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.00480f88
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00494e64
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x44d6ff
cmp dword [esi + 0x14], 0x10
jb 0x44d768
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x44d782
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004965e8
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x44d7b8
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x44d7a8
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x44d7f6
cmp ecx, edx
je 0x44d86d
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x44d7de
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.0046c558
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004810b8
mov eax, esi
jmp 0x44d73e
or ecx, 0xffffffff
jmp 0x44d7f8
Function at 0x44da98
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00480f88
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dbbb
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d2b8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dbd2
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d1c8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x46c81d
Capabilities:
Encode data using xor

Disassembly:
loop 0x46c87a
or dword [eax + eax*2 - 0x5a318f08], edx
test eax, 0xfc1788ac
pop ebx
leave
push ss
invalid
test ecx, edx
xchg ebx, eax
stosb byte es:[edi], al
pop ebp
pop ds
jne 0x46c82c
adc edi, dword [esi + 0x6bf2d198]
xchg ecx, eax
movsd dword es:[edi], dword [esi]
invalid
Function at 0x46ee88
Capabilities:
Encode data using xor

Disassembly:
push 0x2949064c
daa
pop es
call 0xe1056bbc
and esi, dword [edx + 0x6e5b97a2]
ret
jmp 0x46eda6
xchg ecx, eax
popal
push ecx
cmpsd dword [esi], dword es:[edi]
invalid
mov al, 0xdd
sal byte [ecx - 0x735046ae], 0x82
cmpsb byte [esi], byte es:[edi]
jno 0x46ee06
cdq
test byte [edi + 0x503bef68], 0x9a
insd dword es:[edi], dx
leave
ret 0x705b
sub dword [ebp - 0x20], edi
mov esi, 0x176bcc1a
xor eax, 0x229224ec
xchg edi, eax
outsd dx, dword [esi]
adc bl, byte [0xf5f7a9d1]
test al, 0x84
and dl, byte [edi - 0x2ee2ed91]
test eax, 0x84a8f5f7
pop ecx
xchg byte [edx], ah
dec esp
inc edx
inc ebp
jp 0x46ee1d
sub bl, dl
sti
jnp 0x46ee6e
inc esp
not dword [esi]
push ss
push ss
push esp
cdq
push cs
mov eax, 0x7a183433
cli
push edi
test byte [ebx - 0x24], dl
test byte [ebp - 0x37], bl
sbb bl, byte [eax]
jp 0x46ee1f
fadd qword [ebp + ebx*2 + 0x7a181ac9]
or byte [ebp + esi*4 + 0x5c], 0xd5
popfd
dec esp
mov ch, 0x5c
aad 0x9d
xor dword [eax], ecx
dec ebp
int 0x92
lahf
pop ebp
push ds
loop 0x46ee95
call 0x1284a6cb
and ebp, edx
stc
push eax
loop 0x46ee3b
xchg ebx, eax
lcall 0x5f59, 0xec47e08f
xor bh, byte [edx - 0x7f]
pop ds
push ebx
sbb dword [eax], eax
jg 0x46ee62
lock add dword [ebp + 0x58], esi
insb byte es:[edi], dx
imul edi, dword [esi], 0xffffff86
outsb dx, byte [esi]
lodsb al, byte [esi]
sbb dword [eax], ebp
xchg byte [edx + 0x14], ah
inc ebx
add ebx, ecx
insb byte es:[edi], dx
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
int 0xa
xor byte [ebx - 0x50bd350a], 0xb1
invalid

Function at 0x4b5688
Capabilities:
Encode data using xor

Disassembly:
out 0x62, eax
sar dword [edx - 0x5d40a9e], 1
xor esp, dword [ebp - 0x5e]
bound esi, qword [ecx + 0x3e7ecb9]
loope 0x4b567b
rol ebx, 0xd8
mov ebp, 0xb6ec20c5
fabs
sub al, 0x53
mov al, 0xfb
call 0xaba47468
push ecx
mov cx, 0x6307
cld
xchg ecx, eax
lodsd eax, dword [esi]
or al, 0x20
retf
pushal
xchg esi, eax
mov cl, 0x13
jge 0x4b56de
add byte [ebp - 0x7a51ce1f], 0x82
jbe 0x4b56cb
mov dword [ecx + 0x7b], esp
xacquire xchg dword [ebx - 0x2be768cc], edx
xor al, 0x97
sbb ah, dl
jb 0x4b56b1
test byte [edx - 0x37b8603], 0xd2
jns 0x4b560a
test ah, bh
cld
shl byte [ebx - 0x4e], cl
arpl word [edx + 0x375d9bc9], si
leave
wait
pop ebp
aaa
dec edx
pop edi
imul eax, dword [edx], 0x41
nop
movsd dword es:[edi], dword [esi]
lcall 0xf821, 0x56980afd
and eax, 0xe552ccc5
fst dword [ebx]
cwde
sbb byte [edx], dl
outsd dx, dword [esi]
add byte [esp + edx*4], 0xf0
xor al, bh
sbb byte [ecx], dh
push esi
jg 0x4b568a
xor dword [esi + 0x7f], edx
aad 0x55
push ebp
inc ebx
mov cl, 0x30
call 0xa21f4901
pop esp
popfd
not dword [ecx - 0x19]
xchg ecx, eax
and esp, dword es:[ebx + 0x30]
mov ebx, 0xd46a85d0
test dword [edx - 0x2c], ebp
jge 0x4b5666
sahf
adc ah, byte [eax + 0x7c849dab]
pop ebx
cli
cdq
insb byte es:[edi], dx
adc dh, byte es:[0xa735f51c]
fcompi st(2)
invalid
sbb al, 0xf5
xor eax, 0x62f2dfa7
not dword [edx + 0x5d08f6b0]
test byte [edx], 0x8b
jg 0x4b5684
jbe 0x4b5685
adc eax, 0xc4c277e1
adc byte [ebx + 0x16], cl
mov eax, 0x1c2b282
xor cl, dh
mov ebp, 0xf6075066
iretd
Function at 0x4b60c8
Capabilities:
Encode data using xor

Disassembly:
aaa
movsd dword es:[edi], dword [esi]
ljmp 0x7fc4
cwde
arpl word [esi], bx
les edi, [edi]
enter 0x47d, 0xffffffffffffffd7
push ebp
mov esi, 0x673f537
inc esi
sub eax, 0x4ee11073
xchg edi, eax
adc eax, dword [edx + 0x4243793]
xchg byte [ebp + 0x25632445], dl
shl byte [esi], cl
mov cl, 0x87
enter 0x4105, 0xfffffffffffffffc
add eax, 0x5edb88c8
push edi
jnp 0x4b607f
pop esi
or eax, 0x8372b83c
inc edx
push ebp
mov dword [0x8d56029d], eax
inc esp
pop edx
aaa
xchg esi, eax
rcl cl, 1
push esp
lds eax, [eax]
xor byte [edi], dh
and al, 0xf2
xchg esp, eax
out 0x55, eax
add dword [ebp + 0x479841f4], 0xbf39f58b
xchg edi, eax
movsb byte es:[edi], byte [esi]
xchg edi, eax
jns 0x4b6156
mov edi, 0xf736a206
add al, 4
pop ebx
pop es
jb 0x4b6106
div dword [ecx]
push es
add eax, dword [eax]
push es
sbb al, 0x26
daa
inc ecx
das
loop 0x4b6097
sub dl, byte es:[ecx + 0xcc38d66]
or al, 0x28
jbe 0x4b60f3
cli
mov eax, dword [0x9932a695]
xor byte [esi + 0x25], al
invalid
invalid
xor byte [edi - 0x5de54210], al
adc al, byte [edx + esi*2 - 0x77]
add ebp, edi
mov bh, 0x63
stosb byte es:[edi], al
clc
jb 0x4b613b
hlt

Function at 0x4c9cf8
Capabilities:
Encode data using xor

Disassembly:
ljmp 0xcb3e:0xb6e69db6
invalid
lodsd eax, dword [esi]
adc ebp, edx
ja 0x4c9cbd
rol dl, cl
pop eax
jae 0x4c9cff
je 0x4c9d35
enter 0x4ccd, 7
pop es
ja 0x4c9cec
pushal
sal dword [esi], cl
stc
stc
xor edi, dword [eax - 0xea8897e]
pop edx
and dword fs:[eax - 0x3e], esp
jne 0x4c9d07
and edx, dword [edi]
push ebx
pop ds
jb 0x4c9d0c
xlatb
mov eax, dword [0x3a25ed3]
div dword [ebp - 0xd]
pop ebp
stosb byte es:[edi], al
cmp dword [edi + 0x41], esi
out 0x96, eax
adc al, 0xf6
xchg edx, eax
sal byte [esi], cl
inc eax
inc eax
pop esp
Function at 0x4e0288
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513778
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e03ab
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffaa8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e03c2
push ecx
lea ecx, [esi + 0x24]
call fcn.004ff9b8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5299b8
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055cea8
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529adb
push ecx
lea ecx, [esi + 0x18]
call fcn.005491d8
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529af2
push ecx
lea ecx, [esi + 0x24]
call fcn.005490e8
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5541f8
Capabilities:
Encode data using xor

Disassembly:
jbe 0x554238
mov ebp, 0x3313d503
pop ss
aad 0x13
xor edx, dword [edi]
dec ebp
xchg ebp, eax
movsb byte es:[edi], byte [esi]
fldcw word [ebx]
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
invalid
cmpsd dword [esi], dword es:[edi]
and al, 0x23
mov bl, 0x45
cmp ah, byte [edi - 0x30259137]
jecxz 0x5541fc
mov dl, 0xaf
test eax, 0x1195a507
fstp xword [ebx]
enter 0x5103, 0xffffffffffffffbd
cmp ecx, dword [0x2a8711e3]
mov dl, 0x58
jl 0x5542b4
mov eax, dword [0x76bd7144]
stc
jecxz 0x5541fc
jp 0x5542c3
jmp 0x8db9a5e1
cmc
mov ecx, dword [edi + 0x1a]
inc esp
lea edi, [esi + edx*2 + 0x12]
xchg ebx, eax
movsd dword es:[edi], dword [esi]
fld qword [ebx + 0x4d]
mov eax, dword [0x539541b]
or cl, cl
daa
not byte [ecx - 0x48]
inc ebx
sbb ebx, dword [ecx - 0x2d]
iretd
ror edi, cl
pushfd
dec edx
jmp 0x55f86a43
sahf
sub al, 0xa
insd dword es:[edi], dx
xor byte [ebp - 0x7c], ah
leave
xor dh, dl
xchg ecx, eax
cli
je 0x554298
xor ebp, dword [ebx + 0x13b06107]
pop es
popal
mov al, 0x13
cmp al, 0x51
mov byte [ebx + 0x58], cl
mov dl, 0x31
xor esp, ebx
and al, 2
pop esp
xchg esp, eax
jo 0x5542d5
mov cl, 0x69
je 0x5542d4
stosd dword es:[edi], eax
out 0x34, eax
lcall 0x2158, 0x51029548
jae 0x554376
imul ecx, dword [ecx + 0x3f], 0xa0b12005
xchg ebx, eax
retf
movsd dword es:[edi], dword [esi]
dec edi
popfd
xchg byte [eax], ah
ljmp 0x57a9
sbb al, 6
test eax, 0xb140e757
jmp 0xef8457a
leave
stc
mov ch, 0x6a
and esp, dword gs:[ebp + 0x448a0f0f]
ret 0xec76
loope 0x554316
rol dword [eax - 0x69], 1
inc ebp
dec esp
loope 0x55431e
cmpsd dword [esi], dword es:[edi]
je 0x55436e
xor bh, byte [ebx + 0x412379bd]
jne 0x55432c
ror dword [eax - 0x40], 1
pop ebx
jmp 0x5543c5
sub eax, 0x95fc0065
pop ebx
mov eax, dword [0x5d4423c9]
lodsd eax, dword [esi]
xor bl, byte [ebp + 0x2373f7a3]
xor ah, dh
test al, 0x6e
inc edx
jnp 0x5543e0
inc esi
scasb al, byte es:[edi]
and al, 0xff
mov ch, 0xa9
and ch, byte [eax - 6]
pop ds
invalid

Function at 0x57b588
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [esi], byte es:[edi]
push edx
aas
scasd eax, dword es:[edi]
xchg ebx, eax
insb byte es:[edi], dx
add ah, byte [ecx]
xchg edx, eax
aam 0xc3
and dh, dl
cwde
imul esp, dword [esi], 0xffffffb2
sub al, 0x91
imul esi, dword [ebx], 0xa362d36d
mov dword [0xdcfa1d96], eax
ror dl, 0x76
invalid
mov dword [0xdcfa1d96], eax
ror dl, 0x76
sub al, 0xe4
rcr byte [esi + 0x19], cl
jne 0x57b59d
in al, 0xd2
pop esi
sbb dword [ebp + 6], esi
neg byte [ebx]
mov eax, dword [0xf36c36bd]
pushal
pushal
xor byte [edi + 0x47], 0x19
mov ah, 0x36
inc ebx
les esp, [esi - 0x28]
inc ecx
mul byte [eax - 0x2f]
rcr dword [ecx + esi*2], 0x98
push cs
pop ss
dec ebx
out dx, eax
mov dword [0x9fba9a9d], eax
mov bl, 0xc0
loopne 0x57b570
cmp dl, cl
les ebp, [edi - 0x35cad0ac]
adc ch, dh
inc esi
shr dword [esi - 0x2929933a], cl
pop esi
movsb byte es:[edi], byte [esi]
and al, byte [esi + ebx]
and al, 0x41
invalid
Function at 0x591b28
Capabilities:
Encode data using xor

Disassembly:
inc edx
imul ecx, dword [esp + ebx*8 + 0x5d22294], 2
or eax, 0xe41bbdbe
les eax, ss:[ecx]
shr bh, 1
out dx, eax
mov eax, dword [0xe280bb6b]
xor esp, dword [eax - 0x7bed8979]
xor ah, 0xa1
add byte [edi], 0x9e
sal byte [ebp + ecx*8 - 0x85ebe2e], 1
inc ecx
and bh, bh
jp 0x591b3a
adc al, byte [edx - 0x2c]
int3

Function at 0x60e4f8
Capabilities:
Encode data using xor

Disassembly:
rcr byte [eax + 0x70], 0xa6
or eax, 0xc806f90
idiv byte [ecx - 0x514a1cb5]
jmp 0x60e536
daa
mov al, 0x87
and edx, ecx
adc al, byte [ebp + 0x40]
cmp byte [eax + 0x4f73ec3d], bl
out dx, al
add edi, ebx
loope 0x60e5bc
clc
lock adc byte [edi + 0x4a], ah
mov byte [0xddad0e94], bh
dec ecx
movsb byte es:[edi], byte [esi]
mov dword [ecx - 0x5602b72f], esp
insd dword es:[edi], dx
pop edi
adc cl, bh
dec edx
mov dh, 0xef
mov ebp, 0x4b22a834
mov esi, 0x9befe2d7
cmc
pop edi
rol ecx, cl
outsb dx, byte [esi]
adc bh, byte [ebp - 0x58]
cld
or byte [eax], ch
mov dword [edi], edx
arpl word [edi + 0x710f1b0], dx
adc al, 0x2c
shr cl, 0x13
mov dh, 0xbe
cmp dword [eax - 0x77], eax
out dx, eax
mov edi, 0x2549669
push ebp
pop esi
mov esp, 0x4efc78f3
int1
sub dword [ecx - 0x1710bb27], esp
push esp
lodsd eax, dword [esi]
xchg byte [esi + edx + 0x5cfe0a11], dh
int1
pop esp
invalid
invalid

Function at 0x624b18
Capabilities:
Encode data using xor

Disassembly:
push eax
stc
jmp [eax]
stc
jb 0x624b59
inc ebp
fimul word [ebx]
out 0x4c, eax
pop esp
push esi
ror byte [esi - 0xf048dfb], 0xa0
jl 0x624ad3
sti
invalid
or bh, byte [eax]
push es
test eax, 0x1ed3547b
shr edx, cl
sahf
aad 0xf1
jmp 0x624b8b
test dword [ebx - 0x19], 0xe038e479
dec ebx
out 0x79, eax
in al, 0x38
loopne 0x624b79
sbb ah, bl
sbb al, byte [ecx + 0x4e]
fcomp qword [edx]
inc ecx
dec esi
inc esi
sahf
invalid
dec ebp
jbe 0x624be0
push esp
ret
popal
mov ecx, 0xad30b85c
popfd
xor byte [ecx - 0x13de36e9], al
jns 0x624b26
push ss
pushfd
insb byte es:[edi], dx
dec edi
push edi
insd dword es:[edi], dx
push ebx
jg 0x624b5a
pop ecx
ror byte [ebx + esi*8 - 0x39875e26], 0xa
jae 0x624bcf
js 0x624b60
or dh, byte [ebx + 0x32]
xchg ecx, eax
jle 0x624b72
pop eax
retf 0x428e
mov eax, 0xd85920a9
leave
invalid
leave
inc eax
stc
add cl, byte [ecx - 0x489c0159]
pop ebx
pop eax
jge 0x624c42
xor ebx, dword [esi - 0x2b403c9e]
sbb eax, 0x30430d7a
push es
jns 0x624bed
cwde
sub ebx, dword [ebx + 0x65]
adc dword [ebp + 0x6db182a9], ebx
jmp 0x624b98
xchg dword [ecx + 6], ecx
pop edx
in al, 0x7c
or dword [esi + 0x6c14299f], eax
invalid
lea ebp, [ecx - 0x7f129701]
test eax, 0x8d4ca7df
pop esi
sbb byte [edi + 0x46], ah
test dword [ecx - 0x32], esp
insb byte es:[edi], dx
aad 0x7f
test al, 0x6c
pop edi
test al, 0x71
sahf
lodsb al, byte [esi]
salc
jno 0x624c2d
cmp cl, byte [ecx + 0x62]
clc
popal
xor dword [ecx], ebx
or al, 0xfd
jp 0x624ce6
xor al, 0x5d
push esi
mov ecx, 0x7a0a129b
std
push ds
xchg dword [eax - 0x47], ebx
enter 0x25aa, 0xffffffffffffffb0
retf
cmp dword [edx - 0x78], esp
iretd
Function at 0x64d15d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x654338
cmp edx, dword [eax]
je 0x64d17f
add eax, 8
inc ecx
cmp eax, 0x6543c8
jl 0x64d170
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x654338]
jne 0x64d2ad
mov eax, dword [0xa57c90]
cmp eax, 1
je 0x64d287
test eax, eax
jne 0x64d1b0
cmp dword [0x654264], 1
je 0x64d287
cmp edx, 0xfc
je 0x64d2ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d1e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064db40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064dfd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d22a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064dfd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x6526d4
push edi
call fcn.0064fea0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064db40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064db50
lea eax, [ebp - 0xa0]
push 0x6526b4
push eax
call fcn.0064db50
push dword [esi + 0x65433c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064db50
push 0x12010
lea eax, [ebp + 8]
lea esi, [esi + 0x65433c]
push 0
push eax
push dword [esi]
call fcn.0064dfd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x10001380
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.10001a70
test esi, esi
jne 0x100013b6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.10001b34
jmp 0x100013d4
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.10001294
mov edi, eax
test esi, esi
je 0x100013d4
cmp dword [ebx], 0
je 0x100013d4
dec esi
jmp 0x100013bd
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x10003de4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor esi, esi
mov edi, 0x12
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea eax, [esi + 1]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
xor ebx, ebx
mov bl, byte [eax + edx]
shl ebx, 0x10
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi]
shl eax, 0x18
add ebx, eax
lea eax, [esi + 2]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
shl eax, 8
add ebx, eax
lea eax, [esi + 3]
xor edx, edx
div dword [ebp - 8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + edx]
add ebx, eax
xor dword [ecx], ebx
lea eax, [esi + 4]
xor edx, edx
div dword [ebp - 8]
mov esi, edx
add ecx, 4
dec edi
jne 0x10003e03
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edi, edi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.10003a24
pop ecx
mov eax, edi
add eax, eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [edx + eax*4 - 0x1048], ecx
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov dword [edx + eax*4 - 0x1044], ecx
inc edi
cmp edi, 9
jne 0x10003e65
mov edi, 4
mov eax, dword [ebp + 8]
lea ebx, [eax - 0x1000]
xor esi, esi
mov eax, dword [ebp + 8]
push eax
push 1
mov eax, dword [ebp + 8]
lea ecx, [eax - 0x1048]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xc]
call fcn.10003a24
pop ecx
mov eax, esi
add eax, eax
mov edx, dword [ebp - 0xc]
mov dword [ebx + eax*4], edx
mov edx, dword [ebp - 0x10]
mov dword [ebx + eax*4 + 4], edx
inc esi
cmp esi, 0x80
jne 0x10003eb4
add ebx, 0x400
dec edi
jne 0x10003eb2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret