joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55e8e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x55ea03
test esi, esi
je 0x55ea03
movzx edx, word [edi + 2]
mov eax, 0x800
mov ecx, edx
and ecx, eax
mov ebx, eax
cmp cx, bx
je 0x55e9a7
movzx ecx, word [esi + 2]
mov ebx, ecx
and ebx, eax
cmp bx, ax
je 0x55e9a7
xor cl, dl
test cl, 0x10
jne 0x55e9a7
mov al, byte [edi]
cmp al, byte [esi]
jne 0x55e9a7
push dword [esi + 8]
push dword [edi + 8]
call fcn.0055e8e9
pop ecx
pop ecx
test eax, eax
jne 0x55e9a7
push dword [esi + 0xc]
push dword [edi + 0xc]
call fcn.0055e8e9
pop ecx
pop ecx
test eax, eax
jne 0x55e9a7
mov ebx, dword [esi + 0x10]
mov edi, dword [edi + 0x10]
call fcn.00558ad3
test eax, eax
jne 0x55e9a7
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x18]
cmp eax, dword [esi + 0x18]
jne 0x55e9a7
mov ax, word [edi + 0x1c]
cmp ax, word [esi + 0x1c]
jne 0x55e9a7
movzx eax, word [edi + 2]
mov ecx, eax
mov eax, 0x400
and ecx, eax
mov edx, eax
cmp cx, dx
jne 0x55e9ac
mov cx, word [esi + 2]
and cx, dx
cmp cx, ax
jne 0x55e9a7
mov eax, dword [edi + 4]
cmp eax, dword [esi + 4]
je 0x55e9d6
push 2
pop eax
jmp 0x55ea0e
cmp byte [edi], 0x98
je 0x55e9d6
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x55e9d6
mov dx, word [esi + 2]
mov ebx, eax
and dx, bx
cmp dx, ax
je 0x55e9a7
mov edx, dword [esi + 4]
test edx, edx
je 0x55e9a7
call fcn.00554101
test eax, eax
jne 0x55e9a7
movzx ecx, word [edi + 2]
mov dx, word [esi + 2]
mov eax, 0x100
and ecx, eax
and dx, ax
cmp cx, dx
je 0x55e9f2
xor eax, eax
inc eax
jmp 0x55ea0e
test cx, cx
je 0x55e9ff
mov eax, dword [edi + 0x14]
cmp eax, dword [esi + 0x14]
jne 0x55e9a7
xor eax, eax
jmp 0x55ea0e
mov eax, esi
sub eax, edi
neg eax
sbb eax, eax
and eax, 2
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5621ee
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x562202
xor eax, eax
jmp 0x5622f1
push esi
mov esi, dword [ebp + 8]
push 0x50
call fcn.0055b4b0
mov esi, eax
pop ecx
test esi, esi
je 0x5622f0
push ebx
push dword [ebp + 0x10]
mov ebx, dword [edi]
push dword [ebp + 8]
call fcn.0055e523
push dword [ebp + 0x10]
mov dword [esi], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.005620c4
push 0
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push eax
push dword [ebp + 8]
call fcn.0056496a
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x10]
call fcn.0055e523
push 0
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
push dword [ebp + 8]
call fcn.0056496a
push dword [ebp + 0x10]
mov dword [esi + 0x14], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x18]
call fcn.0055e523
add esp, 0x44
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.005621ee
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
push eax
push dword [ebp + 8]
call fcn.0056496a
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.0056496a
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ax, word [edi + 6]
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
mov ecx, 0xfff7
and ax, cx
add esp, 0x2c
or dword [esi + 0x40], 0xffffffff
mov word [esi + 6], ax
mov dword [esi + 0x24], ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x56e5c9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov ecx, dword [ebx + 0x3c]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ecx], edi
jne 0x56e5fc
mov eax, dword [ebx + 0x78]
push edi
push ecx
mov ecx, dword [ebx]
or eax, 0x1e
push edi
call fcn.00553bde
add esp, 0xc
mov dword [ebp - 4], eax
cmp eax, edi
jne 0x56e6d6
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x56e632
mov eax, dword [ebx + 0x80]
push edi
cdq
push ecx
push edx
push eax
call fcn.00599090
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
push esi
jmp 0x56e637
xor edi, edi
mov esi, dword [ebp + 8]
cmp esi, edi
je 0x56e6d5
mov edi, dword [esi + 0xc]
mov dword [ebp - 0xc], edi
cmp edi, dword [ebx + 0x18]
ja 0x56e6c5
test byte [esi + 0x14], 0x20
jne 0x56e6c5
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.00599090
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
cmp edi, 1
jne 0x56e677
call fcn.00556821
push dword [ebp - 0x10]
mov eax, dword [esi]
push dword [ebp - 0x14]
mov dword [ebp - 8], eax
push dword [ebx + 0x80]
push eax
mov eax, dword [ebx + 0x3c]
call fcn.00553b6f
add esp, 0x10
mov dword [ebp - 4], eax
cmp edi, 1
jne 0x56e6af
mov esi, dword [ebp - 8]
add esi, 0x18
lea edi, [ebx + 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp + 8]
cmp edi, dword [ebx + 0x20]
jbe 0x56e6b7
mov dword [ebx + 0x20], edi
push dword [esi]
mov eax, dword [ebx + 0x58]
call fcn.0056b2a2
mov esi, dword [ebp + 8]
pop ecx
cmp dword [ebp - 4], 0
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
je 0x56e635
pop esi
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x59393a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d26f8]
jne 0x593944
repz ret
jmp fcn.005a275c

Function at 0x59d2ff
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x59d330
call fcn.00598f84
mov dword [eax], esi
call fcn.00598f71
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005946f4
add esp, 0x14
or eax, 0xffffffff
jmp 0x59d36b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x59d34d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00598f97
pop ecx
jmp 0x59d32b
test byte [ebp + 0xc], 0x80
je 0x59d358
and eax, 0xfffffffe
jmp 0x59d35b
or eax, 1
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x59d33e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x59d36e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x59d39f
call fcn.00598f84
mov dword [eax], esi
call fcn.00598f71
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.005946f4
add esp, 0x14
push 0x16
pop eax
jmp 0x59d3f4
test dword [ebp + 0xc], 0xfffffff9
jne 0x59d37b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x59d3cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00598f97
pop ecx
call fcn.00598f71
mov eax, dword [eax]
jmp 0x59d3f4
test al, 0x10
jne 0x59d3f2
test al, 1
je 0x59d3f2
test byte [ebp + 0xc], 2
je 0x59d3f2
call fcn.00598f84
mov dword [eax], 5
call fcn.00598f71
mov dword [eax], 0xd
jmp 0x59d3c3
xor eax, eax
pop esi
pop ebp
ret
Function at 0x5b2e40
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.005a30f4
and dword [ebp - 4], 0
cmp dword [0x6ea2e0], 0
mov ebx, eax
jne 0x5b2ef1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x5b2fa2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x5b2fa2
push eax
call fcn.005a3082
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x6ea2e0], eax
call esi
push eax
call fcn.005a3082
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x6ea2e4], eax
call esi
push eax
call fcn.005a3082
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x6ea2e8], eax
call esi
push eax
call fcn.005a3082
pop ecx
mov dword [0x6ea2f0], eax
test eax, eax
je 0x5b2ef1
push 0x690620
push edi
call esi
push eax
call fcn.005a3082
pop ecx
mov dword [0x6ea2ec], eax
mov eax, dword [0x6ea2ec]
cmp eax, ebx
je 0x5b2f49
cmp dword [0x6ea2f0], ebx
je 0x5b2f49
push eax
call fcn.005a30fd
push dword [0x6ea2f0]
mov esi, eax
call fcn.005a30fd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x5b2f49
test edi, edi
je 0x5b2f49
call esi
test eax, eax
je 0x5b2f40
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x5b2f40
test byte [ebp - 0xc], 1
jne 0x5b2f49
or dword [ebp + 0x10], 0x200000
jmp 0x5b2f82
mov eax, dword [0x6ea2e4]
cmp eax, ebx
je 0x5b2f82
push eax
call fcn.005a30fd
pop ecx
test eax, eax
je 0x5b2f82
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x5b2f82
mov eax, dword [0x6ea2e8]
cmp eax, ebx
je 0x5b2f82
push eax
call fcn.005a30fd
pop ecx
test eax, eax
je 0x5b2f82
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x6ea2e0]
call fcn.005a30fd
pop ecx
test eax, eax
je 0x5b2fa2
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x5b2fa4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xe72b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6b2000]
push edi
or ebp, 0xffffffff
jmp 0xe72b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xe72b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe72b58
mov eax, 1
add ebx, ebx
jne 0xe72b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xe72b8c
jne 0xe72bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe72bab
dec eax
add ebx, ebx
jne 0xe72b98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xe72b70
add ebx, ebx
jne 0xe72ba7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xe72bfd
xor ecx, ecx
sub eax, 3
jb 0xe72bc3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xe72c32
sar eax, 1
mov ebp, eax
jmp 0xe72bce
add ebx, ebx
jne 0xe72bce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe72b9c
inc ecx
add ebx, ebx
jne 0xe72bdc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xe72b9c
add ebx, ebx
jne 0xe72be9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xe72bde
jne 0xe72bfa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xe72bde
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xe72c1c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xe72c0e
jmp 0xe72b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xe72c1c
add edi, ecx
jmp 0xe72b5e
pop esi
mov edi, esi
mov ecx, 0x24805
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xe72c3a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xe72c3f
lea edi, [esi + 0xa2f000]
mov eax, dword [edi]
or eax, eax
je 0xe72ca7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xad0100]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xad02c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xe72c65
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xad02d0]
or eax, eax
je 0xe72ca1
mov dword [ebx], eax
add ebx, 4
jmp 0xe72c82
call dword [esi + 0xad02cc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0xe72cd8
cmp al, 0xef
ja 0xe72ccb
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0xe72cad
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0xe72cba
mov ebp, dword [esi + 0xad02d4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xe72d0c
sub esp, 0xffffff80
jmp 0xa63d10
Function at 0x49aa64
Capabilities:
Encode data using xor

Disassembly:
dec ebx
push ebp
mov ah, 0xfb
dec esp
ret
sahf
or byte [esi], 0xb9
mov ah, 0xda
lcall 0xcd0, 0xc4e9d763
xor ecx, dword [edi + 0x39]
mov eax, dword [0x3051a32]
jbe 0x49a989
outsb dx, byte [esi]
xor al, 0xbb
invalid
and al, 0xf6
stosd dword es:[edi], eax
adc eax, 0x14f440f5
nop
adc al, 0xa7
add esi, esi
rcr byte [edx], 0xda
jne 0x49a95f
daa
add esp, dword [esi + ebx*8 - 0x7c44546c]
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
mov ah, 0xe3
xchg edi, eax
mov dword [0x16c0da0e], eax
jg 0x49aa66
add ebx, dword ss:[edi + 0x52]
adc al, 0xf2
xchg edx, eax
jl int.0049aa64
loope 0x49a983
pushal
pop ss
mov al, 0x87
in eax, dx
pop eax
mov dword [edx], eax
xchg ebx, eax
cmp al, ah
movsd dword es:[edi], dword [esi]
lahf
fimul dword [ebx - 0x5b486e66]
and byte [esi + ebx*4], bh
dec esp
mov esi, 0x5205dd05
or al, 0x13
leave
push ecx
mov eax, 0xf418c896
mov ch, 0x21
hlt
inc esi
je 0x49aa3a
or eax, 0xd5b1dc56
pop ebp
push esp
pop edi
je 0x49aa3d
mov word [ecx - 0x4cf6276e], gs
mov ah, 0x49
mov word [edx + 0x3a], ss
jp 0x49a9cd
add eax, dword [edx]
hlt
mov byte [0x40dcd325], al
rcr esp, cl
inc eax
je 0x49aabe
jge 0x49aa30
aad 0x63
sbb al, byte [esi]
cwde
sbb eax, 0x71140ef8
dec eax
je 0x49aace
js 0x49aae6
mov esi, 0xac49edb4
sbb ebx, dword gs:[ecx + 0x43]
retf 0xc47c
push ecx
adc dword [ecx - 2], ebp
and esi, dword [edx + 0x7ec9ced9]
jmp 0x952357b9
into
leave
jle 0x49aaab
rep lodsb al, byte [esi]
fst dword [ebp + edi*4 - 0x38100829]
je 0x49aab8
aam 0x34
test dword [0x602ec925], 0x70233609
sub byte [eax - 0xb], dh
xor al, 0xf7
or eax, 0x602ec925
or dword [esi], esi
and esi, dword [eax + 0x28]
and eax, 0x9602ec9
and esi, dword ss:[eax + 0x28]
jo 0x49aad1
inc esp
test dword [esi - 0x425b4dae], edx
cdq
cld
cdq
salc
fisub word [ebp + 0x1f]
pop ss
insb byte es:[edi], dx
aad 0x48
jmp dword [eax + 0x10]

Function at 0x576d44
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov byte [esi], dl
leave
cmp esp, 0xffffffc1
mov dh, ah
adc eax, 0xa2d66408
test byte [0xaca941ed], dh
add dword ss:[ecx - 0x5e], eax
outsb dx, byte [esi]
call 0x3a22a6b1
int1
cmp byte [eax - 0x1ea62c2d], bh
sbb word [ebp - 0x4514a128], cx
mov esp, 0x31bfbb1f
inc eax
mov cl, 0x6b
jo 0x576cec
inc ecx
test eax, 0x77572172
sub esp, dword [ebp + 0x62]
scasd eax, dword es:[edi]
int3
xor eax, esi
adc byte [ebx + 0x792f6412], ch
lds eax, [edi - 0x39]
lodsb al, byte [esi]
xchg ecx, eax
ficom word [eax + 0x48056b99]
pop ds
cdq
imul eax, dword [0x3fd01f48], 0x74
jp 0x576cf1
sar byte [edi], 1
je 0x576d6f
sti
sbb cl, byte [ebp + 0x3a5a7069]
jno 0x576c7e
lea ebp, [ecx + 0x70]
pop edx
cmp dh, byte [ecx - 0x80]
pop esp
inc ecx
lahf
push ss
ljmp 0xc5b1
or dl, byte [ecx - 0x379c6cfd]
lcall 0x7d7c, 0x3c456a7d
ja 0x576ce5
mov bh, 0xab
dec ebp
add esi, dword [edi]
cmp dword [eax + edi*2], ebp
js 0x576cdd
js 0x576cdd
sar dword [ecx - 0x779fa821], cl
js 0x576cf7
clc
movsd dword es:[edi], dword [esi]
loope 0x576d52
scasb al, byte es:[edi]
jno 0x576d2e
cmp byte [edx + 0x29], al
stc
fdivr qword [ecx - 0x715eef84]
pop bp
imul eax, dword [edx], 0x18
invalid
xchg edi, eax
invalid
Function at 0x6305c4
Capabilities:
Encode data using xor

Disassembly:
inc edi
inc ebp
insb byte es:[edi], dx
mov cl, 0xd3
invalid
jno 0x630580
mov dl, 0xa9
pop edi
pushfd
lds edx, [eax]
mov bh, 0xdb
add byte [eax + ebp*4 + 0x153be637], al
push 2
pop esi
sub dword [ecx], ebp
and al, 0x56
adc eax, 0x295e026a
sub dword [esi + edx*2], esp
xchg ecx, eax
mov byte [0x546890e1], al
xchg edi, eax
fldcw word [eax - 6]
out 0xdc, eax
rol dl, cl
xor byte [esi + 0x11cb9e8b], dh
lodsb al, byte [esi]
inc edi
jg 0x6305d4
sub cl, byte [edx]
daa
int3

Function at 0x64e05d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658408
cmp edx, dword [eax]
je 0x64e07f
add eax, 8
inc ecx
cmp eax, 0x658498
jl 0x64e070
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658408]
jne 0x64e1ad
mov eax, dword [0xa5bd60]
cmp eax, 1
je 0x64e187
test eax, eax
jne 0x64e0b0
cmp dword [0x658334], 1
je 0x64e187
cmp edx, 0xfc
je 0x64e1ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e0e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ea40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064eed0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e12a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064eed0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653e34
push edi
call fcn.00650da0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ea40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ea50
lea eax, [ebp - 0xa0]
push 0x653e14
push eax
call fcn.0064ea50
push dword [esi + 0x65840c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ea50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650d14
add esp, 0x2c
pop edi
jmp 0x64e1ad
lea eax, [ebp + 8]
lea esi, [esi + 0x65840c]
push 0
push eax
push dword [esi]
call fcn.0064eed0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10003a38
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1005d5c0], 0
push esi
push edi
mov edx, 0xff
jne 0x10003a77
xor esi, esi
push 8
mov ecx, esi
pop edi
test cl, 1
je 0x10003a5e
shr ecx, 1
xor ecx, 0xedb88320
jmp 0x10003a60
shr ecx, 1
dec edi
jne 0x10003a4f
mov edi, esi
xor edi, edx
inc esi
cmp esi, 0x100
mov dword [edi*4 + 0x1005d5c0], ecx
jb 0x10003a4a
xor ecx, ecx
cmp dword [esp + 0x10], ecx
jle 0x10003aa3
mov esi, dword [esp + 0xc]
movzx esi, byte [ecx + esi]
mov edi, eax
and edi, edx
shr eax, 8
xor esi, edi
xor eax, dword [esi*4 + 0x1005d5c0]
xor eax, 0xff000000
inc ecx
cmp ecx, dword [esp + 0x10]
jl 0x10003a7f
pop edi
pop esi
ret

Function at 0x10003ab9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov ecx, dword [eax]
and dword [ebp - 0xc], 0
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 8]
push ebx
push esi
mov esi, dword [eax + 4]
mov dword [ebp - 4], ecx
mov ecx, dword [eax + 0xc]
push edi
mov edi, edx
mov dword [ebp - 8], ecx
mov ecx, dword [eax + 0x10]
add edi, 2
movzx ebx, byte [edi]
xor edx, edx
mov dh, byte [edi - 2]
add edi, 4
mov dl, byte [edi - 5]
shl edx, 8
or edx, ebx
movzx ebx, byte [edi - 3]
shl edx, 8
or edx, ebx
mov ebx, dword [ebp - 0xc]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
mov dword [ebp + ebx*4 - 0x150], edx
jb 0x10003ae5
push 0x40
lea edx, [ebp - 0x148]
pop edi
mov ebx, dword [edx + 0x2c]
xor ebx, dword [edx + 0x18]
xor ebx, dword [edx - 8]
xor ebx, dword [edx]
add edx, 4
dec edi
rol ebx, 1
mov dword [edx + 0x34], ebx
jne 0x10003b1d
xor edx, edx
cmp edx, 0x14
jae 0x10003b58
mov ebx, dword [ebp - 4]
mov edi, esi
not edi
and edi, dword [ebp - 8]
and ebx, esi
or edi, ebx
add edi, dword [ebp + edx*4 - 0x150]
lea edi, [edi + ecx + 0x5a827999]
jmp 0x10003baf
cmp edx, 0x28
jae 0x10003b75
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 4]
xor edi, esi
add edi, dword [ebp + edx*4 - 0x150]
lea edi, [edi + ecx + 0x6ed9eba1]
jmp 0x10003baf
cmp edx, 0x3c
jae 0x10003b99
mov edi, dword [ebp - 4]
mov ebx, dword [ebp - 4]
or edi, esi
and edi, dword [ebp - 8]
and ebx, esi
or edi, ebx
add edi, dword [ebp + edx*4 - 0x150]
lea edi, [edi + ecx - 0x70e44324]
jmp 0x10003baf
mov edi, dword [ebp - 8]
xor edi, dword [ebp - 4]
xor edi, esi
add edi, dword [ebp + edx*4 - 0x150]
lea edi, [edi + ecx - 0x359d3e2a]
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
ror esi, 2
mov dword [ebp - 4], esi
mov esi, dword [ebp - 0x10]
mov dword [ebp - 8], ebx
mov ebx, esi
rol ebx, 5
inc edx
add edi, ebx
cmp edx, 0x50
mov dword [ebp - 0x10], edi
jb 0x10003b35
mov edx, dword [eax]
add edx, edi
mov dword [eax], edx
mov edx, dword [eax + 4]
add edx, esi
mov esi, dword [ebp - 4]
mov dword [eax + 4], edx
mov edx, dword [eax + 8]
add edx, esi
mov esi, dword [ebp - 8]
mov dword [eax + 8], edx
mov edx, dword [eax + 0xc]
add edx, esi
mov dword [eax + 0xc], edx
mov edx, dword [eax + 0x10]
pop edi
add edx, ecx
pop esi
mov dword [eax + 0x10], edx
pop ebx
leave
ret
Function at 0x100148d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 4
lea eax, [ebp - 4]
push 0
push eax
call sub.MSVCRT.dll_memset
push 6
lea eax, [ebp - 0xc]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
push 0x30
push 0x1005a8f8
call fcn.10014839
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
xor ecx, ecx
sub edi, eax
lea eax, [ebp + ecx - 0xc]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 6
jl 0x10014914
mov al, byte [ebp - 0xc]
push 0
shr al, 2
call fcn.100148a8
mov cl, byte [ebp - 0xb]
shl al, 4
or byte [ebp - 4], al
mov al, byte [ebp - 0xc]
and al, 3
shl al, 4
shr cl, 4
push 1
or al, cl
call fcn.100148a8
or byte [ebp - 4], al
mov al, byte [ebp - 0xb]
mov cl, byte [ebp - 0xa]
and al, 0xf
shl al, 2
shr cl, 6
push 2
or al, cl
call fcn.100148a8
shl al, 4
or byte [ebp - 3], al
mov al, byte [ebp - 0xa]
push 3
and al, 0x3f
call fcn.100148a8
or byte [ebp - 3], al
mov al, byte [ebp - 9]
push 4
shr al, 2
call fcn.100148a8
mov cl, byte [ebp - 8]
shl al, 4
or byte [ebp - 2], al
mov al, byte [ebp - 9]
and al, 3
shl al, 4
shr cl, 4
push 5
or al, cl
call fcn.100148a8
or byte [ebp - 2], al
mov al, byte [ebp - 8]
mov cl, byte [ebp - 7]
and al, 0xf
shl al, 2
shr cl, 6
push 6
or al, cl
call fcn.100148a8
shl al, 4
or byte [ebp - 1], al
mov al, byte [ebp - 7]
push 7
and al, 0x3f
call fcn.100148a8
or byte [ebp - 1], al
push 4
push 0
push dword [ebp + 0x10]
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0x20
push 0x1005a928
call fcn.10014839
pop edi
leave
ret 0xc

Function at 0x100149fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x94
push ebx
push esi
push edi
push 8
mov edi, eax
lea eax, [ebp - 0x28]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 0x74]
push 0x40
push 0x1005a988
call fcn.10014839
cmp dword [ebp + 0x7c], 0
push 0x10
lea esi, [ebp - 0x24]
pop ebx
je 0x10014a69
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [ebp + 0x68]
push eax
push edi
push esi
call fcn.100148d3
xor eax, eax
add esi, 8
mov cl, byte [esi + eax - 0xc]
xor cl, byte [ebp + eax + 0x68]
mov byte [esi + eax], cl
inc eax
cmp eax, 4
jl 0x10014a50
add edi, 6
dec ebx
jne 0x10014a3b
jmp 0x10014a98
add edi, 0x5a
mov eax, dword [esi]
mov dword [esi + 4], eax
lea eax, [ebp + 0x68]
push eax
push edi
push esi
call fcn.100148d3
xor eax, eax
add esi, 8
mov cl, byte [esi + eax - 0xc]
xor cl, byte [ebp + eax + 0x68]
mov byte [esi + eax], cl
inc eax
cmp eax, 4
jl 0x10014a81
sub edi, 6
dec ebx
jne 0x10014a6c
pop edi
pop esi
xor eax, eax
pop ebx
mov cl, byte [ebp + eax + 0x5c]
mov byte [ebp + eax + 0x60], cl
mov cl, byte [ebp + eax + 0x58]
mov byte [ebp + eax + 0x64], cl
inc eax
cmp eax, 4
jl 0x10014a9d
push 8
push 0
push dword [ebp + 0x78]
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 0x78]
lea eax, [ebp + 0x60]
push eax
push 0x40
push 0x1005a948
call fcn.10014839
add ebp, 0x6c
leave
ret 0xc