joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cd88
Capabilities:
Encode data using xor

Disassembly:
and dword [edx], eax
adc byte [edx + 0x24], dl
out 0xd5, eax
nop
pop ss
or eax, 0x32313131
xor byte [edx], dh
xor dh, byte [eax]
xor esi, dword [eax]
xor esi, dword [ebx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
and al, 0x51
dec esp
add al, 0x21
invalid
jl 0x41cda5
and dword [edx + ebx - 0x55], edi
stosd dword es:[edi], eax
jle 0x41cd5d
aad 0xb5
sub eax, 0xd1797a0
xor dword [eax + esi], esi
xor al, 0x31
xor eax, 0x31333330
xor dword [ebx], esi
xor dword [edx + 0x30], ebx
and dword [edx], eax
adc byte [edx + 0x25], dl
out dx, eax
cld
cld
jg 0x41cdad
int3
xchg dword [edx - 0x3e03c4ee], ebx
mov ebx, 0x310d177d
xor esi, dword [ecx]
xor byte [edx], dh
xor dword [eax], esi
xor dword [eax], esi
xor al, 0x34
xor byte [edx + 0x30], bl
and dword [edx], eax
adc byte [edx + 0x26], dl
jne 0x41cd6d
adc byte [edx + 0x25], dl
out dx, eax
cld
cld
jg 0x41cdad
int3
out 0xe2, al
pop esp
shr dword [ecx + 0x6b645ba6], 0x41
clc
pop ss
or eax, 0x38303431
xor dword [ecx], esi
xor byte [ecx], dh
xor dword [ecx], esi
xor dword [eax], edi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
int 0xe4
and ch, bh
wait
loop 0x41cdfa
scasb al, byte es:[edi]
xlatb
adc eax, 0x919d83a0
popfd
xchg ecx, eax
pop ss
or eax, 0x34303331
xor byte [ecx], bh
xor byte [eax], dh
xor esi, dword [edx]
xor al, 0x32
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
daa
adc dword [ecx], edx
mov ecx, 0x3b02a884
or eax, dword [esi + 0x4edcde31]
add edx, dword [edi]
or eax, 0x37303431
xor esi, dword [eax]
xor byte [ecx], dh
xor dword [edx], esi
xor dh, byte [0x221305a]
adc byte [edx + 0x2b], dl
sub ah, 0x56
push cs
sbb esi, dword [eax - 0x5f]
mov bh, 0x4e
dec ecx
lea edi, [edi + 0xd17b84a]
xor dword [ebx], esi
xor dword [ecx], esi
xor byte [eax], bh
xor dword [esi + 0x5a363330], esi
xor byte [ecx], ah
add dl, byte [eax]
push edx
sub al, 0x53
pop ds
dec edx
shr byte [edi - 0x9e2dbd0], 0xcd
cmp cl, byte [eax]
cmp eax, 0x310d173a
xor esi, dword [eax]
cmp dword [ecx], esi
cmp byte [eax], dh
cmp byte [ebx], dh
cmp byte [ebx], dh
xor bl, byte [edx + 0x30]
and dword [edx], eax
adc byte [edx + 0x2c], dl
sub byte [ecx], 0x5b
pop ss
das
add edx, dword [ebx + 0x45]
das
mov cl, 1
insd dword es:[edi], dx
popal
imul edx, dword [edi], 0x3034310d
aaa
xor dword [0x39343831], esi
xor esi, dword [ecx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
sub eax, 0x82cc26a7
invalid
Function at 0x41d3b5
Capabilities:
Encode data using xor

Disassembly:
sbb dl, byte [esp + edx - 0x72682f9c]
add dword [edi], edx
or eax, 0x33303231
rcl byte fs:[edi + 0xd17018d]
xor dword [edx], esi
xor byte [ebx], dh
xor dh, byte [esi]
xor dh, byte [ebx]
xor al, 0x37
xor al, 0x32
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
arpl word [eax], ax
jbe 0x41d3b2
daa
or dword [edx + edi - 0x3c], 0x4161886f
cmp ebx, edi
pop ss
or eax, 0x34303331
xor dword [ecx], esi
xor byte [eax], bh
xor al, 0x38
xor al, 0x36
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
arpl word [ebx + 0x38], ax
out 0x4b, al
sti
add dword [edi + 0x33ce128d], edi
pop ss
cmp dl, byte [eax + 0x17]
push eax
pop ss
or eax, 0x39303231
xor dword [ecx], edi
xor dword [0x38303435], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
sbb word [edx + 0x2c], sp
jecxz 0x41d476
movsd dword es:[di], dword [si]
mov dl, 0xf2
mov bh, 3
push ss
retf
cmp byte [edx + 0x30], bl
and dword [edx], eax
adc byte [edx + 0x68], dl
push ebp
cdq
and byte [esi], cl

Function at 0x41d515
Capabilities:
Encode data using xor

Disassembly:
or bh, byte [ecx + ecx*8]
adc al, 0x45
salc
pop ss
or eax, 0x36303231
xor dh, byte [eax]
xor byte ss:[eax + esi], dh
xor dword [eax], esi
xor byte [edx], dh
xor ebx, dword [edx + 0x30]
and dword [edx], eax
adc byte [edx + 0x6a], dl
sbb bh, byte [esi + 0x47350461]
mov edx, 0xfc0a9779
push esp
pop edi
ficom dword [edi]
or eax, 0x32313131
xor byte [esi], dh
xor dword [eax + esi], esi
xor eax, 0x305a3933
and dword [edx], eax
adc byte [edx + 0x6a], dl
test eax, 0x72141f79
cmp al, 0xb6
cwde
xchg edi, eax
mov al, byte [0x17d099df]
fistp word [ecx + 0x310d17d0]
xor dh, byte [ecx]
xor byte [eax], dh
xor dword ss:[ebx], esi
fistp word [ecx + 0x310d17d0]
xor dh, byte [ecx]
xor byte [eax], dh
xor dword ss:[ebx], esi
xor byte [ebx], dh
xor dword [eax], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push edx
insb byte es:[edi], dx
pop ebp
push esi
push edx
clc
jp 0x41d4cc
xlatb
push ebp
sti
inc eax
adc esp, esp
add al, bh
pop ss
Function at 0x41e4f0
Capabilities:
Encode data using xor

Disassembly:
add dl, byte [eax]
push ebx
add dl, byte [edi - 0xa]
jg 0x41e465
int3
or bl, bl
pop ss
or eax, 0x37303431
xor dh, byte [eax + esi]
xor dword [ecx], esi
xor dh, byte [edx]
xor byte [edx + 0x30], bl
and dword [edx], eax
adc byte [ebx + 2], dl
test eax, 0xbfed9395
xor cl, byte [edx + 0x3c]
stosd dword es:[edi], eax
adc dl, ch
test byte [esi + 8], cl
pop ss
or eax, 0x32303431
xor dh, byte [0x34343031]
xor dword [edx], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
add esp, ebx
cmp esi, dword [esi + 0x4c]
or dword [ebx + 0x2a7ed1f7], ebx
rcl dword [eax - 0x6c]
cwde
pop ss
or eax, 0x32313331
xor dword [ecx], esi
xor dh, byte [ecx]
xor bh, byte [eax]
xor esi, dword [0x221305a]
adc byte [ebx + 5], dl
dec esp
cld
xor al, 0xb
scasb al, byte es:[edi]
inc ebx
test al, 0x78
mov dh, byte [esi + edx*4 + 0x17e30682]
js 0x41e455
mov ah, 0x96
add byte [esi], 0xe3
pop ss
or eax, 0x38303131
xor dword [ecx], esi
xor dword [ecx], edi
xor edi, dword [eax]
xor byte [ebx], dh
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
add eax, 0xf3054ba4
clc
cmp al, 0xf5
cmp byte [ecx], dh
xor dword [ecx], esi
cmp dword [ebx], esi
cmp byte [eax], dh
xor ebx, dword [edx + 0x30]
and dword [edx], eax
adc byte [ebx + 5], dl
movsb byte es:[edi], byte [esi]
dec ebx
add eax, 0xf53cf8f3
add bl, ch
arpl word [0x17033d68], bx
push 0xd17033d
xor dword [eax + esi], esi
xor dword ss:[edi], esi
xor dword [ecx], esi
xor dword [edx], esi
xor byte [edx], dh
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
or bh, ah
add dword [eax + 0x3cbb5ffd], edx
jecxz 0x41e4c9
lahf
mov eax, 0x1704870c
or eax, 0x35303231
xor byte [eax], bh
xor byte [ebx], dh
xor esi, dword [ecx]
xor edi, dword [eax]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
or ebx, dword [ebx]
int3
Function at 0x41e7ac
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
add dword [edi], esp
pop ss
or eax, 0x31303331
xor dh, byte [0x37313930]
xor eax, 0x21305a37
add dl, byte [eax]
push ebx
and al, 0x54
push ss
xadd byte [ebx], bl
push es
fdivp st(7)
jg 0x41e82a
in al, 0x72
mov edx, 0x310d1715
xor esi, dword [eax]
cmp dword [edx], esi
xor dword [eax], esi
xor al, 0x30
cmp dword [0x21305a32], esi
add dl, byte [eax]
push ebx
and eax, 0x2a03d2e
std
mov eax, 0x398141f
cmc
jmp 0x41e857
hlt
xor dh, byte [esi]
xor dword [0x33313432], esi
xor al, 0x31
xor ebx, dword [edx + 0x30]
and dword [edx], eax
adc byte [ebx + 0x27], dl
adc byte [ebx + 0x27], dl
sbb eax, 0x596147b3
xchg esi, eax
ror esp, 1
out dx, eax
xchg ecx, eax
imul edx, dword es:[edx], 0x310d173e
xor al, 0x30
xor dh, byte ss:[esi]
xor byte [ecx], dh
xor dword [ebx], esi
xor dh, byte [edx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
sub byte [esi - 0x6f34fb10], dh
and dword [edx], eax
adc byte [ebx + 0x28], dl
mov dh, 0xf0
add al, 0xcb
nop
mov ah, 0x16
lea esp, [eax]
mov eax, 0xcf1f98cd
pop ss
or eax, 0x34303331
xor dh, byte [ecx]
xor byte [eax], dh
xor esi, dword [edx]
xor esi, dword [edi]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push ebx
sub dword [edi + 0x3e], esp
ja 0x41e84b
cli
test cl, cl
outsb dx, byte [esi]
jb 0x41e80e
pop eax
add ebx, dword [ebp + 0x310d170a]
xor al, 0x30
xor al, 0x30
xor dh, byte [ecx]
xor esi, dword [eax]
xor eax, 0x305a3632
and dword [edx], eax
adc byte [ebx + 0x29], dl
jg 0x41e81e
leave
mov ah, 0x3f
jl 0x41e8c8
scasb al, byte es:[edi]
mov byte [0x7b853067], al
push edx
pop ss
or eax, 0x36303431
xor dword [eax + esi], esi
xor dword [ecx], esi
xor dword [ebx], esi
xor byte [edx + 0x30], bl
and dword [edx], eax
adc byte [ebx + 0x29], dl
xchg esi, eax
cmp byte [edx - 0x1e], bh
xor eax, 0x18ae1eae
sahf
push ds
xor esp, dword [ebx]
pop ss
invalid

Function at 0x420a02
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
pop ebp
pop ss
or eax, 0x33303331
xor dword [ebx], esi
xor byte [ebx], dh
xor dword [ebx], esi
xor byte [ebx], dh
xor dh, byte [0x30303130]
xor eax, 0x21305a31
add dl, byte [eax]
push esp
inc edi
cmp edi, ebp
cwde
push edx
xchg edi, eax
das
sbb dl, byte [edx]
sub cl, bl
mov al, 0x5c
xchg ebp, eax
xchg edi, eax
pop ss
or eax, 0x32303331
xor byte [ecx + esi], dh
xor eax, 0x33343134
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
dec eax
jns 0x4209fd
sub al, 0x74
ljmp 0x75a
Function at 0x421425
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x39323831
xor byte [ecx], bh
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov bl, 0xda
insd dword es:[edi], dx
mov dl, 0x98
nop
xor eax, 0x39edbfe2
pop ebp
enter 0xd17, 0x31
xor al, 0x30
xor eax, 0x38303730
xor byte [edi], dh
xor esi, dword [eax]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov ah, 0xfa
and dword [edx], eax
adc byte [esp + esi*4 - 6], dl
push ds
in eax, 0x14
test byte [edx + 0x7f2d01c], ah
mov edi, 0x17700840
or eax, 0x39303331
xor byte [0x35303130], dh
xor dh, byte [ebx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov dh, 0x1c
adc byte [ebp + edx*8 + 5], ah
fld qword [ecx - 0x2a11992b]
pushal
or edx, dword [ebx + 0x17]
or eax, 0x31303431
xor dh, byte [edi]
xor dword [eax], edi
xor byte [esi], dh
xor al, 0x31
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov dh, 0x37
in al, dx
mov bh, 0x77
wait
lodsd eax, dword [esi]
jo 0x421451
xchg dword [eax + 0x73], esi
jbe 0x4214b9
ficom word [edi]
or eax, 0x38303231
xor esi, dword [ecx]
xor byte [edi], dh
xor dh, byte [esi]
xor esi, dword [edx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov bh, 0x7d
and dh, byte [esi]
cwde
stosd dword es:[edi], eax
and eax, 0x1f171e25
mov ch, byte [edi + 0xd1743c8]
xor dword [ebx], esi
xor byte [edi], dh
xor byte [eax + esi], dh
xor dword [eax], esi
xor al, 0x31
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esp
mov eax, 0x1ec8b16a
retf 0x5313

Function at 0x423f9e
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], esi
xor byte [ecx], dh
xor byte [esp + esi], dh
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push esi
insd dword es:[edi], dx
xlatb
invalid

Function at 0x42bfb5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45b8f8]
jne 0x42bfbf
repz ret
jmp fcn.00432f78
Function at 0x430cb7
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x430cf4
cmp dword [ebp + 0x14], edi
je 0x430cf4
cmp ecx, edi
jne 0x430cfb
call fcn.0042d590
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0042cf0a
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x430d0f
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x430d30
cmp ebx, 0xffffffff
je 0x430d1f
push ebx
push edi
push ecx
call fcn.0042e370
add esp, 0xc
cmp esi, edi
je 0x430cdc
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x430cdc
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x430d4c
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x430d53
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x430e44
test word [esi + 0xc], 0x10c
je 0x430da7
mov eax, dword [esi + 4]
test eax, eax
je 0x430da7
jl 0x430ea5
cmp ebx, eax
mov edi, ebx
jb 0x430d78
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x430e4c
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0042c32e
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x430e3c
cmp ebx, dword [ebp - 0xc]
jb 0x430e14
cmp dword [ebp - 0xc], 0
je 0x430dd1
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x430dc6
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x430dcd
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x430ddc
mov eax, SysReAllocString
cmp ebx, eax
ja 0x430ddc
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x430e78
push eax
push dword [ebp - 8]
push esi
call fcn.004309fa
pop ecx
push eax
call fcn.0043cd54
add esp, 0xc
test eax, eax
je 0x430eb7
cmp eax, 0xffffffff
je 0x430ea5
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x430e3c
push esi
call fcn.0043c673
cmp eax, 0xffffffff
pop ecx
je 0x430ea9
cmp dword [ebp - 4], 0
je 0x430e78
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x430d5b
mov eax, dword [ebp + 0x14]
jmp 0x430cf6
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x430e63
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0042e370
add esp, 0xc
call fcn.0042d590
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x430cec
cmp dword [ebp + 0xc], 0xffffffff
je 0x430e8e
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0042e370
add esp, 0xc
call fcn.0042d590
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x430cec
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x430cf6
or dword [esi + 0xc], 0x10
jmp 0x430ea9
Function at 0x431c86
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x45b910]
je 0x431ca1
inc edi
cmp edi, 0x17
jb 0x431c92
cmp edi, 0x17
jae 0x431e21
push ebp
push 3
call fcn.0043d786
cmp eax, 1
pop ecx
je 0x431ded
push 3
call fcn.0043d786
test eax, eax
pop ecx
jne 0x431cd5
cmp dword [0x45b760], 1
je 0x431ded
cmp ebx, 0xfc
je 0x431e20
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x45ef48
push ebp
call fcn.00435a01
add esp, 0xc
test eax, eax
je 0x431d0b
push esi
push esi
push esi
push esi
push esi
call fcn.0042ce0e
add esp, 0x14
push 0x104
mov esi, 0x45ef61
push esi
push 0
mov byte [0x45f065], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x431d4f
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00435a01
add esp, 0xc
test eax, eax
je 0x431d4f
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0042ce0e
add esp, 0x14
push esi
call fcn.00435a70
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x431d94
push esi
call fcn.00435a70
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45f25c
push 0x44cb4c
sub ecx, eax
push ecx
push eax
call fcn.0043d6d3
add esp, 0x14
test eax, eax
je 0x431d94
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0042ce0e
add esp, 0x14
jmp 0x431d96
xor esi, esi
push 0x44cb48
push ebx
push ebp
call fcn.0043d662
add esp, 0xc
test eax, eax
je 0x431db6
push esi
push esi
push esi
push esi
push esi
call fcn.0042ce0e
add esp, 0x14
push dword [edi*8 + 0x45b914]
push ebx
push ebp
call fcn.0043d662
add esp, 0xc
test eax, eax
je 0x431dd8
push esi
push esi
push esi
push esi
push esi
call fcn.0042ce0e
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043d4a5
add esp, 0xc
jmp 0x431e20
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x431e20
cmp ebp, 0xffffffff
je 0x431e20
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x45b914]
push dword [esi]
call fcn.00435a70
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43d4a5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043284b
xor ebx, ebx
cmp dword [0x45fa44], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43d57b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43d65b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43d65b
push eax
call fcn.004327dd
mov dword [esp], 0x44ce28
push edi
mov dword [0x45fa44], eax
call esi
push eax
call fcn.004327dd
mov dword [esp], 0x44ce14
push edi
mov dword [0x45fa48], eax
call esi
push eax
call fcn.004327dd
mov dword [0x45fa4c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0042d243
test eax, eax
pop ecx
pop ecx
je 0x43d549
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042ce0e
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43d57b
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004327dd
cmp eax, ebx
pop ecx
mov dword [0x45fa54], eax
je 0x43d57b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004327dd
pop ecx
mov dword [0x45fa50], eax
mov eax, dword [0x45fa50]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43d600
cmp dword [0x45fa54], ecx
je 0x43d600
push eax
call fcn.00432854
push dword [0x45fa54]
mov esi, eax
call fcn.00432854
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43d600
cmp edi, ebx
je 0x43d600
call esi
cmp eax, ebx
je 0x43d5cd
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43d5cd
test byte [ebp - 0x18], 1
jne 0x43d600
lea eax, [ebp - 0x10]
push eax
call fcn.0042d27a
test eax, eax
pop ecx
je 0x43d5e8
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0042ce0e
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43d5f7
or dword [ebp + 0x10], 0x200000
jmp 0x43d63b
or dword [ebp + 0x10], 0x40000
jmp 0x43d63b
mov eax, dword [0x45fa48]
cmp eax, dword [ebp - 8]
je 0x43d63b
push eax
call fcn.00432854
cmp eax, ebx
pop ecx
je 0x43d63b
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43d63b
mov eax, dword [0x45fa4c]
cmp eax, dword [ebp - 8]
je 0x43d63b
push eax
call fcn.00432854
cmp eax, ebx
pop ecx
je 0x43d63b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45fa44]
call fcn.00432854
cmp eax, ebx
pop ecx
je 0x43d65b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43d65d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x444634
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x45b8f8]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004445c9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042e370
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x444683
cmp dword [ebp - 0x1c], 5
jb 0x44469b
jmp 0x444697
cmp dword [ebp - 0x10], 1
jne 0x44469b
cmp dword [ebp - 0x1c], 4
ja 0x444697
jne 0x44469b
cmp dword [ebp - 0x18], 0
jbe 0x44469b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x44e7b8
call fcn.004444ba
test eax, eax
jge 0x4446bc
mov byte [0x45fe14], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042bfb5
add ebp, 0x78
leave
ret

Function at 0x22e3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.022e378f
jae 0x22e370e
xor ecx, ecx
call fcn.022e378f
jae 0x22e373d
xor eax, eax
call fcn.022e378f
jae 0x22e374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.022e378f
adc al, al
jae 0x22e372f
jne 0x22e3779
stosb byte es:[edi], al
jmp 0x22e3711
call fcn.022e379b
sub ecx, ebx
jne 0x22e3756
call fcn.022e3799
jmp 0x22e3775
lodsb al, byte [esi]
shr eax, 1
je 0x22e3783
adc ecx, ecx
jmp 0x22e3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.022e3799
cmp eax, 0x7d00
jae 0x22e3772
cmp ah, 5
jae 0x22e3773
cmp eax, 0x7f
ja 0x22e3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x22e3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x5b3108
Capabilities:
Encode data using xor

Disassembly:
xchg dword [esp + 4], eax
push ebx
cwde
mov eax, 0x456234
push 0x8e9a1eca
pushal
call fcn.005d31b3
add dword [edi - 0x32979fb3], 0x878031a8
inc esp
and al, 0x20
lea eax, [ebx - 0x37814ee5]
not ax
push 0xe8c07c6f
mov eax, 0x4965a1
push dword [esp]
mov eax, dword [eax + 0xea278]
mov byte [esp], ah
pushfd
lea esp, [esp + 0x2c]
call fcn.005aace0
pushfd
pop edi
mov di, si
mov edi, eax
not ax
pushfd
mov eax, dword [esp + 4]
pushfd
mov byte [esp], dh
lea esp, [esp + 0xc]
jmp fcn.0045082e

Function at 0x5b7e8e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
not bh
mov ebx, eax
cwde
not al
mov eax, dword [esp + 4]
mov byte [esp + 4], 0xa6
pushal
push 0x1be9d46a
pushfd
lea esp, [esp + 0x30]
jmp fcn.004a5543
jmp 0x5b742a

Function at 0x5c9c91
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [eax + 0x169a0d]
push 0xd330db7c
call fcn.0057d86c

Function at 0x5c9ca1
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 0x1c], eax
setl al
lea eax, [edi*8 + 0x2d4a0ef1]
pushal
mov eax, 0x40bc81
call fcn.005bff67

Function at 0x5d4dc3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [eax + 0x1b6a98]
call fcn.005a57d2
fmul qword [ebp - 0x77]
or byte [ecx + 0x42d9a2f5], 0x77
sbb al, 0x9c
inc eax
push ebp
xchg ecx, eax
wait
push edi
inc ecx
test byte [esi + edi*2 - 0x540cd899], dl
invalid

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx