joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4839c5
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.00483941
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x483b34
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x483b34
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x483ae9
jg 0x483a21
test eax, eax
je 0x483adf
push 1
push 0x1000
call fcn.00477344
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x483a44
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x483ad6
push 0x8000
push ebx
call fcn.00476230
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x483a6d
jg 0x483a68
cmp ecx, 0x1000
jb 0x483a6d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0047abfe
add esp, 0x10
cmp eax, 0xffffffff
je 0x483ab2
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x483a68
jl 0x483a99
test ecx, ecx
jne 0x483a5a
push dword [ebp - 0xc]
push ebx
call fcn.00476230
push esi
call fcn.004773a1
add esp, 0xc
xor ebx, ebx
jmp 0x483b42
cmp byte [edi + 0x24], 0
je 0x483ac9
cmp dword [edi + 0x20], 5
jne 0x483ac9
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x483ad4
mov ebx, dword [edi + 0x18]
jmp 0x483ad6
xor ebx, ebx
push esi
call fcn.004773a1
pop ecx
jmp 0x483b42
test ecx, ecx
jg 0x483aab
jl 0x483ae9
test eax, eax
jae 0x483aab
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00479817
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x483b09
cmp byte [edi + 0x1c], 0
je 0x483aab
jmp 0x483b3a
push ebx
call fcn.0047df8b
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x483aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x483b42
cmp byte [edi + 0x1c], 0
je 0x483b3f
mov ebx, dword [edi + 0x18]
jmp 0x483b42
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.00479817
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x484470
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x48449d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x48449d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Check mutex on windows
Hide graphical window

Disassembly:
sub esp, 0x48
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp]
push esi
push edi
mov edi, str.MainWindowClass
push str.NetSchemeHandler
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 1
mov eax, ecx
mov esi, edi
mov edi, edx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
je 0x401054
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40105f
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x48
ret 0x10
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x64
mov dword [esp + 0x2c], 3
mov esi, dword [esp + 0x58]
mov dword [esp + 0x30], main
push esi
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], esi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push 0
mov dword [esp + 0x44], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
push 4
mov dword [esp + 0x44], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [esp + 0x28]
lea ecx, [esp + 8]
push edx
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], ecx
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x40116a
push 0
push esi
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10cf0000
lea eax, [esp + 0x2c]
push str.NetSchemeHandler
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
je 0x40116a
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
lea ecx, [esp + 0x14]
push 0
push ecx
call esi
test eax, eax
je 0x40115e
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
lea edx, [esp + 0x10]
push edx
call edi
lea eax, [esp + 0x10]
push eax
call ebx
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call esi
test eax, eax
jne 0x40113e
pop ebx
mov eax, dword [esp + 0x14]
pop edi
pop esi
add esp, 0x48
ret 0x10
push 0x10
push str.Sorry
push str.Failed_to_register_main_class...
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
xor eax, eax
pop esi
add esp, 0x48
ret 0x10

Function at 0x439f12
Capabilities:
Encode data using xor

Disassembly:
cwde
in al, 0xa4
out 0x59, eax
jne 0x439f8d
or al, 0x9b
invalid
invalid
Function at 0x471ee6
Capabilities:
Encode data using xor

Disassembly:
rol byte [esp + edi*4 - 0x967b9cb], 0x28
cmp dword [esi + 0x26], 0x43
xor edi, dword [ecx + 0x37]
mov eax, dword [0x2f499672]
mov dh, 0xe7
mov esi, 0x52bd9958
wait
test al, 0x77
out dx, eax
aaa
invalid
aaa
aas
cld
mov esi, 0x31f32a4
leave
push esi
mul dword [ebx]
lahf
sbb eax, 0xeb0adc99
sar esp, 0x28
sbb ah, byte [eax - 0x43]
je 0x471f32
fmul dword [ebx]
jg 0x471e99
pop esi
mov cl, dl
push edi
lds edx, [edx + 0x1e441f65]
push eax
insd dword es:[edi], dx
sbb al, 0x4c
xor byte [ebx + 0x294748f], 0x13
mov cl, byte [eax + 0x39]
loop 0x471ec6
xor byte [ecx - 0x50], dh
scasd eax, dword es:[edi]
retf 0x9b3
jp 0x471f41
enter 0xffffffffffffdffb, 0x39
outsd dx, dword [esi]
sub byte [ebp - 0x52], bh
mov ah, 0xae
sar dword [ebx - 0x24a3bbe5], cl
mov eax, dword [0xfc3c302d]
mov al, 0x7e
retf
wait
add dh, byte [ecx]
wait
cwde
jge 0x471f97
xor byte [ecx - 0x54], bl
pop ecx
lodsb al, byte [esi]
and ebx, ecx
push edi
jle 0x471f14
push cs
jb 0x471f8c
mov edx, 0x3a17596b
or byte [esi + 0x4b96e6bc], ch
movsb byte es:[edi], byte [esi]
push esi
push es
dec edx
insd dword es:[edi], dx
add al, ah
test dword [esi + edx*8 - 0x44cf4ba1], esp
push edi
dec edx
dec ecx
xchg ebp, eax
mov ah, 0x30
mov ebx, 0x95494a57
push ds
xchg ebp, eax
push ebp
fisub word [esp + edx*8 + 0x25]
or dh, bh
add al, 0x1f
or dword [ecx - 0x32], ebp
mov edi, edi
xor edi, dword [eax + 0x3d]
xchg esi, eax
dec esp
ja 0x471f62
cld
push ebp
jnp 0x471f3a
mov bh, 0xec
invalid
inc ebp
inc eax
shl dword [edi - 0x64], cl
dec ebx
fdivp st(5)
test edi, eax
mov esi, esi
add dh, 0xe2
cmpsb byte [esi], byte es:[edi]
and dword [esi], edi
test byte [eax + 0x21a6e2c6], 0x3e
invalid
mov byte [0x4ac880fa], al
cmp al, 4
add eax, 0x86ed100
add byte [ebp + 0x20], dh
rcr dword [ecx], 1
cmp bl, ch
jns 0x471f5b
add eax, 0xf269e272
call 0xa2b31516
aam 0xd5
pop esp
add eax, 0xa2ac473
add al, 0xf8
sbb ecx, dword ss:[edx + 0x174a25df]
and dl, 0x18
lahf
cwde
jno 0x471f99
push edi
add dh, al
xchg edi, eax
div dword [eax]
mov ebp, 0x6545370c
inc eax
salc
push 0x13
scasb al, byte es:[edi]
or esi, dword [eax]
ret
Function at 0x47639a
Capabilities:
Authenticate hmac

Disassembly:
ficom dword [eax + 0x76]
jg 0x47630f
jle 0x476346
insb byte es:[edi], dx
fucomi st(5)
mov cs, esi
or al, 0x74
fisttp word [edi]
cld
mov ss, word [eax]
pop esp
inc eax
xor edx, dword [edx - 0x1c]
pop ebp
adc byte [ecx], cl
adc edi, edx
jge 0x476334
jne 0x47636d
mov al, byte [0x9ff5e03e]
cmp dword [eax], edx
mov ah, 0x34
ljmp 0xb04d
cmp dword [edx + ebp*4 + 0x42480348], ecx
mov word [edx + 0x42480348], gs
loopne 0x4762d1
sti
inc eax
xor dword [ebx], 0x42dae22c
into
adc cl, ah
xor bh, al
push 0xffffffffffffffa6
mov cl, 0x65
test eax, 0x92908d76
add al, 0xfe
pop ss
xchg ebp, eax
mov dl, 0x28
jae 0x4762ec
sub byte [ebx - 0x4b], dh
add al, 0x49
or eax, 0x92509d36
xor ebp, ebp
push cs
mov eax, 0xb7759e79
invalid
cmp eax, 0x17bc7ac5
pop edx
xlatb
or eax, 0x7d29c908
movlps xmm6, qword [esi + 0x16]
lodsd eax, dword [esi]
add dl, byte [eax]
outsd dx, dword [esi]
test byte [ebp + 0x5c8d0c00], 0
movsb byte es:[edi], byte [esi]
inc ebp
cli
jo 0x476310
lcall 0xf61e, 0x229b9b47
mov word [eax], ds
inc esp
ret 0x3c49
wait
and bl, byte [esi]
test byte [eax + ebx + 0x3c49c244], 0x6c
out dx, eax
dec edi
jae 0x4763be
lcall 0x41b5, 0xec1d3d39
mov bh, 0x91
les esp, [ebx]
mov esi, 0xd081cb1
sbb al, 8
or eax, 0x184a414b
pop ss
sbb al, 8
or eax, 0x184a414b
pop ss
shl dh, 0xdd
cmp esi, esp
aad 0x36
cmc
adc dh, bl
loopne 0x47637d
pop ds
mov cl, 0xa4
inc ecx
or al, byte [edx - 0x684c7b93]
insb byte es:[edi], dx
push ds
pop es
int 0x48
jne 0x476359
lcall 0x1a6a, 0xcc31bef0
sbb esp, 0xffffffbc
in eax, dx
sbb al, 0x5c
pushfd
lodsb al, byte [esi]
mov byte [eax + 0x11981fbc], bh
in eax, 0xaa
pop ss
out 0x6d, al
test al, 0xc2
cmp dl, dh
xor dword [esi - 0x18], esp
xor bl, byte [edx - 0x178e4385]
pop ecx
lcall 0x5354, 0x6bd44b0e
cmc
sub dword [esi], ebx
int3
invalid
Function at 0x4c4426
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cc280
cmp edx, dword [eax]
je 0x4c4448
add eax, 8
inc ecx
cmp eax, 0x4cc310
jl 0x4c4439
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cc280]
jne 0x4c4576
mov eax, dword [0x4d0908]
cmp eax, 1
je 0x4c4550
test eax, eax
jne 0x4c4479
cmp dword [0x4cc1c4], 1
je 0x4c4550
cmp edx, 0xfc
je 0x4c4576
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c44b0
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c4b40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c4d70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c44f3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c4d70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c8a58
push edi
call fcn.004c6540
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c4b40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c4b50
lea eax, [ebp - 0xa0]
push 0x4c8a38
push eax
call fcn.004c4b50
push dword [esi + 0x4cc284]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c4b50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c64b4
add esp, 0x2c
pop edi
jmp 0x4c4576
lea eax, [ebp + 8]
lea esi, [esi + 0x4cc284]
push 0
push eax
push dword [esi]
call fcn.004c4d70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
mov ecx, 0x29882932
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
mov ecx, 0x2d512a9b
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x401208
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004012d0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x401240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0xfffffffffffffff6
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push 7
push dword [ebp - 4]
call sub.kernel32.dll_SetConsoleMode
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 8]
leave
ret 8

Function at 0x402bd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404840], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047c0], 0x30
mov dword [0x4047c4], 2
mov dword [0x4047cc], 0
mov dword [0x4047d0], 0
mov dword [0x4047c8], 0x402f50
jmp 0x402c23
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4047d4], eax
mov dword [0x4047e0], 0xf
mov dword [0x4047e8], 0x404767
mov dword [0x404104], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4047d8], eax
mov dword [0x4047ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4047dc], eax
push 0x4047c0
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.litform
push str.ndcls
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404838], eax
xor eax, eax
jmp 0x402cc2
push eax
push dword [0x404838]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404838]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x4047f0
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x402d08
push 0x4047f0
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x4047f0
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402cdb
mov eax, dword [0x4047f8]
jmp 0x402d15
call 0x4022b2
ret
Function at 0x40105b
Capabilities:
Hide graphical window

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4036c0], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x4036c4], eax
push 0x7f04
push 0
call sub.user32.dll_LoadIconA
mov dword [0x4036c8], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x4036cc], eax
push 0
call sub.user32.dll_GetSystemMetrics
mov dword [0x4036e0], eax
push 1
call sub.user32.dll_GetSystemMetrics
mov dword [0x4036e4], eax
call 0x40105b
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x10
push dword [0x4036cc]
push dword [0x4036c8]
push str.qe_tbl_class
push 0x401192
call fcn.00401100
mov dword [ebp - 4], 0x230
mov dword [ebp - 8], 0x19a
push dword [0x4036e0]
push dword [ebp - 4]
call fcn.004017db
mov dword [ebp - 0xc], eax
push dword [0x4036e4]
push dword [ebp - 8]
call fcn.004017db
mov dword [ebp - 0x10], eax
push 0
push dword [0x4036c0]
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0x80000
push str.Character_Table_Tool_for_PB
push str.qe_tbl_class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x4036d4], eax
push 1
push dword [0x4036d4]
call sub.user32.dll_ShowWindow
push dword [0x4036d4]
call sub.user32.dll_UpdateWindow
call fcn.00401163
leave
ret

Function at 0x401bb7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0x10
push dword [0x4036cc]
push dword [0x4036c8]
push str.view_win_class
push 0x401c5a
call fcn.00401100
mov dword [ebp - 4], 0x179
mov dword [ebp - 8], 0x13d
push dword [0x4036e0]
push dword [ebp - 4]
call fcn.004017db
mov dword [ebp - 0xc], eax
push dword [0x4036e4]
push dword [ebp - 8]
call fcn.004017db
mov dword [ebp - 0x10], eax
push 0
push dword [0x4036c0]
push 0
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push 0x80000
push str.View_table
push str.view_win_class
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x4036d8], eax
push 1
push dword [0x4036d8]
call sub.user32.dll_ShowWindow
push dword [0x4036d8]
call sub.user32.dll_UpdateWindow
leave
ret 4

Function at 0x401e84
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
mov eax, 0x4036ec
mov byte [eax], 0
push edi
mov ecx, 0x4c
mov al, 0
lea edi, [ebp - 0x4c]
rep stosb byte es:[edi], al
pop edi
mov dword [ebp - 0x4c], 0x4c
push dword [ebp + 8]
pop dword [ebp - 0x48]
push dword [ebp + 0xc]
pop dword [ebp - 0x44]
push dword [ebp + 0x14]
pop dword [ebp - 0x40]
push 0x4036ec
pop dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0x104
push 0x4037f0
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
mov eax, 0x4037f0
mov dword [ebp - 0x20], eax
push dword [ebp + 0x10]
pop dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0x280006
lea eax, [ebp - 0x4c]
push eax
call sub.comdlg32.dll_GetSaveFileNameA
mov eax, 0x4036ec
leave
ret 0x10
Function at 0x401fcc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401ff7
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x419010
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add byte [edx], ch
mov edi, eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x5a
push esi
mov edi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
test edi, edi
mov ebx, eax
je 0x419055
invalid
invalid

Function at 0x45d9d1
Capabilities:
Encode data using xor

Disassembly:
fcmove st(0), st(7)
jns 0x45da0e
test eax, 0xce05b45e
pop esi
mov ah, 5
into
add eax, 0x6dbabbce
sub al, 0x9a
mov ebx, 0x9a2c6dba
and al, 0x45
adc dword [ecx - 0x4964311b], esp
nop
lahf
pop es
push esp
cld
inc eax
in eax, 0xd9
ror dword [0x85cdd2c7], 0xce
xchg edi, eax
sar ebx, cl
out 0x34, eax
dec esi
imul ecx, dword [ebx + 0x5e869e03], 0x5819902e
lcall 0xe2c2, 0x70815937
mov esp, 0x15cf4e28
or byte [ebx], bh
mov es, esi
sub byte [esi - 0x31], cl
adc eax, 0x673e3b08
mov es, esi
xor eax, 0xd3904ad3
dec edx
dec ecx
insb byte es:[edi], dx
je 0x45d9d6
loopne 0x45d9d8
jnp 0x45da69
lodsd eax, dword [esi]
mov ecx, 0xda50aa0f
push edi
pop ss
wait
lea edx, [ecx + 0x263005e8]
rcr byte [ebp - 0x7e], 1
push 0xffffffffffffffe2
or ah, byte [ecx - 5]
bnd jnp 0x45da51
jmp [esi + 0x15]
lodsb al, byte [esi]
rcl byte [ecx + 0x4580fcc3], 0xd8
daa
imul ebp, dword [ebp + 0x67], 0xfffffff2
in al, dx
test eax, 0x6bd32f6d
pushal
adc al, 0xd9
das
in eax, dx
mov dword [ebx + 0x74], edx
dec edi
push ecx
cmc
dec esp
push edi
mov gs, edi
jle 0x45da6f
iretd
Function at 0x4c42ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4cc230
cmp edx, dword [eax]
je 0x4c42d0
add eax, 8
inc ecx
cmp eax, 0x4cc2c0
jl 0x4c42c1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4cc230]
jne 0x4c43fe
mov eax, dword [0x4d08b8]
cmp eax, 1
je 0x4c43d8
test eax, eax
jne 0x4c4301
cmp dword [0x4cc174], 1
je 0x4c43d8
cmp edx, 0xfc
je 0x4c43fe
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4c4338
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004c49c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004c4bf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4c437b
lea eax, [ebp - 0x1a4]
push eax
call fcn.004c4bf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c8a20
push edi
call fcn.004c63c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004c49c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004c49d0
lea eax, [ebp - 0xa0]
push 0x4c8a00
push eax
call fcn.004c49d0
push dword [esi + 0x4cc234]
lea eax, [ebp - 0xa0]
push eax
call fcn.004c49d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004c6334
add esp, 0x2c
pop edi
jmp 0x4c43fe
lea eax, [ebp + 8]
lea esi, [esi + 0x4cc234]
push 0
push eax
push dword [esi]
call fcn.004c4bf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401220
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
inc esi
dec eax
bswap edi
imul edx
bswap edx
bswap edx
rol esi, 0x57
rcl eax, 0x81
add eax, 0x6b
sub edx, 0x75
bswap ebx
bswap esi
add edx, 0x83
neg edx
rcr edi, 0x11
rcl edi, 0x7a
dec eax
neg eax
or edi, 0x96
dec eax
imul edi
and edi, 0x55
neg eax
or esi, 0x48
rcl ebx, 0x7d
rcl esi, 0x66
mov ebx, 0xb6
dec edx
dec edi
not eax
bswap eax
or edx, 0x26
neg edx
and edi, 0xa5
add esi, 0xe8
rcr esi, 0x7b
inc ebx
inc edx
dec edx
sub edx, 0x33
or ebx, 0x95
inc eax
rcr eax, 0x3a
rcl edx, 0xf6
imul ebx
neg eax
add ebx, 0xdc
add ebx, 0x98
not ebx
add edi, 0x35
xor ecx, ecx
xor edi, edi
and ebx, 0x41
neg edi
bswap esi
ror ebx, 0xec
sbb eax, 0x11
sbb edx, 0x78
rcl eax, 0x1c
inc edx
or ebx, 0xa1
sbb edx, 0xf
bswap eax
not eax
sub esi, 0x3f
dec eax
dec ebx
or esi, 0xc3
inc edx
neg ebx
rol edi, 0xee
sub edi, 0xda
dec edx
not ebx
ror edi, 0x45
add ebx, 0xfd
sub eax, 0x63
add edx, 0x9d
dec eax
ror esi, 0xa
inc edi
imul edi
inc edi
ror edi, 0x6c
rol edx, 0x32
not ebx
sbb edi, 0x40
mov ebx, 0xfb
bswap ebx
sub ebx, 0xef
or ebx, 0x7c
sub edi, 0x37
inc edi
imul edx
ror eax, 0xde
mov eax, 0x2e
sbb eax, 0xa7
sbb edx, 0x38
add eax, 0xb4
sbb edi, 0x10
dec ebx
or edx, 0xcb
mov ecx, dword [ebp + 0xc]
neg edx
and edx, 0xde
rcr edx, 0xe3
ror edx, 0x94
imul ebx
rol esi, 0x94
inc eax
bswap edx
imul edx
dec esi
neg eax
rcr edx, 0x89
inc ebx
or edx, 0x6a
imul esi
ror ebx, 0xe1
rcr eax, 0xec
mov ebx, 0xab
add esi, 0xfc
neg edi
neg edx
dec edx
inc edx
imul edx
bswap ebx
not esi
or esi, 0x6b
rcl eax, 0xc6
dec ebx
ror esi, 0x37
imul esi
dec edx
sbb ebx, 0x4a
imul edx
inc edx
add edi, 0x6e
inc eax
ror edx, 0x9b
dec edi
not edx
dec ebx
and edi, 9
not edi
ror edi, 0x8f
inc ebx
bswap esi
or edx, 0xad
imul ebx
imul edx
not eax
mov edi, dword [ebp + 8]
mov eax, ebx
xor eax, ebx
mov ebx, ebx
not byte [edi]
mov esi, eax
xor esi, ebx
mov esi, esi
xor ebx, eax
mov eax, esi
mov esi, eax
xor eax, ebx
mov ebx, ebx
mov ebx, ebx
add byte [edi], 0x37
xor eax, esi
mov eax, eax
mov ebx, esi
xor esi, ebx
xor ebx, ebx
xor ebx, esi
mov ebx, esi
xor ebx, esi
xor eax, eax
sub byte [edi], 0x75
mov ebx, esi
mov ebx, ebx
xor ebx, eax
xor esi, eax
xor eax, esi
xor ebx, ebx
xor esi, esi
mov ebx, esi
xor esi, ebx
imul byte [edi]
inc edi
loop 0x4013ca
pop edi
pop esi
pop ebx
pop ebp
ret