joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4038ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x403916
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff4138fb
cmp ebx, 0x40
jle 0x4038ca
add dh, al
mov edx, dword [ebp - 4]
call 0x1403bf3
call fcn.0040d38b
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x403981
add bl, bl
jle 0x40394f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b406ce7
add byte [ebp - 4], al
call fcn.0040698b
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x3f39aa
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x40398a
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x4059e3
add byte [eax], al
jmp 0x40395c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.004139df
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.00403d63
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x4039e7
inc ebp
cld
call fcn.004063cb
add byte [ecx], al
loopne 0x4039db
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x44e4cb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x44e536
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff45e51b
cmp ebx, 0x40
jle 0x44e4ea
add dh, al
mov edx, dword [ebp - 4]
call 0x144e813
call fcn.00457fab
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x44e5a1
add bl, bl
jle 0x44e56f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b451907
add byte [ebp - 4], al
call fcn.004515ab
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0043e5ca
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x44e5aa
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x450603
add byte [eax], al
jmp 0x44e57c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.0045e5ff
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.0044e983
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x44e607
inc ebp
cld
call fcn.00450feb
add byte [ecx], al
loopne 0x44e5fb
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x498fcb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x499036
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff4a901b
cmp ebx, 0x40
jle 0x498fea
add dh, al
mov edx, dword [ebp - 4]
call 0x1499313
call fcn.004a2aab
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4990a1
add bl, bl
jle 0x49906f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b49c407
add byte [ebp - 4], al
call fcn.0049c0ab
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004890ca
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x4990aa
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x49b103
add byte [eax], al
jmp 0x49907c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.004a90ff
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.00499483
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x499107
inc ebp
cld
call fcn.0049baeb
add byte [ecx], al
loopne 0x4990fb
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x4e3c2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x4e3c96
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff4f3c7b
cmp ebx, 0x40
jle 0x4e3c4a
add dh, al
mov edx, dword [ebp - 4]
call 0x14e3f73
call int.004ed70b
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x4e3d01
add bl, bl
jle 0x4e3ccf
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b4e7067
add byte [ebp - 4], al
call fcn.004e6d0b
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.004d3d2a
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x4e3d0a
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x4e5d63
add byte [eax], al
jmp 0x4e3cdc
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.004f3d5f
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.004e40e3
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x4e3d67
inc ebp
cld
call fcn.004e674b
add byte [ecx], al
loopne 0x4e3d5b
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x52eb9b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x52ec06
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff53ebeb
cmp ebx, 0x40
jle 0x52ebba
add dh, al
mov edx, dword [ebp - 4]
call 0x152eee3
call fcn.0053867b
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x52ec71
add bl, bl
jle 0x52ec3f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b531fd7
add byte [ebp - 4], al
call fcn.00531c7b
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.0051ec9a
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x52ec7a
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x530cd3
add byte [eax], al
jmp 0x52ec4c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.0053eccf
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.0052f053
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x52ecd7
inc ebp
cld
call fcn.005316bb
add byte [ecx], al
loopne 0x52eccb
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret

Function at 0x53867b
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x82926676
jl 0x53867d
xchg dx, ax
cmp byte [ebx + edi*8 - 6], 0xc
repe scasd eax, dword es:[edi]
cli
or al, 0xf3
scasd eax, dword es:[edi]
stc
and dword [esp + esi - 0x33], ecx
lodsb al, byte [esi]
xor dword [esi], eax
call 0xcf09f168
mov dh, 0x9d
movsd dword es:[edi], dword [esi]
and byte [ebx - 0x613c1dd5], bh
mov esp, 0x90fb5d1d
aaa
mov ebp, 0x1e39dcd6
mov eax, 0x68d19cd
adc al, byte [esi]
xor byte [esi], al
jne 0x538683
fistp word [ebp - 0x1d261977]
push edx
ret
Function at 0x5799ab
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x579a16
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff5899fb
cmp ebx, 0x40
jle 0x5799ca
add dh, al
mov edx, dword [ebp - 4]
call 0x1579cf3
call fcn.0058348b
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x579a81
add bl, bl
jle 0x579a4f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b57cde7
add byte [ebp - 4], al
call fcn.0057ca8b
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call int.00569aaa
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x579a8a
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x57bae3
add byte [eax], al
jmp 0x579a5c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.00589adf
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.00579e63
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x579ae7
inc ebp
cld
call fcn.0057c4cb
add byte [ecx], al
loopne 0x579adb
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x5c488b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x5c48f6
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff5d48db
cmp ebx, 0x40
jle 0x5c48aa
add dh, al
mov edx, dword [ebp - 4]
call 0x15c4bd3
call int.005ce36b
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5c4961
add bl, bl
jle 0x5c492f
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b5c7cc7
add byte [ebp - 4], al
call fcn.005c796b
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005b498a
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x5c496a
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x5c69c3
add byte [eax], al
jmp 0x5c493c
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.005d49bf
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.005c4d43
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x5c49c7
inc ebp
cld
call fcn.005c73ab
add byte [ecx], al
loopne 0x5c49bb
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x60f71b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
mov dh, 0
xor eax, eax
push ebp
push 0x409050
add edi, edi
xor byte [ecx + ecx*4 + 0x20], ah
in al, dx
add byte [ebx + 0x4a7e40fb], al
jle 0x60f786
lea eax, [ebp]
add ecx, ecx
mov edx, 0x59000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
push ebp
add byte [edx + 0x40], bh
call 0xff61f76b
cmp ebx, 0x40
jle 0x60f73a
add dh, al
mov edx, dword [ebp - 4]
call 0x160fa63
call fcn.006191fb
popal
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x60f7f1
add bl, bl
jle 0x60f7bf
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x9b612b57
add byte [ebp - 4], al
call fcn.006127fb
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005ff81a
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
ljmp 4
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 2], bl
add cl, ch
ja 0x60f7fa
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
add al, byte [eax]
jmp 0x611853
add byte [eax], al
jmp 0x60f7cc
nop
inc eax
add byte [edi], ah
mov dword fs:[eax], esp
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
sbb dword [eax], eax
mov esi, 0x2d289
add byte [ebx + 0x508b0100], cl
cld
add edx, 0xc
lea eax, [ebp - 4]
call fcn.0061f84f
mov eax, dword [ebp + 8]
mov edi, dword [ebp]
mov edx, dword [ebp - 4]
call fcn.0060fbd3
add dword [ebp + 8], eax
mov eax, dword [eax - 4]
mov eax, dword [0x2d200]
add byte [eax], al
mov eax, dword [ebp]
add dword [eax - 4], eax
mov byte [eax + 0x5bd3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
jne 0x60f857
inc ebp
cld
call fcn.0061223b
add byte [ecx], al
loopne 0x60f84b
in eax, dx
pop ds
add ah, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x637b17
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x1c
cmp dword [edi + 0x39], 0x72a80ef5
movsb byte es:[edi], byte [esi]
xchg ecx, eax
shl dword [ecx - 0x1c], 0xc2
retf 0x4d28
rol esp, 1
ret
inc edi
shl ecx, 1
cmp dword [edx - 0x7c], ebp
pop es
insb byte es:[edi], dx
jg 0x637b61
cli
mov ch, 0x23
nop
ja 0x637abb
mov dl, 0xaa
wait
hlt
xor dword [eax + 0x5cc15ce2], esp
sub dh, cl
xor eax, ebp
adc eax, 0xdebaf394
jae 0x637b0d
mov edx, 0xe3a373de
insb byte es:[edi], dx
jecxz 0x637bd8
ficom dword [edx - 0x3c8e89b3]
dec ebx
inc eax
cdq
imul dword [esi]
test bl, ah
mov ebp, dword [eax]
adc byte [edi], ah
mov bl, 0xb3
neg edi
xchg ebx, eax
and dword [eax - 0x57006039], 0xffffffd4
push edx
aaa
xchg ebx, eax
jp 0x637b66
inc ebp
jb 0x637bc3
movsb byte es:[edi], byte [esi]
ja 0x637b59
pop esi
rcl bh, 0x62
push es
sbb dh, byte [eax + esi*8 - 0xb932f12]
clc
invalid
invalid
ljmp 0xe4b9:0x7689eb6c
and edx, dword [esi + 0xd]
clc
or eax, 0x7e22a6a2
test al, 0xe3
adc al, 0xaa
xor al, 0x8d
sbb al, 0xaa
jo 0x637bce
ffreep st(0)
in al, 0x9c
lodsd eax, dword [esi]
xor ecx, dword [ecx - 0x69dcc3bf]
jle 0x637b9b
jae 0x637bee
fld dword [esi]
ja 0x637b77
js 0x637bae
aam 0xc5
inc esi
cmp byte [edx], ah
in eax, 0x30
add esp, dword [edx - 0x43ed1dd9]
lds eax, [esi + 0x38]
and ah, ch
xor byte [ebx], al
mov byte [0xbc12e227], al
imul edx, dword [edx + 0x58], 0x1f744424
les edi, [ebx - 0x7b68eef6]
push esp
invalid

Function at 0x658f3d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x660398
cmp edx, dword [eax]
je 0x658f5f
add eax, 8
inc ecx
cmp eax, 0x660428
jl 0x658f50
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x660398]
jne 0x65908d
mov eax, dword [0xa5d0f4]
cmp eax, 1
je 0x659067
test eax, eax
jne 0x658f90
cmp dword [0x6602c4], 1
je 0x659067
cmp edx, 0xfc
je 0x65908d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658fc7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00659920
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00659db0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65900a
lea eax, [ebp - 0x1a4]
push eax
call fcn.00659db0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65e5ec
push edi
call fcn.0065bc80
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00659920
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00659930
lea eax, [ebp - 0xa0]
push 0x65e5cc
push eax
call fcn.00659930
push dword [esi + 0x66039c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00659930
push 0x12010
lea eax, [ebp + 8]
lea esi, [esi + 0x66039c]
push 0
push eax
push dword [esi]
call fcn.00659db0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
Function at 0x438400
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43842d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43842d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
nop
nop
jmp loc.00401219
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6e693c21
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4310d2
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5d1c3a4d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6443703a
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6c0073b0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219