joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443949
Capabilities:
Encode data using xor

Disassembly:
sbb edi, esi
or ecx, edx
jle 0x4438fd
sub byte [eax - 0x22f4e994], dl
xchg ebp, eax
wait
in al, 0x10
lahf
push es
and byte [edi + edi + 0x1d], 0xe8
jae 0x44393c
aas
sbb eax, 0x623973e8
aas
bound edi, qword [edi]
jne 0x44392f
insb byte es:[edi], dx
dec ecx
cld
mov cl, 8
adc byte [edx], dl
mov dword [0x4c03a186], eax
dec bp
div dword [edi + 4]
mov dh, 0x2b
and dl, byte [edi]
cmp byte [ebx + 0x42e273cc], 0xd9
xchg edi, eax
and al, 0x74
fidivr word [esi - 0x27d74f3a]
clc
cmc
dec eax
jg 0x44396e
xchg dword [edi], ebx
cwde
lahf
add al, 0x23
inc esp
aas
test al, 0x33
movsd dword es:[edi], dword [esi]
dec ecx
outsd dx, dword [esi]
sub dh, byte [0x834ef3df]
out dx, eax
inc edi
dec esi
sub edi, 0x3e
inc edi
mov ecx, 0x4b4d1563
adc byte [esi - 0x63], dl
daa
in eax, dx
xor eax, 0xe1619c6d
cmp ah, al
adc eax, 0xf548cf63
insd dword es:[edi], dx
push es
or eax, ecx
xchg ebx, eax
jb 0x443942
push eax
shl dword [ecx + ebx*4 + 0x7d], 1
sbb al, 0xea
cmp al, 0
mov al, byte [0xe7ebe560]
add byte [eax - 0x18141aa0], ah
imul esi, dword [esi - 0xf], 0xfffffffb
mov ch, 0x49
ret 0xf8ff

Function at 0x467150
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
retf
movsb byte es:[edi], byte [esi]
cld
and dword [edx + 0x136a0dd7], ebx
dec ecx
js 0x4670ee
test byte [ebp + 0x76cb129f], bh
xchg dl, al
dec edx
add dword [ebp + 0x4a4f5bc7], 0xffffffbc
imul ebp, dword [ecx + 0x5a], 0x63
mov word [ebx], fs
mov ebp, 0x511ca3f6
invalid
loopne 0x4670f9
mov esi, 0x6eabd10a
push esi
or ch, byte [edi + 0x43fb33a6]
mov al, 0x5b
ficom word [eax]
sbb ecx, dword [edi + edi*4]
loopne 0x4671b7
invalid
loop 0x4671da
mov byte [0x42068e76], al
cmp edi, dword [edx - 0x15]
xor al, bl
and dword [esi], esp
rcl dword [esi], cl
mov esp, 0xba23f6a6
sub edi, dword [esi + 0x7834e959]
cmp dh, byte [edx - 0x2dea0cb5]
dec esi
xor dword [0xc99bc58b], esp
and eax, 0xc99bc58b
xchg edx, eax
cmp byte [ebx + 0x14], dl
in eax, 0xe3
invalid

Function at 0x46d9e9
Capabilities:
Encode data using xor

Disassembly:
cld
mov dl, 0x7f
lcall 0x4259, 0xd70a869f
xchg ebp, eax
mov al, 0x21
cmpsb byte [esi], byte es:[edi]
ja 0x46d9dc
inc eax
cmp esp, ebp
push 0xd3233327
jne 0x46da3a
std
int 0xbd
call 0xf26668cd
imul eax, dword [edx], 0x36
movsb byte es:[edi], byte [esi]
test al, 0x90
ljmp 0x89fe
mov eax, dword [0xbef648ba]
clc
rcl dword [edi*4 - 0x7bb8529e], cl
push edx
fidiv word [ebp - 0x90e6482]
mov byte [0x2ca416b9], al
xor eax, 0x9fccb19e
lahf
and eax, dword [edi - 0x14e6b0d8]
wait
xor eax, 0x712d838e
or dword [edi + 0x49591f9c], edx
xor dword [edi], esp
pop eax
popal
jns 0x46da58
pop ecx
jo 0x46dad8
iretd
movsd dword es:[edi], dword [esi]
fdivr dword [ebp + 0x28]
test eax, 0x1e18e5ba
ret

Function at 0x481d78
Capabilities:
Encode data using xor

Disassembly:
lahf
leave
sbb edx, dword [esp + esi*2]
inc ecx
out 0x65, eax
invalid
shl byte ds:[edx + 0x71], cl
push eax
bound esi, qword [ecx + 0x50]
sbb byte [0x243c2796], dl
xor al, 0xdc
cmpsb byte [esi], byte es:[edi]
rcr esi, 0x4b
mov word [esp + edx*4], es
aad 0x4e
mov bh, 0xa3
js 0x481d75
lodsd eax, dword [esi]
jmp 0x481d58
Function at 0x481e1c
Capabilities:
Authenticate hmac

Disassembly:
sbb bl, byte [edi - 0x61]
outsb dx, byte [esi]
mov ah, 0xe0
outsd dx, dword [esi]
int 0x60
adc esi, dword [edx]
pop edx
jmp dword [esi]
jg 0x481d93
push ds
push edi
invalid
clc
add bh, byte cs:[0x7891e1db]
das
pop eax
in eax, dx
loopne 0x481e4b
jmp 0x481dbf
add eax, esp
cmp eax, 0x713eb33c
mov bl, 0x3e
invalid
les edi, [0x713eb33c]
mov bl, 0x3e
jno 0x481dff
stc
push ebp
mov ecx, dword [eax - 0x4c]
das
mov edx, esi
popfd
add dh, byte [ebp - 0x54]
mov eax, 0x2114860b
xor dh, byte [edx - 0x3d]
mov word [ecx + 0x4ad55cb5], ss
mov ch, 0x5c
aad 0x4a
pushal
and edx, esp
fadd dword [eax - 0x755c8de8]
mov word [ebp - 0x664bbefa], es
jno 0x481dcf
xlatb
xchg byte [ecx - 0xd6c5cf], dl
mov dl, 0x32
pop edx
xchg esi, eax
xchg esp, eax
add eax, 0xe5633911
mov al, 0x36
cmp byte [edx], bh
jp 0x481dfe
dec ebx
call 0xa9b10de
imul esi, dword [edi + 0xc], 0x5ff10a9a
adc esi, dword [edx - 0x24]
ja 0x481eb7
invalid
jp 0x481e5c
jmp dword [eax]
and byte [edi - 0x13], bl
push 0xffffffffffffffc6
sal dword [ebx + 0x6f], cl
pop ss
add dword [ebx], esp
wait
or dword [ebx + 0xf], ebx
rcr bh, 0xb8
dec esp
push ebx
cmpsd dword [esi], dword es:[edi]
xor ebx, dword [edi - 0x46188319]
pop ss
xor eax, 0xc228e38b
out dx, al
mov byte [edx + 0x69], bh
sub dh, byte [esi]
mov edi, dword [ecx]
pop esp
xor dl, byte [esi]
add edx, edx
sub dh, dh
cmpsd dword [esi], dword es:[edi]
cmp al, 0x8f
jne 0x481e6c
invalid

Function at 0x483e79
Capabilities:
Encode data using xor

Disassembly:
iretd
mov edx, 0x43e65c3e
jg 0x483df7
cli
xor al, 0xd0
mov esi, 0x75ff9acc
outsb dx, byte [esi]
dec ebx
sub cl, byte [edx + 0x6b4b991e]
add al, 0x32
jns 0x483ec5
retf 0xbb5e
cmp dword [esi + 0x5a], edi
adc esi, dword [eax]
rol byte [ecx], cl
mov cl, 0xde
mov dword [0x8d36fecd], eax
movsb byte es:[edi], byte [esi]
pushal
sahf
enter 0x4a6f, 0xffffffffffffffd0
test eax, 0xf97bca4e
ja 0x483e54
cmpsd dword [esi], dword es:[edi]
push edi
invalid
adc dword [ecx + 0x689aa8f4], edi
add dword [edx - 0x17], esi
sbb eax, 0x3f9cb578
pop ecx
invalid

Function at 0x48bb4b
Capabilities:
Encode data using xor

Disassembly:
shr byte [eax], cl
pushal
and al, 0xe1
add edi, ecx
out dx, al
pop esi
push cs
push ebp
invalid
inc edi
pushal
adc eax, 0xbed5733e
add eax, 0xc589c3f4
into
test eax, esi
push ss
mov esp, 0x9cb04b7f
invalid
jns 0x48bb4f
imul eax, dword [ebx], 0x71
shr dword [edx], cl
fnstenv [eax - 0x73]
jno 0x48bb24
sub bl, cl
jo 0x48bae2
invalid

Function at 0x494f94
Capabilities:
Encode data using xor

Disassembly:
or al, 0xd4
push ebx
cld
lodsd eax, dword [esi]
clc
loope 0x494fbb
inc ah
and al, 0xdf
test eax, 0x3ae4e380
mov ch, 0xec
push ds
xor al, 0x8a
out 0x7c, eax
out 0x35, al
call dword [eax + ecx*2 - 0x3c]
mov eax, dword [0xad3ca842]
popfd
in eax, 0x6b
jge 0x494fa0
in al, 0x81
push esi
mov eax, dword [0x7b19150]
adc dword [esi - 0x5f], 0x7b19150
push 0x6e
test byte [edx + ecx*8 - 0x22c70397], bh
test byte [edx + 0x6a], al
out 0xff, al
dec edx
iretd
Function at 0x4b36e8
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
adc dword [edi + 0x525b9baa], ebx
sbb ecx, edx
xor esp, ebx
or dword [edx + esi*8], eax
push 0xffffffffffffffaf
pop ebp
fist dword [ebx + esi]
adc al, 0x61
jecxz 0x4b36e9
inc edx
pop edi
movsb byte es:[edi], byte [esi]
and byte [0x7e51245f], dh
nop
xlatb
and bh, byte [edx - 0x49]
stc
in al, 0xf
imul eax, dword [edx + ebp*4 + 0x27], 0xa2cbb773
popfd
dec dx
sub esi, dword [ecx + ebx*2 + 0xd]
and dh, dl
dec edx
xchg esi, eax
mov byte [edi], dh
fisub word [ecx - 0x5a77fea9]
mov ecx, 0x3b377814
xor ecx, dword [edx]
enter 0x624d, 0xffffffffffffffc0
jge 0x4b3710
mov al, byte [edi + 0x74]
outsd dx, dword [esi]
push 0xffffffffffffff81
xchg esp, eax
sbb edi, ecx
sbb dh, byte [ebx - 0x5e]
adc byte [eax + 0x35], bh
mov dword [0xb64f6e99], eax
jae 0x4b370a
mov ah, 0x46
xor eax, 0x46488b00
in eax, dx
test al, 0x9b
cli
jnp 0x4b37cb
dec esi
sub esp, dword [edi]
push esi
leave
mov ecx, 0xc8f766ed
push ecx
mov ah, 0x8e
jmp [ebp + 0x58]
mov edi, 0x2eb6acfc
fbld tbyte [eax - 0x59ee2e61]

Function at 0x4b373c
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
adc dword [edi + 0x525b9baa], ebx
sbb ecx, edx
xor esp, ebx
or dword [edx + esi*8], eax
push 0xffffffffffffffaf
pop ebp
fist dword [ebx + esi]
adc al, 0x61
jecxz 0x4b36e9
inc edx
pop edi
movsb byte es:[edi], byte [esi]
and byte [0x7e51245f], dh
nop
xlatb
and bh, byte [edx - 0x49]
stc
in al, 0xf
imul eax, dword [edx + ebp*4 + 0x27], 0xa2cbb773
popfd
dec dx
sub esi, dword [ecx + ebx*2 + 0xd]
and dh, dl
dec edx
xchg esi, eax
mov byte [edi], dh
fisub word [ecx - 0x5a77fea9]
mov ecx, 0x3b377814
xor ecx, dword [edx]
enter 0x624d, 0xffffffffffffffc0
jge 0x4b3710
mov al, byte [edi + 0x74]
outsd dx, dword [esi]
push 0xffffffffffffff81
xchg esp, eax
sbb edi, ecx
sbb dh, byte [ebx - 0x5e]
adc byte [eax + 0x35], bh
mov dword [0xb64f6e99], eax
jae 0x4b370a
mov ah, 0x46
xor eax, 0x46488b00
in eax, dx
test al, 0x9b
cli
jnp 0x4b37cb
dec esi
sub esp, dword [edi]
push esi
leave
mov ecx, 0xc8f766ed
push ecx
mov ah, 0x8e
jmp [ebp + 0x58]
mov edi, 0x2eb6acfc
fbld tbyte [eax - 0x59ee2e61]

Function at 0x4b3895
Capabilities:
Encode data using xor

Disassembly:
or ch, byte ds:[esi + ebp]
mov ebp, dword [ebx + edi*4 - 0x1f0273f0]
pop edx
mov dword [ecx - 0x73ab10ca], ebx
dec esp
out dx, eax
pop esp
jns 0x4b382f
test al, 0xaa
ljmp 0x50fd

Function at 0x4b73eb
Capabilities:
Encode data using xor

Disassembly:
add eax, 0xcf77e51e
and eax, 0x6e2da94a
mov esp, 0xa7b5236d
stosb byte es:[edi], al
cmp dl, ah
dec ecx
fdiv qword [edi]
imul ax, word [edx - 0x279a179a], 0x70fb
jmp 0x4b7432
xor dword [eax - 0x4fce4b70], edx
out dx, al
sbb byte [eax + 0x1b], 0x81
inc esi
mov eax, dword [eax]
add byte [ebx], bl
call 0x83b192b9
and dword [0x2d893d09], eax
push es
xor al, 0x2e
jge 0x4b7432
sbb dl, byte [esp + ebx*8 + 0x32179db2]
xchg edx, eax
fimul word [edi - 0x12689732]
lahf
and esp, dword [eax]
dec eax
fild qword [edi - 0x70]
xlatb
int3
Function at 0x4bb6ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3390
cmp edx, dword [eax]
je 0x4bb6cf
add eax, 8
inc ecx
cmp eax, 0x4c3420
jl 0x4bb6c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3390]
jne 0x4bb7fd
mov eax, dword [0x4c7d2c]
cmp eax, 1
je 0x4bb7d7
test eax, eax
jne 0x4bb700
cmp dword [0x4c32b8], 1
je 0x4bb7d7
cmp edx, 0xfc
je 0x4bb7fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb737
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc090
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc520
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb77a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc520
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c09cc
push edi
call fcn.004be3f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc090
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc0a0
lea eax, [ebp - 0xa0]
push 0x4c09ac
push eax
call fcn.004bc0a0
push dword [esi + 0x4c3394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc0a0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be364
add esp, 0x2c
pop edi
jmp 0x4bb7fd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3394]
push 0
push eax
push dword [esi]
call fcn.004bc520
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4148c6
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041473c

Function at 0x418e62
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004189b5

Function at 0x4121e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section._____1
lea edi, [esi - 0xc000]
push edi
or ebp, 0xffffffff
jmp 0x412202
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x412209
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4121f8
mov eax, 1
add ebx, ebx
jne 0x41221b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x412210
jne 0x41222c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x412210
xor ecx, ecx
sub eax, 3
jb 0x412240
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4122b2
mov ebp, eax
add ebx, ebx
jne 0x41224b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x412258
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41227c
inc ecx
add ebx, ebx
jne 0x412268
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41225d
jne 0x412279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41225d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41229c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41228d
jmp 0x4121fe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41229c
add edi, ecx
jmp 0x4121fe
pop esi
mov edi, esi
mov ecx, 0x411
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4122ba
cmp byte [edi], 0
jne 0x4122ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4122bf
lea edi, [esi + 0x10000]
mov eax, dword [edi]
or eax, eax
je 0x41232e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x124e0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4122ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124e4]
or eax, eax
je 0x412328
mov dword [ebx], eax
add ebx, 4
jmp 0x412309
call dword [esi + 0x124e8]
popal
jmp 0x409cc0
Function at 0x401000
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x405520
mov eax, edx
mov esi, 8
test al, 1
je 0x40101c
shr eax, 1
xor eax, 0xedb88320
jmp 0x40101e
shr eax, 1
dec esi
jne 0x40100f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x405920
jl 0x401008
pop esi
ret

Function at 0x401040
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
not eax
jle 0x401079
push ebx
push edi
mov edi, dword [esp + 0x14]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x405520]
xor eax, edx
inc ecx
cmp ecx, esi
jl 0x401057
pop edi
pop ebx
not eax
pop esi
ret

Function at 0x401190
Capabilities:
Get file size
Read file on windows
Set current directory
Write file on windows

Disassembly:
push ecx
push ebx
push esi
push edi
push 0x405920
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push 0
push 3
push 0
push 1
push 0xc0000000
push 0x405a28
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4011df
mov eax, dword [esp + 0x14]
push 0x1000
push str.Error
push 0x405070
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
pop ecx
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esp + 0xc]
push 0
mov esi, eax
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
push esi
push 0
call fcn.00401040
mov ecx, dword [0x405b2c]
add esp, 0xc
cmp eax, ecx
je 0x401248
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x14]
push 0x1000
push str.Error
push str.CRC_
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [0x405b34]
mov esi, 5
add eax, 0xfffffff8
cmp eax, esi
jle 0x4012cc
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [0x405b30]
xor edx, edx
xor ecx, ecx
push 0
mov dl, byte [eax + esi]
mov cl, byte [eax + esi + 1]
shl edx, 8
add ecx, edx
xor edx, edx
mov dl, byte [eax + esi + 2]
push 0
shl ecx, 8
add ecx, edx
push ecx
push ebx
call ebp
mov eax, dword [0x405b30]
xor ecx, ecx
xor edx, edx
push 0
mov cl, byte [eax + esi + 3]
mov dl, byte [eax + esi + 4]
mov edi, ecx
lea ecx, [esp + 0x14]
shl edi, 8
add edi, edx
push ecx
lea edx, [eax + esi + 5]
push edi
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x405b34]
lea esi, [esi + edi + 5]
add eax, 0xfffffff8
cmp esi, eax
jl 0x401267
pop ebp
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
push 0
push 0x40505c
push 0x405050
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x40220d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x405170
cmp edx, dword [eax]
je 0x40222f
add eax, 8
inc ecx
cmp eax, 0x405200
jl 0x402220
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x405170]
jne 0x40235d
mov eax, dword [0x405b40]
cmp eax, 1
je 0x402337
test eax, eax
jne 0x402260
cmp dword [0x4050c0], 1
je 0x402337
cmp edx, 0xfc
je 0x40235d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402297
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004027c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402930
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4022da
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402930
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4043d0
push edi
call fcn.004035c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004027c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004027d0
lea eax, [ebp - 0xa0]
push 0x4043b0
push eax
call fcn.004027d0
push dword [esi + 0x405174]
lea eax, [ebp - 0xa0]
push eax
call fcn.004027d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040352e
add esp, 0x2c
pop edi
jmp 0x40235d
lea eax, [ebp + 8]
lea esi, [esi + 0x405174]
push 0
push eax
push dword [esi]
call fcn.00402930
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x103f5730
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5923198
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebp
push edi
mov edi, ecx
xor ebp, ebp
mov ecx, dword [esp + 0x48]
lea eax, [esp + 0x48]
push ebp
push eax
push ecx
lea ecx, [edi + 0x104]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
call fcn.103f0630
test eax, eax
jne 0x103f579c
push ebp
push 0x596ffc4
mov ecx, edi
call fcn.103f49b0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop ebp
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
mov edx, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x50]
push esi
push ebp
push ebp
push ebx
lea ecx, [edx + 0x14]
call fcn.103f01b0
lea ecx, [esp + 0x2c]
mov esi, eax
call fcn.103e80c0
push ebx
mov dword [esp + 0x4c], ebp
call fcn.103f07e0
add esp, 4
test eax, eax
je 0x103f583f
add esi, 0x18
push esi
call fcn.103e8b10
add esi, eax
push esi
call fcn.103e8b10
mov ecx, dword [esp + 0x60]
add esp, 8
cmp ecx, 3
lea eax, [esi + eax + 8]
ja 0x103f5b42
jmp dword [ecx*4 + 0x58a3b80]
mov eax, dword [esi]
push ebp
push eax
mov ecx, edi
call fcn.103f4af0
mov ebx, dword [esp + 0x58]
mov ebp, eax
lea edi, [esi + 0x18]
mov edx, dword [ebp + 0x28]
lea ecx, [ebx + ebx*4]
mov esi, edi
lea eax, [edx + ecx*4]
push esi
mov dword [esp + 0x5c], eax
call fcn.103e8b10
add esi, eax
push esi
call fcn.103e8b10
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x103f5890
mov ecx, dword [esi + 0x1c]
push ecx
call dword [0x592641c]
test eax, eax
je 0x103f5890
mov eax, 1
jmp 0x103f5892
xor eax, eax
cmp ebx, 8
jge 0x103f5af7
cmp ebx, 7
ja 0x103f5b42
jmp dword [ebx*4 + 0x58a3b90]
test eax, eax
jne 0x103f5b0a
mov ecx, dword [esp + 0x10]
push eax
push 0x596ffb0
call fcn.103f49b0
push 6
call dword [ebp + 0x2c]
lea edx, [esp + 0x1c]
xor ecx, ecx
add ebx, 0xfffffff8
push edx
mov dword [esp + 0x20], ecx
push ebx
push esi
mov dword [esp + 0x2c], ecx
call eax
mov edx, dword [esp + 0x5c]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push eax
call fcn.103f6050
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov esi, eax
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x594c0e8
call fcn.103e82c0
mov ecx, dword [esp + 0x40]
mov eax, esi
pop esi
mov edx, edi
pop ebx
pop edi
pop ebp
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x103fd2e0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x5995c60]
xor edx, edx
cmp eax, edx
jne 0x103fd306
xor eax, eax
mov byte [eax + 0x5995b60], al
inc eax
cmp eax, 0x100
jl 0x103fd2ee
mov dword [0x5995c60], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x5995b60
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x103fd397
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x103fd36a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x103fd338
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x103fd410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x103fd463
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x103fd44a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret