joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5721af
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push edi
xor edi, edi
test ebx, ebx
jne 0x5721d2
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax], 1
mov dword [eax + 4], edi
jmp 0x57226f
push esi
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push ebx
call fcn.00571dba
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5721f5
push ebx
call fcn.00554588
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x57224b
mov esi, dword [ebp + 0x10]
xor eax, eax
inc eax
test esi, esi
cmovne eax, esi
push eax
call dword [0x75e3e0]
mov dword [ebp - 4], eax
pop ecx
push ebx
test eax, eax
jne 0x572220
call fcn.00554588
mov eax, dword [ebp + 8]
mov dword [eax], 3
jmp 0x57224b
push esi
push 1
push eax
call fcn.005547b8
push ebx
mov esi, eax
call fcn.00554588
add esp, 0x14
cmp esi, dword [ebp + 0x10]
je 0x572254
push dword [ebp - 4]
call dword [0x75e3e4]
mov eax, dword [ebp + 8]
mov dword [eax], 2
pop ecx
mov dword [eax + 8], edi
mov dword [eax + 4], edi
jmp 0x57226e
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0057215a
mov eax, dword [ebp + 8]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x575350
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x57537d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x57537d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x576ef8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x576f05
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.00576f0d

Function at 0x5779ee
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00583692
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x577a1b
xor eax, eax
jmp 0x577b17
mov eax, dword [ebp - 4]
mov ecx, bind
push 0x40
push 0x541a6a
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.00578aa4
push esi
push eax
call fcn.00541a80
add esp, 0x14
test eax, eax
je 0x577a56
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0058381f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00578a86
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0057a177
add esp, 0x28
test eax, eax
jne 0x577a8d
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x577ace
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005837f0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x577ac9
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x577afe
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0058375f
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.00583719
add esp, 0x14
jmp 0x577a14
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.005835df
push dword [ebp - 4]
call fcn.00577bbd
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x579f28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x579f5e
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x579f51
push eax
call fcn.00583705
push 2
call fcn.0058367e
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.0053fb70
add esp, 0xc
pop edi
pop esi
pop ebp
ret

Function at 0x57b3ab
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00583692
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x57b3d8
xor eax, eax
jmp 0x57b57c
mov eax, dword [ebp - 4]
mov ecx, bind
push 0x40
push 0x541a6a
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.00578aa4
push esi
push eax
call fcn.00541a80
add esp, 0x14
test eax, eax
je 0x57b425
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.0058381f
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00578a86
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.0057a177
add esp, 0x28
test eax, eax
jne 0x57b45c
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x57b498
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.005837f0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x57b498
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x57a247
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.0057a296
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x57b518
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.00576ae2
add esp, 0xc
cmp eax, 0xfffffffa
je 0x57b501
cmp eax, 0xfffffffc
je 0x57b4fa
cmp eax, 0xfffffffe
je 0x57b4f3
test eax, eax
je 0x57b513
push str.Unknown_zlib_error
jmp 0x57b506
push str.zlib_stream_error
jmp 0x57b506
push str.zlib_memory_error
jmp 0x57b506
push str.zlib_version_error
push dword [ebp - 4]
call fcn.00578ac0
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x57b548
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.0058375f
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.00583719
add esp, 0x14
jmp 0x57b3d1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.0058060f
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
leave
ret
Function at 0x5887a4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
mov esi, ecx
and dword [esi + 4], 0
mov dword [esi], vtable.SevenZip::CResStream.0
call dword [sym.imp.KERNEL32.dll_LockResource]
and dword [esi + 0x10], 0
mov dword [esi + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0xc], eax
mov eax, esi
pop esi
pop ebp
ret 8
Function at 0x5f41b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x5f41d7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x5f41c6
pop edi
movzx eax, dl
pop esi
ret

Function at 0x5fbf20
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.0048b8f0
push ebx
push esi
mov esi, dword [esp + 0x38]
xor ebx, ebx
mov eax, esi
sub eax, ebx
je 0x5fbf68
sub eax, 2
je 0x5fbf68
sub eax, 0x15
je 0x5fbf68
push 0x293
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.005d6170
add esp, 0x14
pop esi
xor eax, eax
pop ebx
add esp, 0x20
ret
call fcn.00600cb0
cmp eax, 1
jne 0x5fbf60
mov eax, dword [esp + 0x3c]
xorps xmm0, xmm0
movups xmmword [esp + 8], xmm0
push ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
push edi
xor edi, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], esi
movups xmmword [esp + 0x20], xmm0
test esi, esi
jne 0x5fbfa8
or eax, 0x400
mov dword [esp + 0x10], eax
cmp dword [esp + 0x3c], 1
jne 0x5fbfb6
or eax, 1
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x4c]
lea eax, [esp + 0x10]
push ebp
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x5fc00c
cmp esi, 8
je 0x5fc053
mov eax, dword [esp + 0x10]
test eax, 0x400
je 0x5fc01b
and eax, 0xfffffbff
mov edi, esi
or eax, 4
push ebp
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x5fbfd4
mov ebx, 1
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2d6
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.005d6170
test edi, edi
cmovne esi, edi
push esi
call fcn.005fc4b0
push eax
push 1
call fcn.005d5960
add esp, 0x20
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
push 0x2c7
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.005d6170
add esp, 0x14
pop edi
pop ebp
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ecx
pcmpeqw mm6, mm6
pxor mm7, mm7
push edx
psllw mm6, 0xf
push edi
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
movq mm1, qword [edx]
sub eax, 4
movq mm0, mm1
psrlq mm1, 0x20
jl 0x4010e4
jmp 0x401040
movq mm3, qword [edx + 8]
add edi, 8
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pcmpeqd mm7, mm7
psubd mm5, mm3
pslld mm7, 0x12
movq mm2, mm6
paddd mm4, mm7
psrld mm2, 0x1c
paddd mm5, mm7
movq mm3, mm2
psrld mm7, 0x1e
pand mm2, mm4
paddd mm4, mm7
psrld mm2, 3
pand mm3, mm5
paddd mm5, mm7
psrld mm3, 3
paddd mm4, mm2
paddd mm5, mm3
psrad mm4, 3
add edx, 0x10
psrad mm5, 3
add ecx, 8
packssdw mm4, mm5
movq mm0, mm1
pxor mm7, mm7
psrlq mm1, 0x20
sub eax, 4
movq qword [edi - 8], mm4
jge 0x401040
add eax, 4
jle 0x401185
movq mm3, qword [edx + 8]
punpckldq mm1, mm3
movq mm4, qword [ecx]
paddd mm0, mm1
pxor mm4, mm6
movq mm1, qword [edx + 0x10]
movq mm5, mm4
punpcklwd mm4, mm7
movq mm2, mm3
psrlq mm3, 0x20
paddd mm0, mm2
punpckldq mm3, mm1
psubd mm0, mm4
paddd mm2, mm1
punpckhwd mm5, mm7
pcmpeqd mm7, mm7
paddd mm3, mm2
pslld mm4, 4
psubd mm3, mm5
pslld mm5, 4
psubd mm4, mm0
pslld mm7, 0x12
psubd mm5, mm3
psrld mm6, 0x1c
paddd mm4, mm7
movq mm0, mm6
paddd mm5, mm7
psrld mm7, 0x1e
pand mm6, mm4
paddd mm4, mm7
psrld mm6, 3
pand mm0, mm5
paddd mm5, mm7
psrld mm0, 3
paddd mm4, mm6
paddd mm5, mm0
psrad mm4, 3
psrad mm5, 3
packssdw mm4, mm5
cmp eax, 2
jl 0x40117f
movd dword [edi], mm4
je 0x401185
psrlq mm4, 0x20
add edi, 4
movd edx, mm4
mov word [edi], dx
emms
pop edi
pop edx
pop ecx
ret

Function at 0x43cbef
Capabilities:
Check for vm using instruction vpcext
Encode data using xor

Disassembly:
out 0x94, al
imul esi, dword [ecx - 0x415589ad]
pop esi
dec esi
pop ds
sbb eax, 0xb992da21
xchg edi, eax
mov bl, dl
stosb byte es:[edi], al
bound esi, qword [edx + 0x69521a6]
xchg ebx, ebx
push edi
add al, 0x8e
in eax, dx
adc dword [ecx - 0xc5d6f51], esi
pop eax
invalid

Function at 0x44e50c
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
mov edi, 0xcfbe8293
fnstsw word [esi - 0x30]
cdq
mov ah, 0xbd
add esp, ecx
arpl word [0xf803dda3], ax
sbb dword ds:[ecx - 0x7189bccd], ebp
pop eax
xchg byte [edi + 0x47e5b16b], bl
xor dh, bh
invalid
Function at 0x49bb33
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esp
mov ah, 0xb9
xchg dword [edi], edx
cli
mov ecx, 0xfa271487
rcl byte [eax], 0xb1
je 0x49bae6
add al, dh
xchg esp, eax
rcr byte [0x7a056f8], cl
cmpsd dword cs:[esi], dword es:[edi]
rol ch, 1
iretd
in al, dx
inc eax
je 0x49bae8
mov esp, 0x4a888527
dec edx
xor dword [edx + 0x50], 0x897b00dd
mov bl, 0x4f
mov bl, 0x8a
cwde
push ebx
lcall 0x2350, 0xb95bbeb0
lcall 0x8e2b, 0x73453b31
mov edx, ecx
xchg ebp, eax
and eax, 0x397edd42
fstp xword [ebx - 0x2ec2276c]
and bh, ch
or al, 0xed
xchg edi, eax
out 0xf5, al
sub byte [ebp + 0x12271a75], al
cmp eax, 0x468f7da3
outsb dx, byte [esi]
inc ebp
push ebp
sahf
mov ecx, 0xeedef16a
add dh, ah
js 0x49bb3c
sub esp, dword [ebp - 0x3e]
fidiv dword [ebx + 0xaeca34e]
salc
pop ds
mov ebx, 0xc980dba6
sub dword [ecx + edi*8 + 0x6f], 0x20
sbb bl, dl
into
mov bl, 0x3b
xchg ebp, eax
xor dword [ebp + 0x684b27fb], 0x42
test dword [edx - 0x4d], 0xf27ba635
mov edx, 0x7eafdd12
iretd

Function at 0x627cc9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630390
cmp edx, dword [eax]
je 0x627ceb
add eax, 8
inc ecx
cmp eax, 0x630420
jl 0x627cdc
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630390]
jne 0x627e19
mov eax, dword [0x639d20]
cmp eax, 1
je 0x627df3
test eax, eax
jne 0x627d1c
cmp dword [0x6302bc], 1
je 0x627df3
cmp edx, 0xfc
je 0x627e19
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d53
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627d96
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca34
push edi
call fcn.0062aa10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286c0
lea eax, [ebp - 0xa0]
push 0x62ca14
push eax
call fcn.006286c0
push dword [esi + 0x630394]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a984
add esp, 0x2c
pop edi
jmp 0x627e19
lea eax, [ebp + 8]
lea esi, [esi + 0x630394]
push 0
push eax
push dword [esi]
call fcn.00628b40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40d5f9
Capabilities:
Encode data using xor

Disassembly:
push 0x3ee86f35
in al, dx
test al, 0x7a
call 0x7ae9c23c
in al, dx
std
cmp ebp, dword [ebx]
pop edx
jge 0x40d630
pop ebp
push 0x7a6c62de
pop esp
stosd dword es:[edi], eax
mov byte [ebx + 0x3b485ba8], bh
sub dword [edx], ebx
or dword [edx], edi
sub dword [edx + 0x4a], ebx
mov ecx, 0xb88a99aa
stosd dword es:[edi], eax
pop eax
dec esp
sbb eax, 0x5221330f
inc ecx
mov dl, 0xa2
xchg ecx, eax
xor byte [eax + 0x364457a4], 0x25
adc eax, 0x54273506
push edi
inc esp
and eax, 0x27350615
push esp
js 0x40d5f6
test al, 0x9b
mov dword [ecx + 0x384b59aa], edi
sub al, 0x1f
or al, 0x3e
sub eax, 0xa0bc4e5d
xchg edx, eax
xor dword [ecx + 0x344657a2], 0x39092b27
sub al, 0x5f
dec ebp
mov ebp, 0xb28093af
mov dword [0x27354550], eax
adc al, 0x38
or ebp, dword [eax]
pop ebx
dec edx
mov ecx, 0xbd8e9daa
scasd eax, dword es:[edi]
push edx
inc ebx
and eax, 0x2a3b3815
pop eax
dec edi
mov esp, 0xb28192a0
mov byte [0x23304251], al
pop ss
add eax, 0x47552636
mov ebp, dword [eax - 0x55467665]
pop eax
dec esp
aas
sub al, 0x1e
or eax, 0x4f5c2e3d
mov esp, 0xb08193af
movsb byte es:[edi], byte [esi]
push esi
inc edi
or ebp, dword [eax]
sbb cl, byte [edx]
cmp byte [ebx], ch
pop eax
dec esp
mov edi, 0xbc8e9ead
scasd eax, dword es:[edi]
push ebx
inc ecx
xor dword [ebx], esp
adc byte [ebx], al
xor byte [edi + edx*2], ah
inc esp
mov bh, 0xa4
xchg edi, eax
test dword [esi - 0x20b6945a], esi
dec esi
and al, 0x6c
sub byte [ecx - 0x40], al
sub ah, byte [ecx - 0x34]
cmpsd dword [esi], dword es:[edi]
loop 0x40d679
pop edx
bound ebp, qword [esi]
dec sp
daa
arpl word [edx], bp
inc esp
outsd dx, dword [esi]
sbb esp, dword [eax - 0x35]
mov eax, dword [0x63c8a2e8]
sub dword [ebx + 0x4e], esp
and al, 0x6e
and al, 0x4f
das
int3

Function at 0x428b42
Capabilities:
Encode data using xor

Disassembly:
cmp bl, dl
test eax, 0xaf2e9e06
xchg edi, eax
int1
push eax
push ecx
and ebp, dword [ecx - 0x2801afac]
add al, 0xea
push edi
invalid
je 0x428ad0
inc ecx
pop ecx
mov bh, 0x1c
pop es
jo 0x428b3b
cmp eax, 0x368f91c4
adc al, 0xc2
and cl, byte [eax - 0x7e]
mov eax, 0xdd702f1c
xchg esi, eax
lds ebx, [ebx]
and al, 0x13
imul edi, dword [edx], 0xc098734
sub dl, ah
inc esi
xor dword [esi], eax
push eax
invalid
Function at 0x451859
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
sbb dword [ebx], edi
fidiv dword [ebx - 0x6b]
push ebp
clc
pop esp
wait
adc ebp, ebx
inc ebp
retf 0x9c9b
or eax, 0xf163a86f
dec ebx
jecxz 0x4518a0
or ebx, edx
and edi, eax
aas
loopne 0x45185f
int 0xe
dec ecx
xor ecx, ebx
pop eax
cmpsd dword [esi], dword es:[edi]
pop edx
test eax, 0xf959a9db
pop ecx
stc
pop ecx
stc
jno 0x45187d
enter 0xffffffffffffcf06, 0x6c
mov dh, 0x3f
mov edx, 0x46e658a2
out 0x22, eax
arpl word [edi + 0x22], ax
retf
iretd
jb 0x4517f7
mov ah, 0x99
cmp byte [edi + 0x6d], dh
daa
in eax, 0xf1
mov dword [0x54d01f49], eax
daa
out dx, al
jno 0x45188c
mov al, 0x75
xchg esp, eax
sti
or edi, dword [edi]
jns 0x45183f
cmp edi, ebx
inc esi
mov esi, 0x9c9866e6
lds ebp, [ebx + 0x72b7b397]
push edi
invalid
add bl, byte [esi]
xchg ebp, eax
mov esi, 0x33a175a2
jno 0x4518c5
aam 0xe6
loop 0x45186e
push ds
jle 0x4518aa
invalid
jb 0x4518c7
add dword [edi - 0x56], edi
jg 0x451872
stosb byte es:[edi], al
jg 0x451915
jb 0x451853
xor byte [edx - 0x10bfa259], dh
cmp al, 0xf
xor al, 0x7a
pop edx
add eax, dword [ebx]
and al, byte [edi]
jg 0x45194d
sub eax, 0x6fbe6614
pop es
out 0xef, al
mov dl, 0x89
pop edi
jecxz 0x451905
invalid
inc edi
mov dl, 0x4f
and ebp, dword [ebx]
sbb eax, 0xfb38f24a
mov esi, dword [ebx]
pop ebx
in eax, dx
mov edi, 0x872985c
cwde
jb 0x451920
mov ebx, 0xf807aaca
jg 0x4518c4
in eax, dx
outsb dx, byte cs:[esi]
hlt
test eax, 0x29898700
cld
xchg esp, eax
and eax, dword [ecx - 0x5e]
stosd dword es:[edi], eax
rcr dword [edi + 0x72], 1
dec esp
pop esp
daa
stosb byte es:[edi], al
inc edi
popal
aas
invalid

Function at 0x480409
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ds
wait
int1
cmpsd dword [esi], dword es:[edi]
xor bh, byte [ebp + 0x54526a12]
cmc
aam 0x95
xor eax, eax
stc
outsb dx, byte [esi]
test esp, 0xe702d0b
test dword [ecx], edi
invalid
add al, 0x7e
push edi
mov bh, byte [esp + edi*4 - 0x77]
cmc
dec edx
xchg dword [edi], esp
mov ah, 0x24
pop ecx
ja 0x48039b
cmp byte [0x7f71f1e4], al
mov byte [ecx - 0x36], 0x3a
pop ebp
mov cl, 0xb4
cwde
dec esp
imul ecx, dword [edi - 0x35cb53cb], 0x5014756a
out 0x35, eax
lodsb al, byte [esi]
xor al, 0xca
push 0x75
adc al, 0x50
sbb ah, byte [edi]
push ecx
invalid
loope 0x4803f2
jb 0x4803cf
loop 0x48043e
ljmp 0x7ff7:0xfbb6e959
xor byte ss:[ebp + 0x71], dh
sub byte [ecx], dl
xchg ebx, eax
invalid
Function at 0x627cf9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630390
cmp edx, dword [eax]
je 0x627d1b
add eax, 8
inc ecx
cmp eax, 0x630420
jl 0x627d0c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630390]
jne 0x627e49
mov eax, dword [0x639d20]
cmp eax, 1
je 0x627e23
test eax, eax
jne 0x627d4c
cmp dword [0x6302b8], 1
je 0x627e23
cmp edx, 0xfc
je 0x627e49
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d83
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627dc6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca4c
push edi
call fcn.0062aa40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286f0
lea eax, [ebp - 0xa0]
push 0x62ca2c
push eax
call fcn.006286f0
push dword [esi + 0x630394]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a9b4
add esp, 0x2c
pop edi
jmp 0x627e49
lea eax, [ebp + 8]
lea esi, [esi + 0x630394]
push 0
push eax
push dword [esi]
call fcn.00628b70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x442004]
jne 0x40100a
repz ret
jmp fcn.00401899

Function at 0x40866e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040339f
and dword [ebp - 4], 0
cmp dword [0x444104], 0
mov ebx, eax
jne 0x40871f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4087d0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4087d0
push eax
call fcn.0040332d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x444104], eax
call esi
push eax
call fcn.0040332d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x444108], eax
call esi
push eax
call fcn.0040332d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44410c], eax
call esi
push eax
call fcn.0040332d
pop ecx
mov dword [0x444114], eax
test eax, eax
je 0x40871f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040332d
pop ecx
mov dword [0x444110], eax
mov eax, dword [0x444110]
cmp eax, ebx
je 0x408777
cmp dword [0x444114], ebx
je 0x408777
push eax
call fcn.004033a8
push dword [0x444114]
mov esi, eax
call fcn.004033a8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408777
test edi, edi
je 0x408777
call esi
test eax, eax
je 0x40876e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40876e
test byte [ebp - 0xc], 1
jne 0x408777
or dword [ebp + 0x10], 0x200000
jmp 0x4087b0
mov eax, dword [0x444108]
cmp eax, ebx
je 0x4087b0
push eax
call fcn.004033a8
pop ecx
test eax, eax
je 0x4087b0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4087b0
mov eax, dword [0x44410c]
cmp eax, ebx
je 0x4087b0
push eax
call fcn.004033a8
pop ecx
test eax, eax
je 0x4087b0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x444104]
call fcn.004033a8
pop ecx
test eax, eax
je 0x4087d0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4087d2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42e004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219