joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408010
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408175
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406270
cmp si, word [0x4487d0]
jb 0x4080a8
cmp si, word [0x4489d0]
ja 0x4080a8
mov edi, 0x40
xor eax, eax
mov dword [ebp - 8], eax
cmp edi, dword [ebp - 8]
jb 0x4080a8
mov ebx, dword [ebp - 8]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4487d0]
jae 0x408082
mov edi, ebx
dec edi
jmp 0x4080a3
cmp si, word [ebx*8 + 0x4487d0]
jbe 0x408092
inc ebx
mov dword [ebp - 8], ebx
jmp 0x4080a3
mov edx, dword [ebp - 4]
mov eax, dword [ebx*8 + 0x4487d4]
call fcn.00407f20
jmp 0x4080a8
cmp edi, dword [ebp - 8]
jae 0x40806c
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x408157
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408157
push 0x55
lea eax, [ebp - 0xb2]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x15c]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x160]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406bf8
push dword [ebp - 0x160]
push 0x408190
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x15c]
mov ecx, 0x55
call fcn.00406bf8
push dword [ebp - 0x164]
push 0x4081a0
lea eax, [ebp - 0x168]
lea edx, [ebp - 0xb2]
mov ecx, 0x55
call fcn.00406bf8
push dword [ebp - 0x168]
mov eax, dword [ebp - 4]
mov edx, 5
call fcn.00406e24
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40817c
lea eax, [ebp - 0x168]
mov edx, 3
call fcn.004062d0
ret
Function at 0x408328
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40842b
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44cb4d
call sub.kernel32.dll_EnterCriticalSection
cmp bx, word [0x44cb66]
jne 0x408374
mov eax, esi
mov edx, 0x44cb68
mov ecx, 0x55
call fcn.00406bf8
push 0x44cb4d
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x408415
push 0x44cb4d
call sub.kernel32.dll_LeaveCriticalSection
mov eax, esi
call fcn.00406270
push 2
movzx eax, bx
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x4083e3
cmp byte [0x44cb4c], 0
je 0x4083a8
mov edx, esi
mov eax, ebx
call fcn.0040820c
jmp 0x4083e3
mov edx, esi
mov eax, ebx
call fcn.00408010
call sub.kernel32.dll_GetSystemDefaultUILanguage
cmp bx, ax
je 0x4083e3
cmp dword [esi], 0
je 0x4083cc
mov eax, esi
mov edx, 0x408444
call fcn.00406d44
call sub.kernel32.dll_GetSystemDefaultUILanguage
lea edx, [ebp - 4]
call fcn.00408010
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00406d44
push 0x44cb4d
call sub.kernel32.dll_EnterCriticalSection
mov word [0x44cb66], bx
push 0xaa
mov eax, dword [esi]
call fcn.00406b6c
push eax
push 0x44cb68
call sub.kernel32.dll_lstrcpynW
push 0x44cb4d
call sub.kernel32.dll_LeaveCriticalSection
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408432
lea eax, [ebp - 4]
call fcn.00406270
ret
Function at 0x408660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406354
xor eax, eax
push ebp
push 0x408885
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x4086a0
push 0x105
lea eax, [ebp - 0x21a]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
jmp 0x4086ba
push 0x105
mov eax, dword [ebp - 4]
call fcn.00406b6c
push eax
lea eax, [ebp - 0x21a]
push eax
call sub.kernel32.dll_lstrcpynW
cmp word [ebp - 0x21a], 0
je 0x40886f
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408894
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408789
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408894
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408789
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4088d0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408789
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x4088d0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408789
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408904
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x408789
lea eax, [ebp - 0xc]
push eax
push 0xf0019
push 0
push 0x408938
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x40886f
xor eax, eax
push ebp
push 0x408868
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x21a]
mov edx, 0x105
call fcn.0040846c
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x4087f8
mov eax, dword [ebp - 0x10]
call fcn.004042d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
lea eax, [ebp - 0x21a]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406bbc
jmp 0x408843
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0x408978
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x408843
mov eax, dword [ebp - 0x10]
call fcn.004042d8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0x408978
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00406bbc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40886f
cmp dword [ebp - 8], 0
je 0x40885e
mov eax, dword [ebp - 8]
call fcn.004042f4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40888c
lea eax, [ebp - 4]
call fcn.00406270
ret
Function at 0x408bc4
Capabilities:
Get geographical location
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406354
xor eax, eax
push ebp
push 0x408c84
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea eax, [ebp - 0xc]
push eax
push 3
call sub.kernel32.dll_GetUserDefaultUILanguage
movzx eax, ax
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00406bf8
mov ecx, dword [ebp - 0x10]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406d9c
mov eax, dword [ebx]
call fcn.00408a8c
test al, al
jne 0x408c61
mov word [ebp - 8], 0
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xc]
mov ecx, 4
call fcn.00406bf8
mov ecx, dword [ebp - 0x14]
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00406d9c
mov eax, dword [ebx]
call fcn.00408a8c
test al, al
jne 0x408c61
mov eax, ebx
call fcn.00406270
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x408c8b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004062d0
lea eax, [ebp - 4]
call fcn.00406270
ret

Function at 0x409540
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [esp + 0x14]
add esp, 0x24
ret

Function at 0x418318
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x418371
test eax, edx
je 0x418374
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41832f
movzx eax, word [eax]
sub eax, ecx
jmp 0x418356
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x418357
add ecx, 4
js 0x418347
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x418354
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x418356
xor eax, eax
ret
test eax, eax
je 0x418380
test edx, edx
jne 0x418320
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41c1a0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x200]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41c1d9
mov ecx, eax
dec ecx
lea edx, [ebp - 0x200]
mov eax, ebx
call fcn.004063c8
jmp 0x41c1e2
mov eax, ebx
mov edx, esi
call fcn.00406620
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x41c1ec
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov esi, edx
mov ebx, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push ebx
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x41c20e
movzx eax, word [esp]
jmp 0x41c210
mov eax, edi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41cecc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x41cff1
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0041ccdc
mov esi, eax
mov eax, dword [0x449190]
cmp byte [eax], 0
je 0x41cf99
mov eax, dword [0x44904c]
call fcn.004045f4
call fcn.00404434
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x41cea4]
call fcn.00407a9c
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x41d00c
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x41cfd5
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x449018]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x44cc30]
call fcn.00407b54
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41cff8
lea eax, [ebp - 4]
mov edx, dword [0x41cea4]
call fcn.00407aa8
ret

Function at 0x41e810
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00406710
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409520
mov edi, eax
cmp edi, 0x104
jbe 0x41e7bb
mov eax, edi
add eax, eax
call fcn.004042d8
mov esi, eax
jmp 0x41e7bd
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00409520
push esi
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41e7f6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41e7e0
mov eax, esp
cmp esi, eax
je 0x41e803
mov eax, esi
call fcn.004042f4
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41e83c
cmp bl, 0
je 0x41e838
cmp bl, 0x41
jl 0x41e833
cmp bl, 0x5a
jg 0x41e833
or bl, 0x20
xor al, bl
inc esi
jmp 0x41e817
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41e77c

Function at 0x41efbc
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.00406bf8
add esp, 0x800
pop ebx
ret
Function at 0x40dd9a
Capabilities:
Authenticate hmac

Disassembly:
test byte [ecx - 0x46], cl
jp 0x40de1b
sbb dl, byte [edx]
sar bl, 1
lahf
xor eax, 0x385b998c
fldenv [esi + 0x7aacf86a]
fsubr st(6), st(0)
js 0x40de05
lahf
clc
jb 0x40de1f
fsub st(4), st(0)
sbb al, 0x38
cmc
jge 0x40ddb4
lds edi, [edx - 0x6bf96248]
push cs
dec esp
sub al, 0x36
add ah, ah
scasb al, byte es:[edi]
pop esp
mov ah, 0x5c
pushal
push es
mov esi, 0x1e5d549f
rcl byte [edx + edx*2 + 0x61bd207d], cl
sal byte [0x4cb85c15], 1
pop edx
pushfd
jle 0x40dddc
jne 0x40ddc4
pop ecx
dec eax
nop
insd dword es:[edi], dx
invalid
dec ecx
push esp
popfd
pop ss
mov edx, 0x7e29715c
stosd dword es:[edi], eax
sub dword [esi - 0x55], edi
jle 0x40ddb3
imul ecx, dword [ebx], 0x8463ff51
daa
or eax, 0x36839857
or eax, 0xd2e0781f
pop ds
and eax, 0xb55c541c
sbb al, 0x54
pop esp
mov ch, 0x50
push eax
js 0x40ddfe
xor dword es:[ecx], ebx
push ebp
jns 0x40de5c
imul esp, esi, 0xffffffe3
sbb al, 0x8f
xchg edx, eax
mov ah, dl
ljmp 0xf9af
je 0x40ded5
inc esp
mov byte [eax], bl
fxam
bnd jnp 0x40de9a
inc esp
jbe 0x40de5a
mov ebp, 0x24b418e4
js 0x40de06
test eax, 0x9fddb67c
retf
clc
aad 0x86
sub ah, ah
cmp ch, ah
sbb ebx, dword gs:[esp + ecx]
cwde
sub eax, 0x81cbf36
popfd
mov esp, 0x8adb83c0
into
loope 0x40de9d
daa
ljmp 0x2c41
pop es
xor al, 0x6e
inc ebx
dec eax
xor dl, byte [ebx]
in al, 0x37
and al, byte ss:[ebp + esi*8 + 0xff6b4f1]
mov eax, dword [0x5b2b98d6]
leave
movsb byte es:[edi], byte [esi]
dec esi
mov al, byte [0xe94f4d5c]
invalid

Function at 0x418010
Capabilities:
Get disk information

Disassembly:
push ecx
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
push 0x4c4064
mov dword [0x4c7aec], eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [0x4c7aec]
add ecx, eax
test esi, esi
mov dword [0x4c7aec], ecx
je 0x418056
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 4]
pop esi
pop ecx
ret

Function at 0x418060
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov dword [esi], 0
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x4c7aec], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
add dword [0x4c7aec], eax
call fcn.00418010
mov ecx, dword [0x4c7aec]
push str.shell32.lib
add ecx, eax
mov dword [0x4c7aec], ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x10
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x4180b6
or dword [esi], 0x2000000
push str.SetCurrentProcessExplicitAppUserModelID
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, esi
pop edi
pop esi
ret
Function at 0x421d6a
Capabilities:
Encode data using xor

Disassembly:
invalid
and esi, dword [ebp - 0x1d375922]
aas
dec ebx
aaa
push esp
std
cmpsd dword [esi], dword es:[edi]
lds edx, [edx - 0x779a503]
sub eax, 0x57c84abe
pop ebp
jmp 0x421d9c
loop 0x421d3f
lodsd eax, dword [esi]
in al, dx
invalid
Function at 0x43af2a
Capabilities:
Encode data using xor

Disassembly:
lea edi, [edx - 0x54]
out 0x66, al
je 0x43af87
lea esi, [eax + 0x6e10fbb9]
xor al, bh
mov al, 0x23
jecxz 0x43af35
adc byte [esi + 0x32], ch
invalid
fsub qword [ebp - 0x55374bb3]
mov eax, dword [0x73b127dd]
pop eax
movsd dword es:[edi], dword [esi]
push edx
cmc
iretd
mov eax, dword [ecx + 0x62]
or al, 0x27
push esp
aaa
inc ebp
jge 0x43afb8
cmpsb byte [esi], byte es:[edi]
outsd dx, dword ds:[esi]
pushal
mov al, byte [0x49a3445d]
and dword [eax + 0x10], eax
inc esp
mov dword [0x10402149], eax
daa
loope 0x43af7c
sub ebp, dword [esp + ecx*4]
neg dword [edx]
sal byte [edi + 0x23a60dd1], cl
xor ebp, dword [eax + 0x5b66f8d9]
pop ecx
das
push ebx
mov esi, 0x51fb75d1
lahf
pop eax
mov cl, 0xc1
sub esi, dword [eax - 0x56]
mov dword [0x424f258], eax
and al, 4
loopne 0x43af8c
fnstenv [ecx + 0x514f1cc7]
outsb dx, byte [esi]
sub ch, byte [esi - 0x3bc6de1f]
stosd dword es:[edi], eax
xchg edx, eax
xchg edi, eax
cmp dword [edx - 0x76], 0x1a
cdq
enter 0xfffffffffffff1aa, 0xffffffffffffffdd
push esi
rcl al, 1
inc edi
pop esi
aaa
mov bl, 0x5b
bound edi, qword [ecx]
mov dl, 0x63
salc
loopne 0x43afe9
scasb al, byte es:[edi]
fdivr dword [ebp + 0x70]
sbb bh, al
jo 0x43b005
clc
lds edx, [ebp - 1]
xor dl, byte [eax - 0x30]
pop eax
xchg esi, eax
or eax, 0xc3247a8d
xchg ecx, eax
pop ecx
dec ebp
pop esi
mov dword [edx - 0x2f], eax
mov dword [0x5f2dbf90], eax
ret 0x2fd
Function at 0x4800fa
Capabilities:
Encode data using xor

Disassembly:
push ebx
push 0x6487
push 0x2e
pushfd
or eax, 0x4e3a8d4c
in al, dx
test al, 0x26
add byte [esi], 0xd
dec edx
dec esi
sub cl, byte [esi + 0x45]
loop 0x4800ac
into
mov bh, 0xa1
jbe 0x480068
xchg esi, eax
xchg dword [eax], edi
lodsd eax, dword [esi]
inc ecx
test byte [ecx + ecx - 0x611ff08e], ch
mov ch, 0xd
cmp byte [edi], bh
aad 0xda
daa
shl byte [esi], 7
xchg byte [eax - 0x7bdcf28b], dl
mov ah, 0xc8
inc esi
inc esp
jbe 0x48007b
mov esp, dword [ebx + 0x1dea870c]
xchg edi, eax
repne cmpsb byte [esi], byte es:[edi]
mov bl, 2
xchg edx, ebp
sbb eax, 0x3ea6f297
mov bl, 2
and ch, byte [eax]
mov dword [edx], ecx
sub byte [ebx], ah
jae 0x4800ba
and esi, dword [ebx - 3]
mov eax, 0xd56892f2
jmp 0x5ce4d174
add dword [ebx - 0x3a], esp
imul esp, dword [eax], 0xffffff8c
test bl, dl
lodsb al, byte [esi]
sti
cmp al, 0xcb
loop 0x4800a5
invalid
sbb eax, dword [edi]
pop es
outsb dx, byte [esi]
xor al, 0x96
pushfd
mov bl, 0xdb
xchg esp, ecx
outsb dx, byte [esi]
jge 0x4800fb
pop eax
jle 0x4800d5
aam 3
pop edx
mov byte [0x3cab5e44], al
adc al, 0xb5
add al, 0xe8
or edi, dword [edx + ebp]
hlt
Function at 0x4975ca
Capabilities:
Encode data using xor

Disassembly:
pushal
sbb al, 0x8b
invalid
dec ebp
push ebp
or ebp, esp
fdiv st(3), st(0)
xor dl, cl
jo 0x497596
dec ecx
push ds
cmp esp, dword [ecx - 0x6f10ad92]
nop
push es
adc ecx, esp
and al, byte [ebp + 0x10]
or byte [ebp + 0x1af942ed], cl
lodsb al, byte [esi]
xor al, 0x89
les edi, [eax + 0x429a7194]
test byte [ebp - 0x3c], bh
call 0x980d088
inc ebx
sal byte [ecx + ecx*2], 1
inc esi
pop esp
jbe 0x49762c
inc edi
adc byte [eax + 8], al
push esp
aas
imul edi, ecx, 0xffffffae
xor esp, dword [ecx + esi*8 + 0x73e5f486]
adc al, 0x42
invalid
lea edx, [eax - 0x68ff6b8e]
lea esp, [eax]
xchg dword [0x2f5c685], edi
inc ebp
enter 0x37a4, 0xffffffffffffffcd
clc
or cl, 0x71
push es
daa
dec ebp
add esp, esp
mov dl, 0xaa
mov eax, dword [0x9e618bed]
imul edi, dword [edx - 0x6e078d77], 0xfffffff2
fsubr st(4), st(0)
lodsb al, byte [esi]
invalid

Function at 0x4a29fa
Capabilities:
Encode data using xor

Disassembly:
dec eax
iretd
pop ebp
xor eax, 0x64925801
cmc
add eax, 0xb4f59697
cmpsb byte ds:[esi], byte es:[edi]
imul esp, ebx, 0xffffff89
loope 0x4a2a62
jmp 0x4a299d
push es
xchg ebp, eax
mov bl, byte [ebp - 3]
test eax, 0x55c8420b
imul ebx, dword [edx], 2
jb 0x4a2ac9
movsb byte es:[edi], byte [esi]
rcl byte [esi], cl
cwde
xchg esp, eax
push es
imul ebx, dword [edi + 0x771b303f], 0xffffffe7
mov dl, byte [ebx + 0x790d3138]
fsubr qword [esp + edx*2 + 0x6aa6942e]
xor al, ah
pop eax
xchg dword [ecx + 0x6d079fc5], ecx
scasd eax, dword es:[edi]
and eax, 0x3bb4a50e
jp 0x4a2a77
sbb ecx, dword [0x1270dac6]
or dword [0x7168c240], eax
add dh, byte [edx + eax + 0x5e5706e0]
aas
test al, 0x77
mov byte [0x5b2924f5], al
dec esp
mov cl, 0x3e
aaa
pushfd
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
push ss
call 0xf7bcae99
inc esi
pushal
or cl, byte [ebx - 0x4f]
pop es
mov cl, 7
invalid
Function at 0x4bc709
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c43a0
cmp edx, dword [eax]
je 0x4bc72b
add eax, 8
inc ecx
cmp eax, 0x4c4430
jl 0x4bc71c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c43a0]
jne 0x4bc859
mov eax, dword [0x4c8d40]
cmp eax, 1
je 0x4bc833
test eax, eax
jne 0x4bc75c
cmp dword [0x4c42cc], 1
je 0x4bc833
cmp edx, 0xfc
je 0x4bc859
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc793
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd0f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd580
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc7d6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd580
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c19e4
push edi
call fcn.004bf450
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd0f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd100
lea eax, [ebp - 0xa0]
push 0x4c19c4
push eax
call fcn.004bd100
push dword [esi + 0x4c43a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf3c4
add esp, 0x2c
pop edi
jmp 0x4bc859
lea eax, [ebp + 8]
lea esi, [esi + 0x4c43a4]
push 0
push eax
push dword [esi]
call fcn.004bd580
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
push ebx
pop eax
and eax, 0x1f
push ebx
pop edx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
sub eax, eax
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
push eax
pop edi
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
mov esi, eax
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
or eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
jmp fcn.00401219