joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4143d0
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x90
lea eax, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push 0x80
push eax
call sub.WSOCK32.dll_gethostname
lea ecx, [esp + 0x20]
push ecx
call sub.WSOCK32.dll_gethostbyname
mov ebp, eax
test ebp, ebp
je 0x41443f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x41443f
xor ebx, ebx
movsx ecx, word [ebp + 0xa]
mov esi, dword [ebx + eax]
mov edx, ecx
lea edi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x14]
push esi
call sub.WSOCK32.dll_inet_ntoa
push eax
call fcn.004141d0
add esp, 4
test eax, eax
je 0x41445d
mov eax, dword [ebp + 0xc]
add ebx, 4
cmp dword [ebx + eax], 0
jne 0x414403
mov ecx, dword [esp + 0xa4]
push 0x42b6b8
call sub.MFC42.DLL_CString::operator
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x90
ret
push esi
call sub.WSOCK32.dll_inet_ntoa
mov ecx, dword [esp + 0xa4]
push eax
call sub.MFC42.DLL_CString::operator
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x90
ret
Function at 0x413532
Capabilities:
Encode data using xor

Disassembly:
fist word [ecx + 0x38]
push ebx
push ds
enter 0xffffffffffffb269, 0x3e
invalid

Function at 0x45f665
Capabilities:
Encode data using xor

Disassembly:
pop ecx
rcl dword [ebx - 0x2de9f2a4], cl
xor cl, byte [esi]
inc edi
ficom dword [esi - 0x9e7ab79]
inc byte [0x7fa08fe2]
sti
xor eax, 0xa6de8497
cmpsb byte [esi], byte es:[edi]
add al, 0x86
and eax, dword [esp + esi]
xchg edi, eax
cmp cl, cl
and byte [edx], 0x57
push eax
jae 0x45f604
cmpsd dword ss:[esi], dword es:[edi]
aad 0xa2
std
xlatb
sub dl, cl
hlt
xchg ebp, edx
xchg esi, eax
pop ss
test byte [eax], 0x86
xchg ch, ah
and ch, ch
xchg ch, ah
and ch, ch
dec edx
aad 0x94
aam 0x57
pushfd
add eax, 0xb41599c3
push esp
in al, 0xae
je 0x45f5fb
mov byte [0x850613bb], al
mov ah, byte [edx]
sbb ecx, eax
adc edi, dword [edx + ebx*8 - 0x56]
adc eax, dword [esi]
test dword [edx + 0x13c11922], ecx
jl 0x45f65f
stosb byte es:[edi], al
movsd dword es:[edi], dword [esi]
mov eax, dword [0x93e45574]
pop ss
int 0x9a
dec eax
sar dword [ebp - 0x3c], 0x47
arpl word [ebx + 0x88d2855], cx
lds eax, [edi + 0x6fc87ce4]
or dword [ecx + edx + 0x41e0e464], 0xffffff85
in al, 0x87
aaa
jmp 0x45f67b

Function at 0x462fec
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x6da7f68f
sbb eax, 0x744558a5
lodsb al, byte [esi]
invalid
ror dword [ebx - 0x62cc1b6d], 0x36
mov bh, 0x89
aam 0x85
xor ah, cl
test eax, 0x6efd9ce2
test byte [ebx + 0x53ca97a5], bh
lds eax, [ebx + 0x5efb2192]
adc dword [edx + 0xd5efb21], 0x6e
stosb byte es:[edi], al
mov esp, 0x366864eb
mov ah, 0x87
shl edi, 1
cmp byte [edx], 0x5c
invalid
ret
push eax
hlt
adc dword [edx + 0xd5efb21], 0x6e
stosb byte es:[edi], al
mov esp, 0x366864eb
mov ah, 0x87
shl edi, 1
cmp byte [edx], 0x5c
sub eax, 0x95f450c3
mov ch, 0xc2
jle 0x462fdc
loope 0x462f92
xchg ebp, eax
inc eax
pushfd
pushal
inc ecx
pop ebx
movsd dword es:[edi], dword [esi]
cmpsd dword [esi], dword es:[edi]
loope 0x462fa0
cli
mov ebp, 0xea54e539
jg 0x462fd3
insb byte es:[edi], dx
sub eax, dword [edi + esi - 0x48]
arpl word [edi + 0x30255aee], si
push ebp
mov al, 0xb0
cld
pop edi
je 0x463010
das
pop esi
fist dword [eax - 0x7fa6b5cc]
les ebp, [edx - 0x3943eeee]
call 0x9555a715
xor eax, 0xfd84f4a4
cmpsb byte [esi], byte es:[edi]
enter 0xffffffffffffe280, 0xffffffffffffffce
inc ecx
imul edx, dword [edi - 0x54c8e8ea], 0xfffffff2
pop esp
nop
das
mov ebp, 0xbc2171d6
mov dword [0x6fd9243c], eax
test eax, 0x7b8b383f
inc ecx
add byte [edx + 0x31], bh
cmp al, 0x16
sbb dword [ebp - 0x5b], 0x4d
sbb al, 0x59
lds edx, [edi - 0x3e]
out dx, al
and ebx, dword [ebx]
invalid
Function at 0x4799d2
Capabilities:
Encode data using xor

Disassembly:
aad 0x6f
mov ebp, esp
cmp dword [eax + 0x432a6a78], esp
mov al, byte [0x432a6a78]
bound edi, qword [ebx]
push 0x9e66612a
imul ebx, dword [eax], 0x47
xor dword [edx + 0x77], esp
xchg esi, eax
js 0x4799d7
test al, 0x78
push 0x38b73dcf
sbb ah, byte [ebp - 0x4e]
les edi, [esi]
and ebx, dword [0xc6d465a2]
in eax, 0x4f
pushal
mov es, word fs:[0xda45adc9]
sub al, 0xaf
sub dword [edi], edx
sbb al, 0xfb
xchg byte [edx - 0x537b38c7], cl
imul ebp, dword [0xa130b4ea], 0xf4f6072b
outsd dx, dword [esi]
add al, 0x99
lds edi, [edi - 0x14537fcb]
in eax, dx
jg 0x4799e6
sub byte [esi], ah
and byte [ebp - 0x1262ddd6], bh
dec eax
clc
mov esi, dword [ebp + 0x78]
out dx, eax
leave
dec esi
daa
xlatb
fcomp dword [edi - 0x6273bed1]
mov esp, 0x68b78fe2
pushal
stc
xor eax, 0x298f69a9
jg 0x479aa5
stosd dword es:[edi], eax
pushal
aas
xchg dword [esi - 0x74870ed6], ebx
cmp al, ah
aad 0x9d
add al, 0x29
xor dword [edi + 0x58], ebp
jg 0x479aba
lodsb al, byte [esi]
mov dword [0x20e99aad], eax
sub eax, 0x2a1d88ac
fnstcw word [eax - 0x55]
lcall 0x1d88, 0xac2d20e9
sub bl, cl
js 0x479a1e
pop ebp
push ebx
ret 0xbf53
xchg byte [ecx + 0x2eced2bd], ch
out dx, eax
sbb byte [esi + 0x45], cl
pop edi
imul byte [edi]
or dword [ebp + 0x179c1d8e], 0xffffffe0
mov edi, 0x6f3b4f44
cmp ebx, dword [esi - 0x2875f098]
loop fcn.00479af9
inc esp
dec edi
cmp ebp, dword [edi + 0x3b]
sahf
push 0xe2d78a0f
xor esi, dword [ebx - 0x54]
jae 0x479a74
lea eax, [ebp + 0x7e8579f7]
sub cl, byte [ecx + ebx*4 - 0x29]
mov edx, 0x398a5076
add byte [0x97753124], ch
daa
jg 0x479a68
cmp cl, byte [ebp + 0xbc93f12]
cmp byte [edi - 0x5b], 0xdb
leave
aas
invalid
Function at 0x4f179f
Capabilities:
Encode data using xor

Disassembly:
sub dword [ebx - 0x370173d7], ecx
mov ebx, 0xc9a0ab9b
cwde
pop es
mov edi, dword [ebp + 0x1f8cb4d3]
mov dh, 0x8b
mov byte [ebx + 0x1c86089e], 0xc3
cmp al, 0xad
jle 0x4f1707
push edi
cmp ch, byte [ebp + 0x6042f6d0]
xchg edi, eax
dec ecx
mov byte [edi - 0x15], dh
xor dl, bl
mov byte [ebx - 0x63d6d096], ah
call 0x476a6990
sub dword [eax + ebp*8 + 0x471b52aa], ebx
pop esi
nop
lahf
mov al, 0x55
popal
mov eax, dword [0xea20a091]
test byte [edi + 0x49], ch
out dx, eax
cwde
or esp, esp
inc esp
pop ebp
push ebp
jnp 0x4f16ac
daa
invalid
or bl, cl
jge 0x4f1717
rcr bh, 1
dec edx
pop esi
lcall 0x638e, 0x5cab03ea
dec esi
and ecx, dword [edi - 0x7a]
add ah, ah
in al, 0xcb
not dword [ecx + ebp - 0x3a4e5065]
aad 0x91
dec esp
mov eax, dword [ebp + 0x5c1a0b01]
push 0xa8cf4a20
je 0x4f16df
in eax, dx
sbb eax, 0xb9b44b7d
dec edx
sbb edi, dword [ebx]
pop es
lcall 0xb928, 0x1865398a
or eax, 0xf0c8ce2e
mov ch, 0xdf
pushfd
mov bl, 0xba
dec edx
dec eax
jle 0x4f17d3
mov edx, 0x7f7e484a
jno 0x4f176b
lodsd eax, dword [esi]
cmp edx, dword [esp + edx - 0x5c1965b1]
fidivr word [ebx]
adc byte [ebx - 0x71b48b66], 0x38
cmpsd dword [esi], dword es:[edi]
clc
mov cs, word [ecx - 0x16]
jp 0x4f16fb
dec ecx
ljmp 0x5bab
mov dword gs:[0x962e5bab], eax
inc edi
ljmp 0xde48
add al, 0x97
leave
sbb al, 0x98
dec edi
lahf
jle 0x4f174f
out 8, al
cmpsd dword [esi], dword es:[edi]
jmp 0x54cdf185
mov edi, 0xc0556f97
jb 0x4f1800
sar ecx, cl
xchg esi, eax
in eax, 0x55
outsd dx, dword [esi]
inc edx
mov dh, 0x1a
leave
out dx, eax
inc esi
jp 0x4f1789
or al, 0xc8
inc edx
test byte [ebx - 0x4a], cl
wait
xor eax, 0x7f87d468
lahf
cmpsd dword [esi], dword es:[edi]
push 0xf9a5fa43
fbld tbyte [eax + ecx*2]
xchg dword [ecx + 0x1d6ab3db], ebp
cmp dword [esi + 0x71e40d46], esp
push edi
xchg dword [eax + 0x3e], edi
or eax, 0x875771e4
js 0x4f1818
pushal
inc esp
mov edx, 0xd4c37887
inc edx
invalid
xchg ebx, eax
invalid
lcall 0x6dc0, 0x5b8acc84
jbe 0x4f183a
push edi
mov ch, 0xb4
test dword [ebp + 0x7a], 0x68596fa6
shl byte [esi + 0x7b], 0x84
stosd dword es:[edi], eax
wait
imul esi, dword [ecx], 0x2b
xor eax, dword [ecx - 0x59]
or byte [edi + ecx*4 + 0x3e316b4d], dl
pop esp
mov dword [ebp + 0x18986596], esp
cmpsd dword [esi], dword es:[edi]
pminub mm6, qword [ebx]
push 0xfffffffffffffff4
cmpsd dword [si], dword es:[di]
invalid
invalid
Function at 0x4f62db
Capabilities:
Encode data using xor

Disassembly:
pop edx
mov ah, 0xfc
pop edi
shr byte [edi + 0x51], 2
or dword [eax], edi
mov eax, dword [0x6dfcec7e]
in eax, dx
xor cl, dl
mov word [0x2c4c91df], ds
fist word [ecx - 0x7669d3b4]
cli
fist word [ecx - 0x7669d3b4]
cli
ror al, cl
div dword [edi]
mov cl, 0x21
push es
mov cl, 0x5f
mov bh, 0xd5
popfd
sbb byte [edx - 0x7bf058f4], ah
mov bp, 0x4e5b
fbld tbyte [ebp - 0x22]
pop esi
in al, 0xf9
daa
fist word [edi]
adc esi, eax
divps xmm0, xmm5
lea eax, [esi]
insd dword es:[edi], dx
mov esi, 0xbf092b0a
outsb dx, byte [esi]
push ds
push 0xffffffffffffffeb
or byte [edx], bl
insd dword es:[edi], dx
xor dh, al
jnp 0x4f62c7
sal dword [ebx + 0x2c], 0xdc
jne fcn.004f6360
xchg ebp, eax
lds ebp, [eax - 1]
mov eax, dword [0x1990d339]
mov esp, 0x611c7191
inc eax
cmp ebx, edx
nop
sbb dword [ecx + edx*4 + 0x40611c71], edi
add al, 8
inc eax
mov word [ebp + 0x1c], fs
mov al, 0x28
or eax, 0x73e0d72f
salc
leave
fidivr word [esi + 0x739db4ed]
cli
js 0x4f6324
lcall 0x46e5, 0xb5f96eb0
cmp byte [edx + 0x4c937522], bh
invalid

Function at 0x4fabb3
Capabilities:
Encode data using xor

Disassembly:
sti
mov ah, 0x24
pop ds
cwde
push edi
in al, dx
push edx
outsb dx, byte [esi]
sub dword [ebx - 0x3f], ecx
movsb byte es:[edi], byte [esi]
nop
aam 5
adc dl, ch
lodsd eax, dword [esi]
pushal
or dword [ebp - 0x308a507e], 0xffffffb6
lahf
aaa
xor bh, byte [edi + 0x31]
std
sbb dword [edx], edi
cmp dh, bh
adc eax, 0x1bd65b
enter 0x5461, 0xffffffffffffffe1
dec eax
pop es
invalid
Function at 0x50d0bc
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword [esp + edi - 0x3b], 0xffffffa0
cwde
dec esp
xchg esp, eax
insb byte es:[edi], dx
mov al, byte [0x6c944c98]
daa
js 0x50d0d7
ja 0x50d0cd
in eax, dx
add eax, 0x448ccfbc
in eax, dx
jo 0x50d109
aad 0xa
adc esi, dword [edi + edx*8]
pop esi
fst dword [0x55bd4b3d]
xchg ebp, eax
cmp eax, 0x9555bd4b
push esi
sbb byte [edx - 0xb], ch
jge 0x50d15f
cmp edi, ebp
insd dword es:[edi], dx
sbb eax, 0x345174ef
not al
adc byte [edx], bh
in al, dx
mov dl, 0x8c
lds edx, [ebp + ebx*2 + 0x5d753664]
dec edx
in al, 0x4d
cmp byte [eax + 0x44], al
xchg sp, ax
xchg ebp, eax
xor al, 0x4b
and esi, esi
pop ebp
xchg byte [esi - 0x4b102904], bh
push esp
salc
out dx, eax
mov ah, 0x54
adc eax, 0x3a6595b4
cmp byte [eax], al
mov cl, 0xf5
pushal
lodsd eax, dword [esi]
pushfd
std
loope 0x50d0b8
wait
jle 0x50d12b
rol byte [ebp + 0x6309780c], 1
push ebx
jno 0x50d13d
sal dword [eax + 0x21], 0x63
mov byte [0x25df6143], al
arpl word [edx + 0x25df6143], sp
inc ebx
popal
fbld tbyte [0x7517ef1e]
xor dword [edi - 0x56], esi
push ds
out dx, eax
pop ss
jne 0x50d167
ja 0x50d0e2
mov ch, 0x23
adc al, 0xe3
xor al, 0x54
ror dword [ebp + 0x36], 0x32
or al, 0x14
xor eax, 0xe9bd406c
fcom qword [0x9c6c2f7c]
push edi
pop esi
in al, 0x10
push ebp
loopne 0x50d18a
push ecx
retf 0x1457
lds esp, [eax + edx*8 + 0x54]
push ss
adc al, 0x29
sti
push ebp
bound edi, qword [edx + ebx + 0x6474e93d]
sub ch, byte [ebx + 0x3e]
jno 0x50d18f
inc esp
ret 0x2711
and dword [eax], esi
mov eax, dword fs:[0xf5787d75]
jge 0x50d209
cmc
lodsd eax, dword [esi]
in al, 0x96
cmp al, 0x63
and al, 0x69
xor al, 0x18
pop ecx
in al, dx
std
jae 0x50d13b
dec ebp
and byte [edi + 0x7c], al
daa
jl 0x50d12d
inc ebp
jno 0x50d191
popal
in al, 0xca
sbb esi, esp
jo 0x50d1cd
sbb ebp, dword [ebp - 0x75]
cmp al, 0xe5
insd dword es:[edi], dx
mov edi, dword [0x34642974]
sbb dword [ebx], edi
mov ebp, 0x1c859b75
je 0x50d1e1
xor al, 0x19
cmp edi, dword [ebp + 0x1c859b75]
cld
jl 0x50d1b1
in eax, dx
xor ah, byte [edx - 0x666f1cbc]
dec eax
jl 0x50d1b6
inc ebx
dec ecx
clc
fsubr qword [esp + esi - 0x11130dc5]
xor al, 0x9a
stosb byte es:[edi], al
mov word [ecx], fs
movsb byte es:[edi], byte [esi]
pop es
pop esp
inc ecx
mov edi, gs
int 0x3d
mov ah, 0x35
jmp 0x50d22d
outsb dx, byte [esi]
fsub qword [eax - 0x61fe087]
jns 0x50d213
loopne 0x50d1ef
std
pop ebp
xor eax, 0x6a4a7c65
dec esi
and ah, bl
fisttp qword [esp + ecx*4 + 0x1c]
movsb byte es:[edi], byte [esi]
or al, 0x14
pop ecx
jle 0x50d1c3
stc
xor dl, byte [esi]
dec eax
in al, dx
jl 0x50d1f2
dec ebp
fimul word [ebp + ebp + 0x4c]
or al, 0x4e
lodsb al, byte [esi]
popal
into
mov cl, 0xec
pop ebp
pop esi
mov edx, 0x4def3a4c
sbb eax, 0xbfef40c7
imul ecx, dword [esp + eax*8 + 0x19], 0xfa4c0aba
xor al, 0xcc
out dx, al
lea esp, [ebx + ecx*4 - 0xa]
int3
sbb dword [edx + 0x34fa4c0a], edi
int3
Function at 0x50d678
Capabilities:
Encode data using xor

Disassembly:
popfd
call 0x500c1601
sub eax, 0xae50a417
mov word [edi], es
cld
outsd dx, dword [esi]
lea esp, [edi]
loope 0x50d63a
call dword [eax]
and esp, ecx
in eax, dx
xchg ecx, eax
xchg dword [esi], esp
xlatb
jmp dword [ebx]
adc byte [ecx], ah
int3
out dx, eax
pop es
cmp byte [0x37b37e], cl
out dx, eax
sbb ecx, dword ds:[esi]
scasb al, byte es:[edi]
push cs
mov edx, 0x1428c48
or dh, dl
and al, bh
fisttp word [esi]
ja 0x50d628
clc
inc ebx
out 0x17, eax
mov esi, 0x5e59d50a
dec edx
mov al, byte [0xc5db983f]
enter 0xffffffffffffdefa, 0xfffffffffffffffa
mov dword [0xa010fc3c], eax
jno 0x50d68c
call 0x2ca23a5c
jns 0x50d728
mov ah, 0x63
push ecx
sub al, 0x79
jle 0x50d6bf
adc al, 0x9d
popfd
je 0x50d66f
push esp
push ds
mov ah, 0x8c
shl dword [esi], cl
loop 0x50d704
mov ebx, ss
loop 0x50d704
jecxz 0x50d6f7
dec ebp
mov esp, 0x4ffe04c
sub eax, 0x447898fa
cli
cwde
js 0x50d707
test dword [ebp - 0x50622955], esi
scasd eax, dword es:[edi]
aam 0xfb
push ebp
bound edx, qword [edx - 0x69]
test byte [edi + 0x481ec2d7], bl
invalid
xor al, 0x5f
jge 0x50d703
add dword [esi - 0x5dde710f], esi
mov bh, 0x8a
mov bh, al
clc
stc
jge 0x50d6a3
wait
push 0xffffffffffffffd6
psrld mm2, 0x35
mov ds, word [edx]
xor eax, 0xd789f11f
mov edi, edx
mov ebp, 0xbd9e43fa
sub ah, byte [ecx]
idiv dh
pop ebx
js 0x50d713
dec esi
jne 0x50d6b1
loope 0x50d6c8
leave
leave
push esi
nop dword [edi - 0x5aae164]
insd dword es:[edi], dx
arpl word [ecx - 0x261a7e55], di
wait
sub ecx, edx
hlt
Function at 0x50dd4a
Capabilities:
Encode data using xor

Disassembly:
aaa
adc al, 0x6b
ror ebx, 1
cmp dh, ah
aaa
cmpsb byte [esi], byte es:[edi]
stc
inc edx
push edx
sar ch, 1
mov edi, 0x64215f47
inc esi
mov esi, 0xbf198753
mov byte [ebx + 0x51], ah
sub esi, dword [esi]
test al, 0x5f
xor eax, 0x4f6eca6
loope 0x50dceb
mov bh, 0xdc
cmp esi, dword [edi + 0x13]
salc
xchg dword [ebp + 0x77], esi
cmc
push edi
in al, dx
inc esi
sbb dh, byte [edi]
xchg ebp, eax
rcl dword [ebp + 0x5f], 0x1f
pop ds
inc edi
inc eax
and eax, 0x97884655
sahf
jnp 0x50dd80
push eax
pop eax
movsb byte es:[edi], byte [esi]
and ebx, edx
in eax, 0xa8
jne 0x50dda7
dec esi
imul edi, dword [esi + esi*4 - 0x5781b83e], 0x19c55fd7
and dword [edi - 0x18dab008], ecx
mov eax, 0xcb3f151a
mov bh, 0xfe
jg 0x50dcf0
cwde
or byte [eax], ah
fisub dword [edi - 0x40c15968]
aad 0xae
xor edi, esi
add eax, 0x451b94c1
pop ds
mov dh, 0x15
scasb al, byte es:[edi]
xchg dword [edi + 0x47f4aafd], ebp
xor eax, 0x7d63e4d2
mov ah, 0xf4
imul edi, dword [edi], 0xffffffe7
mov edx, 0x97cef78f
xor al, 0xe4
push ebx
in al, 0x53
mov byte [0xc0132c4f], al
into
jb 0x50dd25
push esp
jp 0x50dd26
aas
stc
std
test edi, edi
fnsave dword [edi - 0x71822e30]
lcall 0x2db7, 0x81078c59
lodsb al, byte [esi]
adc al, 0xe2
mov ecx, 0xaf85f062
mov word [edi], es
xor dword [edi - 0x1deb53d3], 0xf062b936
test dword [edi - 0x118d1156], ebp
scasd eax, dword es:[edi]
stosb byte es:[edi], al
out dx, al
jb 0x50dd9a
je 0x50dd2f
les ebp, [ecx + 0x40ac47b4]
scasd eax, dword es:[edi]
mov dword [0xefc5a987], eax
cmc
fsub st(3), st(0)
push ds
rcr dword [esi + 0x21], 1
cmp bh, byte [edi]
outsb dx, byte [esi]
pop ss
mov edi, 0x60a73eb5
cmpsb byte [esi], byte es:[edi]
out 0x16, eax
invalid
Function at 0x51b021
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0xe29623fb
push ds
xor eax, 0xe905c55f
lodsb al, byte [esi]
and al, 0x87
push 0x2efd5777
imul ebp, edi, 0xf5add2eb
mov bl, 0x1f
jno 0x51af42
int1
jb 0x51af66
adc dword [edi], edx
les eax, [eax - 0x15]
inc ebp
push 0x75
lodsd eax, dword [esi]
jmp 0x51af07
loope 0x51af74
js 0x51af7c
and dword [eax + 0x7f], edx
js 0x51af34
add al, 0xe3
out dx, al
jno 0x51aefb
rol dword [eax - 0x74], 0xa8
and ch, ch
sar byte [edi + 0x4e], 1
inc eax
mov word [eax + 0x7fd0ed20], gs
dec esi
add byte [esi - 0x1b8ce979], dh
fdivp st(4)
inc esp
invalid
out 0xab, eax
inc edi
ja 0x51afcc
imul ecx, dword [ebp + 0x3c2d71db], 0xfffffff6
mov esp, 0x7750b877
add al, 0x70
ja 0x51af25
mov esi, 0x124c7db4
cmp dh, ch
mov ah, 0x7d
dec esp
adc bh, byte [edx]
cmc
cmpsb byte [esi], byte es:[edi]
les esp, [edi - 0x29]
add eax, dword [edi - 4]
inc ebp
int 0x94
enter 0xffffffffffff8536, 0xfffffffffffffff7
pop ecx
pop eax
inc esp
push 0xa3d35384
leave
push esp
add dword [ecx - 0x61], ebp
out 0x61, al
inc ecx
pop eax
cmpsb byte [esi], byte es:[edi]
retf
sub ch, byte [ebx + 0x16]
enter 0x68f8, 0x75
sbb al, byte [esi]
and al, cl
adc al, 0xf4
mov ebx, 0x2b1abeb9
div ebx
dec edx
mov dword [0x2260a79d], eax
add byte [edx + edx*8 - 0x34], ah
in al, 0x52
push edx
xchg edx, eax
xchg esp, eax
jae 0x51af52
mov byte [ebx + 0x1075738], ah
call 0xb085496b
cmc
shl dword fs:[0xdc17e9d8], cl
xor ecx, dword [ecx + 0x2af4e5c3]
invalid
dec ebp
push cs
inc ebx
rol dh, cl
push esp
mov esp, edi
cmp al, 0xe0
cmp eax, 0x87e315b9
test eax, 0x6756b0c2
fld dword [ebp + 0x6d49250e]
push ss
xlatb
rol dword [ebx - 0x2fd79140], 1
sahf
fcompi st(2)
call 0xe8cf4d52
jns 0x51afac
and eax, 0x5989e9b6
sbb dword [edx + ecx*2 + 0x196e28c4], eax
outsb dx, byte [esi]
sbb dword [ebx + edx + 7], edx
outsb dx, byte [esi]
sbb dword [ebx + edx + 7], edx
call 0xb52f23f2
xchg esi, eax
ja 0x51afd8
stosd dword es:[edi], eax
fiadd dword es:[0x1fb82277]
stosb byte es:[edi], al
ja 0x51b032
ja 0x51b056
mov eax, 0xf977aa1f
aad 0xc5
lodsd eax, dword [esi]
imul ebp, dword [esi - 0x134c1a66], 0x64
and ebp, dword [edx]
invalid
mov bh, 0xcf
jg 0x51afea
invalid

Function at 0x51f905
Capabilities:
Encode data using xor

Disassembly:
mov ah, byte [eax + 0x66]
idiv dword [edx]
cmp edx, dword [eax + ecx - 0x24]
mov eax, 0x81bacc4f
mov ebp, 0xdce2f822
xor byte [0xd4d900f], bl
dec ebp
invalid
outsb dx, byte [esi]
dec ebp
dec edx
test dword [esp], esi
pop ebp
fsubr qword [edx + 0x4eb8ce1d]
sub dh, bl
sub dword [esi + 0x6d], 0x63
mov bh, 0xab
je fcn.0051f905
fucompi st(4)
sbb eax, 0x8db0610a
sub al, 0x79
sub dword [eax - 0x47b31151], ebp
hlt
Function at 0x52a49d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x532390
cmp edx, dword [eax]
je 0x52a4bf
add eax, 8
inc ecx
cmp eax, 0x532420
jl 0x52a4b0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x532390]
jne 0x52a5ed
mov eax, dword [0x536d5c]
cmp eax, 1
je 0x52a5c7
test eax, eax
jne 0x52a4f0
cmp dword [0x5322b8], 1
je 0x52a5c7
cmp edx, 0xfc
je 0x52a5ed
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x52a527
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0052ae80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0052b310
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x52a56a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0052b310
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x52f8c4
push edi
call fcn.0052d1e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0052ae80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0052ae90
lea eax, [ebp - 0xa0]
push 0x52f8a4
push eax
call fcn.0052ae90
push dword [esi + 0x532394]
lea eax, [ebp - 0xa0]
push eax
call fcn.0052ae90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0052d154
add esp, 0x2c
pop edi
jmp 0x52a5ed
lea eax, [ebp + 8]
lea esi, [esi + 0x532394]
push 0
push eax
push dword [esi]
call fcn.0052b310
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x1003af9d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
cmp ebx, 3
jmp 0x1003c151
mov byte [esp], 0xfa
mov word [esp], 0x585f
lea esp, [esp + 4]
je 0x1003e862
pushfd
pushfd
push 0x4c790bd9
lea esp, [esp + 0xc]
jmp 0x1003d66d
test cl, dh
add dword [ebx + edi], edx
lea esp, [esp + 4]
pushfd
setl bh
mov bx, word [esi]
test bl, 0x39
and ebx, 0xfff
cmp dh, 0x43
test dh, 0xe1
jmp 0x1003d664

Function at 0x1003b901
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pop esi
setne bl
pop esi
mov esi, dword [esp + 0x18]
seto cl
mov edi, dword [esp + 0x1c]
movzx ebx, cl
xchg ch, bl
lea ebx, [esp + 0x5084687a]
mov ebx, dword [esp + 0x20]
bswap cx
setno ch
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
jmp 0x1003b8ab
mov esp, ebp
lea ebp, [edx - 0x8b82240]
lea ebp, [ebp*2 + 0x3ed5317d]
pushal
mov ebp, dword [esp + 0x20]
pushfd
mov byte [esp], al
mov byte [esp + 4], 0x3b
push dword [esp + 4]
push dword [esp + 0x2c]
ret 0x40
jmp 0x1003ba0b
push dword [esp]
pushfd
lea esp, [esp + 0xc]
je 0x1003aa69
bt bp, 4
xchg bx, di
add dword [ebp - 4], ecx
sub di, si
and bh, 0x9f
pushfd
sar di, cl
sub ecx, 8
rcl bl, 7
not bh
rcr bh, 5
shr ecx, 1
adc bl, bl
btc edi, ecx
shl bl, 1
ror di, 6
mov edi, dword [esi]
pushfd
clc
add edi, dword [ebp + 0x10]
bsf bx, di
cmp bl, 0x45
xor bh, ah
add esi, 8
sub esp, 0xfffffff8
bts bx, bx
and bl, 0x29
shr bh, 1
sal bl, 1
mov bx, word [esi]
push eax
mov byte [esp], ah
push 0xa5a7451e
shr ebx, 0xc
cmc
jmp 0x10079861
push 0x9cefb5ca
pushal
cmc
cmp bl, 0x88
add esi, 2
push esp
dec ecx
call fcn.10074174
cmc
pop ecx
clc
mov byte [ebp - 2], dl
clc
pushal
pushal
cmc
cmp ecx, 4
push 0x6e215462
push 0x500201bc
lea esp, [esp + 0x48]
jmp 0x1007413e
push 0x98d04cd0
mov byte [esp], 0x28
call fcn.1003e48f
movsd dword es:[edi], dword [esi]
in eax, dx
insd dword es:[edi], dx
rcl edx, cl
sub dword [ebx + 0x12], ebx
daa
test dword [0x4f0e9e7c], esp
jns 0x1003e93a
xchg edi, eax
inc ebp
bound esp, qword [edx - 0x3b2bc070]
mov es, ecx
aaa
aaa
retf 0x4888
push 0xbc8a0bb1
cmp ebx, 1
lea esp, [esp + 0xc]
jne 0x1003e963
pushfd
pushal
mov byte [esp + 0xc], 0x6b
lea esp, [esp + 0x24]
je 0x1007b385
bt dx, 2
cmp ebx, 2
pushal
push dword [esp]
pushal
call fcn.1006e2d5
sar bl, cl
rol bh, 4
add bx, 0x89b7
mov bx, word [esi]
push edx
push ebx
and ebx, 0xfff
stc
pushfd
bt cx, si
add word [ebx + edi], ax
push 0x4b3264b3
pushal
pushfd
pushfd
lea esp, [esp + 0x38]
jmp 0x1003d66d

Function at 0x1003df34
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edx, eax
push 0xf8d6e55c
lea esp, [esp + 0x34]
jmp 0x10070db0
Function at 0x1003e48f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
cmc
and ebx, 0xfff
jmp 0x100788b7
mov byte [esp + 4], ch
lea esp, [esp + 8]
je 0x1007b385
pushfd
test ah, 0x14
test bl, 0xd7
pushfd
cmp ebx, 2
mov byte [esp], 0x9c
pushfd
pushal
lea esp, [esp + 0x2c]
je 0x1003e5a1
jmp 0x1007754c
not bh
mov bx, word [esi]
jmp 0x1003da6a
push dword [edi]
pop dword [esp]
push 0x3e7e1388
cmc
cmp edi, ebx
mov byte [esp], cl
pushfd
call fcn.1003af0d
movsx ecx, dl
lahf
lea eax, [edx + 0x36b3ee8]
mov ecx, 0x3d36
movsx di, cl
xchg edi, eax
mov esi, 0x5c31acf1
mov eax, 0x400
bswap si
xchg esi, edi
mov edi, ebx
lea esi, [esi + 0xc276802]
rep stosd dword es:[edi], eax
movsx esi, cl
pushal
mov al, dh
pop ecx
mov esi, dword [ebp + 8]
jmp 0x100777c0
test edi, 0x804da6d4
call fcn.10075617
btr esi, ebx
not esi
mov esi, esp
cmp cl, 0x2b
clc
sub edi, 4
push esp
stc
jmp 0x10077186
setne al
lodsb al, byte [esi]
movsx ecx, dl
pushal
call fcn.1003c623
call 0x10077058

Function at 0x1003ea10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x2c]
jne 0x10075159
pushfd
mov byte [edi - 1], 0
jmp 0x10071c25
bswap eax
movzx ax, bl
pushal
mov dword [esp + 0x20], ebx
movsx ax, al
lea eax, [0x1007aaf3]
mov byte [esp], 1
mov byte [esp + 4], 0x22
call fcn.10078f2c
ror bl, 0x58
scasd eax, dword es:[edi]
lodsd eax, dword [esi]
insd dword es:[edi], dx
ret

Function at 0x10071c05
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xdca0e8cc
pushal
pushfd
lea esp, [esp + 0x34]
ja 0x10075159
push esp
pushfd
pushal
push dword [esp]
lea esp, [esp + 0x2c]
jmp 0x10079b24

Function at 0x10075617
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ebx, 3
mov byte [esp], dl
lea esp, [esp + 4]
je 0x1003e862
pushal
mov byte [esp + 4], 0x41
pushal
push dword [esp]
lea esp, [esp + 0x44]
jmp 0x1003d66d