joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f820c
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x6a62f8
mov dword [0x6a62f8], 0x114
call fcn.0040ac1b
mov edi, eax
xor eax, eax
jmp 0x497ab5
lea ecx, [eax + 1]
imul ecx, ecx, 0x4f5a
xor cx, word [eax*2 + 0x59d19c]
inc eax
mov word [ebp + eax*2 - 0x30a], cx
cmp eax, 5
jl 0x497ab5
lea edx, [ebp - 0x308]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, dword [eax + 0x3c]
mov edx, dword [0x6a62fc]
add esi, eax
push 0x510774
ret
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x10043a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x114
push 0
push 0x6a62f8
mov dword [0x6a6410], eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x497a98

Function at 0x5051cd
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov edi, edi
lea edx, [eax + 1]
imul edx, edx, 0x22de
xor dx, word [eax*2 + 0x59d6c0]
inc eax
mov word [ebp + eax*2 - 0x436], dx
cmp eax, 8
jl 0x438824
mov ebx, dword [ebp + 8]
mov esi, dword [sym.imp.msvcrt.dll_sprintf]
push ebx
lea eax, [ebp - 0x434]
push eax
push ecx
call esi
add esp, 0xc
jmp dword [0x438864]
push ebp
mov ebp, esp
sub esp, 0x540
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov dword [ebp - 0x538], ecx
jmp 0x438820

Function at 0x50a2f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
lea ecx, [eax + 1]
imul ecx, ecx, 0x33d6
xor cx, word [eax*2 + 0x59d218]
inc eax
mov word [ebp + eax*2 - 0x10a], cx
cmp eax, 0xc
jl 0x50a30c
xor eax, eax
lea edx, [eax + 1]
imul edx, edx, 0x5ec5
jmp dword [0x50a341]

Function at 0x511efc
Capabilities:
Receive data
Receive data on socket

Disassembly:
push 0
push eax
mov eax, dword [ebp + 8]
lea ecx, [esi + eax]
push ecx
push ebx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
jle 0x4a0c3e
mov eax, dword [0x6a6540]
add esi, edi
mov dword [ebp - 8], esi
test eax, eax
je 0x48064f
fild dword [ebp - 4]
sub esp, 0xc
fstp dword [esp + 8]
fild dword [ebp - 8]
fstp dword [esp + 4]
fild dword [ebp + 0xc]
fstp dword [esp]
call eax
cmp esi, dword [ebp + 0xc]
jl 0x511f16
jmp dword [0x480662]
cmp edi, 0xffffffff
pop edi
jne 0x4a0c51
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [0x6a653c]
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
jle 0x4a0c51
push edi
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x100000
jle 0x480606
mov eax, 0x100000
jmp 0x480606
Function at 0x530006
Capabilities:
Encode data using xor
Send data
Send data on socket

Disassembly:
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004419d3
mov esp, ebp
pop ebp
ret
call esi
and eax, 0x800000ff
jns 0x503582
dec eax
or eax, 0xffffff00
inc eax
cmp byte [ebp - 0x54], 0
mov byte [ebp - 0x53], al
je 0x5035a1
mov cl, al
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x503593
push 0
push 0x50
lea eax, [ebp - 0x58]
push eax
push edi
call dword [sym.imp.WS2_32.dll_send]
cmp byte [ebp - 0x54], 0
je 0x476b86
mov cl, byte [ebp - 0x53]
xor eax, eax
xor byte [ebp + eax - 0x52], cl
inc eax
cmp eax, 0x4a
jl 0x5035bf
jmp dword [0x5035d3]
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.msvcrt.dll_rand]
push edi
mov edi, dword [0x6a653c]
call esi
cdq
mov ecx, 0x3e8
idiv ecx
mov dword [ebp - 0x50], 0xa
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x54], 1
mov word [ebp - 0x58], dx
mov edx, ecx
sub edx, dword [ebp - 0x58]
mov word [ebp - 0x56], dx
jmp 0x50356e

Function at 0x5573d0
Capabilities:
Allocate or change rwx memory

Disassembly:
cmp eax, 6
jne 0x442ef3
mov eax, dword [0x6a6300]
cmp eax, 1
jne 0x442ed1
lea esi, [edi + 0x15]
jmp 0x541809
cmp eax, 2
jne 0x442ee2
lea esi, [eax + 0x14]
jmp 0x541809
cmp eax, 3
jne 0x541809
lea esi, [eax + 0x14]
jmp 0x541809
cmp eax, 0xa
jne 0x541809
jmp dword [0x442f05]
mov dword [ebx + 4], edx
movzx eax, word [0x65f0d4]
mov word [ebx + 8], ax
movzx edx, byte [0x65f0d6]
mov byte [ebx + 0xa], dl
mov eax, dword [0x65f07c]
mov dword [ecx], eax
mov edx, dword [0x65f080]
mov dword [ecx + 4], edx
mov eax, dword [0x65f084]
mov dword [ecx + 8], eax
mov edx, dword [0x65f088]
push 0x4e86ec
ret
mov dword [0x65f5ab], edx
adc eax, edi
mov dword [0x65f5af], eax
lea ecx, [ebx + 0x100]
mov dword [0x65f0cd], ecx
lea eax, [ebp - 8]
cdq
mov dword [0x65f5c0], edx
mov edx, dword [ebp - 0x14]
mov dword [0x65f5bc], eax
movzx eax, word [ebp - 0xc]
mov dword [ebx + 0x400], edx
movzx edx, byte [ebp - 0xa]
mov dword [ebx + 0x404], esi
mov word [ebx + 0x408], ax
mov byte [ebx + 0x40a], dl
mov eax, dword [0x65f0cc]
mov dword [ebx], eax
mov edx, dword [0x65f0d0]
jmp 0x4c898e
mov dword [0x65f529], edx
mov edx, dword [ebp + 0x10]
mov dword [0x65f52d], eax
mov eax, dword [ebp + 0x14]
mov dword [0x65f533], edx
mov dword [0x65f547], eax
xor eax, eax
mov dword [0x65f541], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [0x65f53d], 0x7ffeffff
mov dword [0x65f551], 0x3000
mov dword [0x65f560], 0x40
mov edx, ebx
add edx, 0x400
jmp 0x4dbc24
mov ebx, dword [0x6a6658]
cmp ebx, edi
jne 0x541837
push 0x40
push 0x3000
push 0x1000
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
mov dword [0x6a6658], ebx
jmp 0x54184b
mov eax, dword [0x6a665c]
push eax
call fcn.0042ee78
mov ebx, dword [0x6a6658]
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
jmp 0x51cafe
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x6a62fc]
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], 0xb8d18b4c
mov word [ebp - 0xc], 0x50f
mov byte [ebp - 0xa], 0xc3
jmp 0x442eb2
Function at 0x5686eb
Capabilities:
Parse pe header

Disassembly:
jne 0x568701
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x568705
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jmp 0x4452e8

Function at 0x56f5e6
Capabilities:
Get hostname

Disassembly:
push 0xff
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x3e0]
push ecx
lea edx, [ebp - 0x10c]
push edx
mov dword [ebp - 0x3e0], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x53da10
lea ecx, [eax + 1]
imul ecx, ecx, 0x7b11
push 0x510910
ret
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.004419d3
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x3e0]
push 1
lea eax, [ebp - 0x3dc]
push eax
push 0
push 0
mov byte [ebp + edx - 0x10c], 0
mov dword [ebp - 0x3dc], 0x1a8
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
lea eax, [ebp - 0x3b8]
push 0x4c0cd4
ret
push ebp
mov ebp, esp
sub esp, 0x3e8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], ebx
test eax, eax
je 0x50a4a5
test ebx, ebx
je 0x50a4a5
jmp 0x4a70d4
Function at 0x57374b
Capabilities:
Encode data using xor
Terminate process

Disassembly:
xor ebx, ebx
xor esi, esi
push edi
mov edi, edx
mov dword [ebp - 0x128], ecx
mov byte [ebp - 0x120], 0xb8
mov dword [ebp - 0x11b], 0x3e8
mov word [ebp - 0x117], 0xc200
mov dword [ebp - 0x113], 0x340fd48b
mov byte [ebp - 0x10f], 0xc3
cmp eax, 6
jne 0x57d73c
push 0x455468
ret
mov edx, dword [0x6a6664]
push edx
mov ebx, eax
call fcn.0042ee78
mov eax, dword [0x6a6660]
add esp, 4
xor ebx, ebx
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x124]
push 0x40
push 0x3000
push 0x43f0bc
ret
lea ecx, [eax + 1]
imul ecx, ecx, 0x2d67
xor cx, word [eax*2 + 0x59d2a0]
inc eax
mov word [ebp + eax*2 - 0x10e], cx
cmp eax, 6
jl 0x4eb4ca
push ebx
push ebx
lea edx, [ebp - 0x10c]
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x534c70
jne 0x506b68
mov esi, 0x1a6
jmp 0x534c77
cmp eax, 0x3839
jne 0x506b7d
mov esi, 0x1a8
jmp 0x534c77
cmp eax, 0x3ad7
jne 0x506b92
mov esi, 0x1ad
jmp 0x534c77
xor eax, eax
jmp 0x4eb4ca
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0x18
mov word [ebp - 0x115], ax
mov eax, dword [0x6a6660]
mov dword [ebp - 0x11f], esi
cmp eax, ebx
jne 0x4e1e68
push 0x40
push 0x3000
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebp - 0x120]
mov edx, dword [ebp - 0x11c]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x118]
mov dword [eax + 4], edx
mov edx, dword [ebp - 0x114]
mov dword [eax + 8], ecx
jmp dword [0x534ccf]
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x124], eax
mov eax, dword [0x6a62fc]
jmp 0x41eb52
cmp eax, 0xa
jne 0x534c77
mov eax, dword [0x6a6304]
cmp eax, 0x2800
jne 0x57d75f
mov esi, 0x1a3
jmp 0x534c77
cmp eax, 0x295a
jmp 0x506b58

Function at 0x586a7e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x6a640c]
lea edx, [ecx + eax*2]
xor eax, eax
mov dword [esi], edx
test edi, edi
jle 0x40ac15
lea ebx, [ebx]
mov edx, dword [esi]
lea ecx, [eax + 1]
imul ecx, dword [ebp + 8]
xor cx, word [ebx + eax*2]
inc eax
mov word [edx + eax*2 - 2], cx
cmp eax, edi
jl 0x40abfa
mov eax, esi
pop ebp
ret 8
push ebp
mov ebp, esp
cmp byte [0x6a6650], 0
jne 0x40abdc
push 0x1000
call dword [sym.imp.msvcrt.dll_malloc]
add esp, 4
mov dword [0x6a640c], eax
mov byte [0x6a6650], 1
jmp dword [0x586ab0]
Function at 0x46b1c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x433015
lea edi, [esi - 0x32015]
mov dword [edi + 0x5b0b8], 0xf98e677e
push edi
or ebp, 0xffffffff
jmp 0x46b1ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x46b1f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b1e0
mov eax, 1
add ebx, ebx
jne 0x46b203
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46b214
jne 0x46b233
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b233
dec eax
add ebx, ebx
jne 0x46b220
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x46b1f8
add ebx, ebx
jne 0x46b22f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46b285
xor ecx, ecx
sub eax, 3
jb 0x46b24b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x46b2ba
sar eax, 1
mov ebp, eax
jmp 0x46b256
add ebx, ebx
jne 0x46b256
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b224
inc ecx
add ebx, ebx
jne 0x46b264
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46b224
add ebx, ebx
jne 0x46b271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46b266
jne 0x46b282
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46b266
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46b2a4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46b296
jmp 0x46b1e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46b2a4
add edi, ecx
jmp 0x46b1e6
pop esi
mov edi, esi
mov ecx, 0xcbe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x46b2c2
cmp byte [edi], 0xd
jne 0x46b2c2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x46b2c7
lea edi, [esi + 0x65000]
mov eax, dword [edi]
or eax, eax
je 0x46b336
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x6b000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x6b0c8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x46b2f4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6b0cc]
or eax, eax
je 0x46b330
mov dword [ebx], eax
add ebx, 4
jmp 0x46b311
call dword [esi + 0x6b0dc]
mov ebp, dword [esi + 0x6b0d0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0x6b391]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x46b382
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401083
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm0, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm3, mm4
punpckhwd mm5, mm6
movq qword [edi - 0x10], mm0
paddd mm3, mm5
add esi, 8
movq qword [edi - 8], mm3
sub eax, 4
jge 0x401030
add eax, 4
jle 0x4010b6
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x401089
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x424738
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x552e80ec
add edi, dword [ebp + 0x4aa532f1]
push ebp
jbe 0x42478b
cmpsb byte [esi], byte es:[edi]
in eax, 0xbb
pop ebp
enter 0xe4, 0xfffffffffffffffe
xor eax, 0xa57c9b24
push ecx
xor ch, byte [esi + 0x19c06a43]
loop 0x424749
push ss
push ds
out 0xbe, eax
and ebx, eax
push ds
mov ebp, 0xe9c259e7
mov ch, byte [ecx]
pop edx
fst dword [ebp - 0x17]
push ebp
sub dword [ebp - 0x2b976bd7], edx
push 0x2b972bd4
xchg edi, eax
jmp 0x4247d4
lahf
jecxz 0x4247ec
loop 0x4247e9
and eax, 0x67982498
invalid
pop ecx
aad 0x69
salc
sub al, 0x92
and dword [ebp + 0x5fe35ce0], ebx
and ebx, dword [esi - 0x279a61de]
invalid
lcall 0x57eb, 0x54e89519
sub dl, byte [ecx - 0x2f936ed3]
outsd dx, dword [esi]
call 0x2a9a3345
xchg ecx, eax
sub eax, 0x6fd06c91
shr dword [esi], cl
xchg edx, eax
popfd
loopne 0x42485d
loop 0x424858
daa
lcall 0xd66a, 0xd76b9419
and al, 0x9b
jmp 0x2ad671b8

Function at 0x4545e8
Capabilities:
Encode data using xor

Disassembly:
ret 0x7c0d
cld
pop ebx
cli
sbb eax, 0xdccca1e3
into
dec eax
jns 0x45461c
xor byte [edx + 0x6e98b2d1], cl
jecxz 0x454627
popal
add dh, bl
ret 0xf195
insd dword es:[edi], dx
popal
test dword [edi - 0x4d1eac71], eax
loope 0x45459c
loope 0x45459c
mov dl, 0x4e
dec esi
xor bh, ah
mov ecx, 0x4efa88b9
inc eax
cmp dword [ecx + 0x7661eb45], edx
mov bh, 0x72
dec ebx
fldcw word [ebx]
movsd dword es:[edi], dword [esi]
jo 0x4545e9
div bl
jae 0x4545e1
ror dh, 1
cwde
cli
jae 0x4545b2
mov edi, 0x9f877f45
xchg dl, dl
das
sub byte [esi + 0x67], 0x64
cmovl ebp, dword [eax + 0x20]
xchg ecx, eax
jecxz 0x454686
sahf
jg 0x4545c5
test dword [edi], 0x67467f53
dec ecx
dec ecx
mov ebp, 0x79f247f0
and eax, 0x17537270
fist word [eax - 0x38]
int1
xor esp, dword [edi + ecx*2 + 0x2b814e8c]
scasb al, byte es:[edi]
jmp 0xfab62130
pop ebx
fadd qword [0x6d183692]
sbb byte ss:[ebp - 0x5a], ch
Function at 0x47f5e1
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x23
push ecx
lds edi, [ebp - 0x4c]
xor byte [eax + eax - 0x87fec6f], 0x9b
mov dword [ebp - 0x6f], eax
jns 0x47f623
mov eax, dword [0xd216217d]
mov bh, 0x54
cmpsd dword [esi], dword es:[edi]
dec ebp
mov dword [0x67c4a1f2], eax
in eax, 0xb6
ret
xchg edi, eax
add eax, 0x55b20a00
loop 0x47f5e7
add al, byte [ebx - 0xe]
push ss
add eax, 0x98b577
loope 0x47f632
adc al, 0x28
adc dword [0x9470c419], esi
vpsadbw xmm0, xmm0, xmm3
push ebx
aaa
sub byte [ecx - 0x10], 0x16
mov esi, 0x219dde00
ficomp word [ebp - 0x597bdddf]
cmp dl, dl
add al, 0xcb
and al, byte [esi - 0x34fb2dc8]
cli
adc dword fs:[edx], 0x16f6ffb7
xor eax, 0xf3e4612c
and eax, 0x699d451c
inc edi
inc ecx
cld
out 0x36, al
inc edi
sbb eax, 0x129f3ff6
xor byte ds:[ecx], ch
mov dword [ebp + 0x11], ebx
salc
stosb byte es:[edi], al
inc edi
or al, 0x32
mov bl, 0xf5
xchg ebx, eax
mov byte [0xe0ce8855], al
test byte [ebx + edx*8 - 0x1b], 0x13
push ebx
push ds
loop 0x47f62f
jo 0x47f607
clc
leave
push esp
jecxz 0x47f623
inc ebp
push esp
stosb byte es:[edi], al
test eax, 0x6366c441
add dword [ebp + 0x57], 0x545f174
push ss
call 0xf6cdbe5f
outsd dx, dword [esi]
sbb ebp, dword [eax + 0x38]
movsb byte es:[edi], byte [esi]
jp 0x47f681
imul esp, esi, 0xd
out 0x3d, al
fincstp
push ds
xchg esp, eax
ret 0x554b

Function at 0x49ca2c
Capabilities:
Encode data using xor

Disassembly:
sub dword [edi], 0x36
jae 0x49ca4c
stosb byte es:[edi], al
std
inc esp
or dl, dh
inc edx
insb byte es:[edi], dx
out 0x1d, eax
push edx
fdiv qword [esi + 0x46b0df72]
adc esi, dword [esi - 9]
out dx, al
mov eax, 0xe75bd73a
dec edi
ror edi, cl
mov ch, bl
in eax, 0x82
pushfd
hlt
sbb al, 9
mov eax, 0xaaca94e8
mov bh, 0x68
aad 0x33
ja 0x49ca7d
lds esp, [ecx]
pop es
int1
push ebp
aas
lds edx, [0x5f96b68]
inc edx
push 0xe94dd0b7
jmp 0x49c9d9
jmp 0x440f553c
xchg edi, eax
movsb byte es:[edi], byte [esi]
sahf
pop edi
push cs
dec ecx
sal dl, 0x9f
aad 0xaf
adc byte ds:[ecx - 0x29940f28], cl
adc byte [ecx - 0x29940f28], cl
cmc
scasb al, byte es:[edi]
pop ds
xor edx, 0x9fb4d600
cmpsb byte [esi], byte es:[edi]
sti
test byte [esp + 0x4d], bl
movzx ecx, bx
xor dl, byte [esi - 0x59]
xchg ecx, eax
jg 0x49ca89
or eax, 0x3be967ce
les ecx, [esp + ebx*4 + 0x1c]
push esp
mov bh, 0x5f
call 0x7d64e2e2
imul edx, dword [edx - 0x17], 0xa746e83a
retf
Function at 0x605e28
Capabilities:
Encode data using xor

Disassembly:
cmc
outsd dx, dword [esi]
xlatb
enter 0xffffffffffffe456, 0xffffffffffffff92
in eax, dx
stosd dword es:[edi], eax
test byte [eax - 0x328e4855], 0xd4
or dword [edx - 0x5eb8c8b3], ebp
salc
popal
xchg ecx, eax
or al, 0xde
mov dl, 0xc4
scasd eax, dword es:[edi]
pop edx
aas
fisub dword [ecx + 0x6f]
mov ecx, 0x99b7f68d
and bl, byte [ecx]
adc edi, dword [esi - 0x2d]
mov ebp, 0x6fb8127f
push esi
add ah, byte [eax - 0x39196ab1]
test byte [ecx + 0x5e72a8e], 0xc8
mov dl, 0xf4
pushal
enter 0xfffffffffffff4b2, 0x60
sub byte [ebx], cl
xor eax, 0x9ced673b
in al, dx
push esp
xchg cl, bh
mov byte [0x17668eaf], al
popal
pop esp
mul byte [ecx]
adc al, 0x4e
cwde
in eax, dx
mov esi, dword [edi - 0x5e]
mov word [ecx], cs
lcall 0xb87b, 0x8c749b2e
lea esi, [0xddf54577]
xor eax, 0xddf54577
das
stosb byte es:[edi], al
push ds
ja 0x605da3
sbb eax, 0xf1cde01b
mov ecx, 0x9e44a4c9
aaa
or al, 0xb2
jno 0x605de3
mov esp, 0x4edc3c1b
sbb edi, dword [esp + ebx*8]
cmp al, 0xdc
dec esi
push cs
jle 0x605e26
or ecx, dword [eax + 0x59]
dec edx
daa
jg 0x605e0e
rol ebp, 1
mov eax, dword [0x319df23b]

Function at 0x6294a5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x632378
cmp edx, dword [eax]
je 0x6294c7
add eax, 8
inc ecx
cmp eax, 0x632408
jl 0x6294b8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x632378]
jne 0x6295f5
mov eax, dword [0x63bd00]
cmp eax, 1
je 0x6295cf
test eax, eax
jne 0x6294f8
cmp dword [0x6322a4], 1
je 0x6295cf
cmp edx, 0xfc
je 0x6295f5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62952f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629e90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062a2c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629572
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062a2c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ec1c
push edi
call fcn.0062be60
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629e90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629ea0
lea eax, [ebp - 0xa0]
push 0x62ebfc
push eax
call fcn.00629ea0
push dword [esi + 0x63237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629ea0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062bdd4
add esp, 0x2c
pop edi
jmp 0x6295f5
lea eax, [ebp + 8]
lea esi, [esi + 0x63237c]
push 0
push eax
push dword [esi]
call fcn.0062a2c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403550
Capabilities:
Delete file
Enumerate gui resources

Disassembly:
mov eax, dword [0x49e4dc]
mov ecx, dword [0x49b3e4]
sub esp, 0xc2c
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40363f
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], eax
cmp dword [0x49e4dc], 0x959
jne 0x403625
push 0
push 0
call edi
push 0
push 0
call ebx
push 0
call ebp
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
lea eax, [esp + 0x1c]
push eax
push 0
call esi
push 0
push 0
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
lea edx, [esp + 0x43c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call esi
push 0
push 0x402ca0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov eax, dword [esp + 0x14]
push eax
call fcn.004033b0
add dword [esp + 0x14], 8
sub dword [esp + 0x18], 1
jne 0x403590
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret