joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416aa0
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x416cae
sub esp, 0x18
mov eax, dword [0x94b480]
test eax, eax
jne 0x416c97
nop
nop
lea eax, [0x94b470]
mov dword [esp], eax
call fcn.0040a0c0
mov eax, dword [0x94b474]
test eax, eax
je 0x416ae8
cmp dword [eax + 8], 0xcc
jne 0x416b5e
mov edx, dword [0x94b478]
test edx, edx
jne 0x416b40
mov dword [esp], 0x1000
mov dword [esp + 4], 0
lea eax, [0x951f10]
mov dword [esp + 8], eax
call fcn.0040c5b0
mov eax, dword [esp + 0xc]
mov dword [0x94b478], eax
mov ecx, dword [0x94b47c]
mov dword [eax], ecx
mov eax, dword [0x94b478]
mov dword [0x94b47c], eax
movzx eax, byte [0x94bb80]
test al, al
jne 0x416b40
xor eax, eax
jmp 0x416c68
mov edx, dword [0x94b478]
mov ebx, dword [edx + 4]
mov dword [0x94b478], ebx
mov ebx, dword [0x94b474]
mov dword [edx + 4], ebx
mov dword [0x94b474], edx
mov edx, dword [0x94b474]
mov eax, dword [edx + 8]
cmp eax, 0xcc
jae 0x416c47
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
lea eax, [edx + 8]
mov dword [esp], eax
mov dword [esp + 4], 1
call fcn.00402c70
mov eax, dword [0x94b7e0]
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + ecx*4]
test eax, eax
jne 0x416ba8
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
jmp 0x416bbe
call fcn.00467ef0
mov eax, dword [esp + 0x20]
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov ebx, dword [edx + ecx*4 + 0x10]
mov dword [edi + 4], ebx
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [edx + ecx*4 + 0x18], eax
mov eax, dword [0x94b7e0]
test eax, eax
jne 0x416be2
mov eax, dword [esp + 0x28]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x1c]
jmp 0x416c10
call fcn.00467f30
mov eax, dword [esp + 0x28]
mov dword [edi], eax
mov ebx, dword [edx + ecx*4 + 0x1c]
mov dword [edi + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [edi + 8], ebx
mov ebp, dword [edx + ecx*4 + 0x20]
mov dword [edi + 0xc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [edi + 0x10], ebp
mov esi, dword [edx + ecx*4 + 0x14]
mov dword [edi + 0x14], esi
mov dword [edx + ecx*4 + 0x1c], eax
mov dword [edx + ecx*4 + 0x20], ebx
mov dword [edx + ecx*4 + 0x14], ebp
nop
nop
lea eax, [0x94b470]
mov dword [esp], eax
call fcn.0040a2c0
nop
lea eax, [0x94b46c]
mov dword [esp], eax
mov dword [esp + 4], 8
call fcn.00402df0
add esp, 0x18
ret
mov ecx, 0xcc
call fcn.00467f50
lea edx, [0x8e9b84]
movzx ebx, byte [edx + eax]
lea ebp, [0x94bb80]
mov byte [ebp + ecx], bl
lea eax, [ecx + 1]
cmp eax, 0x80
jge 0x416b40
mov ecx, eax
mov eax, 0xcccccccd
imul ecx
add edx, ecx
sar edx, 2
lea edx, [edx + edx*4]
mov eax, ecx
sub eax, edx
cmp eax, 5
jb 0x416c51
mov ecx, 5
call fcn.00467f40
lea eax, [0x68a9c1]
mov dword [esp], eax
mov dword [esp + 4], 0x18
call fcn.00438990
nop
call fcn.00466ae0
jmp fcn.00416aa0
Function at 0x424780
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x424883
sub esp, 0x1c
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x42487d
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00424bd0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x10], ax
mov word [esp + 0x12], cx
mov dword [esp + 0x14], edx
mov byte [esp + 0x18], bl
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x10]
mov dword [esp], edx
mov edx, dword [esp + 0x28]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00424cb0
movzx eax, byte [esp + 0x18]
test al, 2
je 0x424831
cmp word [esp + 0x10], 0x1f0
jbe 0x424831
and eax, 0xfffffffd
nop
mov byte [esp + 0x18], al
mov edx, dword [esp + 0x20]
movzx ebx, byte [edx + 0x30]
test bl, bl
jne 0x424835
mov ebx, dword [esp + 0x28]
cmp ebx, 0x200
jae 0x424835
nop
jmp 0x424835
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x24]
cmp eax, ecx
jae 0x424878
mov ecx, dword [edx]
lea eax, [ecx + eax*8]
movzx ecx, word [esp + 0x10]
movzx edx, word [esp + 0x12]
mov ebx, dword [esp + 0x14]
movzx ebp, byte [esp + 0x18]
mov dword [esp], eax
mov word [esp + 4], cx
mov word [esp + 6], dx
mov dword [esp + 8], ebx
xchg ebp, eax
mov byte [esp + 0xc], al
xchg ebp, eax
call fcn.00424c40
add esp, 0x1c
ret
call fcn.00467f50
call fcn.00467f50
nop
call fcn.00466ae0
jmp fcn.00424780
Function at 0x424890
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4249c4
sub esp, 0x20
mov edx, dword [esp + 0x24]
mov ecx, dword [edx + 4]
mov eax, dword [esp + 0x28]
cmp eax, ecx
jae 0x4249be
mov ecx, dword [edx]
lea ecx, [ecx + eax*8]
mov dword [esp], ecx
call fcn.00424bd0
movzx eax, word [esp + 4]
movzx ecx, word [esp + 6]
mov edx, dword [esp + 8]
movzx ebx, byte [esp + 0xc]
mov word [esp + 0x14], ax
mov word [esp + 0x16], cx
mov dword [esp + 0x18], edx
mov byte [esp + 0x1c], bl
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x2c]
lea edx, [esp + 0x14]
mov dword [esp], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
call fcn.00424da0
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
mov edx, dword [esp + 0x28]
cmp edx, ecx
jae 0x4249b7
mov ecx, dword [eax]
lea ecx, [ecx + edx*8]
movzx ebx, word [esp + 0x14]
movzx ebp, word [esp + 0x16]
mov esi, dword [esp + 0x18]
movzx edi, byte [esp + 0x1c]
mov dword [esp], ecx
mov word [esp + 4], bx
mov word [esp + 6], bp
mov dword [esp + 8], esi
xchg edi, eax
mov byte [esp + 0xc], al
xchg edi, eax
call fcn.00424c40
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
lea eax, [ecx + eax - 1]
shl eax, 0xd
mov ecx, dword [esp + 0x28]
shl ecx, 0x16
add eax, ecx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x24]
cmp dword [ecx + 0x28], eax
jae 0x42497a
mov dword [ecx + 0x28], eax
lea eax, [ecx + 0x20]
mov dword [esp], eax
call fcn.00431160
mov eax, dword [esp + 0x10]
cmp dword [esp + 4], eax
jae 0x4249b3
mov ecx, dword [esp + 0x24]
add ecx, 0x20
nop
mov dword [esp], ecx
xor ecx, ecx
sub ecx, eax
mov eax, 0
sbb eax, 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
call fcn.00402bb0
add esp, 0x20
ret
mov eax, edx
call fcn.00467f50
call fcn.00467f50
nop
call fcn.00466ae0
jmp fcn.00424890
Function at 0x42aa00
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x42ab70
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 2
ja 0x42ab00
cmp cl, 1
je 0x42aa92
cmp cl, 2
jne 0x42ab59
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042ff70
nop
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a0c0
mov eax, dword [0x92fa04]
sub eax, dword [0x92f9e8]
nop
mov dword [0x92fa04], eax
mov eax, dword [0x92f9f4]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x92f9f4], ecx
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a2c0
jmp 0x42ab55
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.00416aa0
nop
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a0c0
mov eax, dword [0x92f9dc]
sub eax, dword [0x92f9c0]
nop
mov dword [0x92f9dc], eax
mov eax, dword [0x92f9cc]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x92f9cc], ecx
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a2c0
jmp 0x42ab55
cmp cl, 3
jne 0x42ab0b
mov byte [eax + 8], 1
jmp 0x42ab55
cmp cl, 4
jne 0x42ab59
nop
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a0c0
mov eax, dword [0x92fa54]
sub eax, dword [0x92fa38]
nop
mov dword [0x92fa54], eax
mov eax, dword [0x92fa44]
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov dword [0x92fa44], ecx
nop
nop
lea eax, [0x92fa60]
mov dword [esp], eax
call fcn.0040a2c0
add esp, 0x14
ret
lea eax, [0x686391]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.00438990
nop
call fcn.00466ae0
jmp fcn.0042aa00
Function at 0x455020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45519a
sub esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
jbe 0x455190
mov edx, dword [esp + 0x14]
movzx ebx, byte [edx]
test ebx, ebx
jne 0x45507a
movzx ebp, byte [esp + 0x28]
xchg ebp, eax
test al, al
xchg ebp, eax
jne 0x45507a
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov byte [esp + 0x38], 0
add esp, 0x10
ret
test ebx, 0x80
je 0x45508d
xor eax, eax
xor ebx, ebx
xor ebp, ebp
jmp 0x455167
mov eax, 1
mov ebp, ebx
and ebx, 1
neg ebx
shr ebp, 1
xor ebx, ebp
mov ebp, dword [esp + 0x24]
add dword [ebp], ebx
cmp ecx, eax
jb 0x45515b
sub ecx, eax
mov ebx, dword [esp + 0x1c]
sub ebx, eax
mov ebp, ebx
neg ebx
sar ebx, 0x1f
and eax, ebx
lea ebx, [edx + eax]
test ecx, ecx
jbe 0x455152
movzx edx, byte [edx + eax]
test edx, 0x80
je 0x4550e0
mov dword [esp + 0xc], ecx
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x455123
mov eax, 1
cmp eax, ecx
ja 0x455117
mov esi, dword [esp + 0x20]
add dword [esi], edx
sub ebp, eax
sub ecx, eax
mov edx, ebp
xchg ebp, ebx
neg ebx
xchg ebp, ebx
sar ebp, 0x1f
and eax, ebp
add eax, ebx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
mov byte [esp + 0x38], 1
add esp, 0x10
ret
call fcn.00467fb0
lea esi, [ecx + 7]
mov ecx, dword [esp + 0xc]
cmp eax, ecx
jae 0x45514d
movzx edi, byte [eax + ebx]
xchg edi, eax
mov byte [esp + 0xb], al
xchg edi, eax
and edi, 0x7f
mov ecx, esi
shl edi, cl
inc eax
or edx, edi
movzx edi, byte [esp + 0xb]
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x45511c
mov ecx, dword [esp + 0xc]
jmp 0x4550e5
call fcn.00467f50
xor eax, eax
mov ecx, eax
call fcn.00467f40
call fcn.00467fb0
lea ebp, [ecx + 7]
mov ecx, dword [esp + 0x18]
cmp ecx, eax
jbe 0x45518b
movzx esi, byte [eax + edx]
mov edi, esi
and esi, 0x7f
mov ecx, ebp
shl esi, cl
inc eax
or ebx, esi
xchg edi, eax
test al, 0x80
xchg edi, eax
jne 0x455160
mov ecx, dword [esp + 0x18]
jmp 0x455092
call fcn.00467f50
xor eax, eax
mov ecx, eax
call fcn.00467f40
nop
call fcn.00466ae0
jmp fcn.00455020

Function at 0x45c950
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x94b584]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45c9eb
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x94b584]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00468167
lea ecx, [0x45ca00]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.004669f0
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00466ae0
jmp fcn.0045c950
Function at 0x467d90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x94b9e0]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x46651b
je 0x46656e
cmp ebx, 0x20
jbe 0x466574
cmp ebx, 0x40
jbe 0x4665ba
jmp 0x46665b
test ebx, ebx
je 0x466564
add eax, 0x10
test ax, 0xff0
je 0x466550
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x6deb20]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x6dec20]
jmp 0x466538
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x466538
pxor xmm1, xmmword [0x94b9f0]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x94b9f0]
pxor xmm2, xmmword [0x94ba00]
pxor xmm3, xmmword [0x94ba10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x94b9f0]
pxor xmm2, xmmword [0x94ba00]
pxor xmm3, xmmword [0x94ba10]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x4666ba
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x94b428], 0
je 0x467daa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4664e0
jmp fcn.00408880
Function at 0x40d999
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
stc
sbb al, 0xf0
retf 0x811d
pushal
inc ebx
and eax, 0xbecab734
mov esi, 0xec7b3023
mov esi, 0xec7b3023
wait
scasd eax, dword es:[edi]
inc ecx
xor esp, dword [ecx - 0x20]
pushal
mov al, byte [edx]
cmp dword [0x161a1c5], eax
jne 0x40d993
jo 0x40d9b4
mov al, 0x76
push ebx
push ss
inc esi
and al, byte [0xc7c863e]
pop esi
invalid

Function at 0x43b659
Capabilities:
Encode data using xor

Disassembly:
invalid
out 5, eax
and dword [ebp + ecx*8 - 0x5e9d7fa3], 0xffffffe9
jmp 0xed8302a7
or byte [edi + edi - 0x13], 0x3f
je 0x43b5c1
out dx, al
xchg ebx, eax
inc ebp
test al, 0xe3
cmp dl, byte [edx + 0x6c]
cmp dword [edi], 0x6ce2bdc2
sbb eax, 0x10ad2fb5
xchg esp, eax
jg 0x43b622
mov byte [0x37888225], bl
pop ebx
jns 0x43b6b9
popfd
call 0x1edc05ed
cwde
push ds
or eax, 0xd52de426
pop edx
xor eax, 0x88e0ed47
loopne 0x43b5e3
xor byte [ebx - 0x14], al
fldenv [edx + 0x71]
popfd
xchg ecx, eax
mov esp, 0x95c64e9
adc al, 0xfa
dec eax
and al, 0x23
pushfd
cmpsd dword [esi], dword es:[edi]
mov al, 0xeb
rcr byte [ecx + 0x5606d00], cl
mov ebx, 0xe059f2ac
jge 0x43b64e
cmp ebp, ebx
push eax
pop esp
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
xor byte [eax + 0x51], ah
loopne 0x43b6f6
invalid
invalid
insd dword es:[edi], dx
iretd
pushal
mov al, 0xc1
pop ds
add cl, ah
mov bl, 0x10
dec ebp
inc ecx
sub eax, 0xf4bf798e
mov esi, 0x162d9e9f
leave
adc dword [eax + 0x31], ebx
insd dword es:[edi], dx
in al, 0x68
scasb al, byte es:[edi]
or ah, bh
in eax, 0x68
sbb cl, dl
jp 0x43b71e
sar edi, cl
mov edx, 0xe4ee7812
nop
js 0x43b70e
in al, 0x90
or byte [esi - 0x4f3d4e10], cl
jge 0x43b6ea
inc esi
cmp byte [edx - 0x32], bh
and esi, dword [ecx - 0x6f368084]
push ecx
push 0x62ccfd7e
lahf
insd dword es:[edi], dx
insd dword es:[edi], dx
sahf
lahf
jmp 0xc9b63496

Function at 0x4541c3
Capabilities:
Encode data using xor

Disassembly:
jmp 0x17c3df86
jmp 0x4541ca
loopne 0x4541b0
lodsb al, byte [esi]
ja 0x454187
in al, dx
leave
mov byte [eax], bl
pushal
dec edx
or dword [0xe87cce9a], ebp
std
out dx, eax
aaa
jno 0x454213
dec edi
movsb byte es:[edi], byte [esi]
dec ecx
push ebp
std
sub dword [eax - 0x34b63504], ecx
inc eax
invalid
pushal
push 0x98829540
pop es
xchg esi, eax
hlt

Function at 0x46c2d2
Capabilities:
Encode data using xor

Disassembly:
fiadd dword [esi + 0x2f40b2fd]
mov ebx, 0x63915c80
arpl sp, bx
lea ebp, [edi - 0x311e6f44]
arpl sp, bx
lea ebp, [edi - 0x311e6f44]
xchg edx, eax
xor byte [esi + esi*4 - 0x5d], al
call 0x80f5ae60
rcr ecx, 0xdd
adc byte [ebx], 0x9f
shr byte [ecx - 0x69], cl
fucompi st(1)
outsb dx, byte [esi]
inc edx
dec eax
pmaxsw mm4, qword [esi + ebx + 0x46]
jg 0x46c2c8
dec esi
invalid
Function at 0x48578d
Capabilities:
Encode data using xor

Disassembly:
ret
and al, 0xb0
push 0x2326e22b
inc esi
mov ds, ecx
inc edi
arpl word [eax - 0x1830f86d], bx
xrstors [ebp - 0x4a]
pop ss
test ebx, ebx
or dword [eax + 0x70a1ab8f], 0x7c
cwde
sbb al, 0xbf
cmp dword [ecx + 7], ebp
mov ebx, 0xe921c212
fsubr qword [edi]
push 0xa4c5a5cb
das
into
invalid
and eax, dword es:[esi - 0x72]
fld dword [edi + 0x63]
cwde
xchg ebx, eax
pop es
iretd
cmp cl, 0x5f
loope 0x485702
push ss
salc
pop ebp
push edi
sub dl, bl
xchg ecx, ecx
jmp 0xe247f910
loope 0x485715
push edi
scasd eax, dword es:[edi]
add dword [ebx + 0xccefa09], ecx
jbe 0x485751
mov ah, 0xb6
inc esi
push edx
dec esp
sbb dword [ebx - 0x26], 0x7acbfcc3
push es
push cs
jg 0x485710
leave
std
invalid
lds ebp, [ebp - 0xa]
sal byte [esi + 0x1a284fc8], 1
rcl dword [eax + 0x47], cl
push eax
inc edi
push eax
inc edi
cmp bh, 0x14
mov eax, dword [0xbaa825c4]
add byte [eax], ch
pop esi
jb 0x48571d
mov esp, dword [ecx - 0x551e85e8]
jp 0x485782
stosb byte es:[edi], al
push 0x8a112e5f
salc
xchg edi, eax
loope 0x4857f3
out dx, eax
mov word [ebp - 0x61], gs
stc
mov bh, 0x60
xor dword [eax], 0xe76da5ce
and al, 0x41
fldenv [edx]
add edx, ecx
inc ebp
mov dh, 0xd
outsb dx, byte [esi]
push cs
outsb dx, byte [esi]
mov cl, 0xac
out dx, al
sti
jecxz 0x48579f
mov ah, 0xef
jp 0x485820
fdivp st(6)
pop ebx
dec esp
jo 0x485835
jecxz 0x485762
push edi
xor ebx, dword [edi]
xlatb
cmpsb byte [esi], byte es:[edi]
sbb al, 0x92
mov edi, 0x2b7bf718
into
mov byte [0xded98dc7], al
push ss
ljmp 0xd00b
or eax, ecx
scasb al, byte es:[edi]
test al, 0x44
mov ch, 0xf
ret 0x7772
and ebx, dword [ebp + esi - 0x2b]
popal
pop edi
dec esi
das
xchg ebp, eax
inc esp
adc al, 0xf7
xor byte [edx - 0x33], dh
inc ebx
mov byte [0xb4a5ddfc], al
mov byte [0xb4a5ddfc], al
add al, byte [ebp - 5]
pop edi
cmp eax, 0x4b7025b4
adc dword [ebx + edx - 0x6d], esi
sti
xchg esi, eax
adc esi, dword [ecx - 0x28]
jno 0x48580f
dec edx
add dword [esi + 0x432161e9], ecx
invalid
Function at 0x629cf5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323e0
cmp edx, dword [eax]
je 0x629d17
add eax, 8
inc ecx
cmp eax, 0x632470
jl 0x629d08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323e0]
jne 0x629e45
mov eax, dword [0x63bd88]
cmp eax, 1
je 0x629e1f
test eax, eax
jne 0x629d48
cmp dword [0x632308], 1
je 0x629e1f
cmp edx, 0xfc
je 0x629e45
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629d7f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062a6e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062ab70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629dc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062ab70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea4c
push edi
call fcn.0062ca40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062a6e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a6f0
lea eax, [ebp - 0xa0]
push 0x62ea2c
push eax
call fcn.0062a6f0
push dword [esi + 0x6323e4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a6f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c9b4
add esp, 0x2c
pop edi
jmp 0x629e45
lea eax, [ebp + 8]
lea esi, [esi + 0x6323e4]
push 0
push eax
push dword [esi]
call fcn.0062ab70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x404110
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x18c8
call fcn.00411990
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [0x498678]
push ebx
push esi
mov dword [ebp - 8], ecx
mov ecx, dword [0x49867c]
mov dword [ebp - 0x18], eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], ecx
call fcn.00404100
mov ebx, dword [ebp - 0xc]
mov edx, dword [0x498680]
mov eax, dword [0x498684]
mov edi, dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
add ebx, 0x23f
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], 0x20
jmp 0x404180
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov esi, dword [ebp - 8]
mov eax, dword [0x49fe0c]
shl esi, 4
add esi, dword [ebp - 0x20]
cmp eax, 0xfa9
jne 0x4041ac
mov dword [0x49fe08], 0xedeb2e40
jmp 0x4041c7
cmp eax, 0x3eb
jne 0x4041c7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x49f898], 0
mov ecx, dword [ebp - 8]
add ecx, ebx
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x49fe0c], 0x9e6
mov dword [0x49fe04], 0xf4ea3dee
jne 0x4041ff
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x49fe0c], 0x213
jne 0x40429b
push 0
lea eax, [ebp - 0xcc8]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
lea ecx, [ebp - 0x4c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x34]
push edx
lea eax, [ebp - 0x10c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call edi
push 0
push 0
lea ecx, [ebp - 0x18c8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call edi
lea edx, [ebp - 0x2c]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 4]
cmp dword [0x49fe0c], 0xc
mov dword [ebp - 0x10], esi
jne 0x4042b5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, esi
shr edx, 5
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
mov eax, esi
shl eax, 4
add eax, dword [ebp - 0x18]
lea ecx, [ebx + esi]
xor eax, ecx
xor eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sub dword [ebp - 8], eax
add ebx, 0x61c88647
sub dword [ebp - 0x14], 1
jne 0x404180
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
pop edi
pop esi
mov dword [eax], edx
mov dword [eax + 4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4