joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455d30
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
test dl, dl
je 0x455d44
add esp, 0xfffffff0
call fcn.00408800
mov ebx, edx
mov esi, eax
mov dl, 1
mov eax, dword [0x44fcb4]
call fcn.00474448
mov dword [esi + 4], eax
mov dl, 1
mov eax, dword [0x454d00]
call fcn.004771fc
mov dword [esi + 8], eax
mov dl, 1
mov eax, dword [0x454d00]
call fcn.004771fc
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x10], eax
mov eax, esi
test bl, bl
je 0x455d99
call fcn.00408858
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4be614
Capabilities:
Resume thread

Disassembly:
push ebx
mov ebx, eax
or dl, byte [ebx + 0xd]
je 0x4be657
cmp byte [ebx + 0x11], 0
jne 0x4be657
cmp byte [ebx + 0x24], 0
jne 0x4be657
mov byte [ebx + 0xf], 0
mov byte [ebx + 0xd], 0
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
je 0x4be66e
mov ecx, dword [0x4ff334]
mov dl, 1
mov eax, dword [0x48e4b0]
call fcn.00428e70
call fcn.004096d0
pop ebx
ret
mov ecx, dword [0x4ff334]
mov dl, 1
mov eax, dword [0x48e4b0]
call fcn.00428e70
call fcn.004096d0
pop ebx
ret

Function at 0x4befdc
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0xf]
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x4bf02a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0xf], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
push eax
call sub.kernel32.dll_SuspendThread
test eax, eax
setge dl
mov eax, dword [ebp - 4]
call fcn.004be4c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf043
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4bf04c
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 8]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.004be4c0
dec esi
jne 0x4bf06e
mov byte [ebx + 0xf], 0
pop esi
pop ebx
ret
Function at 0x4d7768
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d7848
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, 0x14
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040abd4
mov eax, dword [ebp - 4]
call fcn.0040aa48
push eax
push ebx
call sub.kernel32.dll_GetLogicalDriveStringsW
cmp ebx, eax
jge 0x4d77c4
mov ebx, eax
lea eax, [ebp - 4]
mov edx, ebx
call fcn.0040abd4
mov eax, dword [ebp - 4]
call fcn.0040aa48
push eax
push ebx
call sub.kernel32.dll_GetLogicalDriveStringsW
test eax, eax
je 0x4d7830
push 0x1a
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x411a00]
call fcn.0040ce88
add esp, 4
or esi, 0xffffffff
mov eax, dword [ebp - 4]
call fcn.0040aa48
mov ebx, eax
jmp 0x4d780b
inc esi
mov eax, dword [ebp - 8]
mov eax, dword [eax]
lea eax, [eax + esi*4]
mov edx, ebx
call fcn.0040aaa8
mov eax, ebx
call fcn.004222a0
mov ebx, eax
add ebx, 2
mov eax, ebx
call fcn.0040a4dc
mov edi, eax
test edi, edi
ja 0x4d77ef
inc esi
push esi
mov eax, dword [ebp - 8]
mov ecx, 1
mov edx, dword [0x411a00]
call fcn.0040ce88
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d784f
lea eax, [ebp - 4]
call fcn.00409fe8
pop eax
jmp eax
Function at 0x405c7e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a01c]
jne 0x405c88
repz ret
jmp fcn.00406007

Function at 0x14973bc
Capabilities:
Encode data using xor

Disassembly:
into
jmp 0x14973c6
pushal
call 0x14973cc
pop ebp
sub ebp, 0x10
sub ebp, 0x10973bc
jmp 0x14973e2
mov eax, 0x10973bc
add eax, ebp
add eax, 0x4c
mov ecx, 0x606
mov edx, 0xcba55a60
xor byte [eax], dl
inc eax
dec ecx
jne 0x14973f9
jmp 0x149740c
jmp 0x14973bb
Function at 0x406870
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4068af
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4068af
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4068af
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4068af
cmp dword [ecx + 0x74], 0xe
jbe 0x4068af
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40c403
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40c4a0
push ebx
push esi
call fcn.0040c3cc
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040c360
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40c44d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c49f
push edi
push eax
call fcn.0040d020
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40c46d
call fcn.0040aec1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40c49e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040c360
add esp, 0x20
test eax, eax
jne 0x40c48c
push edi
call fcn.0040aec1
jmp 0x40c494
push ebx
call fcn.0040aec1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40d79d
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49c268
push 0x49c260
push str.FlsAlloc
push 0x1f
call fcn.0040d65c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d7d1
push dword [ebp + 8]
mov ecx, esi
call dword [0x417174]
call esi
jmp 0x40d7d7
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40d81b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49c278
push 0x49c270
push str.FlsGetValue
push 0x21
call fcn.0040d65c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d852
push dword [ebp + 8]
mov ecx, esi
call dword [0x417174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40d85a
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x49c280
push 0x49c278
push str.FlsSetValue
push 0x22
call fcn.0040d65c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40d894
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x417174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x412cf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x412d1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412d1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10ae0b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.010ae200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x10ae0d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ae0c2
add dl, dl
jne 0x10ae0e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ae134
xor eax, eax
add dl, dl
jne 0x10ae0ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10ae1d5
add dl, dl
jne 0x10ae0fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ae108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ae113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ae11e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x10ae12a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10ae0cd
mov eax, 1
add dl, dl
jne 0x10ae142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10ae14d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ae139
sub eax, ebx
mov ebx, 1
jne 0x10ae180
mov ecx, 1
add dl, dl
jne 0x10ae166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10ae171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ae15d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ae0cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10ae197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10ae1a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10ae18e
cmp eax, 0x7d00
jae 0x10ae1c5
cmp eax, 0x500
jb 0x10ae1c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ae0cd
cmp eax, 0x7f
ja 0x10ae1c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10ae0cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10ae1f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10ae0cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40288e
pop dword [ebp - 0x48]
mov eax, 0xd79efc40
sub eax, 0xd75ed3b2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x306a1610
sub dword [ebp - 0x58], 0xe217d0c5
mov dword [ebp - 0x54], 0x537dffc2
sub dword [ebp - 0x54], 0x214ab37d
mov dword [ebp - 0x50], 0xf71fcab0
sub dword [ebp - 0x50], 0xaad38682
mov dword [ebp - 0x4c], 0x9396d841
sub dword [ebp - 0x4c], 0x9396d841
lea eax, [ebp - 0x58]
push eax
mov eax, 0x3ffa6243
add eax, 0xc0461e49
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x2f86f426
sub dword [ebp - 0x58], 0xbb148ad0
mov dword [ebp - 0x54], 0x698494a7
add dword [ebp - 0x54], 0xd7e7ccce
mov dword [ebp - 0x50], 0x1d9d69d2
add dword [ebp - 0x50], 0x45d2029a
mov dword [ebp - 0x4c], 0x6e79e317
add dword [ebp - 0x4c], 0x91861ce9
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xf750eb54
add eax, 0x8ef9580
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36dd6
push 0
call eax
mov ecx, 0x845a684d
sub ecx, 0x845a1f3a
xor ebx, ebx
add ebx, eax
mov edi, 0x637a6c26
add edi, 0x9cc6a3da
add edi, dword [ebp - 0x48]
mov edx, 0x6d30a85e
sub edx, 0xbfe95f81
sub dword [ebp - 0x10], ebx
mov esi, dword [edi]
xor esi, edx
sub dword [ebp - 0x18], 0x2557cb05
mov dword [ebx], esi
mov dword [ebp - 0x24], 0xdd891501
add ebx, 4
add edi, 0x48e9fd12
add edi, 0xb71602f2
loop 0x4029b2
add eax, 0x35519756
sub eax, 0x35508037
mov ebx, eax
add eax, 0xf0696b46
add eax, 0xf9694bf
mov ecx, 0x3880c6e2
sub ecx, 0x3840c6e2
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40cbc8
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x7d63837c
sub cl, al
pop edx
ret
xor cl, bl
cmp dl, byte [esi]
les esp, [ebp + 0x27e01bfb]
cmp dword [0xea922154], esp
push esp
iretd
xchg edx, eax
ljmp 0xcae5
push es
sbb dl, dl
rcr dword [ecx + 0x78], 0xa1
test byte [ecx], ah
and dword [ecx], edi
invalid
invalid
dec esi
loop 0x40cc29
loop 0x40cc29
sub bl, byte [ebx + 0x14]
aas
sub dl, bl
jl 0x40cbaf
salc
xchg esi, eax
les ebp, [ebx]
inc ebx
dec edx
cwde
xor cl, byte [esp + ebx*8 + 0x5c54f669]
ja 0x40cb93
movsb byte es:[edi], byte [esi]
dec esp
insd dword es:[edi], dx
jp 0x40cbc0
dec esi
enter 0xffffffffffffce72, 0x6a
std
push esi
or byte [ebp - 0x4bb02bf0], dl
jb 0x40cc1c
pop eax
and al, 0x4a
inc edi
scasd eax, dword es:[edi]
mov dword [0xb4e106a0], eax
jne 0x40cba1
push ebx
xor al, 0x3b
aad 0x91
cdq
dec ebp
clc
fdiv st(1), st(0)
rol dword [eax - 0x5d], 1
in al, 0xa4
in al, dx
dec eax
daa
rcl byte [esp + ebx*2 + 0x7dce9580]
fisttp dword [ebp + 0x6d]
xchg esp, eax
pop esp
adc byte [ebp + 0x4ddb7dce], 0x6d
inc esp
insb byte es:[edi], dx
les ecx, [ebp + 9]
adc dword [eax - 0x68be5b7c], edx
les eax, [eax + eax*2]
or dword [ecx], edx
nop
test byte [ecx + eax*2 + 0x4004c497], ah
mov ah, 0x1c
mov byte [0x689ca2a7], al
dec esi
popfd
cmpsb byte [esi], byte es:[edi]
aam 0x4a
xchg esp, eax
movsd dword es:[edi], dword [esi]
fst qword [edx - 0x19]
cmp bh, byte [ecx + edi*2]
cmp al, 0x79
lea esi, [eax]
in al, dx
xor al, 0xc
cmc
lea ebx, [ecx + edi*4 - 0x1325030f]
sbb al, 0xe
xchg edx, eax
push 0xffffffffffffffc8
loop 0x40cc46
test al, 0xdd
mov edi, 0x2af527ab
dec ecx
cmp cl, byte [ecx + 0x65]
or ebp, dword [eax - 0x4580e41d]
out dx, al
test al, 0x6e
aam 0xfd
insb byte es:[edi], dx
mov edi, 0x63142c4d
insd dword es:[edi], dx
mov esp, ebp
scasb al, byte es:[edi]
ret 0xb98

Function at 0x438674
Capabilities:
Encode data using xor

Disassembly:
aas
fcom dword [ebp - 0x2f]
imul ebx, dword [ebp + 3], 0x16
sub edi, dword [0x8b1afc3c]
aam 0x33
fcompi st(0)
movsd dword es:[edi], dword [esi]
cld
test al, 0x6e
mov dword [0x7d70d1b8], eax
fldpi
outsd dx, dword [esi]
xor bl, dl
aad 0xe7
jo 0x43868a
jns 0x4386e7
movsd dword es:[edi], dword [esi]
clc
out 0xc4, eax
cmpsb byte [esi], byte es:[edi]
nop
arpl word [edx + 0x19], di
mov ah, 0x55
call 0x39993f60
add eax, 0xcc072453
push 0x9b83b3a6
add eax, 0x634c3b9b
mov edx, 0xd8aa798f
dec ecx
adc eax, 0x1b7995f1
fst dword [eax + 0x1a]
retf 0xb2d8
ret
cdq
push es
xor ecx, dword [ecx]
jle 0x43873f
ret 0xbacb
add eax, 0xbdea6c9f
rcl eax, 0xc2
dec ecx
jg 0x4386e3
mov ah, 0xb5
dec ebp
or byte [edi - 0x5471f08e], bl
mov cl, 0x45
and cl, byte [ecx + ecx*2]
aad 0x2d
repe scasd eax, dword es:[edi]
out dx, eax
invalid

Function at 0x43a894
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
pushal
mov edi, 0xca815b46
imul ecx, ebx, 0xffffff93
out 0xc2, al
imul edx, ebp, 0x51214ca5
push esp
outsd dx, dword [esi]
mov ah, byte [esi - 0x6907ec64]
mov eax, dword [0x2f9d241b]
pop edi
and eax, 0x9f618312
xor cl, dh
aam 0x3c
invalid
Function at 0x43a8c4
Capabilities:
Encode data using xor

Disassembly:
dec esp
and dword [ecx + 0x54], edx
adc al, byte [ebx - 0x31cd609f]
mov eax, 0x8ac3c58e
fdiv qword [ecx + 0x27e247dd]
lodsb al, byte [esi]
sahf
or al, 0xa
sub byte [esi - 0x72662197], cl
xor bl, al
add eax, 0x59ef398f
jg 0x43a8a3
push ebx
jecxz 0x43a8b5
lodsd eax, dword [esi]
sbb al, 0x51
aam 0x38
adc al, 0x2a
into
adc al, ch
adc eax, 0x8c8bd8f6
sbb eax, 0x5c81f161
outsb dx, byte [esi]
push es
xchg ebp, eax
cmp eax, 0xdddb46d1
fld qword [esp + ecx*4 - 0x24]
inc esp
mov esp, ds

Function at 0x4538ee
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x42
adc ah, byte [edi]
mov ch, 0x8a
xor eax, 0x587a42e
into
jp 0x45386f
ret
lahf
fld dword [ebx + 0x3c]
mov esi, 0xe11cdfdb
fcmovnu st(0), st(7)
sbb al, 0xe1
xchg esi, eax
dec esi
out dx, eax
cld
sbb byte [eax + 0x76c5ce38], 0xca
xchg ebp, eax
mov byte [esi + 0x77a9f913], bl
push ss
mov al, byte [ebx]
or eax, 0xeae62058
leave
adc al, 0xda
jb 0x453875
adc eax, 0xb453dbde
invalid
mov ah, 0xdb
and eax, 0x72790dde
jge 0x45382b
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
dec ebx
xchg ebx, eax
aad 0xb7
pop esp
mov bh, 0x61
ret
push ecx
or bl, ah
stosd dword es:[edi], eax
jecxz 0x45389d
xor al, byte [ebx + 0x57914086]
ja 0x4538ef
dec eax
mov esp, 0x5089adb5
imul eax, dword [ecx], 0x29
dec esi
rol dword [ecx + ecx*4], 1
into
inc ebp
jle 0x4538f0
out dx, al
scasd eax, dword es:[edi]
invalid

Function at 0x465934
Capabilities:
Encode data using xor

Disassembly:
invalid
mov bh, 0x5f
pop edi
hlt
jae 0x465968
mov bh, 0x39
xchg edx, eax
jg 0x4658a7
fmul dword [esi - 0x58]
inc edx
mov ecx, 0x6d23cdd7
test word [ebx + 0x2f], 0xde47
jmp 0x4658f2
leave
sbb al, 0x77
and esp, dword [eax - 0x6b]
wait
adc byte [esi + 0x4734267a], al
fldenv [edx - 0x7f]
jle 0x4658f3
nop
xchg dword [ebp + 0x40abaeec], ebp
pop ss
popfd
bnd jl 0x465946
dec ecx
inc esi
jno 0x46591a
cmp dword [edi - 0x73f0d1a6], esi
cmp ebx, edi
add al, 0x38
or esp, dword [edx]
jmp 0xd8a9249d
sub edi, esp
or ebx, dword [ecx - 0x29]
mov ah, 0x24
push esp
jp 0x4659ad
mov edi, 0x971d974b
mov dl, 0x1c
adc eax, 0xc9daff06
in eax, dx
cmp eax, esp
mov esp, esi
call 0xa52251af
pop esp
test dword [esi + 0x40785688], esp
ljmp 0x65cb
out 0xe8, al
daa
clc
invalid
shr dword [esi - 0x5967cb22], 1
scasb al, byte es:[edi]
fidiv word [eax + ebx*4]
cmpsb byte [esi], byte es:[edi]
adc ch, byte [ecx + 0x16]
cmp al, 0x62
salc
cmp al, 0x27
mov ah, dh
xor eax, 0x1ece0901
dec esi
enter 0xfffffffffffff9e1, 0xffffffffffffffeb
add byte [eax], dl
jle 0x4659ae
xchg esi, eax
inc edi
xor byte [edi - 0x67], dl
loope 0x465982
xor al, 0x5c
xchg edx, edi
pop ss
xor dword [esi], ecx
xchg esp, eax
in eax, 0x84
pop esp
int3
Function at 0x46f94c
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
ror edx, 1
pop ss
in al, 0x7c
fmul qword [edx - 0x57]
xchg ebx, eax
aad 0x39
lahf
mov al, byte [0x7b953d47]
sbb byte fs:[esi - 0x43], 0x4b
fcmovu st(0), st(0)
push ecx
test dword [ecx], edx
cmc
pop edx
pop edi
mov bh, 0xd4
mov esi, 0xfa681a88
mov byte [0x6be07d32], al
loopne 0x46f991
adc dword [edx + ebp*4], ebx
jle 0x46f924
and dword [edx + 0x57], esp
mov byte [0xd285f283], al
das
dec edx
and eax, 0x9f8d9a6d
rcr dword [ebp - 0x330ee1a4], 0xe
cli
scasd eax, dword es:[edi]
xchg esp, eax
out dx, al
mov byte [0x7121870d], al
in al, 0x6a
push 0x40
push 0x40
dec ecx
bound ebp, qword [edi]
movsd dword es:[edi], dword [esi]
xor eax, 0xa2e232b
and al, 0x2a
test eax, 0x248cff5a
jne 0x46f912
mov word [esi*2 - 0x25ac944e], fs
arpl word [ebp + edx*4 + 0x17], si
imul edx, dword [ebx - 0x26], 0x63
je 0x46f8fb
pop ss
adc ah, al
je 0x46f9e0
jno 0x46f95c
invalid
aad 0xae

Function at 0x47dcd4
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
cmp bh, byte [ecx - 0x26]
pop esp
nop
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
cwde
adc dword [ecx], ebx
or esp, dword [ecx]
mov bh, 0xb9
push ebp
dec esi
int 0x55
aaa
test eax, 0x2457dd97
add al, 0x44
aam 0xbb
ret 0x9df5
out dx, eax
mov esi, 0x9a860d65
and byte [eax], al
add byte [edx], dh
or dh, byte [ecx - 0x1b2a9189]
add byte [edx], dh
or dh, byte [ecx - 0x1b2a9189]
push ebx
xchg ebp, eax
in eax, dx
push ecx
cmp al, 0xa4
inc esi
pop es
add ah, al
salc
jae 0x47dccc
sub byte [eax - 0x19c0f8d8], dl
movsb byte es:[edi], byte [esi]
loop 0x47dca9
sbb ch, byte [ecx + edx + 0x656c0d98]
mov eax, dword [0x51c9640a]
inc esp
hlt

Function at 0x4b3305
Capabilities:
Encode data using xor

Disassembly:
fdivr dword [esi + 0x45b06c1e]
lea ebx, [edx - 0x4d7d630c]
adc al, 0x2c
lea edi, [edi - 0x5a]
and dword [0xac41bb9c], 0xffffffa6
popfd
out dx, al
std
shr ah, cl
in al, dx
sub eax, 0x5333cbfd
aad 0x6f
or eax, 0xe18947b9
push eax
popal
xchg edx, eax
xor bh, byte [0x1302258e]
jns 0x4b32c9
jbe 0x4b3309
push ss
cdq
mov bh, 0xd0
mov esp, 0xd2ee5042
push ebp
insd dword es:[edi], dx
out dx, al
rcl byte [ebp + 0x6d], cl
pop es
add bh, byte [esi - 0x4c80313e]
insd dword es:[edi], dx
insb byte es:[edi], dx
movsd dword es:[edi], dword [esi]
push eax
xor dword [ecx + 0x3115eb33], esi
add al, 0x8d
xchg ebp, eax
pop ebp
dec esp
jae 0x4b32ea
invalid
in al, 0xca
cmp eax, 0x4eb4fd7e
retf 0x7e3d
std
mov ah, 0x4e
test eax, 0x22526e8e
jl 0x4b32ad
cmp bh, bl
adc al, 0x4b
dec eax
xchg ebp, eax
in eax, dx
dec esi
add cl, ah
add ecx, esp
cmp eax, 0x70f022dc
lahf
mov ah, 0xc3
lcall 0xcdae, 0x89fc3fb6
mul byte [ebx + ebp*8]
push edx
mov byte [0x664c0dbf], al
movsd dword es:[edi], dword [esi]
sbb dword [esi + 0x53], 0xffffffea
ret 0xcc4d
Function at 0x4bb041
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2390
cmp edx, dword [eax]
je 0x4bb063
add eax, 8
inc ecx
cmp eax, 0x4c2420
jl 0x4bb054
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2390]
jne 0x4bb191
mov eax, dword [0x4c6d1c]
cmp eax, 1
je 0x4bb16b
test eax, eax
jne 0x4bb094
cmp dword [0x4c22bc], 1
je 0x4bb16b
cmp edx, 0xfc
je 0x4bb191
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb0cb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba20
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbeb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb10e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbeb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c072c
push edi
call fcn.004bdd80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba30
lea eax, [ebp - 0xa0]
push 0x4c070c
push eax
call fcn.004bba30
push dword [esi + 0x4c2394]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba30
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bdcf4
add esp, 0x2c
pop edi
jmp 0x4bb191
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2394]
push 0
push eax
push dword [esi]
call fcn.004bbeb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x42c005
Capabilities:
Packed with generic packer

Disassembly:
jmp fcn.0042a8d0
jmp section.42vab535