joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7eaaa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x232000]
mov dword [edi + 0x2cd47c], 0x29901fdf
push edi
jmp 0x7eaaca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7eaad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7eaac0
mov eax, 1
add ebx, ebx
jne 0x7eaae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7eaaf4
jne 0x7eab13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7eab13
dec eax
add ebx, ebx
jne 0x7eab00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7eaad8
add ebx, ebx
jne 0x7eab0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7eab65
xor ecx, ecx
sub eax, 3
jb 0x7eab2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7eab9a
sar eax, 1
mov ebp, eax
jmp 0x7eab36
add ebx, ebx
jne 0x7eab36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7eab04
inc ecx
add ebx, ebx
jne 0x7eab44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7eab04
add ebx, ebx
jne 0x7eab51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7eab46
jne 0x7eab62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7eab46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7eab84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7eab76
jmp 0x7eaac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7eab84
add edi, ecx
jmp 0x7eaac6
pop esi
mov edi, esi
mov ecx, 0xef8d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7eaba2
cmp byte [edi], 0x26
jne 0x7eaba2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7eaba7
lea edi, [esi + 0x3d9000]
mov eax, dword [edi]
or eax, eax
je 0x7eac1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4403c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x44059c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7eabd4
mov ecx, edi
jns 0x7eac03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4405a4]
or eax, eax
je 0x7eac19
mov dword [ebx], eax
add ebx, 4
jmp 0x7eabf1
call dword [esi + 0x4405a0]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x7eac50
cmp al, 0xef
ja 0x7eac43
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x7eac25
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x7eac32
mov ebp, dword [esi + 0x4405a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7eac84
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x401230
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x401258
cmp dword [ebp - 4], 0x10
je 0x401258
mov dword [ebp - 8], 1
jmp 0x40125f
mov dword [ebp - 8], 0
mov al, byte [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x403ee6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40f050]
jne 0x403ef0
repz ret
jmp fcn.00404da6

Function at 0x409c9c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040557c
and dword [ebp - 4], 0
cmp dword [0x410728], 0
mov ebx, eax
jne 0x409d4d
push 0x40d12c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409dfe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40d120
push edi
call esi
test eax, eax
je 0x409dfe
push eax
call fcn.0040550a
mov dword [esp], 0x40d110
push edi
mov dword [0x410728], eax
call esi
push eax
call fcn.0040550a
mov dword [esp], 0x40d0fc
push edi
mov dword [0x41072c], eax
call esi
push eax
call fcn.0040550a
mov dword [esp], 0x40d0e0
push edi
mov dword [0x410730], eax
call esi
push eax
call fcn.0040550a
pop ecx
mov dword [0x410738], eax
test eax, eax
je 0x409d4d
push 0x40d0c8
push edi
call esi
push eax
call fcn.0040550a
pop ecx
mov dword [0x410734], eax
mov eax, dword [0x410734]
cmp eax, ebx
je 0x409da5
cmp dword [0x410738], ebx
je 0x409da5
push eax
call fcn.00405585
push dword [0x410738]
mov esi, eax
call fcn.00405585
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409da5
test edi, edi
je 0x409da5
call esi
test eax, eax
je 0x409d9c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409d9c
test byte [ebp - 0xc], 1
jne 0x409da5
or dword [ebp + 0x10], 0x200000
jmp 0x409dde
mov eax, dword [0x41072c]
cmp eax, ebx
je 0x409dde
push eax
call fcn.00405585
pop ecx
test eax, eax
je 0x409dde
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409dde
mov eax, dword [0x410730]
cmp eax, ebx
je 0x409dde
push eax
call fcn.00405585
pop ecx
test eax, eax
je 0x409dde
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x410728]
call fcn.00405585
pop ecx
test eax, eax
je 0x409dfe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x409e00
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ba00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40ba87
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40ba87
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40ba87
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0x14]
call fcn.00402310
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 0
mov ecx, dword [ebp + 0x14]
call fcn.00402350
push eax
call fcn.00404510
add esp, 0xc
mov al, 1
jmp 0x40ba89
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x40ba90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40be38
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x40f050]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x24]
call fcn.00402280
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push eax
push 0x40dac0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040ba00
add esp, 0x10
movzx eax, al
test eax, eax
je 0x40bb7d
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
je 0x40bb7d
mov dword [ebp - 0x2c], 0
push 0
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0x24]
call fcn.00402330
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.00402350
push eax
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40bb5b
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2d], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004022f0
mov al, byte [ebp - 0x2d]
jmp 0x40bb93
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2e], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004022f0
mov al, byte [ebp - 0x2e]
jmp 0x40bb93
mov byte [ebp - 0x2f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.004022f0
mov al, byte [ebp - 0x2f]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x493190
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x5c000]
push edi
jmp 0x4931aa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4931b1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4931a0
mov eax, 1
add ebx, ebx
jne 0x4931c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4931d4
jne 0x4931f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4931f3
dec eax
add ebx, ebx
jne 0x4931e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4931b8
add ebx, ebx
jne 0x4931ef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x493245
xor ecx, ecx
sub eax, 3
jb 0x49320b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x49327a
sar eax, 1
mov ebp, eax
jmp 0x493216
add ebx, ebx
jne 0x493216
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4931e4
inc ecx
add ebx, ebx
jne 0x493224
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4931e4
add ebx, ebx
jne 0x493231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x493226
jne 0x493242
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x493226
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x493264
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x493256
jmp 0x4931a6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x493264
add edi, ecx
jmp 0x4931a6
pop esi
mov edi, esi
mov ecx, 0x3021
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x493282
cmp byte [edi], 0x19
jne 0x493282
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x493287
lea edi, [esi + 0x90000]
mov eax, dword [edi]
or eax, eax
je 0x4932ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9410c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x94224]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4932b4
mov ecx, edi
jns 0x4932e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x94228]
or eax, eax
je 0x4932f9
mov dword [ebx], eax
add ebx, 4
jmp 0x4932d1
call dword [esi + 0x94238]
mov ebp, dword [esi + 0x9422c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x493333
sub esp, 0xffffff80
jmp 0x45282d
Function at 0x412722
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41274e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4127eb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x412815
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412790
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x41281a
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x412815
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0x408939
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.0040895c
mov ebx, 0x7c165a
xor dword [esi], eax
add esi, 1
add edx, edx
and ebx, edx
cmp esi, ecx
jne fcn.00408939
sub edx, ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409693
Capabilities:
Encode data using xor

Disassembly:
pop ss
push ebp
aaa
and bl, byte [esi - 0x28]
jae 0x409652
inc ebx
outsb dx, byte [esi]
xchg ecx, eax
out dx, eax
mov dl, 0x87
adc dl, al
or dword [ebp - 0x5c176ac0], 0xd779bfd0
sar byte [edi + 0x6d1bd779], 1
pop edi
xlatb
sbb ebp, dword [ebp + 0x5f]
dec ebp
arpl word [ebx], si
jbe 0x40969a
push ebx
enter 0x5ea5, 0x42
cmp dword [eax + 0x2b], 0x3c
cmp byte [ecx], ah
pop ecx
xor byte [ebx + 0x52fcd969], cl
and dword [ecx + 0x30], ebx
mov ebp, dword [ecx - 0x27]
cld
push edx
imul ebx, ecx, 0xe3e252fc
loop 0x40963f
sti
movsb byte es:[edi], byte [esi]
rep movsd dword es:[edi], dword [esi]
and al, 0x2b
pop ss
inc edx
cmp esi, dword [esi + 0x51]
enter 0x3fb, 0x53
daa
jmp 0x8db67576
stc
leave
adc ah, byte [eax + 0x30908ed1]
arpl word [edi], bp
xor byte [ebx + 0x2f], ah
jle 0x409656
pop edi
inc eax
loopne 0x409626
test eax, 0x72a9a23f
adc bh, byte [ebx]
jae 0x4096dd
inc ebx
xor edx, dword [edi + 0x43]
fimul word [eax]
stc
stc
xchg ebx, eax
add ebp, 0xffffffd4
loop 0x40963c
and esi, 0xffffffa2
pop ebx
mov al, byte [0x53231b11]
invalid
mov dl, 0xd6
fcmovnbe st(0), st(6)
out 0x33, al
cmp dl, byte [esi + 0x6f]
adc ebp, dword [edi - 0x2a]
stosd dword es:[edi], eax
and byte [edx + 0x15f40655], bh
invalid

Function at 0x45c1cf
Capabilities:
Encode data using xor

Disassembly:
in al, 0x6d
pop edi
rcr dword [edi], 1
lodsb al, byte [esi]
neg dword [ebx + esi*4 - 0x41]
invalid

Function at 0x464ff3
Capabilities:
Encode data using xor

Disassembly:
add ch, byte [edx]
mov ah, dl
invalid
dec ecx
push esp
adc al, 0x53
jne 0x464fe4
adc esp, edx
xor cl, 0xc1
add al, byte [ecx + 0x50120b93]
imul esi, dword [ecx - 0x1c6256b0], 0x5b708f06
out 0xff, eax
jae 0x464f89
dec esp
int 0x20
add ch, byte [ecx - 0x20c2e480]
add dword [ecx + edx + 0x2a], ebp
rcl dword [ecx + 0x51], 0xeb
cwde
jmp 0x465020
rcr byte [ecx - 0x1e], cl
mov edx, 0x18774989
adc ebx, dword [ebx + 0x1f1eb59]
aad 0x79
jns 0x464fa7
invalid
jl 0x465042
jns 0x464fa7
sar dword [edx + ecx*2 - 0x5e], 1
mov ecx, 0xd482b202
mul dword [ecx + 0x3b]
adc eax, 0x7dac7117
mov byte [0x82b202b9], al
aam 0xf7
popal
cmp edx, dword [0x7dac7117]
pop es
popal
rcl eax, 0xa2
push ebx
call 0x142b65fa
jp 0x465028
rcr eax, 0xd4
sbb bh, byte [ebp + 0x4b]
ror byte [ebp + edx*8 - 0xa], cl
hlt
jle 0x465033
cmp eax, 0x56c7d639
add dword [esi], esi
rcl dword [edx]
rcl dword ss:[edx]
pop edi
cmp al, byte [ecx - 0x78]
imul byte [ebp - 0x1e700c80]
xchg ecx, eax
mov ch, 0x73
jnp 0x46501d
invalid
out 0xca, eax
xor eax, 0x30d757ea
mov esp, 0x254aae8
adc esp, dword ss:[ebx + 0x27]
neg byte [ebx]
and byte [esi - 0x30a4f393], bl
and esi, ebx
pop edi
and dh, dl
mov ah, 0xdc
pop esp
xor ecx, dword [ecx - 0x22ec1c16]
jb 0x46504e
sahf
insd dword es:[edi], dx
or al, 0x5b
iretd
insb byte es:[edi], dx
and ebx, dword [edx + edx*4 - 0x1979ec45]
das
invalid

Function at 0x4730c3
Capabilities:
Encode data using xor

Disassembly:
aaa
ja 0x4730eb
dec ebp
xchg dword [edx - 0x63738326], edx
mov dh, 0xe1
invalid
loopne fcn.00473143
invalid
Function at 0x47f96b
Capabilities:
Encode data using xor

Disassembly:
inc ebp
inc ebx
dec eax
jl 0x47f92a
push esp
and eax, 0x95585a1c
mov ah, 0xbc
out dx, al
add ebx, dword [ebx + ecx*8 + 0x6163d682]
push ecx
inc ecx
xor dword [ecx + 0x49], eax
dec esp
jge 0x47f95a
cwde
xchg edx, eax
bound esi, qword [esi - 0xc87e350]
mov al, byte [0x5c5c2ea5]
inc eax
test byte [esi + ecx*4], bl
sub eax, 0x869adcd0
push edx
inc ecx
push edi
int3
pop esp
inc ecx
inc ebx
call dword [edx - 0xc9f839e]
adc dword [ebx], 0x65
mov ebp, 0xbec4bd41
aad 0x14
inc ecx
pop ebp
inc eax
pop edx
fimul word [ebp + 0x50]
dec ebp
mov al, 0x53
imul ecx, dword [ecx], 0xffffffff
jge 0x47f944
cmp byte [eax + 0x16608151], bl
pushal
push ss
dec ebx
dec ebp
scasd eax, dword es:[edi]
pop esp
jge 0x47f900
and byte [esi + 0x3f378e57], cl
adc dword [ebx + 0x3d], 0x8c2a2d01
and al, 0xa1
popfd
jo 0x47f9cf
dec edx
dec esp
xor byte [ecx + eax*4 + 0x58758143], bh
dec ecx
mov al, byte [0xa1458d4f]
add byte [ebp - 0x73], ch
pop edx
adc byte [ecx + 0x5ba27cac], 0xac
mov edx, 0xb7aa5b08
jno 0x47fa08
inc eax
in al, 8
imul esp, dword [ebp + 0x58], 0x9b875d4c
mov cl, 0xfd
or byte [esi + 0x7e], 0xbd
sbb byte [edx], ah
mov al, byte [0xe415d72]
add byte [eax], dh
mov al, byte [0xfa8ecdc8]
mov ecx, 0x58258693
xor dl, byte es:[eax - 0x57]
pop esp
jo 0x47f9b0
loopne 0x47fa32
popal
test byte [ebp - 0x65], al
sbb al, 0x10
jl 0x47f9ed
inc eax
mov edx, 0xe026b3cd
jno 0x47fa42
jno 0x47fa16
xor eax, 0xbf5d6c6c
cmpsb byte [esi], byte es:[edi]
mov cl, 0x51
mov edx, dword [edx - 0x1217493c]
and cl, byte [ecx + esi*2 + 0x65]
xchg edx, eax
les esi, [esi + 0x4c22ede8]
jno 0x47fa5b
inc edi
mov byte [ebx], dh
lcall 0x92f4, 0x723a919a
lahf
sbb al, 0x41
sahf
mov esi, 0x4f6d88a6
dec edi
mov dword [0xe6da96a2], eax
push ebp
xchg edx, eax
dec edx
sub esi, dword [edi - 0x19526861]
movsb byte es:[edi], byte [esi]
out 0xa4, al
cmp dword [esi + 0x13], ebx
cdq
and byte [edx + 0x28], bl
jno 0x47fa7d
adc eax, 0x34949b2e
xlatb
add eax, 0xfba76c6c
leave
dec esi
adc ecx, dword [ebx - 0x36]
mov ebp, 0x853f4a28
fcmovu st(0), st(3)
aad 0x4a
sub byte [edx + 0x3f], cl
test edx, ebx
fcmovnbe st(0), st(5)
dec edx
cmp ebx, dword [ebx + 0x6804a34f]
and dword [esi + 8], edx
mov eax, 0xe7188c89
or byte [eax - 0x18e77377], bh
mov dword [ebx + 0x49], 0x554e056b
outsb dx, byte [esi]
jne 0x47fa5d
or ebx, edi
or dword [edi + 0x6fc4e7c5], eax
dec edx
stosd dword es:[edi], eax
add eax, 0xcda20547
mov byte [ecx], cl
inc edi
add eax, 0x988cda2
cmpsd dword [esi], dword es:[edi]
invalid
or eax, 0x5bcfbbc9
and bh, bl
retf

Function at 0x4aca63
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0xf8
adc al, bl
and eax, dword [eax + eax - 0x38]
xchg edi, eax
add al, 0x62
xor eax, 0xdaa414c2
sub esp, dword [edx]
sbb dword [ecx + edx*2 + 8], esi
mov eax, dword [0xb11eb94a]
clc
pushal
jno fcn.004aca63
inc esi
inc edx
sbb al, 0x67
push es
retf
Function at 0x4ba905
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3398
cmp edx, dword [eax]
je 0x4ba927
add eax, 8
inc ecx
cmp eax, 0x4c3428
jl 0x4ba918
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3398]
jne 0x4baa55
mov eax, dword [0x4c7d1c]
cmp eax, 1
je 0x4baa2f
test eax, eax
jne 0x4ba958
cmp dword [0x4c32c0], 1
je 0x4baa2f
cmp edx, 0xfc
je 0x4baa55
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba98f
lea eax, [ebp - 0x1a4]
push 0x4bfb70
push eax
call fcn.004bb2f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb780
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba9d2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb780
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb6c
push edi
call fcn.004bd650
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bfb50
push eax
call fcn.004bb2f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb300
lea eax, [ebp - 0xa0]
push 0x4bfb4c
push eax
call fcn.004bb300
push dword [esi + 0x4c339c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb300
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bfb24
push eax
call fcn.004bd5c4
add esp, 0x2c
pop edi
jmp 0x4baa55
lea eax, [ebp + 8]
lea esi, [esi + 0x4c339c]
push 0
push eax
push dword [esi]
call fcn.004bb780
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4106f6
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x410735
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x410735
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x410735
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x410735
cmp dword [ecx + 0x74], 0xe
jbe 0x410735
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41f555
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436160
push 0x436158
push str.FlsAlloc
push 0x1e
call fcn.0041f41f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f589
push dword [ebp + 8]
mov ecx, esi
call dword [0x430158]
call esi
jmp 0x41f58f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x41f5d3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x436170
push 0x436168
push str.FlsGetValue
push 0x20
call fcn.0041f41f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41f60a
push dword [ebp + 8]
mov ecx, esi
call dword [0x430158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]