joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4550e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4551e3
sub esp, 0x28
mov eax, dword [esp + 0x2c]
mov dword [eax + 0xe8], 0
mov dword [eax + 0xec], 0
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0x18]
mov ecx, dword [ecx + 0x58]
mov dword [eax + 0xf0], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp], ecx
call fcn.00455810
mov eax, dword [esp + 4]
mov dword [esp + 0x14], eax
lea ecx, [0x4a14e0]
mov dword [esp], ecx
call fcn.0040b970
mov eax, dword [esp + 4]
mov dword [eax], 0xffffffff
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [eax + 4], ecx
lea ecx, [0x557c3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call fcn.004549f0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ecx, dword [esp + 0x2c]
mov edx, dword [ecx + 0x50]
mov ecx, dword [ecx + 0x54]
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
mov byte [esp], 0xd
mov dword [esp + 4], 2
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], 2
call fcn.00453e40
add esp, 0x28
ret
call fcn.00461530
jmp fcn.004550e0

Function at 0x4583e0
Capabilities:
Access peb ldr_data

Disassembly:
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45847b
sub esp, 0x30
lea ecx, [esp + 0x34]
mov dword [esp + 4], ecx
mov edx, dword [0x573670]
mov edx, dword fs:[edx]
mov edx, dword [edx]
mov dword [esp + 8], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00462ad7
lea ecx, [0x458490]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
lea ecx, [esp + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00461440
mov ecx, dword [esp + 8]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00461530
jmp fcn.004583e0
Function at 0x45f2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45f430
sub esp, 0x1c
mov eax, dword [esp + 0x20]
test byte [eax], al
lea ecx, [eax + 0x18]
mov dword [esp + 0x18], ecx
nop
mov dword [esp], ecx
call fcn.004097d0
mov eax, dword [esp + 0x20]
movzx ecx, byte [eax + 0x1c]
test cl, cl
jne 0x45f419
mov byte [eax + 0x1c], 1
inc dword [eax + 0x24]
inc dword [eax + 0x60]
mov dword [esp], eax
call fcn.004310f0
mov eax, dword [esp + 0x20]
mov dword [esp], eax
mov dword [esp + 4], 0x72
mov byte [esp + 8], 0
call fcn.004317d0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x20]
mov dword [esp], ecx
mov dword [esp + 4], 0x77
mov byte [esp + 8], 0
call fcn.004317d0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], edx
test ecx, ecx
je 0x45f3a0
lea ecx, [eax + 0x28]
mov dword [esp], ecx
call fcn.00451ae0
mov eax, dword [0x573760]
test eax, eax
jne 0x45f387
mov eax, dword [esp + 0x20]
jmp 0x45f395
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
call fcn.00462930
mov dword [edi], ecx
mov dword [eax + 0x3c], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [eax + 0x78]
test ecx, ecx
je 0x45f3d7
lea ecx, [eax + 0x64]
mov dword [esp], ecx
call fcn.00451ae0
mov eax, dword [0x573760]
test eax, eax
jne 0x45f3c2
mov eax, dword [esp + 0x20]
jmp 0x45f3d0
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x78]
call fcn.00462930
mov dword [edi], ecx
mov dword [eax + 0x78], 0
nop
nop
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.004099d0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x45f3fd
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004315b0
mov eax, dword [esp + 0x10]
test eax, eax
je 0x45f415
mov dword [esp], eax
mov dword [esp + 4], 3
call fcn.004315b0
add esp, 0x1c
ret
lea eax, [0x4bb07c]
mov dword [esp], eax
mov dword [esp + 4], 0x24
call fcn.00436c20
nop
call fcn.00461530
jmp fcn.0045f2d0
Function at 0x4627e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x573840]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x460f6b
je 0x460fbe
cmp ebx, 0x20
jbe 0x460fc4
cmp ebx, 0x40
jbe 0x46100a
jmp 0x4610ab
test ebx, ebx
je 0x460fb4
add eax, 0x10
test ax, 0xff0
je 0x460fa0
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x4d5ea0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x4d5fa0]
jmp 0x460f88
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x460f88
pxor xmm1, xmmword [0x573850]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x573850]
pxor xmm2, xmmword [0x573860]
pxor xmm3, xmmword [0x573870]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x573850]
pxor xmm2, xmmword [0x573860]
pxor xmm3, xmmword [0x573870]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x46110a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x573544], 0
je 0x4627fa
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x460f30
jmp fcn.004081b0
Function at 0x462800
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4031cc
sub esp, 0x10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call fcn.004081b0
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
add esp, 0x10
ret
call fcn.00461530
jmp 0x403190
cmp byte [0x573544], 0
je 0x46281b
mov eax, dword [esp + 4]
mov ebx, dword [eax + 4]
mov eax, dword [eax]
lea edx, [esp + 0xc]
jmp 0x460f30
jmp 0x403190

Function at 0x463670
Capabilities:
Allocate thread local storage

Disassembly:
mov ebp, esp
mov eax, dword [sym.imp.kernel32.dll_TlsAlloc]
call eax
mov esp, ebp
mov ecx, eax
cmp ecx, 0x40
jb 0x46368a
mov ecx, 0x14
jmp 0x463693
shl ecx, 2
add ecx, 0xe10
mov dword [0x573670], ecx
ret
Function at 0x48c080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x573670]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x48c171
sub esp, 0x1c
mov ecx, dword [esp + 0x20]
test byte [ecx], al
mov edx, dword [esp + 0x24]
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x18], ecx
xor eax, eax
jmp 0x48c0bc
mov ebx, dword [esp + 0xc]
inc ebx
mov ecx, dword [esp + 0x18]
mov eax, ebx
cmp eax, 4
jge 0x48c0f5
mov dword [esp + 0xc], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call fcn.00466d70
mov eax, dword [esp + 0x24]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x28]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x48c0b1
mov byte [esp + 0x2c], 1
add esp, 0x1c
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x48c0ff
inc eax
cmp eax, 4
jge 0x48c114
mov dword [esp + 0x14], eax
lea ebx, [ecx + eax*8]
mov ebp, dword [ebx]
mov ebx, dword [ebx + 4]
xor esi, esi
jmp 0x48c16a
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call fcn.00466db0
mov byte [esp + 0x2c], 0
add esp, 0x1c
ret
mov edi, ebp
and edi, 0xff
xor edx, edi
shr ebp, 8
mov edi, ebx
shl edi, 0x18
mov dword [esp + 0x10], edi
mov eax, edx
mov edi, 0x1b3
mul edi
inc esi
mov edi, dword [esp + 0x10]
or ebp, edi
shr ebx, 8
mov edx, eax
mov eax, dword [esp + 0x14]
cmp esi, 8
jl 0x48c13b
jmp 0x48c0fe
call fcn.00461530
jmp fcn.0048c080

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x411292
Capabilities:
Encode data using xor

Disassembly:
aaa
and byte [edi], cl
movsb byte es:[edi], byte [esi]
psrlq mm5, mm2
shr edx, cl
pop edi
xchg esi, eax
add edx, dword [eax + 0x5dbd8346]
inc ebx
outsd dx, dword [esi]
mov ss, word [0xa1495459]
adc dh, byte [esi - 0x741ccb02]
push esp
dec edx
pushfd
mov dword [ebx - 0x69b0e650], ebp
stosd dword es:[edi], eax
xchg esp, eax
xor al, byte [ecx]
jo 0x411297
add byte [edi - 0x1055668c], bh
pop ecx
sub byte [ebx + esi*4 + 0x68], al
out dx, eax
push cs
call 0xeaa3a350
add al, 0x84
and byte [esi], cl
daa
adc al, 0xf
insb byte es:[edi], dx
mov cl, 0x54
sar dword [eax - 0xe], cl
std
sahf
invalid

Function at 0x417e10
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
mov esi, 0x190
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
mov edi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x417ee7
lea ecx, [esp + 0x24]
push ebp
mov ebp, 4
push ecx
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [esp + 0x24], eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call ebx
test eax, eax
jne 0x417e94
mov edi, dword [esp + 0x1c]
xor esi, esi
lea eax, [esp + 0x10]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push str.Browse_For_Folder_Height
push eax
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x28], ebp
call ebx
test eax, eax
pop ebp
jne 0x417ec2
or esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
test eax, eax
je 0x417edc
mov ecx, dword [0x4c7b4c]
push 0x4c783c
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x1c
ret

Function at 0x423305
Capabilities:
Encode data using xor

Disassembly:
cmp dl, ah
ror dword [edi - 0x6cab6a5], 1
pop esp
mov ecx, 0x79c8dbd4
movsb byte es:[edi], byte [esi]
xor dword [esi + 0x52], edi
invalid

Function at 0x4417cd
Capabilities:
Encode data using xor

Disassembly:
add ecx, ebp
and eax, 0x8347871a
pop ebx
invalid
arpl word [ebx - 0x74], bx
out dx, eax
cmp dword [ebx], ecx
cld
and al, al
lea esp, [esp + eax*8]
jl 0x4417a8
in eax, dx
idiv ebp
not dword [esi + 0x45cc9e77]
and byte [ebp + 0x77], bl
cmp eax, 0x5a7e0633
pop ebp
ja 0x441826
xor eax, dword [esi]
jle 0x441847
pop ebx
jo 0x4417e6
sbb dword [ebx - 4], esi
xchg esi, eax
mov dword [0x178bf794], eax
rcl dword [ebx], cl
inc byte [ebx + ebp*4]
adc byte [0xd0b757f4], cl
push 0xffffffffffffff97
ret
popfd
sub eax, 0xb874f6a9
sbb al, byte [edx + 0x13]
mov esi, 0xa54b4dd1
movsd dword es:[edi], dword [esi]
jle 0x44183a
or byte [ebx + 0x4c], ch
hlt
Function at 0x442028
Capabilities:
Encode data using xor

Disassembly:
ret
pop ebx
ret
scasd eax, dword es:[edi]
mov ebx, dword [eax + 0x1c]
push esi
loopne 0x44200f
pushal
mov al, 0x45
push 0x192a098c
test al, 0x3c
jns 0x441fc8
jp 0x4420a7
jae 0x442039
stosb byte es:[edi], al
mov bh, 0xa2
sbb eax, 0x38d86aa1
fdivp st(6)
mov cl, 0x28
insb byte es:[edi], dx
and dword [eax - 0x4b], esi
pop ebp
xchg edi, eax
cmp byte [esi], ah
sbb dword [ebp + edi*8 - 0x73], ebx
xor byte [ecx - 0x69f7ad5c], 0xe7
lcall 0xe761, 0xe89e01be
aad 0xb4
sal byte [0x9cc860ea], 0x59
aam 0x39
fadd dword [ebp + 0x6a]
dec eax
push ebx
mov ah, 0x2f
mov dword [eax], 0x7fc40c3c
in eax, dx
fmulp st(1)
invalid
mov eax, dword [0xde38d86a]
invalid
ja 0x44201e
and byte [esi + 0x6285c40f], bh
mov dl, 0x10
fst dword [ecx - 0x55]
adc cl, bl
push ecx
stosd dword es:[edi], eax
add eax, 0xf75d5448
or bl, byte [esi]
jle 0x442088
invalid
aad 0x93
mov dword [0x8550efc8], eax
test byte [ecx + 0x75], cl
cmc
jo 0x4420ee
loopne 0x4420ed
pop edi
jl 0x4420f0
xor al, 0x54
invalid
sti
mov al, 0xca
leave
jecxz 0x442091
loope 0x442139
fstp xword [0x8f2168b6]
rcr dword [ecx - 0x2326abf3], 0x38
wait
add dword [esi - 0x46528a48], 0x4a
jp 0x4420b9
popfd
jbe 0x442159
mov ch, 0x1b
cdq
in al, dx
aad 0x2e
inc eax
cmc
or eax, 0xf34c79ff
insd dword es:[edi], dx
jns 0x44213e
rep insd dword es:[edi], dx
je 0x44211b
pushal
xchg esi, eax
jge 0x4420fa
mov dh, 0x4f
aad 0xe4
cld
invalid
je 0x4420c3
and ch, byte [ecx - 0x2e]
xchg dword [edi + 0x367b3241], edi
loope 0x442179
test eax, 0x31ea0182
push ss
pushal
sub al, 0xdf
sal dword [ebx + 0xdf169c5], cl
sub ebp, dword [ebx - 0x44e7ae01]
fistp dword [ecx + ecx*8 + 0x3d841a4]
call dword [ecx + 0x18]
mov ebx, 0xa4c99cdb
pushfd
leave
movsb byte es:[edi], byte [esi]
inc ecx
fadd dword [ebx]
mov dl, 0x90
mov dword [eax + 0x78], edi
nop
bound esp, qword [eax + esi + 0x4f187054]
adc dl, byte [esi - 0x3a]
dec ebp
cdq
pop ebp
mov cl, 0xbc
sub byte [ecx + 0x21], 0x6f
mov esp, 0x6f216980
dec esi
xchg edi, eax
invalid
add ebx, dword [edx]
sar dword [edi - 0x545023aa], 1
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
std
jg 0x44213e
pop esi
mov dl, 0xe8
shr byte [eax], 1
push 0xac0d7c7a
insd dword es:[edi], dx
xchg esi, eax
in eax, dx
sub ch, byte [ebp + 0x3c945e8e]
dec esi
lodsb al, byte [esi]
retf 0x3aa6

Function at 0x442516
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ebx - 0x69], ecx
push cs
jbe 0x442590
out 0x59, al
ret
push edx
inc ebp
mov al, 0x44
lodsd eax, dword [esi]
aam 0x17
push edx
or al, 0x24
invalid
Function at 0x4684a5
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc esp
mov dl, 0x9f
imul ecx, dword [edx], 0x2d261c5a
das
jns 0x4684f0
inc ecx
sub al, 0x74
invalid
test ch, ch
pop esi
xchg edx, eax
and eax, 0x710b1ce4
shr byte [ebp + 0x35ee26cc], 0x47
les esp, [esi]
adc al, 0x42
test eax, 0x94eee765
mov esi, 0x6cd52802
adc ah, byte [ecx + 0x64]
sahf
mov dh, 0x21
in al, 0x6e
in al, dx
inc ecx
enter 0x229, 0xe
and byte [edi - 0xb], bh
popal
pop eax
cmp byte [eax - 0x64e1c301], al
dec esi
dec esi
mov dl, 0x45
jnp 0x468520
push ebp
outsb dx, byte [esi]
cmc
push ds
cmc
xchg ebx, eax
lcall 0xdc9, 0x44aecd6d
push edi
cmc
add al, 0xb
out dx, al
loopne 0x4684ba
jmp 0xe781b599
xchg ebp, eax
jns 0x4684b8
or edx, ebx
mov es, word [edx + 0x20]
push es
push ds
pop ss
xor al, 0x73
mov esi, 0x412729bb
fisub word [edi]
cmp esi, dword [ebp + 0x20]
mov ecx, dword [eax]
sbb eax, dword [edi]
popal
invalid

Function at 0x4691cb
Capabilities:
Encode data using xor

Disassembly:
and byte [ecx], al
dec edi
cli
stosb byte es:[edi], al
sbb ch, byte [esi + 0x1f40e944]
or al, 0x54
dec edx
mov esp, 0x1589146b
dec eax
popal
mov esi, 0x3fc8d86a
invalid

Function at 0x4bb8c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4408
cmp edx, dword [eax]
je 0x4bb8e3
add eax, 8
inc ecx
cmp eax, 0x4c4498
jl 0x4bb8d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4408]
jne 0x4bba11
mov eax, dword [0x4c8d8c]
cmp eax, 1
je 0x4bb9eb
test eax, eax
jne 0x4bb914
cmp dword [0x4c4330], 1
je 0x4bb9eb
cmp edx, 0xfc
je 0x4bba11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb94b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc2a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc730
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb98e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc730
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0b64
push edi
call fcn.004be600
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc2a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc2b0
lea eax, [ebp - 0xa0]
push 0x4c0b44
push eax
call fcn.004bc2b0
push dword [esi + 0x4c440c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc2b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be574
add esp, 0x2c
pop edi
jmp 0x4bba11
lea eax, [ebp + 8]
lea esi, [esi + 0x4c440c]
push 0
push eax
push dword [esi]
call fcn.004bc730
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10007082
pop dword [ebp - 0x4c]
mov eax, 0x10007082
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x3812d
push 0
mov eax, 0x6390e172
sub eax, 0x538fa10e
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0x20a279ef
sub ecx, 0x20a235c2
mov edi, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x4c]
mov edx, 0xe426495f
add edx, 0xe6bc4cd0
add dword [ebp - 0x14], 0xa5c6ddd4
mov esi, dword [ebx]
add dword [ebp - 8], 0x16b08ebf
xor esi, edx
mov dword [edi], esi
sub dword [ebp - 0x38], 0xa2c39afa
add edi, 4
add ebx, 4
loop 0x100070d6
add eax, 0xba080a66
add eax, 0x45f8f921
mov ebx, eax
add eax, 5
mov ecx, 0x4b71aafb
add ecx, 0xc48e5505
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x401e50
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x401e9b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401e94
test esi, esi
je 0x401e94
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401e70
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402080
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4020d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x4021a8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40210e
cmp eax, 4
jne 0x402130
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40211e
cmp edx, 4
je 0x40211e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402080