joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100c9e8
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0100d291

Function at 0x100cb7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], 4
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
je 0x100cced
cmp dword [ebp + 0xc], ebx
je 0x100cced
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0x1007ad8
call fcn.01009883
cmp eax, ebx
mov dword [ebp + 8], eax
jl 0x100ccc4
push esi
push ebx
push dword [ebp - 8]
mov esi, 0x80000002
push esi
call fcn.0100a819
test eax, eax
jne 0x100cbdc
mov dword [ebp + 8], 0x80070057
cmp dword [ebp + 8], ebx
jl 0x100ccc3
push edi
xor eax, eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
pop edi
cmp eax, ebx
jne 0x100cc75
mov esi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push 0x1007ac4
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x100cc75
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x1007ab0
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x100cc75
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x1007aa0
push dword [ebp - 4]
call esi
cmp eax, ebx
jne 0x100cc75
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1007a8c
push dword [ebp - 4]
call esi
cmp eax, ebx
je 0x100cc84
jle 0x100cc81
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp ecx, ebx
jne 0x100cc99
cmp eax, ebx
jne 0x100cc99
mov dword [ebp + 8], 0x8007139f
cmp dword [ebp + 8], ebx
jl 0x100ccc3
sub ecx, dword [ebp - 0x1c]
push ebx
sbb eax, dword [ebp - 0x18]
push 0x2710
push eax
push ecx
call fcn.0100d560
cmp edx, ebx
je 0x100ccbe
mov dword [ebp + 8], 0x80070216
jmp 0x100ccc3
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
pop esi
cmp dword [ebp - 4], ebx
je 0x100ccd2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], ebx
je 0x100cce8
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp + 8]
jmp 0x100ccf2
mov eax, 0x80070057
pop ebx
leave
ret 8
Function at 0x100db07
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 4], 0xffffffff
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 8], ebx
cmp dword [ebp + 8], ebx
jne 0x100db29
mov esi, 0x80070057
jmp 0x100dc08
cmp dword [ebp + 0xc], ebx
je 0x100db1f
cmp dword [ebp + 0x10], ebx
je 0x100db1f
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0100d7cd
cmp dword [ebp - 4], 0xffffffff
jne 0x100db6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100d761
mov esi, eax
jmp 0x100dc08
push dword [ebp - 4]
call fcn.0100d743
mov byte [ebp + 0xb], al
cmp al, bl
je 0x100db81
xor eax, eax
jmp 0x100db84
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x100db5b
cmp dword [ebp - 0xc], ebx
jne 0x100db1f
push edi
push esi
call fcn.01008844
pop ecx
lea ecx, [ebp - 8]
mov edi, eax
call fcn.0100d8d5
cmp edi, ebx
jne 0x100dbbb
mov dword [ebp - 8], ebx
mov esi, 0x8007000e
jmp 0x100dc07
mov dword [ebp - 8], edi
cmp byte [ebp + 0xb], bl
je 0x100dbc7
xor eax, eax
jmp 0x100dbca
mov eax, dword [ebp - 4]
push ebx
lea ecx, [ebp - 0x10]
push ecx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100dbec
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0100d761
mov esi, eax
jmp 0x100dc07
cmp dword [ebp - 0x10], esi
je 0x100dbf8
mov esi, 0x8000ffff
jmp 0x100dc07
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], ebx
mov dword [eax], edi
mov esi, ebx
pop edi
lea ecx, [ebp - 8]
call fcn.0100d8d5
lea ecx, [ebp - 4]
call fcn.0100d7a9
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x100e2e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc8
mov eax, dword [0x101000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc0], eax
xor ebx, ebx
lea eax, [ebp - 0xc8]
push eax
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xb8], ebx
mov esi, 0x20019
call fcn.0100dd6b
cmp eax, ebx
mov dword [ebp - 0xac], eax
jl 0x100e4ac
cmp dword [ebp - 0xc8], 1
jne 0x100e34a
mov esi, 0x20119
mov eax, 0x10082f8
cmp dword [ebp + 8], ebx
jne 0x100e359
mov eax, 0x1008298
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xb4]
push ecx
push esi
push ebx
push eax
push 0x80000002
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
push eax
call fcn.0100d646
test eax, eax
je 0x100e4ac
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
lea ecx, [ebp - 0xc4]
push ecx
push ebx
push 0x1008274
mov esi, 0xa4
push eax
mov dword [ebp - 0xc4], 3
mov dword [ebp - 0xbc], esi
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
push eax
call fcn.0100d646
test eax, eax
je 0x100e4ac
cmp dword [ebp - 0xbc], esi
je 0x100e3ec
mov dword [ebp - 0xac], 0x8000ffff
jmp 0x100e4ac
cmp dword [ebp - 0xa8], esi
jne 0x100e3dd
cmp edi, ebx
je 0x100e412
push edi
push 0x10
lea eax, [ebp - 0x74]
push eax
call fcn.0100ecdc
cmp eax, ebx
mov dword [ebp - 0xac], eax
jl 0x100e4ac
mov edi, dword [ebp - 0xc0]
cmp edi, ebx
je 0x100e4ac
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0100dfff
cmp eax, ebx
mov dword [ebp - 0xac], eax
jl 0x100e4ac
mov eax, dword [ebp - 0xb8]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x100858c
push eax
call esi
pop ecx
pop ecx
test eax, eax
jne 0x100e45f
mov dword [edi], 1
jmp 0x100e4ac
mov edi, dword [ebp - 0xb0]
push 0x100857c
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x100e4a1
push 0x1008560
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x100e4a1
push 0x1008548
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x100e4a1
push 0x1008530
push edi
call esi
pop ecx
pop ecx
test eax, eax
je 0x100e4a1
xor eax, eax
jmp 0x100e4a4
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], eax
lea ecx, [ebp - 0xb8]
call fcn.0100d8f1
lea ecx, [ebp - 0xb0]
call fcn.0100d8f1
lea ecx, [ebp - 0xb4]
call fcn.0100d9a9
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xac]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100919d
leave
ret 0xc
Function at 0x10015d2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0xc]
push eax
push 1
xor esi, esi
push esi
push 0x10012b0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100163a
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x1001294
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], 4
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001631
cmp dword [ebp - 4], 4
jne 0x1001631
cmp dword [ebp - 8], 1
jne 0x1001631
inc esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x1003f27
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1003f64
push 3
push 1
push 0x10
push 2
push dword [0x1006304]
call fcn.01003e13
add esp, 0x14
push 0x1006310
call dword [sym.imp.GDI32.dll_RemoveFontResourceW]
push 2
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop ebp
ret 4

Function at 0x1004322
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x10047e0
call fcn.010044e4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x1006f30
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10040d9
cmp eax, esi
jne 0x10040cc
xor esi, esi
inc esi
mov ebx, esi
jmp 0x10040dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10040b3
xor esi, esi
inc esi
mov eax, dword [0x1006f2c]
cmp eax, esi
jne 0x10040ef
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x100411e
mov eax, dword [0x1006f2c]
test eax, eax
jne 0x1004118
mov dword [0x1006f2c], esi
push 0x1001244
push 0x1001238
call fcn.01004018
pop ecx
pop ecx
test eax, eax
je 0x100411e
jmp 0x1004246
mov dword [0x100697c], esi
mov eax, dword [0x1006f2c]
cmp eax, esi
jne 0x1004142
push 0x1001234
push 0x100122c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x1006f2c], 2
test ebx, ebx
jne 0x100414e
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x1006f34], 0
je 0x1004172
push 0x1006f34
call fcn.01004459
pop ecx
test eax, eax
je 0x1004172
push 0
push 2
push 0
call dword [0x1006f34]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x10041ce
test al, al
je 0x100418c
cmp dword [ebp - 0x1c], 0
jne 0x10041ce
mov al, byte [esi]
test al, al
je 0x100419c
cmp al, 0x20
ja 0x100419c
inc esi
mov dword [ebp - 0x20], esi
jmp 0x100418c
test byte [ebp - 0x3c], 1
je 0x10041a8
movzx eax, word [ebp - 0x38]
jmp 0x10041ab
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x1006978], eax
cmp dword [0x100696c], 0
jne 0x1004222
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x10041dd
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x10041f0
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x1004179
cmp dword [0x100697c], 0
jne 0x1004231
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1006978]
jmp 0x1004252
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.01004529
ret
call fcn.01004631
jmp 0x1004079
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408e84
mov ecx, 0x4c5b0129
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xfbc7d84
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x417c10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x630038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x63003c]
or ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
fild qword [esp + 4]
test ecx, ecx
fadd qword [0x630050]
fstp qword [0x630050]
je 0x417c63
mov eax, dword [0x6337e0]
test eax, eax
je 0x417c57
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dl, byte [0x630042]
mov cl, byte [0x630049]
xor cl, dl
mov edx, dword [0x630030]
mov byte [0x630049], cl
mov ecx, dword [0x630034]
and ecx, 4
and eax, 0xc
add edx, ecx
mov esi, dword [0x630038]
mov dword [0x630030], edx
mov edx, dword [0x630048]
and edx, 0xff
push ebp
imul eax, edx
xor esi, eax
push edi
lea eax, [esp + 0x14]
push 0x50
push eax

Function at 0x44f4fe
Capabilities:
Encode data using xor

Disassembly:
sti
sbb dword [edx - 0x16], ebx
pop ebp
jbe 0x44f4a6
mov esi, 0xc7bd5340
xchg byte [ecx + 0x64336caa], ch
invalid

Function at 0x45026e
Capabilities:
Encode data using xor

Disassembly:
lahf
xlatb
mov eax, dword [0xbbf35cea]
inc edx
test al, 0x80
inc ecx
mov ebp, eax
cdq
xchg esi, eax
invalid
mov ebx, 0x99858e56
scasb al, byte es:[edi]
test dword [eax - 0x3ba9587], ebx
cmpsb byte [esi], byte es:[edi]
dec ebx
scasb al, byte es:[edi]
mov edi, dword [ecx]
cmp bh, bl
jp 0x45020a
scasd eax, dword es:[edi]
mov dword [ecx - 0x66d28aad], edi
push ds
mov eax, 0x826f8cbc
test eax, 0x7279e5b
pop es
pop es
lcall 0x9a6e, 0x70591fe1
adc eax, 0xa14a699d
or dl, cl
loopne 0x450248
sti
scasb al, byte es:[edi]
jecxz 0x4502e8
dec esp
loope 0x450302
imul ecx, dword [ebx - 0x58292f5d], 0x5f4df3af
stosb byte es:[edi], al
mov edx, 0xfafd45bd
test eax, 0xb9fcd698
and byte [eax + 0x7a], 0xab
mov cl, byte [edi - 0x55]
fild word [edx - 0x58]
pop edx
in al, dx
or ch, al
jle 0x450290
add dword [esi + 0x367ab7cf], ebp
outsd dx, dword [esi]
outsb dx, byte [esi]
invalid
cli
imul ecx, dword [ebp - 0x1561c66d], 3
adc edx, ebp
sub byte [ebx + 0x492f21ab], bl
test al, 0xef
int 0x38
int 0x93
in al, 0x41
dec ecx
mov dh, 0x34
xor al, byte [edx]
push edx
and eax, 0xe55ab9d2
arpl word [ecx + 0x63], bp
or dword [esi], esi
outsd dx, dword [esi]
xor al, 0x32
add dl, byte [edx + 0x25]
sar byte [ecx + 0x6963e55a], cl
arpl word [ecx], cx
outsd dx, dword ss:[esi]
push 0x328f9b2c
mov ecx, 0x9c0ac69a
lcall 0x3ab6, 0x871a1f6
xlatb
push cs
lds edi, [ebp - 0x20]
invalid

Function at 0x4534fe
Capabilities:
Encode data using xor

Disassembly:
imul esi
popal
pop ebp
mov ebx, 0x840d5d9f
salc
invalid
Function at 0x46a503
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebx], eax
in eax, dx
or dword [edi - 0x7f], ebp
insd dword es:[edi], dx
dec ebp
pop esp
add al, 0xd8
push ebp
fisttp dword [edi]
out dx, eax
in eax, 7
pxor mm4, mm5
pop es
adc bh, ah
std
pop ss
mov eax, 0x6df1f127
test al, 0x74
mov ebp, 0xf1d4b70e
inc ebp
imul ecx, eax, 0x7f45f070
imul ebp, dword [eax + 3], 0x83b0283e
sbb dl, byte [eax]
lds eax, [edi + edx - 0x236086b4]
ja 0x46a510
repne outsd dx, dword [esi]
push ds
xor dl, ch
sbb dword [edi - 0x195ea398], 0xffffffcb
mov edx, 0xc911bb08
pop ecx
daa
fldcw word [edx]
das
int 0x43
add ch, byte [edx - 0xd49e5d9]
iretd

Function at 0x4835df
Capabilities:
Encode data using xor

Disassembly:
dec edi
cmp al, 0x96
invalid
lds ebp, [ebx]
pop ss
jp 0x48352a
invalid
loop 0x48353b
fisubr dword [edx + 0x31]
invalid
shl dword [edi + 0x5087cdb3], 1
mov bh, 0xda
jnp 0x483567
adc ch, byte [ecx - 0x6423c6c3]
sbb dword [edi], ecx
xor dword [ecx + eax*8 + 0x19908164], eax
imul edi, dword [ebp + 0x4edbbfd2], 0x8e7a371c
rol byte [ebx], cl
invalid
sbb al, 0xf7
and al, 0x25
shl dword [eax + ebp*2 - 0xae5894f], 1
push 0xf51a76b1
jle 0x483575
jnp 0x483612
rcr dword [ebp + 0xaa02899], 0x6c
cwde
pop ebp
dec esi
sbb bh, byte [esp + ebx*2 + 0x489aa98b]
cdq
add ebx, dword [esp + ebx*8 + 0x166831f7]
sub ah, byte [ecx + 0x21537bd8]
jge 0x48367f
jbe 0x48363d
salc
sub al, byte [esi - 0x669bb24c]
dec ebp
cdq
sbb ah, cl
and byte [ecx + 0x31], cl
xor al, 0xcd
pop ecx
fmulp st(0)
aas
mov byte [ecx], cl
les esp, [ecx]
mov dword [edx], edx
sbb ebx, ebp
lahf
mov cl, 0xad
or eax, 0xe839da55
cdq
xchg edx, eax
dec esp
jp 0x4835ec
stosd dword es:[edi], eax
adc al, byte [ecx]
pop ss
loope fcn.004835df
mov eax, dword [0xe0558910]
sbb bh, byte [ecx - 0x401f1817]
sbb ch, byte [0xf177fb2f]
jnp 0x4835e5
adc byte [ecx - 0x46e51fab], cl
jmp 0x1b081730
or eax, 0x528dcac5
jns 0x48368c
jmp 0xc92bc9c0
pop ds
scasb al, byte es:[edi]
mov cl, 0x8b
adc edx, esp
ret
xchg edx, eax
pop eax
push ds
pop ds
jno 0x483615
stc
push cs
cmp dl, byte [ecx + 0x3505f349]
add eax, 0x549a0e81
xor eax, 0x9a0e8105
push esp
aam 0xa2
add al, 0x29
jae 0x48366d
js 0x48366b
mov cl, 0x7f
int3

Function at 0x488d2b
Capabilities:
Encode data using xor

Disassembly:
xchg edx, eax
inc esi
in eax, 0x82
inc ebp
ror ebp, 0xc9
sub al, 0xd4
invalid
lea esp, [eax]
invalid
Function at 0x4970de
Capabilities:
Encode data using xor

Disassembly:
daa
cmp eax, dword [edi - 0x76]
adc ah, byte [edx + 0x3ae2e126]
inc ecx
ret 0x8232
mov byte [edi + 0x5f25ce20], ch
sub dword [edi + 0x51424fc2], esi
mov gs, ebp
mov byte [0x136ee622], al
inc ebx
call [edi]
xor al, 0x93
and ah, byte [eax - 0x7d776c49]
mov al, byte [0x828893b7]
jecxz 0x4970a4
xor cl, byte [esi + 0x13]
dec esi
not byte [ecx - 0x79]
and al, byte [ebp - 0x4a4546b2]
jne 0x4970f7
ljmp 0x61c2:0x82107597
xchg edi, eax
jne 0x497120
add dl, 0x61
cmp esi, dword [0xe472c390]
movsd dword es:[edi], dword [esi]
mov ah, 0xa0
sub esi, dword [edx - 0x73]
mov esi, 0x5526ba43
mov esi, 0x5526ba43
inc esp
add dword [ecx], eax
dec ebx
inc esp
aad 0xb7
out dx, al
test byte [ebp + 0x3f], dh
xchg dword [0x8a3b3fe3], ecx
jne 0x49710c
mov esp, 0xe253e120
inc esp
xor edi, dword [edx]
loop 0x49710d
xchg esi, eax
lds ecx, [esi + 0xd]
test byte [edx - 0x4b], dh
pop ss
cmc
push edx
mov esp, 0x7467c7a5
test dword [esp - 0x35a8076d], esi
mov dword [ebp - 0x7b], 0x93303d6f
fcompi st(2)
inc edi
inc ebx
add eax, 0x3b5e70b5
adc eax, 0xa52e5e7
ret

Function at 0x498ce3
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor ebx, dword [eax*2 + 0x177a03b1]
mov eax, 0x1f35082b
push ss
sub bh, byte [ebp + 0x13]
inc byte [ebx]
sbb dword [edi], ebx
dec edx
sub esp, dword [ebx - 0x20]
adc byte [edi], dh
pop esi
cmp dword [ebx - 0x3c], ebp
mov dl, 0x61
mov word [ebx + 0x49cd8fa4], es
stosb byte es:[edi], al
test eax, ebx
invalid

Function at 0x498d0e
Capabilities:
Encode data using xor

Disassembly:
xor dword [ebp + ebx*8 + 0x7e], edi
xor al, 6
fild dword [esi + 0xa]
adc ebx, eax
dec eax
inc edx
dec ebx
dec eax
not ebp
out dx, eax
inc ebp
sub eax, edi
push esp
lahf
hlt
add ebx, dword [ecx]
pop ds
cmc
pop ebx
mov ebx, 0x8aa20124
xor byte [ebx + eax*4], al
jns 0x498cf4
inc edx
jno 0x498cb5
das
arpl word [ebx], cx
stosd dword es:[edi], eax
aam 0xcd
push 0x23ac65e3
add edx, dword [ebp + 0xb26b151]
push 0xb04c1851
and dh, byte gs:[eax - 0x6f6089d]
shl byte [ecx - 0x62], 1
invalid
Function at 0x628bc1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303b0
cmp edx, dword [eax]
je 0x628be3
add eax, 8
inc ecx
cmp eax, 0x630440
jl 0x628bd4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303b0]
jne 0x628d11
mov eax, dword [0x636dd0]
cmp eax, 1
je 0x628ceb
test eax, eax
jne 0x628c14
cmp dword [0x6302dc], 1
je 0x628ceb
cmp edx, 0xfc
je 0x628d11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628c4b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006295a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629a30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628c8e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629a30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d8ec
push edi
call fcn.0062b900
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006295a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006295b0
lea eax, [ebp - 0xa0]
push 0x62d8cc
push eax
call fcn.006295b0
push dword [esi + 0x6303b4]
lea eax, [ebp - 0xa0]
push eax
call fcn.006295b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b874
add esp, 0x2c
pop edi
jmp 0x628d11
lea eax, [ebp + 8]
lea esi, [esi + 0x6303b4]
push 0
push eax
push dword [esi]
call fcn.00629a30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4029d0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040426c
test esi, esi
jne 0x402a06
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040435c
jmp 0x402a24
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402884
mov edi, eax
test esi, esi
je 0x402a24
cmp dword [ebx], 0
je 0x402a24
dec esi
jmp 0x402a0d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4033ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x42b00c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403444
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403424
xor eax, eax
push ebp
push 0x40341d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403460
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403424
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x42b00c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x42b00c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x42c044], 0
je 0x404151
cmp word [0x42c218], 0xd7b2
jne 0x404119
cmp dword [0x42c220], 0
jbe 0x404119
mov eax, 0x42c214
call dword [0x42c230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x42b054
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404178
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x42b01c], 0
jne 0x40416d
push 0
push 0x42b074
push 0x42b054
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret