joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401114
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42d004]
jne 0x40111e
repz ret
jmp fcn.00401636

Function at 0x4087aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403df0
and dword [ebp - 0x14], 0
cmp dword [0x42fc9c], 0
mov dword [ebp - 0x18], eax
jne 0x40885d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x408905
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x408905
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42fc9c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42fca0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42fca4], eax
call edi
push eax
call esi
mov dword [0x42fcac], eax
test eax, eax
je 0x40885d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42fca8], eax
mov eax, dword [0x42fca8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4088b6
cmp dword [0x42fcac], ecx
je 0x4088b6
push eax
call esi
push dword [0x42fcac]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4088b6
test ebx, ebx
je 0x4088b6
call edi
test eax, eax
je 0x4088ad
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4088ad
test byte [ebp - 8], 1
jne 0x4088b6
or dword [ebp + 0x10], 0x200000
jmp 0x4088e9
mov eax, dword [0x42fca0]
cmp eax, dword [ebp - 0x18]
je 0x4088e9
push eax
call esi
test eax, eax
je 0x4088e9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4088e9
mov eax, dword [0x42fca4]
cmp eax, dword [ebp - 0x18]
je 0x4088e9
push eax
call esi
test eax, eax
je 0x4088e9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42fc9c]
call esi
test eax, eax
je 0x408905
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x408907
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401114
leave
ret
Function at 0x421420
Capabilities:
Create pipe

Disassembly:
sub esp, 0x41c
mov eax, dword [0x42d004]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [esp + 0x420]
mov eax, dword [eax]
push ebx
mov ebx, dword [0x431a34]
push edi
mov edi, dword [0x433eb4]
call fcn.00421360
cmp dword [0x433eb4], 0x2f
jne 0x4214b4
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
call fcn.00421390
mov ecx, dword [esp + 0x420]
pop edi
pop ebx
xor ecx, esp
call fcn.00401114
add esp, 0x41c
ret
Function at 0x421930
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1010
call fcn.0040c410
mov eax, dword [0x42d004]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [0x433eb4]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetSystemTimes]
push edi
mov ebx, 0x1519af
mov edi, 0x8e46a6f0
mov dword [0x433b1c], edi
cmp eax, 0x3dc
jne 0x42197a
push 0
push 0
push 0
call esi
mov eax, dword [0x433eb4]
dec ebx
jne 0x421960
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ebx, dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor esi, esi
jmp 0x421990
cmp eax, 0xa5f
jne 0x4219c7
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
lea ecx, [esp + 0x830]
push ecx
push 0x42b50c
call ebx
mov eax, dword [0x433eb4]
cmp esi, 0x846143
jne 0x4219de
mov eax, dword [0x42ebf0]
add eax, 0xa231
mov dword [0x433eb4], eax
cmp eax, 0x141
jne 0x4219f9
mov dword [0x4301c0], 0xec58acac
mov dword [0x4301c4], 0xffffffff
inc esi
cmp esi, 0x12d12ba
jl 0x421990
call fcn.004214d0
mov ecx, dword [esp + 0x1018]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00401114
add esp, 0x1010
ret 0x10
Function at 0x413e0d
Capabilities:
Encode data using xor

Disassembly:
sub ecx, dword [esi + 0x6b03d27e]
adc al, cl
enter 0xffffffffffffefc2, 5
and al, byte [edi - 0x5f]
push es
cmp dword [ebp + 5], 0xb7681914
sbb dword [eax - 0x49], ebp
pop esp
sti
mov esp, 0x3d656504
lds ebx, [eax + 0x775cdf65]
xor eax, 0x19e83fbd
xchg edx, eax
mov dh, 0x75
and bh, ah
adc al, 0xdc
rol byte [eax - 0xa], 0x4b
xor al, 0x5c
in eax, dx
adc al, 0x72
cmc
je 0x413dc6
cmp eax, 0xd5e897ac
mov edi, 0x4167eb25
test eax, 0x54d399
xchg dword [ebp + 0x19c6ea86], esp
cmc
loope 0x413e13
xor eax, 0xc75c716a
sbb edx, edx
xor edx, ebx
into
xchg esp, eax
arpl bx, ax
mov esp, esp
jnp 0x413d93
add byte [edi + 0x5aa63acb], al
mov eax, dword [0xbcf53d20]
inc edx
daa
insb byte es:[edi], dx
je 0x413da4
int3
pop edi
push ds
clc
xor edi, edi
jo 0x413dac
mov byte [0xa80e43d6], al
push esi
adc ebx, dword [esp + eax - 0x6574baf4]
retf
Function at 0x420812
Capabilities:
Encode data using xor

Disassembly:
mov dword [edi - 0xa], edi
jnp 0x420734
sub bl, byte [eax]
push ss
rcl byte [ecx - 0x3aa0cf3d], 0x2b
mov ah, 0xbe
outsd dx, dword [esi]
fsub qword [edi + 0x7aeed148]
imul ebp, dword [ecx], 0xb72408cf
aaa
pop eax
fcmovu st(0), st(1)
adc dh, bl
in al, dx
je 0x42073f
pop edi
sbb esp, dword [edi - 0xc5db102]
invalid
mov cl, 0xd5
and dword [ecx + 0x46], esp
dec edi
leave
xchg ebp, eax
int1
out dx, eax
pop esp
sti
pop ds
cmp al, 0xbf
aam 0x6d
cmpsd dword [esi], dword es:[edi]
sete byte [ebp - 1]
ja 0x4207ca
jp 0x42076a
test ebp, ebp
pop ds
ror byte [esi], cl
test al, bl
mov ebx, 0x16bf8d2f
xchg edx, eax
mov al, byte [0xc66dcec3]
jp 0x420778
xlatb
jno 0x4207a3
add dword [ecx], ebx
into
js 0x420779
push cs
daa
xor eax, 0xc96aa219
invalid
test dword [edi - 0x6e], esp
xchg edx, eax
pop es
int3
adc ebp, esp
sbb dword [esp + ebx*4 + 0x5a045432], 8
invalid
pushfd
pushfd
xor dl, byte [esp + eax + 0x5a]
or bh, al
aad 0x4f
shr edi, 1
shr byte [eax], cl
xchg esi, eax
ja 0x4207ea
pushfd
fdivr qword [esi - 0x70]
aas
sub eax, dword [ecx]
retf
popal
jle 0x42081e
call dword [edi]
in eax, 0xe4
stosd dword es:[edi], eax
xchg esi, eax
jl 0x4207a6
lcall 0xe795, 0x24e7f3
les ecx, [esi - 0x70279175]
out 0x80, al
or bh, byte [ebp - 0x63755e71]
pushfd
jl 0x4207d1
int1
jnp 0x42086b
add al, 0xbd
mov ebx, dword [esi - 0x27]
sal dword [ebx + edi - 0x7c], 0x48
je 0x42084f
test byte [eax - 0x7a], cl
inc ebp
imul edi, edi, 0xce8c05c5
cmc
inc byte [ebp + 0x35034d07]
sal cl, 0x3e
push ebp
cmc
inc byte [ebp + 0x35034d07]
sal cl, 0x3e
push ebp
pop esi
scasb al, byte es:[edi]
or edi, dword [edi + 0x168e614f]
pop eax
xchg esi, eax
rcl byte [eax - 0x6ba12af1], cl
mov ch, 0xf9
mov edx, 0xb000de8d
xor al, 4
dec ecx
xchg dword [ebp + 0x7d], edx
push ds
or cl, dl
cwde
fldenv [edi]
mov al, pe_nt_image_headers32
daa
mov ch, 0x57
xchg esp, eax
jg 0x42083b
mov cs, word [ecx + ecx*8]
lodsd eax, dword [esi]
daa
test bl, ah
loop 0x42080e
inc ebp
jno 0x420894
test eax, 0xa8b0e2e
add eax, 0x23eb653e
dec ecx
and byte [ebx], ah
int1
fcmovnbe st(0), st(4)
movsb byte es:[edi], byte ds:[esi]
cli
xor dword [edi], edi
inc edx
out dx, al
lodsd eax, dword [esi]
jle 0x4208a1
jmp 0x420890
retf
aad 0x3d
mov ah, 0xfa
in eax, 0xc7
clc
mov cl, 0x68
mov ecx, 0x1004ac46
fnstcw word [edi + 0x4d]
push cs
or eax, 0x4186e66c
aam 0x58
dec esi
xchg ebp, eax
imul edx, dword [ecx + 0x58], 0x1a
mov ebp, 0x1eb04dc0
js 0x4208e4
and eax, 0x701cba97
dec edi
hlt
mov eax, 0x55ffa42b
inc eax
sal bl, cl
inc edx
xor eax, esi
jmp 0x721ab85b

Function at 0x421932
Capabilities:
Encode data using xor

Disassembly:
lcall 0x997a, 0x3d71eb78
vmwrite edi, dword [ecx - 0x12313ef5]
pop ecx
push es
dec ecx
push ds
sti
add eax, 0xf72d67ac
invalid
Function at 0x424d04
Capabilities:
Encode data using xor

Disassembly:
dec esp
invalid
jl 0x424c70
shl byte [ebx + 0x6f998563], 0xb1
insb byte es:[edi], dx
jl fcn.00424c7f
scasb al, byte es:[edi]
push edx
inc ecx
insd dword es:[edi], dx
ror dword [esi + 0x1dc58dac], cl
or dword [edi - 0x4e], esi
inc edx
fld xword [edx - 0x7e]
add al, 0xa3
invalid
or edi, esp
shr dword [eax + 0x11], 1
sub eax, 0x5f807bb5
lea ebp, [ecx + esi*2]
out 0xa4, eax
inc ebp
push 0x5d41f32b
stc
invalid
jo 0x424d41
xchg dword [ecx], edx
cmp ebx, dword [edi + 0x5c02726]
jae 0x424ca4
adc byte [0xa46efbb6], 0x78
dec ebx
pop ss
out dx, al
xor ecx, ebp
loopne 0x424c7e
in eax, 0x83
or dl, byte [edx + 0x1796a2a4]
mov ch, 0xb0
sbb byte [esi + 0xc], bl
add edi, dword [ecx - 0x5f0e9eba]
mov ecx, 0xa0f16146
mov ecx, 0xa0f16146
rcr byte [edx], cl
ficomp word [ebx + 0x6a]
in al, 0xf0
xor dword [eax - 0x75], edx
sti
stc
push esp
les edi, [edx + 4]
cmp ecx, edx
test eax, 0xaef6541e
xor al, 0xb3
jno 0x424d16
imul byte [esi - 0xd8e4ccc]
mov eax, dword [0x86298296]
xor bh, bl
sal byte [ebx + edx*2 - 0x5f], cl
xor al, byte [0x4b320b3]
jno 0x424cdb
jno 0x424d1e
out 0xa4, eax
xor dword [eax + 0x44], edx
cmpsd dword [esi], dword es:[edi]
adc byte es:[ebx + 0x46ae736b], ah
adc byte [ebx + 0x46ae736b], ah
mov dword [0x46ae736b], eax
sbb eax, dword [esi + 0x17a49cf4]
int1
pop ebp
aas
lcall 0x7b9, 0x52705bc5
loop 0x424dca
push ebp
xor eax, 0x2b4374bc
pushfd
sbb al, 9
cld
fdiv dword [edx]
pop es
mov al, ch
lea esi, [ecx + 0x14ace859]
jno 0x424d40
shl dword [edx + 0x7a], 1
fiadd dword [esi + 0x53]
bound edi, qword [edx - 0x26]
inc esi
push ebx
jnp 0x424d6e
mov eax, dword [0xf23255e7]
ret
push esp
pop es
dec eax
mov esi, dword gs:[ebp + edx + 0x56]
scasb al, byte es:[edi]
fidiv dword [esi - 0x6f45c87]
sub edi, eax
cmp byte [edi], ah
movsd dword es:[edi], dword [esi]
dec esp
jb 0x424e31
mov eax, eax
pop ebx
invalid
xor edx, ecx
sub dword [edi + 0x60], 0x12accfe6
sahf
sub eax, 0xb1f3cda6
mov dword [0x51d225d0], eax
add esi, dword [esi + 0x3ca7a5ea]
and al, 0x64
push ecx
scasd eax, dword es:[edi]
push edx
or bh, ah
sub edi, dword [ebx]
mov bl, 0xb1
jne 0x424e3a
salc
movsb byte es:[edi], byte [esi]
mov byte [0xcdcd2428], al
mov byte [edi], al
sub al, 0x36
invalid
Function at 0x44e9e2
Capabilities:
Encode data using xor

Disassembly:
out 0x73, eax
xlatb
sbb dh, bh
sub eax, 0x30e931d7
shl eax, 1
mov al, byte [0xa49124d1]
jne 0x44ea48
popfd
inc esi
cli
test ch, al
call 0xd40caaee
mov dword [0x54000012], eax
push ebx
mov bl, 0x47
xchg esp, eax
xchg esi, eax
mov eax, dword [0xf24f81a0]
push esi
add byte [eax + 0x20], dl
mov eax, dword [0x762b7110]
push eax
and byte [ecx + 0x762b7110], ah
popal
or al, byte [eax]
daa
sal dword [ecx], 1
dec edx
popal
adc byte [ebx], 0x44
js 0x44eaa5
aaa
push 0x869550ad
ror dword [esi - 0x6f9d2e90], 1
inc ebx
mov bl, 0x79
test dword [eax + 0x41], 0xe6493057
push esi
in al, 0x57
or eax, dword [ebx + 0x1e76d7fa]
ror bl, cl
inc esi
push 0x72ecf170
jno 0x44ea6e
push eax
and dword [edi - 0x93d2591], edi
dec esi
push ebx
sal ah, 0xb5
mov al, byte [0xc6b6e63e]
mov cl, 0x53
mov bh, 0xc5
xor dl, byte [edx - 0x4e1a6d11]
cmpsd dword [esi], dword es:[edi]
and al, 0xc7
push ebp
imul dword [ecx]
push edi
xor byte [eax + 0x12b143f6], dl
salc
mov dl, 0xe3
jae 0x44ea11
pop eax
jbe 0x44eaf9
cdq
imul esi, dword [ecx - 0x50e73396], 0xffffffc6
test ebx, 0xb6c463f3
not byte [ebx + 0x769aaf1e]
xchg dword [edi + 0x32], ecx
xchg byte [edi + 0x49b08af6], ah
xchg edx, eax
pushfd
popfd
xchg edx, eax
cmp eax, 0x5f2a1702
pop edi
pop es
sub esp, dword [ecx - 0xc9ce09a]
xchg edi, eax
loop 0x44eac3
in eax, dx
lodsb al, byte [esi]
dec edx
retf 0x7629
xchg byte [esi], al
add dword [edi + eax*8], ecx
push es
invalid
out 0xed, al
out 0xd3, eax
xchg edi, eax
sal esi, 0x36

Function at 0x452dd4
Capabilities:
Encode data using xor

Disassembly:
mov ds, word [ebx + 0x2a23ab78]
mov ecx, 0x4a0b4a15
pop eax
cwde
sahf
adc dword [eax + ecx*4 - 0x534d7326], ebp
push ebx
dec edi
neg dword [esi]
sub dword [esp + eax*4 - 0xd], edi
xchg ebp, eax
mov al, byte es:[0x92d945ec]
xor al, 0xda
scasb al, byte es:[edi]
pop ebx
xchg ecx, eax
sub al, 0xc1
invalid

Function at 0x456d33
Capabilities:
Encode data using xor

Disassembly:
dec esp
jnp 0x456d76
ret
sub bl, byte [edi + 0x16]
mov ah, 0xea
fld st(0)
cmc
adc dword [esi], edi
pop edx
sal ch, 0x11
pop edx
xor eax, 0x2363b8f4
jle 0x456d7c
pop esi
jmp fcn.00456dd5
Function at 0x469c34
Capabilities:
Encode data using xor

Disassembly:
daa
clc
mov dl, 0xed
dec esi
mov ecx, 0x7a1855ca
mov dword [0xbaeff923], eax
mov edx, 0x2bf7ba94
loop 0x469c9f
ret 0xb5ee
mov al, 0xec
test bh, bl
jno 0x469d12
inc edx
and dword [ecx], edi
sub dh, byte [edi]
ljmp 0x69cd
mov cs, word [ebp + 0x2ab94c1b]
xchg esp, eax
clc
sal ebx, 0xf0
sahf
lea esi, [eax]
test al, 0x24
idiv dword [ebx]
test dword [ecx + 0x39], edx
in al, 0xc9
xchg al, dh
fimul word [eax + 0x70]
in eax, dx
invalid
dec eax
jo 0x469d02
jnp 0x469d50
adc al, 0x10
je 0x469d3e
mov cl, 0x6b
xor eax, 0xe8792d62
adc bh, byte [eax - 0x5f]
xor al, 0xa7
cmp al, 0x28
test dh, bl
popal
movsb byte es:[edi], byte [esi]
xchg ecx, eax
jb 0x469cf8
sub ebp, esi
mov bl, 0xc8
cmp eax, 0x3c004065
sbb al, 0
mov ecx, 0x162aebcd
jmp 0x469d6a
push ss
pop ebx
imul edi, dword [esi + 0x24f97443], 0x32adef1b
push cs
je 0x469d40
and al, 0x1b
out dx, eax
lodsd eax, dword [esi]
xor cl, byte [esi]
mov cl, 0xb1
aaa
cdq
in eax, 0x10
mov eax, dword [0x3264e2b6]
push es
cmc
jbe 0x469d45
sbb al, 0x4b
cmpsb byte [si], byte es:[di]
push ecx
ftst
test eax, 0xa1742d3
jbe 0x469db6
or dh, byte [esi + 0x4b]
dec ebx
jo 0x469ddc
adc al, 0x40
mov dh, 0x61
ret
mov ebp, 0x69c65126
jecxz 0x469d68
push ecx
invalid
sub al, 0x6f
sbb dword [ecx], 0x2c
jecxz 0x469db8
cwde
dec esp
clc
sti
mov dword [0x2bae2773], eax
cdq
fiadd dword [esi + 0x46b9e439]
ja 0x469de6
lds ecx, [edx + 0x6d984f28]
push 0x30cb2813
cmc
pushal
sbb esp, dword [edx + 0x2f]
pop edx
fbstp tbyte [ecx]
cld
pop es
or al, 0x68
dec ebp
leave
stosb byte es:[edi], al
bound ebp, qword [edi]
push 0xffffffffffffffe4
in eax, 0x28
cmp al, 0x7a
cmp byte [edi], ch
int3

Function at 0x495832
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
mov word [edx], es
xlatb
dec ebp
cmp dword [edi], edi
imul esp, dword [esi - 0x63], 0x19ff0973
call [ecx]
mov bh, 0xf1
mov bh, 0x99
xor eax, 0x370c1ca5
add edx, edx
dec eax
xor ecx, ebp
push esi
pop ecx
daa
pop eax
dec ebp
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
jl 0x49583e
xor bh, 0x88
shr byte [eax - 0x1c], cl

Function at 0x4ae342
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x7213da70]
in eax, 0xd5
in al, dx
in al, 0x73
mov dl, 0x23
test eax, 0xf3da3492
sub al, 0x24
out dx, eax
movsb byte es:[edi], byte [esi]
mov bh, 0xbf
and al, ah
mov bl, 0x9c
xor ecx, dword [edx - 0x5c1c8907]
pop edi
mov ch, 0xf7
sbb al, 0xb3
adc al, 0x79
mov eax, dword [0x342837f2]
push ecx
sbb al, 0xae
sbb al, 0xdf
insb byte es:[edi], dx
mov ebx, 0xfd1ba422
aam 0x21
invalid
jge 0x4ae2ce
fisub word [eax - 9]
and dword [eax + 0xe7ae573], 0xffffffa9
in al, 0x62
cmp ebx, dword [esi + 0x6ab44990]
enter 0xffffffffffffb069, 0xffffffffffffffb1
stc
arpl bx, cx
int1
nop
push cs
pushal
jb 0x4ae2fb
sahf
xlatb
invalid
Function at 0x4ba270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1a8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba314
push 4
lea eax, [ebp - 0x1a8]
push eax
push 0x18
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba307
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1ac], 0
je 0x4ba305
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba314
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x605343

Function at 0x4bb2f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3310
cmp edx, dword [eax]
je 0x4bb318
add eax, 8
inc ecx
cmp eax, 0x4c33a0
jl 0x4bb309
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3310]
jne 0x4bb446
mov eax, dword [0x4c79b4]
cmp eax, 1
je 0x4bb420
test eax, eax
jne 0x4bb349
cmp dword [0x4c3250], 1
je 0x4bb420
cmp edx, 0xfc
je 0x4bb446
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb380
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbc40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb3c3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbc40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb00
push edi
call fcn.004bd410
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4bfae0
push eax
call fcn.004bba20
push dword [esi + 0x4c3314]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd384
add esp, 0x2c
pop edi
jmp 0x4bb446
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3314]
push 0
push eax
push dword [esi]
call fcn.004bbc40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5f228f
Capabilities:
Encode data using xor

Disassembly:
add al, 0xec
xor byte [ecx + 0x8426b65], al
mov ch, 0xb0
xchg edi, eax
jnp 0x5f22c1
or al, 0xce
mov eax, 0xcfd1d70f
and ebx, esi
ret 0x96eb
push cs
xlatb
xor eax, 0xf6906a32
or al, 0x3b
mov al, 0
inc ebp
xchg ebp, eax
mov edx, 0xbeaffc1a
test byte [esi - 0x1529afbf], al
inc edx
xor eax, 0xd983efa3
shl byte [edx + 0x46], cl
popfd
scasd eax, dword es:[edi]
push ecx
add cl, byte [edx]
push edi
pop es
dec ecx
pop eax
jne 0x5f22c3
clc
imul edi, ebx, 0xa8140ae1
jne 0x5f22ee
popal
inc edi
and esp, 0x26a55623
jbe 0x5f2310
salc
out dx, al
sbb byte [ecx + 0x1f], ch
pop ds
push ds
inc esi
aas
cmp al, dl
invalid
sbb byte [esi - 0x190b2e2c], bl
sub eax, 0xb1b5733
cmp eax, 0xc6312ce8
jl 0x5f2392
loop 0x5f2324
mov al, byte [0xbceb912c]
mov dh, 0x17
xor cl, byte [edi - 0x7674a1c2]
in eax, 6
cli
fdiv st(6)
scasd eax, dword es:[edi]
push edi
add dword [edx], edi
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
jp 0x5f2368
pop ecx
dec eax
inc esp
pop edx
in eax, dx
pxor mm7, mm6
mov edi, 0xf60fa7f8
jno 0x5f239a
jns 0x5f2304
adc dword [edx + 0x29], 0xd03a4a5b
and al, 0xb9
ror dword [eax], 1
push es
mov esp, 0xee025797
add bh, byte [esi]
push ebx
lahf
out 0x9f, al
popfd
popfd
push edx
push esp
ja 0x5f23e6
cmp edx, dword [esi + 0x4b53f83c]
or eax, 0x7a2b0168
out dx, al
sub dh, dl
mov ebx, 0x73aac2bd
mov ebx, 0x7ed55be1
neg dword [eax - 0x73e180c2]
jbe 0x5f23d6
fbld tbyte [edi - 0x2710edb6]
pop edi
xlatb
out dx, eax
fcomp dword [edi - 0x29]
inc edi
invalid
adc byte [ecx], dh
retf
xor ch, dl
rcr byte [edi + 0x7b], 1
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
jne 0x5f2402
ljmp 0x4f53:0x4e0ba534
push edx
pop ebx
push ebx
int3
pop ebp
mov bl, 6
loopne 0x5f2391
not dword [ecx + 0x6fcadffe]
xor al, 2
scasd eax, dword es:[edi]
sti
cli
xor eax, 0xf7df595c
lahf
lds edi, [ebx + 0x2f088175]
imul esi, dword [eax + 0x111e22ba], 0xffffffc7
test eax, 0x547ad1f
insb byte es:[edi], dx
sub eax, dword [eax]
int3
Function at 0x401450
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x401479
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [eax + 0x3c]
add ebx, eax
cmp dword [ebx], 0x4550
je 0x401499
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx + 0x50]
mov eax, dword [ebx + 0x34]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 4
push 0x3000
push edx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x4014dd
mov ecx, dword [ebx + 0x50]
push 4
push 0x3000
push ecx
push eax
call esi
mov edi, eax
test edi, edi
jne 0x4014dd
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
nop
nop
nop
nop
nop
nop
nop
push 0x24
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x401523
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
nop
nop
nop
nop
nop
nop
nop
push 0x8000
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push 4
mov dword [esi + 4], edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 0x401400
mov dword [esi + 0x18], 0x401420
mov dword [esi + 0x1c], 0x401440
mov dword [esi + 0x20], eax
mov edx, dword [ebx + 0x54]
push 0x1000
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ecx, dword [ebx + 0x54]
mov edx, dword [ebp + 8]
push ecx
push edx
push eax
mov dword [ebp - 4], eax
call fcn.0040ed80
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x3c]
add eax, dword [ebp - 4]
push esi
push ebx
mov dword [esi], eax
push ecx
mov dword [eax + 0x34], edi
call section..text
add esp, 0x18
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [ebx + 0x34]
je 0x40159c
push eax
mov eax, esi
call fcn.004011e0
add esp, 4
call fcn.00401270
test eax, eax
je 0x4015db
mov ebx, esi
call fcn.004010c0
mov eax, esi
call fcn.004011a0
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esi]
mov eax, dword [eax + 0x28]
test eax, eax
je 0x4015f0
push 0
push 1
add eax, edi
push edi
call eax
test eax, eax
jne 0x4015e9
push 0x45a
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.004016e0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [esi + 0x10], 1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401b50
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
test eax, eax
jne 0x401b7b
push str.Load_dll_error__n
call fcn.0040755d
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
push str.RtlDecompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
jne 0x401b9d
push str.Load_function_error__n
call fcn.0040755d
add esp, 4
mov edi, 0x1000
push edi
mov dword [ebp - 4], 0
call fcn.00407b71
mov esi, eax
add esp, 4
test esi, esi
je 0x401bfe
push edi
push 0
push esi
call fcn.0040ed00
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 4]
push eax
push ecx
push edx
push edi
push esi
push 2
call ebx
mov eax, dword [ebp - 4]
cmp edi, eax
jae 0x401c0e
test esi, esi
je 0x401bed
push esi
call fcn.004077ee
mov eax, dword [ebp - 4]
add esp, 4
push eax
mov edi, eax
call fcn.00407b71
mov esi, eax
add esp, 4
test esi, esi
jne 0x401bb8
push str.new_memory_error__n
call fcn.0040755d
mov eax, dword [ebp - 4]
add esp, 4
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov dword [ecx], esi
mov dword [edx], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret