joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7a6f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x7bb9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x7a7002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.007aadff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x7a7002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.007a26e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.007ab20b
push 0x10
call fcn.007ab1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x7a6fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.007971c0
jmp 0x7a6fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.007a6b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x7a6ff0
mov ecx, edi
call fcn.007972c0
push edi
call fcn.007ab1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x7a7021
inc ebx
cmp ebx, 0x20
jb 0x7a6f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x7a8250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7bc808
push 0x7ac288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x7a8329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7a8329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.007ab1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x7a8329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x7a8329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x7a832c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.007a8351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7a8d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7a8d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x7a8d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x7a8d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x7a8d94
push eax
push esi
call fcn.007ab20b
add esp, 8
pop esi
ret 0x10

Function at 0x7a8da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7a8e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x7a8e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x7c1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007aadff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x7a8dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x7a8e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7a8ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x7a8eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x7c1320
push ecx
mov dword [esp + 0x1c], 4
call fcn.007aadff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x7a8eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x7a8e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x7a9000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x7a9131
push esi
call fcn.007ac145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0079b080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x7a9131
push 0
push ebp
call fcn.0079b3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0079b260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x7a908b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0079b2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x7a9121
push 0x7c1918
push edi
call fcn.007aa3f0
push eax
push ebx
push esi
call fcn.007a8f60
push 0x7c18f8
push edi
call fcn.007aa3f0
push eax
push ebx
push esi
call fcn.007a8f60
push 0x7c18d8
push edi
call fcn.007aa3f0
push eax
push ebx
push esi
call fcn.007a8f60
push 0x7c18c0
push edi
call fcn.007aa3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.007a8f60
push 0x7c18a0
push edi
call fcn.007aa3f0
push eax
push ebx
push esi
call fcn.007a8f60
push 0x7c1888
push edi
call fcn.007aa3f0
push eax
push ebx
push esi
call fcn.007a8f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7aa1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.007aa140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.007aa140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.007aa140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.007aa140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x7aabfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x7aac50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x7bc87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7aac43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x7aac52
xor eax, eax
pop esi
leave
ret 4
Function at 0x40e26c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4241e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004051e5
and dword [ebp - 0x14], 0
cmp dword [0xe5ac1c], 0
mov dword [ebp - 0x18], eax
jne 0x40e31f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40e3c7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40e3c7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xe5ac1c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xe5ac20], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xe5ac24], eax
call edi
push eax
call esi
mov dword [0xe5ac2c], eax
test eax, eax
je 0x40e31f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xe5ac28], eax
mov eax, dword [0xe5ac28]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40e378
cmp dword [0xe5ac2c], ecx
je 0x40e378
push eax
call esi
push dword [0xe5ac2c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40e378
test ebx, ebx
je 0x40e378
call edi
test eax, eax
je 0x40e36f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40e36f
test byte [ebp - 8], 1
jne 0x40e378
or dword [ebp + 0x10], 0x200000
jmp 0x40e3ab
mov eax, dword [0xe5ac20]
cmp eax, dword [ebp - 0x18]
je 0x40e3ab
push eax
call esi
test eax, eax
je 0x40e3ab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40e3ab
mov eax, dword [0xe5ac24]
cmp eax, dword [ebp - 0x18]
je 0x40e3ab
push eax
call esi
test eax, eax
je 0x40e3ab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xe5ac1c]
call esi
test eax, eax
je 0x40e3c7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40e3c9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004051d6
leave
ret

Function at 0x438cac
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x438a14
add edx, 0xe0dbe8ef
mov eax, 0x5e82a267
call fcn.00438ce5
add eax, 0x8d817b87
xor dword [ebx], esi
mov eax, eax
sub edx, eax
inc ebx
add eax, eax
add edx, edx
cmp ebx, edi
jne fcn.00438cac
dec eax
add eax, 0x931fb61d
inc eax
ret
Function at 0x402b00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f746
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x44d064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x402bac
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x402bac
call fcn.00401ef0
mov edi, eax
jmp 0x402ccb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x402bcf
call fcn.00401ef0
jmp 0x402cbe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x402bed
call fcn.00401ef0
jmp 0x402cbe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x402c0e
mov edi, 0x8007000e
jmp 0x402cc0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x402d04
jb 0x402c2c
cmp eax, 0xffffffff
ja 0x402d04
cmp eax, 0x400
jbe 0x402c41
push eax
lea ecx, [ebp - 0x418]
call fcn.00401d70
jmp 0x402c67
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x402c67
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x402c7e
mov edi, 0x8007000e
jmp 0x402cc0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x402c9e
call fcn.00401ef0
jmp 0x402cbe
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00402960
mov edi, eax
test esi, esi
je 0x402ccb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x402ce4
lea ecx, [ebp - 0x418]
call fcn.00402130
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004052db
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00401f30
int3
Function at 0x42a894
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a06e

Function at 0x42a89f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042a2a9

Function at 0x42b876
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0042b5fd
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x80c77af
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x36dd6285
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40f597
Capabilities:
Encode data using xor

Disassembly:
add ebp, eax
xlatb
cmc
mov bl, 0xe9
sub eax, dword [eax]
invalid

Function at 0x440348
Capabilities:
Encode data using xor

Disassembly:
push edi
xor dh, byte [eax]
cmp eax, 0x32989a3f
xor byte [ebp + 0x57], dl
bound esp, qword [eax + 0x45]
inc edi
in eax, dx
out dx, eax
mov cl, byte [eax - 0x46db7e7d]
mov ecx, 0x760252cd
push ebx
inc esi
adc eax, dword [edi - 0x3d]
out 0x9a, al
ror byte [edx + 0x69], cl
stc
les edi, [ecx - 0x46dd3aa1]
sal dword [ebp + 0x1601c833], 1
or dword [edx], edx
add eax, 0x9e40430a
invalid
and dword [eax + 0x1ef9a67f], eax
jbe 0x440311
stosb byte es:[edi], al
jbe 0x4402db
bound edi, qword [ebx - 0x25cc444a]
popal
jb 0x44038a
and byte [esi + ebx*4 + 0x1d], ah
jge 0x44036b
invalid
mov dh, 0x7f
aad 0x5d
jg 0x440327
dec edx
or dh, byte [ebx + esi*8 + 0x4e]
mov al, 0xa7
sub dl, bl
add ch, cl
invalid
js 0x4403d4
fadd qword [edi + 0x6ee7f633]
loopne 0x4403d9
stc
nop
lahf
loopne 0x440378
adc al, 0x5e
jnp 0x4403d6
or dword [edi - 0x76], ecx
jmp 0x101b72ad
salc
daa
inc edi
sub eax, 0xfd283f84
pop es
push cs
adc byte [edi + 9], bl
retf
xchg edi, eax
add dword ss:[edx - 0x5f], 0xb93f837f
cli
cdq
and edi, dword [ebx + edx + 0x6b6bbb4b]
sub esi, eax
sbb ebp, dword [eax]
pop eax
xchg edx, eax
sub byte [eax - 0x6e], bl
test byte [ebx], 0x7f
jge 0x4403e9
jae 0x440442
inc esi
cmpsb byte [esi], byte es:[edi]
out dx, al
jns 0x4403b3
dec ecx
invalid
jne 0x440448
hlt
imul esi, edi, 0x686d9f7
or byte [esi], ah
cmp bh, dl
add byte [esi - 0x6f], dl
inc eax
push ebx
jbe 0x4403a8
mov esi, 0xd08befce
into
out dx, eax
mov edx, eax
mov cl, cl
invalid
mov ah, 0x13
lea esp, [ebx]
pop ecx
pop eax
xchg esi, eax
add esi, dword [edi + 5]
jle 0x4403bd
inc edx
test eax, 0xa9718786
sub byte [eax - 0x5928f28c], al
or byte [eax - 0x45], ch
mov edi, 0xe5035319
mov ebx, 0x35319bf
in eax, 0x7b
das
jnp 0x440479
dec eax
aas
xchg al, ah
push 0xde5a9f15
mov ecx, 0x58364684
mov byte [0xc6b13bc2], al
mov dh, byte [ebx]
out 0x26, eax
cmp ebx, dword [edx]
pop eax
push cs
wait
mov dh, 0x33
imul ecx, dword [edi + 0x5b], 0x76df860b
mov di, 0x1f56
iretd
mov edi, 0x93660b23
or bl, byte [esi + 0x6fe67ffa]
fimul dword [edx]
xchg byte [edi - 0x46], cl
outsd dx, dword [esi]
cmpsb byte [esi], byte es:[edi]
das
push esi
dec edi
cld
push ebx
mul byte [edx]
jecxz 0x440428
shl edi, cl
dec ebx
xor bh, byte [edi]
mov dword es:[0x3bc69316], eax
pop ss
add esp, dword [esi + 0x3f]
salc
lahf
invalid
Function at 0x44a8d0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc
push ebp
lea eax, [esp + 8]
push esi
push eax
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x44a9c3
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a942
mov edx, dword [0x651d44]
push 0x651a78
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov eax, ebx
or eax, 0x8001
push eax
call edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll__lcreat]
push ebx
mov esi, eax

Function at 0x4a9978
Capabilities:
Encode data using xor

Disassembly:
hlt
dec ebx
ret 0xda2
or esp, eax
push ebx
mov cl, 0x4f
wait
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
jl 0x4a98e6
jecxz 0x4a988f
sbb byte [edx + eax + 0xb], bh
invalid
cdq
invalid
cmp ebx, eax
leave
sub byte [ebx + edx - 0x711e984f], dh
mov ecx, 0x5420e832
push esi
salc
call 0xd6a0ed51
inc edi
mov ah, 0xc7
fistp word [ebx + eax*2]
sub al, 0x3c
wait
xor dword [edi], 0x16
sbb dword [eax - 0x28b9e90f], 0x3a4f9bc
lea ebp, [edx - 0x5422fd6e]
stosd dword es:[edi], eax
out dx, al
rcl dword [eax + 0x41], cl
inc ecx
jg 0x4a9920
pop eax
mov word [ecx], cs
mov dl, 0x2d
insd dword es:[edi], dx
cdq
sub eax, 0x8d914234
adc al, 0x73
loope 0x4a999d
sti
jo 0x4a98f0
jl 0x4a9910
or eax, 0x5eda90a3
pushaw
xchg edi, eax
or al, 9
ret
inc esp
mov ecx, 0x6d9cab86
jge 0x4a992c
dec ecx
cmp al, 0x1a
jb 0x4a994c
dec esp
retf 0xba54
fsub qword [ebx + 0xecfc5c]
jmp 0x7d32760e

Function at 0x4d4779
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x21
xor ecx, esi
scasb al, byte es:[edi]
repne lodsd eax, dword [esi]
loopne fcn.004d4779
out 0x57, al
push ebx
or al, 0x9a
aas
sti
inc ecx
cli
into
pop edx
fcomp qword [ecx + 0xf]
or eax, 0xe34186e8
mov dl, 0xde
retf
Function at 0x527a15
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
stosb byte es:[edi], al
cmc
pop ss
fisttp qword [edx]
sbb esi, dword [eax + edx*2 - 0x34]
adc cl, byte [edx + 0x30]
and edi, ebp
shr dword [edx - 0x5c], 0x5a
add dword [esp + ebx*8 - 0x20], 0x41cd626c
inc ecx
jb 0x527a9f
pushal
sbb ch, byte [esi + 0x75]
into
int3
lahf
add al, 0xd9
outsd dx, dword [esi]
sub ebx, dword [ecx + 0x7c786cb5]
adc esp, dword [ebx - 0x3b627970]
xchg ebx, eax
pop esi
mov edx, 0xf7a286a9
inc edi
add edi, dword [eax - 0x79d7e8b0]
adc byte [edx], al
mov eax, dword [0xfd749904]
salc
push 0xffffffffffffffaa
fbld tbyte [edi - 0x68c7619b]
in eax, dx
push ebx
push esi
mov ch, 0x72
and dh, byte [edx]
cdq
shl dword [ecx], 3
mov al, 2
fadd qword [edi + edx - 0x4e]
xchg edi, eax
outsb dx, byte [esi]
mov esp, 0xf7e60841
mov ebp, 0x91f78e5e
adc ah, bh
inc edi
cdq
inc edi
push ebp
add byte [edx + 0x69], ch
xor ebx, dword [ecx]
mov bl, 0xae
xor dh, 0x56
push edi
lcall 0xe1f3, 0x44cc7502
xchg edx, eax
pop esp
mov byte [0x815aa4fe], al
jb 0x527ae7
invalid
inc esi
stosd dword es:[edi], eax
adc dl, byte [ebp - 0x24]
and ebp, ebx
outsd dx, dword [esi]
daa
insd dword es:[edi], dx
mov ch, 0x54
push eax
hlt

Function at 0x566f09
Capabilities:
Encode data using xor

Disassembly:
jmp 0x566f1c
dec edx
shr dword [ebx], 1
enter 0x22d2, 0xffffffffffffffd8
cmp esp, ecx
aaa
int 0x2e
mov ah, 0x44
mov esi, 0x7c86875d
lahf
test dword [ebp - 0x71], esi
insb byte es:[edi], dx
mov dh, 0x60
lcall 0xd00a, 0xe913e379
dec ebx
mov cl, 0x52
dec eax
mov eax, 0xad7ba142
push edi
mov ah, 0x2e
fisub word [edi + eax*8]
sbb eax, 0xcc5b5e29
jge 0x566f5d
int3
addps xmm6, xmm0
xchg dword [edx + 0x56532495], eax
add dword [ebx - 0x30811614], ebx
mov eax, 0x3542eabd
xor byte [edi], ah
xchg esi, eax
loope 0x566f50
wait
in al, dx
jmp 0xbe0f3ee2
mov bl, 0x3d
dec edx
dec edi
fsubr dword [ecx + 0x1e]
sbb ecx, dword [esp - 0x6d]
xchg esi, eax
xor dword [eax], 0x8f154247
clc
std
push 0xffffffffffffffdb
lodsb al, byte [esi]
test eax, 0x242156fe
xor eax, dword [edx + 0x70a7f0f5]
pop es
add dl, byte [ebp + 0x1565324]
test eax, 0x7dccdbde
or cl, byte [edi]
pop eax
ret 0xb0b5

Function at 0x58f2f1
Capabilities:
Encode data using xor

Disassembly:
add dword [edx], 0x99e71800
jbe 0x58f307
inc ebp
movsb byte es:[edi], byte [esi]
aad 0x86
xor dh, al
cdq
cmp eax, 0x579ed59e
xchg esp, eax
or byte [edx], dl
sbb byte [edx - 0x33647d6], bl
test al, 0xe6
ror dword [ecx], 1
cmpsb byte [esi], byte es:[edi]
bound ecx, qword [edx + 0x6bc0352c]
stosb byte es:[edi], al
leave
xor dword [ebp + 0x5b95bdf0], edx
jp 0x58f335
mov bh, 0xe5
add dword [esi + 0x3a78068a], esi
add dh, byte [edi]
cmpsd dword ss:[esi], dword es:[edi]
daa
test dword [ebx + 0x65], edi
and eax, ebp
in al, 0xf4
jecxz 0x58f2ac
sbb byte [ebp + ecx*2 - 0x4eb792db], dl
sub ch, dl
stosd dword es:[edi], eax
outsb dx, byte [si]
mov bh, 0xf8
aaa
dec eax
xchg ebx, eax
pushal
aam 0x17
ljmp 0x3083
dec edi
xor eax, 0xf7d5c479
invalid