joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418060
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push esi
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x4180d8
lea eax, [esp + 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
call fcn.00418010
push str.WavePad_Internal
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
test esi, esi
mov dword [esp + 4], eax
je 0x4180b6
mov ecx, dword [0x4c9abc]
push 0x4c97ac
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea edx, [esp + 4]
push 1
push edx
call dword [sym.imp.USER32.dll_GetPriorityClipboardFormat]
mov ecx, eax
pop esi
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
xor eax, eax
test ecx, ecx
setne al
add esp, 8
ret
xor ecx, ecx
xor eax, eax
test ecx, ecx
setne al
pop esi
add esp, 8
ret

Function at 0x43997f
Capabilities:
Encode data using xor

Disassembly:
leave
in eax, 0x24
xchg esi, eax
mov esi, 0xc59f88b6
xchg esi, eax
mov dl, 0x44
or eax, 0x941a54b6
jmp 0x4399e6
pop ds
push esp
invalid

Function at 0x44f8cf
Capabilities:
Encode data using xor

Disassembly:
out 0xbd, eax
adc eax, dword [edi + 0x79]
or dl, byte [edi - 0x1f]
dec edi
mov ebp, 0xa794713
push edi
loope 0x44f93b
dec edi
test byte [edi - 0x33], ch
salc
in eax, dx
in al, 0xbd
pushal
mov byte [eax - 0x7f8a0851], bl
scasd eax, dword es:[edi]
div dword [ebp - 0x80]
xor al, 0x14
pop ecx
add dh, 0xd9
dec ebp
xchg ebp, eax
test byte [ecx], bh
adc esp, dword [esi]
push edi
dec bx
mov al, ah
fmul dword [ebx + ebx*8]
insb byte es:[edi], dx
in eax, 0x71
and dword [esi - 0x612ba074], esp
inc esi
in al, 0x37
test bl, ah
jno 0x44f8e4
outsb dx, byte [esi]
mov byte [0x8354], al
push edx
mov byte [0x52648354], al
xchg ebp, eax
xor cl, byte [ebx - 0x29]
pop es
out 0xc6, al
aas
jp 0x44f90f
xchg dword [ecx + ebp*2 + 0x27c7d9e4], eax
mov eax, 0x6e2d813f
lodsb al, byte [esi]
stosb byte es:[edi], al
add dl, bl
adc dword [eax + 0x647f0b78], ecx
movsd dword es:[edi], dword [esi]
jp 0x44f8ce
xchg esp, eax
aas
jnp fcn.0044f8cf
and ebp, dword [ecx - 0xb18d5e6]
sbb ch, byte [edx]
out 0xf4, eax
mov ebx, 0xafcc223c
jmp 0x44f93f
Function at 0x467acb
Capabilities:
Encode data using xor

Disassembly:
bnd jne 0x467b3c
jge 0x467b4e
fdivr dword [eax + 0x7a]
sbb al, 0x65
xor edi, dword [edi]
lcall 0x7c19, 0x173028dd
mov word [edi - 0x16], cs
push edi
out 0xde, al
xchg edx, eax
push dword [edi]
push edx
js 0x467ad9
sub byte [eax], dh
pop ss
sbb dword [esp + ecx*4 + 0x4f], edi
ljmp 0x37ff
sbb byte [ecx], dh
adc al, 0x98
insb byte es:[edi], dx
fidivr word [eax + ebp*2 + 0x72d88eb8]
cli
push edx
mov byte [0x7dd0d546], al
cmc
mov edx, 0x3bb4aa31
pop ebx
push 0x6c
dec edi
or al, 0x99
mov edi, 0xf756ce26
push 0xffffffffffffffda
fisubr dword [edi]
cmp al, 0x7f
adc esi, edi
cmp ebx, ebx
dec edx
scasb al, byte es:[edi]
lcall 0xb611, 0x2dbd9a0f
inc esi
sbb dword [edx], esp
cmp eax, 0xbe9ae366
xor esi, ecx
or eax, 0x3dd33be0
jp 0x467aee
aad 0xc4
int1
test eax, 0x9ba6d1f7
invalid
or esi, ebp
lcall 0x8a9e, 0x2c8078ed
aaa
ljmp 0x1fd8
jne 0x467b94
mov ebx, eax
pop ds
rcl dword [edi + edi*2 + 0x44], 0x36
jge 0x467bc3
push esp
jg 0x467b95
jge 0x467bc3
in al, 0xc1
mov bl, bh
movsx edi, byte [eax]
cwde
ret
out 0x6a, eax
fdiv qword [ecx - 0x5a5c4d96]
push 0xffffffffffffffdc
mov cl, 0x6a
mov dl, 0xa3
movsd dword es:[edi], dword [esi]
call 0xce64a573
cmp dl, byte [edx]
sbb dl, ch
push ss
xchg dword [esi], ebp
xchg ebx, eax
out dx, eax
outsb dx, byte [esi]
scasd eax, dword es:[edi]
xchg ebp, eax
jg 0x467b48
invalid
invalid
Function at 0x47ff23
Capabilities:
Encode data using xor

Disassembly:
nop
mov byte [0x2ca12a79], al
inc esp
lea ebp, [ecx - 0x521eec60]
mov edx, dword [ecx]
test al, 0x41
inc ecx
loopne 0x47ff5d
imul ebp, ecx, 0x7d
jl 0x47ff41
mov dword [0xef6071c1], eax
invalid
aas
dec ebx
out dx, eax
and dword [ecx], esp
pop ebp
push eax
mov eax, dword [0xdee8635f]
xor bh, ch
pop esi
daa
cmpsb byte [esi], byte es:[edi]
jnp 0x47fee9
out 0xe3, eax
salc
js 0x47ff4b
mov dword [0x77db5041], eax
movsd dword es:[edi], dword [esi]
mov dword [0x8a49e711], eax
dec ecx
mov bh, byte [eax + ebp*2 - 0x4fae453c]
invalid
invalid
dec ecx
mov bh, byte [eax + ebp*2 - 0x4fae453c]
mov eax, dword [0xd38bf066]
sbb eax, 0x32c8a5ad
dec edi
loop 0x47fed9
mov bl, bl
mov esp, 0x41305091
push ebp
mov al, byte [0x17fa57d5]
aad 0x57
cli
pop ss
shl dword [0xa59ba1f8], 1
test byte [eax + eax*4 - 0x61], ah
pop ss
nop
out 0xf8, eax
insb byte es:[edi], dx
insd dword es:[edi], dx
nop
jmp 0x47ff02
cmpsb byte [esi], byte es:[edi]
and dl, byte [edx + edx*2]
pop esp
ret 0x942b

Function at 0x488a2f
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0xbf2668b3
jmp 0x488a85
scasb al, byte es:[edi]
pop edx
out 0x4a, al
mov al, byte [ecx + 0x28cf5d1e]
sub dword [eax + 0x54a687ee], esi
rol byte [ecx + 0x5e15fd35], 1
dec ebp
ja 0x488ab3
out dx, al
xchg dword [esi + 0x3581d054], esp
std
adc eax, 0x21774d5e
inc ebp
xor dword [edx - 0x5f4ffead], ebp
sub byte [esi + 0x4b], dl
pop es
pop ecx
inc eax
lcall 0x97e7, 0xb09c5a47
push 0x5a
out dx, al
mov word [edi], es
je 0x488a79
dec esp
inc esp
pop ds
invalid
sbb dword [ebx + 0x7d0ea36f], esp
imul ebx, dword [ebp - 0x47712a1c], 0x4f65162c
push ebp
aaa
adc byte [edx], ah
cmp eax, dword [esp + edx - 0x7311e0a9]
stosb byte es:[edi], al
ja 0x488b16
ljmp 0x5a79:0x2fb29f29
stosd dword es:[edi], eax
aas
jae 0x488ad1
push ds
enter 0xffffffffffffb616, 0xffffffffffffff99
mov gs, esp
cmpsb byte [esi], byte es:[edi]
std
stosb byte es:[edi], al
lea ebp, [ebp - 0x37]
push 0x4a
add esi, edi
pushfd
pop esi
mov bh, 0x5e
or al, 0xf9
adc al, 0x98
cmp al, 0x8f
push cs
cmpsd dword [esi], dword es:[edi]
or dl, byte [ecx + 2]
aad 0x48
test al, 0x9d
insd dword es:[edi], dx
ror edx, cl
fnstenv [ebp - 0x79f5e058]
ror dword [esi + 0x49742796], cl
xchg byte [ebx + 0x7b60ccc], cl
sar byte [eax + 0x4f], 1
dec eax
retf
Function at 0x4964cf
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xd1
into
in al, 0x4a
push ds
invalid
sub eax, 0x251f1258
pop eax
iretd
pop eax
adc bl, byte [edi]
and eax, 0xc6cf58f3
enter 0x13b6, 1
sbb al, byte [ebx - 0x213860a6]
in al, 0x40
invalid
mov dh, 0x13
add dword [edx], ebx
sbb dword [edx - 0x61], 0xffffffc7
fsubrp st(4)
inc eax
mov bh, 0x1a
sbb dl, byte [ebp - 0x3c]
push ebp
les ebx, [ecx + 0x32]
fisubr word [ebx]
test eax, 0x817345f
test eax, 0x817345f
sar dword [edi + ebp*2 + 0x3d], cl
loop 0x4964bf
add ah, byte [esi + ebp*2 + 0x70]
rcl dword [ebp + 0x31], cl
dec edi
sub al, 0x8f
inc ebp
sal dword [ebx - 0x3ef2c3b5], cl
jne 0x4964b7
jo 0x4964b8
push ebp
xor dword [edi + 0x2c], ecx
pop dword [ebp - 0x2d]
mov bl, 0x4b
cmp al, 0xd
sal dword [ebp - 0x3c], 0x53
push ebx
jne 0x49654f
jb 0x49654f
mov al, 0x99
shr al, cl
xchg ebp, eax
adc byte [edx + 0x29f64d6c], cl
js 0x496485
jns 0x496523
push eax
salc
das
inc ecx
adc ebx, ebx
cmp eax, 0xbb1f3d23
dec esi
jnp 0x496590
add al, 0x43
lea eax, [edx]
inc byte [ebx - 0x15]
mov dl, 0x13
mov gs, word [ecx + 0x62]
rol byte [eax], 0xb
rcr byte [ebp + 0x6e], 1
or edx, eax
pop ebp
outsb dx, byte [esi]
rcl byte [edx], cl
je 0x4964c1
je 0x496581
insb byte es:[edi], dx
cmp eax, 0xea72037a
cmp eax, 0xea72037a
cmp eax, 0xea72037a
loopne 0x4964d5
outsb dx, byte [esi]
or byte [ebp - 0xe2b939a], dl
dec edx
fnstcw word [eax]
div byte [edi - 0x72]
inc edi
jmp 0x4965c0
cmp eax, 0xfa29f51f
xor al, 0xba
jp 0x4964e3
out dx, eax
sbb dl, byte [eax]
sar dword [0xfd5a3f3b], cl
sub al, 0xc
jmp 0x4965bb
test eax, 0x25cbfe60
push edx
and eax, 0x5d12bfd0
sbb al, 0x91
lodsd eax, dword [esi]
mov al, 0x8e
jo 0x496588
mov cl, 0x4f
invalid
jl 0x4965cc
invalid
imul edi
popfd
pop esp
test eax, 0xc96dce71
insd dword es:[edi], dx
leave
leave
sub al, 0x9c
int 8
scasb al, byte es:[edi]
push edx
push ebp
fistp word [edi + ebx*4 + 0x6d]
pop esi
fstp qword [edi - 0x1176af01]
mov ebp, 0x9dd158e1
adc dword [edi], esp
lahf
jns 0x496567
push ds
adc ah, byte [edx + ebp*2 + 0x3c]
sub edi, ecx
mov ah, 0xd9
outsb dx, byte [esi]
test dword [edi + 0x7b], esp
xor al, 0
int3
add ah, cl
mov dh, 0xf1
xchg esi, eax
xchg esi, eax
insb byte es:[edi], dx
push eax
xlatb
int3
sub al, 0x6d
Function at 0x49fd8f
Capabilities:
Encode data using xor

Disassembly:
cmc
and dword [esi + 0x53fdb23c], edi
xor bl, byte [esi - 0x2535a58c]
dec ebx
sub eax, 0x2a1a7e7a
call 0x5ac32e8e
xor al, 0x31
jns 0x49fdb4
ror dword [0xe12ef4fe], 1
xor byte cs:[ebx + 0x4d67b343], bh
insd dword es:[edi], dx
add ebp, 0x27
popfd
sub dword [ebx - 0x2818c49d], esi
xor dword [eax - 0x372472cc], esi
inc edx
push 0x795d116e
scasd eax, dword es:[edi]
jae 0x49fd56
invalid
hlt
enter 0xffffffffffffacc3, 0x4c
cmpsd dword [esi], dword es:[edi]
push esp
jae 0x49fd42
sub al, 0x62
call 0x633930da
sbb dword [ebx - 0x23], esp
wait
lodsd eax, dword [esi]
pushal
adc dl, byte [ecx]
jno 0x49fdd1
pop ss
cmp byte [ebx - 0x7be3aa8e], bh
fldenv [edi - 0x46]
test dword [ecx], edx
jb 0x49fd75
adc dword [edx - 0x42], esi
enter 0xfffffffffffffef7, 0xffffffffffffffce
xor al, 0x10
or byte [esi - 0x3b], bl
sub dl, byte [eax + 0xa]
mov ah, 0xce
adc al, 0xf8
invalid
in al, 0xcb
test byte [ecx - 0xf0def91], bh
adc ch, byte [esi - 0x1b52b426]
add al, 0x90
dec ecx
in al, 0xf1
sti
int3
Function at 0x4ae2e6
Capabilities:
Encode data using xor

Disassembly:
cmp cl, ah
cmp esp, ecx
pop edi
push ebx
fdivp st(5)
imul esi, dword [edx + 0x481447e7], 0x74
insd dword es:[edi], dx
mov dl, 0xe7
inc edi
adc al, 0x48
je 0x4ae363
mov edx, 0x5780db84
add eax, 0xfbae3acc
in al, 0x52
mov dl, 0x5e
test dword [eax - 0x429bc6e3], ebx
xor al, 0xb4
jp 0x4ae2ef
loope 0x4ae347
cmp byte [edi - 0x2f], ah
add eax, 0x7bd63cf2
pop ebp
rol dword [di], 1
cmp al, 0xd6
jnp 0x4ae374
lodsb al, byte [esi]
mov al, 0x2a
sub ah, byte [edi + 0x5f8cd61]
iretd
mov bl, 0x85
enter 0xffffffffffffc439, 0x64
test dword [edi + 0x3dc9bae4], edx
invalid
call dword [esi - 0x6dc24062]
mov dl, 0x27
push ebp
xchg esi, eax
dec edi
rcl byte [esi]
and eax, 0x3e9e8c29
cmp al, 0xf4
insd dword es:[edi], dx
scasb al, byte es:[edi]
push es
lodsb al, byte [esi]
sub eax, 0x7e350b11
and esi, edi
push 0xffffffffffffffc0
jle 0x4ae388
imul dword [edx - 0x40]
mov bh, 0x50
sub eax, 0x219745a1
pop ecx
lea eax, [esi - 0x65]
popfd
sbb ebx, dword [ebp - 0x126e216d]
jb 0x4ae385
les esi, [esi + 0x6732e20]
jne 0x4ae30d
invalid
invalid
dec ebx
xchg ebp, eax

Function at 0x4bcaad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6370
cmp edx, dword [eax]
je 0x4bcacf
add eax, 8
inc ecx
cmp eax, 0x4c6400
jl 0x4bcac0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6370]
jne 0x4bcbfd
mov eax, dword [0x4cacfc]
cmp eax, 1
je 0x4bcbd7
test eax, eax
jne 0x4bcb00
cmp dword [0x4c629c], 1
je 0x4bcbd7
cmp edx, 0xfc
je 0x4bcbfd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bcb37
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd490
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bcb7a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1c7c
push edi
call fcn.004bf7f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd490
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd4a0
lea eax, [ebp - 0xa0]
push 0x4c1c5c
push eax
call fcn.004bd4a0
push dword [esi + 0x4c6374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd4a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf764
add esp, 0x2c
pop edi
jmp 0x4bcbfd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c6374]
push 0
push eax
push dword [esi]
call fcn.004bd920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10015217
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002d711
call fcn.10017005
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015234
xor eax, eax
jmp 0x10015311
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001530f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x100152e5
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000128b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000128b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1001969c
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x100152ef
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x10015264
jmp 0x10015308
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016faf
ret

Function at 0x1001969c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x100196ab
pop dword [ebp - 4]
mov eax, 0x100196ab
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x418dd
push 0
mov eax, 0xd40bf13b
sub eax, 0xc408ffdf
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x4a1a
xor edx, edx
add edx, eax
mov ebx, 0x746e4562
sub ebx, 0x64699962
add ebx, dword [ebp - 4]
mov esi, 0x93789452
add esi, 0x275b249
mov edi, dword [ebx]
xor edi, esi
mov dword [edx], edi
add edx, 0xc4931257
add edx, 0x3b6cedad
add ebx, 0x9fad4258
sub ebx, 0x9fad4254
loop 0x10019701
add eax, 0xebb985da
sub eax, 0xebb86a9f
mov ebx, eax
add eax, 0x352c759b
sub eax, 0x352c7596
mov ecx, 0xca897526
sub ecx, 0xba897526
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x101f4525
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x3f934b9d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x100012c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
test esi, esi
je 0x100013d0
lea eax, [ebp - 0x94]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_OpenFile]
sub esp, 0xc
mov ebx, eax
xor edi, edi
cmp ebx, 0xffffffff
je 0x10001362
mov edx, dword [sym.imp.kernel32.dll__llseek]
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [ebp - 0xdc], edx
mov dword [esp], ebx
call edx
lea eax, [ebp - 0xd4]
mov edi, dword [sym.imp.kernel32.dll__lread]
sub esp, 0xc
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
mov edx, dword [ebp - 0xdc]
sub esp, 0xc
cmp eax, 0x40
je 0x10001370
xor edi, edi
test esi, esi
je 0x10001362
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll__lclose]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
cmp word [ebp - 0xd4], 0x5a4d
jne 0x10001350
mov eax, dword [ebp - 0x98]
mov dword [esp + 8], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
call edx
lea eax, [ebp - 0xd8]
sub esp, 0xc
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call edi
sub esp, 0xc
cmp eax, 4
jne 0x10001350
xor eax, eax
cmp dword [ebp - 0xd8], 0x4550
sete al
mov edi, eax
jmp 0x10001352
movzx eax, ax
mov dword [esp], eax
call sym._DosFileHandleToWin32Handle_4
sub esp, 4
mov ebx, eax
jmp 0x100012fa

Function at 0x10001440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10001498
cmp byte [esi + ebx - 1], 0xa
je 0x1000146c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10006084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x100019f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov edi, dword [0x10006094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x10001bb0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x10006094]
movzx eax, al
bt eax, esi
jae 0x10001c10
mov ecx, dword [0x10006084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x10001ab5
test byte [0x100022e8], 8
jne 0x10001b50
lea ebx, [ebp - 0xd4]
mov edi, ebx
test byte [0x100022f8], 8
jne 0x10001b00
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10001a84
cmp esi, 3
jbe 0x10001ac0
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 8], str._s:_s:_s
mov dword [esp], eax
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
lea edx, [edi + 1]
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + 0x100040d4]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x10001a84
mov ecx, dword [0x10006094]
test ecx, ecx
je 0x10001bf0
mov dword [esp], 0x100022f8
call dword [0x10006094]
test al, 8
je 0x10001a5b
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x10001a5b
mov ebx, dword [0x10006094]
test ebx, ebx
je 0x10001bd0
mov dword [esp], 0x100022e8
call dword [0x10006094]
test al, 8
je 0x10001a46
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
lea ebx, [ebp - 0xd4]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mul edx
mov dword [esp], ebx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x10001a4e
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001a0d
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001b5a
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x10006094
call sym._load_func.part.0
jmp 0x10001b0e
mov eax, 0xffffffff
jmp 0x10001ab5

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x405092
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.00404b11
test eax, eax
je 0x4050fe
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32.dll
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4050cc
push str.SetProcessDEPPolicy
push eax
call esi
test eax, eax
je 0x4050cc
push 1
call eax
test eax, eax
jne 0x4050fd
push str.ntdll.dll
call edi
test eax, eax
je 0x4050fd
push str.NtSetInformationProcess
push eax
call esi
mov esi, eax
test esi, esi
je 0x4050fd
push 4
lea eax, [ebp - 4]
push eax
push 0x22
mov dword [ebp - 4], 0xd
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
pop edi
push 2
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
call fcn.00404ee4
test al, al
jne 0x405124
xor eax, eax
inc eax
jmp 0x405133
push esi
call fcn.00404b81
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40584e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a224]
jne 0x405858
repz ret
jmp fcn.00405df1

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx