joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10011890
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], ebx
lea eax, [edi + edi*2]
shl eax, 3
push eax
push ebx
push esi
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 8]
add esp, 0xc
cmp dword [edx + 8], edi
jbe 0x100118f8
test byte [0x1003e864], 2
je 0x100118ea
mov eax, dword [0x100400e4]
push 0x123
push 0x8002000e
push 0x10005b78
push 0x48c09
push eax
call fcn.1000d160
add esp, 0x14
pop edi
pop esi
mov eax, 0x8002000e
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor edi, edi
mov dword [ebp - 0xc], edi
cmp dword [ebp + 0x14], ebx
jbe 0x10011a71
movzx ecx, word [edi + edi]
mov eax, dword [edx + 8]
mov ebx, ecx
shr ecx, 0xb
and ebx, 0xf7ff
and ecx, 0xffffff01
mov dword [ebp - 8], ecx
cmp edi, eax
jae 0x10011a0f
cmp dword [ebp - 4], 0
jl 0x10011a0f
sub eax, edi
dec eax
shl eax, 4
add eax, dword [edx]
movzx ecx, word [eax]
test ebx, 0x4000
je 0x10011989
test ecx, 0x4000
je 0x10011973
mov edx, 0x400c
cmp cx, dx
jne 0x10011966
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10011966
mov eax, ecx
cmp word [eax], dx
je 0x10011958
mov ecx, edx
mov word [esi], cx
mov dword [esi + 8], eax
jmp 0x100119fd
mov byte [esi + 0x11], 1
mov ecx, 0xa
mov eax, 0x80020004
mov word [esi], cx
mov dword [esi + 8], eax
jmp 0x100119fd
mov edx, 0x400c
cmp cx, dx
jne 0x100119a1
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x100119a1
mov eax, ecx
cmp word [eax], dx
je 0x10011993
movzx edi, word [eax]
mov edx, edi
movzx ecx, bx
xor edx, ecx
test edx, 0xffffbfff
je 0x100119e4
mov ecx, 0xc
cmp cx, bx
je 0x100119e4
cmp edi, 0xa
jne 0x100119cb
cmp dword [eax + 8], 0x80020004
je 0x100119e4
push ebx
push 0
push eax
push esi
mov byte [esi + 0x10], 1
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov edi, dword [ebp - 0xc]
mov ebx, eax
mov dword [ebp - 4], ebx
jmp 0x10011a00
mov ecx, dword [eax]
mov edi, dword [ebp - 0xc]
mov dword [esi], ecx
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov eax, dword [eax + 0xc]
mov dword [esi + 0xc], eax
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
test ebx, ebx
js 0x10011a25
cmp word [esi], 0xa
jne 0x10011a25
jmp 0x10011a21
mov ebx, dword [ebp - 4]
mov eax, 0xa
mov word [esi], ax
mov dword [esi + 8], 0x80020004
mov byte [esi + 0x11], 1
cmp byte [esi + 0x11], 0
je 0x10011a5e
test cl, cl
jne 0x10011a5e
test byte [0x1003e864], 2
mov ebx, 0x8002000e
mov dword [ebp - 4], ebx
je 0x10011a5e
mov eax, dword [0x100400e4]
push 0x174
push ebx
push 0x10005b78
push 0x5d009
push eax
call fcn.1000d160
add esp, 0x14
mov edx, dword [ebp + 8]
inc edi
add esi, 0x18
mov dword [ebp - 0xc], edi
cmp edi, dword [ebp + 0x14]
jb 0x10011906
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10015130
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003b7b1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x1003e4a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [0x1003e888], 0x1000a884
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0x1000184c
mov dword [edi + 0x20], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], 0
mov dword [ebp - 4], 0
mov dword [edi], 0x10001a18
mov dword [edi + 4], 0x10001a08
mov dword [edi + 8], 0x10001998
mov dword [edi + 0x24], 0
mov byte [edi + 0x28], 7
lea esi, [edi + 0x48]
mov dword [edi + 0x38], 0x10001994
xor eax, eax
mov byte [edi + 0x40], 7
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push esi
mov dword [esi + 0xc], eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, 0xa
mov dword [edi + 0x50], 0x80020004
mov word [esi], ax
mov dword [edi + 0x58], 0
lea eax, [edi + 0x68]
mov byte [ebp - 4], 2
push eax
mov dword [edi + 0x64], 0x100039b8
mov dword [eax], 0
call dword [sym.imp.MSDART.DLL_MPInitializeCriticalSection]
mov dword [edi + 0x6c], 0
mov eax, 0x81
mov word [edi + 0x2c], ax
add esp, 4
mov dword [edi + 0x30], 1
mov eax, edi
mov dword [edi + 0x60], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100360f0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [0x1003e830]
mov dword [esi], ecx
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [esi + 0xc], eax
xor ebx, ebx
mov eax, dword [0x1003e830]
cmp dword [eax + 0xc], 0xffffffff
setne bl
call dword [sym.imp.OLEAUT32.dll_ClearCustData]
mov ecx, eax
shr eax, 0x10
cmp ax, 0x1e
ja 0x10036140
jne 0x10036130
mov eax, 0x10a2
cmp cx, ax
jae 0x10036140
mov ecx, dword [0x1003e830]
xor al, al
pop esi
mov byte [ecx + 0x14], al
mov eax, ebx
pop ebx
ret
mov eax, dword [0x1003e830]
mov cl, 1
pop esi
mov byte [eax + 0x14], cl
mov eax, ebx
pop ebx
ret

Function at 0x10036df0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov ecx, dword [ebp + 8]
sub esp, 8
test ecx, ecx
je 0x10036e55
xor eax, eax
mov dword [esp + 4], eax
mov al, byte [ecx]
test al, al
je 0x10036e44
inc ecx
movzx eax, al
mov word [esp + 4], ax
mov edx, 1
mov word [esp + 6], ax
mov al, byte [ecx]
test al, al
je 0x10036e44
jmp 0x10036e30
movzx eax, al
lea ecx, [ecx + 1]
add word [esp + edx*2 + 4], ax
xor edx, 1
mov al, byte [ecx]
test al, al
jne 0x10036e30
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 4]
mov dword [ecx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x10037cf0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x1003e830]
push esi
mov esi, ecx
mov dword [esi + 0x14], 0
mov dword [esi + 0x1c], 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [esi], eax
mov dword [esi + 0x18], 0
test eax, eax
je 0x10037d25
inc dword [eax + 4]
mov eax, esi
pop esi
ret 4
mov eax, dword [0x1003e830]
push esi
mov dword [esi + 4], 1
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov word [esi + 0x10], 0
mov byte [esi + 0x12], 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi], esi
mov eax, esi
pop esi
ret 4
Function at 0x1003b100
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x1003b13e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1003b136
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1003b140
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1003b126
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1003b210
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x1003b226
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x1003b241
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x40103c
Capabilities:
Terminate process

Disassembly:
mov dword [0x402475], eax
mov edx, eax
call dword [sym.imp.kernel32.dll_GetTickCount]
xor edi, edi
call dword [sym.imp.kernel32.dll_GetVersion]
xor esi, esi
push dword [0x403587]
call dword [sym.imp.winmm.dll_waveOutClose]
add eax, 6
test eax, 0xb
jne 0x401075
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
ret

Function at 0x4033a3
Capabilities:
Get graphical window text

Disassembly:
add esi, dword [0x56db2108]
mov ecx, dword [eax + ecx*2]
jnp 0x4033d1
call 0xf35c641c
mov esi, dword [eax]
sbb al, 0xf3
inc ebp
clc
mov esi, esp
cwde
inc ebp
clc
jmp 0x40338d
jnp 0x4033c0
jns 0x403381
jnp 0x403405
cld
mov eax, ecx
mov ecx, dword [ebx + 0x1c]
or dword [ebx + 0x84b8b0b], 0x24491d79
xor byte [eax], al
pop eax
add al, 0x23
inc eax
invalid
push 0xfffffffffffffff0
push 0xfffffffffffffff0
push 0x303303
out dx, eax
adc eax, 0x30358c
inc eax
push 0x30327f
xor byte [eax], al
inc eax
inc dword [0xf0403100]
mov dword [0x303594], eax
dec eax
push 0x3032d8
inc eax
inc dword [0xf0403100]
mov dword [0x303598], eax
mov bl, 0xf
je 0x4033e4
pcmpeqb mm3, mm4
invalid

Function at 0x403462
Capabilities:
Execute anti-debugging instructions

Disassembly:
push eax
mov edi, eax
mov esi, 0x4025b0
mov ecx, dword [0x403222]
shr ecx, 1
dec ecx
mov bl, byte [0x403226]
rdtsc
push eax
mov bh, byte [esi]
inc esi
mov byte [edi], bh
inc edi
mov al, byte [esi]
stosb byte es:[edi], al
add byte [edi - 1], bl
inc esi
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
loop 0x403482
rdtsc
pop edx
sub eax, edx
sub esp, 0x18
push 0
push dword [0x40245d]
call dword [sym.imp.Msacm32.dll_acmStreamOpen]
pop edx
sub edx, eax
push edx
push 0
push 0
push 0x4032fa
call dword [fcn.0040359c]
push 0x4032b5
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [fcn.00403590], eax
push 0
push 2
push 0x4032f8
push 0x4032c4
call dword [fcn.00403590]
pop edx
sub edx, eax
ret
Function at 0x41170d
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
mov edx, 0x41fb16ac
jne 0x411710
popal
push edx
push ebp
mov esp, 0x33779617
add eax, 0x9e6f9d10
invalid
stosd dword es:[edi], eax
lahf
push ecx
je 0x4116a7
mov dword [0x9be6f57], eax
stosb byte es:[edi], al
rol byte [edx], 1
std
jne 0x4116ae
or dword [ebx - 0x3b8d5a9b], ebp
retf

Function at 0x415536
Capabilities:
Encode data using xor

Disassembly:
js 0x41553c
ror dword [esi - 0x29], 1
rol byte [edi + 0x13], cl
push 0xffffffffffffffe7
lodsd eax, dword [esi]
out 0xad, eax
xchg dword [ecx - 0x4b7947ce], ebx
mov bl, 0xc
test dword [ebx + 0x3d57b24b], eax
out 0xea, eax
xor byte [eax + 0x1a7ea1ed], bh
je 0x415540
invalid

Function at 0x43d4bb
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xf4
out 0x2a, eax
inc esi
outsd dx, dword [esi]
sti
xor ebp, dword [ecx + edi - 0x2e33aa84]
mul byte [ecx + 0xf]
jnp 0x43d502
xor esi, dword [0xfc6ac829]
xor eax, 0xfc6ac829
push esp
pushfd
loopne 0x43d4ce
add al, 0xd
fidiv word [edx - 0x64]
je 0x43d53f
pushfd
imul ch
popal
popfd
mov esp, 0x7876969e
clc
pop ebx
jge 0x43d558
cmp esp, ebx
mov esi, dword [ecx + 0x25]
xor al, 0xf2
and byte [esi], dl
mov byte [0x5efdb3ae], al
xor dword [edi], 0x74854be7
test dword [ecx + ecx + 0x61], esi
aaa
or dword [ecx + 0x37], esp
jno 0x43d4db
pop ss
add byte [esi - 0x2a1ae754], ah
cmp eax, 0x143d926b
movsd dword es:[edi], dword [esi]
js 0x43d4fd
int 0xe0
or al, 0x9e
lodsd eax, dword [esi]
jnp 0x43d4e9
clc
lodsd eax, dword [esi]
xchg edi, eax
fisubr dword [esi - 0x2b089f6a]
scasb al, byte es:[edi]
xchg esp, eax
insd dword es:[edi], dx
imul eax, dword [ebp - 0x2d776092], 0x7dd93398
retf
lds edx, [esi]
inc esi
invalid
mov bl, 0xe2
invalid
Function at 0x43daf3
Capabilities:
Check for vm using instruction vpcext

Disassembly:
dec eax
fnsave dword [ecx]
std
adc dword [ebp - 0x4ce1f0], ebx
dec esp
adc byte [ebx], cl
or al, 0x72
aas
cmp eax, 0xeb8f2949
dec byte [ecx + 0x3798182d]
imul edx, dword [edi + 7], 0xacfd1f20
push 0x29
pop edi
add edi, dword [0xa7eb8912]
cmpsb byte [esi], byte es:[edi]
sbb eax, 0xe17d2e4e
push 0xffffffffffffffed
dec ecx
sub dword [0x1219debc], esi
jbe 0x43db5c
in eax, 0x60
jno 0x43db3b
pop ds
jecxz 0x43db72
pop ebx
fild word [edx]
adc al, 0x51
push ecx
in al, dx
xchg edx, eax
jb 0x43dbba
add dword [edi - 0x5e7a5685], ecx
adc esi, dword [ecx + 0x18870f01]
pop esp
dec ebp
popfd
enter 0x2cb6, 0xfffffffffffffff6
int1
mov edx, edx
xor edx, eax
dec esp
jge 0x43db79
mov dh, 0x82
mov dh, 0x82
daa
and dh, byte [edi + ecx]
sub cl, byte [edx + 0x2d]
fucomi st(1)
push ds
int 0x54
dec ecx
cld
sub eax, 0x81a51ff8
push ds
jo 0x43db5b
iretd
add dh, byte [esi - 0x31]
inc eax
sbb byte ss:[eax - 0x67], bh
xlatb
and eax, 0x10ecc4b6
ja 0x43db0e
push esi
lcall 0xd8dd, 0xfb47614b
ja 0x43dc04
invalid
mov eax, 0xf3a02799
add al, al
fistp word [edx + 0x61]
test byte [ecx + 0x109976de], bh
movsd dword es:[edi], dword [esi]
xor ebx, dword [edi + 0x23875c5d]
add bh, byte [esi + 0x4737a2a0]
xor al, 0xea
dec ecx
mov ecx, 0xd404aea
mov byte [eax - 0x10c661de], al
dec esi
scasb al, byte es:[edi]
sti
dec ebp
outsb dx, byte [esi]
and al, byte [ebp + 0x649c86db]
dec esp
pushfd
cmp dword [esi - 0x24], ebx
push edx
das
and eax, 0x596cf489
or edi, dword [ebp - 0x606cbce7]
insb byte es:[edi], dx
cli
adc edi, esp
scasd eax, dword es:[edi]
mov ecx, 0x607e26d7
clc
loop 0x43dc3e
jno 0x43dc31
xor al, 1
insb byte es:[edi], dx
imul ebp, dword [edx], 0xffffff89
retf 0xa2e6
js 0x43dc6e
enter 0x30ad, 0x5b
popfd
arpl word [ebx], sp
mov ebp, 0x8d0fe6d
sahf
and dl, ah
xchg esp, eax
sar dword [esi], 1
dec esp
or byte [esi - 0x2e6b1de0], bl
dec esp
clc
sbb ch, byte [ebp - 0x47fe0b0d]
pop ds
outsb dx, byte [esi]
xchg ecx, eax
call 0x1541b60e
popfd
ret 0x4d06
dec ebp
invalid
Function at 0x43f6d6
Capabilities:
Encode data using xor

Disassembly:
js 0x43f700
sbb edi, dword [ecx]
inc ebx
lodsd eax, dword [esi]
mov bl, 0xdf
in al, 0xc3
inc ebp
mov cl, 0x6a
sub ch, byte [ebx + 0x14]
pop ecx
push es
sub al, 0x4a
and eax, ebp
invalid
in eax, dx
mul byte [ebp - 0x57191904]
xor al, 0xf6
test al, 0x67
xor al, 0xf6
inc esi
fmul qword [esi - 0xa]
cld
loop 0x43f693
push edx
test bl, dh
loopne 0x43f72e
loopne 0x43f72e
mov byte [0xf98c9aa2], al
je 0x43f75a
sub dh, dh
mov esp, 0xb7169d23
add bh, 0x6d
mov dl, 0xc0
in al, 0xc4
add bl, byte [esi - 0x4dd8b8e0]
jbe 0x43f6e9
push ss
neg byte [ecx - 0x4e]
std
pushfd
stosd dword es:[edi], eax
sti
push esp
dec ebp
adc al, 0x3f
ljmp 0x3b77
popal
jbe 0x43f6dc
loope 0x43f765
mov bl, 0x6f
mov eax, dword [0xb6554a35]
and esp, dword [edi - 0x10]
pushfd
outsb dx, byte [esi]
cmp byte [esi + 0x3f], ch
or ecx, 0xffffff80
test dword [edx + edx*8 - 0x2b15b9cc], edi
stosb byte es:[edi], al
xchg edi, eax
scasb al, byte es:[edi]
test byte [eax + 0x55], cl
mov bl, 0x18
jle 0x43f77e
and dl, byte [edi]
push edx
adc al, 0xe3
xchg edx, eax
push es
out dx, al
js 0x43f774
enter 0xfc1, 0x70
loopne 0x43f700
mov dword [0x9f9a64be], eax
invalid
lcall 0xcb81, 0xfb93f09f
push ss
pop ds
mov word [edx - 0x1ce5b61f], cs
test al, 0x80
ja 0x43f7f7
cdq
or ebx, dword [edi + 0x2fb645c9]
das
sbb eax, 0xcc30fb6a
das
cmp dword [ebx - 0x1a6d29c0], edx
and bl, byte fs:[eax - 0x3f]
or ch, byte cs:[ebx + ebx]
daa
xchg esi, eax
push esp
sbb ecx, dword [ebp - 0x237ff0cd]
out 0x82, eax
les esp, [esi + 0x7d]
dec edx
lea esi, [ebx]
jo 0xc4c6df7c
jge 0x43f7ed
sbb esp, dword [edi]
jg 0x43f729
pop edi
sbb dword [ebx], esi
mov edx, 0xa696a665
xchg edx, eax
inc edx
cmpsb byte [esi], byte es:[edi]
push ds
cwde
stc
push ss
xor al, 0x8c
js 0x43f7af
arpl cx, si
jo 0x43f836
jnp 0x43f7e5
and al, 0x6a
pushal
jno 0x43f798
fadd dword [edi - 0x15]
or al, bl
cdq
mov ah, 0x63
cmpsb byte [esi], byte es:[edi]
or ecx, dword [ebp + 0x2111fb1]
add al, byte [ecx - 0x1d548f5]
cmp al, 0x89
jns 0x43f796
and ah, cl
adc al, 0xce
stc
adc al, 0xe4
ljmp 0xc185
test ecx, eax
movsb byte es:[edi], byte [esi]
retf 0xa2e0
pop ebp
sbb dl, byte gs:[edx]
push ds
inc esi
push es
add eax, 0x47196b00
sbb al, 0xdd
mov bh, 0x4e
outsb dx, byte [esi]
cmp dword [ebp + 0x2eed8dfa], edx
aad 0x43
xchg edx, eax
mov fs, word [edx - 0x3194a6a0]
inc edi
push ebx
dec edx
mov byte [0x98124ec3], al
sahf
jae 0x43f883
mov ebp, 0xb2c2208f
invalid
sbb ch, byte [ebp + 0x64fa044d]
bound esp, qword [ecx + edx - 0x783077d2]
mov dword [edi - 0x42240e1b], eax
sbb dh, byte [ebx - 0x6e366535]
cmp byte [ebx + 0x4dbd4411], 0x84
int3
dec edx
popfd
push cs
invalid

Function at 0x458708
Capabilities:
Encode data using xor

Disassembly:
push 0x180bf17e
cmp dh, byte [0xf48df15d]
mov eax, 0x47856201
lds ebp, [esi]
cmp ecx, ecx
and eax, dword [ecx]
fnstcw word [esp + ecx - 0x5871861a]
sub eax, 0x347be76e
cmp ecx, 0xffffff86
sub edx, dword [eax - 0x1a532f59]
invalid
Function at 0x46f0c4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
stc
xchg esi, eax
aam 0xeb
cwde
lcall 0xa241, 0x5a4518d
sub dh, ah
inc ecx
jl 0x46f0da
cdq
adc eax, 0x148a7d0a
mov al, al
out dx, al
aas
adc al, 0x8a
shr dh, 0x3f
and byte [edi - 0x54218216], bl
inc ebx
mov eax, 0x23256c1f
lodsb al, byte [esi]
mov dl, 0x93
pushal
mov eax, 0x9c2b3761
add al, byte [eax - 0x54654bf5]
pop ebp
xor byte [esi - 0x42], bl
jmp 0x46f130
xchg esp, eax
imul esi, dword [esi + 0x5d], 0xce0f0a7
das
lea ecx, [esi + eax - 0x43]
fcom dword [ecx + 0x528facc5]
fsub dword [ebp - 0x40]
add cl, byte [edi]
rol byte [edx], 0xf
jl 0x46f145
invalid

Function at 0x4bc875
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5380
cmp edx, dword [eax]
je 0x4bc897
add eax, 8
inc ecx
cmp eax, 0x4c5410
jl 0x4bc888
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5380]
jne 0x4bc9c5
mov eax, dword [0x4c9d1c]
cmp eax, 1
je 0x4bc99f
test eax, eax
jne 0x4bc8c8
cmp dword [0x4c52ac], 1
je 0x4bc99f
cmp edx, 0xfc
je 0x4bc9c5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bc8ff
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd260
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bd6f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bc942
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bd6f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1b04
push edi
call fcn.004bf5c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd260
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd270
lea eax, [ebp - 0xa0]
push 0x4c1ae4
push eax
call fcn.004bd270
push dword [esi + 0x4c5384]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd270
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf534
add esp, 0x2c
pop edi
jmp 0x4bc9c5
lea eax, [ebp + 8]
lea esi, [esi + 0x4c5384]
push 0
push eax
push dword [esi]
call fcn.004bd6f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4012f4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x436114]
push dword [0x436118]
call fcn.00401272
push dword [0x436114]
mov edi, eax
add edi, 0x7519b6aa
push dword [0x436118]
call fcn.00401272
push dword [0x436114]
add eax, 0x7519b6e6
mov dword [ebp - 8], eax
push dword [0x436118]
call fcn.00401272
push dword [0x436114]
mov ebx, eax
add ebx, 0x7519b686
push dword [0x436118]
call fcn.00401272
push dword [0x436114]
add eax, 0x7519b68a
mov dword [ebp - 4], eax
push dword [0x436118]
call fcn.00401272
push dword [0x436114]
add eax, 0x7519b68e
mov dword [ebp - 0xc], eax
push dword [0x436118]
call fcn.00401272
mov esi, dword [ebp + 8]
and dword [ebp + 8], 0
add eax, 0x7519b692
add esp, 0x30
mov ecx, dword [edi + esi]
add ecx, dword [ebp - 8]
mov ecx, dword [ecx + esi]
add ecx, esi
mov edx, dword [ecx + ebx]
mov ebx, dword [ecx + eax]
mov dword [ebp - 8], edx
mov edx, dword [ebp - 4]
add ebx, esi
mov edi, dword [ecx + edx]
mov edx, dword [ebp - 0xc]
add edi, esi
mov edx, dword [ecx + edx]
add edx, esi
cmp dword [ebp - 8], 0
jbe 0x4013f2
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push dword [0x436114]
mov eax, dword [eax]
add eax, esi
push eax
call fcn.00401272
cmp eax, dword [ebp + 0xc]
pop ecx
pop ecx
je 0x4013f2
inc dword [ebp + 8]
add dword [ebp - 4], 4
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 8]
jb 0x4013c9
mov eax, dword [ebp - 8]
cmp dword [ebp + 8], eax
jne 0x4013fe
xor eax, eax
jmp 0x401414
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
movzx eax, word [ebx + eax*2]
mov eax, dword [edi + eax*4]
add eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a2b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x436ff0
cmp edx, dword [eax]
je 0x40a2db
add eax, 8
inc ecx
cmp eax, 0x437080
jl 0x40a2cc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x436ff0]
jne 0x40a409
mov eax, dword [0x43a640]
cmp eax, 1
je 0x40a3e3
test eax, eax
jne 0x40a30c
cmp dword [0x4369b0], 1
je 0x40a3e3
cmp edx, 0xfc
je 0x40a409
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a343
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040a4d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040a5c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40a386
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040a5c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x42ed5c
push edi
call fcn.0040c070
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040a4d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040a4e0
lea eax, [ebp - 0xa0]
push 0x42ed3c
push eax
call fcn.0040a4e0
push dword [esi + 0x436ff4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040a4e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040e0ad
add esp, 0x2c
pop edi
jmp 0x40a409
lea eax, [ebp + 8]
lea esi, [esi + 0x436ff4]
push 0
push eax
push dword [esi]
call fcn.0040a5c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x417ce0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00404fb0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x417dab
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x417dab
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x417d5e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x417d69
or bh, 8
and edi, 0x8000000
je 0x417d84
mov eax, dword [0x43c27c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x417dab
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret