joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dbe5
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call int.004810d5
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x44dd08
push ecx
lea ecx, [esi + 0x18]
call fcn.0046d405
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x44dd1f
push ecx
lea ecx, [esi + 0x24]
call fcn.0046d315
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49f7b5
Capabilities:
Encode data using xor

Disassembly:
pop eax
cmp eax, 0xdab1a20d
mul byte [ebp - 0x2d]
mov byte [edi + 0x4a], bh
dec edx
leave
pop edi
adc ecx, dword [edx]
adc byte [edx], 0x33
xor ch, byte [edx + 0x6a]
add edi, dword [eax]
pop esi
adc bh, byte [ebp - 0x78]
fild word [edi]
and bl, ch
xchg edi, eax
dec edx
sar ecx, cl
js 0x49f7c0
invalid
Function at 0x4e03d5
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005138c5
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e04f8
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffbf5
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e050f
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffb05
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x55ca15
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xd0
sbb esp, dword [ebp + 0x73309a5f]
add dword [esi + 0x145a0740], esp
loope 0x55ca34
cmpsd dword [esi], dword es:[edi]
push eax
adc dword [eax - 0x5e], eax
add al, 1
shl byte ss:[eax + 0x4f], 1
shl byte [eax + 0x4f], 1
and cl, ah
dec ebx
sti
ror dword [bx], 0x73
mov cl, 0x13
into
xor esp, esi
mov dword fs:[eax], esp
push ebp
call 0x613e7fe6
loopne 0x55c9de
jae 0x55c9e0
pop ss
xchg ecx, eax
mov dh, 0x7a
xchg dword [eax + 0x6b5515b8], esi
outsb dx, byte [esi]
loopne 0x55c9f3
xchg edi, eax
and dword [ecx - 0x21], 0xa7f0acd2
pop ebx
cmpsb byte [esi], byte es:[edi]
or ecx, edi
and dword [edx + 0x53923771], edi
invalid
xchg edx, eax
push ebx
adc dword [ecx + edx], 0xbb635231
push edx
mov byte [esi + 0x56b7e388], 0x7c
in al, 0xcd
add dh, byte [ebp - 6]
adc dword [ecx], esi
push edx
arpl word [ebx - 0x777939ae], di
jecxz 0x55c9f6
push esi
jl 0x55ca26
int 2
jne 0x55ca40
add al, 0x14
xor eax, 0xc29064d7
xchg esi, eax
and dword [edi - 0x190e9861], 0x16ae1564
js 0x55ca30
nop
push ebp
shl dword [ebx], cl
xlatb
cmpsb byte [esi], byte es:[edi]
add bh, 0xe0
fsub dword [0xd3feb722]
cdq
xor eax, 0x513148d5
push ebp
or esi, dword [ebp - 0x48]
adc eax, 0xbe813e92
les edx, [eax - 9]
and eax, 0x66e45883
sbb eax, dword [edx - 0x7f]
ret 0x1337
Function at 0x594cb5
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pop edi
movsd dword es:[edi], dword [esi]
inc edi
enter 0xffffffffffffe4b0, 0xffffffffffffffdd
xchg dword [eax + edx*2], edi
inc ecx
add ch, byte [edx]
xor eax, 0xd81f7826
mov dword [ebx + 0x55], eax
push 0x3465a841
insd dword es:[edi], dx
fst qword [ebx - 0x6c]
cmp dword [ecx + eax*4 - 7], 0x7f15bd50
adc eax, dword [ecx + 0x6631a7d0]
in eax, dx
invalid

Function at 0x5a5fe5
Capabilities:
Encode data using xor

Disassembly:
xor edx, 0x9d90476c
ror ah, 0xd0
pop ds
mov byte [esi], 0x35
mov ecx, 0xa80f9f19
sbb dword [edi - 0x72c457f1], ebx
loope 0x5a602c
shr byte [ecx], 0x50
sbb dword [edi - 0x72c457f1], ebx
loope 0x5a602c
test al, 0x3b
invalid
shr byte [ecx], 0x50
add al, 0x44
xchg esp, eax
stosd dword es:[edi], eax
mov eax, dword [0x80d153c4]
in eax, dx
sti
mov dword [ebx], edi
enter 0xffffffffffffb9f2, 0x5e
lea esp, [esi + 0x28253b53]
mov bl, 0x26
inc edi
xor dword [eax + 0x29], edi
cmp byte [esi - 0x63], bh
loope 0x5a5fd7
mov cl, 0x9c
push ecx
std
nop
xchg edx, eax
jp 0x5a5fe8
jge 0x5a6068
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
insb byte es:[edi], dx
invalid

Function at 0x606255
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
add byte [eax], al
Function at 0x42e7c0
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x42e949
pushal
mov esi, 0x420059
lea edi, [esi - 0x1f059]
push edi
or ebp, 0xffffffff
jmp 0x42e7ea
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x42e7f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x42e7e0
mov eax, 1
add ebx, ebx
jne 0x42e803
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
ja 0x42e7f8
jne 0x42e814
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e7f8
xor ecx, ecx
sub eax, 3
jb 0x42e828
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x42e89a
mov ebp, eax
add ebx, ebx
jne 0x42e833
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x42e840
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x42e864
inc ecx
add ebx, ebx
jne 0x42e850
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
ja 0x42e845
jne 0x42e861
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42e845
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jle 0x42e884
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x42e875
jmp 0x42e7e6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x42e884
add edi, ecx
jmp 0x42e7e6
pop esi
sub edi, dword [edi - 4]
push edi
mov edi, esi
mov ecx, 0x746
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x42e8a6
cmp byte [edi], 0xb
jne 0x42e8a6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x42e8ab
pop edi
mov eax, dword [edi]
or eax, eax
je 0x42e917
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2e068]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2e0cc]
xchg edx, eax
mov al, byte [edi]
inc edi
or al, al
je 0x42e8d3
push edx
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push edx
call dword [esi + 0x2e0d0]
pop edx
or eax, eax
je 0x42e911
mov dword [ebx], eax
add ebx, 4
jmp 0x42e8f0
popal
xor eax, eax
ret 0xc
lea ebx, [esi - 4]
add edi, 4
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x42e948
cmp al, 0xef
ja 0x42e93b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x42e91d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x42e92a
popal
jmp section..text
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x100062fa
pop dword [ebp - 0x30]
mov eax, 0x100062fa
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x342f4
push 0
mov eax, 0xe0cfa14d
sub eax, 0xd0ce60e9
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x34a6
mov edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x30]
mov esi, 0xc7649439
add esi, 0xa50b56ae
add dword [ebp - 0x18], 0x9b146932
mov edi, dword [ebx]
add edi, esi
xor dword [ebp - 0x1c], edi
mov dword [edx], edi
sub dword [ebp - 0x24], esi
add edx, 0x69dfb6d1
sub edx, 0x69dfb6cd
add ebx, 4
loop 0x10006348
add eax, 0xc56b
xor ebx, ebx
add ebx, eax
add eax, 0x9828d372
add eax, 0x67d72c93
mov ecx, 0x10000000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4202b0
Capabilities:
Encode data using xor

Disassembly:
jbe 0x4202db
popfd
xor eax, 0x8d442aa9
retf 0x5d4a
lds esp, [edx]
push ebp
cmp bh, dh
invalid

Function at 0x437350
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 2
jne 0x437382
movzx ecx, word [ebp + 8]
sar ecx, 8
push ecx
mov ecx, dword [ebp - 4]
call fcn.00437250
movzx edx, byte [ebp + 8]
push edx
mov ecx, dword [ebp - 4]
call fcn.00437250
jmp 0x437451
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 1
jne 0x4373ad
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00437250
movzx edx, word [ebp + 8]
sar edx, 8
push edx
mov ecx, dword [ebp - 4]
call fcn.00437250
jmp 0x437451
movzx eax, word [ebp + 8]
cmp eax, 0x7f
jg 0x4373c8
movzx ecx, byte [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.00437250
jmp 0x437451
movzx edx, word [ebp + 8]
cmp edx, 0x7ff
jg 0x437401
movzx eax, word [ebp + 8]
sar eax, 6
or eax, 0xc0
push eax
mov ecx, dword [ebp - 4]
call fcn.00437250
movzx ecx, word [ebp + 8]
and ecx, 0x3f
aas
or ecx, 0x80
push ecx
mov ecx, dword [ebp - 4]
call fcn.00437250
jmp 0x43746f
cmpsb byte [esi], byte es:[edi]
xchg ebp, eax
sbb eax, 0xff7e8240
pop edx
mov word [ebp - 1], gs
or dl, byte [ebx + 0x1f]
mov dl, 0xfe
fdiv st(3), st(0)
xor eax, esi
add ch, byte [0xdf62ea3c]
test dword [edx + 0x42], ebp
sal byte [edx - 0x80], 1
test dword [ebx - 0x4e], ebp
dec esi
or dl, al
mov bl, 0x62
sar dword [edi], cl
add byte [edx], 0xce
inc edx
mov bl, byte [ebx + 0x67]
jns 0x437441
push ds
or ch, byte [esi + 0x55]
xchg ecx, eax
pop ss
jns 0x4373ef
xchg byte [ebx - 0x52], al
jecxz 0x437413
pop ds
xchg esi, eax
out dx, eax
dec edx
mov byte [edi - 0x31], bl
or eax, 0x3d793e6f
lcall 0x74fc, 0x1d6f42aa
rcr dword [edx - 0x24], 0xd2
stosb byte es:[edi], al
push dword [esi - 0x61ed532d]
mov bl, byte [0x4c52ece3]
sbb eax, 0x4c52ece3
sbb eax, 0x5ac174fc
invalid
pop ebx
in al, dx
imul edi, ecx, 0xffffffd3
mov edi, dword [ebx]
cmpsd dword [esi], dword es:[edi]
adc eax, 0xb4a86a25
dec eax
inc edx
test dword [ebp + 0x3bbfe25d], eax
dec esi
daa
xor dl, byte [edx]
xchg byte [eax + 0x75], bh
dec esi
iretd

Function at 0x465520
Capabilities:
Encode data using xor

Disassembly:
lahf
jnp 0x46555a
push ebx
invalid
inc edi
or eax, 0x761620f4
invalid

Function at 0x47c8c0
Capabilities:
Encode data using xor

Disassembly:
xor edi, ebx
popal
outsb dx, byte [esi]
mov dh, 0xa0
xor eax, 0xff6b1949
ja 0x47c906
pop esi
ret 0x804a
clc
xchg edi, eax
xchg byte [esi], dh
outsb dx, byte [esi]
mov eax, dword [0x351bae16]
insd dword es:[edi], dx
pushfd
or dword [edx], ecx
scasb al, byte es:[edi]
sbb esi, dword [0xa099c6d]
xor eax, 0x1005d470
sbb dword [ecx - 0x79796621], 0x115eb0c9
xchg ecx, eax
adc ah, byte [edi + 2]
xor byte [esi], 0xb7
jle 0x47c947
sbb al, 0x94
xor byte [edx + 0x56], cl
xchg ebp, eax
jb 0x47c8fe
out 9, al
push esi
Function at 0x47f670
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
inc ebp
fucomp st(4)
adc dword [ebx + 0x6a7c5c9c], ebp
mov dword [0x3f77e2a7], eax
stc
rcr dword [esi + 0x661ddcc4], cl
leave
xchg esp, eax
imul ecx, dword [esi], 0x50
xor ah, 0x30
movsd dword es:[edi], dword [esi]
push esp
lodsb al, byte [esi]
enter 0x2ca0, 0x1f
push ebx
xor esi, dword [ecx - 0x852f29e]
popfd
lodsb al, byte [esi]
les ebx, [0x74ee98a8]
test al, 0x98
out dx, al
invalid
sbb eax, 0x74ee98a8
pop ds
insb byte es:[edi], dx
or eax, 0x5da40ecc
mov ebx, 0xfb10120c
pop ebp
xor byte [esi], 0x34
mov esp, 0xb5668c98
xor al, 0x66
xor al, 0xbc
cwde
mov word [esi - 0x4b], fs
leave
lodsd eax, dword [esi]
jno 0x47f65e
cmp dword [eax - 0x21cc8246], edi
rcl byte [eax + 0x3b132d31], cl
rcl byte [ecx - 0x2e7f1cc4], 0x88
jns 0x47f6da
rcl byte [edi - 0x70]
sub al, 0x52
sub byte [edx], 0x78
sbb al, 0xd5
outsd dx, dword [esi]
jl 0x47f66f
js 0x47f6f1
jge 0x47f6dd
sub esi, dword [edx]
adc ecx, dword [ebx - 0x18]
cmp ch, byte [edi + 0x15f28058]
out dx, al
sbb al, 0x83
jne 0x47f6b1
pop esi
sbb edx, esi
inc eax
sbb eax, 0x14287c20
pop esp
sub byte [esp + ebx*2], dl
js 0x47f703
cwde
xchg byte [edx], bl
sahf
push edi
invalid
inc edx
xor al, 0xdb
scasd eax, dword es:[edi]
adc al, 0x3c
jnp 0x47f682
hlt
invalid
cmp edx, dword [esi + edx*2 - 0x25]
std
mov ecx, ecx
jnp 0x47f719
push esp
pop ebx
insb byte es:[edi], dx
pop ebp
invalid
sar byte [edi + 0x4b], cl
daa
lcall 0x4edf, 0xdcd6cb9c
cmc
add byte [edi + 0x75], ch
pop esi
dec eax
jge 0x47f6cc
lodsb al, byte [esi]
cmp al, 0x4b
ror ch, 1
fnstsw word [ecx - 0x19]
mov ch, 0x8c
inc edx
adc al, 0x11
int 0x83
adc eax, 0xffffffbe
dec esi
mov al, byte [0xb3c08ee1]
invalid

Function at 0x494000
Capabilities:
Encode data using xor

Disassembly:
pop ss
mov byte [0x263f23fd], al
in al, 0xcf
cmpsb byte [esi], byte es:[edi]
xlatb
push ss
xchg al, bl
lcall 0x4a02, 0xf6c2f224
clc
pop edx
and ch, byte [esi + 0x5382e09d]
xchg edx, eax
sbb ch, byte [edx - 0x6d45a316]
inc eax
sahf
in eax, dx
cmpsb byte [esi], byte es:[edi]
test byte [eax - 0xb], dh
and dword [ecx + 0x1725e291], edx
jp 0x494034
in eax, 0x20
aam 0xd0
outsb dx, byte [esi]
jge 0x494001
mov dl, 0x22
adc byte [ebx + 0x24], 0xc1
rol dl, 1
push es
invalid
Function at 0x4bafed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb00f
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb000
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb13d
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb117
test eax, eax
jne 0x4bb040
cmp dword [0x4c22bc], 1
je 0x4bb117
cmp edx, 0xfc
je 0x4bb13d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb077
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb9d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbe60
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb0ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbe60
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c070c
push edi
call fcn.004bdd30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb9d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb9e0
lea eax, [ebp - 0xa0]
push 0x4c06ec
push eax
call fcn.004bb9e0
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb9e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdca4
add esp, 0x2c
pop edi
jmp 0x4bb13d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbe60
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1000a360
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1000a36f
pop dword [ebp - 0xc]
mov eax, 0x4b0fe3a3
sub eax, 0x3b0f4034
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6746fc3a
sub dword [ebp - 0x1c], 0x18f4b6ef
mov dword [ebp - 0x18], 0x514deee2
add dword [ebp - 0x18], 0xe0e55d63
mov dword [ebp - 0x14], 0x23f77ff
add dword [ebp - 0x14], 0x4a0ccc2f
mov dword [ebp - 0x10], 0xd2edf4ad
sub dword [ebp - 0x10], 0xd2edf4ad
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x9f84bf73
sub eax, 0x8f837f23
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xd42a43f2
add dword [ebp - 0x1c], 0xa0482564
mov dword [ebp - 0x18], 0x7d100ac
add dword [ebp - 0x18], 0x399b60c9
mov dword [ebp - 0x14], 0x99a32582
sub dword [ebp - 0x14], 0x3633b916
mov dword [ebp - 0x10], 0xfaa3478
add dword [ebp - 0x10], 0xf055cb88
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0xa003cbd4
sub eax, 0x90028b80
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x37406
push 0
call eax
mov ecx, 0xbc7f04f2
sub ecx, 0xbc7ec8cb
xor esi, esi
add esi, eax
mov edi, 0x1001e200
add edi, dword [ebp - 0xc]
mov ebx, 0x7861f618
add ebx, 0x526d76ca
sub dword [ebp - 8], 0x7b62d22c
mov edx, dword [edi]
xor dword [ebp - 4], 0xfd635e4f
xor edx, ebx
sub dword [ebp - 4], edi
mov dword [esi], edx
add dword [ebp - 4], edi
add esi, 4
add edi, 0xa8c3a3b9
sub edi, 0xa8c3a3b5
loop 0x1000a48d
add eax, 0xe36f
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x1000718f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x1003102c]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
push ebx
mov ebx, dword [esp + 0x120]
push ebp
mov ebp, dword [sym.imp.advapi32.dll_RegEnumKeyA]
push esi
push edi
push 0x104
mov dword [esp + 0x18], eax
xor edi, edi
lea eax, [esp + 0x20]
xor esi, esi
push eax
push edi
push ebx
call ebp
test eax, eax
jne 0x10007262
mov eax, dword [esp + 0x14]
inc esi
push dword [eax + 8]
lea eax, [esp + 0x20]
push eax
call fcn.10008567
pop ecx
pop ecx
test eax, eax
je 0x1000721a
test edi, edi
je 0x1000720d
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.100085da
pop ecx
pop ecx
test eax, eax
jle 0x1000721a
push edi
call fcn.100075cd
pop ecx
lea eax, [esp + 0x1c]
push eax
call fcn.1000763b
pop ecx
mov edi, eax
push 0x104
lea eax, [esp + 0x20]
push eax
push esi
push ebx
call ebp
test eax, eax
je 0x100071d9
test edi, edi
je 0x10007262
lea eax, [esp + 0x10]
xor ebp, ebp
push eax
push 0x20019
push ebp
push edi
push ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
push edi
mov esi, eax
call fcn.100075cd
pop ecx
test esi, esi
je 0x1000727d
cmp dword [esp + 0x10], ebp
je 0x10007262
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x120]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10009534
add esp, 0x114
ret
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x104
push eax
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push str.JavaHome
push dword [esp + 0x24]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x10007252
cmp dword [esp + 0x10], ebp
je 0x100072b4
push dword [esp + 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea eax, [esp + 0x1c]
push eax
call fcn.1000763b
pop ecx
jmp 0x10007264