joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039a8
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x4036f8
mov al, byte [0x20fe0000]
jb 0x40392c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x403768
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x403981
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x403968
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x403938
pop edi
pop ebx
test esi, esi
je 0x40398a
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x40398f
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.00405aa1
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x403988
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x4039b6
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x4036e8
Function at 0x44e688
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x44e3d8
mov al, byte [0x20fe0000]
jb 0x44e60c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x44e448
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x44e661
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x44e648
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x44e618
pop edi
pop ebx
test esi, esi
je 0x44e66a
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x44e66f
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.00450781
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x44e668
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x44e696
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x44e3c8
Function at 0x4990c8
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x498e18
mov al, byte [0x20fe0000]
jb 0x49904c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x498e88
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x4990a1
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x499088
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x499058
pop edi
pop ebx
test esi, esi
je 0x4990aa
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x4990af
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.0049b1c1
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x4990a8
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x4990d6
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x498e08
Function at 0x4e3d18
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x4e3a68
mov al, byte [0x20fe0000]
jb 0x4e3c9c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x4e3ad8
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x4e3cf1
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x4e3cd8
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x4e3ca8
pop edi
pop ebx
test esi, esi
je 0x4e3cfa
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x4e3cff
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.004e5e11
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x4e3cf8
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x4e3d26
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x4e3a58
Function at 0x52e6d8
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x52e428
mov al, byte [0x20fe0000]
jb 0x52e65c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x52e498
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x52e6b1
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x52e698
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x52e668
pop edi
pop ebx
test esi, esi
je 0x52e6ba
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x52e6bf
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.005307d1
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x52e6b8
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x52e6e6
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x52e418
Function at 0x579488
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x5791d8
mov al, byte [0x20fe0000]
jb 0x57940c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x579248
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x579461
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x579448
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x579418
pop edi
pop ebx
test esi, esi
je 0x57946a
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x57946f
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.0057b581
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x579468
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x579496
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x5791c8
Function at 0x5c4b58
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x5c48a8
mov al, byte [0x20fe0000]
jb 0x5c4adc
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x5c4918
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x5c4b31
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x5c4b18
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x5c4ae8
pop edi
pop ebx
test esi, esi
je 0x5c4b3a
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x5c4b3f
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.005c6c51
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x5c4b38
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x5c4b66
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x5c4898
Function at 0x60f9d8
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ecx], bl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0x6a00ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x60f728
mov al, byte [0x20fe0000]
jb 0x60f95c
mov edi, esi
shr edi, 5
test byte [eax], al
add byte [ecx], al
mov edx, eax
shr edx, 0x10
mov ebx, eax
shr ebx, 8
and ebx, 0xa5
and edx, 0xff
mov edx, dword [edx*4 - 0x3b64c7f8]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0x2b]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
loopne 0x60f798
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x8e]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor ebx, dword [0x9b3c0000]
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x893408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor ebx, ebx
add byte [eax], al
rol cl, 1
ljmp 0x8eb
cmp esi, 4
jb 0x60f9b1
mov edx, esi
shr edx, 2
rol dword [eax], 1
add byte [ecx], al
add ecx, 4
mov edi, eax
shr edi, 0x10
and edi, 0xc400ff
add byte [edi*4 + 0x9b3808], bh
mov ebx, eax
shr ebx, 8
and ebx, 0xdc
xor edi, dword [ebx*4 + 0x9b3c08]
mov ebx, eax
shr ebx, 0x18
loopne 0x60f998
add byte [eax], cl
xor al, 0x9b
add byte [0xff], ah
xor edi, dword [eax*4 + 0xc608]
sub esi, 4
dec edx
mov eax, edi
jne 0x60f968
pop edi
pop ebx
test esi, esi
je 0x60f9ba
add byte [eax], al
mov dh, 0x11
xor edx, eax
and edx, 0xff
add byte [esi - 0x7e2fccef], dh
loop 0x60f9bf
adc dword [ebx], esi
rol byte [ecx + 0xffe2], 1
inc dword [eax]
add byte [eax], al
add byte [eax], al
add cl, al
call fcn.00611ad1
or byte [ebx + ebx*4], dh
shr eax, 8
and dword [eax], eax
add byte [eax], cl
xor al, 0x9b
add byte [ecx + 0x4e], al
jne 0x60f9b8
not eax
pop esi
ret
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x60f9e6
xor eax, eax
pop ebp
ret
sti
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x60f718
Function at 0x659a7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663168
cmp edx, dword [eax]
je 0x659a9f
add eax, 8
inc ecx
cmp eax, 0x6631f8
jl 0x659a90
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663168]
jne 0x659bcd
mov eax, dword [0xa68ab0]
cmp eax, 1
je 0x659ba7
test eax, eax
jne 0x659ad0
cmp dword [0x663094], 1
je 0x659ba7
cmp edx, 0xfc
je 0x659bcd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x659b07
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a460
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a8f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659b4a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a8f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eea4
push edi
call fcn.0065c7c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a460
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a470
lea eax, [ebp - 0xa0]
push 0x65ee84
push eax
call fcn.0065a470
push dword [esi + 0x66316c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a470
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065c734
add esp, 0x2c
pop edi
jmp 0x659bcd
lea eax, [ebp + 8]
lea esi, [esi + 0x66316c]
push 0
push eax
push dword [esi]
call fcn.0065a8f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x48edd4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9b30]
jne 0x48edde
repz ret
jmp fcn.00493887

Function at 0x491a11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9b30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048bfb2
and dword [ebp - 0x14], 0
cmp dword [0x4acb0c], 0
mov dword [ebp - 0x18], eax
jne 0x491ac4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x491b6c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x491b6c
mov esi, dword [fcn.00487fe0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4acb0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4acb10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4acb14], eax
call edi
push eax
call esi
mov dword [0x4acb1c], eax
test eax, eax
je 0x491ac4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4acb18], eax
mov eax, dword [0x4acb18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.00487fe4]
cmp eax, ecx
je 0x491b1d
cmp dword [0x4acb1c], ecx
je 0x491b1d
push eax
call esi
push dword [0x4acb1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x491b1d
test ebx, ebx
je 0x491b1d
call edi
test eax, eax
je 0x491b14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x491b14
test byte [ebp - 8], 1
jne 0x491b1d
or dword [ebp + 0x10], 0x200000
jmp 0x491b50
mov eax, dword [0x4acb10]
cmp eax, dword [ebp - 0x18]
je 0x491b50
push eax
call esi
test eax, eax
je 0x491b50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x491b50
mov eax, dword [0x4acb14]
cmp eax, dword [ebp - 0x18]
je 0x491b50
push eax
call esi
test eax, eax
je 0x491b50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4acb0c]
call esi
test eax, eax
je 0x491b6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x491b6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048edd4
leave
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x5f906d13
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x3e9b1e83
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
cld
mov edi, dword fs:[0x30]
mov edi, dword [edi + 0xc]
mov edi, dword [edi + 0x14]
shr ebx, 0x1f
shr ebx, 1
or ebx, 1
test ebx, ebx
je 0x401051
shr esi, 0x1f
shr esi, 1
add esi, dword [edi + 0x28]
mov edx, 0
lodsw ax, word [esi]
cmp ax, 0
je 0x401041
or al, 0x20
rol edx, 0x13
rol edx, 2
xor dl, al
jmp 0x40102d
mov ebx, dword [edi + 0x10]
mov edi, dword [edi]
push ecx
mov ecx, dword [ebp + 8]
push edx
sub edx, ecx
pop edx
pop ecx
jne 0x40101c
push eax
push ebx
pop eax
pop ebx
pop esi
pop edi
pop ebx
leave
ret 4
Function at 0x4170ff
Capabilities:
Access peb ldr_data
Encode data using xor

Disassembly:
mov edi, dword fs:[0x30]
push dword [edi + 0xc]
pop edi
push dword [edi + 0x14]
pop edi
push 0
pop esi
xor esi, dword [edi + 0x28]
push esi
call fcn.00417194
push eax
pop ecx
push dword [edi + 0x10]
pop eax
mov edi, dword [edi]
cmp ecx, dword [esp + 4]
jne 0x41710e
ret 4