joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b2a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45ecd8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x47a070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40b448
cmp byte [ebx + 0x3d], 0
je 0x40b448
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x40b2f9
xor al, al
jmp 0x40b44a
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00405e10
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebx + 0x38]
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edi, [ebp - 0x28]
cmp edx, 0x10
lea esi, [ebp - 0x28]
mov edx, dword [ecx]
cmovae edi, dword [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x40b366
sub eax, 1
je 0x40b36a
mov edx, dword [ebp - 0x14]
sub eax, 2
je 0x40b42e
xor bl, bl
jmp 0x40b430
mov byte [ebx + 0x3d], 0
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, ecx
sub esi, eax
je 0x40b39f
push dword [ebx + 0x4c]
cmp edx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, ecx
push 1
push eax
call fcn.0044278b
mov edx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x40b35f
cmp byte [ebx + 0x3d], 0
je 0x40b42e
test esi, esi
jne 0x40b321
mov ecx, dword [ebp - 0x18]
or eax, 0xffffffff
sub eax, ecx
cmp eax, 8
jbe 0x40b424
lea esi, [ecx + 8]
cmp esi, 0xfffffffe
ja 0x40b424
cmp edx, esi
jae 0x40b40b
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00407560
mov edx, dword [ebp - 0x14]
test esi, esi
je 0x40b321
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edx, 0x10
xorps xmm0, xmm0
cmovae ecx, dword [ebp - 0x28]
movq qword [eax + ecx], xmm0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x18], esi
cmovae eax, dword [ebp - 0x28]
mov byte [esi + eax], 0
jmp 0x40b31e
test esi, esi
jne 0x40b3df
cmp edx, 0x10
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov byte [eax], 0
jmp 0x40b31e
push str.string_too_long
call fcn.0040fea6
mov bl, 1
cmp edx, 0x10
jb 0x40b444
lea ecx, [edx + 1]
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.00406ce0
mov al, bl
jmp 0x40b44a
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00423334
mov esp, ebp
pop ebp
ret
Function at 0x40b700
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45e8a6
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x47a070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00423581
mov esi, eax
push 1
mov dword [ebp - 4], 0
call fcn.0040fb03
mov dword [esi + 4], eax
lea ecx, [edi + 8]
lea eax, [edi + 4]
mov dword [edi + 0x34], esi
mov dword [edi + 0xc], eax
add esp, 8
lea eax, [edi + 0x14]
mov dword [edi + 0x10], ecx
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [edi + 0x20]
mov dword [eax], 0
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42605c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4504f7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004501ba

Function at 0x450502
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045033b

Function at 0x45555d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045521d

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3a31414
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x78414c32
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x40eb4d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ecx], al
add byte [eax], al
push ebx
push ecx
push ecx
push ebx
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153
mov dword [esp + 0x120], 0x53515153

Function at 0x418ca1
Capabilities:
Encode data using xor

Disassembly:
xor ebx, dword [ebx + 0x6421f42d]
mov al, 0xd3
in al, dx
out 0x1f, eax
sbb byte [edx], dh
jecxz 0x418c6d
outsb dx, byte [esi]
insb byte es:[edi], dx
adc al, 0x46
enter 0xffffffffffffca36, 0xffffffffffffffd8
mov cs, word [ebp - 0x3e]
std
inc esi
in eax, dx
push ss
or eax, 0x592c5a06
push 0x76956156
sub esp, dword [esi]
lahf
jae 0x418c87
jae 0x418c81
invalid
push ss
sbb ecx, dword [ebp - 0x55994ce8]
pushal
inc ecx
push esi
xor eax, 0xb4648f30
test eax, 0xb1d279c8
mov ah, 0xa9
enter 0xffffffffffffd279, 0xffffffffffffffb1
mov cl, 0x74
std
je 0x418c8c
mov dl, byte [edi + 0x38dacdda]
or eax, 0xc5bfe1e1
push ss
ret 0x332
out 0x67, eax
test edx, ebp
dec ecx
jbe 0x418c36
daa
cmp byte [ecx], bh
cmp ecx, eax
xchg byte [esi], dl
leave
push es
sbb edi, dword [ebx - 0x26]
nop
pop edx
push ds
sbb dh, byte [ebp + 0xd]
sti
cmc
jmp 0x418cdb
salc
fidivr dword [edx + ebx*4 - 0x80]
mov dword [edi + eax*2], edx
shr dword [eax - 0x2a], 1
cmc
xor cl, byte [ebx - 0x2a]
stosd dword es:[edi], eax
test cl, cl
dec byte [edi]
mov dl, 0x4a
salc
aad 0x12
mov al, 0x13
das
adc ah, byte [esi - 0x50]
adc ebp, dword [edi]
fisub word [edi + 0x6f]
sahf
jge 0x418cc2
cld
cmc
into
in eax, dx
mov esi, cs
in eax, dx
add dword [edx + ecx*4 - 0x4e], esp
imul ecx, dword [eax], 0x21
xchg byte [edx - 9], ah
mov edx, 0xe2df5f79
ja 0x418d75
popal

Function at 0x41922e
Capabilities:
Encode data using xor

Disassembly:
cli
jb 0x419264
fsub dword [esi - 0x38]
nop
push eax
cmp byte [edi + 0x44], ah
test dword [eax - 0x6bcebac3], 0xe4ffb6cc
rol byte [eax], 1
jge 0x41926e
sub eax, 0xe49821c0
sub byte [ebx - 0x3eb3af7e], ch
sbb ch, byte [eax]
bound edi, qword [esi]
inc edi
in al, dx
mov ah, 0xec
cmc
push ds
push edx
push eax
and bh, dh
dec ebx
insb byte es:[edi], dx
push 0x3d
sbb ch, bh
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp eax, 0xababef1a
ret
sub eax, dword [eax + 0x67]
inc ebx
sub esp, dword [edi - 0x3c]
test al, 0x20
stosd dword es:[edi], eax
pushal
sub al, 0x1d
xor bl, dh
pushal
movsd dword es:[edi], dword [esi]
pushfd
invalid
Function at 0x41b958
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, 0x20
add dword [eax], eax
add byte [ebx + 0x52], dl
push edx
push ebx
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
mov dword [esp + 0x120], 0x53525253
push edx
push ebx

Function at 0x425218
Capabilities:
Encode data using xor

Disassembly:
dec ebp
sal dword [ecx], 0x10
mov ch, 0x25
dec edx
xor byte [edi + 0x24], dl
sbb eax, 0xe254ea38
pushfd
dec ebx
imul byte [edx - 0x70]
push ds
push esp
invalid
dec eax
lodsd eax, dword [esi]
jae 0x4251ba
sti
cld
xchg ebx, eax
jge 0x42528e
inc edx
push ebx
out 0x68, eax
ja 0x42526e
invalid
mov byte [0x7b3a1860], al
test byte [ecx], dh
retf 0x46cc
xchg edx, eax
inc esi
lea edx, [eax - 0x232d139e]
shl dword [ebx - 0x4b], cl
xchg esi, eax
xchg ebx, eax
dec ebp
les esp, [eax + 0x1b]
dec edi
jne 0x42530a
cdq
stosd dword es:[edi], eax
mov al, 0xfb
aad 0x2d
dec byte [eax]
mov edx, 0xa9dabda
sbb ecx, ebp
mov bl, byte [edi - 0x72]
dec ecx
scasd eax, dword es:[edi]
sahf
imul edx, dword [ebx], 0xfffffff3
das
std
sub eax, dword [edx - 0x628902e8]
jl 0x425321
dec esi
pop ebp
invalid
retf 0xc948
push ebp
movsb byte es:[edi], byte [esi]

Function at 0x42869e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stc
push edx
invalid
sub byte [esi + 0x70eee00f], dh
push ss
xchg edx, eax
sub eax, dword [edx - 0x70761506]
leave
mov ah, 0xf9
xchg ebp, eax
mov eax, 0xa9be86c6
pop esp
dec esi
add esi, esi
imul edi
wait
jne 0x428732
pop edx
out 0xd6, eax
push ss
outsd dx, dword [esi]
into
jnp 0x428696
or eax, esp
mul bl
push es
xor bh, byte [ecx + ebx*2 - 0x6d097a79]
not byte [edx]
jne 0x4286c4
sub bl, byte [edx]
push eax
or dh, byte [esi - 0xc194df8]
inc esp
outsb dx, byte [esi]
salc
std
sbb al, 0x65
call 0x8be5d568
add dl, dh
push edi
movsb byte es:[edi], byte [esi]
ret 0xe648
inc esp
push ebp
lodsb al, byte [esi]
pushal
or dword [0xc8c578e7], 0x976c26c1
aad 0x42
xchg dword [esi], eax
jb 0x4287a9
loopne 0x4287a6
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [ebx + 0x53], dl
push ebx
push ebx
mov dword [esp + 0x120], 0x53535353
invalid

Function at 0x428763
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test byte [eax], ah
add dword [eax], eax
add byte [ebx + 0x53], dl
push ebx
push ebx

Function at 0x43091c
Capabilities:
Encode data using xor

Disassembly:
mov al, byte ss:[0xb9db8004]
aad 0xdf
or al, 0xf0
mov ah, 0xe9
test byte [esi + edx*4 - 0x5995da76], cl
sub edx, dword [edi + 0x18]
test al, 0x71
xlatb
jo 0x43098e
outsd dx, dword [esi]
outsd dx, dword [esi]
add byte [ecx], dl
jo 0x430942
sbb esi, dword [esi]
add bh, al
mov bh, 0x8f
push eax
invalid
invalid
fidiv dword [edx]
xchg byte [ecx - 0x4d4c1326], al
adc bl, byte [ecx]
and eax, 0x1e5ed402
invalid
Function at 0x4313f7
Capabilities:
Encode data using xor

Disassembly:
ficom word [ebp + 0x6d540bc6]
invalid
out dx, eax
je 0x4313c0
lodsd eax, dword [esi]
or ebx, dword [edi + ecx]
xchg esp, eax
and ebp, dword [ecx + 0x2a]
adc dword [ebx], edx
xchg ecx, eax
invalid

Function at 0x442b04
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
push ebx
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
mov dword [esp + 0x120], 0x53565653
add byte [ebx + 0x56], dl
push esi
push ebx

Function at 0x44b988
Capabilities:
Encode data using xor

Disassembly:
pop eax
std
scasb al, byte es:[edi]
xchg bh, ch
aam 0x46
hlt
imul byte [ebx]
invalid
cmp ch, ah
nop
out dx, al
push esi
int 0x2d
xchg dl, dh
sub byte [ebx - 0x7c301e9], ah
clc
rcr bl, cl
loope 0x44b921
outsb dx, byte [esi]
mov ebx, 0x531cf1e3
js 0x44b9e4
inc ebx
fbld tbyte [eax + 0x3da814ce]
loop 0x44b924
jae 0x44b930
inc esp
mov ebp, 0x3f0da59
mov byte [0xdfdab434], al
mov al, byte [0xf5b72f1d]
and al, 0x38
ficom dword [ecx - 0x6e]
push ss
mov edi, 0xd46fd6b0
and eax, 0x3c218f42
xchg dword [edx], esi
pushal
jecxz 0x44b9f7
cmp al, 0x87
xor ah, byte [eax - 0x1d]
xor dword [edi + 0x53], ecx
dec edi
push ebx
sub esi, dword fs:[edi]
cli
xchg ebp, eax
and bl, cl
mov dl, byte [esi]
xor dword [eax - 0x4e], edx
clc
add byte [ebx + edx*2 + 0x38], ch
add byte [ebp + 0x7552eeeb], 0x9c
xor ebx, dword [0xdcf304e8]
aaa
fdiv qword [edi]
cmpsd dword [esi], dword es:[edi]
insd dword es:[edi], dx
out 0x23, al
jnp 0x44b9c0
ficom dword [esi]
push cs
fmul qword [edx]
invalid
mov dh, 0x23

Function at 0x45a0ec
Capabilities:
Encode data using xor

Disassembly:
pop es
lodsb al, byte [esi]
sbb byte [eax + esi - 0x652942ed], cl
sbb byte [ebx], 0xfc
push eax
or eax, dword [edx - 0x31]
pushfd
out dx, al
xor esp, dword [ecx - 0x36]
push ebp
push eax
in eax, 0x3b
scasd eax, dword es:[edi]
invalid
sub eax, 0xbf62eefe
adc bl, byte [ebp + ecx*2 - 0x735676f0]
and eax, 0xbe42dc4f
adc edi, dword [ebx - 0x5a]
pop ss
xchg edx, eax
mov ch, 0xd5
jo 0x45a087
xchg ebp, eax
lds ebp, [ebx + 0x15]
loopne 0x45a145
insb byte es:[edi], dx
sub eax, 0xb92bad2c
insb byte es:[edi], dx
invalid
ljmp 0x9099:0x44de3a21
Function at 0x45a80b
Capabilities:
Encode data using xor

Disassembly:
pop eax
hlt
aad 0x48
inc ebp
out dx, al
aam 0xda
arpl word [ecx], bx
je 0x45a783
jmp 0x3d997aff
dec edi
aas
wait
loope 0x45a794
cmp cl, byte [ebx]
mov esi, 0x34747d0f
dec esi
fucomp st(3)
aad 0x44
push dword [ebx + 0x7781becd]
push 0xd48e7fff
mov ebp, 0xf1eecac8
in eax, dx
invalid

Function at 0x45cab4
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
pop ebp
mov bl, 0x9c
pushfd
idiv byte [ebx + edi]
out dx, eax
mov eax, dword [0xbb362c05]
sub dh, byte [ebp + edx*4 + 0x1c]
xor al, 0x7d
wait
and ecx, dword [ebp + 0x7b]
lodsd eax, dword [esi]
mov esp, dword [ebp + esi*2 + 0x77]
jne 0x45cad8
pop ebp
cmc
sbb eax, dword [ebx - 7]
push cs
xchg edi, eax
out dx, al
popfd
jb 0x45ca47
lodsd eax, dword [esi]
mov ebx, 0x43e87de9
add eax, 0x68f18d3f
xchg ebp, edi
popfd
insd dword es:[edi], dx
xor edi, edi
pop eax
push cs
xchg ebp, eax
sub byte [esi + 0x1308f92d], ch
int3
ret
insd dword es:[edi], dx
dec ebx
jns 0x45ca45
mul dword [eax + 0x693f8fc]
jl 0x45ca5e
pop ebx
lds ebx, [0x556d2a5f]
in al, dx
imul ecx, edi, 0xffffff9d
and dword [esi + ebp*8 + 0x1c], edi
lodsb al, byte [esi]
inc ecx
jle 0x45cb02
invalid
inc eax
pop esp
inc ebx
jle 0x45ca93
outsd dx, dword [esi]
mov ah, 0xfe
inc ebp
aam 0x2c
jge 0x45cb3e
inc ebx
jp 0x45cb65
push ebx
dec esp
popal
lea ecx, [0x1f67dc9]
xchg byte [0x2d3a776b], ch
lea ebp, [esi - 0x1401d2ac]
lea edx, [edx - 0x312ef8ff]
into
mov bl, 0x90
xor esp, edi
add al, 4
adc dl, ch
adc al, byte [eax + 0x27]
inc edi
invalid
sub byte [eax + 0x6a], al
xor al, 0x41
imul byte [eax]
jne 0x45caf1
inc sp
push ecx
fild dword [ebx]
invalid
add byte [eax], al
add byte [ecx], al
add byte [eax], al
push ebx
push ebp
push ebp
push ebx
invalid
test byte [eax], ah
add dword [eax], eax
invalid
push ebx

Function at 0x467155
Capabilities:
Encode data using xor

Disassembly:
cmc
sub cl, byte [0xc13dd4ca]
dec eax
push ebp
mov dword [ecx - 0x26ea36e0], esi
adc byte [eax], al
inc ecx
leave
adc eax, 0x410010d9
jp 0x46713a
in eax, dx
out dx, al
jmp 0x46717a
dec ecx
mov byte [ecx + ecx*4 - 0x727ffd8e], cl
sub byte [ecx - 0x7a], bl
call 0xfa1f9402
push esp
jno 0x467182
xchg byte [edi + 2], bh
jbe 0x467206
sub byte [ecx + ecx], dh
dec esp
enter 0xffffffffffffb244, 0xffffffffffffffd1
xchg ebp, eax
xor al, 0x17
mov bh, 0x29
daa
xchg edi, eax
jo 0x4671af
inc ebx
clc
cld
mov edi, 0x4694a603
mov bl, 0x67
test ch, cl
int3
int 0xcc
movsb byte es:[edi], byte [esi]
xchg edx, eax
xchg esi, eax
jmp 0x467161
lodsb al, byte [esi]
and ah, al
outsb dx, byte [esi]
xor ah, 0x49
mov ds, word [edx + 0x78]
sar byte [eax + ebp*2 + 0x10b8dff9], 0x2c
jg 0x4671fc
lcall 0x7c89, 0xb3d1037c
mov al, 0xe7
cld
out 8, eax
js 0x46724e
fst qword [edx + 0x3788bf05]
push esi
push 0x29
fistp qword [ecx - 0x2c95ef84]
adc byte [ecx + 0x628e2ace], dh
mov edx, 0xd42765b3
sub al, 0xce
fadd dword [ebp + edi*4 + 0x3fea7784]
push ebp
cdq
adc dword [ecx + 0x7183360e], edi
cmp al, 0xa8
ljmp 0x6095
push edi
in al, 0xbe
xchg ebp, eax
pushal
invalid
Function at 0x46a2f9
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f708
push 0x46a120
mov eax, dword fs:[0]
add byte [eax], al
push eax
mov dword fs:[0], esp
add byte [ebx + 0x565358ec], al
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x1085584], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x1085580], ecx
shl ecx, 8
add ecx, edx
mov dword [0x108557c], ecx
shr eax, 0x10
mov dword [0x1085578], eax
xor esi, esi
push esi
call fcn.0046ace6
pop ecx
test eax, eax
jne 0x46a352
push 0x1c
call fcn.0046a401
pop ecx
mov dword [ebp - 4], esi
call fcn.0046ab3b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1086ab8], eax
call fcn.0046aa09
mov dword [0x1085560], eax
call fcn.0046a7bc
call fcn.0046a703
call fcn.0046a425
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]

Function at 0x46a302
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46f708
push 0x46a120
mov eax, dword fs:[0]
add byte [eax], al
push eax
mov dword fs:[0], esp
add byte [ebx + 0x565358ec], al
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x1085584], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x1085580], ecx
shl ecx, 8
add ecx, edx
mov dword [0x108557c], ecx
shr eax, 0x10
mov dword [0x1085578], eax
xor esi, esi
push esi
call fcn.0046ace6
pop ecx
test eax, eax
jne 0x46a352
push 0x1c
call fcn.0046a401
pop ecx
mov dword [ebp - 4], esi
call fcn.0046ab3b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x1086ab8], eax
call fcn.0046aa09
mov dword [0x1085560], eax
call fcn.0046a7bc
call fcn.0046a703
call fcn.0046a425
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
Function at 0x46ad5b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x473108
cmp edx, dword [eax]
je 0x46ad7d
add eax, 8
inc ecx
cmp eax, 0x473198
jl 0x46ad6e
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x473108]
jne 0x46aeab
mov eax, dword [0x1085568]
cmp eax, 1
je 0x46ae85
test eax, eax
jne 0x46adae
cmp dword [0x47306c], 1
je 0x46ae85
cmp edx, 0xfc
je 0x46aeab
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46ade5
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0046b300
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0046b470
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x46ae28
lea eax, [ebp - 0x1a4]
push eax
call fcn.0046b470
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46f9e8
push edi
call fcn.0046c100
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0046b300
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0046b310
lea eax, [ebp - 0xa0]
push 0x46f9c8
push eax
call fcn.0046b310
push dword [esi + 0x47310c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0046b310
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0046c06e
add esp, 0x2c
pop edi
jmp 0x46aeab
lea eax, [ebp + 8]
lea esi, [esi + 0x47310c]
push 0
push eax
push dword [esi]
call fcn.0046b470
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40b16a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f86
and dword [ebp - 4], 0
cmp dword [0x42a22c], 0
mov ebx, eax
jne 0x40b21b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40b2cc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x40b2cc
push eax
call fcn.00404f14
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42a22c], eax
call esi
push eax
call fcn.00404f14
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42a230], eax
call esi
push eax
call fcn.00404f14
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42a234], eax
call esi
push eax
call fcn.00404f14
pop ecx
mov dword [0x42a23c], eax
test eax, eax
je 0x40b21b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404f14
pop ecx
mov dword [0x42a238], eax
mov eax, dword [0x42a238]
cmp eax, ebx
je 0x40b273
cmp dword [0x42a23c], ebx
je 0x40b273
push eax
call fcn.00404f8f
push dword [0x42a23c]
mov esi, eax
call fcn.00404f8f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40b273
test edi, edi
je 0x40b273
call esi
test eax, eax
je 0x40b26a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40b26a
test byte [ebp - 0xc], 1
jne 0x40b273
or dword [ebp + 0x10], 0x200000
jmp 0x40b2ac
mov eax, dword [0x42a230]
cmp eax, ebx
je 0x40b2ac
push eax
call fcn.00404f8f
pop ecx
test eax, eax
je 0x40b2ac
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40b2ac
mov eax, dword [0x42a234]
cmp eax, ebx
je 0x40b2ac
push eax
call fcn.00404f8f
pop ecx
test eax, eax
je 0x40b2ac
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42a22c]
call fcn.00404f8f
pop ecx
test eax, eax
je 0x40b2cc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40b2ce
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219