joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4423c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4423f3
push esi
call fcn.00450780
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4423ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x442479
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x442462
mov eax, dword [esi + 8]
test eax, eax
je 0x442417
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44245e
cmp eax, 2
je 0x442462
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x44240a
cmp eax, 3
je 0x44243d
cmp eax, 1
jne 0x44240a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x44240a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x44240a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004424a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x442488
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004424a0
add esp, 4
pop esi
ret

Function at 0x442d10
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x442d31
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x442d31
mov eax, dword [eax + 0x44]
test eax, eax
je 0x442d31
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4709dd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x470a15
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046ea94
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046ea6c
jmp 0x470a21
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4720cb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47210d
call fcn.00477b87
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47210d
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x472104
xor eax, eax
jmp 0x472115
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047211b
pop edi
pop esi
pop ebx
ret 4
Function at 0x4780b7
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4780e5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x478103
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047801d
jmp 0x478103
mov eax, dword [esi + 0x14]
test eax, eax
je 0x478103
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047801d
test edi, edi
mov eax, edi
jne 0x4780ed
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x405155
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], edx
push edi
mov edx, ecx
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], edx
mov edi, dword [ecx]
and edi, 7
cmp dword [ebp - 4], 5
jb 0x40529a
sub dword [ebp - 4], 4
add dword [ebp + 8], 5
push ebx
push esi
mov ecx, dword [ebp - 4]
lea esi, [eax + edx]
lea ebx, [edx + ecx]
cmp esi, ebx
jae 0x40519c
mov cl, byte [esi]
and cl, 0xfe
cmp cl, 0xe8
je 0x40519c
inc esi
jmp 0x40518b
mov ecx, esi
sub ecx, eax
mov eax, esi
sub ecx, edx
sub eax, edx
cmp esi, ebx
jae 0x405286
cmp ecx, 2
jbe 0x4051b7
xor edi, edi
jmp 0x4051e1
shr edi, cl
test edi, edi
je 0x4051e1
cmp edi, 4
ja 0x40527b
cmp edi, 3
je 0x40527b
mov ecx, edi
shr ecx, 1
mov cl, byte [ecx + esi + 1]
inc ecx
test cl, 0xfe
je 0x40527b
movzx ecx, byte [esi + 4]
lea ebx, [ecx + 1]
test bl, 0xfe
jne 0x40527b
movzx ebx, byte [esi + 3]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 2]
shl ecx, 8
or ecx, ebx
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
mov ebx, ecx
mov ecx, dword [ebp + 8]
add ecx, eax
add eax, 5
cmp dword [ebp + 0x10], 0
mov dword [ebp - 8], ecx
je 0x405223
add ebx, ecx
jmp 0x405225
sub ebx, ecx
test edi, edi
je 0x405258
and edi, 6
mov edx, ebx
shl edi, 2
mov ecx, edi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x405253
mov edx, 0x100
shl edx, cl
dec edx
xor ebx, edx
cmp dword [ebp + 0x10], 0
je 0x405250
add ebx, dword [ebp - 8]
jmp 0x405253
sub ebx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
xor edi, edi
mov ecx, ebx
mov byte [esi + 1], bl
shr ecx, 8
mov byte [esi + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [esi + 3], cl
mov byte [esi + 4], bl
jmp 0x405182
or edi, 8
shr edi, 1
inc eax
jmp 0x405182
push 2
pop edx
pop esi
shr edi, cl
cmp edx, ecx
mov edx, dword [ebp + 0xc]
sbb ecx, ecx
pop ebx
not ecx
and ecx, edi
mov dword [edx], ecx
pop edi
leave
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0xa365cd8
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x52156984
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x17f27234
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x2f5b67aa
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x4027b9
Capabilities:
Get common file path
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.00408dc0
mov eax, dword [0x839d78]
mov ecx, dword [0x838cc8]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x40288e
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x839d78], 0x959
jne 0x40287c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SleepEx]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0xc00]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call fcn.0040261e
add edi, 8
dec ebx
jne 0x4027e5
pop edi
pop ebx
pop esi
leave
ret
Function at 0x403780
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a0c8]
jne 0x40378a
repz ret
jmp fcn.00405cee

Function at 0x405914
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403aff
and dword [ebp - 4], 0
cmp dword [0x41b704], 0
mov ebx, eax
jne 0x4059c5
push 0x401920
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x405a76
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401914
push edi
call esi
test eax, eax
je 0x405a76
push eax
call fcn.00403a8d
mov dword [esp], 0x401904
push edi
mov dword [0x41b704], eax
call esi
push eax
call fcn.00403a8d
mov dword [esp], 0x4018f0
push edi
mov dword [0x41b708], eax
call esi
push eax
call fcn.00403a8d
mov dword [esp], 0x4018d4
push edi
mov dword [0x41b70c], eax
call esi
push eax
call fcn.00403a8d
pop ecx
mov dword [0x41b714], eax
test eax, eax
je 0x4059c5
push 0x4018bc
push edi
call esi
push eax
call fcn.00403a8d
pop ecx
mov dword [0x41b710], eax
mov eax, dword [0x41b710]
cmp eax, ebx
je 0x405a1d
cmp dword [0x41b714], ebx
je 0x405a1d
push eax
call fcn.00403b08
push dword [0x41b714]
mov esi, eax
call fcn.00403b08
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405a1d
test edi, edi
je 0x405a1d
call esi
test eax, eax
je 0x405a14
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405a14
test byte [ebp - 0xc], 1
jne 0x405a1d
or dword [ebp + 0x10], 0x200000
jmp 0x405a56
mov eax, dword [0x41b708]
cmp eax, ebx
je 0x405a56
push eax
call fcn.00403b08
pop ecx
test eax, eax
je 0x405a56
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x405a56
mov eax, dword [0x41b70c]
cmp eax, ebx
je 0x405a56
push eax
call fcn.00403b08
pop ecx
test eax, eax
je 0x405a56
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41b704]
call fcn.00403b08
pop ecx
test eax, eax
je 0x405a76
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x405a78
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x222a6b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15c0000]
push edi
or ebp, 0xffffffff
jmp 0x222a6d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x222a6d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x222a6c8
mov eax, 1
add ebx, ebx
jne 0x222a6eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x222a6fc
jne 0x222a71b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x222a71b
dec eax
add ebx, ebx
jne 0x222a708
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x222a6e0
add ebx, ebx
jne 0x222a717
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x222a76d
xor ecx, ecx
sub eax, 3
jb 0x222a733
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x222a7a2
sar eax, 1
mov ebp, eax
jmp 0x222a73e
add ebx, ebx
jne 0x222a73e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x222a70c
inc ecx
add ebx, ebx
jne 0x222a74c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x222a70c
add ebx, ebx
jne 0x222a759
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x222a74e
jne 0x222a76a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x222a74e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x222a78c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x222a77e
jmp 0x222a6ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x222a78c
add edi, ecx
jmp 0x222a6ce
pop esi
mov edi, esi
mov ecx, 0x37e4
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x222a7aa
cmp byte [edi], 0x13
jne 0x222a7aa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x222a7af
lea edi, [esi + 0x1e27000]
mov eax, dword [edi]
or eax, eax
je 0x222a827
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1e2e6d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1e2e79c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x222a7dc
mov ecx, edi
jns 0x222a80b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1e2e7a4]
or eax, eax
je 0x222a821
mov dword [ebx], eax
add ebx, 4
jmp 0x222a7f9
call dword [esi + 0x1e2e7a0]
mov ebp, dword [esi + 0x1e2e7a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x222a85b
sub esp, 0xffffff80
jmp 0x46f1ee
Function at 0x43a5ab
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
fistp dword [0x56ca2602]
cmp eax, 0xe843c495
push 7
push cs
mov bh, byte [edi - 0x5d]
sar byte [edx - 0x1956be21], 0xb2
adc eax, 0xa89b17e0
sbb ecx, dword [ebx + 0x11]
sahf
invalid

Function at 0x43e40b
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
mov ecx, 0xf720d347
inc ebx
cld
push edi
in eax, dx
pop edx
dec ebx
salc
adc eax, 0x935abd7
std
fadd dword [edi]
pop ebx
pushal
sbb al, 0x99
push cs
push cs
xor bh, cl
idiv dword [eax - 0x58f6cfe]
in eax, dx
pushal
add ecx, dword [ebp + 0x6621c9e6]
add eax, 0xc776cf4
mov ebx, 0xed3a2e09
aad 0x36
xor byte [edi - 0x50], dl
add ebp, ecx
add byte [ebx + 0x40], 0x57
jp 0x43e426
cmp al, 0xb8

Function at 0x43fe6b
Capabilities:
Encode data using xor

Disassembly:
dec ecx
push cs
jae 0x43fe9c
mov byte [0xe0737eb0], al
xchg ebx, eax
call 0xbb1119f5
call 0xe7b394ee
xchg ebp, eax
invalid
retf 0x2c39

Function at 0x4582db
Capabilities:
Encode data using xor

Disassembly:
invalid
aas
lodsd eax, dword [esi]
insd dword es:[edi], dx
nop
inc esp
cld
cwde
push edi
cli
and al, byte [ecx + ecx*4]
loope 0x4581f0
add dword [esi + 0x1c], edx
outsd dx, dword [esi]
add edx, dword [ebx - 0x1640f22b]
jnp 0x4582b3
ljmp 0x41b2:0x4361be43
add byte [ebp - 0x467dc248], al
push esi
test dword [eax + 0x56b9823d], edi
jp 0x458248
daa
mov byte [ebx + esi - 0x39], dl
sbb dword [eax + 0x2be33d12], ebx
clc
xor al, 0xee
movsd dword es:[edi], dword [esi]
dec edi
das
sbb dword [edi - 0x2b], 0x5e
xor dword [eax], esi
cmp al, 0x38
jno 0x458354
xlatb
xor byte [ebp - 0x5bf4a88], dl
inc eax
cli
inc eax
cli
jne 0x9b86863d
mov al, byte [0xea42e6b3]
pop esi
push esi
cmp edi, dword [esi + 0x38224aa9]
les edx, [edi + 0x40839930]
add eax, 0x1cf22986
mov ah, 0x4d
arpl word [edx], si
pushfd
and al, 0xb
mov eax, dword [edx]
mov bl, 0xa9
salc
loop 0x45830b
pop ebp
or ecx, dword [ebx + 0x6d]
fsubp st(0)
jno 0x4582b2
sbb dword [esi + 0x7f4229cf], 0xbe2c7893
call 0x3b90ffea
jmp 0x45834b
jmp 0xb45194c7
mov ch, 0x48
sub byte [esi + 0x132ea625], 0x30
fild qword [ebp - 0x2aa4dac9]
in al, dx
ret 0x765d

Function at 0x487d1b
Capabilities:
Encode data using xor

Disassembly:
add dword [eax - 0x13], ecx
stosd dword es:[edi], eax
sub al, 0xec
mov bl, 0x34
xchg ecx, eax
inc ecx
mov ah, 0x2d
cmp eax, 0x9faa76e3
ja 0x487d80
jmp 0x487ceb
Function at 0x4ab933
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x2816f59c]
rep lodsb al, byte [esi]
lodsb al, byte [esi]
lodsb al, byte [esi]
sub eax, 0xb05c558d
mov fs, word [ebp - 0x27c17af3]
dec edx
mov bh, 0xe
fmul dword ds:[edx - 0x49]
push cs
pop es
bound edx, qword [esi + 0x65c92721]
fmul qword [esi - 0x6fc22e10]
loopne 0x4ab93f
jl 0x4ab98d
sub al, 0xdf
pop ds
dec esp
dec edx
popal
pushal
loopne 0x4ab923
pop ss
call 0xa927369f
jns 0x4ab986
jge 0x4ab901
test al, 0x79
pop esi
int 0x36
and al, byte [esi]
push ds
mov eax, dword [0x4c1111e6]
jp 0x4ab8f1
invalid
lodsb al, byte [esi]
adc byte [edi], cl
wait
stc
xchg byte [ebp - 0x17dfb46f], bh
adc byte [edi - 7], ah
and al, 0x8f
inc edi
inc esi
pop eax
sbb eax, 0xa680d32d
cmpsb byte [esi], byte es:[edi]
test al, 0xd7
jge 0x4ab953
test al, 0x17
mov edi, 0x1c299b4f
cwde
dec edi
wait
sub dword [eax + ebx*4], ebx
inc ecx
xlatb
sbb dword [edi - 0x13af68b2], ebx
movsb byte es:[edi], byte [esi]
pop es
test dword [ecx - 0x2c], ebp
dec ecx
xchg ebp, eax
aam 0xb2
scasb al, byte es:[edi]
fisttp qword [eax - 0x733a2c3f]
js 0x4ab8f8
mov bh, 0x52
pop edx
xchg edi, eax
les esi, [edx - 0x2a]
xchg byte [ecx - 0x2af30a56], al
push esp
lahf
pop eax
fidivr dword [eax - 0x30ef34ca]
mov esi, 0x731cf5ec
mov esp, 0x7728b545
sub dword [0xbc4988d7], edx
retf
jae 0x4ab94b
inc ebp
mov ch, 0x28
ja 0x4ab9bd
adc eax, 0xbc4988d7
ja 0x4ab9d4
push ebp
jo 0x4ab9d1
dec esp
cld
into
xor esi, dword [esi + 0x58]
faddp st(3)
call 0x51a6a8db
ror dword [ecx], cl
push 0x6a72f76d
aad 0x88
into
push ss
fucom st(4)
push esi
add esi, 0x88d93dc8
mov eax, 0x2d36c1f7
cmp eax, 0xf7b888d9
sal dword [esi], 0x2d
cmp ebx, edx
xor eax, 0xbf2fb99d
mov esi, 0x5b34ab1d
sub eax, 0xab6c6ca6
insb byte es:[edi], dx
stosd dword es:[edi], eax
mov bl, 0xb3
mov esp, 0x13568d33
xlatb
pop esp
mov esp, 0x7fd3f986
pop ebp
invalid
Function at 0x4c5d3a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cb450
cmp edx, dword [eax]
je 0x4c5d5c
add eax, 8
inc ecx
cmp eax, 0x4cb4e0
jl 0x4c5d4d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cb450]
jne 0x4c5e8a
mov eax, dword [0x4cfb4c]
cmp eax, 1
je 0x4c5e64
test eax, eax
jne 0x4c5d8d
cmp dword [0x4cb394], 1
je 0x4c5e64
cmp edx, 0xfc
je 0x4c5e8a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c5dc4
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c6450
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c6680
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c5e07
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c6680
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c96f8
push edi
call fcn.004c7e50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c6450
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c6460
lea eax, [ebp - 0xa0]
push 0x4c96d8
push eax
call fcn.004c6460
push dword [esi + 0x4cb454]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c6460
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c7dc4
add esp, 0x2c
pop edi
jmp 0x4c5e8a
lea eax, [ebp + 8]
lea esi, [esi + 0x4cb454]
push 0
push eax
push dword [esi]
call fcn.004c6680
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x416900
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0041698f
jae 0x41690e
xor ecx, ecx
call fcn.0041698f
jae 0x41693d
xor eax, eax
call fcn.0041698f
jae 0x41694d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0041698f
adc al, al
jae 0x41692f
jne 0x416979
stosb byte es:[edi], al
jmp 0x416911
call fcn.0041699b
sub ecx, ebx
jne 0x416956
call fcn.00416999
jmp 0x416975
lodsb al, byte [esi]
shr eax, 1
je 0x416983
adc ecx, ecx
jmp 0x416972
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00416999
cmp eax, 0x7d00
jae 0x416972
cmp ah, 5
jae 0x416973
cmp eax, 0x7f
ja 0x416974
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x416911
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x40d070
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00410360
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x423440
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x40d132
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x40d12b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x40d116
lea edx, [esi + 1]
push edx
call fcn.0040be90
mov edi, eax
add esp, 4
test edi, edi
je 0x40d108
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.004105f0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x40d0c2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x40d145
push eax
call fcn.00410790
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0040be90
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x42343c
call fcn.00410560
pop edi
pop esi
pop ebx
add esp, 0x20
ret