joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b7af
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x40b7f6
call fcn.00412e31
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40b7f6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x40b812
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0040b2af
mov esi, eax
test edi, edi
je 0x40b810
test ebx, ebx
je 0x40b810
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40bc45
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x51610b
call fcn.004f9882
mov esi, ecx
cmp dword [esi + 0x6c], 0
jne 0x40bc6a
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x40bcbc
call fcn.0040e5e5
push eax
lea ecx, [ebp - 0x10]
call fcn.00401759
mov ecx, dword [esi + 0x6c]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f8848
push eax
call fcn.00403ebe
add esp, 0x14
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.004017be
mov eax, esi
call fcn.004f995a
ret 8

Function at 0x40ea4c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x565470]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x40ea91
push 0x51fb18
push 4
push eax
call fcn.004fb37a
push eax
call fcn.00403ebe
add esp, 0x10
jmp 0x40eaa7
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x40eb27
push edi
call fcn.004f9ddd
mov edi, dword [eax]
call fcn.004f9ddd
and dword [eax], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004f9d7a
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004f9ddd
cmp dword [eax], 0
je 0x40eafb
call fcn.004f9ddd
push dword [eax]
call fcn.004050ba
pop ecx
jmp 0x40eb02
call fcn.004f9ddd
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
pop edi
je 0x40eb27
cmp dword [ebp - 0x234], esi
jae 0x40eb27
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40eb29
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004f8839
leave
ret
Function at 0x40f014
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x565470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp + 0xc]
push edi
push str.KERNEL32.DLL
mov dword [ebp - 0x13c], eax
xor esi, esi
call fcn.00406c3e
pop ecx
cmp eax, esi
je 0x40f0fe
push str.GetThreadPreferredUILanguages
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
cmp edi, esi
je 0x40f0fe
xor eax, eax
push 0xc8
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push esi
push eax
mov dword [ebp - 0x140], esi
call fcn.004f99b0
add esp, 0xc
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x34
mov dword [ebp - 0x138], 0x65
call edi
test eax, eax
je 0x40f0fe
lea edi, [ebp - 0xd0]
cmp word [ebp - 0xd0], si
je 0x40f0fe
cmp esi, 0x14
jge 0x40f0fe
push 0x10
push 0
push edi
call fcn.004fba3f
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x40f0ed
call fcn.004f9ddd
cmp dword [eax], 0x22
je 0x40f0ed
mov dword [ebp + esi*4 - 0x134], ebx
inc esi
push edi
call fcn.004f998c
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
pop ecx
jne 0x40f0c3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
mov ebx, 0xfc00
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x134], eax
call edi
mov dword [ebp + esi*4 - 0x130], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
mov ecx, eax
and ecx, 0x3ff
and eax, ebx
or eax, ecx
push eax
mov dword [ebp - 0x138], ecx
call edi
push dword [ebp - 0x138]
mov dword [ebp + esi*4 - 0x12c], eax
call edi
mov dword [ebp + esi*4 - 0x128], eax
add esi, 4
cmp dword [0x568788], 0
jne 0x40f189
mov dword [ebp + esi*4 - 0x134], 0x800
inc esi
xor edi, edi
test esi, esi
jle 0x40f1b2
push dword [ebp + edi*4 - 0x134]
mov ecx, dword [ebp - 0x144]
push dword [ebp - 0x13c]
call fcn.0040ea4c
pop ecx
pop ecx
test eax, eax
jne 0x40f1b4
inc edi
cmp edi, esi
jl 0x40f18f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f8839
leave
ret 8

Function at 0x4104f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor ebx, ebx
call fcn.00412e31
mov esi, dword [eax + 0xc]
push 5
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x410532
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov ecx, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push ebx
call fcn.00410136
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x410590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x78], ebx
test ebx, 0xffff0000
jne 0x4105b4
cmp dword [edi + 0x74], 0
jne 0x4105b4
movzx eax, bx
mov dword [edi + 0x74], eax
call fcn.00412e31
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00410551
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x413210
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00412eb4
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x41325a
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040500b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00404fdc
jmp 0x413265
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004151da
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x41326b
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call fcn.0040b8bb
push 0xfffffffffffffff0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x4132a8
call fcn.00412eb4
mov dword [esi + 0xc], 1
jmp 0x4132ad
call fcn.00412eb4
cmp dword [esi], 0
je 0x4132f6
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x4132ce
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0040500b
jmp 0x4132e0
mov ecx, dword [ebp + 0x10]
push 0xff
call fcn.004018d1
push 0x100
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00404fdc
jmp 0x41331a
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x41331a
push dword [esi]
push dword [ebp + 8]
call fcn.004151da
pop esi
pop ebp
ret 0xc
Function at 0x41754f
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x565470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x105
push esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x417584
xor eax, eax
jmp 0x4175d7
lea eax, [ebp - 0x210]
push eax
call fcn.004f998c
cmp word [ebp + eax*2 - 0x212], 0x5c
pop ecx
je 0x4175b5
push 0x547e74
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004fba59
add esp, 0xc
test eax, eax
jne 0x417580
push edi
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.004fba59
add esp, 0xc
test eax, eax
jne 0x417580
lea eax, [ebp - 0x210]
push eax
call fcn.00406c3e
pop ecx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004f8839
leave
ret

Function at 0x44c903
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004d1aac
call fcn.00412862
cmp dword [eax + 0x14], 0
jne 0x44c920
mov ecx, esi
pop esi
jmp fcn.0044c408
pop esi
ret

Function at 0x44ff8a
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.0045ccee
call fcn.00412862
cmp dword [eax + 0x14], 0
jne 0x44ffa7
mov ecx, esi
pop esi
jmp fcn.0044f95d
pop esi
ret

Function at 0x4651ae
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x4651c8
call fcn.00412e31
mov esi, dword [eax + 0xc]
push dword [0x56a5b0]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4651e6
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x4651de
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x465213
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x4651e0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.004650dc
mov esi, eax
jmp 0x465205
Function at 0x4df1f8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4df210
mov edi, dword [esi + 0xc]
jmp 0x4df250
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4df229
call fcn.0040c6fd
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4df23e
call fcn.0040c6fd
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4df250
call fcn.0040c6fd
call fcn.00412e31
cmp dword [eax + 0x3c], 0
je 0x4df265
push edi
mov ecx, ebx
call fcn.004de029
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004df112
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4df283
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4df28f
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4f8839
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x565470]
jne 0x4f8843
repz ret
jmp fcn.004ff7f3
Function at 0x50a1e8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x565470]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004ff21b
and dword [ebp - 0x14], 0
cmp dword [0x56cfa4], 0
mov dword [ebp - 0x18], eax
jne 0x50a29b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x50a343
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5452f8
push ebx
call edi
test eax, eax
je 0x50a343
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5452e8
push ebx
mov dword [0x56cfa4], eax
call edi
push eax
call esi
push 0x5452d4
push ebx
mov dword [0x56cfa8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x56cfac], eax
call edi
push eax
call esi
mov dword [0x56cfb4], eax
test eax, eax
je 0x50a29b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x56cfb0], eax
mov eax, dword [0x56cfb0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x50a2f4
cmp dword [0x56cfb4], ecx
je 0x50a2f4
push eax
call esi
push dword [0x56cfb4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x50a2f4
test ebx, ebx
je 0x50a2f4
call edi
test eax, eax
je 0x50a2eb
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x50a2eb
test byte [ebp - 8], 1
jne 0x50a2f4
or dword [ebp + 0x10], 0x200000
jmp 0x50a327
mov eax, dword [0x56cfa8]
cmp eax, dword [ebp - 0x18]
je 0x50a327
push eax
call esi
test eax, eax
je 0x50a327
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x50a327
mov eax, dword [0x56cfac]
cmp eax, dword [ebp - 0x18]
je 0x50a327
push eax
call esi
test eax, eax
je 0x50a327
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x56cfa4]
call esi
test eax, eax
je 0x50a343
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x50a345
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f8839
leave
ret
Function at 0x427358
Capabilities:
Encode data using xor

Disassembly:
pop ecx
add byte [ecx], ch
add cl, byte [eax + 0x1a]
insb byte es:[edi], dx
jnp 0x427363
mov dword ss:[0xe3b9113f], eax
mov dword [0xe3b9113f], eax
pop es
fisub dword [esi - 0x1727edb]
push ss
pushal
lea esp, [edi + 0x76364df6]
cmp eax, 0x4f184b84
push ecx
or byte [edi], al
pop ss
mov al, bl
sub dword [ebx], ebp
neg byte [edx - 0x5a]
scasd eax, dword es:[edi]
xchg ecx, eax
out dx, al
jecxz 0x42739b
mov al, 0x83
fistp qword [eax - 0xd49879c]
dec eax
sub ebp, dword [ebp - 0x23]
fbld tbyte [ecx - 0x53005a16]
cmpsd dword [esi], dword es:[edi]
std
sub esp, 0xffffff95
stc
mov dword [0xe334fe42], eax
movsd dword es:[edi], dword [esi]
jmp [edi - 0x137c029b]
xor al, 0xe3
in al, 0xd9
mov ebp, 0xb72d87ea
inc edi
xor eax, 0x43f6f508
dec edi
rol byte [ebp + 0x6e3b20c4], 0x31
je 0x4273a8
push ecx
pushfd
xor eax, dword [ebx - 0x4d]
mov byte [ecx - 0x3d], dl
push esp
sbb cl, bl
mov eax, 0x9bff31e5
sub al, 0x87
insb byte es:[edi], dx
adc dword [0x4a179246], esi
or al, cl
xor eax, 0xa7785322
invalid

Function at 0x44a210
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, 0x190
push edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2e2
lea ecx, [esp + 0x20]
push ebp
mov ebp, 4
push ecx
push edi
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.Browse_For_Folder_Width
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a290
mov ebx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [esp + 0x14], ebp
je 0x44a2a9
mov eax, dword [0x65bb1c]
push 0x65b838
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.Browse_For_Folder_Height
push ecx
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
pop ebp
jne 0x44a2d7
or esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
mov edx, ebx
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x4ea775
Capabilities:
Encode data using xor

Disassembly:
inc edi
push eax
add al, 0xe
mov cl, 0x9f
sbb cl, 0x9a
push ebx
lea ebp, [esi - 0x5e8c4af1]
mov ebx, 0x9d12a72d
jecxz 0x4ea759
xor cl, byte [ebp - 0x77]
Function at 0x602f88
Capabilities:
Encode data using xor

Disassembly:
dec esp
enter 0xffffffffffffc518, 0x3b
fsub dword [ebp + 0x26]
lds edx, [edx - 0x1d]
sbb ch, al
cmp ebx, eax
lds edx, es:[edx - 0x1d]
lds edx, es:[edx - 0x1d]
invalid
invalid
inc esi
loope 0x602fe6
add ah, byte [esi + 0x2d]
push cs
cmpsb byte [esi], byte es:[edi]
xor edx, 0xffffffa8
mov al, byte [ecx - 0x72]
xor dword [ecx - 0x2f], edx
jl 0x602f96
jae 0x602fc2
invalid
push es
xchg esi, eax
cmp cl, byte [eax + 0xcafe059]
salc
pop ecx
loopne 0x602f78
or al, 0xd6
fadd qword [edi - 0x60]
outsb dx, byte [esi]
pop esp
jo 0x602f66
lodsd eax, dword [esi]
sub ecx, dword [ebx - 0x77334a5b]
lodsd eax, dword [esi]
mov al, 0x4c
in al, dx
sbb byte [edi + 0x14b18942], 0x59
jecxz 0x602f68
mov ah, 0x2e
jnp 0x602f6d
cmp byte [esi], bl
xor eax, 0xda3fb91
and eax, 0x1b0afb59
inc ebp
and byte es:[ebx], ch
jp 0x603079
sub dl, byte [esp + esi + 0x6f]
test ah, 0x9a
dec ebp
sub eax, 0xbf9090f2
out dx, eax
push edi
cmc
cmc
or eax, 0x1276c285
inc esi
sbb dl, byte [ebx + 0x435481ec]
loop 0x603041
xchg edx, eax
mov ebx, 0xea8f0552
xchg edx, eax
jbe 0x602fc6
mov edx, 0x716c346d
bound edx, qword [ebp + edx*2 - 0x5b]
imul dword [ebx + 5]
cmpsb byte [esi], byte es:[edi]
cmp eax, 0x49a52215
stosd dword es:[edi], eax
invalid
Function at 0x637767
Capabilities:
Encode data using xor

Disassembly:
inc edi
push edx
movsd dword es:[edi], dword [esi]
xor ecx, esp
cmp byte [edx], dl
dec ebx
mov byte [0xd91548bb], al
ficom dword [eax]
fmulp st(3)
push eax
imul esi, esi, 0x22
inc esp
mov dh, ah
cmp eax, 0x8a6c401e
add al, 0x1e
insb byte es:[edi], dx
mov al, byte [esi + ebx]
jmp 0x3c8d47ea
rcl byte [eax - 0x5e], 0x49
mov eax, dword [0x63827549]
sub byte [bp + si + 0x5378], 0x1c
pop ebp
push ebx
push ds
test dword [ebx], 0x6d4f300
je 0x637728
aad 0x29
dec esp
inc ebx
mov dl, 4
in eax, dx
test cl, dl
push edi
and byte [edx], ah
jecxz 0x63774a
push 0x5a311745
wait
jbe 0x63767b
push ebx
nop
push ebx
dec edi
jecxz 0x637696
out dx, eax
and eax, dword [ebx]
in eax, dx
pop eax
mov bh, 0x32
bound edx, qword [ebx + 0x43]
loope 0x637719
adc dh, byte [edi - 0x44]
ja 0x6376c5
xor byte [ebp + 0x738431b0], dh
sub al, byte [ecx]
xchg dword [ebx - 0x3e4cd4f2], edx
mov ch, byte [ebp - 0x27440c24]
mov esi, 0xef39a037
fdivr st(3), st(0)
mov ebx, 0xa037bed8
cmp edi, ebp
xchg edi, eax
mov esi, 0x644dc37e
imul ebp, dword fs:[eax], 0x21
imul ebp, dword [eax], 0x21
inc edi
jecxz 0x637707
arpl bp, si
jae 0x637707
sub byte [esi - 6], 0x7e
mov esp, 0xc3d5920e
cmp edx, dword [ebp + ecx*8 - 0x2363cc6e]
int 0x92
invalid
pushfd
fdivr qword [edx + 0x28]
lcall 0x4c8b, 0x54ae
dec esp
mov ebp, 0xc30c7da3
mov bl, 0x6f
mov byte [0x93a18472], al
push 0x37c00387
sal byte [edi], 0x3b
inc edx
xor eax, 0x2c7b3003
cmp eax, dword [edx + 0x35]
add esi, dword [eax]
jnp 0x63778f
scasb al, byte es:[edi]
clc
sub cl, byte [eax]
sbb ecx, dword [ecx + 0x42a079cf]
inc edx
js 0x637706
add dh, byte [ecx + 0x1e8676b6]
int 0x82
out 0xf9, al
lahf
jb 0x6377be
jg 0x637727
arpl word gs:[edx], si
test byte [esi + 0x1d22395e], bl
jbe 0x63777a
inc esp
xchg esi, eax
div dword [ebx + ebx*2 - 0x659bcb3d]
mov dl, 0xde
xor ah, dh
jle 0x637790
mov ah, 0x5b
pop ebx
ret
mov byte [0x23c3ccc4], al
and cl, ah
cmp edx, dword [ebx + 0x74]
lds esp, [bp + di - 0x519f]
dec esp
or al, 7
out 0x4d, al
sal byte [ebx + 0x1693b205], 0x43
in eax, 0xac
invalid
je 0x63775a
rcl byte [esi + 0x22]
add al, 0x64
rol dword [0x62e3c392], cl
cmp al, byte [ebx]
sbb bh, cl
test cl, dh
or al, 0x64
dec ebp
inc ecx
movsb byte es:[edi], byte [esi]
mov al, 0x3a
fld dword [edi]
adc al, 0x53
pushfd
retf

Function at 0x64cfe8
Capabilities:
Terminate process

Disassembly:
add byte gs:[ecx + 0x59], bl
ret
Function at 0x64e06d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x658408
cmp edx, dword [eax]
je 0x64e08f
add eax, 8
inc ecx
cmp eax, 0x658498
jl 0x64e080
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x658408]
jne 0x64e1bd
mov eax, dword [0xa5bd60]
cmp eax, 1
je 0x64e197
test eax, eax
jne 0x64e0c0
cmp dword [0x658334], 1
je 0x64e197
cmp edx, 0xfc
je 0x64e1bd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e0f7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ea50
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064eee0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e13a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064eee0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653e34
push edi
call fcn.00650db0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ea50
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ea60
lea eax, [ebp - 0xa0]
push 0x653e14
push eax
call fcn.0064ea60
push dword [esi + 0x65840c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ea60
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650d24
add esp, 0x2c
pop edi
jmp 0x64e1bd
lea eax, [ebp + 8]
lea esi, [esi + 0x65840c]
push 0
push eax
push dword [esi]
call fcn.0064eee0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x577370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x57738e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x5a0074
push ecx
mov edi, eax
call fcn.0058b198
mov esi, eax
add esp, 8
test esi, esi
jne 0x5773cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0058b02e
push esi
call fcn.0058afb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret