joyce8/EMBER2024-capa huggingface dataset:
Function at 0x843f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x843ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x844035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00843e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0x843fc5
mov edi, 0x85e8b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0x844035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00843e00
add edi, 4
add esp, 0xc
cmp edi, 0x85e8c0
jb 0x844000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0x844070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.0084a082
mov esi, eax
add esp, 8
test esi, esi
je 0x844107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x844102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00849946
add esp, 8
test eax, eax
je 0x8440e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0x8440e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00849946
add esp, 8
test eax, eax
jne 0x8440c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0x844102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0x844f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x8599fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0x845002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00848dff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x845002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.008406e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.0084920b
push 0x10
call fcn.008491d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0x844fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.008351c0
jmp 0x844fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00844b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0x844ff0
mov ecx, edi
call fcn.008352c0
push edi
call fcn.008491c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x845021
inc ebx
cmp ebx, 0x20
jb 0x844f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x846250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x85a808
push 0x84a288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x846329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x846329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.008491d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x846329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x846329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x84632c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00846351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x846d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x846d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x846d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x846d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x846d94
push eax
push esi
call fcn.0084920b
add esp, 8
pop esi
ret 0x10

Function at 0x846da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x846e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x846e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x85f320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00848dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x846dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x846e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x846ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x846eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x85f320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00848dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x846eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x846e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x847000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x847131
push esi
call fcn.0084a145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00839080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x847131
push 0
push ebp
call fcn.008393a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00839260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x84708b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.008392f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x847121
push 0x85f918
push edi
call fcn.008483f0
push eax
push ebx
push esi
call fcn.00846f60
push 0x85f8f8
push edi
call fcn.008483f0
push eax
push ebx
push esi
call fcn.00846f60
push 0x85f8d8
push edi
call fcn.008483f0
push eax
push ebx
push esi
call fcn.00846f60
push 0x85f8c0
push edi
call fcn.008483f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00846f60
push 0x85f8a0
push edi
call fcn.008483f0
push eax
push ebx
push esi
call fcn.00846f60
push 0x85f888
push edi
call fcn.008483f0
push eax
push ebx
push esi
call fcn.00846f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x8481b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00848140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00848140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00848140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00848140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x848bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x848c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x85a87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x848c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x848c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x451fc1
Capabilities:
Encode data using xor

Disassembly:
salc
sub al, 0x2a
and byte [edi + ebp*8 - 0x5a], ch
add dword [edx], edx
mov cl, 0x76
in al, 0xb2
fbld tbyte [esi + 0x2b]
dec eax
xchg ebx, eax
mov ch, 0xd3
push edx
loope 0x451f3a
sar dword [edi + 0x51b8d553], 1
jecxz 0x451fbf
add dword [edx - 0x1c], edx
cmc
xchg edx, eax
mov eax, dword [0x1812dd1e]
int 0x50
leave
xchg esp, eax
cmp bh, byte [ecx]
add bh, ch
xchg ebp, edx
xor ch, byte [edi - 0x50]
pop edx
or al, 0xe8
int3
js 0x451ff2
rol dword [eax + esi*4 + 0x75f87df1], 1
xchg esp, eax
int1
jge 0x451f8b
jne 0x451f29
test byte [edi], dh
mov dword fs:[edi + edx*2 + 0x17], eax
invalid
insd dword es:[edi], dx
inc ebp
sub al, 0x27
mov dh, byte [eax]
or edi, dword [0x828d3ebf]
xchg ebx, eax
jo 0x451f90
adc ch, byte [edi + 0x1ce17e40]
mov eax, 0x7c62df51
sbb al, 0xb8
push ecx
fbld tbyte [edx + 0x7c]
insb byte es:[edi], dx
rol esp, 1
xor dh, dl
loopne 0x451fd3
sbb eax, 0x9c06e456
loop 0x452015
ret
sbb dword [edx - 0x712345fb], 0xffffffe1
sbb al, 0x19
adc dword [edi], edi
and al, 0xe1
and byte [ecx], dl
mov dword [edi], 0x32340186
xor al, 0xd1
lcall 0x6236, 0x32879525
or eax, 0x2f07a171
popal
salc
insb byte es:[edi], dx
pop esp
jb 0x451f9c
inc esp
invalid

Function at 0x4944ed
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, ecx
ja 0x494539
movzx edx, byte [eax + 1]
movzx esi, byte [eax + 3]
xor edx, 8
and esi, edx
add eax, 2
cmp esi, 0xf8
jb 0x4944d1
movzx esi, byte [eax - 2]
shl edx, 8
add esi, edx
movzx edx, byte [eax + 1]
and edx, 7
lea edx, [edx + esi*8]
movzx esi, byte [eax]
add eax, 2
shl edx, 8
add edx, esi
mov esi, eax
sub esi, edi
add esi, ebp
shr esi, 1
sub edx, esi
mov ebx, edx
shr ebx, 0xb
mov byte [eax - 4], bl
mov ebx, edx
shr ebx, 0x13
and bl, 7
mov byte [eax - 2], dl
or bl, 0xf0
shr edx, 8
or dl, 0xf8
mov byte [eax - 3], bl
mov byte [eax - 1], dl
jmp 0x4944d1
invalid
Function at 0x49b484
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebx]
push 0
inc edi
add byte [ebx], al
jno 0x49b446
mov ecx, ebx
call dword [eax]
add al, ch
mov eax, dword [ebx]
push ecx
push ecx
xchg edi, eax
add ch, bl
sbb al, 0x24
call dword [eax + 0x24]
lea eax, [eax]
add byte [eax], bl
push eax
call dword [0x8f68]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp]
add byte [esp + 0x4f000220], cl
add byte [esi], al
call 0x6c649d
mov eax, dword [eax]
add byte [esi + 0x5b], bl
mov esp, ebp
pop ebp
fiadd word [eax]
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
add byte [eax], al
inc esp
or byte [eax], al
add byte [ebx - 1], dl
add byte [esi + edx*2], cl
mov esi, eax
mov eax, dword [ebx]
push edi
add byte [eax], al
call dword [eax]
test al, al
je 0x49b4c8
add bh, bh
adc byte [eax + eax*8 + 0x45002674], al
or bh, al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
pushfd
add al, byte [eax]
add cl, al
and eax, 0xbf0d2561
jae 0x49b43d
add byte [ebp + 8], al
mov dword [eax], 1
add byte [edx + eax + 0x25c10000], bl
popal
and eax, 0x8573bf0d
mov esi, 0xdd75bb45
fidivr dword [ebx - 0x633affbb]
rcr byte [0xfdd1add5], cl
std
in al, dx
cmp al, 0x7e
das
xchg ecx, eax
clc
lodsd eax, dword [esi]
invalid
cmp eax, 0xe1a8359f
mov esi, 0x3e33ee7c
sti
pushfd
inc ecx
cmp byte [edi + 6], dl
mov byte [0x8516412a], al
cwde
jl 0x49b514
mov ch, 0xff
mov bl, ah
invalid
loopne 0x49b49b
in al, 0x49
retf 0x976f

Function at 0x513ffa
Capabilities:
Encode data using xor

Disassembly:
call 0xff530c5a
clc
add eax, 0x3ba6cc11
mov word [esi - 0x6bcc255a], gs
fidiv dword [ebx]
xchg esp, eax
fidiv dword [ebx]
xchg esp, eax
sal dword [esi + ebp*8 + 0x65368f37], cl
mov byte [ecx + 0x19], dh
clc
jae 0x51405d
test eax, 0x66af5c42
lahf
cli
push ebp
movsb byte es:[edi], byte [esi]
mov dword [0x7de595f2], eax
je 0x513fec
sbb ah, bh
and edx, ebx
hlt
invalid
Function at 0x578814
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
add byte [ebp + 0x42c2484], cl
add byte [eax], al
add byte [eax], al
add al, 3
jno 0x578760
push ebx
inc dword [eax]
and al, 0x24
push eax
call 0x1577a8a
add byte [eax], al
mov dword [esp + 0x10], eax
add dword [eax], 0x24
adc byte [eax], al
jne 0x5787db
lea eax, [eax + eax]
push eax
mov dword [esp + 0x14], esi
jl 0x578783
wait
invalid
add al, ch
mov eax, dword [ebx]
push ecx
push ecx
xchg edi, eax
add ch, bl
sbb al, 0x24
call dword [eax + 0x24]
lea eax, [eax]
add byte [eax], bl
push eax
call dword [0x8f68]
mov eax, dword [esp + 0x10]
mov esi, dword [ebp]
add byte [esp + 0x4f000220], cl
add byte [esi], al
call 0x7a382d
mov eax, dword [eax]
add byte [esi + 0x5b], bl
mov esp, ebp
pop ebp
fiadd word [eax]
add byte [ebp - 0x75], dl
in al, dx
and esp, 0xfffffff8
add byte [eax], al
inc esp
or byte [eax], al
add byte [ebx - 1], dl
add byte [esi + edx*2], cl
mov esi, eax
mov eax, dword [ebx]
push edi
add byte [eax], al
call dword [eax]
test al, al
je 0x578858
add byte [ebp + 8], al
mov dword [eax], 1
add byte [edx + eax + 0x68b0000], bl
add bh, bh
push edi
push 0x710370
add byte [eax], al
call dword [eax + 0x20]
mov esi, dword [ecx + 0x17]
sahf
inc edi
ja 0x57887d
pushal
mov bh, 0x43
inc ebx
cmp al, byte [ecx]
and edx, dword [edi]
ja fcn.00578860
nop
out 0x61, al
jmp 0x5788a0
push eax
mul dword [edi + 0xf]
mov bh, 0xb7
add dword [edx*4 + 0x5785b5d1], edi
mov cl, 0x60
push eax
and eax, 0xdb77f081
inc ebx
inc esp
fist dword [ecx + 0x2d]
mov dh, 0xa7
movsd dword es:[edi], dword [esi]
inc edi
mov bh, byte [ebp + 0x5f]
jo 0x5788fe
pop ebp
aad 0xeb
mov bh, 0xc1
lodsb al, byte [esi]
xchg edx, eax
sub al, 0x23
mov ch, 0xc6
clc
sbb al, byte [ecx - 0x19]
fadd dword [edi]
pushal
or eax, 0x514bd1e5
mov edx, ebp
xor byte [0x77152253], ch
in eax, 0x85
xchg byte [ebx - 0x60b65877], ah
invalid
mov dword [0x6733535], eax
jbe 0x578871
push ebp
dec esp
adc bh, dl
xor eax, 0xad8f0106
out 0x3e, eax
push esi
push edi
int3
inc eax
mov ah, 0x6d
inc ecx
xchg esp, eax
mov edx, 0x862bb56f
mov dh, dh
push ecx
aaa
loopne 0x578915
out 0xf1, al
cmp edi, dword [ebx]
pushal
invalid
jge 0x578925
pushal
jbe 0x578939
push cs
pop ebx
pop ds
jbe 0x5788fe
invalid
std
add byte [esi + 0x183c456d], al
fsub st(6)
nop
div bl
mov fs, word [eax]
inc esp
adc eax, 0x2c26507e
sub al, 0x16
push ss
and eax, dword [0x76956a90]
mov eax, 0xcdb73005
rcr dword [edi - 0x55], 0xbd
jne 0x5788cf
inc ebx
xchg dword [ebx + 0x59bc379e], ebp
inc ecx
daa
sub dword [edi - 0x2ac2d42b], eax
xor eax, 0xd4d3b471
stosd dword es:[edi], eax
aas
pushfd
out dx, eax
aad 0x27
mov edi, 0xdef8a5c3
in al, 0x24
cmc
salc
fldenv [ebp + 0x4148c017]
adc dl, byte [esi]
jno 0x578938
xchg ebp, eax
mov ah, 0x6f
mov dword [ecx], edx
sbb edi, dword [ebp - 0x62]
invalid
Function at 0x5b4fc8
Capabilities:
Encode data using xor

Disassembly:
jb 0x5b5037
push 0xee17dd6c
mov edx, 0x88f5e31f
cmc
mov cl, dh
jecxz 0x5b4fbe
cmc
mov cl, dh
daa
aad 0x56
mov ebp, 0xffd47287
add esi, dword [ecx + 0x3ed79ad5]
mov eax, dword [0x2994a771]
pop ecx
and eax, 0x15049b77
les ebx, [edx + 1]
mov eax, dword [0x7125ab93]
cmc
lea ebp, [0x6d651231]
xchg ebx, eax
stosd dword es:[edi], eax
and eax, 0x2d8df571
xor dword [edx], edx
insd dword es:[edi], dx
loop 0x5b500d
cmpsb byte [esi], byte es:[edi]
imul ebp, dword [edi + 0x11585592], 0xb167607c
mov byte [0x62aa57b1], al
xchg ecx, eax
ja 0x5b4fe9
sti
ffreep st(5)
adc cl, 0x69
iretd
shr dword [ecx - 0x31], 1
jle 0x5b4fc7
xchg dword [ebp + 0x257e376c], esp
xor byte [ebp - 0x3a], dh
inc esp
adc esi, esi
jl 0x5b501b
int1
lodsb al, byte [esi]
test bh, ah
idiv dword [eax]
popal
xchg esi, eax
shr byte [ebp + 0x2b546940], 1
mov cl, byte [ebx + 0x1c]
sub esp, esp
dec esi
fldcw word [ecx]
clc
enter 0x4f51, 0x21
bound esp, qword [edi + 0x7e5f3bf0]
or edi, dword [edx + eax*2 + 0x429f7cdd]
out dx, al
popfd
or al, 0xe6
test ch, 0xd9
push ss
add esi, dword [edx - 0x1a]
mov byte [0xe97207e9], al
jg 0x5b508e
mov dword [edi - 0x6f], 0xc67378ac
insd dword es:[edi], dx
sub al, 0xd7
push edx
sahf
ret
or al, byte [eax + 0x45]
sal byte fs:[edi + 0x2c423ebc], cl
salc
dec esp
adc al, 0x15
adc byte [ecx - 0x36], dh
jge 0x5b50ff
aad 0x95
sahf
add dword [edi], 0x50
jmp 0x627af557
and edx, 0xffffffe9
fisubr word [eax - 0x7e]
mov eax, dword [0x925d23c1]
and ebx, dword [ebp - 0x6e]
xchg edi, eax
mov ecx, 0xe3e608a9
jae 0x5b5107
xchg ebx, eax
rcl dword [ecx - 0x4f], 0xfd
xchg dword [0x13bb3cb7], esi
adc eax, 0xaf8375e8
pop dword [ecx - 0x63fda884]
in al, dx
add al, byte [ecx + 0x38fa2b37]
pop ds
daa
sar byte gs:[ecx + 0x33], cl
xchg ecx, eax
cmp eax, dword [edi]
sbb byte [ecx + 7], dh
test byte [esi - 0x7c], dh
aas
shl dword [ecx], 0x8f
and dword [ebx + edi*8 + 0x4f], eax
cmp eax, dword [edi]
xchg ecx, eax
stc
cdq
xchg ebx, eax
invalid

Function at 0x5de670
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
mov al, 0x85
in al, 0x35
pop es
salc
mov dl, 0x57
xor dl, byte [esi + eax*8 + 0x31b781a8]
cmp dword [eax + eax + 0x1a], edi
and byte [ebp + 0x34], dh
xor dword [edi + 0x7c3931], 0x3475201a
push ss
inc eax
jb 0x5de67d
invalid

Function at 0x5f70fe
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0
add al, 0xe1
mov ah, 0xde
inc eax
xlatb
and eax, 0x57ca4f52
vpor ymm4, ymm3, ymmword [esi - 0x3e]
invalid

Function at 0x61a7be
Capabilities:
Encode data using xor

Disassembly:
add byte [ecx - 0x32], bh
pop es
mov esp, dword [ebx + ebx*4 - 0x1ab4847c]
sar dword [eax + 0x2a], 0x45
in al, 0x60
adc eax, edx
and byte [esi + 0x75], cl
mov al, 0x59
inc ecx
xlatb
xor byte [edi], al
invalid
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.13
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0040a800
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402610
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.004128d9
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.004024b0
add esp, 0xc
jmp 0x4011ee
push 0x2000
call fcn.004128d9
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.004024b0
add esp, 0xc
jmp 0x4011ee
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040e7d2
add esp, 0x10
cmp eax, esi
jne 0x4011e9
push dword [esp + 0x5c]
call fcn.0040e5cd
add esp, 4
test eax, eax
jne 0x4011e9
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00408ea0
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40119e.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401212
push ebp
push esi
push 1
push ebx
call fcn.0040eef5
add esp, 0x10
cmp eax, esi
jne 0x4011d0
push ebp
call fcn.0040e5cd
add esp, 4
test eax, eax
je 0x401223
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402610
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.0040a5f0
push dword [esp + 0x14]
call fcn.004128be
push ebx
call fcn.004128be
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401227
push esi
push ebx
push edi
call fcn.0040bca0
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401170
cmp eax, 1
je 0x401261
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401245
cmp dword [esp + 0x10], ecx
jbe 0x4011d3
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d3
cmp eax, 1
jne 0x4011d3
xor esi, esi
jmp 0x4011ec