joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72fc158c
Capabilities:
Find taskbar
Get explorer pid

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0
call dword [sym.imp.USER32.dll_GetShellWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call esi
cmp dword [ebp + 8], eax
je 0x72fc15c3
push 0
push 0
push 0x72fc1114
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call esi
cmp dword [ebp + 8], eax
je 0x72fc15c3
xor eax, eax
jmp 0x72fc15c6
xor eax, eax
inc eax
pop esi
pop ebp
ret 4

Function at 0x72fc1628
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov edi, dword [ebp + 8]
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x72fc165c
push edi
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
jne 0x72fc171e
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xor esi, esi
cmp eax, esi
mov dword [ebp - 8], eax
je 0x72fc171e
push eax
call fcn.72fc158c
test eax, eax
jne 0x72fc171e
push ebx
push edi
mov dword [ebp - 0x20], edi
call sym.NMASNT.dll_OSI_IsWOWWindow
mov edi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov ebx, 0x72fc14f7
jmp 0x72fc16cd
cmp dword [ebp - 0x10], esi
jne 0x72fc16db
cmp dword [ebp - 0x18], esi
jne 0x72fc171d
cmp dword [ebp - 0x1c], esi
jne 0x72fc16df
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.72fc123d
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x72fc171d
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
cmp dword [ebp - 0x14], esi
je 0x72fc16a5
jmp 0x72fc1703
push 0x11
jmp 0x72fc1705
mov eax, dword [ebp - 8]
cmp eax, dword [0x72fc3030]
jne 0x72fc16fd
mov eax, dword [0x72fc302c]
mov dword [0x72fc302c], esi
mov dword [0x72fc3030], esi
jmp 0x72fc16ff
xor eax, eax
cmp eax, esi
je 0x72fc171d
push 0x21
xor ecx, ecx
cmp dword [0x72fc3020], esi
pop eax
setne cl
push 1
push ecx
push eax
push dword [ebp + 8]
call sym.NMASNT.dll_OSI_ShareWindow
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x72fc17fc
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
call fcn.72fc128f
push 0xfffffffffffffff0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
test eax, 0x40000000
je 0x72fc184a
push ebx
call dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp esi, eax
je 0x72fc184a
test edi, edi
je 0x72fc18d5
push 1
push ebx
call sym.NMASNT.dll_OSI_UnshareWindow
jmp 0x72fc18d5
xor esi, esi
cmp edi, esi
jne 0x72fc18d5
lea eax, [ebp - 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x72fc18d5
push eax
call fcn.72fc158c
test eax, eax
jne 0x72fc18d5
push ebx
mov dword [ebp - 0x1c], ebx
call sym.NMASNT.dll_OSI_IsWOWWindow
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 0x72fc14f7
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 0x10], esi
jne 0x72fc18c8
cmp dword [ebp - 0xc], esi
jne 0x72fc18c8
mov esi, dword [sym.imp.USER32.dll_GetWindow]
push 4
push ebx
call esi
mov edi, eax
test edi, edi
je 0x72fc18d5
push edi
call fcn.72fc128f
test eax, eax
jne 0x72fc18c4
push 4
push edi
call esi
mov edi, eax
test edi, edi
jne 0x72fc18af
test edi, edi
je 0x72fc18d5
push 1
push dword [ebp + 0xc]
push 0x42
push ebx
call sym.NMASNT.dll_OSI_ShareWindow
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10008ca0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x24
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
push str.ADVAPI32.dll
mov byte [esp + 0x18], 1
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.OpenProcessToken
push edi
call esi
push str.AdjustTokenPrivileges
push edi
mov ebx, eax
call esi
push str.LookupPrivilegeValueA
push edi
mov dword [esp + 0x24], eax
call esi
push str.kernel32.dll
mov dword [esp + 0x1c], eax
call ebp
push str.GetCurrentProcess
push eax
mov dword [esp + 0x28], eax
call esi
lea ecx, [esp + 0x10]
push ecx
push 0x28
call eax
push eax
call ebx
test eax, eax
jne 0x10008d0e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
neg edx
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 1
sbb edx, edx
push eax
and edx, 2
push ecx
push 0
mov dword [esp + 0x3c], edx
call dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push 0
push 0
lea edx, [esp + 0x2c]
push 0x10
push edx
push 0
push eax
call dword [esp + 0x34]
push str.KERNEL32.dll
call ebp
push str.GetLastError
push eax
call esi
call eax
test eax, eax
je 0x10008d65
mov byte [esp + 0x14], 0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je 0x10008d7d
push edi
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10008d88
push eax
call esi
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
and eax, 0xff
pop ebx
add esp, 0x24
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x4118c7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
xor esi, esi
inc esi
mov dword [0x489628], eax
push edi
mov edx, esi
mov eax, 0x489628
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x489fe4
jl 0x4118d8
pop edi
mov dword [0x478078], esi
mov dword [0x489ff8], esi
pop esi
ret

Function at 0x411906
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ecx
cmp dword [0x489ff8], 0
push ebx
push ebp
push esi
push edi
mov esi, 0x489628
jne 0x411926
push 0
call fcn.00452f3f
pop ecx
call fcn.004118c7
mov dword [0x478078], 0x270
mov dword [0x489620], esi
mov edx, 0xe3
mov ecx, 0x7ffffffe
mov eax, 0x9908b0df
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi + 0x634]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x411945
mov edx, 0x18c
mov ebx, dword [esi]
lea edi, [esi + 4]
mov ebp, dword [edi]
xor ebx, ebp
and ebx, ecx
xor ebx, dword [esi]
mov dword [esp + 0x10], ecx
mov ecx, ebp
and cl, 1
shr ebx, 1
neg cl
sbb ecx, ecx
and ecx, eax
xor ebx, ecx
xor ebx, dword [esi - 0x38c]
dec edx
mov ecx, dword [esp + 0x10]
mov dword [esi], ebx
mov esi, edi
jne 0x41197b
mov edx, dword [0x489628]
mov edi, dword [esi]
xor edi, edx
and edi, ecx
xor edi, dword [esi]
and dl, 1
shr edi, 1
neg dl
sbb edx, edx
and edx, eax
xor edi, edx
xor edi, dword [esi - 0x38c]
mov dword [esi], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4119d5
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
dec dword [0x478078]
jne 0x4119e2
call fcn.00411906
mov eax, dword [0x489620]
mov ecx, dword [eax]
add dword [0x489620], 4
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
ret

Function at 0x411a19
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ecx
dec dword [0x478078]
jne 0x411a27
call fcn.00411906
mov eax, dword [0x489620]
mov eax, dword [eax]
add dword [0x489620], 4
mov ecx, eax
shr ecx, 0xb
xor eax, ecx
mov ecx, eax
and ecx, 0xff3a58ad
shl ecx, 7
xor eax, ecx
mov ecx, eax
and ecx, 0xffffdf8c
shl ecx, 0xf
xor eax, ecx
mov ecx, eax
shr ecx, 0x12
xor ecx, eax
test ecx, ecx
mov dword [esp], ecx
fild dword [esp]
jge 0x411a6d
fadd qword [0x472380]
fmul qword [0x472378]
pop ecx
ret
Function at 0x412c26
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
push esi
push edi
lea eax, [ebp - 0xdc]
call fcn.0041288d
push dword [ebp + 0x10]
lea esi, [ebp - 0xdc]
call fcn.004129cd
xor edi, edi
cmp dword [ebp + 0xc], edi
jbe 0x412c6b
mov eax, dword [ebp + 8]
lea esi, [edi + eax]
lea eax, [ebp - 0xdc]
push eax
call fcn.0041299f
xor byte [esi], al
inc edi
cmp edi, dword [ebp + 0xc]
jb 0x412c51
pop edi
pop esi
leave
ret 0xc

Function at 0x452eab
Capabilities:
Encode data using xor

Disassembly:
sub dword [edx - 0x23290c70], edi
mov edx, 0xdcd6f390
xchg dword [esi], ecx
scasd eax, dword es:[edi]
mov ebx, 0x34d21186
xor byte [ebx + 0x19], ch
scasd eax, dword es:[edi]
inc esp
mov eax, 0xe5e1bed3
cmpsd dword [esi], dword es:[edi]
inc esp
sar dword [esi + 0x44a7e5e1], cl
clc
jl 0x452eac
loope 0x452edd
jns 0x452ec1
and bh, byte [eax]
dec ebx
mov esi, 0xb71ebd18
into
salc
fisttp qword [ebp - 0x519ea748]
scasb al, byte es:[edi]
int1
sar ebp, 0x8d
mov dword [edx - 0x7ce2dca3], esi
mov al, byte [0xbeb3a405]
xor al, 0x28
out 0xfd, eax
jns 0x452f23
pop esi
call 0x2ed412a1
fld xword [ebp - 0x1f]
in al, 0x11
fld st(4)
inc esp
invalid
in eax, 0x62
xor esp, dword [edi - 0xf]
cli
or al, 0x26
mov edx, 0x792396aa
mov ch, 0xa9
invalid
Function at 0x40eb1b
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
lahf
cld
mov byte [eax - 0x6f], ch
and edx, edx
lcall 0xe641, 0x6536245
adc bh, byte [ebx - 0x2579bd5b]
lodsd eax, dword [esi]
sub al, 0xf6
adc ch, byte [ebx + 0x62]
jnp 0x40eab0
arpl ax, ax
add dl, bh
in al, 0xd0
xchg ebp, eax
and bl, byte [ecx + 8]
out 0xa3, eax
inc edi
cmpsd dword [esi], dword es:[edi]
daa
jge 0x40eb71
jb 0x40eb67
jb 0x40eaf8
insb byte es:[edi], dx
test byte [ebx - 0x2e0fcb7a], ch
pop ecx
bound ecx, qword [ebp + 0x40f005a3]
test byte [edi], al
add dword [esi - 0x680a1af6], 0x2aa05ada
and byte [ebp + 0x67], 0x1b
mov esi, dword [eax]
insd dword es:[edi], dx
sbb ecx, dword [bp + di + 0x6d30]
movntps xmmword [ecx - 0x70], xmm6
adc dword [edi - 0x7d], esi
idiv byte [esi - 0x7bdc54da]
jg 0x40ebbb
mov ebp, 0xb7ad388f
jnp 0x40ebc2
add byte [0xb8d5923b], dl
popfd
and byte [ecx - 0x7695bec], 1
stosd dword es:[edi], eax
insb byte es:[edi], dx
cmc
clc
mov ah, 0x60
clc
add dword [ebx - 0x4b070a94], ebp
pushal
inc ebx
mov esi, 0xa2d9f20c
xor byte [ebx - 0x223874f2], 0x85
sub edx, ecx
adc dword [edx], esi
ror byte [ebx + 0x55], 0x31
or al, 0xf2
fldenv [edx - 0x74f14c7e]
invalid
xor dh, bl
ror byte [ebx + 0x55], 0x31
outsd dx, dword [esi]
cli
inc edx
sub esi, eax
sahf
sti
je 0x40eb7f
dec ebp
out dx, al
push ebx
mov ebp, 0x9077a0c8
mov cl, 0x96
pop eax
fst dword [edi + 0x28]
sub eax, 0xf3ba6504
push 0xffffffffffffffa3
daa
inc ebx
push edi
jno 0x40eb40
mov ecx, 0xd65837a6
insd dword es:[edi], dx
mov ebx, 0x4600becb
stosd dword es:[edi], eax
cmp eax, 0xb519b16c
sahf
lahf
sal dword [edi], cl
or dh, dh
wait
dec ebx
cwde
retf

Function at 0x425b78
Capabilities:
Authenticate hmac

Disassembly:
ja 0x425b68
sar byte [ebp + eax*8 - 0x68], 1
xchg esp, eax
ljmp 0x68ad
lea ecx, [ecx]
lcall 0xb497, 0xc21dee67
pop ebp
lodsb al, byte [esi]
mov esi, 0xa0e15cd3
mov ah, 0x5c
test al, 0x3d
cmpsd dword [esi], dword es:[edi]
and al, 0xf1
int3
mov bh, 5
xchg dword [ecx], esi
inc eax
rol byte [esi - 6], 1
sub dword [ebp + 0x5e], esp
jnp 0x425aff
adc al, 0x85
invalid
xchg byte [esi + 0x27], dl
mov eax, 0x7c207435
dec edx
jecxz 0x425bab
je 0x425b23
in eax, 0x81
adc eax, 0xd1c41f70
jo 0x425b99
invalid
sal dword [ebp + 0xf7a81ad], 1
xchg ebp, eax
pop ss
mov ah, 0x69
mov dword [edi - 9], eax
mov ah, bl
xchg byte [esi + 0x2505c0a7], dh
lodsw ax, word [esi]
mov word [edi], cs
mov dh, 0x2c
xchg byte [ebp - 0x509ca740], bh
jo 0x425b99
invalid
rcr byte [eax + 0x63], 0xaf
xchg esp, eax
bound edi, qword [eax]
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
out 0x1f, al
pushal
jne 0x425b54
mov ah, 0x7d
cmp eax, 0xcfa9f5b5
popfd
in al, 0x32
cmc
test eax, 0x32e49dcf
push ebp
ja 0x425bcf
in eax, dx
xchg ebp, eax
sbb dword [eax - 0x434cc8cf], ebx
add edx, esi
inc ecx
jo 0x425bc8
outsd dx, dword [esi]
or byte [edi - 0x7b], 0xe8
add eax, 0x3f479fb7
Function at 0x42870c
Capabilities:
Encode data using xor

Disassembly:
daa
sahf
out dx, al
mov ch, 0xdf
dec ebx
adc al, 0x95
js 0x428755
jbe 0x42876f
mov bh, 0x81
xchg ebp, eax
xor al, 0x1b
dec ebx
jge 0x428740
sub al, 0xa4
loopne 0x4286e2
mov byte [0x1657d0e5], al
adc eax, 0xf02b65df
jmp 0x20bd2d86
mov al, byte [0x758211b5]
aaa
xor eax, 0x705571c6
mov ebp, 0x8beb5ea6
invalid
jbe 0x4287e0
pop ebp
out dx, eax
push esp
xor al, 0x7e
mov ah, dl
mov dh, byte [esi + edi*8 + 0xfdf5a6d]
fisub dword [eax + ebx + 0x29]
mov byte [0x4a6c34d5], al
aam 0xf8
into
invalid
cmp ebx, esi
mov dh, 0x98
pushfd
and dword [eax], ecx
aas
mov ch, byte [ebp + 0x66ad1a5e]
aam 0x85
imul ebx, eax, 0xf39c1471
invalid

Function at 0x43d07b
Capabilities:
Encode data using xor

Disassembly:
invalid
push ebx
mov al, byte [0x23841f5]
add eax, 0xe6550801
je 0x43d05f
xchg edi, eax
retf 0x4a66
aas
cmp dh, byte [edx + 0x3a]
push ebp
mov word [ebp + 0x779ea65b], ss
fadd dword [esi - 0xa]
jg 0x43d077
fbld tbyte [esi + 0x3e4c5b9e]
dec ebx
popal
lcall 0x452e, 0xc635a404
pop ss
push ebp
sahf
clc
pop ebx
mov dl, 0x1c
jnp 0x43cff7
and byte [ebp + 0x3c], dl
aad 0xc3
mov dword [0xb384bfc1], eax
int3
jno 0x43cffd
and eax, 0xf64771b2
mov eax, 0x7e4ed675
jno 0x43d0c4
idiv byte [eax + 0x7e4ed675]
jne 0x43d057
dec esi
jle 0x43d031
lodsd eax, dword [esi]
jmp 0x86af7d98
mov edi, 0x5f4c1b6
sbb dword [edx], 0xd666bbc6
and al, 0xf9
sbb al, dh
mov ebx, 0xf924d666
rol ebp, 0x7f
je 0x43d07f
lds edi, [edi + 0x64]
je 0x43d07f
mov ebx, 0x55f71e73
inc edx
mov ebp, 0x77059f41
jl 0x43d0bb
mov edx, 0x8375aac3
or ch, byte [ecx + 0x6da537f5]
mov dl, byte [edx]
add byte ds:[edi + 0x63], bl
jo 0x43d152
dec ebp
scasb al, byte es:[edi]
jge 0x43d0b5
push cs
ror dword [ebp + 0xe], cl
sbb dword [eax], esi
mov byte [esi - 0x26a5c526], dh
and esi, dword [esi + 0x47]
push esi
xlatb
sal dword [edx - 0xd], cl
std
and eax, 0xd771acc6
pop es
or byte [eax + edi*8 + 0x3b], bh
loop 0x43d157
add dword [edi + 0x20], 0x71
aad 0x79
int3
inc esp
push eax
pop edx
movsd dword es:[edi], dword [esi]
sub eax, 0x3fe8af9f
salc
xor al, 0x5e
mov bl, 0xec
fisubr dword [eax + 0x38]
lea esi, [ebx]
push edx
mov ebx, 0xcb95351b
push ebx
cmpsd dword [esi], dword es:[edi]
sub edx, edx
neg bl
aaa
sub al, 0x7c
stosb byte es:[edi], al
xchg ebx, edx
call 0x9f09056d
xor al, 0xc5
sahf
mov dl, ah
bound esi, qword [ecx + 0x64]
pop ebp
out dx, al
mov ah, 0x48
dec eax
xor ch, byte [ebx]
add al, byte [0x7a4eb3ed]
stc
popfd
fsubr qword [ebx]
je 0x43d163
cmp edx, dword es:[eax + 0x38]
mov dword [0x7d0d3639], eax
add esp, edx
add eax, 0xf049d600
movsd dword es:[edi], dword [esi]
daa
jecxz 0x43d12f
pop edi
or al, 0x55
sbb byte [eax], dh
cmp al, 0x7d
std
arpl word [ebx + 0x30], sp
sahf
add dl, byte [ecx + ecx*8 - 0x72]
enter 0xffffffffffffdd57, 3
ret 0x6fb
Function at 0x43ece0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
pop ss
add esp, dword [ebx + ebp*2 - 0x2d0b1e6b]
pop ds
les edi, [esi - 0x1a11f012]
salc
call dword [eax - 0x5b]
sbb eax, dword [esp + ebx*4 - 0x639975d0]
wait
inc ecx
clc
and edi, dword [edi + 0x52a05afe]
xor eax, 0x121f425e
sub dword [ebx], esp
xor eax, 0xc6b19703
add al, 0xc1
push ebx
xchg ebx, eax
xor dword [eax + edi*8 + 0x7d], 0xffffffed
adc al, 0xef
xchg esp, eax
mov edx, 0xb92d3c3a
pop esp
sbb al, 0xb0
mov esp, 0xd84a8f95
insb byte es:[edi], dx
mov cl, 0x93
div byte [esi + 0x75]
test dword [ecx - 0x2a], esp
xchg dword [edi - 0x6a], edi
test edx, ebp
jg 0x43ecfa
rcr dword [esi - 0x5c], cl
fnstenv [eax]
dec eax
mov ah, 0x90
xchg esp, eax
mov eax, 0xeda5fdb1
aad 0xba
inc ecx
shr dword [edi + 0x7b], 1
nop
cli
mov dl, 0x6c
inc ecx
not byte [ebx - 4]
jecxz 0x43ed8f
popfd
mov byte [esi + ebx*8], al
int 0xb7
push esi
cmp al, 0xbd
fnstenv [edi]
mov cl, 0xf3
leave
add ah, al
adc al, 0xe2
xchg esp, eax
add dword [ebp + 0x5a], 0x6ca37c15
stosb byte es:[edi], al
int1
les edi, [eax + eax - 0x24]
mov bh, 0xdd
jge 0x43ed2b
test eax, 0xfaa220c6
inc eax
ret
adc eax, 0x37543bbd
mov bh, 0xbd
xor eax, 0xe641e72f
lcall 0xe4d6, 0x8162a76a
cmp eax, 0x3d2c5cf9
hlt

Function at 0x46d795
Capabilities:
Encode data using xor

Disassembly:
add eax, dword [edi - 0x7d788c2f]
invalid
or bh, ch
adc ecx, dword [eax + 0x32]
lodsb al, byte [esi]
sbb dword [eax - 0x716314ea], eax
je 0x46d737
pop edi
sbb eax, 0x1ed26f8c
fadd st(4)
call 0x81f641be
xlatb
sbb byte [edx + ebx*2 - 0x5430b9c5], ch
Function at 0x4823f6
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
jl 0x48246f
and eax, 0xd70c1a83
sub ecx, dword [eax]
invalid
leave
mov esi, 0xba3b4d43
push edi
outsd dx, dword [esi]
js 0x482432
fcomp dword [ecx]
bndstx [esi + ecx*2], bnd0
wait
add eax, 0x8b9643fe
ljmp 0x9c9d
inc ebx
xchg esi, eax
mov ebp, edx
popfd
fmulp st(7)
xor bl, byte [ebp + 0x2ff1139c]
imul edx, ebp, 0x1c
adc dword [ebx], edx
out dx, al
invalid
in al, 3
mov dl, 0x55
test dword [edi], ecx
and al, 0xd3
jnp 0x48241f
invalid

Function at 0x49991e
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffe6
adc cl, bl
inc ebp
clc
insd dword es:[edi], dx
test al, 0x57
add al, dl
push ebx
fidiv dword [0xd9446a1]
aad 0x84
sbb edx, dword [ebx - 0xbb70666]
xchg byte [0xc244545a], cl
pop ecx
std
in eax, 0xdb
xor byte [eax + esi*4 - 0x2e], ch
sbb ebx, dword [edx + edi - 0x25]
pop ss
sbb al, 0xd5
inc edx
xchg esi, eax
mov esi, 0xfa65b6d0
dec edi
sahf
mov byte [0x559905ab], al
sti
push eax
mov byte [ebx - 8], ah
nop
jae 0x49991a
push esi
out dx, eax
add dword [edx - 5], edi
xchg esp, eax
inc ebp
aaa
add al, byte [0xaa4cffba]
les eax, [esi + 0x48]
mov edx, 0xc4aa4cff
inc esi
dec eax
aad 0x76
push 0x44
dec esp
mov edx, 0x7abda48a
enter 0x6218, 0x65
mov ebx, 0x2a10850a
xchg ecx, eax
mov dh, 0xbe
xor dword gs:[eax - 0x45], edi
xor al, 0x44
les edi, [edx - 0x62d024c6]
pushal
sub edi, dword [ebx + 0x4f]
jge 0x499969
scasd eax, dword es:[edi]
wait
jp 0x4999d6
pop edx
test eax, 0xab5b303c
mov esp, 0x8e9db4e0
sti
invalid
Function at 0x4bb691
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3398
cmp edx, dword [eax]
je 0x4bb6b3
add eax, 8
inc ecx
cmp eax, 0x4c3428
jl 0x4bb6a4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3398]
jne 0x4bb7e1
mov eax, dword [0x4c7d3c]
cmp eax, 1
je 0x4bb7bb
test eax, eax
jne 0x4bb6e4
cmp dword [0x4c32c0], 1
je 0x4bb7bb
cmp edx, 0xfc
je 0x4bb7e1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb71b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc070
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc500
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb75e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc500
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09bc
push edi
call fcn.004be3d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc070
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc080
lea eax, [ebp - 0xa0]
push 0x4c099c
push eax
call fcn.004bc080
push dword [esi + 0x4c339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc080
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be344
add esp, 0x2c
pop edi
jmp 0x4bb7e1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c339c]
push 0
push eax
push dword [esi]
call fcn.004bc500
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10010c70
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x10010c85
xor eax, eax
jmp 0x10010cfa
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x10010cb2
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x10010cf5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x10010cf3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x10010cef
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x10010cf3
xor eax, eax
jmp 0x10010cfa
jmp 0x10010ca9
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x401160
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x418004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
mov dword [0x419f18], eax
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 1
jl 0x40119d
mov dword [0x419508], 1
mov dword [0x41950c], esi
xorps xmm0, xmm0
lea eax, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push eax
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], 0x8000
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push 0x401b60
push 0
push 0x81
push dword [0x419f18]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00401eed
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4011f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov eax, ecx
mov ebx, edx
push 0x3f7
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [eax + 1]
add ebx, esi
lea ecx, [ebx + ebx]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40127b
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp - 4]
push ebx
push esi
call fcn.00404b2b
add esp, 0xc
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
push 7
push 0x115
push 0x3f7
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401290
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.004011f0
mov ecx, esi
mov edx, 0x416808
pop esi
jmp fcn.004011f0

Function at 0x4012b0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov edx, str.Ready.
mov esi, ecx
call fcn.004011f0
mov ecx, esi
mov edx, str.Current_platform:_x86
pop esi
jmp fcn.00401290

Function at 0x4012d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4012e6
test al, 0x10
jne 0x4012e6
mov eax, 1
ret
xor eax, eax
ret