joyce8/EMBER2024-capa huggingface dataset:
Function at 0x737d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x737d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x737d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x737d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x737d94
push eax
push esi
call fcn.0073a20b
add esp, 8
pop esi
ret 0x10

Function at 0x737da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x737e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x737e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x750320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00739dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x737dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x737e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x737ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x737eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x750320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00739dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x737eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x737e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x738000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x738131
push esi
call fcn.0073b145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0072a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x738131
push 0
push ebp
call fcn.0072a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0072a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x73808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0072a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x738121
push 0x750918
push edi
call fcn.007393f0
push eax
push ebx
push esi
call fcn.00737f60
push 0x7508f8
push edi
call fcn.007393f0
push eax
push ebx
push esi
call fcn.00737f60
push 0x7508d8
push edi
call fcn.007393f0
push eax
push ebx
push esi
call fcn.00737f60
push 0x7508c0
push edi
call fcn.007393f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00737f60
push 0x7508a0
push edi
call fcn.007393f0
push eax
push ebx
push esi
call fcn.00737f60
push 0x750888
push edi
call fcn.007393f0
push eax
push ebx
push esi
call fcn.00737f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x7391b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00739140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00739140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00739140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00739140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x739bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x739c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x74b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x739c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x739c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4091e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4091f2
pop dword [ebp - 0x38]
mov eax, 0x4091f2
sub dword [ebp - 0x38], eax
push 0x40
push 0x1000
push 0x361f2
push 0
mov eax, 0x13dcf40
add eax, 0xff032150
add eax, dword [ebp - 0x38]
call dword [eax]
mov ecx, 0x4e0faca
add ecx, 0xfb1f441a
mov esi, eax
mov edi, 0x1ec3bb1
sub edi, 0x1aa91b1
add edi, dword [ebp - 0x38]
mov edx, 0x789b65ab
sub edx, 0xb11a6f07
sub dword [ebp - 0x34], 0xde27d245
mov ebx, dword [edi]
mov dword [ebp - 0x10], 0x1dfd72fe
sub ebx, edx
xor dword [ebp - 8], ebx
mov dword [esi], ebx
sub dword [ebp - 0xc], 0xcd98bc31
add esi, 4
add edi, 0xebf76aa9
sub edi, 0xebf76aa5
loop 0x40924c
add eax, 0x1ff5926c
sub eax, 0x1ff4a409
mov ebx, eax
add eax, 0xf08e9461
add eax, 0xf716ba4
mov ecx, 0x8bf5d5d
sub ecx, 0x87f5d5d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x403160
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
cmp dword [0xc28080], 0x594
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
push edi
mov dword [ebp - 0xc], eax
jne 0x403199
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov ecx, dword [0x808ef8]
mov ebx, dword [0x808efc]
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0x9e3779b9
mov dword [ebp - 0x28], ecx
call fcn.00403150
mov edx, dword [0x808f00]
mov eax, dword [0x808f04]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], eax
mov edi, 0x20
jmp 0x4031e0
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov ecx, dword [0xc28080]
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x403248
push 0
lea ecx, [ebp - 0x42c]
push ecx
push 0x4025c0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor eax, eax
xor edx, edx
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov ecx, dword [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
mov eax, dword [ebp - 4]
mov ecx, dword [0xc28080]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp ecx, 0xfa9
jne 0x403262
mov dword [0xc2761c], 0xedeb2e40
jmp 0x403274
cmp ecx, 0x3eb
jne 0x403274
mov dword [0xc26fd0], 0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add edx, esi
mov dword [ebp - 0x14], edx
mov edx, esi
shr edx, cl
mov dword [0xc27618], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
xor edx, dword [ebp - 4]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], 0x64
sub dword [ebp - 0xc], eax
sub dword [ebp - 0xc], 0x64
cmp dword [0xc28080], 0xc
jne 0x4032d2
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
push 0
push 0
push 0
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
mov edx, dword [ebp - 0xc]
shl edx, 4
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov ecx, dword [ebp - 4]
add eax, ebx
xor eax, edx
xor ecx, eax
mov dword [ebp - 4], ecx
sub esi, ecx
mov eax, dword [ebp - 0x20]
sub dword [ebp - 8], eax
sub edi, 1
jne 0x4031e0
cmp dword [0xc28080], 0xa6d
mov edi, dword [ebp + 8]
mov dword [edi], esi
jne 0x403339
push 0
push 0x4025f4
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
mov edx, dword [ebp - 0xc]
mov dword [edi + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp - 0xc]
mov dword [edi + 4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x403350
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0xc28080]
mov ecx, dword [0xc26fd4]
shr eax, 3
sub esp, 0x408
test eax, eax
jbe 0x40342a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EnumDateFormatsExA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
lea ebx, [ebx]
cmp dword [0xc28080], 0x959
jne 0x403410
push 0
call esi
push 0
push 0
call edi
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 0x402628
push 0
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push 0
lea eax, [ebp - 0x408]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringA]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
call dword [sym.imp.KERNEL32.dll_HeapLock]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00403160
add dword [ebp - 4], 8
sub dword [ebp - 8], 1
jne 0x403390
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4045b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x8080c8]
jne 0x4045ba
repz ret
jmp fcn.00406d1e

Function at 0x40693f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404631
and dword [ebp - 4], 0
cmp dword [0x809a10], 0
mov ebx, eax
jne 0x4069f0
push 0x4019f8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406aa1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4019ec
push edi
call esi
test eax, eax
je 0x406aa1
push eax
call fcn.004045bf
mov dword [esp], 0x4019dc
push edi
mov dword [0x809a10], eax
call esi
push eax
call fcn.004045bf
mov dword [esp], 0x4019c8
push edi
mov dword [0x809a14], eax
call esi
push eax
call fcn.004045bf
mov dword [esp], 0x4019ac
push edi
mov dword [0x809a18], eax
call esi
push eax
call fcn.004045bf
pop ecx
mov dword [0x809a20], eax
test eax, eax
je 0x4069f0
push 0x401994
push edi
call esi
push eax
call fcn.004045bf
pop ecx
mov dword [0x809a1c], eax
mov eax, dword [0x809a1c]
cmp eax, ebx
je 0x406a48
cmp dword [0x809a20], ebx
je 0x406a48
push eax
call fcn.0040463a
push dword [0x809a20]
mov esi, eax
call fcn.0040463a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406a48
test edi, edi
je 0x406a48
call esi
test eax, eax
je 0x406a3f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406a3f
test byte [ebp - 0xc], 1
jne 0x406a48
or dword [ebp + 0x10], 0x200000
jmp 0x406a81
mov eax, dword [0x809a14]
cmp eax, ebx
je 0x406a81
push eax
call fcn.0040463a
pop ecx
test eax, eax
je 0x406a81
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406a81
mov eax, dword [0x809a18]
cmp eax, ebx
je 0x406a81
push eax
call fcn.0040463a
pop ecx
test eax, eax
je 0x406a81
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x809a10]
call fcn.0040463a
pop ecx
test eax, eax
je 0x406aa1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406aa3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x467c1f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x46f108
cmp edx, dword [eax]
je 0x467c41
add eax, 8
inc ecx
cmp eax, 0x46f198
jl 0x467c32
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x46f108]
jne 0x467d6f
mov eax, dword [0x1081488]
cmp eax, 1
je 0x467d49
test eax, eax
jne 0x467c72
cmp dword [0x46f06c], 1
je 0x467d49
cmp edx, 0xfc
je 0x467d6f
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x467ca9
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004681d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00468340
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x467cec
lea eax, [ebp - 0x1a4]
push eax
call fcn.00468340
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46c8c8
push edi
call fcn.00468fd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004681d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004681e0
lea eax, [ebp - 0xa0]
push 0x46c8a8
push eax
call fcn.004681e0
push dword [esi + 0x46f10c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004681e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00468f3e
add esp, 0x2c
pop edi
jmp 0x467d6f
lea eax, [ebp + 8]
lea esi, [esi + 0x46f10c]
push 0
push eax
push dword [esi]
call fcn.00468340
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x44804e
Capabilities:
Check for software breakpoints

Disassembly:
sub dh, al
jecxz 0x4480b1
xor al, byte [eax]
xchg esp, eax
retf
xlatb
pop ebx
cmc
jb 0x4480d2
sbb al, 0x69
invalid
imul ecx, dword [edi - 0x64b36ccc], 0xc09cdc81
mov ch, 0x25
jecxz 0x448136
mov ecx, dword [0x900f6b3d]
lcall 0xd6ba, 0xef872db9
mov ebp, 0xb3f84953
xor eax, 0x1da8dd8e
push ebx
dec ecx
clc
mov bl, 0x35
mov ds, ebp
test al, 0x1d
cdq
int3
imul esi, dword [ebx], 0x4bf3b12c
invalid
xchg ecx, eax
or eax, 0x87fdec76
dec eax
jnp 0x4480b5
xchg dword [eax + 0x7b], ecx
mov cl, 2
pop ebp
insb byte es:[edi], dx
add bl, byte [ebp + 0x6c]
sub byte [ecx + 0x18], dl
sbb edi, eax
out 0x84, eax
cmc
xlatb
inc ecx
loope 0x4480fb
shr dword [eax + 0x526173f6], cl
jge 0x4480de
sub edi, ebp
cmp al, 0xcc
sub al, 0x76
lodsd eax, dword [esi]
pop ds
jg 0x448188
jl 0x448130
xor byte [ebx - 0x17076bf9], dh
sbb al, 0xa0
mov cl, 0x4f
dec edi
call 0xe121e4c6
pushfd
out 0x16, eax
xor al, 0x14
mov ebx, dword [ecx]
loop 0x448100
lcall 0xc7d, 0x6ef8e38d
cmp dword [eax + 0x7b440f25], edx
add byte [ebx], al
push edi
or eax, 0x6647de2a
aaa
aaa
ret
sbb dh, bl
or esi, dword [esi + eax - 0x70]
inc eax
adc dword [eax], ecx
xor byte [eax - 0x1c03e1c], 0x25
jo 0x448153
cwde
inc edi
mov gs, edx
invalid
Function at 0x45fc07
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
dec edx
jns 0x45fc59
push esi
shl ecx, 0xf7
out 0x97, al
outsb dx, byte [esi]
inc esi
dec ecx
invalid
add cl, byte [eax]
js 0x45fc66
stosb byte es:[edi], al
dec eax
loope 0x45fc02
mov ch, 0xee
cmp dword [ebp + 0x7ae19ab3], esp
sub al, 0x92
repne stosd dword es:[edi], eax
lodsd eax, dword [esi]
add byte [ecx], ah
inc edi
inc ecx
sbb bh, byte [esi + 0x32b8e8bf]
ljmp 0x5f6c
mov bl, 0x9b
pop edi
pop ds
fst dword [eax + 0x7813182]
nop
xor byte [ecx], 0x81
pop es
aaa
sahf
popal
loopne 0x45fc5e
js 0x45fbea
push esp
stosb byte es:[edi], al
popfd
scasd eax, dword es:[edi]
and eax, 0x80e5e742
add bl, byte [ebp + 0x6cbbc224]
pop esi
imul ecx, dword [ebx], 0xffffff83
test dword [esp + esi - 0x1170f30a], edx
inc edi
mov ecx, 0x137fd9eb
cmp dl, al
add dword [esi], 0x5fdf60ee
test ah, bh
inc ebp
in al, dx
salc
std
lds esi, [edi + edi*8 + 0x59]
imul ebx, dword [ebp - 0x32c10d1f], 0x64
sahf
arpl si, bp
outsb dx, byte [esi]
xor byte [esp + edi - 0x68e899db], bh
add cl, ch
sahf
pop edx
mov al, 0xe4
xor ebp, dword [ecx]
movsd dword es:[edi], dword [esi]
cwde
imul esp, esi, 0xffffffbc
dec edi
pop eax
fistp word [0x1f8b68de]
jae 0x45fd0b
xor al, byte [esi]
inc ebx
jl 0x45fcbd
test dword [ebp - 0x608b8447], ebx
mov ecx, 0xbba1a05
pop edx
test al, 0x3a
dec ecx
lcall 0x3947, 0x7c107719
add byte [edi + 0x76], dl
invalid
add byte [ebp - 0x26], ah
pop esp
add eax, 0xcb6395ed
adc ebx, 0xffffffca
stosb byte es:[edi], al
daa
or bh, al
invalid
Function at 0x4c4b1a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4ca498
cmp edx, dword [eax]
je 0x4c4b3c
add eax, 8
inc ecx
cmp eax, 0x4ca528
jl 0x4c4b2d
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4ca498]
jne 0x4c4c6a
mov eax, dword [0x4ceb8c]
cmp eax, 1
je 0x4c4c44
test eax, eax
jne 0x4c4b6d
cmp dword [0x4ca3dc], 1
je 0x4c4c44
cmp edx, 0xfc
je 0x4c4c6a
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c4ba4
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c5230
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c5460
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c4be7
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c5460
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c85e0
push edi
call fcn.004c6c30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c5230
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c5240
lea eax, [ebp - 0xa0]
push 0x4c85c0
push eax
call fcn.004c5240
push dword [esi + 0x4ca49c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c5240
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c6ba4
add esp, 0x2c
pop edi
jmp 0x4c4c6a
lea eax, [ebp + 8]
lea esi, [esi + 0x4ca49c]
push 0
push eax
push dword [esi]
call fcn.004c5460
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40657c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4065a0
xor eax, eax
test eax, eax
je 0x4065b3
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065b3
xor ecx, ecx
jmp 0x4065b6
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x4d42787
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3c1f1c11
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219