joyce8/EMBER2024-capa huggingface dataset:
Function at 0x594cbe
Capabilities:
Encode data using xor

Disassembly:
adc al, 0x88
insd dword es:[edi], dx
push esp
mov byte [0x48623cb1], al
lahf
xchg ebp, eax
invalid
inc esi
inc ebp
sbb eax, 0x2ceaa80
scasd eax, dword es:[edi]
adc cl, dh
add dword [edx + ecx*2 - 0x2f], edx
iretd
and al, 0x91
sbb byte ds:[edx], 0xeb
sub eax, 0xc0de60e7
dec eax
pop ebx
xchg esp, eax
jo 0x594c4e
mov al, 0xa4
sub al, 0xac
lds edx, [edx + 0x4064408c]
loope 0x594c6b
movsd dword es:[edi], dword [esi]
aam 0x67
rcr byte [ecx + 0x7ef0bf11], cl
sub al, 0x95
mov edi, 0x952c7ef0
sub byte [edx], cl
xchg esp, eax
dec edi
dec ebx
push ebp
add byte [ebx], ch
xor esi, esi
cmp byte [eax + 0x7e639476], ah
sub dword [edi - 0x275c03c0], ebx
mov ebp, 0x1eb61105
adc al, 0xf0
xor eax, 0xb5b098dd
and byte [ebx + 0x769109e7], bh
push ebp
cmpsd dword [esi], dword es:[edi]
lodsb al, byte [esi]
stosd dword es:[edi], eax
jne 0x594d0e
push eax
in eax, dx
test al, 0xf2
sal byte [0x10f7bb0f], 1
mov eax, 0xa855fd7e
cmc
xor esp, dword [eax]
push eax
mov edx, dword [esi - 0x5e6b6e4c]
loope 0x594d97
xchg ebx, eax
bnd jbe 0x594d80
and byte [edx - 0x2b717525], al
nop
adc ah, dh
sub edx, edi
mov edi, dr3
sbb al, 0xda
ja 0x594d5f
mov al, 0xce
xchg edx, eax
push dword [esp + eax*4]
mov esp, 0x15f30cd4
xchg dword [ebx - 0x4b3fee7c], ebp
faddp st(7)
jp 0x594ce0
mov al, byte [0x7f572564]
sbb eax, 0x1bc64651
invalid
push ecx
inc esi
invalid
out 2, al
call 0x546c7ec8
aad 0xe0
push ebx
js 0x594dea
fist word [eax - 0x4f6eb210]
fstp dword [0xf80647bc]
push es
clc
bound edx, qword es:[eax]
adc al, 0x16
cld
clc
adc dword [edi], ebx
pop es
sub esp, dword [ecx + 0xf82bc6]
clc
invalid
mov ebp, 0xdef2e727
mov dl, 0xc8
out 0x8b, eax
dec ebp
iretd
xor byte [eax - 0x62], 0x60
xchg dword [edi + 7], edi
in eax, 0x63
xor dh, byte [esi - 0xc]
jbe 0x594de0
cmpsb byte [esi], byte es:[edi]
and edi, dword [0x6fc46d8e]
je 0x594dab
push eax
xchg ebp, eax
sub al, 0x2f
fprem1
jle 0x594e3a
push ebx
xor dword [edx + 0x4614d1f4], 0x60
sbb eax, 0x656e9c21
pop ecx
adc byte [edi - 0x11], ah
stosd dword es:[edi], eax
pop ebx
inc ecx
mov eax, dword [0xbc7bd1b0]
inc ebx
mov bl, 0xe6
xor dl, byte [ecx - 0x16]
dec ebx
dec esi
dec ebp
jmp 0x594e51
pop ebp
and dword [edi - 0x6e8a48b5], esp
mov edx, 0xa92b214a
loope 0x594ea1
xchg di, ax
fiadd dword [eax + 0x2684f0fa]
invalid
out 0xb8, eax
push 0x48c10344
fdivr dword [ebp + 0x32666456]
mov bh, 0x15
call 0x6831e865
or dword [ecx + 0x78b66ef8], edi
xor dh, byte [edi - 0x65ff17eb]
fsub dword [edi + 9]
mov ecx, 0x78b66ef8
push es
and edi, dword [edx + 0x27a5c6b1]
xor eax, 0x75799df4
dec esp
loopne 0x594e5c
mov ebp, 0xe29aec5f
adc byte [ebx + 0x6155c0b2], ch
fimul dword [edi]
jle 0x594ec1
mov ebx, 0x8772ee83
add dl, byte [ecx - 0x11672c1c]
and byte [edi + 0x34], 0xe8
xor dword [edx - 0x4f], esp
aad 0x12
and eax, 0x4ce27a8
das
into
add al, 0x2f
push esi
cld
jb 0x594eb2
imul ecx, ebp, 0x2f
mov ecx, 0x2f3393f9
out 0x4e, al
invalid
cmpsb byte [esi], byte es:[edi]
nop
ret 0xc08c
Function at 0x59ce2e
Capabilities:
Get number of processors

Disassembly:
pop eax
std
and cl, 0x93
sal byte [ebp + 0x1c09724f], 1
in eax, 0x3c
dec edi
mov ch, 0x4f
jb 0x59ce41
sbb al, 0xe5
cmp al, 0x4f
adc ecx, dword [eax - 0xf704ce4]
xor ebx, dword [esi - 0x63ca7f0f]
lock xor ebx, dword [esi - 0x63ca7f0f]
inc esp
rcl byte [ebp - 0x3f]
in al, 0xd2
lcall 0x516b, 0x4e53f5c4
mov ecx, 0xe24a5f2
pop esi
movsb byte es:[edi], byte [esi]
inc ebp
xchg esi, eax
add ah, al
push edi
pop ds
sal byte [esp + eax*8], cl
mov bl, byte [eax - 0x650a5e75]
or byte [edi + 0x30], dl
mov dh, 0x65
dec esi
adc al, 0x50
add al, 0xe0
movsb byte es:[edi], byte [esi]
jecxz 0x59ce86
das
stc
cdq
int1
cmc
push ebp
mov ch, pe_nt_image_headers32
ror byte [esi], cl
jno 0x59ce74
or ebx, eax
mov edx, 0xe7c4f312
jb 0x59ce34
out dx, eax
jo 0x59ced5
mov edi, 0x10c49b61
push ebx
invalid
pop ebp
jns 0x59cf1b
ret 0x113f
sub edi, esp
wait
daa
cmp ebp, edx
test byte [ebx], bl
out dx, al
cmp ch, bh
scasd eax, dword es:[edi]
insb byte es:[edi], dx
push edi
fisub dword [ebp + 0x35893562]
in al, dx
aad 0x64
invalid

Function at 0x60625e
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0063974e
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606381
push ecx
lea ecx, [esi + 0x18]
call fcn.00625a7e
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x606398
push ecx
lea ecx, [esi + 0x24]
call fcn.0062598e
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x60b972
Capabilities:
Encode data using xor

Disassembly:
sbb ah, dh
or byte [edx + 0x5b], 0x1f
out dx, al
and dword [eax + 0x35b565d7], 0x78
and byte [edx], ch
stosd dword es:[di], eax
cmc
ja 0x60ba03
invalid
xchg edx, eax
div dword [edi + ecx*8 + 0x7c]
adc al, 0x12
and eax, 0x3ecb7a8
fsubrp st(7)
dec ebp
push ebp
add eax, 0x48b7010
inc ebx
pushfd
xchg edx, eax
adc bl, al
rol dword [esi - 0x681bafc3], cl
pop edi
popal
out 0x70, eax
and dword [ebx - 0x72], ecx
pop ds
sub eax, 0xd63ae48f
int3

Function at 0x64d35d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6553a8
cmp edx, dword [eax]
je 0x64d37f
add eax, 8
inc ecx
cmp eax, 0x655438
jl 0x64d370
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6553a8]
jne 0x64d4ad
mov eax, dword [0xa58d00]
cmp eax, 1
je 0x64d487
test eax, eax
jne 0x64d3b0
cmp dword [0x6552d4], 1
je 0x64d487
cmp edx, 0xfc
je 0x64d4ad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64d3e7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064dd40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064e1d0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64d42a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064e1d0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x652834
push edi
call fcn.006500a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064dd40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064dd50
lea eax, [ebp - 0xa0]
push 0x652814
push eax
call fcn.0064dd50
push dword [esi + 0x6553ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064dd50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650014
add esp, 0x2c
pop edi
jmp 0x64d4ad
lea eax, [ebp + 8]
lea esi, [esi + 0x6553ac]
push 0
push eax
push dword [esi]
call fcn.0064e1d0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40ef0e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40ef1d
pop dword [ebp - 0x1c]
mov eax, 0xdb4361c
sub eax, 0xd7346ff
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x368d2
push 0
mov eax, 0x6b758a2d
sub eax, 0x6b33981d
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0xb7d593f6
sub ecx, 0xb7d56a0a
xor edx, edx
add edx, eax
mov ebx, 0x5bdadb75
sub ebx, 0x5b975975
add ebx, dword [ebp - 0x1c]
mov edi, 0xfdf4a123
add edi, 0xfb91a50c
add dword [ebp - 4], 0x79df85a6
mov esi, dword [ebx]
xor esi, edi
mov dword [ebp - 0x18], 0x5f728349
mov dword [edx], esi
sub dword [ebp - 0x10], 0x8ea12012
add edx, 4
add ebx, 4
loop 0x40ef7e
add eax, 0x16c9825c
sub eax, 0x16c8e7d9
xor ebx, ebx
add ebx, eax
add eax, 0x61ded884
sub eax, 0x61ded87f
mov ecx, 0x91612a5e
sub ecx, 0x91212a5e
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x7729179c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x76c818fb
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40611c
pop dword [ebp - 0x34]
mov eax, 0x8ac8517f
sub eax, 0x8a87f063
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x7a8dd419
sub dword [ebp - 0x44], 0x2c3b8ece
mov dword [ebp - 0x40], 0x9a06eff0
sub dword [ebp - 0x40], 0x67d3a3ab
mov dword [ebp - 0x3c], 0xe975aa12
add dword [ebp - 0x3c], 0x62d69a1c
mov dword [ebp - 0x38], 0x1e30f4b8
sub dword [ebp - 0x38], 0x1e30f4b8
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe067a24e
sub eax, 0xe02731ee
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x1e948449
sub dword [ebp - 0x44], 0xaa221af3
mov dword [ebp - 0x40], 0x3cc09cda
sub dword [ebp - 0x40], 0xfb543b65
mov dword [ebp - 0x3c], 0xf67d3c55
sub dword [ebp - 0x3c], 0x930dcfe9
mov dword [ebp - 0x38], 0xe1aac799
sub dword [ebp - 0x38], 0xe1aac799
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x3b867
push 0
call eax
mov ecx, 0xae12a57
add ecx, 0xf51f3154
mov ebx, eax
mov edi, 0x410000
add edi, dword [ebp - 0x34]
mov edx, 0x1859feae
add edx, 0xc7bdee6f
mov dword [ebp - 0x18], 0xc8ec95c
mov esi, dword [edi]
add dword [ebp - 0x28], edi
xor esi, edx
add dword [ebp - 0x20], esi
mov dword [ebx], esi
add ebx, 0x14f29a92
add ebx, 0xeb0d6572
add edi, 4
loop 0x406233
add eax, 0x4cbe2d43
add eax, 0xb343343c
mov ebx, eax
add eax, 0xb84cc1d5
add eax, 0x47b33e30
mov ecx, 0xf3e9095a
add ecx, 0xc56f6a6
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040610d
jmp 0x406676

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403cf8
nop
sub eax, 0x403c9e
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x1000800f
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x178
mov eax, 0x1000bbb4
call fcn.10009cac
cmp byte [0x10044502], 0
mov edi, dword [ebp + 8]
push 0xa
pop eax
jne 0x1000819d
lea eax, [ebp - 0x15c]
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SOFTWAREApple_Computer__Inc.QuickTime
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100080c1
lea eax, [ebp - 0x160]
mov dword [ebp - 0x160], 4
push eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x16c]
push eax
push ebx
push str.Version
push dword [ebp - 0x15c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x15c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100080c1
mov ecx, dword [ebp - 0x164]
mov eax, ecx
shr eax, 0x18
shr ecx, 0x10
push 0xa
mov byte [0x1004450b], al
mov byte [0x1004450a], cl
mov word [0x10044508], bx
pop eax
jmp 0x1000818e
push 0x104
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.kernel32.dll_GetSystemDirectoryA]
push ebx
push 0x1000cb50
lea eax, [ebp - 0x128]
push 0x118
push eax
call fcn.1000aaa3
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
add esp, 0x18
test eax, eax
jne 0x10008180
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x184]
call fcn.1000aaa3
lea ecx, [ebp - 0x184]
call fcn.1000aaa3
mov esi, edx
mov ebx, eax
mov ecx, esi
mov edx, ebx
shr ecx, 0x10
mov eax, esi
and cl, 0xf
mov byte [0x1004450b], cl
mov ecx, esi
shrd edx, ecx, 0x1c
mov ecx, ebx
shrd ecx, eax, 0x10
shrd ebx, esi, 0x1c
xor dl, cl
xor eax, eax
and dl, 0xf
mov word [0x10044508], ax
xor dl, bl
mov dword [0x10044504], eax
mov byte [0x1004450a], dl
mov esi, eax
lea ecx, [ebp - 0x184]
mov dword [ebp - 4], eax
mov dword [ebp - method.CFileVersion.virtual_0], vtable.CFileVersion.0
call fcn.10007bfb
or dword [ebp - 4], 0xffffffff
mov ebx, dword [0x10044504]
test esi, esi
push 0xa
pop eax
cmovne ebx, eax
mov dword [0x10044504], ebx
mov byte [0x10044502], 1
jmp 0x100081a3
mov ebx, dword [0x10044504]
test ebx, ebx
jne 0x100081bd
push 4
push 0x10044508
push edi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
call fcn.10009c56
ret
mov dword [ebp - 0x168], eax
lea eax, [ebp - 0x168]
push 0x10042958
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x40aa5b
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x41a004]
xor eax, esp
mov dword [esp + 0x38], eax
push esi
mov esi, dword [ebp + 8]
push 0x4074dc
push 0x4074f8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40aa95
push 0x800
call eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [esp + 0xc]
call fcn.00409cb0
push esi
lea ecx, [esp + 0x24]
call fcn.0040921b
lea ecx, [esp + 0x20]
call fcn.004095c7
mov esi, eax
test esi, esi
jns 0x40aae9
lea ecx, [esp + 8]
call fcn.0040a9d0
test al, al
je 0x40ab33
cmp esi, 0x80040b00
jne 0x40ab33
lea ecx, [esp + 0x20]
call fcn.00409683
mov esi, eax
test esi, esi
js 0x40ab33
mov esi, 0x80040b02
jmp 0x40ab33
cmp dword [esp + 0x1c], 8
lea esi, [esp + 8]
jb 0x40aaf8
mov esi, dword [esp + 8]
push 0x406f80
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40ab2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x40ab24
jle 0x40ab33
movzx esi, si
or esi, 0x80070000
jmp 0x40ab33
mov esi, 0x80004005
jmp 0x40ab33
push dword [ebp + 0x14]
push esi
call eax
mov esi, eax
lea ecx, [esp + 0x20]
call fcn.004092b7
lea ecx, [esp + 8]
call fcn.00409da9
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040b187
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40c074
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40c0af
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40c096
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40c0a7
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40c0b1
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40c08c
xor eax, eax
pop edi
pop esi
ret

Function at 0x40c380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push dword [ebp + 8]
call fcn.0040bff9
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.0040c034
lcall 0xe845, 0x8d9a0f49
invalid
pop ebp
Function at 0x40c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
cwde
pop ss
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0040c044
push eax
push esi
push dword [ebp + 8]
call fcn.0040bff9
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040c044
push eax
push esi
push dword [ebp + 8]
call fcn.0040bff9
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040c034
xor dl, byte [esi + esi]
add byte [eax - 0x8363], cl
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
Function at 0x40c777
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40c70b
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40c729
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40c787
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40c76e
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je fcn.0040c777
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40c781
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40c763
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40c6ed
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40c7d4
dec eax
je 0x40c7cb
sub eax, 3
je 0x40c7c2
mov dword [ebp - 4], 0x40
jmp 0x40c7f1
mov dword [ebp - 4], 4
jmp 0x40c7d7
mov dword [ebp - 4], 0x20
jmp 0x40c7d7
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40c823
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40c7a3
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040c034
bound eax, qword [edx + 0x75ff5193]
adc al, 0x6a
add dword [esi - 1], edx
xlatb
mov eax, esi
jmp 0x40c82f
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret