joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4249a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43ae09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.MemoryData.0
mov eax, dword [esi + 0xc]
xor ebx, ebx
cmp eax, ebx
mov dword [esp + 0x14], 3
je 0x4249e3
cmp byte [esi + 9], bl
je 0x4249e3
push eax
call fcn.00430938
add esp, 4
lea ecx, [esi + 0x4c]
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x10], ebx
mov byte [esp + 0x14], 2
call fcn.0042c660
lea ecx, [esi + 0x30]
mov byte [esp + 0x14], 1
call fcn.004141b0
lea ecx, [esi + 0x1c]
mov byte [esp + 0x14], bl
call fcn.004174b0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.00418080
mov ecx, dword [esp + 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x424b10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43ae3e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [esp + 4], esi
call fcn.00418040
xor eax, eax
lea ecx, [esi + 0x1c]
mov dword [esp + 0x10], eax
mov byte [esi + 8], al
mov byte [esi + 9], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
call fcn.00416ea0
lea ecx, [esi + 0x30]
mov byte [esp + 0x10], 1
call fcn.00414020
lea ecx, [esi + 0x4c]
mov byte [esp + 0x10], 2
call fcn.0042c620
mov ecx, dword [esp + 8]
mov dword [esi], vtable.MemoryData.0
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x425050
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43aed8
push eax
mov dword fs:[0], esp
sub esp, 0x5c
xor edx, edx
push ebx
push ebp
push esi
mov esi, ecx
xor ecx, ecx
push edi
lea eax, [esi + 0x34]
lea edi, [esi + 8]
xor ebp, ebp
mov dword [eax], ecx
mov dword [eax + 4], ecx
lea eax, [esi + 0x3c]
mov dword [esi + 0x3c], edx
mov dword [eax + 4], edx
lea eax, [esi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [eax + 4], ecx
mov ecx, edi
mov dword [esi + 0x44], ebp
mov byte [esi + 0x24], 0
mov dword [esi + 0x28], ebp
call fcn.00413b90
mov ebx, dword [esp + 0x7c]
cmp ebx, ebp
jne 0x4250c6
mov ecx, dword [esp + 0x80]
cmp ecx, ebp
je 0x4250bf
mov edx, dword [ecx]
push str.loadFileInfoAnsi_failed:_no_filename
call dword [edx + 0x10]
xor al, al
jmp 0x425216
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4250fd
mov esi, dword [esp + 0x80]
cmp esi, ebp
je 0x4250f6
mov eax, dword [esi]
push str.loadFileInfoAnsi_failed:_cannot_get_attributes
mov ecx, esi
call dword [eax + 0x10]
mov edx, dword [esi]
push ebx
push str.filename
mov ecx, esi
call dword [edx + 0x2c]
xor al, al
jmp 0x425216
mov dword [esi + 0x44], eax
lea ecx, [esp + 0x10]
shr eax, 4
and al, 1
mov byte [esi + 0x24], al
call fcn.004180d0
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], ebp
call fcn.004182e0
lea ecx, [esp + 0x10]
call fcn.00418980
push eax
mov ecx, edi
call fcn.00414510
mov al, byte [esi + 0x24]
mov ebp, dword [esp + 0x80]
test al, al
push ebp
je 0x42514b
lea eax, [esp + 0x14]
push eax
call fcn.004156c0
jmp 0x425155
lea ecx, [esp + 0x14]
push ecx
call fcn.004155b0
mov edi, eax
add esp, 8
cmp edi, 0xffffffff
jne 0x425196
test ebp, ebp
je 0x42517e
mov edx, dword [ebp]
push str.loadFileInfoAnsi_failed:_cannot_open_for_reading
mov ecx, ebp
call dword [edx + 0x10]
mov eax, dword [ebp]
push ebx
push str.filename
mov ecx, ebp
call dword [eax + 0x2c]
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.00418190
xor al, al
jmp 0x425216
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x3c]
push eax
lea eax, [esi + 0x34]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x4251ec
test ebp, ebp
je 0x4251cc
mov edx, dword [ebp]
push str.loadFileInfoAnsi_failed:_cannot_get_file_time
mov ecx, ebp
call dword [edx + 0x10]
mov eax, dword [ebp]
push ebx
push str.filename
mov ecx, ebp
call dword [eax + 0x2c]
push 0
push edi
call fcn.004246e0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.00418190
xor al, al
jmp 0x425216
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov dword [esi + 0x28], eax
call fcn.004246e0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], 0xffffffff
call fcn.00418190
mov al, 1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8
Function at 0x425230
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x43aef8
push eax
mov dword fs:[0], esp
sub esp, 0x5c
xor eax, eax
xor edx, edx
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x34]
lea edi, [esi + 8]
mov ecx, ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [esi + 0x3c]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
lea eax, [esi + 0x2c]
mov dword [esi + 0x2c], ecx
mov dword [eax + 4], ecx
xor eax, eax
mov ecx, edi
mov dword [esi + 0x44], eax
mov byte [esi + 0x24], al
mov dword [esi + 0x28], eax
call fcn.00413b90
mov ebp, dword [esp + 0x7c]
test ebp, ebp
je 0x42533c
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x42533c
mov dword [esi + 0x44], eax
lea ecx, [esp + 0x10]
shr eax, 4
and al, 1
mov byte [esi + 0x24], al
call fcn.004180d0
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0
call fcn.004183a0
lea ecx, [esp + 0x10]
call fcn.00418980
push eax
mov ecx, edi
call fcn.00414510
mov al, byte [esi + 0x24]
test al, al
je 0x4252f2
mov edx, dword [esp + 0x80]
lea eax, [esp + 0x10]
push edx
push eax
call fcn.004156c0
jmp 0x425304
mov ecx, dword [esp + 0x80]
lea edx, [esp + 0x10]
push ecx
push edx
call fcn.004155b0
mov edi, eax
or ebp, 0xffffffff
add esp, 8
cmp edi, ebp
je 0x42532f
lea eax, [esi + 0x2c]
push eax
lea eax, [esi + 0x3c]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
push 0
push edi
jne 0x425340
call fcn.004246e0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], ebp
call fcn.00418190
xor al, al
jmp 0x425363
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
mov dword [esi + 0x28], eax
call fcn.004246e0
add esp, 8
lea ecx, [esp + 0x10]
mov dword [esp + 0x74], ebp
call fcn.00418190
mov al, 1
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8

Function at 0x4264d0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push edi
mov edi, ecx
mov dword [edi], vtable.ZipCRC.0
mov al, byte [0x44f714]
test al, al
jne 0x426545
push ebx
push ebp
push esi
xor ebx, ebx
mov esi, 0x44f314
push 8
push ebx
mov ecx, edi
call fcn.00426550
shl eax, 0x18
mov dword [esi], eax
mov edx, 8
mov ebp, eax
mov ecx, ebp
mov eax, ecx
and eax, 0x80000000
neg eax
sbb eax, eax
add ecx, ecx
and eax, 0x4c11db7
xor eax, ecx
dec edx
mov ebp, eax
jne 0x426502
push 0x20
push eax
mov ecx, edi
mov dword [esi], ebp
call fcn.00426550
mov dword [esi], eax
add esi, 4
inc ebx
cmp esi, 0x44f710
jle 0x4264ec
pop esi
pop ebp
mov eax, edi
pop ebx
mov byte [0x44f714], 1
pop edi
ret
mov eax, edi
pop edi
ret

Function at 0x4265a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
test edx, edx
mov esi, ecx
je 0x4265dd
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4265dd
push ebx
push edi
lea edi, [eax]
mov eax, dword [esi + 4]
xor ebx, ebx
mov bl, byte [edx]
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x44f314]
xor ecx, eax
inc edx
dec edi
mov dword [esi + 4], ecx
jne 0x4265b7
pop edi
pop ebx
pop esi
ret 8
Function at 0x427310
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag

Disassembly:
push 0xffffffffffffffff
push 0x43b10a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.00418040
xor ebx, ebx
lea ecx, [esi + 0x4c]
mov dword [esp + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], ebx
mov byte [esi + 0x48], bl
mov byte [esi + 0x49], bl
call fcn.00414020
lea ecx, [esi + 0x70]
mov byte [esp + 0x14], 1
mov dword [esi + 0x68], ebx
mov byte [esi + 0x6c], bl
call fcn.00414020
lea ecx, [esi + 0x90]
mov byte [esp + 0x14], 2
mov byte [esi + 0x8c], bl
call fcn.00414020
lea ecx, [esi + 0xc0]
mov byte [esp + 0x14], 3
mov word [esi + 0xac], bx
mov byte [esi + 0xae], bl
mov dword [esi + 0xb0], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xbc], ebx
call fcn.00423590
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 4
call fcn.00423590
lea ecx, [esi + 0x40]
xor eax, eax
mov dword [esi], vtable.ExeResource.0
xor edx, edx
mov dword [ecx], eax
mov dword [ecx + 4], eax
lea eax, [esi + 0x30]
xor ecx, ecx
mov dword [eax], edx
mov dword [eax + 4], edx
mov dword [eax + 8], edx
mov dword [eax + 0xc], edx
lea edx, [esi + 0x20]
lea eax, [esi + 0x1c]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x42a4e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov edx, 1
cmp dword [esi + 0x50], edx
jle 0x42a5eb
push ebx
push edi
lea eax, [esi + 0x66]
xor ebx, ebx
xor ecx, ecx
mov bl, byte [eax - 1]
mov cl, byte [eax + 1]
add eax, 0x10
mov edi, dword [ebx*4 + 0x44c6b8]
mov ecx, dword [ecx*4 + 0x44ceb8]
xor ebx, ebx
xor ecx, edi
mov bl, byte [eax - 0x10]
mov edi, dword [ebx*4 + 0x44cab8]
xor ebx, ebx
mov bl, byte [eax - 0x12]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c2b8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0x12], ecx
mov bl, byte [eax - 0xc]
xor ecx, ecx
mov cl, byte [eax - 0xb]
mov edi, dword [ebx*4 + 0x44cab8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x44ceb8]
mov bl, byte [eax - 0xd]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c6b8]
xor ebx, ebx
mov bl, byte [eax - 0xe]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c2b8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xe], ecx
mov bl, byte [eax - 8]
xor ecx, ecx
mov cl, byte [eax - 7]
mov edi, dword [ebx*4 + 0x44cab8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x44ceb8]
mov bl, byte [eax - 9]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c6b8]
xor ebx, ebx
mov bl, byte [eax - 0xa]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c2b8]
xor ebx, ebx
xor ecx, edi
mov dword [eax - 0xa], ecx
mov bl, byte [eax - 4]
xor ecx, ecx
mov cl, byte [eax - 3]
mov edi, dword [ebx*4 + 0x44cab8]
xor ebx, ebx
mov ecx, dword [ecx*4 + 0x44ceb8]
mov bl, byte [eax - 5]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c6b8]
xor ebx, ebx
mov bl, byte [eax - 6]
xor ecx, edi
mov edi, dword [ebx*4 + 0x44c2b8]
xor ecx, edi
inc edx
mov dword [eax - 6], ecx
mov ecx, dword [esi + 0x50]
cmp edx, ecx
jl 0x42a4f6
pop edi
pop ebx
pop esi
ret
Function at 0x42c780
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 4]
push edi
cmp eax, 0xffffffff
jne 0x42c79d
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov ebp, dword [esp + 0x2c]
mov esi, dword [ebx + 8]
xor edi, edi
lea ecx, [esp + 0x1c]
mov edx, dword [ebp]
push edi
push ecx
push edx
push eax
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x42c7d2
mov dword [ebx + 8], esi
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [ebp]
mov ecx, dword [esp + 0x38]
mov dword [ebx + 8], eax
call fcn.004236c0
push 0x4e20
xor esi, esi
call fcn.004313b4
mov ecx, dword [ebx + 8]
add esp, 4
lea edx, [esp + 0x10]
mov ebp, eax
mov eax, dword [ebx + 4]
push edi
push edx
push 0x4e20
push ebp
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x2c], edi
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42c830
push ebp
call fcn.00430938
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov eax, dword [esp + 0x10]
cmp eax, edi
jne 0x42c84d
push ebp
call fcn.00430938
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
cmp eax, 4
jge 0x42c867
push ebp
call fcn.00430938
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov ecx, dword [ebx + 8]
mov edx, dword [esp + 0x30]
add ecx, eax
mov dword [esp + 0x14], eax
mov dword [ebx + 8], ecx
mov edi, dword [ebp]
cmp edi, edx
mov ecx, ebp
je 0x42c925
mov edi, dword [ecx]
cmp edi, dword [esp + 0x34]
je 0x42c925
cmp eax, 4
jl 0x42c8a9
mov edi, dword [esp + 0x18]
dec eax
inc esi
inc edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
lea ecx, [esi + ebp]
jmp 0x42c91d
test eax, eax
je 0x42c8d7
mov ecx, eax
add esi, ebp
mov edx, ecx
lea edi, [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
lea esi, [esp + 0x20]
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, 0x4e20
lea ecx, [esp + 0x10]
push 0
sub edx, eax
push ecx
mov ecx, dword [ebx + 4]
add eax, ebp
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x42c931
mov eax, dword [esp + 0x10]
test eax, eax
je 0x42c931
mov edx, dword [ebx + 8]
mov ecx, dword [esp + 0x14]
add edx, eax
xor esi, esi
add ecx, eax
mov dword [ebx + 8], edx
mov edx, dword [esp + 0x30]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, ebp
cmp dword [ecx], edx
jne 0x42c884
mov eax, dword [ecx]
cmp eax, edx
je 0x42c946
cmp eax, dword [esp + 0x34]
je 0x42c946
push ebp
call fcn.00430938
add esp, 4
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
add eax, edx
mov edx, dword [esp + 0x2c]
push 4
push ecx
mov ecx, dword [esp + 0x40]
mov dword [edx], eax
call fcn.00417760
push ebp
call fcn.00430938
add esp, 4
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x42c980
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jne 0x42c997
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov edi, dword [esp + 0x14]
mov ebx, dword [esi + 8]
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
mov dword [esi + 8], eax
jne 0x42c9c9
mov dword [esi + 8], ebx
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov dword [esi + 8], edi
mov edi, dword [esp + 0x1c]
mov ecx, edi
call fcn.004236c0
mov ebx, dword [esp + 0x18]
mov ecx, edi
push ebx
call fcn.004174e0
mov ecx, edi
call fcn.00416de0
test eax, eax
jne 0x42c9f7
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
lea edx, [esp + 0x14]
push 0
push edx
push ebx
push eax
mov eax, dword [esi + 4]
push eax
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42ca1f
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret 0xc
mov eax, dword [esi + 8]
pop edi
add eax, ebx
mov dword [esi + 8], eax
pop esi
mov al, 1
pop ebx
pop ecx
ret 0xc

Function at 0x42fd30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp eax, ecx
je 0x42fd5b
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret 4

Function at 0x433fb9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x44dd78
cmp edx, dword [eax]
je 0x433fdb
add eax, 8
inc ecx
cmp eax, 0x44de08
jl 0x433fcc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x44dd78]
jne 0x434109
mov eax, dword [0x44ff24]
cmp eax, 1
je 0x4340e3
test eax, eax
jne 0x43400c
cmp dword [0x44d7e4], 1
je 0x4340e3
cmp edx, 0xfc
je 0x434109
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x434043
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004361c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004357f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x434086
lea eax, [ebp - 0x1a4]
push eax
call fcn.004357f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43cf0c
push edi
call fcn.00431520
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004361c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004361d0
lea eax, [ebp - 0xa0]
push 0x43ceec
push eax
call fcn.004361d0
push dword [esi + 0x44dd7c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004361d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004362b0
add esp, 0x2c
pop edi
jmp 0x434109
lea eax, [ebp + 8]
lea esi, [esi + 0x44dd7c]
push 0
push eax
push dword [esi]
call fcn.004357f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42e6a4
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x52373706
fsub dword [ebp + edx - 0x49]
dec ebp
scasb al, byte es:[edi]
add byte [esi + 0x18dc8e07], bl
aas
xor byte [edi], 0x82
out 0x82, eax
invalid

Function at 0x449774
Capabilities:
Encode data using xor

Disassembly:
mov dh, 1
pushfd
pop ecx
xor al, 0x77
les edx, [ebp + 0x1d816928]
insd dword es:[edi], dx
lea eax, [0x2c994c96]
mov ecx, 0x1efa7b2
jg 0x449778
ret 0x2425

Function at 0x45c2f4
Capabilities:
Encode data using xor

Disassembly:
popfd
cli
xchg dword [esi], edi
dec esp
jmp 0x45c310
aad 0x32
cmp eax, 0x5d28f996
jp 0x45c34d
inc ebx
invalid
sub eax, 0x37fc92e
or dword [ebx - 8], esi
add ecx, dword [ecx]
jae 0x45c349
sbb al, 0xa9
std
mov edi, 0x43600668
dec esi
sbb eax, 0x8cf4ad5f
arpl bx, cx
sub bh, 0xd
adc byte [ebx - 0x40], ch
jbe 0x45c312
ljmp 0x3ec7:0xdf04762b

Function at 0x4d514b
Capabilities:
Check for software breakpoints

Disassembly:
adc ch, byte [ecx]
sti
sub byte [esi + eax*8 + 0x1ef4d11], 0x4f
xchg esi, eax
out 0xc0, eax
jl 0x4d5191
sbb bh, byte cs:[ecx - 0x261f37aa]
sbb ah, ch
inc edx
aam 0x5d
test dword [esi], esi
mov ebp, 0x1703e874
jno 0x4d5198
mov eax, dword [0x2b98df8c]
adc al, 0x2c
in eax, 0xda
imul esp, dword [esi - 5], 0x24a43e92
mov al, 1
shr esi, 1
outsb dx, byte [esi]
push 0x903794ed
fcmovb st(0), st(5)
mov ah, 0x58
popfd
mov esi, 0x403cff2b
in al, dx
test al, 0xb9
sub byte [0x120efd68], bl
xlatb
and al, 0x40
jb 0x4d51af
and byte [esi - 0x5e0d6246], bl
or al, cl
or byte [esi + 0x653f0af7], 0xa2
push ebx
and byte [edi + 0xda4b9dc], bh
invalid
invalid

Function at 0x50fb98
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x24fefffc
pop eax
jg 0x50fbc2
cmc
std
dec esi
mov dword [eax - 0x1e9c91e2], edi
jo 0x50fbc5
sal dword [eax], 0x55
sahf
hlt
in eax, 0x4d
fisub dword [ebx - 4]
arpl sp, di
daa
jno 0x50fc33
insd dword es:[edi], dx
shr dword [edi + 0x74714155], 0x51
mov ds, ebx
push ebx
int3
invalid
inc esi
lodsb al, byte [esi]
jg 0x50fbd5
mov bl, 0x32
xor dl, al
retf
ror bl, 1
mov esi, 0x24130132
mul dword [eax]
enter 0xffffffffffffd334, 0xb
jae 0x50fc38
int1
fadd st(1), st(0)
mov byte [0xae46f3bc], al
shl byte [ebp + 0x4c769c93], 0x15
scasb al, byte es:[edi]
mov edi, 0x222312fe
jb 0x50fc28
and eax, 0x21e17d6b
adc dword [edx], edx
insb byte es:[edi], dx
inc ebx
xchg edi, eax
outsb dx, byte [esi]
out dx, al
popal
dec ebx
mov esi, 0xa74e4e87
out dx, al
int3

Function at 0x59f348
Capabilities:
Encode data using xor

Disassembly:
pop ebp
and byte [eax - 0x759462eb], cl
in al, 0xe0
aad 0x4c
mov ch, 0x5c
sbb al, 0xdf
cmp esp, dword [eax + edx + 0x77bd54c7]
sub al, 0xa
invalid
Function at 0x600454
Capabilities:
Encode data using xor

Disassembly:
fisttp dword [edi + 0x75]
mul byte [ecx - 0x64dcbb8c]
sbb ebx, dword [ecx + 0x631e85ba]
dec edi
xor byte [esi + 0x4921193c], 0xee
push ebp
test dword [ebp - 0x87bd85e], ecx
xchg esp, eax
push ebx
jb 0x600463
popal
mov ch, 0xfa
clc
fcomp qword [eax - 0x1bf96cf1]
mov bl, byte [ebp + 0xb39bfb3]
dec edx
push ebp
inc byte [edi]
inc ecx
imul edi, dword [edi + 0x55faf2a9], 0x4c5e0faa
cmp byte [edi - 0x6d], dl
sbb eax, 0xf0bbefb4
add ebx, edi
mov bh, 0xf1
pop edi
and dword [esi + 0x486a6d80], esi
mov edi, edi
mov ecx, ecx
mov ebp, ebp
mov ebx, ebx
mov ecx, ecx
mov edx, edx
mov edi, edi
mov ecx, ecx
mov edx, edx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x617c24
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
wait
std
lodsd eax, dword [esi]
xor dword [ecx - 0x5d], 0x7f45042b
scasd eax, dword es:[edi]
jnp 0x617bc3
arpl ax, si
invalid
cmp eax, 0xe9561dfd
inc edx
dec ecx
std
sbb eax, 0x4942e956
mov ebx, 0xaf477359
inc ebp
push ecx
loop 0x617bc2
invalid
int 0xc6
in eax, dx
jo 0x617c0f
jle 0x617b9a
pushal
insd dword es:[edi], dx
sub eax, 0x62393a8a
mov esi, 0xb58be454
invalid
dec ebx
cmp eax, 0x5d2f1d76
push cs
sub byte [ebx + 0xeff205], ah
mov dword [0xeff205], eax
test al, 0xb0
in eax, 0xca
xchg edx, eax
mov dword [0x80b3ad82], eax
cmp al, 0x34
push ecx
pushal
pop es
sub al, 0xde
fidiv word [esi]
dec eax
fidiv word [esi]
dec eax
push eax
cli
sbb esp, esp
cmp eax, 0x6ba357af
cmp eax, 0xec614fc2
inc ebx
jg 0x617bce
scasd eax, dword es:[edi]
cwde
xchg edi, eax
lodsb al, byte [esi]
je 0x617c07
dec ebp
mov dl, 0xb7
mov al, 0x5c
mov al, byte [0x826b590b]
jo 0x617cb6
pop edx
je 0x617bde
sar dword [ebx - 0x29ba7e31], cl
adc eax, 0x231ffeed
inc edx
rol byte [edx], cl
dec ebx
stc
xchg edi, eax
retf 0x3b8a
add byte [ebp - 0x4e], ch
insd dword es:[edi], dx
jb 0x617cd6
test byte [0xa30bb972], dl
fstp dword [ebp - 0x34edbf0e]
jb 0x617c26
mov ecx, 0x9dd9a30b
inc eax
or esp, dword [ebx + 0x40f29dd9]
adc cl, bl
adc al, 0x3f
jle 0x617c95
mov cl, byte [ecx + 0x239a6cb2]
jns 0x617c9d
movsd dword es:[edi], dword [esi]
clc
and bl, dh
jmp 0x617cdb
or byte [ebp - 0x1a79b20d], dl
lodsd eax, dword [esi]
pop edx
in al, dx
pushal
aaa
jb 0x617c6b
das
pop ecx
movsb byte es:[edi], byte [esi]
das
pop esp
dec esi
xchg edx, eax
lds edi, [ecx + edi]
sti
sti
xchg edx, eax
adc edx, dword [ecx + 0x5437659c]
adc ebp, dword [eax + 0x4d]
xor dword [esi + 8], ebp
inc esi
mov eax, 0xaef4cf5
jb 0x617cb9
hlt
jecxz 0x617d1f
mov dword [edx], edx
pop edi
add eax, 0xc5a18c32
sbb al, 0x5d
pop ds
pop esi
jmp 0x617c61
jge 0x617d09
loopne 0x617c6c
push ds
dec ecx
cmp eax, 0xe6416c57
arpl word [ecx + 0x56], di
aam 0xd8
cmp byte [edi*2 + 0x3c44b14a], 0xf3
pushfd
or cl, dl
add byte [ecx], bl
cmc
les edi, [ecx]
inc ecx
mov bh, 0x9f
dec edi
shl dword [ebx + 0x255fc833], 0x40
and dword [ebx + 0x32a4296b], edi
dec edi
add ebp, ecx
cmp ebp, ebp
xchg esi, eax
imul esp
xchg ecx, eax
loope 0x617d80
xor cl, byte [edi + 3]
jmp 0xf7f86a4c
sar byte [eax + 0x12], 0x98
mov al, 0xa1
loop 0x617cc4
cmp eax, 0x155920b5
and byte [ecx + 0x15], bl
pop esp
xor byte [ebp - 0x684eddf0], cl
or eax, 0x83b78556
movlps xmm7, qword [ebp + 2]
sbb byte [ecx - 0x18], bh
cld
push esi
sub byte [ebp + 0x52], 0x38
and al, 0xc2
aas
jbe 0x617d22
adc eax, 0x9ea21a53
dec ecx
pushfd
push eax
mov ah, 0xbe
cmp eax, 0x2f228c32
fsubr st(5)
clc
cld
fld st(5)
iretd
dec esp
ret 0x43fd