joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4089c0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x4321c0], 0x55004e
mov dword [0x4321c4], 0x4c
test esi, esi
jne 0x408a19
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4319c0
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x408c0d
cmp eax, 0x400
jle 0x408a6a
jmp 0x408c0d
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00407fdf
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4321c0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x408c0d
cmp eax, 0x400
jle 0x4089ea
jmp 0x408c0d
mov dword [esp + 0xc], 0x4319c0
mov dword [esp + 8], 0x4321c0
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x4315c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x416930]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x4319c0
mov dword [esp + 4], eax
call fcn.00408698
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x4319c0
call fcn.00407fdf
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x408c0d
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, ebx
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
mov esi, eax
test eax, eax
je 0x408c03
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004080a5
sub esp, 0xc
test eax, eax
je 0x408c03
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], esi
call fcn.00407eb4
push edx
push edx
lea edx, [esi + ebx]
test eax, eax
jne 0x408b64
mov dword [esp + 4], str._Rename__r_n
add ebx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
push eax
push eax
jmp 0x408ba3
add eax, 0xa
mov dword [esp + 4], 0x40c74b
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.00407eb4
mov dword [ebp - 0x20], eax
push ecx
push ecx
mov ecx, ebx
test eax, eax
je 0x408ba3
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, esi
cmp edx, dword [ebp - 0x20]
jbe 0x408b9b
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x408b8d
mov eax, dword [ebp - 0x20]
sub eax, esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [esp + 4], 0x4315c0
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00407f1f
add ebx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.004080eb
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408c92
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4329c0
mov dword [esp + 4], eax
call fcn.004084f3
push ebx
push ebx
mov dword [esp], 0x4329c0
call fcn.00407e20
push edx
test eax, eax
jne 0x408cc3
xor eax, eax
jmp 0x408d3f
mov dword [esp], eax
mov ebx, eax
call fcn.004085bb
push ecx
test byte [0x41692c], 0x80
je 0x408ce5
mov ax, word [ebx]
test ax, ax
je 0x408cbf
cmp ax, 0x5c
je 0x408cbf
sub ebx, 0x4329c0
sar ebx, 1
mov dword [esp], 0x4329c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x4329c0
cmp ebx, eax
jge 0x408d24
call fcn.00408c5a
push edx
test eax, eax
je 0x408d15
test byte [eax], 0x10
je 0x408cbf
mov dword [esp], 0x4329c0
call fcn.00407dae
push eax
jmp 0x408ced
call fcn.00408527
push eax
mov dword [esp], 0x4329c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x408fc6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x409004
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x40900b
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c720
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x4091ac
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x433a24], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x4091e9
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x4091d4
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4091c6
mov dword [ecx*4 + 0x433a20], eax
inc ecx
cmp ecx, 0x100
jne 0x4091bf
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x40920b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x433a20]
jmp 0x4091f3
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x40aa53
Capabilities:
Encode data using xor

Disassembly:
mov word [esi + 0x41335620], cs
popfd
sbb ah, 0x14
sbb al, 0xbe
pop esp
dec eax
dec esp
xor dword [0xfd1505a4], esi
adc al, 0x1c
mov esi, 0x314c485c
xor eax, 0xfd1505a4
sbb al, byte [eax - 0x78]
loopne 0x40aa5c
mov esi, 0xc85e5a46
push 0xffffffffffffffa8
inc esi
or byte [edx + 0x52], dl
das
or al, 0x36
mov ecx, 0x1cbb0161
invalid

Function at 0x414e9f
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
not dword [eax]
xor al, 0x39
push cs
cmp byte [eax + 0x17], dh
sal dword [esi - 0x104d0758], 0x9f
pop esi
cmp dword [edi], 0xffffffc1
enter 0xfffffffffffffe26, 0xffffffffffffff92
xor cl, byte [eax - 0x275637c0]
pop esp
inc eax
enter 0xffffffffffffd8a9, 0x5c
mov ch, 0x38
dec esi
jp 0x414f0c
cmp dh, byte [esi + 0x64]
and byte [edi + 1], ch
mov dword [0x955a61e1], eax
xchg esi, eax
jp 0x414f25
shrd dword [edx - 0x600b5187], esp, cl
stosd dword es:[edi], eax
daa
mov edx, 0xf390a497
mov cl, 0x9e
pop edx
jg 0x414e73
scasd eax, dword es:[edi]
push esp
xchg ebp, eax
popal
salc
push ds
jmp 0x414ede
xor al, 0xca
dec esi
push esp
dec edi
and bl, byte [ebp + 0x54]
popfd
pop esp
sub ch, byte [ecx - 0x41]
pop ebp
aad 0xbc
enter 0xffffffffffff9543, 0xffffffffffffffca
sub esi, ebp
pop ds
xor byte [0x2da6fe6c], ch
pop edi
pop ebx
lea ecx, [edx + eax]
inc esp
pop es
jl 0x414e8d
rcl dword [ecx]
mov eax, dword [0x584e9c8b]
pop eax
fst qword [esi - 0x3d725030]
xor al, 0xd7
push edx
popfd
mov dl, 0xb9
push edi
inc ebx
test dword [edx], ebp
rcl byte [eax - 0x67]
jecxz 0x414f10
scasd eax, dword es:[edi]
invalid
dec edx
shr byte [eax + 0x6f], 1
outsd dx, dword [esi]
jge 0x414efd
mul byte [eax + 0x37]
int 0x4f
push es
test eax, 0xcafc5116
mov dword ds:[0x8d554a46], eax
mov word [ecx], fs
pop eax
inc edi
outsd dx, dword [esi]
push 0x2230c6af
cmpsb byte [esi], byte es:[edi]
cmp byte [esi + edx], dl
insb byte es:[edi], dx
mov ch, 0x5c
invalid
Function at 0x418010
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x94
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
push 0x4c7d38
and edx, 8
xor esi, esi
imul edx, ecx
or eax, edx
mov dword [0x4c303c], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [esp + 4]
push edx
push 0x20019
push esi
push str.CLSIDEC529B00_1A1F_11D1_BAD9_00609744111AInprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x418090
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov al, byte [0x4c3049]
mov cl, byte [0x4c3048]
xor cl, al
mov eax, dword [esp + 0x14]
mov byte [0x4c3048], cl
mov cl, byte [0x4c3043]
or cl, 8
lea edx, [esp + 0xc]
shr cl, 3
and ecx, 0xff
push edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 8]
fild dword [esp + 0xc]
push eax
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c69d0]
push ecx
mov dword [esp + 0x24], 0x104
fadd qword [0x4c3050]
fstp qword [0x4c69c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4180fe
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4
Function at 0x421cae
Capabilities:
Encode data using xor

Disassembly:
cmp edx, dword [ebp + 0x5092be44]
mov byte [0x3ed20fd3], al
enter 0xffffffffffff97b1, 0xfffffffffffffffb
sbb dword [edx + 0x5a], edx
neg ebx
dec edx
and ch, byte [esi + 0x57]
shr dword [esi + 0x20], 0x8d
dec ecx
pop ds
xor dword [edi + 0x770890c6], ebp
pop ds
loopne 0x421ccd
push ss
scasd eax, dword es:[edi]
pop edi
xor eax, dword [edi - 0x2e67c281]
sbb dword [edi], ecx
push ecx
or byte [0xe34f9a53], ah
sub al, byte [ebx + 0x5a3fc64d]
mov dword [ebx - 0x1661aa53], esi
sbb al, dl
push ecx
test al, 0xa8
pop esi
lea ebp, [eax + 0x27]
push edx
adc esp, dword [edx + 0x41d0aca5]
aas
pop edi
dec ebp
stc
mov ebx, 0xce5fc2dd
rcl cl, cl
cmp esp, dword [eax]
mov ebx, dword [edx + 0x58]
cmp al, 0xf4
pop edi
jne 0x421d79
invalid
add bl, byte [ebp + ebp - 0x40]
pushal
rcpps xmm3, xmmword [edx + 0x2896def1]
arpl word [eax], di
inc esi
inc ebx
mov bl, 0x7e
arpl word [edi], dx
inc eax
call dword [ebp - 0x25]
rol byte [ebp + 0x294503d7], cl
push cs
enter 0xffffffffffffbf21, 0xffffffffffffffcb
xchg esi, eax
push 0x893662af
std
push 0x4b
mov bl, 0x49
dec edx
push ds
xor bl, byte [edi + 0x56]
das
shl dword [ebx - 0x307db2fc], 0xe3
neg dword [edx + 0x3b7fa628]
sbb eax, edx
sahf
dec edi
mov edi, 0x3da7da65
push edx
jl 0x421e02
mov edx, 0xa27bb7b7
invalid
mov edx, 0xe1f057b9
lahf
lea ebx, [eax - 0x687640a4]
lcall 0x1787, 0xad1a551f
ret
cmp byte [edx + 0x12], al
push ds
sbb edi, dword [ebx + 0x2ff7528]
je 0x421e49
fnstenv [edx + 0x37]
mov word [ebx + 0x1d73f756], gs
xchg byte [edx], dh
scasd eax, dword es:[edi]
syscall
adc bh, dh
std
inc esi
int3
xor eax, 0xcd6e2692
push cs
and byte [edx + edx*8], dl
sbb eax, 0x43133f65
dec eax
jg 0x421de0
pop es
imul esi, dword [esi + 0x1f5e132a], 0x75d8ddce
mov dh, 0x2a
adc ebx, dword [esi + 0x1f]
into
fstp st(0)
jne 0x421ead
lea ecx, [esi + 7]
cmp eax, 0x222f6198
outsd dx, dword [esi]
or ah, byte [0xce625431]
xor eax, 0x1758a735
inc esp
ret 0x6a17

Function at 0x42a119
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x9874365f
inc ecx
fdivr dword [ecx + 0x6615ebf4]
loopne 0x42a1a1
invalid
test byte [edi + 0x597353], 0x79
jecxz 0x42a193
imul ebp, dword [0x825cb795], 0x39535e4
invalid
Function at 0x453fc7
Capabilities:
Encode data using xor

Disassembly:
add dword [eax + ecx*2 + 0x56f272e0], edi
wait
pop ss
mov al, 5
in al, dx
lds edx, [ebx]
mov cl, 0x16
xor byte [edi + 0x7e93c75d], dh
in al, 0x68
pop edx
adc dl, byte [ebp + 0x411723b]
mov ecx, 0x7e105b1c
sbb al, 0x37
inc ebx
jmp 0xc6591664
cli
salc
adc eax, esi
add byte [edi - 0x188603a9], cl
bound edx, qword [ecx - 0x6046321a]
or edx, edx
xchg ecx, eax
sbb bl, al
jnp 0x453f3d
shl byte [edi + 0x4f], 0x83
sti
inc edi
or al, 0x71
ror byte [edi + 0xc426e97], cl
push edx
inc edx
or al, 0x52
jmp 0x453f66
sbb byte [ebp - 0xfc0978a], cl
add dword [edi - 0x37961782], edi
sbb ah, byte [ebp + 0x7c6d3184]
salc
mov eax, dword [0xc7bb11e8]
xor al, 0x4a
pcmpeqb mm5, qword [ebx - 0x6101d89a]
cdq
xchg byte [ebx - 0x3a], ah
jg 0x453fc1
je 0x453f89
daa
invalid
aas
les eax, [edi]
jbe 0x453fdc
or byte [ebp + 0x27d26e75], 0xf4
push 0x5447ddd8
push edi
sbb al, 0x56
sal bh, 1
mov byte [0x54f4432], al
pushal
ror esp, 0x73
out dx, al
mov bl, 0x6d
lahf
in eax, dx
mov byte [0x7f257445], al
aad 0xa4
retf

Function at 0x458e51
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push es
shl byte [ebp + 0x68cff477], 0xb0
pushal
scasb al, byte es:[edi]
inc eax
xlatb
salc
xchg esi, esp
add al, 0x70
inc edi
adc dword [edx + 0x68], ecx
pop ebp
sar cl, cl
xlatb
test al, 0x39
mov edi, 0xd15a7664
dec esi
push esp
dec ecx
lcall 0x1b63, 0x9105864c
or dl, byte [esi + esi]
inc esp
shr byte [esi], 0x2f
xchg al, cl
mov bl, 0x2d
cld
call 0x45118e4e
cmpsb byte [esi], byte es:[edi]
mov ah, 0xe4
insd dword es:[edi], dx
wait
xor ch, byte [ecx + 0x6b]
add ecx, dword [ecx]
and ebx, dword [edi - 8]
cmp ah, byte [edi + 0x29878684]
insb byte es:[edi], dx
scasb al, byte es:[edi]
aaa
sub dword [eax], edi
xchg edi, eax
adc dl, bl
adc dh, byte [ecx + 0x5231eb35]
fdivr st(4)
jl 0x458e73
push ds
test eax, 0x1d8ff4be
inc ebx
lodsd eax, dword [esi]
and byte [ebp - 0x4a], dl
pop ecx
das
mov eax, dword [0xbd5c6a2d]
pop edx
and bh, bl
salc
cmp dword [eax - 0x23], eax
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
adc esi, dword [0xa1763f66]
xor ch, byte [ebx - 0x6a]
ret

Function at 0x459e16
Capabilities:
Encode data using xor

Disassembly:
ret 0xaa20
mov al, byte [0xb6138d52]
add dword [esi + edx*2], edx
and edx, eax
leave
arpl word [esi + esi*4], cx
add eax, 0x952ecb30
xor bl, cl
xchg ebp, eax
insd dword es:[edi], dx
loop 0x459dce
cli
or byte [edx], bl
sahf
pop ebx
jp 0x459d70
xchg esp, eax
insd dword es:[edi], dx
les ebx, [edx + 0x694b712e]
xchg esi, eax
test dword [esi - 9], ecx
leave
js 0x459dbf
test dword [eax + edx*8 + 0x6d0bb466], ebp
clc
in al, dx
mov al, byte [0xed653fd9]
out 0xb2, eax
cmp ecx, dword [ebp + 0x2b220d]
pop ebx
ret 0x6a69
pop esp
cmc
push es
jne 0x459ddb
push 1
invalid
Function at 0x45a7c5
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x2e22f877
clc
and ch, byte [esi]
mov esi, 0x533555
invalid
fnstcw word [edx + 0x10]
jb 0x45a752
in al, 0x92
ja 0x45a82f
jbe 0x45a80a
jecxz 0x45a754
dec ebx
sbb al, 0x4e
test eax, 0x6e4eeb0f
dec esi
outsb dx, byte [esi]
dec esi
outsb dx, byte [esi]
mov dl, 0xf3
pop ecx
pop edx
lahf
outsb dx, byte [esi]
out dx, eax
popfd
adc byte [esi], ah
cmp edx, dword [edi]
cwde
or dh, ch
mov al, byte [0x5bda6eef]
and al, 0x29
mov ebx, 0x715dbec0
xor bh, byte [eax - 0x51906beb]
jns 0x45a7b1
sub al, 0x50
adc eax, 0x6b2e1c3b
or eax, 0x241ae09e
push ecx
das
mov al, byte [0x48a4c141]
ror byte [ebx - 0x192e0552], 1
mov ch, 0xcd
push 0xfffffffffffffff8
dec eax
retf 0x8b0b
mov esp, dword [ebx - 0x5c9392ae]
cwde
cmp al, 0xfd
std
push es
invalid
dec ebp
cmp bl, bh
jno 0x45a84d
call 0x5c7d1c75
push ss
mov bl, 0x3f
jbe 0x45a84b
dec ecx
stosb byte es:[edi], al
fldenv [edi]
mov bl, 0x70
xchg esp, eax
jo fcn.0045a7c5
pop ebx
push cs
sbb bl, byte [bp + si - 0x47]
push ebp
cli
inc edi
jp 0x45a872
adc byte [ebx], bl
push cs
xchg dh, al
sub dword [0xb20ec647], eax
jno 0x45a868
push cs
mov dl, 0xf3
jno 0x45a868
jne 0x45a81a
jge 0x45a846
jo 0x45a812
salc
aas
or eax, 0x8ce49254
sub dl, byte [edi]
dec edi
outsb dx, byte [esi]
pop edx
dec ebx
inc esi
cmp al, 0xfe
retf 0x83ce
add ebx, dword [ebp - 4]
scasb al, byte es:[edi]
and al, byte [0x56e9fd14]
cli
ja 0x45a8c4
inc ebx
sti
shl bl, cl
sub al, al
push edx
and dh, byte [ebp - 0x25921764]
pop ecx
or bl, byte [edi + 0x38]
xchg ecx, eax
fisttp word [ebx - 0x77]
mov dword [ebx], esi
cmp eax, 0x813171ec
sbb dword [esi], esp
adc eax, 0x23e37c9d
lodsb al, byte [esi]
int3
push esi
fucompi st(0)
sub dword [eax - 0x18], edx
cmp esp, dword [ebx]
fimul word [edi]
invalid
Function at 0x46cded
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
bnd ret 0xe74c
inc edi
retf 0x97a1
mov eax, dword [0x645ed86e]
mov dh, 0x77
je 0x46cd1c
aad 1
test byte [eax + 0x27], dl
enter 0x54e0, 0xffffffffffffffbe
mov ebx, dword [ebx]
pop esp
fdiv st(3), st(0)
fiadd word [eax + 0x65]
fild qword [eax - 0x26]
fisttp word [edi]
stosb byte es:[edi], al
jle 0x46cd8f
xchg ebp, eax
push esp
pop es
cmp edi, dword [ebp + 0x48]
movsd dword es:[edi], dword [esi]
jb 0x46cd4e
cvtpi2ps xmm2, qword [edx - 0x1c]
adc eax, 0x5aa89580
loop 0x46cd11
loop 0x46cdec
fdivr qword [edx]
mov ch, 0x7c
cmp dword [edx], ebp
and al, 0x12
inc esp
sub cl, byte [esp + 0x4b]
mov eax, 0xc2df4dde
push ecx
movsd dword es:[edi], dword [esi]
xchg dword [ecx - 0x2b], eax
adc al, 0xbf
in eax, dx
or byte [ebp + 0xa], bl
jb 0x46cda7
call dword [edi + 0x51]
push edi
push ecx
cmp ebx, dword [eax + 0x2327c5f0]
std
cmp bh, ah
add al, ah
xchg esp, eax
xor al, 0x13
sbb dword [esi - 0x4f], ecx
dec esi
mov cl, 0x9d
dec ecx
leave
jmp dword [ebx - 0x1a]
scasb al, byte es:[edi]
push 0x8cd406
xchg ebx, eax
xor byte [eax], bh
jns 0x46cd79
sbb ebp, 0xffffffe2
xchg edi, eax
test al, 0x96
push ebx
mov dword [ecx + 0x7d], esi
jo 0x46ce51
scasd eax, dword es:[edi]
cmp al, 0xde
ljmp 0xbf3b
mul bl
sal dword [edx], 1
sahf
movsb byte es:[edi], byte [esi]
jl 0x46ced2
sbb ah, dh
pop ss
test eax, 0x63d2dc27
lodsb al, byte [esi]
jno 0x46cee2
lcall 0x5b10, 0x430236fc
xor al, 0x71
adc cl, byte [0xcdb4f8f2]
sbb edx, dword gs:[ecx + 0x4b10484e]
rcl dword [eax - 0x1e], 0x1e
and dword [ecx - 0x56], ebx
inc eax
mov byte [0x697bd1ad], al
mov esp, 0x5dc9293e
ret
adc eax, 0xc78d8223
jle 0x46cf11
ret 0x68a7
mov ebp, 0x42a60473
mov eax, dword [0xc0672e13]
dec esi
xor eax, 0xf0a7ea36
xor eax, 0x6a8a8068
and dword [di], edi
cmp byte [eax + esi - 0x4c], ah
mov ch, 0xe7
stc
or ebp, dword [ebx + 0x4a]
cmpsb byte [esi], byte es:[edi]
pop ss
imul eax, eax, 0xe403558d
invalid

Function at 0x4745a5
Capabilities:
Encode data using xor

Disassembly:
jb 0x474612
sbb cl, dl
frstor dword [eax - 0x19]
fucomp st(6)
xor dl, byte [eax - 0x578ce75e]
clc
mov ch, 0x5c
adc edx, eax
pop eax
sub ecx, ecx
test eax, 0x4bf320f0
sbb ebp, ecx
dec ecx
sbb al, 0xd1
mov eax, 0xf5ff3a68
sbb al, 0xc0
sub eax, 0x47d2e5a8
cmpsb byte [esi], byte es:[edi]
dec ebp
jb 0x474594
mov ah, 0x67
dec eax
salc
sbb byte [edi + ecx], 0x3a
outsd dx, dword [esi]
xor dh, byte [edx - 0x60]
dec edi
mov ecx, 0xdf9bd065
push ecx
sbb edx, dword [ebx]
mov cl, 0x9f
adc al, 0x38
pop eax
shl dword [ecx], 0xfd
mov byte [0x52105843], al
pinsrw mm1, word [0x50386f73], 0x39
jp 0x4745de
and al, byte [eax + 0x387239e9]
jp 0x474612
int3
dec ebx
in eax, 0xd9
cdq
xchg edx, eax
dec esp
invalid
Function at 0x495dee
Capabilities:
Encode data using xor

Disassembly:
in eax, 0x35
loop 0x495e3f
idiv dword [esi]
cmpsd dword [esi], dword es:[edi]
invalid
xor al, 0xf9
mov dword [0x75ee132f], eax
not edi
dec eax
test ch, dl
cmp al, 0xbe
adc byte [esi], cl
xchg dh, dh
cmp dword [ebx + edx*8 - 0x2a3a188e], edx
mov ah, 0xa4
movsb byte es:[edi], byte [esi]
daa
inc esi
cmp byte [edi], 0xe1
xlatb
mov cl, 0x8e
test byte [edx - 0x116b8cec], dl
les eax, [edi]
sahf
pop edx
movsb byte es:[edi], byte [esi]
mul byte [ecx - 0x3c]
enter 0xffffffffffff940c, 0xffffffffffffffcc
mov edx, 0x5414c1d5
pop esi
aas
mov dh, 2
pop edi
sti
pop ecx
imul esp, dword [esi - 0x1bdbff26], 0xc11ec727
pop eax
jg 0x495e24
rol byte [esp + eax*2], 0x47
sbb byte [eax], al
xchg word [edx], sp
mov ebp, 0x4eed2228
push esp
xchg esp, eax
out 0xb6, eax
pushfd
invalid

Function at 0x499ba5
Capabilities:
Encode data using xor

Disassembly:
int 0xa8
cdq
adc byte [ecx], ch
scasd eax, dword es:[edi]
stc
pop esi
mov ah, 2
lds ecx, [edx - 0x14]
out dx, eax
out 0xd8, al
mov byte [ebp - 0x4f2eb56e], ah
push ebp
adc esp, dword [edx]
fistp qword [esi]
or eax, 0xc318a79c

Function at 0x4bc1ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4

Function at 0x4bc1b6
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d0
cmp edx, dword [eax]
je 0x4bc1cf
add eax, 8
inc ecx
cmp eax, 0x4c3460
jl 0x4bc1c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d0]
jne 0x4bc2fd
mov eax, dword [0x4c7d9c]
cmp eax, 1
je 0x4bc2d7
test eax, eax
jne 0x4bc200
cmp dword [0x4c32f8], 1
je 0x4bc2d7
cmp edx, 0xfc
je 0x4bc2fd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc237
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bcb90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd020
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc27a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd020
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1724
push edi
call fcn.004beef0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bcb90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bcba0
lea eax, [ebp - 0xa0]
push 0x4c1704
push eax
call fcn.004bcba0
push dword [esi + 0x4c33d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bcba0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bee64
add esp, 0x2c
pop edi
jmp 0x4bc2fd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33d4]
push 0
push eax
push dword [esi]
call fcn.004bd020
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4011cb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47401c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x474028
push 0x474024
push 0x474020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x474028]
push dword [0x474024]
push dword [0x474020]
mov dword [0x474014], esp
call fcn.004055a4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401381
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], 1
mov dword [0x407000], 0
mov dword [ebp - 8], pe_nt_image_headers32
jmp 0x4013f6
mov edi, dword [ebp - 0xc]
test edi, 1
je 0x4013b6
mov ebx, 0xedb88320
jmp 0x4013bb
mov ebx, 0
shr edi, 1
xor edi, ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], 0
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
add esi, edi
mov edi, dword [edi*4 + 0x407000]
xor edi, dword [ebp - 0xc]
mov dword [esi*4 + 0x407000], edi
mov edi, dword [ebp - 8]
shl edi, 1
add dword [ebp - 4], edi
cmp dword [ebp - 4], 0x100
jb 0x4013c9
shr dword [ebp - 8], 1
cmp dword [ebp - 8], 0
jne 0x4013a4
pop edi
pop esi
pop ebx
leave
ret