joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4631a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x488c38
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4a7f70]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x4a7eb8]
cmp eax, 0xffffffff
jne 0x4631d9
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x4631e6
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x46324d
jmp 0x46321c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x46328a
test edi, edi
jne 0x463290
push 0x462360
push 0x4aa52c
call fcn.00461eb0
mov eax, dword [0x4a7eb8]
add esp, 8
cmp eax, 0xffffffff
je 0x46324d
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x463276
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x463276
mov eax, dword [ebp]
push 0
mov ecx, ebp
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x4632c8
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x4632b9
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x463290
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov esi, dword [ebx]
mov dword [esp + 0x18], eax
cmp esi, ebx
je 0x463210
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x463327
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x46330c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x463327
jmp 0x463300
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x463300
jmp 0x463327
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x463325
cmp esi, dword [eax + 8]
jne 0x463325
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x463315
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x46333b
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x46333b
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, ebp
call fcn.00410bb0
cmp esi, ebx
jne 0x4632e0
mov ebp, dword [esp + 0x14]
jmp 0x463210
Function at 0x463360
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x18]
push eax
push 4
push edx
push 0x463510
push 0
push 0
call fcn.00468cbf
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x463389
pop esi
xor al, al
pop ebx
ret
mov ecx, dword [esi]
push edi
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x4633ad
cmp eax, 0xffffffff
je 0x4633ad
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
mov al, 1
pop ebx
ret
Function at 0x479cf8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a7f70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0046b9fb
mov dword [ebp - 0x14], eax
cmp dword [0x4ab38c], edi
jne 0x479de9
push 0x800
push edi
push 0x497334
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x479d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x479ec9
push 0x497334
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x479ec9
push 0x49734c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x479ec9
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x4ab38c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4ab390], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4ab394], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab39c], eax
test eax, eax
je 0x479de6
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ab398], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x479e0e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x479e01
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x479e23
push 4
pop eax
jmp 0x479ecb
cmp dword [ebp - 0x14], edi
je 0x479e23
push dword [0x4ab38c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x479e08
mov eax, dword [0x4ab398]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x479e81
cmp dword [0x4ab39c], esi
je 0x479e81
push eax
call ebx
push dword [0x4ab39c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x479e81
test eax, eax
je 0x479e81
call ecx
test eax, eax
je 0x479e76
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x479e76
test byte [ebp - 8], 1
jne 0x479e81
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x479eb1
mov eax, dword [0x4ab390]
cmp eax, esi
je 0x479eae
push eax
call ebx
test eax, eax
je 0x479eae
call eax
mov edi, eax
test edi, edi
je 0x479eae
mov eax, dword [0x4ab394]
cmp eax, esi
je 0x479eae
push eax
call ebx
test eax, eax
je 0x479eae
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x4ab38c]
call ebx
test eax, eax
je 0x479ec9
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x479ecb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464acc
leave
ret
Function at 0x47ee33
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004703ba
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x47ee6b
xor eax, eax
jmp 0x47ee97
cmp esi, dword [ebp - 4]
je 0x47ee94
cmp dword [ebp + 0xc], 0
je 0x47ee94
push dword [edi + 0x9c]
call fcn.0047ea41
push dword [edi + 0x9c]
mov esi, eax
call fcn.0046bf8c
pop ecx
pop ecx
cmp esi, eax
je 0x47ee67
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40401c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x404028
push 0x404024
push 0x404020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x404028]
push dword [0x404024]
push dword [0x404020]
mov dword [0x404014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push esi
push edi
xor edi, edi
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x88], 0xf
mov dword [ebp - 0x8c], 0x1bc
jmp 0x401338
mov eax, dword [ebp - 0x8c]
or eax, eax
jl 0x4012e5
cmp eax, dword [0x4040e0]
jge 0x4012e5
cmp byte [eax + 0x4040e4], 0x4d
jg 0x40134e
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x90], eax
jmp 0x40131b
mov eax, dword [ebp - 0x90]
or eax, eax
jl 0x401314
cmp eax, dword [0x4040e0]
jge 0x401314
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0x90
jge 0x401331
sub dword [ebp - 0x90], 0x46
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x88]
jle 0x401331
cmp eax, dword [0x4040e0]
jl 0x4012f3
add dword [ebp - 0x8c], 0x1c
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebp - 0x88]
jge 0x40134e
or eax, eax
jg 0x4012c9
add dword [ebp - 0x88], 0x60
cmp dword [ebp - 0x88], 0x780
jl 0x4012bd
call fcn.00401c82
mov edi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, edi
or al, 0x40
push eax
mov eax, dword [fcn.00401ef0]
mov edx, dword [0x4040dc]
sub edx, eax
push edx
push dword [0x4040d8]
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x4014d1
mov dword [ebp - 0x8c], 0x1460
mov dword [ebp - 0x90], 0x91a
mov dword [ebp - 0x94], 0x38
mov eax, dword [ebp - 0x94]
or eax, eax
jl 0x4013da
cmp eax, dword [0x4040e0]
jge 0x4013da
cmp byte [eax + 0x4040e4], 0x41
jge 0x401464
mov dword [ebp - 0x98], 0x1a98
jmp 0x401434
mov dword [ebp - 0x9c], 0x1866
jmp 0x401418
mov eax, dword [ebp - 0x9c]
or eax, eax
jl 0x40140e
cmp eax, dword [0x4040e0]
jge 0x40140e
cmp byte [eax + 0x4040e4], 0x6f
jge 0x40142a
add dword [ebp - 0x9c], 0x2c7
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x8c]
jge 0x40142a
or eax, eax
jg 0x4013f2
add dword [ebp - 0x98], 0x161
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x8c]
jle 0x40144a
cmp eax, dword [0x4040e0]
jl 0x4013e6
add dword [ebp - 0x94], 0x186
cmp dword [ebp - 0x94], 0xe84
jl 0x4013ba
add dword [ebp - 0x90], 0xffffff42
cmp dword [ebp - 0x90], 0x19
jg 0x4013b0
add dword [ebp - 0x8c], 0xfffffd87
cmp dword [ebp - 0x8c], 0x4c
jg 0x4013a6
push edi
call fcn.004019f9
lea eax, [ebp - 0x84]
push eax
push edi
call fcn.00401ad1
mov eax, edi
add eax, 0x1ce00
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov esi, dword [ebp - 0x88]
mov ecx, edi
sar esi, cl
push esi
push 0x4040e4
call fcn.00401ef0
add esp, 0x18
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40187e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov eax, esi
add eax, 0xc8
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, edi
xor eax, esi
mov ecx, dword [ebp - 4]
cdq
idiv ecx
mov dword [ebp - 0xc], eax
and dword [ebp - 8], 0
jmp 0x4019e3
or esi, esi
je 0x4018c0
mov eax, dword [ebp - 8]
mov edx, eax
add edx, eax
mov dword [ebp - 0x18], edx
jmp 0x4018c6
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 8], eax
jne 0x4018f3
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov edx, esi
shl edx, cl
add edi, edx
mov edx, dword [ebp - 8]
mov ecx, esi
shl edx, cl
imul edx, dword [ebp - 4]
sub edi, edx
mov dword [ebp - 4], edi
cmp dword [ebp - 4], 0
je 0x4019f4
and dword [ebp - 0x14], 0
push esi
call fcn.004014d7
mov dword [ebp - 0x1c], eax
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, esi
mov dword [ebp - 0x30], eax
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov dword [ebp - 0x38], eax
mov edx, eax
add edi, eax
mov edx, dword [ebp - 0x34]
or dl, 1
mov ecx, esi
imul ecx, edx
mov edx, dword [ebp - 0x34]
mov eax, edx
sub eax, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov ecx, esi
inc ecx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x3c]
cdq
idiv ecx
add edi, edx
mov dword [ebp - 0x20], edi
mov eax, edi
movzx eax, byte [ebx + eax]
add eax, esi
mov byte [ebp - 0x29], al
push esi
call fcn.004014d7
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x44], eax
mov eax, esi
mov dword [ebp - 0x40], eax
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov dword [ebp - 0x48], eax
mov edx, eax
add edx, edi
mov dword [ebp - 0x50], edx
mov edi, dword [ebp - 0x44]
mov ecx, edi
mov edi, esi
sar edi, cl
mov ecx, dword [ebp - 0x44]
mov eax, ecx
sub eax, edi
mov dword [ebp - 0x4c], eax
mov edi, dword [ebp - 4]
mov ecx, edi
or ecx, esi
cdq
idiv ecx
mov edi, dword [ebp - 0x50]
add edi, edx
mov dword [ebp - 0x28], edi
mov ecx, edi
movzx eax, byte [ebx + ecx]
mov ecx, esi
inc ecx
mul ecx
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x2a], al
movzx edx, byte [ebp - 0x29]
mov ecx, esi
shr edx, cl
mov byte [ebx + edi], dl
mov eax, dword [ebp - 0x20]
movzx edx, byte [ebp - 0x2a]
xor edx, esi
mov byte [ebx + eax], dl
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x7e8
jl 0x401901
inc dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, esi
dec edx
and eax, edx
cmp dword [ebp - 8], eax
jle 0x4018b0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401c82
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push ebx
push esi
push edi
and dword [ebp - 0x19c], 0
xor edi, edi
mov dword [ebp - 0x2a4], 0x19
mov eax, dword [ebp - 0x2a4]
or eax, eax
jl 0x401cc1
cmp eax, dword [0x4040e0]
jge 0x401cc1
cmp byte [eax + 0x4040e4], 0x5f
jl 0x401dd2
mov dword [ebp - 0x2a8], 0x13ae
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x2ac], eax
jmp 0x401d88
mov dword [ebp - 0x2b0], 0x520
mov eax, dword [ebp - 0x2b0]
or eax, eax
jl 0x401d07
cmp eax, dword [0x4040e0]
jge 0x401d07
movsx eax, byte [eax + 0x4040e4]
cmp eax, 0x8a
jg 0x401d7e
mov dword [ebp - 0x2b4], 0x10bd
jmp 0x401d55
mov eax, dword [ebp - 0x2b4]
or eax, eax
jl 0x401d2f
cmp eax, dword [0x4040e0]
jge 0x401d2f
cmp byte [eax + 0x4040e4], 0x3a
jge 0x401d67
mov eax, dword [ebp - 0x2b4]
or eax, eax
jl 0x401d4b
cmp eax, dword [0x4040e0]
jge 0x401d4b
cmp byte [eax + 0x4040e4], 0x56
je 0x401d67
add dword [ebp - 0x2b4], 0x267
mov eax, dword [ebp - 0x2b4]
cmp eax, dword [ebp - 0x2ac]
jge 0x401d67
or eax, eax
jg 0x401d13
add dword [ebp - 0x2b0], 0xffffff6c
cmp dword [ebp - 0x2b0], 0x62
jg 0x401ce6
sub dword [ebp - 0x2ac], 0x26c
mov eax, dword [ebp - 0x2ac]
cmp eax, 0x19bd
jle 0x401da1
cmp eax, dword [0x4040e0]
jl 0x401cdc
add dword [ebp - 0x2a8], 0xfffffd5d
cmp dword [ebp - 0x2a8], 0x57
jg 0x401ccb
add dword [ebp - 0x2a4], 0xe9
cmp dword [ebp - 0x2a4], 0xbd6
jl 0x401ca1
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
and dword [ebp - 0x198], 0
lea eax, [ebp - 0x198]
push eax
call sub.KERNEL32.dll_GetVersionExA
push 0
push 0
push 3
push 0
push 0
push 0x80000000
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_CreateFileA
mov ebx, eax
mov byte [ebp - 0x104], 0
call sub.KERNEL32.dll_GetLastError
mov esi, eax
mov dword [ebp - 0x2a4], 0x1de8
mov dword [ebp - 0x2a8], 0x134e
jmp 0x401ea0
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2ac], eax
jmp 0x401e84
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401e61
cmp eax, dword [0x4040e0]
jge 0x401e61
cmp byte [eax + 0x4040e4], 0x3d
je 0x401e96
mov eax, dword [ebp - 0x2ac]
or eax, eax
jl 0x401e7d
cmp eax, dword [0x4040e0]
jge 0x401e7d
cmp byte [eax + 0x4040e4], 1
jle 0x401e96
add dword [ebp - 0x2ac], 0x35
mov eax, dword [ebp - 0x2ac]
cmp eax, dword [ebp - 0x2a4]
jge 0x401e96
or eax, eax
jg 0x401e45
add dword [ebp - 0x2a8], 0x273
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x2a4]
jle 0x401eb6
cmp eax, dword [0x4040e0]
jl 0x401e37
sub dword [ebp - 0x2a4], 0x3d1
cmp dword [ebp - 0x2a4], 0x62
jg 0x401e2b
mov edi, esi
sub edi, 3
push ebx
call sub.KERNEL32.dll_CloseHandle
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x424f66
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
xchg ebx, eax
push esp
or bh, byte [ebp - 0x1b]
out 0x6c, al
scasd eax, dword es:[edi]
retf
sub dword [esi + 0x3e81de1d], 0xd642aa2f
dec esp
dec ecx
xor byte [ebx - 0x2f], cl
pushfd
ficom word [eax - 0xf]
scasd eax, dword es:[edi]
cdq
or al, 0x5d
hlt
outsb dx, byte [esi]
pop esi
push ds
jno 0x424eec
mov al, byte [0xdd1c572f]
push ecx
add byte [edx - 0x56d92ec1], dh
mov esp, 0x457bc1da
aas
shl dword [esi], 1
test eax, 0x7bc1dabc
inc ebp
sahf
or esi, dword [ebx + eax*8 + 0x7764189]
mov eax, dword [0x21da69be]
or al, 0xb1
jnp 0x424f1a
and dword [ebx + 0x2fae7a27], 0x2e7cc28a
mov edx, 0x917e7689
scasb al, byte es:[edi]
xor ecx, 0xfffffff4
bound esi, qword [ecx - 0x274187c1]
xchg ecx, eax
adc ecx, esi
push es
mov esi, 0x419e7c79
dec edx
xor al, 0xcc
or al, 0xb6
mov edx, 0x2ea8db20
mov esp, 0x42bc376f
in al, dx
push esi
xlatb
add byte [edx - 0xf7f6e22], 0xf4
loopne 0x424f73
cdq
sbb al, 0x91
mov esi, 0xa1bf22c4
and al, 0xf7
dec eax
nop
iretd

Function at 0x48251b
Capabilities:
Encode data using xor

Disassembly:
shl cl, 0x34
leave
test eax, 0x709fe891
adc eax, 0x4908f9c6
mov eax, dword [0xedeb90ad]
lodsd eax, dword [esi]
nop
jmp 0x48250c
popfd
lcall 0xd63f, 0x5d2469d0
inc esi
and ah, ah
stosd dword es:[edi], eax
dec esi
adc esi, ebp
and ebx, dword [ebp + 0x40637278]
adc eax, esi
push ds
in al, 0x9f
jle 0x482584
lodsd eax, dword [esi]
nop
jmp 0x48250c
mov dl, 0x21
scasb al, byte es:[edi]
cwde
cmp cl, byte [edi + 0x164a0295]
push 0x1d120e2d
xor bl, byte [ecx - 0x10c85947]
sar dword [edi - 0xfadb40a], 0xf2
bswap ebx
salc
jns 0x48257e
invalid
imul bl
dec edi
psrlq mm2, qword [ecx]
rol dword [ebx - 0x2b], 0x3e
aad 0x3e
enter 0xffffffffffffd323, 0x28
enter 0xffffffffffffd323, 0x28
mov al, 0xca
xor byte [ebx], cl
out dx, al
clc
fnstenv [eax]
jo 0x482565
out dx, eax
lcall 0x8b1a, 0x93bfe16b
xchg esp, eax
pop ecx
sub dword [edi - 0x7e], edx
jp 0x48256e
mov edx, dword [ecx + ebx*2 + 0x7a825729]
loop 0x4825a8
sbb ebp, dword [ebp - 0x131dc36c]
lodsd eax, dword [esi]
xchg esp, eax
cmp al, 0xe2
in al, dx
in al, 0x2f
inc eax
or cl, byte [ebx - 0xf439fc0]
dec ebx
jle 0x48256d
push cs
dec ebp
push eax
aas
imul dword [esi - 0x58faa2ac]
xchg edx, eax
cld
cmc
mov dword [edx - 0x365bf573], ebx
mov word [edx + edi*4], gs
and ebp, eax
popal
xchg edx, eax
mov al, byte [0x59239aa8]
lodsb al, byte [esi]
test eax, 0x26a96cbd
salc
cmpsd dword [esi], dword es:[edi]
lahf
invalid
Function at 0x486d93
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
xchg edx, eax
call 0xbfdb0ed1
sbb al, 0xa7
daa
enter 0xffffffffffff8ccb, 0xc
pop es
retf 0x51f4
xchg edx, eax
xor ch, byte [esi]
mov es, word [0x836f98d5]
add eax, 0x836f98d5
add eax, 0x836f98d5
outsd dx, dword [esi]
xor dword [0x87f2805], 0x21
cmp eax, 0xcb3b17c4
xor eax, 0x87f2805
and dword [0xcb3b17c4], edi
aaa
inc ebp
and dword [edx - 0x73], 0xffffffdd
xchg ecx, eax
cmp al, 0xc6
pop ecx
aam 0x2b
fucom st(6)
jle 0x486d8f
push ebp
push 0x35
cmp ebx, dword [eax]
jns 0x486d96
mov word [0x9d574d54], ds
or eax, 0x3f27ebbb
cmp dword [edi], 0xcf2db615
scasd eax, dword es:[edi]
in eax, dx
dec esp
jns 0x486e30
and dword fs:[edx], esp
loope 0x486d62
sbb ebp, dword [edx - 0x78]
xchg ecx, eax
insb byte es:[edi], dx
or dh, bl
xlatb
jbe 0x486dd3
push ecx
jmp 0xc85e7c97
and ebx, dword [ebp + 0x3a411e7a]
pop ds
xchg ebp, eax
pop esp
push eax
jmp 0x62e4eb86

Function at 0x628cb9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6313e8
cmp edx, dword [eax]
je 0x628cdb
add eax, 8
inc ecx
cmp eax, 0x631478
jl 0x628ccc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6313e8]
jne 0x628e09
mov eax, dword [0x639d88]
cmp eax, 1
je 0x628de3
test eax, eax
jne 0x628d0c
cmp dword [0x631310], 1
je 0x628de3
cmp edx, 0xfc
je 0x628e09
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628d43
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006296a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629b30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628d86
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629b30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62da3c
push edi
call fcn.0062ba00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006296a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006296b0
lea eax, [ebp - 0xa0]
push 0x62da1c
push eax
call fcn.006296b0
push dword [esi + 0x6313ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.006296b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b974
add esp, 0x2c
pop edi
jmp 0x628e09
lea eax, [ebp + 8]
lea esi, [esi + 0x6313ec]
push 0
push eax
push dword [esi]
call fcn.00629b30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x416eff
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov edx, dword fs:[0x30]
push dword [edx + 0xc]
pop edx
push dword [edx + 0x14]
pop edx
shr ebx, 0x17
shr ebx, 8
shr ebx, 1
not ebx
xor ebx, dword [edx + 0x28]
not ebx
push ebx
mov dword [ebp - 0x88], 0
or dword [ebp - 0x88], esi
mov dword [ebp - 0x48], 0
add dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 0
or dword [ebp - 0x44], edx
call fcn.004170c2
push 0
pop ecx
or ecx, eax
imul ebx, ebx, 0
or ebx, dword [ebp - 0x48]
mov esi, 0
or esi, dword [ebp - 0x88]
shl edx, 0x1f
shl edx, 1
add edx, dword [ebp - 0x44]
push ecx
pop eax
sub ecx, ecx
or ecx, dword [edx + 0x10]
mov edx, dword [edx]
cmp eax, dword [esp + 4]
jne 0x416f0e
shl eax, 0x1d
shl eax, 2
shl eax, 1
add eax, ecx
ret 4

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x1e4c767d
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x63757ada
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x672c5297
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7da533ab
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219