joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a3246f6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x2a324705
pop dword [ebp - 0x48]
mov eax, 0x2a324705
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x460c375c
sub dword [ebp - 0x58], 0xf7b9f211
mov dword [ebp - 0x54], 0xa0edcb48
add dword [ebp - 0x54], 0x914580fd
mov dword [ebp - 0x50], 0xa2213557
sub dword [ebp - 0x50], 0x55d4f129
mov dword [ebp - 0x4c], 0x794f0ece
add dword [ebp - 0x4c], 0x86b0f132
lea eax, [ebp - 0x58]
push eax
mov eax, 0x6ba8f3e3
sub eax, 0x4173735f
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xb8266c08
add dword [ebp - 0x58], 0xbc4bfd4e
mov dword [ebp - 0x54], 0x48660b2a
add dword [ebp - 0x54], 0xf906564b
mov dword [ebp - 0x50], 0xb495cfec
add dword [ebp - 0x50], 0xaed99c80
mov dword [ebp - 0x4c], 0x8f2991fb
sub dword [ebp - 0x4c], 0x8f2991fb
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xb0bb3fd3
sub eax, 0x8685bf47
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x4da04
push 0
call eax
mov ecx, 0xf9717867
add ecx, 0x68edc6a
mov edi, eax
mov ebx, 0x5bd07df5
sub ebx, 0x319887f5
add ebx, dword [ebp - 0x48]
mov esi, 0x9ea91925
add esi, 0x79965748
xor dword [ebp - 0x44], 0xde390ece
mov edx, dword [ebx]
add edx, esi
add dword [ebp - 0x18], 0x7a6a88aa
mov dword [edi], edx
sub dword [ebp - 8], 0x53cf5ab9
add edi, 0xb59bc0cd
add edi, 0x4a643f37
add ebx, 0xfb05b977
add ebx, 0x4fa468d
loop 0x2a324822
add eax, 0xe258a46
add eax, 0xf1dbbbd1
mov ebx, eax
add eax, 0x69ca8d6
sub eax, 0x69ca8d1
mov ecx, 0x2a300000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x2a32caab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x2a35572a
call fcn.2a304215
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x2a32cccc
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.2a3246f6
add esp, 0x10
test eax, eax
js 0x2a32ccc6
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x2a32cb4f
push edi
call fcn.2a32df9a
pop ecx
test al, al
je 0x2a32cb4f
mov eax, edi
call fcn.2a352aa0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x2a32cb61
push edi
lea ecx, [ebp - 0x424]
call fcn.2a3246f6
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.2a3246f6
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x2a32ccc6
push 0x60
push ebx
push eax
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x2a32cbb9
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.2a32e256
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x2a32cbb9
call fcn.2a32b317
mov ebx, eax
jmp 0x2a32cc95
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x2a32cbe0
call fcn.2a32b317
jmp 0x2a32cc88
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x2a32cbd6
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x2a32cc13
mov ebx, 0x8007000e
jmp 0x2a32cc8a
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.2a3246f6
jmp 0x2a32cc39
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x2a32cc0c
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.2a3246f6
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.2a3246f6
mov ebx, eax
test edi, edi
je 0x2a32cc95
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x2a32ccae
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccbe
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32ccb4
mov eax, ebx
jmp 0x2a32ccfa
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x2a32cce1
lea ecx, [ebp - 0x418]
call fcn.2a32b98d
or dword [ebp - 4], 0xffffffff
jmp 0x2a32ccf1
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x2a32cce7
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.2a30424f
ret 0x10
Function at 0x4116e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4116ef
pop dword [ebp - 0x20]
mov eax, 0xd61e5f28
add eax, 0x2a22b7c7
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3d996
push 0
mov eax, 0xcc3cf1e9
add eax, 0x3405602f
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x2db39479
sub ecx, 0x2db34d50
xor edx, edx
add edx, eax
mov ebx, 0x435400
add ebx, dword [ebp - 0x20]
mov edi, 0x700f9be3
add edi, 0x689ba528
add dword [ebp - 0x14], 0xe959076d
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xcbe75882
xor esi, edi
sub dword [ebp - 8], 0x7de75f36
mov dword [edx], esi
mov dword [ebp - 0x1c], 0xd8f1bddd
add edx, 0x3f7becbb
add edx, 0xc0841349
add ebx, 0x9c368a68
sub ebx, 0x9c368a64
loop 0x41174a
add eax, 0x10f77
mov ebx, eax
add eax, 0x4fe33771
sub eax, 0x4fe3376c
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.00408518
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.00408518
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.00408518
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.00408518
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.00408518
mov dword [0x41203c], eax
call fcn.00408518
test eax, eax
jge 0x402550
push 8
call fcn.00408518
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.00408518
pop ecx
push 1
call fcn.00408518
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.00408518
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.00408518
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.00408518
jmp 0x402495

Function at 0x408518
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x408527
pop dword [ebp - 0x40]
mov eax, 0x408527
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3e480
push 0
mov eax, 0xc631b664
sub eax, 0xc5f0d58c
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x5bce
xor esi, esi
add esi, eax
mov edi, 0x5b3209
sub edi, 0x19f645
add edi, dword [ebp - 0x40]
mov edx, 0x27197b9f
mov ebx, dword [edi]
sub dword [ebp - 0x18], 0x5fdb156d
sub ebx, edx
xor dword [ebp - 0x1c], 0x8d5ff6fd
mov dword [esi], ebx
add dword [ebp - 4], 0xb6d1aeb2
add esi, 4
add edi, 4
loop 0x408577
add eax, 0xed3683ae
add eax, 0x12cade5d
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x10015057
Capabilities:
Enumerate processes

Disassembly:
push 0x238
mov eax, 0x1002dffa
call fcn.10016e35
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x10015074
xor eax, eax
jmp 0x10015151
xor edi, edi
push edi
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x1001514f
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x23c], 0x22c
push eax
push esi
call sub.kernel32.dll_Process32FirstW
jmp 0x10015125
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.1000127b
push ebx
lea ecx, [ebp - 0x240]
mov dword [ebp - 4], edi
call fcn.1000127b
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 1
call fcn.10001cc6
lea ecx, [ebp - 0x240]
call fcn.10001cc6
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.10029d64
pop ecx
pop ecx
mov ecx, dword [ebp - 0x240]
lea ecx, [ecx - 0x10]
test al, al
jne 0x1001512f
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.10001eb4
lea eax, [ebp - 0x23c]
push eax
push esi
call sub.kernel32.dll_Process32NextW
test eax, eax
jne 0x100150a4
jmp 0x10015148
mov edi, dword [ebp - 0x234]
call fcn.10001eb4
mov ecx, dword [ebp - 0x244]
add ecx, 0xfffffff0
call fcn.10001eb4
push esi
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, edi
call fcn.10016ddf
ret

Function at 0x10029d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x10029d73
pop dword [ebp - 0x48]
mov eax, 0xb3c47eca
add eax, 0x5c3e1ea9
sub dword [ebp - 0x48], eax
push 0x40
push 0x1000
push 0x3e8a1
push 0
mov eax, 0x8a0062f7
add eax, 0x86029e65
add eax, dword [ebp - 0x48]
call dword [eax]
mov ecx, 0x40ca
xor edx, edx
add edx, eax
mov ebx, 0x8dd97a4c
add ebx, 0x822b41b4
add ebx, dword [ebp - 0x48]
mov edi, 0x6fee2ce
xor dword [ebp - 0x3c], eax
mov esi, dword [ebx]
xor dword [ebp - 0x20], 0x3e4b4a59
add esi, edi
sub dword [ebp - 4], esi
mov dword [edx], esi
mov dword [ebp - 0x20], 0x4153c17b
add edx, 0x229a8741
add edx, 0xdd6578c3
add ebx, 4
loop 0x10029dc8
add eax, 0x98f7988b
sub eax, 0x98f6a290
xor ebx, ebx
add ebx, eax
add eax, 0xbb5fc81
sub eax, 0xbb5fc7c
mov ecx, 0xb858ecc0
sub ecx, 0xa858ecc0
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x409be9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x409bf8
pop dword [ebp - 0x2c]
mov eax, 0xbc05a4d3
add eax, 0x443af725
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x81522bb5
sub dword [ebp - 0x3c], 0x32ffe66a
mov dword [ebp - 0x38], 0x1d20cab6
sub dword [ebp - 0x38], 0xeaed7e71
mov dword [ebp - 0x34], 0x1a50a862
add dword [ebp - 0x34], 0x31fb9bcc
mov dword [ebp - 0x30], 0xe002680a
add dword [ebp - 0x30], 0x1ffd97f6
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x25330a2c
add eax, 0xdb0f2648
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0x51a12756
add dword [ebp - 0x3c], 0x22d14200
mov dword [ebp - 0x38], 0xc41cc166
add dword [ebp - 0x38], 0x7d4fa00f
mov dword [ebp - 0x34], 0x36589432
sub dword [ebp - 0x34], 0xd2e927c6
mov dword [ebp - 0x30], 0xc40da89b
sub dword [ebp - 0x30], 0xc40da89b
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3cf3f
push 0
call eax
mov ecx, 0xbc2807
sub ecx, 0xbbe381
xor edi, edi
add edi, eax
mov ebx, 0xe6e9ef1d
add ebx, 0x195954e3
add ebx, dword [ebp - 0x2c]
mov esi, 0x560bef80
mov edx, dword [ebx]
mov dword [ebp - 0x18], 0x1ad70fb5
xor edx, esi
mov dword [ebp - 4], 0xd253318a
mov dword [edi], edx
add dword [ebp - 4], eax
add edi, 0x8af3633b
add edi, 0x750c9cc9
add ebx, 0xb7514541
sub ebx, 0xb751453d
loop 0x409d11
add eax, 0x46fb26a7
add eax, 0xb905de44
mov ebx, eax
add eax, 0x270ac75f
sub eax, 0x270ac75a
mov ecx, 0x2495d110
sub ecx, 0x2455d110
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40c7d0
mov ecx, 0x697257c0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x3cb85d7a
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401d40
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x4071e4
call sym._EnterCriticalSection_4
mov ebx, dword [0x4071dc]
sub esp, 4
test ebx, ebx
je 0x401d8b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x401d84
test esi, esi
je 0x401d84
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401d60
mov dword [esp], 0x4071e4
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x401f70
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x401fc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402098
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x401ffe
cmp eax, 4
jne 0x402020
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40200e
cmp edx, 4
je 0x40200e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00401f70
Function at 0x4512ca
Capabilities:
Encode data using xor

Disassembly:
enter 0x7706, 0xffffffffffffffe0
cmp esi, dword [ebx]
arpl word [ebx - 0x5dffd9cf], cx
inc edi
fsubr qword [ecx - 0x2f23b938]
sbb eax, 0x51537825
shl dword [esi - 0x64], 1
and byte [eax - 0x4fc4165], cl
invalid

Function at 0x4c045a
Capabilities:
Encode data using xor

Disassembly:
xor bl, ah
mov eax, 0x53033744
sbb esp, esp
mov byte [0x882cab88], al
push ebx
xor cl, byte [ebx - 0x2a2acc58]
add byte [edx + ebx*8 - 0x10], dh
in eax, 0x35
rol byte [esi + 0x1e], cl
mov bh, 0xc9
xor dword [ecx - 0x61dd3452], ebx
cmp ebp, dword [ecx]
leave
mov ebx, 0xeccfe76
mov dl, 0x14
inc ebx
je 0x4c04c2
add ebx, dword [edx + 0x745c491d]
and eax, 0xb10b3c68
pushfd
sbb eax, 0x25745c49
push 0x9cb10b3c
sbb al, 0x39
insb byte es:[edi], dx
xor byte [ebp + 0x771e54fa], bh
adc ebp, eax
cmp esi, dword [edi - 0x24]
call [0xab74300f]
add byte [esi], bh
je 0x4c048f
arpl word [0x85368e37], dx
mov bl, byte [ebp - 0x632891e6]
invalid
xchg ebp, eax
add dword [edi + eax + 0x572c1f3a], esp
mov ebx, 0xa61b4791
xchg ebx, eax
pop ecx
xchg edx, eax
push ebp
retf 0xae61

Function at 0x4e3e7a
Capabilities:
Encode data using xor

Disassembly:
jae 0x4e3ec8
pop eax
add ecx, ecx
cdq
cmp edi, dword [ecx]
lodsd eax, dword [esi]
add byte [edx + 1], cl
push edx
ret
int 0xbd
sti
sub al, 0x19
mov cl, 0x47
sbb eax, 0x4a618b89
mov dword [ebx - 0x6d9eb59f], ecx
mov esp, dword [ecx + 0x4a]
popal
xchg edx, eax
push cs
dec edx
and bh, ah
mov bl, 0x11
mov al, 0xc5
pop esi
mov al, 0x61
popal
xor esi, edi
enter 0x3310, 0x1a
loopne 0x4e3eb8
mov ebp, 0x1b18c237
leave
mov gs, word [ecx + ebp*4]
pop esp
mov byte [0xdc8c6023], al
dec ebp
jb 0x4e3eb2
xor byte [eax + 0x5f], ch
add dword [edi], 0x6b
lahf
cmp edx, eax
push ebp
and bh, byte [eax]
mov cl, 0xdc
rol bl, 1
pop ss
jb 0x4e3eb0
fisubr word [ebx]
inc edi
xchg edx, eax
sar byte [edi - 0x2a150b78], 1
jl 0x4e3eb9
push eax
cmp eax, 0x9b621c53
cmc
push es
enter 0x5337, 0x25
mov dh, 0x79
mov eax, ebp
retf 0xc55a
Function at 0x5c16ca
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x3c8d3090
sub ecx, eax
out 0x94, al
xchg esi, eax
push esp
out 0x12, al
adc dword [ebx + 0x76], esi
jp 0x5c16c9
in al, dx
retf 0x60a4
mov dword [0xea24d013], eax
fisttp qword [edx - 0x51]
scasd eax, dword es:[edi]
outsb dx, byte [esi]
adc eax, 0xb3466e72
jp 0x5c16ed
jae 0x5c16b9
out dx, al
cmp byte [ecx], ah
sub al, byte [0x18063126]
js 0x5c1745
cdq
jno 0x5c16d9
jle 0x5c165e
test byte [eax + 0x59391483], ah
mov al, byte [0x59391483]
pop eax
mov ch, 0x95
lahf
mov eax, 0x733292b8
cmpsb byte [esi], byte es:[edi]
call 0xa1429707
rcl byte [ecx + 9], 0x31
mov al, byte [0x310951c0]
xor ebp, dword [ecx]
jbe 0x5c175f
xchg esi, eax
mov ch, 0x31
sbb dword [ecx - 0x2d6a4ebf], edi
popal
nop
xchg ebp, eax
shl byte [ecx - 0x70], cl
add esp, dword [edx - 0x517d5339]
jae 0x5c16fd
lodsd eax, dword [esi]
cwde
jg 0x5c16c0
dec edx
push es
jb 0x5c171d
push edx
push es
inc edx
mov al, ch
cmp eax, 0xdddf737c
mov dx, 0x521d
int3
sbb eax, 0x51a8cc52
mov al, byte [0x3968a09a]
add byte [edi], 0xb6
insb byte es:[edi], dx
in eax, 0xed
push ecx
loope 0x5c1794
sbb dword [edx], ecx
shr edi, 0xf8
pushal
sti
xchg edx, eax
jle 0x5c1759
mov cl, 0x37
pushal
push esi
rcr dword [ebx + 0x46509260], 1
cmp bh, byte [ebp - 0x66671fb7]
adc dl, byte [eax]
and al, 0xc3
rol byte [edi - 0x33e518f], 0x60
sub eax, dword [eax + 0x31]
nop
adc al, 0x6e
js 0x5c17bf
xor dword [eax + 0x60786e14], edx
or dword [eax + esi*4 + 0x16], ebx
int 0x31
inc ebx
jmp 0x36e5ab36
or ch, byte [edx - 0x79d80e4f]
js 0x5c17fd
fdivr qword [esi + ecx*8 + 0x76]
invalid
mov eax, 0x5d8d453b
pop ebp
add ebx, eax
mov al, byte [0xd0dfb762]
pushal
sub dword es:[eax + 0x39], ecx
adc ebx, dword [eax - 0x50]
or edx, dword [edi - 0xe]
and al, cl
xor ecx, dword [ecx - 0x714e3fc7]
pushfd
bound ecx, qword [ecx + 0x60]
mov esi, 0xb455ca5f
rol dword [ecx], 0x20
pop ds
push ds
nop
mov word [edi - 0x198ac420], gs
push ebx
jge 0x5c17c3
mov ebx, 0x13f54e1a
mov ebp, 0x5b709d1e
popfd
jo 0x5c185b
invalid

Function at 0x60a7e5
Capabilities:
Encode data using xor

Disassembly:
sahf
jmp 0x99e0a58f
out 0xef, al
mov al, 0xb8
movsd dword es:[edi], dword [esi]
pop esi
pop ebx
out 0x60, eax
cmpsd dword [esi], dword es:[edi]
rcr dh, cl
aam 0xcc
lea ecx, [ebx - 0x67b61a6b]
jg 0x60a7a2
cmp bh, byte [edi + 0x77e3910]
push 0x875b9c12
jg 0x60a828
ror byte [ebx - 0x5f], cl
push eax
dec eax
pop ebp
rcl byte [ecx - 0x51b142c2]
sub ah, byte [edi]
out dx, al
nop
lcall 0x8fa0, 0xfd2d5e70
or al, 0xe2
hlt
rol cl, 0xcf
wait
cmp dh, byte [esi]
adc byte [ebp - 0x5554bce0], bl
and byte [ebx + 0x6959cb43], dh
dec ecx
in eax, dx
mov byte [0x94f7aa49], al
outsd dx, dword [esi]
mov edi, esi
test eax, 0xa6004335
or byte [esi - 0x45936363], ch
sahf
bound esp, qword [ebx + 0x6fea7ad1]
xor dword [ebp - 0x55], ebp
cmp eax, 0xd5287b2f
jge 0x60a841
shl byte [ecx - 0x6e], cl
add ebp, edi
cmc
jg 0x60a88c
int3
jmp 0x60a80e
Function at 0x64e4ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x659368
cmp edx, dword [eax]
je 0x64e50f
add eax, 8
inc ecx
cmp eax, 0x6593f8
jl 0x64e500
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x659368]
jne 0x64e63d
mov eax, dword [0xa5ccc0]
cmp eax, 1
je 0x64e617
test eax, eax
jne 0x64e540
cmp dword [0x659294], 1
je 0x64e617
cmp edx, 0xfc
je 0x64e63d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e577
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064eed0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f360
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e5ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f360
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65409c
push edi
call fcn.00651230
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064eed0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064eee0
lea eax, [ebp - 0xa0]
push 0x65407c
push eax
call fcn.0064eee0
push dword [esi + 0x65936c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064eee0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.006511a4
add esp, 0x2c
pop edi
jmp 0x64e63d
lea eax, [ebp + 8]
lea esi, [esi + 0x65936c]
push 0
push eax
push dword [esi]
call fcn.0064f360
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
adc bh, byte [esp + edx*8 + 0x5b]
inc edx
and eax, 0xf447dc60
pop ecx
dec ebp
test dword [edi + 0x1db1f731], esi
dec ebx
pop eax
mov ecx, 0xe375610a
xor ecx, edi
invalid