joyce8/EMBER2024-capa huggingface dataset:
Function at 0x241dc4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x241f5f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
je 0x241f34
mov eax, edi
call fcn.00105358
test eax, eax
jle 0x241e48
mov eax, dword [ebp - 4]
call fcn.00105358
mov esi, eax
mov eax, edi
call fcn.00105358
add esi, eax
mov eax, esi
add eax, 3
call fcn.00102de0
mov esi, eax
push dword [ebp - 4]
push 0x241f78
push edi
push 0x241f84
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00105418
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.0010d204
jmp 0x241e74
mov eax, dword [ebp - 4]
call fcn.00105358
add eax, 2
call fcn.00102de0
mov esi, eax
lea eax, [ebp - 0x10]
mov ecx, 0x241f84
mov edx, dword [ebp - 4]
call fcn.001053a4
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.0010d204
push 0
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.0010d140
push eax
push esi
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x241eb5
push 0
call fcn.0025a434
lea ecx, [ebp - 0x14]
mov edx, 0xee60
call fcn.0025a9ec
mov eax, dword [ebp - 0x14]
mov cx, word [0x241f88]
mov dl, 1
call fcn.0013a960
cmp byte [ebp + 8], 0
je 0x241f2d
cmp byte [ebx + 0x19], 0
je 0x241edc
lea edx, [ebp - 0x18]
mov eax, dword [0x2702c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x904]
call fcn.00180f44
cmp dword [ebp - 0x18], 0
jne 0x241f2d
mov eax, edi
call fcn.00105358
test eax, eax
jle 0x241f14
push dword [ebp - 4]
push 0x241f78
push edi
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00105418
mov edx, dword [ebp - 0x1c]
mov eax, dword [0x2702c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x904]
call fcn.00180f74
jmp 0x241f29
mov eax, dword [0x2702c0]
mov eax, dword [eax]
mov eax, dword [eax + 0x904]
mov edx, dword [ebp - 4]
call fcn.00180f74
mov byte [ebx + 0x19], 0
mov eax, esi
call fcn.00102e10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x241f66
lea eax, [ebp - 0x1c]
call fcn.0010507c
lea eax, [ebp - 0x18]
call fcn.0010507c
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.001050a0
ret
Function at 0x25386c
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 4
push 0
push 0
dec ecx
jne 0x253875
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, ecx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x253a3d
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, ebx
mov dl, 1
mov eax, dword [0x250f68]
call fcn.00251050
mov dword [ebp - 4], eax
test esi, esi
jne 0x2538af
mov esi, dword [ebx + 0x18]
xor eax, eax
push ebp
push 0x253a0d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00105358
test eax, eax
jne 0x25391e
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.002572b0
push dword [ebp - 0xc]
call fcn.0025a434
lea ecx, [ebp - 0x10]
mov edx, 0xf231
call fcn.0025a9ec
push dword [ebp - 0x10]
mov eax, dword [0x270680]
mov eax, dword [eax]
call fcn.001e3ce8
lea edx, [ebp - 0x14]
call fcn.0010c1ac
push dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00105418
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.00256dc8
test al, al
jne 0x2538c8
jmp 0x253951
lea edx, [ebp - 0x18]
mov eax, edi
call fcn.0010cb48
cmp dword [ebp - 0x18], 0
jne 0x253947
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.002572b0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 8]
mov ecx, edi
call fcn.001053a4
jmp 0x253951
lea eax, [ebp - 8]
mov edx, edi
call fcn.00105114
mov eax, dword [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.00259270
mov edi, eax
mov eax, dword [ebp - 4]
add eax, 0xc
mov edx, dword [ebp - 8]
call fcn.001050d0
mov eax, dword [ebp - 4]
mov byte [eax + 0x10], 1
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 8], edx
lea ecx, [ebp - 0x20]
mov edx, esi
mov eax, ebx
call fcn.00258aa4
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
add eax, 0x18
call fcn.001050d0
push esi
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0010cc64
mov edx, dword [ebp - 0x24]
xor ecx, ecx
mov eax, ebx
call fcn.00251bdc
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
mov edx, edi
call fcn.0015abf0
mov eax, dword [ebp - 4]
mov byte [eax + 0x1c], 1
mov eax, dword [ebx + 8]
mov al, byte [eax + 0x30]
mov edx, dword [ebp - 4]
mov byte [edx + 0x1d], al
mov eax, dword [ebp - 4]
mov byte [eax + 0x24], 1
mov eax, dword [ebp - 4]
mov dword [eax + 0x28], 0x3e8
mov eax, dword [ebp - 4]
mov byte [eax + 0x1e], 0
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.0010507c
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0025126c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x253a22
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x253a44
lea eax, [ebp - 0x24]
mov edx, 8
call fcn.001050a0
ret
Function at 0x257e10
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x257ff2
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x2702c0]
mov ecx, dword [ecx]
mov dl, 1
mov eax, dword [0x24bca8]
call fcn.0019ad38
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x257fbb
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0024d9ac
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0xec]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x257f4c
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0024d218
mov dl, 1
mov eax, ebx
call fcn.002573fc
mov eax, ebx
call fcn.00259008
mov eax, ebx
call fcn.002586d4
lea edx, [ebp - 0x10]
mov eax, dword [ebx + 0x10]
call fcn.0010cc64
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov edx, 0x25800c
call fcn.0010cab4
mov eax, dword [ebx + 8]
mov edx, dword [eax + 0x34]
mov eax, dword [ebp - 8]
call fcn.0026a3a8
test al, al
jne 0x257f0e
mov eax, dword [ebx + 8]
cmp dword [eax + 0x34], 0
je 0x257f0e
push 0
lea edx, [ebp - 0x18]
mov eax, ebx
call fcn.002572b0
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.0026bd48
mov eax, dword [ebp - 0x14]
call fcn.00105558
push eax
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x34]
call fcn.00105558
push eax
call sub.kernel32.dll_CopyFileA
mov eax, dword [ebx + 8]
add eax, 0x34
mov edx, dword [ebp - 8]
call fcn.001050d0
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x330]
call fcn.00180f44
cmp dword [ebp - 0x1c], 0
je 0x257f4c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x330]
call fcn.00180f44
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x14]
call fcn.001050d0
mov edx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
call fcn.0015ab5c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov ebx, eax
mov eax, dword [0x270720]
mov eax, dword [eax]
call fcn.0026113c
cmp ebx, eax
jge 0x257fa5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xcc]
test eax, eax
jl 0x257fa5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x440]
mov edx, dword [eax]
call dword [edx + 0xcc]
mov edx, eax
mov eax, dword [0x270720]
mov eax, dword [eax]
xor ecx, ecx
call fcn.002607dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x257fc2
mov eax, dword [ebp - 0xc]
call fcn.0019ef00
ret
Function at 0x25d0e0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdd0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], edx
mov ebx, eax
lea esi, [ebp - 0x1e]
xor eax, eax
push ebp
push 0x25d1fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x123]
xor ecx, ecx
mov edx, 0x105
call fcn.001039a0
lea eax, [ebp - 0x123]
mov edx, ebx
call fcn.0010d204
lea eax, [ebp - 0x228]
xor ecx, ecx
mov edx, 0x105
call fcn.001039a0
lea edx, [ebp - 0x230]
mov eax, ebx
call fcn.00111160
push dword [ebp - 0x230]
push 0x25d214
push 0x25d224
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00105418
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x228]
call fcn.0010d204
mov eax, esi
xor ecx, ecx
mov edx, 0x1e
call fcn.001039a0
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 0x123]
mov dword [esi + 8], eax
lea eax, [ebp - 0x228]
mov dword [esi + 0xc], eax
mov dword [esi + 4], 2
mov word [esi + 0x10], 0x54
push esi
call sub.shell32.dll_SHFileOperationA
mov eax, esi
xor ecx, ecx
mov edx, 0x1e
call fcn.001039a0
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 0x123]
mov dword [esi + 8], eax
mov dword [esi + 4], 3
mov word [esi + 0x10], 0x54
push esi
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x25d205
lea eax, [ebp - 0x230]
mov edx, 2
call fcn.001050a0
ret

Function at 0x26197c
Capabilities:
Access peb ldr_data
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x261aa4
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x114]
mov eax, dword [0x270550]
mov eax, dword [eax]
call fcn.001a2f24
mov eax, dword [ebp - 0x114]
lea edx, [ebp - 0x110]
call fcn.0010cb48
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.00111120
mov edx, dword [ebp - 0x10c]
lea eax, [ebx + 0x1c]
call fcn.001050d0
lea eax, [ebx + 0x20]
mov edx, dword [ebx + 0x1c]
call fcn.001050d0
lea eax, [ebx + 0xc]
mov ecx, 0x261ab8
mov edx, dword [ebx + 0x1c]
call fcn.001053a4
lea eax, [ebx + 8]
mov ecx, 0x261ac8
mov edx, dword [ebx + 0x1c]
call fcn.001053a4
lea eax, [ebx + 0x10]
mov ecx, 0x261ad8
mov edx, dword [ebx + 0x1c]
call fcn.001053a4
lea eax, [ebx + 0x14]
mov ecx, 0x261ae8
mov edx, dword [ebx + 0x1c]
call fcn.001053a4
lea eax, [ebx + 4]
mov ecx, 0x261afc
mov edx, dword [ebx + 0x1c]
call fcn.001053a4
push 0
push 5
lea eax, [ebp - 0x105]
push eax
mov eax, dword [0x270550]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathA
test eax, eax
je 0x261a7b
lea eax, [ebx + 0x18]
lea edx, [ebp - 0x105]
mov ecx, 0x105
call fcn.001052ec
jmp 0x261a86
lea eax, [ebx + 0x18]
mov edx, dword [ebx + 0x1c]
call fcn.001050d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x261aab
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.001050a0
ret
Function at 0x26a0ac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
push ebx
xor eax, eax
mov dword [ebp - 0x404], eax
xor eax, eax
push ebp
push 0x26a123
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x400
lea eax, [ebp - 0x400]
push eax
push 0x26a134
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0x404]
lea edx, [ebp - 0x400]
mov ecx, 0x400
call fcn.001052ec
mov edx, dword [ebp - 0x404]
mov eax, 0x26a14c
call fcn.0026a3c0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x26a12a
lea eax, [ebp - 0x404]
call fcn.0010507c
ret

Function at 0x26a618
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
add esp, 0xfffffec4
mov ebx, eax
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, ebx
call fcn.00105558
push eax
call sub.kernel32.dll_CreateFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x26a6b8
push 0
lea eax, [esp + 4]
push eax
push 0x40
lea eax, [esp + 0x14]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push 0
push 0
mov eax, dword [esp + 0x4c]
push eax
push esi
call sub.kernel32.dll_SetFilePointer_1
push 0
lea eax, [esp + 4]
push eax
push 4
lea eax, [esp + 0x10]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push 0
lea eax, [esp + 4]
push eax
push 0x14
lea eax, [esp + 0x54]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
push 0
lea eax, [esp + 4]
push eax
push 0xe0
lea eax, [esp + 0x68]
push eax
push esi
call sub.kernel32.dll_ReadFile_1
cmp word [esp + 0xa0], 3
sete bl
jmp 0x26a6ba
xor ebx, ebx
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
add esp, 0x13c
pop esi
pop ebx
ret

Function at 0x26a714
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x26a795
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov eax, dword [0x27071c]
mov eax, dword [eax]
mov ecx, dword [eax + 0x1c]
mov eax, dword [0x27071c]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov edx, 0x26a7ac
call fcn.0026a4c0
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, ebx
call fcn.001053a4
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00105558
push eax
push 0x26a7b4
call sub.user32.dll_GetDesktopWindow
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x26a79c
lea eax, [ebp - 8]
mov edx, 2
call fcn.001050a0
ret

Function at 0x26a9ac
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, edi
call fcn.00105558
push eax
mov eax, esi
call fcn.00105558
push eax
mov eax, ebx
call fcn.00105558
push eax
push 0
mov eax, dword [0x270550]
mov eax, dword [eax]
mov eax, dword [eax + 0x44]
call fcn.001878f8
push eax
call sub.shell32.dll_ShellExecuteA
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x26b178
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7f0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x26b28b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, esi
call fcn.00105114
cmp dword [ebp - 4], 0
je 0x26b1d5
mov eax, dword [ebp - 4]
call fcn.00105358
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x3b
je 0x26b1d5
lea eax, [ebp - 4]
mov edx, 0x26b2a0
call fcn.00105360
mov al, byte [0x26b2a4]
push eax
lea eax, [ebp - 0x80c]
push eax
xor ecx, ecx
mov edx, 0x26b2b0
mov eax, dword [ebp - 4]
call fcn.00111a20
mov edx, dword [ebp - 0x80c]
lea eax, [ebp - 4]
call fcn.00105114
test bl, bl
je 0x26b218
lea eax, [ebp - 4]
mov edx, dword [0x27071c]
mov edx, dword [edx]
mov edx, dword [edx + 0x24]
call fcn.00105360
jmp 0x26b252
push 0x801
lea eax, [ebp - 0x805]
push eax
push 0x26b2b4
call sub.kernel32.dll_GetEnvironmentVariableA
lea eax, [ebp - 0x810]
lea edx, [ebp - 0x805]
mov ecx, 0x801
call fcn.001052ec
mov edx, dword [ebp - 0x810]
lea eax, [ebp - 4]
call fcn.00105360
mov eax, dword [ebp - 4]
call fcn.00105558
push eax
push 0x26b2b4
call sub.kernel32.dll_SetEnvironmentVariableA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x26b292
lea eax, [ebp - 0x810]
mov edx, 2
call fcn.001050a0
lea eax, [ebp - 4]
call fcn.0010507c
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..rsrc
nop
nop
mov ebx, 0x40915c
mov ecx, 0x4848656d
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x774574fc
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40ce25
Capabilities:
Encode data using xor

Disassembly:
cmp dl, 0x69
xor dword [ebx], ebx
or eax, 0x4316cd16
push ss
inc ebx
adc al, 0x3d
shr dword [esi], 0x16
xor esp, ebx
not byte [ebp - 0x35aee574]
sbb eax, 0x711bf005
pop ss
sbb esi, dword [ecx + 0x17]
popfd
js 0x40ce2f
jbe 0x40ce85
sbb bh, byte [esp + ecx*8]
dec ebx
add eax, 0x5cc179c
fucom st(7)
lodsb al, byte [esi]
adc cl, byte [ebp - 0x79]
and bl, byte [edx]
adc dword [edi], edx
aas
adc eax, 0xd3e51611
jne 0x40ce4c
int 0x3a
jl 0x40ce90
sub al, 0x37
jecxz 0x40ce41
adc eax, 0x132e383b
add eax, 0x3acf05c9
pop ss
cmp al, 0x1a
lodsd eax, dword [esi]
int 0x96
pop ss
int 0x1f
ret
lodsd eax, dword [esi]
adc edi, eax
sub eax, 0xfd169062
iretd
sub al, 0x81
xor dl, dh
jnp 0x40cf0c
push esi
push 0x5a1173f
xor edx, dword [edi]
invalid
daa
mov bh, 0xf6
push 0x6b
and ah, byte cs:[edi + ebx*8 - 0x2d]
mov al, byte [0xdfab77b7]
hlt

Function at 0x417bd6
Capabilities:
Get common file path

Disassembly:
pop edi
add byte [eax], al
add byte [eax - 0x6f6f6f70], dl
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
xor bl, bl
call 0x36d6c5
mov ecx, eax
test eax, eax
jbe 0x417c28
dec ecx
mov dl, byte [ecx + esi]
cmp dl, 0x2e
je 0x417c09
cmp dl, 0x5c
je 0x417c07
cmp dl, 0x3a
je 0x417bcd
int3
nop
nop
nop
nop
nop
nop
nop
nop
nop
add byte [ebx], cl
enter 0x4c89, 0x24
add al, 0x8b
dec esp
and al, 0x60
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x630038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x63003c]
or ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
fild qword [esp + 4]
test ecx, ecx
fadd qword [0x630050]
fstp qword [0x630050]
je 0x417c63
mov eax, dword [0x6337f0]
test eax, eax
je 0x417c57
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dl, byte [0x630042]
mov cl, byte [0x630048]
xor cl, dl
xor edx, edx
mov dl, byte [0x630047]
and eax, 0xc
imul eax, edx
mov esi, dword [0x630038]
mov byte [0x630048], cl
mov ecx, dword [0x630034]
push ebp
mov ebp, dword [0x630030]
and ecx, 4
xor esi, eax
push edi
lea eax, [esp + 0x14]
add ebp, ecx
push 0x50
push eax
mov dword [0x630030], ebp
mov dword [0x630038], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x630090
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x15]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x63004d]
mov ecx, ebp
and ecx, 3
lea edx, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x630040]
push edx
and cl, al
mov byte [0x630040], cl
mov cl, byte [0x637d50]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [esp + 0x6c], ecx
fild dword [esp + 0x6c]
fdivr qword [0x630050]
fadd qword [0x62d560]
fstp qword [0x6339c0]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x6337f0], eax
test eax, eax
pop ebp
je 0x417d84
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x63007c
push eax
call esi
mov dword [0x6337ec], eax
mov eax, dword [0x6337f0]
push 0x630064
push eax
call esi
mov ecx, dword [0x6337ec]
mov dword [0x6337f4], eax
test ecx, ecx
je 0x417d7a
test eax, eax
je 0x417d7a
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dword [0x6337f0], 0
xor eax, eax
pop esi
add esp, 0x58
ret 4
Function at 0x43c755
Capabilities:
Authenticate hmac

Disassembly:
or byte [edi + 0x3c], 0xdd
or byte [eax], ch
stc
lahf
movsd dword es:[edi], dword [esi]
loop 0x43c7aa
dec esp
inc ebx
jno 0x43c7c8
out 0x2f, al
aas
push es
clc
invalid
mov word [ecx - 0x34], gs
adc dword ds:[edx + 0x7f], esp
add dword [eax], edi
jns 0x43c7dd
push edx
cmpsd dword [esi], dword es:[edi]
jmp 0x43c75d
dec edx
push ebx
mov byte [ecx + 0x2d1a76e3], ah
pop ebx
invalid
ja 0x43c7aa
outsd dx, dword [esi]
mov ecx, ebp
jecxz 0x43c815
and eax, 0xfd3bde83
cmpsb byte [esi], byte es:[edi]
adc cl, dh
push edx
xchg edx, eax
mov ebp, 0x252693c0
mov bh, 0x84
mov esp, 0x481bfb4
mov dword [edi + 0x69b0e494], ecx
wait
cmpsb byte [esi], byte es:[edi]
xchg ebx, eax
jo 0x43c792
and eax, 0xb4bc84b7
mov edi, 0x8f890481
xchg esp, eax
in al, 0xb0
imul ebx, dword [ebx - 0x5e8f6c5a], 0x1f41319f
lahf
xor dword [ecx + 0x1f], eax
mov al, byte [0xfe91642]
mov al, 0xcb
xchg esi, eax
jno 0x43c870
retf
mov cl, 0xa8
popal
inc edx
xor byte [eax + 0x32d6ee9b], 0x4f
xchg esp, eax
loope 0x43c7fb
int1
or dh, byte es:[edi + ebp*8 + 0x3a]
invalid
invalid
pop esi
jecxz 0x43c8d8
imul ebp, edx, 0x50266930
ljmp 0x21c0
sbb esi, 0x21
jnp 0x43c8f0
enter 0xffffffffffff921d, 0xffffffffffffffbb
cmc
and ah, 0x3e
in al, 0x3e
or dword fs:[ebp - 0x726a760a], esi
cdq
aam 0x7c
fild qword [esi + ecx*2 - 0x74]
mov eax, dword [0xac969619]
xchg dword [eax - 0x347a126c], esp
jge 0x43c8ec
push cs
and byte [ebp - 0x126d77f3], dl
sub eax, 0xbc854da1
aam 0xfb
test byte [esi], ah
dec ecx
test dword [esp + edx*8 + 0x492684fb], edi
and byte [eax - 8], bh
lodsd eax, dword [esi]
push ebp
lcall 0x9092, 0xa647f65a
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
nop
mov cl, 0x5c
pop esp
in eax, 0x71
jae 0x43c938
inc edi
mov dword [0xf891e9be], eax
pop edx
mov ecx, 0xf4f68d77
salc
jae 0x43c88b
loope 0x43c8b2
mov al, 0xa2
cmp dword [esi], ebx
test eax, esi
mov edi, dword [esp + edi + 0x46]
xchg edi, eax
js 0x43c8e8
or al, byte [ebx]
jl 0x43c8eb
or esi, dword [eax + 0x3801ee52]
retf 0x328e
adc eax, 0x9c68b876
imul edx, eax, 0x51660b0c
sub byte [eax - 0x1945b24f], dl
sar edx, 0x18
push ds
invalid

Function at 0x47dbe5
Capabilities:
Encode data using xor

Disassembly:
das
add ah, 0xdd
inc edi
sub byte [ebx + 0x521ab25], ah
cmp byte [edi + 0x3b], ah
inc edi
adc dword [ebx], eax
daa
xchg bl, dh
pop es
outsb dx, byte [esi]
cwde
and al, byte [edi - 0x6fdde6cc]
mov eax, 0x3cc7e2c4
in al, 0x46
add byte [edi + 0x4424145e], al
out dx, eax
and ah, byte [edi]
lodsd eax, dword [esi]
std
adc dword [eax], ebp
cmp ah, al
movsd dword es:[edi], dword [esi]
loop 0x47dc5c
wait
pop ebx
adc dword [edi - 0x590b829c], edx
arpl word [ecx + 0x46], sp
popal
inc esi
outsd dx, dword [esi]
xor edi, dword [edx]
jae 0x47dc25
mov esp, 0xc4a3f94c
mov esp, 0xf101f104
in al, dx
mul esp
inc ebp
neg dword [ecx - 9]
mov al, byte [0x25ed6db6]
cdq
test al, 0xf
out 0xef, eax
cmc
pop es
xor al, 0xc1
std
mov bl, 0xed
mov fs, word [ecx + edx*4 + 0x3d]
invalid
Function at 0x628b91
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303c8
cmp edx, dword [eax]
je 0x628bb3
add eax, 8
inc ecx
cmp eax, 0x630458
jl 0x628ba4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303c8]
jne 0x628ce1
mov eax, dword [0x637d64]
cmp eax, 1
je 0x628cbb
test eax, eax
jne 0x628be4
cmp dword [0x6302f0], 1
je 0x628cbb
cmp edx, 0xfc
je 0x628ce1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628c1b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629570
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629a00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628c5e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629a00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d8e4
push edi
call fcn.0062b8d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629570
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629580
lea eax, [ebp - 0xa0]
push 0x62d8c4
push eax
call fcn.00629580
push dword [esi + 0x6303cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629580
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b844
add esp, 0x2c
pop edi
jmp 0x628ce1
lea eax, [ebp + 8]
lea esi, [esi + 0x6303cc]
push 0
push eax
push dword [esi]
call fcn.00629a00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret