joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e3b604b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x6e3b60a4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x6e3b604b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x6e3b605a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x6e7bbcfd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x6e3b60ab
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.6e39cf21
cmp eax, dword [ebp + 0xc]
pop eax
je 0x6e3b614a
add edi, 4
add eax, 2
dec ecx
jne 0x6e3b6090
call 0x6e3b60f7
loope 0x6e3b60ed
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x6e3b6147
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x6e3b6158
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x6e3b610b
cmp eax, ecx
ja 0x6e3b610b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x6e3b6195
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x6e3b618b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.6e39d400
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x6e3b605a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x6e3b60a4
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x6e3b604b
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x6e3b605a
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x6e7bbcfd
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x6e3b60ab
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.6e39cf21
cmp eax, dword [ebp + 0xc]
pop eax
je 0x6e3b614a
add edi, 4
add eax, 2
dec ecx
jne 0x6e3b6090
call 0x6e3b60f7
loope 0x6e3b60ed
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x6e3b6147
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x6e3b6158
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x6e3b610b
cmp eax, ecx
ja 0x6e3b610b
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x6e3b6195
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x6e3b618b
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.6e39d400
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x42e8cb
Capabilities:
Encode data using xor

Disassembly:
call 0xbf05bb22
test byte [eax - 0x38], cl
ljmp 0xbd9f
out dx, al
sub al, 0x99
pop ecx
mov ebx, 0x8c23ad29
bswap esi
adc ebx, dword [esi + 0x6e]
xchg esi, eax
pop es
jbe 0x42e927
lodsd eax, dword [esi]
jbe 0x42e900
or eax, 0x7bacd517
fimul word [edi + ebp - 0x22]
push ds
xor al, byte [edi + 0xe]
mov cs, ecx
outsd dx, dword [esi]
dec ecx
adc dword [ebp - 0x76], edx
sbb eax, 0x7114f93e
and bh, byte [0xab2d1503]
sub ah, byte gs:[eax - 0x2dfa6dd]
sub ah, byte [eax - 0x2dfa6dd]
cli
xor al, 0x52
in eax, dx
xor al, 0xad
jae 0x42e8f0
pop esi
adc eax, 0xde2d7fa9
xor dword [eax + 0x26], esp
sub ecx, dword [edx + 0x17461963]
invalid

Function at 0x436fca
Capabilities:
Encode data using xor

Disassembly:
pop ebp
add eax, 0x2fbd21cf
adc ch, byte [eax + 0x53b03739]
jg 0x436fcd
invalid
jmp 0x436fbe

Function at 0x443a4c
Capabilities:
Encode data using xor

Disassembly:
jb 0x443ac0
sub byte [ebp + 0x4d], ah
lea esi, [ecx - 0x14]
mov dh, 0xd
dec esp
cmp dword [esi + 0x2374af79], ebx
mov ebp, 0x4dabaced
sub al, 0x4a
mov ebp, 0x40e71ac5
outsd dx, dword [esi]
scasd eax, dword es:[edi]
push cs
mov ebp, 0x9a6f18d0
xor ecx, ebp
std
dec esp
test dword [edi + 5], 0xb1004980
mov esi, 0x8c684d9e
stosb byte es:[edi], al
lea ebp, [esi]
sahf
dec ebp
push 0x2e8daa8c
sub dword [esi], edx
sti
ficomp dword [edi - 0x1c922689]
in eax, dx
push es
movsd dword es:[edi], dword [esi]
sbb ebx, dword [eax]
pop edx
arpl si, bx
inc esp
jnp 0x443a7e
mov ebx, 0x439d2e10
fsub qword [esi + 0x6c0da9db]
mov byte [ebp + 0x7ff64705], ch
btr dword [eax], ebp
sar dword [0x6aa5cc4b], 1
push ecx
and byte [ecx - 0x41], cl
sbb eax, 0xa42b9569
dec esi
in al, dx
loope 0x443ad8
cmp eax, 0x14ed748a
invalid
mov fs, word [ebp + eax*4 - 0x6f]
cwde
popal
and ebx, edi
insd dword es:[edi], dx
out 0x5c, al
popfd
pop esp
xor ch, byte [ebp + 0xe]
enter 0x677c, 0x65
mov bl, 0x65
loopne 0x443b5c
pop ss
jecxz 0x443b21
lodsb al, byte [esi]
test dl, al
sahf
xchg ebp, eax
scasb al, byte es:[edi]
jmp 0xe392295d
xchg ebp, eax
or eax, 0xed1fbf26
sub ecx, dword [ebx + 0x7e]
movsb byte es:[edi], byte [esi]
rcr byte [edi + ebp*8 + 0x7e6fedda], 0xf4
mov dh, 0xe2
jne 0x443af3
scasb al, byte es:[edi]
jp 0x443baa
adc byte [0x82ef656f], bh
pop ss
nop
dec eax
popfd
cld
out 0xa2, al
xchg edi, edi
cdq
pop ds
movaps xmm1, xmmword [edi - 9]
and byte [edi + 0x5f5acf9d], dh
int 0x45
invalid
cmp al, 0x8a
test al, 0x1a
xchg esi, eax
jg 0x443b6b
xchg edx, eax
mov dh, 0x8f
iretd
cli
das
mov al, 0x8e
lea esp, [eax + 1]
sbb eax, 0x4c23cdf
cld
shl eax, cl
invalid
mov bh, 0x4d
add dword [ebx - 0x7ed95da1], 0x29
xor eax, 0x30fb8edd
arpl word [edx], sp
pop es
sti
xor byte [ebx + 0x24], ah
bound eax, qword [edi]
push esp
fsub st(6)
push ss
push esp
nop
xchg edx, eax
mov bl, 0x9d
xor esp, 0x24f8d732
xchg edi, eax
mov dh, 0xdd
dec ecx
pop esp
test dword [ecx], esi
lea esp, [eax - 0x1b]
or ch, byte [ebp - 0x5cd3bf7a]
and al, 0xba
cmp cl, dh
pop ebp
push 0xf7a788a2
jp 0x443b86
jecxz 0x443b92
invalid
Function at 0x47f2a7
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov eax, 0x8d11c00c
cwde
adc dword [ebp - 0xc], edi
sti
fidiv dword [esp + edx]
mov ecx, dword [eax + 0x5e]
test byte [esi - 2], al
adc dword [ebp + 0x4a], edx
popal
fild qword [eax + 0x19]
dec ecx
sahf
mov byte [0xa09f548b], al
sub ecx, dword [edx - 0x2a07f749]
or byte [ebp + 0x42], dl
in eax, 0xe9
invalid
pop ds
xchg byte es:[esi], ch
cli
cwde
add ebp, dword [edi - 0x28]
cmpsb byte [esi], byte es:[edi]
js 0x47f237
aad 0x9c
aaa
out dx, eax
dec eax
sbb al, 8
retf 0x815d

Function at 0x489d5c
Capabilities:
Encode data using xor

Disassembly:
xor ch, ah
push ecx
xor al, 0x42
inc edx
test al, 0xaa
jnp 0x489d60
fldenv [esi]
adc al, 2
pop edx
ja 0x489dd7
cmp eax, 0x5ff510dc
mov dword [0xe8a85ca3], eax
ret
push ss
imul byte [eax]
mov al, 0x56
add dword [eax - 0x69], ebx
pop eax
xchg edi, eax
imul ebx, ebp, 0x2aa88e54
inc ebx
fmulp st(4)
wait
bnd je 0x489e3f
or dword [edi + eax*8 + 0x5d], 0xffffffe2
cmp dword [0x64b48401], esi
sub bh, byte [esi + 0x3f5e5e7e]
jns 0x489dac
adc ch, bh
invalid
dec ebp
xchg ecx, eax
jnp 0x489ddc
dec eax
leave
add eax, 0x547b1bb8
test al, 0x98
push cs
jnp 0x489e6c
sbb dword [eax - 0x205b5ce8], ebp
jp 0x489e90
jb 0x489ec1
stosb byte es:[edi], al
adc dword [0xbfa47d65], edx
or al, 0x40
sub eax, 0x5303580
mov esi, 0x4c122623
xor byte [ecx], cl
sal bh, 0x65
cpuid
retf 0xdfb8
nop
xchg esp, eax
or al, 0xce
lodsb al, byte [esi]
xor ch, byte [eax]
sub eax, 0xb5c9074
outsd dx, dword [esi]
out 0xc6, al
invalid
int3

Function at 0x48a404
Capabilities:
Encode data using xor

Disassembly:
xor dword [esi - 0x41f72cd1], esp
insb byte es:[edi], dx
fsetpm
mov fs, word [ecx - 0x31]
mov ecx, 0xc1832d15
dec bl
push edi
dec ecx
out 0xa3, al
and eax, 0xaff507d4
pop es
cmc
scasd eax, dword es:[edi]
cmp eax, 0xc839d423
outsb dx, byte [esi]
push ds
mov eax, dword [0x7d7ed9bf]
fldcw word [ebp + 0x3c]
jp 0x48a3e0
sbb al, 0x58
adc dword [esi], esi
jno 0x48a38a
syscall
sbb dword [edi + 0x4326a4c2], esi
inc ebx
test al, 0xc7
cdq
cli
push dword [ecx]
mov ebp, 0x2ffae8f8
sub byte [edi], cl
push esi
cmp byte [ebp + 0x402fe5df], dl
imul esp, dword [eax - 0x6a], 0x779b9568
insd dword es:[edi], dx
adc dword [ebx - 0x5fe90cf6], ebx
inc edi
inc ebp
cdq
mov byte [ebx - 0x15], ch
and byte [ecx - 0x11], cl
push esp
daa
test eax, 0x221b954
fimul dword [ebx]
jmp 0x48a3c4
mov esp, dword [edi + 0xf]
or eax, 0xcfcb8fd
push ecx
cmc
jge 0x48a3a3
sub byte [ebx], cl
adc dword [esi], esp
sub byte [esi], 0xc7
jne 0x48a41d
inc ecx
out 0x24, eax
push cs
mov ah, 0x1c
sub bh, al
adc byte [esi + 0x5c], bl
push ds
imul eax, dword [ebp + 0x2ceb148f], 0xfffffff0
dec edi
add al, 0x5c
arpl word [edx], bp
sbb dword [edi + 0x74], esi
push cs
popfd
or eax, 0xaee10b82
mov cl, 0xb3
xor eax, 0xf4d14200
fsubr st(4), st(0)
sbb dword [ebp*8 + 0x79fc70d9], edi
test al, 0x38
or esi, esi
je 0x48a436
imul ebp, dword [ebp + 0x30], 0x20
lodsb al, byte [esi]
sbb byte [ebx - 0x41eb4582], 0x92
test eax, ebp
add byte [ebp + 0x30abd59b], 0xcf
fstp dword fs:[edx - 0x4d]
push edi
ljmp 0x32d9
Function at 0x493fd4
Capabilities:
Encode data using xor

Disassembly:
psubw mm2, mm3
add eax, 0x21ab9e48
pop ecx
pop esp
invalid
invalid
cmp eax, 0x519f3167
aaa
mov ah, 0x38
loope 0x493fba
or dword [esi + 0x59], edx
push esp
push ecx
xor dword [edx], eax
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
jl 0x493fe3
fcom qword [edx + eax*4 - 0x2eec20e]
lds eax, [edi - 0x30]
adc al, dh
mov al, 2
jbe 0x493fff
fisub dword [edi + 0x3f5b5fcb]
jl 0x493f78
push es
jge 0x493fc7
push esp
dec ecx
pop ss
mov ebx, 0x6f6d8188
lcall 0xc443, 0xf24abf19
sbb dword [edi + 0x6c9cbf21], ebx
leave
fdiv qword [ebx]
arpl word [esi + 0x7d], bp
or eax, 0x16571536
fdiv dword [esi - 3]
sub dword [ebp + 0x6f], 0x4abf199a
inc ebx
les ebx, [ecx]
lahf
and dword [edi - 0x23369364], edi
xor esp, dword [ebx + 0x6e]
jge 0x494023
adc eax, 0x76d81657
std
loope 0x49400a
pop eax
mov dword [ecx], edx
pop ss
sal dword [edi], 1
jae 0x494051
mov esi, esi
nop
lds ecx, [esi + 0x55]
rol dword [edi], 0xb3
setae byte [edi - 0x20b8ba29]
fsubrp st(4)
loop 0x49408f
ret 0x1646
push edi
retf
cmp byte [ebx + 0x2364a398], dl
pop ebp
aad 0x8c
jge 0x4940c8
xchg edi, eax
invalid
xchg esi, eax
xlatb
sbb byte [esi + 0x137fd79c], dh
lock adc cl, byte [esi + ecx]
mov eax, 0x8c28d0f
or dword [eax + ebp - 0x48be86df], ebx
salc
jno 0x49404c
mov bh, 0x79
jmp 0x4940f1
jbe 0x4940ea
nop
cmpsb byte [esi], byte es:[edi]
out 0x4f, al
xor dh, dl
invalid
invalid
pop ss
inc ebx
cmp dword [esi + 0x221621fd], ebp
sub dh, byte [0x4b5b1eb4]
movsd dword es:[edi], dword [esi]
int3

Function at 0x4950ba
Capabilities:
Encode data using xor

Disassembly:
imul eax, ebp, 0xe0b64e42
movsb byte es:[di], byte [si]
and dword [edx - 0x671d9baa], 0x16a8d418
push ds
mov esi, 0xa5b3fec4
mov bl, 0xa5
stosd dword es:[edi], eax
xor al, 0xe8
inc edx
push 0x798a2c6c
and dword [ecx - 0x2c], esi
stc
mov al, byte [0xa4a1d461]
in al, dx
neg ah
push 0x2d49a0a9
mov dword [esi], ecx
or dword [0x700b84d2], edx
aaa
insb byte es:[edi], dx
push 0x3061168
rcr cl, 0x7a
xor byte [ecx], ah
test eax, 0xd9a126b8
loop 0x4950d0
fidiv word [ecx]
add al, 0xcd
jge 0x495189
push esp
imul eax, dword [esp + esi*2], 0xffffffa8
jmp 0x495168
xchg ebx, eax
int3
int3
Function at 0x4a0fe7
Capabilities:
Encode data using xor

Disassembly:
jns 0x4a1004
sbb edi, esp
cld
xchg ebx, eax
mov bl, 0x69
or edx, dword [eax]
xchg ebx, eax
retf 0x7a01
fchs
sub edx, dword [0xe06f79d9]
div dword [edx]
push ebx
jne 0x4a101e
loopne 0x4a0ffd
xor dl, byte [ebx + 0x75]
adc al, 0x2b
sbb byte [esi + 0xf], al
mov esi, 0x86fa1893
rep lodsb al, byte [esi]
sub ebx, dword [eax]
inc esi
movsx edx, byte [ebx - 0xc7905e8]
lodsb al, byte [esi]
call 0xd64d9bb1
xchg esp, eax
cmp dword [edx - 0x6dcf639a], 0x7d073367
pushfd
xor byte [edx + 0x7d073367], dl
adc dword [ecx - 0x6987eb97], esp
and byte [ecx + edi + 0x7b00510], dh
pop ebx
lock and byte [edx - 0x45], ch
lahf
sbb esi, eax
push 0x28
sal dword [eax - 0x40], 0xf2
loopne 0x4a0fe8
fld qword [ebp - 0x6ef06b8]
sal byte [eax - 0x5e913dc5], cl
out dx, eax
mov eax, dword [0xc08fc3c9]
mov byte [edx + 0x2564fca5], ah
movsb byte es:[edi], byte [esi]
mov ecx, 0x31b7c5d9
dec esp
push ss
shl edx, cl
fsub qword [ebp - 2]
movsd dword es:[edi], dword [esi]
fidiv word [esi - 0x71]
adc eax, dword [esi]
shr dword [edi], 1
mov ecx, esi
push esi
push ebx
cmp dword [ecx + 0x19ccf9e7], esi
xbegin 0x85f8e4a0
pop esi
or eax, edi
pop esi
cmp edi, dword [ebx]
call [esi - 0x5c557203]
mov word [esi + esi*4 - 0x337a7c92], fs
invalid

Function at 0x4b2e2c
Capabilities:
Encode data using xor

Disassembly:
sar dword [ebp - 0x525126a], 1
xchg esi, eax
ffreep st(5)
and dword [eax + 0xd], edx
mov al, byte [0x6881a032]
out dx, al
int1
lahf
mov eax, 0x542234c6
not dh
and ebp, eax
inc ecx
pop ebp
sub al, 0x36
xor eax, 0x61f00713
xor eax, 0x61f00713
pop es
invalid
test al, 0xea
jecxz 0x4b2dd2
mov ebp, 0xb9ae3624
aad 0x7e
push ebx
rcr dword [esi], 1
in eax, dx
xor dword [esi - 0xa05733f], eax
pop esp
popfd
wait
add al, 0xc0
mov byte [0x15a078dc], al
sbb eax, 0x8be576f7
lodsd eax, dword [esi]
jb 0x4b2df6
pop edi
mov ebx, 0xbe41e862
adc dl, byte [0x775b8a6]
pop es
pop es
call 0x926df26c
jne 0x4b2df2
scasb al, byte es:[edi]
mov word [esi - 0x25], ss
push ss
adc eax, 0xc9c5d354
rol ebp, cl
leave
leave
pop eax
inc eax
xor edx, 0x57ee6226
pop ebp
salc
or eax, 0x5f0d0dd5
cmp ecx, ecx
paddusb mm0, mm4
dec esi
ja 0x4b2e3c
sub bh, byte [eax]
jae 0x4b2e79
lds edx, [edx - 0xcbfa3a7]
movsd dword es:[edi], dword [esi]
imul ebx, dword [esi + 0x76], 0xe04acba0
dec ebp
hlt
call 0x733f2aae
push esp
adc edx, dword gs:[edi]
sbb cl, bl
sub eax, 0x696670ef
inc edi
in al, dx
cli
std
salc
inc esp
add byte [esi + 0x76ae6a23], bl
cld
aaa
je 0x4b2eb0
ja 0x4b2f08
jnp 0x4b2e63
pop es
cdq
jno 0x4b2eac
mov eax, dword [0x74e7dbf9]
add esi, dword [ebx]
cmp ch, dl
adc eax, 0xac82775e
ja 0x4b2e34
lodsb al, byte [esi]
lcall 0x8de6, 0xda3ddc69
mov edx, 0xd503d04d
rol byte [ecx + 0x49], 1
or edi, esi
mov edi, 0x7cf2b856
dec edx
mov eax, dword [0xb77d82db]
add al, 0x15
pop ecx
adc byte [edx - 0x3d], bh
fsubr dword [edx]
pop ecx
jo 0x4b2f82
cld
jmp 0x4b2f70
stosd dword es:[edi], eax
xor eax, 0x9c2966c1
pop esp
invalid
mov edi, eax
test edi, 0xa8e4671
add al, 0xe2
shl edx, cl
push cs
sbb eax, 0x5cf2a138
pop esp
xor bh, bl
and ch, byte [ebx - 0x5895143c]
jp 0x4b2f64
pop ss
leave
xchg edi, eax
jmp 0xd7f223f8
Function at 0x4b2fda
Capabilities:
Encode data using xor

Disassembly:
dec ebx
mov bl, 0xf
mov bh, 0xf8
sti
cdq
ret
sub eax, 0xf4ce13f7
stosd dword es:[edi], eax
salc
xchg esi, edx
out 0xe, eax
js 0x4b2f53
js 0x4b2f53
push ebp
xor eax, 0x472eee4c
push 0xffffffffffffffb7
xor eax, 0x10f56bf4
fld qword [edi]
sbb ebp, ebx
cmpsd dword [esi], dword es:[edi]
test dword [eax], 0xe98114cf
and byte [ebp + 0x1f7e88], al
dec esp
jno 0x4b2fab
aas
jmp 0x856cbbef
jne 0x4b2f9f
and ah, byte [edi]
and byte [esi + 0x5c149cf7], bl
ljmp 0x8a9c

Function at 0x4ba4c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4ba4e3
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4ba4d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4ba611
mov eax, dword [0x4c6cfc]
cmp eax, 1
je 0x4ba5eb
test eax, eax
jne 0x4ba514
cmp dword [0x4c22a0], 1
je 0x4ba5eb
cmp edx, 0xfc
je 0x4ba611
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba54b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baea0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb330
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba58e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb330
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf95c
push edi
call fcn.004bd200
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baea0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baeb0
lea eax, [ebp - 0xa0]
push 0x4bf93c
push eax
call fcn.004baeb0
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baeb0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd174
add esp, 0x2c
pop edi
jmp 0x4ba611
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004bb330
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4665e4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4665ea
ret

Function at 0x4e8f40
Capabilities:
Packed with generic packer

Disassembly:
mov dword [esp + 0x14], 0x469feb9c
sub esp, 0xffffffd8
jbe 0xda2fcb
cmp dword [esi + 0x34], edi
push eax
lea esp, [esp + 4]
jbe 0xda83f5
pushal
mov byte [esp + 4], dh
lea esp, [esp + 0x20]
call fcn.00e1005b
movzx eax, dl
not dl
mov edx, dword [esi + 0x2c]
movsx ax, dl
mov eax, dword [edx + edi*4]
pushal
mov dword [esp + 8], 0x71b789b
pushfd
mov dword [esp + 0x20], eax
mov byte [esp], 0x8b
jmp 0xe1b50d
clc
cmp cl, 0x7d
pushfd
cmp dword [esi + 0x34], edi
call fcn.00df1f6d
sub eax, 0xe334701c
and dword [ecx], eax
test byte [eax - 0x48], al
or ebp, edx
mov bh, 0xae
mov word [edx], fs
cwde
push eax
aaa
enter 0x56c0, 0xffffffffffffffbb
xor dword [ebx + edi*8 + 0x35], esp
sbb al, dh
inc edx
mov ebx, 0xcfc40666
ret 0x79b8
mov dword [esp + 0x1c], 0xe3dc2b
pushal
push 0xc301f06c
mov dword [esp], eax
pushfd
mov dword [esp + 0x40], ebx
mov word [esp], 0x2bf2
mov byte [esp], 1
push esp
pushfd
push dword [esp + 0x48]

Function at 0x4ed409
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 4], 0xe1
clc
add ecx, 0xc
bt edx, esp
cmp edx, ebp
cmp edx, eax
pushfd
mov byte [esp], dh
jmp 0xe26ee4
dec dword [esi + 0x28]
rdtsc
mov byte [ebp - 1], 1
bswap cx
pop ebx
xchg cx, ax
rdtsc
mov edx, dword [esi]
bswap cx
mov ah, 0xa0
pushal
not eax
mov eax, dword [edx + 8]
movsx ecx, cl
push dword [esp + 4]
not cl
movzx cx, dl
mov ecx, esi
pushfd
pushfd
mov dword [esp + 0x28], 0xe1504c
jmp 0xdb89a9
mov byte [esp + 0x14], 0x14
lea esp, [esp + 0x4c]
jb 0xde4be5
movzx bx, bl
not cx
jmp 0xe22c34

Function at 0x4ee790
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov dword [esp + 4], edx
lea esp, [esp + 0x24]
jbe 0xda83f5
jmp 0xe060a2

Function at 0xda83cb
Capabilities:
Packed with generic packer

Disassembly:
rol ebx, cl
rol ecx, 0xf
neg cl
mov ecx, dword [esi + 8]
cmc
cmc
cmp al, 0x1e
mov word [esp + 4], ax
add bl, al
clc
xor bl, byte [eax + edx]
pushfd
call fcn.00de2f49

Function at 0xdb12a9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp byte [ecx], al
mov dword [esp + 4], 0xe560a5d9
mov word [esp + 4], ax
push 0x22448b49
pushal
lea esp, [esp + 0x38]
je 0xe207ed
pushal
mov byte [esp], al
pushfd
push ecx
lea esp, [esp + 0x28]
jmp 0xdd4214
pushfd
shr eax, 8
jmp 0x4e6b55

Function at 0xdb8848
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea esp, [esp + 0x10]
jbe 0xda83f5
pushfd
lea esp, [esp + 4]
call fcn.00e1005b
xchg al, dl
mov edx, dword [esi + 0x2c]
push esi
mov byte [esp], 0x8c
mov eax, dword [edx + edi*4]
jmp 0x4e91f3
pushfd
mov dword [esp + 4], eax
pushal
call fcn.00de19ad
jmp 0x4e70e7

Function at 0xdc5388
Capabilities:
Packed with generic packer

Disassembly:
mov ecx, ebx
lea edx, [esi + 0x5e3335a1]
xchg dl, al
cdq
bswap dx
mov eax, edi
jmp 0xdf77aa
lea esp, [esp + 0x24]
call fcn.004ead87
pushal
test cx, 0xfbf1
mov ecx, dword [ebp + 0x10]
jmp 0xe30f3b
mov edx, esi
jmp 0xdcf9f2
Function at 0xdcb918
Capabilities:
Encode data using xor

Disassembly:
push dword [esp + 4]
push edx
jmp 0xe12fd5
cmc
test ax, 0x20e7
jmp 0xde8fe0
clc
and ebx, 0x3ff
push ebx
mov dword [esp], esi
jmp 0xe1bafc
enter 0x33e3, 0xffffffffffffffa1
inc ecx
and al, 0x18
or eax, 0xfba7b9f1
cmp dword [ecx - 0x10], 0xffffffb0
or dl, ah
pop ds
int1
imul eax, dword [edi + 0x72ff8463], 0xffffff88
inc eax
invalid
int1
mov ecx, 0x7983fba7
invalid
sal byte [esi + 0x481008a5], cl
xor al, 5
jg 0xdfab40
and byte [ebp + 0x312cccac], dl
fistp word [eax]
inc edx
lodsd eax, dword [esi]
loopne 0xdfaacf
ja 0xdfaac7
push 0xba18e76
invalid
lodsd eax, dword [esi]
loopne 0xdfaaf6
jl 0xdfab45
adc byte [esi], 0x8d
and al, 0x28
je 0xdd346f
call [edi + edi*8 + 0x529c2434]
pushfd
push dword [esp]
pushfd
push edx
lea esp, [esp + 0x10]
jmp 0xe22af3
call fcn.004eb201
mov byte [0x1ff9147b], al
push edi
xor byte [eax], bh
mov eax, dword [bx + di]
sbb dh, byte [ebp + 0x1d]
adc al, 6
jecxz 0xdfab9a
lodsd eax, dword [esi]
loop 0xdfabe4
cdq
out 0xda, al
cmpsd dword [esi], dword es:[edi]
sti
out 0xff, al
loopne 0xdfab30
sub byte [esi], dl
outsb dx, byte [esi]
jno 0xdfab38
inc esp
int 0x93
sbb esi, dword [esi + 0x3c0d13d0]
invalid
mov bh, 0x7c
push eax
sub dh, byte [edi + edi*8]
or edi, edi
inc ebp
add byte [eax - 0x21baa98d], bl
mov eax, 0x5be8c745
push 0xf8123bd3
into
mov bl, 0xe0
cmp byte [esi - 0x15088c48], ah
arpl word [edx - 0x61edcf1f], di
sal byte [ebp - 0x87463de], 0xc9
test eax, 0xb64dc5d4
retf
pop es
push esp
retf
lea esp, [esp + 0x30]
jne 0xdd05fb
pushfd
push 0x4b61479f
pushal
mov dword [esp + 0x24], eax
pushfd
pushfd
lea esp, [esp + 0x2c]
call fcn.00dd8914
btc ebx, 4
shld bx, cx, cl
cmp dx, sp
sub bl, dl
mov ebx, eax
jbe 0xddc5f1
pushal
mov word [esp + 8], dx
push esi
and ebx, 0x3ff
call fcn.004ea02c
dec edi
mov dl, 0xf1
in eax, dx
pushal
in eax, 0xf
push edx
sbb byte [esi], cl
sub edi, dword [edi + 0xc]
ja 0xe1baed
and edi, dword [edi]
mov ebp, 0x8324cbf9
xchg ebp, eax
or byte [esi], dh
lodsd eax, dword [esi]
fidiv word [ebp + esi*2 - 0x7293a9f0]
add al, 0xb5
lodsd eax, dword [esi]
dec edi
dec ebp
out dx, eax
jmp 0xdfab55
std
inc esi
mov byte [esp], 0x38
mov dword [esp + 8], ecx
jmp 0xe0c68c
pushal
invalid
pushal
call fcn.004e6c98
mov ah, byte [ebp - 0x70]
mov esi, 0xb1f51cd6
stosb byte es:[edi], al
sub eax, 0xf11adc20
jns 0xe1bac3
inc esp
dec ecx
fisttp word [esi - 0x17a43bb4]
and eax, dword [edx - 0x7f71be81]
jge 0xe1bb23
pop ebx
call 0x42613d42
mov es, word [eax + 0x5745007d]
inc ebp
push edi
xor cl, ah
push edi
dec eax
jbe 0xe1bb19
push edx
mov al, 0x5b
std
sbb byte [ebx - 0x50], al
stosb byte es:[edi], al
push edi
cmp al, byte [ebp - 0x76]
invalid

Function at 0xdd4200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp]
push ecx
lea esp, [esp + 0xc]
call fcn.00de4a89
not bl
call fcn.004ee7b5

Function at 0xde4acd
Capabilities:
Packed with generic packer

Disassembly:
cmp dword [esi + 0x34], edi
jmp 0xe1b347
jmp 0xe2d68c
lea esp, [esp + 0x14]
jbe 0xda83f5
call fcn.00e23d9e