joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44c92c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
add byte [eax], al
idiv byte [ecx]
jae 0x44c941
jbe 0x44c93f
add byte [ebx + 0x3c8b0443], cl
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
test dword [eax], eax
add byte [ecx], bl
mov ax, word [edi + 8]
inc ebx
add al, ch
xor byte [esi - 0x7d], ah
clc
mov al, 0x85
add byte [eax], al
sbb dword [esi - 0x75], esp
inc edi
or byte [ebx], al
call 0xf8c82f81
pcmpeqd mm0, qword [eax]
add byte [edi + edx*2], cl
call 0xc085b9
add esp, 8
mov eax, dword [ebx + 4]
mov dword [eax], 0
add byte [esi - 0x6d], al
add byte [eax], cl
jb 0x44c93c
mov dword [ebx + 8], 0
pop edi
pop esi
pop ebx
mov ebp, dword [eax + 0xf8bc300]
mov dword [ebp - 4], ecx
test dword [eax], eax
add dh, cl
mov eax, dword [ecx + 0xc]
invalid

Function at 0x4561c7
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [ecx - 0x6382bb], 0xe7e6d4e9
clc
or al, 0xe1
dec eax
aaa
dec dx
xchg ebx, eax
out 0xf8, eax
mov dl, 0x37
sub edx, dword [esi - 0x75979170]
cwde
mov byte [0xcdbe95e7], 0xda
mov dl, 0xf0
out dx, al
loope 0x4561b1
or eax, 0x86ddb643
push ecx
lodsb al, byte [esi]
salc
mov cl, 0xab
into
in eax, dx
pop ds
ret 0x5622
cdq
inc eax
adc ebp, ebx
inc ebp
push esi
rcr dword [esi - 1], 0x94
sub eax, esi
or al, al
insd dword es:[edi], dx
lodsd eax, dword [esi]
mov esi, esp
rcr dword es:[ebx - 0x466407c3], cl
rcr dword [ebx - 0x466407c3], cl
cmp bh, cl
jns 0x45615c
xor byte [ebp + 0x60], dl
nop
adc edi, edx
pop es
mov esi, 0x6f8e8385
adc bh, byte [ecx + 0x199eec9e]
lahf
bound ecx, qword [eax + ecx*8 - 0x3a691582]
ja 0x456226
mov ecx, 0x876f0eb
cmp byte [0xa84ac18f], al
jnp 0x45619d
dec edi
hlt
lodsb al, byte [esi]
push ebx
jmp 0x456265
xchg ebx, eax
scasb al, byte es:[edi]
xor al, 0xc9
xor edi, dword [esi - 0x16]
call 0x8ce30506
push 0x1e
mov esi, 0x400d6146
mov edi, 0xd3394861
popal
dec eax
cmp ebx, edx
xchg esi, eax
sbb eax, 0x72d05256
sahf
mov bl, 0xa7
xor dword [edx + edx*2], 0xa9b46dce
cmp bh, byte [esi + edx*4 + 0x6a9c2623]
pop ds
mov esp, 0xff701f30
out dx, al
add al, 0x95
pushfd
xchg ebp, eax
xlatb
xchg esi, eax
outsd dx, dword [esi]
xor byte [esi + 0x2e], dh
les esp, [esi - 0x29c1c88]
mov dh, 0x55
aad 3
stosb byte es:[edi], al
in eax, 0x69
sal dword [ecx - 0x27], 1
or al, 0x81
adc byte [edi + ebp - 0x40], al
sub al, 0xf5
sti
test byte [ecx + edx], ch
push 0xcfbcea4f
mov edx, 0xb7d9add8
adc bh, cl
jle 0x456279
pop ebx
loopne 0x45634b
invalid
push edi
shl dword [ebx + 0x2ca970b], 1
cld
xchg ebp, eax
jmp 0xdf41f057

Function at 0x45da57
Capabilities:
Encode data using xor

Disassembly:
jne 0x45da45
xchg ebx, eax
cmp eax, 0xd94efcc9
xchg edi, eax
or bl, byte [esi + eax + 0x3f]
iretd
invalid
in eax, dx
push 0x2197f97a
jle 0x45da04
invalid
Function at 0x4648fc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
add byte [eax], al
idiv byte [ecx]
jae 0x464911
jbe 0x46490f
add byte [ebx + 0x3c8b0443], cl
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
test dword [eax], eax
add byte [ecx], bl
mov ax, word [edi + 8]
inc ebx
add al, ch
xor byte [esi - 0x7d], ah
clc
mov al, 0x85
add byte [eax], al
sbb dword [esi - 0x75], esp
inc edi
or byte [ebx], al
call 0xf8c9af51
pcmpeqd mm0, qword [eax]
add byte [edi + edx*2], cl
call 0xc20589
add esp, 8
mov eax, dword [ebx + 4]
mov dword [eax], 0
add byte [esi - 0x6d], al
add byte [eax], cl
jb 0x46490c
mov dword [ebx + 8], 0
pop edi
pop esi
pop ebx
mov ebp, dword [eax + 0xf8bc300]
mov dword [ebp - 4], ecx
test dword [eax], eax
add dh, cl
mov eax, dword [ecx + 0xc]
invalid
Function at 0x46b967
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x11
xor dword [eax + 0x119cfe56], eax
pop esi
push es
in al, dx
sar dword [edx - 0x42ef4481], 0x3e
mov dword [0xc1d9eac1], eax
invalid
test al, 0xb5
mov edx, dword [eax]
adc ah, cl
push ebx
dec ebp
out dx, al
in al, dx
loopne 0x46b9d7
popal
mov eax, dword [0x8d22cc53]
rol byte [edx - 0x71], 1
inc esp
std
jno 0x46b938
or al, 0x41
mul dword [ebx + ebx*4 - 0x4d]
push ecx
shl dword [eax - 0x6e], cl
salc
pop ecx
pop ss
movsb byte es:[edi], byte [esi]
out 0x61, eax
inc byte [ecx - 0x6a]
sbb esi, esi
mov dword [edx - 0x4abfbb71], ecx
loop fcn.0046b967
mov ah, 0x8d
inc edi
mov al, byte [0xcd3c6f4a]
je 0x46b987
adc bh, byte [esi - 0x6ed74677]
test eax, 0xf5a72b67
jmp 0x46ba32
xchg ecx, eax
xor esp, edx
pop ds
invalid
pop ss
aad 0xa0
mov cl, 0xa4
movsb byte es:[edi], byte [esi]
stosb byte es:[edi], al
pop ss
jne 0x46ba0a
sub bl, byte [eax + 0x44]
inc ebx
call dword [ebx]
jnp 0x46ba0a
xchg ebp, eax
imul esi, esi, 0xffffffa1
adc byte [edi + 0x69], cl
insb byte es:[edi], dx
mov eax, dword [0x6c694f10]
xchg ecx, eax
les ecx, [esi - 0x2a]
push ecx
jnp 0x46ba0e
jge 0x46ba28
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
mov dl, 0x64
shl dword [ecx + 0x200e117d], cl
mov eax, dword [0x200e117d]
cmp bl, byte [ecx + 0x16]
push ecx
out 0x49, al
mov ebp, 0xe579ba98
push es
sbb esi, 0xffffffdb
xor dword cs:[bp + di], edi
cmp al, 0x53
sub al, 0xa4
adc dword [eax], esp
or dword fs:[eax + 0x36931a41], ebx
or eax, 0x1716992
add al, 0x85
dec ecx
mov ah, 0x6d
inc ebp
push ecx
out 0x20, al
mov ch, 0xb7
mov esi, 0xdb443c51
or dword [ebp + 0x1461d051], esi
push ecx
shl byte [ecx + 0x14], 1
aaa
in eax, 0xa2
push ds
sar esp, 1
imul esp, dword [edi - 0x290d8a18], 0xffffffb2
les esi, [edi]
pop es
leave
push esp
sbb ebx, esp
and esi, dword [eax]
and eax, 0xad71f012
jbe 0x46ba1f
mov fs, word [edi - 0x33]
movsd dword es:[edi], dword [esi]
in eax, dx
clc
adc al, 0x80
mov byte [0x79e51fc3], al
not byte [ebp + 0x7089a6a3]
bnd jns 0x46bb10
jo 0x46bad2
cmpsb byte [esi], byte es:[edi]
lcall 0x2d56, 0xb3c6e4e8
sbb esp, esi
arpl word [ebx - 0x33], dx
cli
int 0xfa
sub eax, 0x657c7927
lcall 0x702c, 0xe613fea8
lahf
imul ecx, dword [ebp + 0x6f68643c], 0xffffffe0
stosb byte es:[edi], al
in al, 0xe6
xchg ebx, eax
jecxz 0x46bb3a
out dx, al
dec esp
xchg esp, eax
mov ah, 0xd2
or bl, byte [edx]
push ss
inc ecx
xchg ebp, eax
push cs
adc eax, 0x17b33322
jne 0x46ba6e
or ch, 0x11
push ebp
pop ds
xor al, 0x5b
and word [ecx - 0x2d96837e], ax
inc ebx
arpl bx, bp
sti
shl byte [ecx], 0x23
push ds
cdq
inc ebp
push ecx
jne 0x46bab4
push 0xf
push 0x6d
add al, 0x86
jge 0x46bb61
pop ebx
int3
adc al, 0xbd
xor dword [ebx - 0x4748a109], ebx
cmpsd dword gs:[esi], dword es:[edi]
arpl word [ebp + 0x697967ee], si
and byte [ebx + 0x47e669e], cl
mov byte [0x76896cb8], al
jnp 0x46bb5f
arpl word [ecx], sp
sar dword [ebp + 0x7a2a04af], 3
and al, 0xc0
imul edx, esi, 0xffffffb7
Function at 0x47cc8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
add byte [eax], al
idiv byte [ecx]
jae 0x47cca1
jbe 0x47cc9f
add byte [ebx + 0x3c8b0443], cl
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
test dword [eax], eax
add byte [ecx], bl
mov ax, word [edi + 8]
inc ebx
add al, ch
xor byte [esi - 0x7d], ah
clc
mov al, 0x85
add byte [eax], al
sbb dword [esi - 0x75], esp
inc edi
or byte [ebx], al
call 0xf8cb32e1
pcmpeqd mm0, qword [eax]
add byte [edi + edx*2], cl
call 0xc38919
add esp, 8
mov eax, dword [ebx + 4]
mov dword [eax], 0
add byte [esi - 0x6d], al
add byte [eax], cl
jb 0x47cc9c
mov dword [ebx + 8], 0
pop edi
pop esi
pop ebx
mov ebp, dword [eax + 0xf8bc300]
mov dword [ebp - 4], ecx
test dword [eax], eax
add dh, cl
mov eax, dword [ecx + 0xc]
invalid

Function at 0x4815dc
Capabilities:
Encode data using xor

Disassembly:
inc dword [ebp - 0x61]
adc dword [eax + 0x55a2ff00], ebp
pop eax
mov esp, 0x29849d50
pushfd
retf 0x8680
push ecx
sal byte [edi + ebp*4 - 0x1e], cl
cli
je 0x481570
loop 0x4815bd
rcr dword [ecx + 0x21], 1
push esp
hlt
cwde
xor dword [eax - 0x2f], esi
pop edi
loopne 0x48162e
mov ch, 0xcd
ror bl, 1
popal
jg 0x481627
nop
sbb dword [0xa7c352d6], 0xe76c283e
adc eax, edi
pop ebp
outsd dx, dword [esi]
in al, dx
jle 0x481643
je 0x481609
add eax, 0xb1e2c4e1
pop ebx
inc ebx
outsd dx, dword [esi]
sal dword [edi - 9], 0xc
fstp qword [ebp + 0x515c1322]
cmp al, 0xef
add bh, ch
test dword [ebx*8 + 0x5c13229d], 0xef3c51
out dx, eax
pop ebp
push eax
adc eax, 0x7b23a1ff
adc edi, esi
movsx edi, word [edi]
mov bh, 0xef
jge 0x481614
mov edi, 0x7defb73f
fbld tbyte [ebx]
and al, 0x23
xor dword [edi - 0x14ce15df], edi
loope 0x4815bf
jb 0x481656
nop
pop ss
invalid
mov ebp, 0x3b66fb54
add ebx, dword [edi - 0x318f1cdf]
lahf
and ebx, esp
jo 0x48162f
xchg ecx, eax
jns 0x4816ca
xor dword [ebp + 0x6751a53a], esi
push eax
xchg byte [esi - 0x70689ecd], dl
inc edx
out dx, eax
add esi, dword [esi + ebp*8 + 0x1e595d29]
jns 0x48165c
ljmp 0xc68e:0x4f65e1c2
mov esp, 0x841d5011
dec ecx
xchg ebp, eax
adc dword [ebx + 0x4cfa09a1], ecx
movsd dword es:[edi], dword [esi]
invalid
sub ah, ah
dec edi
mov al, 0xbf
add eax, 0xcf7138c
das
and byte [edx - 0x5e4532f9], dl
push edx
pop edi
add al, 0xc6
inc ebp
jp 0x481698
mov ch, 0x41
pop eax
pop esp
popal
mov ch, 0x2e
shr byte [edi], 0xc4
pop ds
or ecx, dword [edi]
mov al, 0xf0
or dl, al
adc al, byte [ebx + edx + 0x2888b495]
mov ebx, 0xae609d66
scasb al, byte es:[edi]
popfd
scasd eax, dword es:[edi]
mov eax, dword [0x5648d321]
pop ds
in eax, 0x7a
jecxz 0x481786
mov cl, 0xde
mov dword [edi - 0x3f], esp
mov edi, 0x46775422
leave
xlatb
in eax, dx
mov al, 0x61
pop ecx
jle 0x4816fe
stosd dword es:[edi], eax
std
pop ss
jg 0x4816a6
add esp, dword [ecx]
sbb eax, 0x332a3a11
les ebp, [edi]
cmp ch, byte [edx]
xor eax, esp
das
mov cl, 0x35
idiv byte [ecx]
xor dh, byte [ecx - 0xecc10a8]
adc bl, ch
jbe 0x481726
loopne 0x4816ed
aad 0xc
push ss
invalid
iretd
Function at 0x49509c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
add byte [eax], al
idiv byte [ecx]
jae 0x4950b1
jbe 0x4950af
add byte [ebx + 0x3c8b0443], cl
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
test dword [eax], eax
add byte [ecx], bl
mov ax, word [edi + 8]
inc ebx
add al, ch
xor byte [esi - 0x7d], ah
clc
mov al, 0x85
add byte [eax], al
sbb dword [esi - 0x75], esp
inc edi
or byte [ebx], al
call 0xf8ccb6f1
pcmpeqd mm0, qword [eax]
add byte [edi + edx*2], cl
call 0xc50d29
add esp, 8
mov eax, dword [ebx + 4]
mov dword [eax], 0
add byte [esi - 0x6d], al
add byte [eax], cl
jb 0x4950ac
mov dword [ebx + 8], 0
pop edi
pop esi
pop ebx
mov ebp, dword [eax + 0xf8bc300]
mov dword [ebp - 4], ecx
test dword [eax], eax
add dh, cl
mov eax, dword [ecx + 0xc]
invalid

Function at 0x4ad4bc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
add byte [eax], al
idiv byte [ecx]
jae 0x4ad4d1
jbe 0x4ad4cf
add byte [ebx + 0x3c8b0443], cl
mov eax, dword [ebx + 4]
mov edi, dword [eax + esi*4]
test dword [eax], eax
add byte [ecx], bl
mov ax, word [edi + 8]
inc ebx
add al, ch
xor byte [esi - 0x7d], ah
clc
mov al, 0x85
add byte [eax], al
sbb dword [esi - 0x75], esp
inc edi
or byte [ebx], al
call 0xf8ce3b11
pcmpeqd mm0, qword [eax]
add byte [edi + edx*2], cl
call 0xc69149
add esp, 8
mov eax, dword [ebx + 4]
mov dword [eax], 0
add byte [esi - 0x6d], al
add byte [eax], cl
jb 0x4ad4cc
mov dword [ebx + 8], 0
pop edi
pop esi
pop ebx
mov ebp, dword [eax + 0xf8bc300]
mov dword [ebp - 4], ecx
test dword [eax], eax
add dh, cl
mov eax, dword [ecx + 0xc]
invalid

Function at 0x4c55ae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4cd1ac]
jne 0x4c55b8
repz ret
jmp fcn.004c7def
Function at 0x4c5e55
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004c4cb6
xor ebx, ebx
cmp dword [0x4d010c], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4c5f2a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4c5e95
xor eax, eax
jmp 0x4c5fee
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x4c5e8e
push eax
call fcn.004c4c53
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4d010c], eax
call esi
push eax
call fcn.004c4c53
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4d0110], eax
call esi
push eax
call fcn.004c4c53
mov dword [0x4d0114], eax
lea eax, [ebp - 8]
push eax
call fcn.004c3f65
test eax, eax
pop ecx
pop ecx
je 0x4c5ef8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004c582b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4c5f2a
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004c4c53
cmp eax, ebx
pop ecx
mov dword [0x4d011c], eax
je 0x4c5f2a
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004c4c53
pop ecx
mov dword [0x4d0118], eax
mov eax, dword [0x4d0118]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x4c5fa3
cmp dword [0x4d011c], esi
je 0x4c5fa3
push eax
call fcn.004c4cbf
pop ecx
call eax
cmp eax, ebx
je 0x4c5f70
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4d011c]
call fcn.004c4cbf
pop ecx
call eax
test eax, eax
je 0x4c5f70
test byte [ebp - 0x18], 1
jne 0x4c5fa3
lea eax, [ebp - 0xc]
push eax
call fcn.004c3f9c
test eax, eax
pop ecx
je 0x4c5f8b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004c582b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x4c5f9a
or dword [ebp + 0x10], 0x200000
jmp 0x4c5fd4
or dword [ebp + 0x10], 0x40000
jmp 0x4c5fd4
mov eax, dword [0x4d0110]
cmp eax, esi
je 0x4c5fd4
push eax
call fcn.004c4cbf
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4c5fd4
mov eax, dword [0x4d0114]
cmp eax, esi
je 0x4c5fd4
push dword [ebp - 4]
push eax
call fcn.004c4cbf
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4d010c]
call fcn.004c4cbf
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ed9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.00401f3f
push 0
lea eax, [ebp - 8]
push eax
push ecx
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x401f0a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
leave
ret 8
Function at 0x4219b4
Capabilities:
Encode data using xor

Disassembly:
inc esi
xchg edx, eax
arpl di, dx
push esp
and ah, al
inc dword [esp - 0x3f]
aam 0x84
invalid
xor al, 0x49
mov byte [0xf6d11b95], dh
mov al, 0x87
adc ecx, esp
jno 0x4218eb
inc esp
and edi, dword [esi]
adc dword [edx + ebp*2 - 0x7c], 3
pcmpeqb mm1, qword [esi]
in eax, 0xac
ljmp 0x5f9a
movsd dword es:[edi], dword [esi]
retf 0x96e5
jl 0x421951
neg byte [eax + 0x1cc4c696]
mov ah, 0x1c
stosd dword es:[edi], eax
add al, byte [esi + 0x5cbe9a16]
add dl, 0x99
push cs
stosb byte es:[edi], al
sub bh, byte fs:[eax]
jb 0x4219af
pop ebp
popal
jg 0x4219f6
js 0x421a0f
add al, 0x4b
ror byte [esi + 0x5a4a4414], 1
xchg ebx, eax
bound ecx, qword [ebx + 3]
sbb byte [ecx + edx*8], al
cmp eax, 0x928c48e9
nop
xchg ebx, eax
test byte [edx + 0x4a], bh
and dh, byte [edx]
push edx
mov edx, 0x61926902
stosb byte es:[edi], al
xchg esi, eax
xchg edx, edx
sbb dword [ecx + edx*2 + 0x7c], 0x334fcf07
mov dword [0xa342d870], eax
jl 0x4219ff
iretd
xor esp, dword [ebx - 0x5cbd2790]
mov dword [0x41ba9811], eax
js 0x42198d
adc dword [eax - 0x7887be46], ebx
in al, dx
dec ebp
sbb byte [ebp + 0x3bc8fa48], ch
add byte [esi], 0x82
mov al, 0x6e
inc esi
daa
push esp
mov ebp, 0x30c902e9
sub eax, 0xade8638f
cdq
arpl word [edx + 0x43], di
loop 0x4219fa
add al, 0x26
xor byte [eax + 0x5427466e], 0xbd
jmp 0xf372e31f
cmp ch, dl
mov dword [0x62f1ac27], edi
mov edx, 0xe76539f8
sahf
push ss
pop ss
mov cl, byte [edx + 0x1b]
push edi
pop eax
add al, 0x5e
rcr dword [ebx + 0x602b1ed7], 1
inc edx
retf
Function at 0x456558
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
xor bl, al
sti
jno 0x456568
xor ecx, dword [eax - 0x67]
add esi, esi
out 0xf3, eax
push esi
mov dword [eax], edx
fadd dword [ebp + 0x655ac13f]
xchg edx, eax
adc al, bl
test dword [edi], edi
rcr dword [edx + 0x65], 0x2e
xchg edx, eax
mov bl, 0x87
lds ecx, [edi + 0x46]
in eax, dx
xor al, 0x5a
test dword [ebx], esi
push cs
inc eax
add cl, byte [edi]
push edi
test dword [0xa39dab5d], eax
or al, 0xba
sbb esi, dword [ebx + 0x7c89477a]
out dx, al
loope 0x4565ac
xor esp, dword [edx - 0x35]
dec edx
sub dword [ebx], esi
movsd dword es:[edi], dword [esi]
mov bl, 0x66
push cs
mov cl, 0xf9
jmp [ebx - 0x56240f59]
sub dword [esi - 0x17], ebx
mov al, 0x51
or al, 0x98
mov bh, 0xbd
shr byte [ecx], 1
stosd dword es:[edi], eax
jbe 0x456627
ffree st(5)
imul ebx, esp, 0x12fb0df1
and cl, ah
mov edi, dword [ebx + 0xd]
and dword [edx], edx
das
int3
xor eax, dword [edx + 0x787af8fe]
cmp dh, 0xf8
jp 0x4566a4
sub ecx, edx
push ebp
outsd dx, dword [esi]
popfd
adc byte [ebx], ah
ror bl, 0x4c
dec eax
xchg ebx, eax
mov eax, esp
dec esi
add dl, byte [esi - 0x14ebebe9]
inc byte [ebx]
dec eax
jb 0x456626
and eax, eax
retf
add ecx, dword [eax + 0x72]
loopne 0x456632
jmp 0x456642
cli
inc edi
and dword [eax + 0xcca64aa], esi
cmp dword [edx - 0x16], ebp
mov ah, 0x60
ja 0x4566b8
lodsd eax, dword [esi]
in eax, dx
mov edx, 0x52a453e4
mov dh, 0x10
test al, 0x18
jne 0x4566a0
movsb byte es:[edi], byte [esi]
add al, 0xbf
pop edi
sub eax, 0xf4fe64ea
pop edi
call 0x970a7578
mov ebp, es
out dx, eax
retf
call 0xd8c00dbc
test byte [edx], bl
jmp 0xb7b1e46f
fadd dword [edx + ebx + 0x6c7dc3e9]
mov bh, 0xcd
mov word [esi - 0x425e8337], gs
test edx, esi
sbb edi, ecx
test eax, 0x71a868e8
call ebx
clc
call 0xffb70f25
sar eax, cl
inc esp
in al, dx
clc
inc esi
and ebx, eax
mov eax, dword [0x45b21fdd]
iretd

Function at 0x46ffd8
Capabilities:
Encode data using xor

Disassembly:
ror bh, cl
mov esi, 0xf065661d
cwde
outsb dx, byte [esi]
out dx, al
cmpsd dword [esi], dword es:[edi]
inc esp
enter 0xffffffffffffd29e, 0x4f
sal dword ss:[esi - 0x3a60e83b], 1
push edx
movsb byte es:[edi], byte [esi]
stosd dword es:[edi], eax
pop esi
or byte [edx + 0x4847d19d], cl
dec ebx
mov bl, byte [ebp + 0x4b4847d1]
push ecx
pop edx
add ch, cl
xor eax, 0x1e928f26
push ss
std
dec eax
cmp al, 0xd8
jge 0x46fff4
adc dl, byte [esi + 0x19]
jmp 0x431e76c1

Function at 0x48e94c
Capabilities:
Encode data using xor

Disassembly:
dec esp
salc
leave
pop edi
dec eax
jb 0x48e949
push eax
invalid

Function at 0x4a0f18
Capabilities:
Encode data using xor

Disassembly:
lea esi, [ecx]
or bl, byte [edx - 0x7ad8f04]
xor al, 0x42
and byte [edx - 0x753ffb57], 0x12
rcr dword [ebx], 1
div byte [esi - 0x536918d7]
sub ecx, dword [edx]
sbb eax, 0x9fd326a3
mov eax, 0x7c561f4
or byte [edi - 0x10f7b0a6], 0x80
push esi
invalid

Function at 0x4a6f06
Capabilities:
Encode data using xor

Disassembly:
sbb al, 0x18
mov eax, dword [0xcc4575c6]
mov edi, 0x3b79a3e1
invalid
Function at 0x4c3eb6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ca230
cmp edx, dword [eax]
je 0x4c3ed8
add eax, 8
inc ecx
cmp eax, 0x4ca2c0
jl 0x4c3ec9
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ca230]
jne 0x4c4006
mov eax, dword [0x4ce8b8]
cmp eax, 1
je 0x4c3fe0
test eax, eax
jne 0x4c3f09
cmp dword [0x4ca174], 1
je 0x4c3fe0
cmp edx, 0xfc
je 0x4c4006
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c3f40
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c45d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c4800
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c3f83
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c4800
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c7928
push edi
call fcn.004c5fd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c45d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c45e0
lea eax, [ebp - 0xa0]
push 0x4c7908
push eax
call fcn.004c45e0
push dword [esi + 0x4ca234]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c45e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c5f44
add esp, 0x2c
pop edi
jmp 0x4c4006
lea eax, [ebp + 8]
lea esi, [esi + 0x4ca234]
push 0
push eax
push dword [esi]
call fcn.004c4800
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rsrc
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x62c048eb
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4320d2
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x582c7775
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219