joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406430
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41d67b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x404194
call fcn.00408fa4
push 4
mov dword [esp + 0x18], 0
call fcn.0040a763
mov edi, eax
add esp, 4
test edi, edi
je 0x4064a4
push ebx
call fcn.00408d9f
mov dword [edi], eax
call fcn.00408b5e
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00408f65
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406498
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00408f8d
pop ebx
jmp 0x4064a6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x40b25b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4203ec]
jne 0x40b265
repz ret
jmp fcn.004120bc
Function at 0x4177e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4203ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00410cd7
and dword [ebp - 0x14], 0
cmp dword [0x4381b0], 0
mov dword [ebp - 0x18], eax
jne 0x417897
push 0x403f30
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41793f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f24
push ebx
call edi
test eax, eax
je 0x41793f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f14
push ebx
mov dword [0x4381b0], eax
call edi
push eax
call esi
push 0x403f00
push ebx
mov dword [0x4381b4], eax
call edi
push eax
call esi
push 0x403ee4
push ebx
mov dword [0x4381b8], eax
call edi
push eax
call esi
mov dword [0x4381c0], eax
test eax, eax
je 0x417897
push 0x403ecc
push ebx
call edi
push eax
call esi
mov dword [0x4381bc], eax
mov eax, dword [0x4381bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4178f0
cmp dword [0x4381c0], ecx
je 0x4178f0
push eax
call esi
push dword [0x4381c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4178f0
test ebx, ebx
je 0x4178f0
call edi
test eax, eax
je 0x4178e7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4178e7
test byte [ebp - 8], 1
jne 0x4178f0
or dword [ebp + 0x10], 0x200000
jmp 0x417923
mov eax, dword [0x4381b4]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417923
mov eax, dword [0x4381b8]
cmp eax, dword [ebp - 0x18]
je 0x417923
push eax
call esi
test eax, eax
je 0x417923
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4381b0]
call esi
test eax, eax
je 0x41793f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417941
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b25b
leave
ret
Function at 0x419200
Capabilities:
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x1388
call fcn.004180a0
cmp dword [0x8e2604], 0x37
push esi
jne 0x419306
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
lea ecx, [esp + 0xb8c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
call esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
mov eax, dword [esp + 0xc]
push 0
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push 0
lea ecx, [esp + 0x38c]
push ecx
push 0x40401c
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0
lea edx, [esp + 0x78c]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x168]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0
call esi
push 0x404034
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
lea edx, [esp + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileSectionW]
push 0x30
lea ecx, [esp + 0x24]
push 0
push ecx
mov dword [esp + 0x28], 0
call fcn.0040a580
add esp, 0xc
lea edx, [esp + 0x1c]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CommConfigDialogW]
mov eax, dword [0x8e4d68]
mov dword [esp + 8], eax
mov eax, 0x5d1
add dword [esp + 8], eax
mov ecx, dword [esp + 8]
mov dl, byte [ecx + edi]
mov eax, dword [0x8e0dfc]
mov byte [eax + edi], dl
pop esi
add esp, 0x1388
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x6562d0b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
mov eax, section..text
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x14f53605
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4cec0f
Capabilities:
Encode data using xor

Disassembly:
pushfd
mov dword [0xeba6f801], eax
cmp byte [edx + 0x48d31e45], bh
push es
dec esp
mov eax, 0x7ad0a2fa
xor al, 0x22
mov ch, byte [ecx + esi*2]
test al, 0x83
sbb dword [esi - 0x30777919], ecx
xor dword [ecx + 0x8cf68b9], 0x56
invalid
insd dword es:[edi], dx
pop edx
ficomp dword [eax + 0x69]
dec ecx
ja 0x4cebe9
jle 0x4ceb9b
push ebp
xor eax, 0xa81cda49
salc
leave
push ecx
popfd
loope 0x4cec25
idiv ecx
invalid
movsd dword es:[edi], dword [esi]
sbb al, 0xf
movsb byte es:[edi], byte [esi]
loope 0x4cec50
and byte [eax], 0xcf
cli
loop 0x4cec96
add al, 1
pop ecx
jmp 0x4cebd7
mov byte [0x1f344528], al
loope 0x4cec8f
jmp 0x1de383ef
push 0xffffffffffffffde
sbb edx, ecx
xchg dword [ebp - 3], eax
mov ecx, 0xefb3a621
pop eax
mov bl, 0xeb
mov ch, 0x3c
sub dword [esi + 0x1bb12aca], edi
push edx
sar byte [edx + 0x1a373810], cl
dec ebx
jg 0x4ceca5
xor eax, 0x3eb2c560
dec eax
int3
invalid
sbb bl, dh
pop edi
and byte [eax], 0x95
xchg edx, eax
xchg edx, eax
std
invalid
daa
enter 0xffffffffffffb879, 0x4a
cld
aaa
scasb al, byte es:[edi]
cmp esi, dword ss:[edi]
adc al, 0x52
cmp al, 0x35
jge 0x4cec9d
out 0x3b, eax
dec eax
pop es
dec edx
jmp 0x67c9d5a8

Function at 0x4ed57b
Capabilities:
Encode data using xor

Disassembly:
iretd
cmpsb byte [esi], byte es:[edi]
and byte [ebp - 0x5d8e70b1], al
jno 0x4ed524
push cs
mov eax, 0xa33760c3
inc edx
psubusw mm4, mm1
push ebx
arpl cx, ax
wait
mov byte [0xf7259f7c], al
xchg edx, eax
adc esp, dword cs:[edx - 0x1d346023]
in eax, dx
xchg esp, eax
imul edx, esi, 0x39
push edx
test dword [ecx + 0x36], esp
arpl word [esi - 0x26], bx
pop es
adc byte [eax], dh
add ecx, edi
sub dword [esi + eax - 0x70], edi
inc ecx
imul eax, ecx, 0x4f
xor al, 0xfd
or byte [ecx], cl
xchg edx, eax
mov ebp, 0x3dd687b2
dec ebx
mov cl, 0xd
sbb dword [edx + 0x65bb2be], esp
das
cmp byte [ebx - 0x7a], ah
add eax, 0x2e4fd6af
fucomp st(0)
cmp byte [edx + 0x1b], dh
push es
das
out 0xcf, al
jp 0x4ed580
mov byte [0xe1fa217], al
int 0xc9
pop ss
mov byte [0xc9cd0e1f], al
sub al, 0x9b
das
cmpsd dword [esi], dword es:[edi]
adc al, 0x62
dec edi
dec esp
or ah, byte [edx]
sahf
into
sbb dl, byte [ebx]
mov dl, 0xbc
add al, 0xe4
js 0x4ed5dd
jp 0x4ed64d
std
jb 0x4ed5ec
movsb byte es:[edi], byte [esi]
jmp 0x4ed66b
psubq mm5, qword [edi - 0x21aebf05]
or dword [edi - 0x4b3a54f2], 0x32
xchg ebp, eax
cmp eax, 0x8edda672
mov byte [0x6274ffaf], al
neg byte [edx]
xchg ebp, eax
push ss
daa
lodsb al, byte [esi]
test byte [ebx + 0x65], dh
or eax, 0xe0137f4d
and ch, byte [ebx - 1]
dec esi
nop
mov al, byte [0x4fe2d41a]
add eax, 0x941fe30c
dec ebx
ret
ret 0x2e45
jae 0x4ed606
dec ecx
and ah, al
invalid
Function at 0x51e62a
Capabilities:
Encode data using xor

Disassembly:
sar bl, 1
insd dword es:[edi], dx
mov cs, edi
cmpsb byte [esi], byte es:[edi]
mov edx, 0xbe6b7fb0
adc dword [eax], edi
out dx, eax
popfd
sbb bh, 0x87
stc
cmp esi, dword cs:[ecx - 0x12]
sbb byte [esi*4 - 0x7a5da30b], 0xa1
sbb eax, dword [edx + 0x21d3d0ef]
mov esi, 0x760fd2f
pop esp
mov byte [0x821ba185], al
out dx, eax
rcl bl, 1
and dword [esi + 0x760fd2f], edi
pop esi
jg 0x51e6ae
sbb al, 0xc3
jb fcn.0051e699
cmp eax, 0x6330ad07
scasb al, byte es:[edi]
push edx
std
and edx, 0xd0893ea3
mov eax, edx
daa
or bl, byte [esi]
pushal
and bh, byte [esi - 0x40]
wait
xor dl, byte [esi - 0x621abb43]
lodsb al, byte [esi]
inc eax
xchg ah, bl
jl 0x51e6da
dec edi
cld
stosd dword es:[edi], eax
movsd dword es:[edi], dword [esi]
pop ds
mov al, byte [0x394c3efd]
push ebx
les ecx, [eax - 0x32722b49]
out dx, al
cmp eax, 0xdfbdbd49
adc dword [edi + ebp*4], 0xfd792f9d
jns 0x51e698
inc edx
jge 0x51e645
and bh, dl
retf
pop edx
pop ss
daa
jge 0x51e6f3
dec edi
cmp eax, 0x8c41ef31
iretd
into
jae 0x51e667
mov al, 0xc0
int1
fild word [eax - 0x70]
xchg esp, eax
aas
arpl word [esi], di
invalid
xchg edx, eax
mov cl, 0xdc
arpl ax, si
das
lea ebx, [ecx]
loope 0x51e6a1
push ds
scasd eax, dword es:[edi]
inc edi
dec ecx
jp 0x51e772
mov al, byte [0x612e7233]
int 0x83
xchg dword [edx], esi
inc ebx
wait
inc eax
xchg ecx, eax
invalid
jb 0x51e7a1
test al, 0x3f
dec esi
Function at 0x53732b
Capabilities:
Encode data using xor

Disassembly:
pop ecx
fcom dword [edi + 0x35]
xchg cl, cl
cmp byte [edi + ecx*8], 0xc9
push edx
ljmp 0x5d87
ja 0x537387
push esi
push ds
imul edx, dword [esi - 0x5932989b], 0x75
push 0x15f11805
div dword [ecx - 0xf]
push edx
xor eax, 0x18855dce
jmp 0x5372f5
ja 0x5373c8
cli
invalid
stc
adc byte [ecx + 0x20], bl
pop ss
cmp eax, 0x5b558f04
jnp 0x537401
pop esi
test al, 0xc0
sar edi, cl
lodsd eax, dword [esi]
lodsd eax, dword [esi]
in eax, 0x1b
dec edi
xchg ecx, eax
sbb ecx, dword [edi + 0x2e]
xchg ecx, eax
sub esi, edi
clc
jnp 0x53745e
cmpsb byte [esi], byte es:[edi]
test byte [eax], 0xb5
imul ebp, dword cs:[ecx], 0xf756c5a5
xor ebp, esp
inc esp
xlatb
jo 0x5373dc
enter 0x2fed, 0xffffffffffffffe7
sub dword [esi - 0x3a], ecx
xchg dword [esi - 0x6e], ebp
cmpsd dword [esi], dword es:[edi]
pop eax
mov dword [esi], esp
fmul dword [edx + 0x30]
adc edx, dword [edx - 0x2d]
outsd dx, dword [esi]
mov esp, 0xa7d79b00
add esp, dword [edi - 0xb]
salc
wait
test dh, dh
arpl word [eax - 0x1c], di
xor al, byte [ebx + 0x75]
invalid
loopne 0x5374cb
mov byte [ebp + 0x7cfb396], bh
imul esp, dword [ebx + esi*2 - 0x3421b7d8], 2
test al, 0xe2
mov word [ebx], fs
and dword [edx - 0x1176d684], esi
leave
dec ebp
rcl byte [esi + 0x20], 0x94
lodsb al, byte [esi]
invalid
or dh, byte [ebx - 0x27]
mov esi, 0x54990de5
stosb byte es:[edi], al
cdq
wait
mul dword [esi]
pop ecx
invalid
mov esp, 0xf2ac438a
cwde
lodsb al, byte [esi]
cwde
sub byte [esi - 0x2a], al
mov word [edi - 0x1926e853], ss
js 0x5374a4
pop esp
xor byte [eax + 0x6b], cl
and ecx, dword [edi - 0x242f5c69]
adc ecx, ecx
adc dword [ebx - 0x53424d58], esp
lodsd eax, dword [esi]
xor ebx, ecx
adc ch, byte [ecx - 0x3823b5ff]
popal
and eax, 0x660dc551
xchg ebx, eax
sub byte [ebp - 0x18], bh
add ch, cl
js 0x5374ce
inc edx
sub dl, byte [edi + 0x26]
adc ecx, edi
std
mov edx, 0x772d86d6
invalid
Function at 0x564053
Capabilities:
Encode data using xor

Disassembly:
pop eax
adc ah, byte [esi]
in eax, dx
dec ecx
and cl, bl
push cs
jns 0x563f10
into
or cl, ah
push esp
retf
push sp
retf 0xb9c6
mov edi, 0x9313cff9
sahf
xchg edi, eax
insb byte es:[edi], dx
lcall 0x4ed1, 0xfb18eada
mov ah, 0x57
clc
mov dl, 0x8a
xor bl, byte [ecx + 0x51]
mov ecx, 0xd4330f32
loop 0x563f4e
sbb dword [ebx - 0x7f3d9c01], esp
mov dword [0x80c263ff], eax
xchg esp, eax
inc eax
in eax, dx
cmpsd dword [esi], dword es:[edi]
adc byte [edx - 0x3f387d39], bh
sbb byte [ebx - 0x6855ef27], al
dec ebp
jb 0x563ef5
aas
jne 0x563fca
or edx, dword [eax - 0x61ee0a8e]
lodsb al, byte [esi]
mov eax, dword [0xac8ac36f]
wait
lodsb al, byte [esi]
imul edi, dword [edx - 5], 0x9010230c
in eax, dx
jne 0x563f1f
jne 0x563f1f
int1
test eax, 0x8522b760
aad 0x69
pop ecx
js 0x563f4b
test dl, al
pop ecx
add edx, ebp
pop esi
invalid
jo 0x563fda
push edi
test ebx, 0xbd4cc08a
out 0xef, eax
stosb byte es:[edi], al
js 0x563f17
loopne 0x563f81
pop eax
sar bl, 0x79
sbb edi, dword [eax + eax*8]
call 0xc6b4e314
loope 0x563f82
inc eax
ja 0x563f34
in al, dx
insd dword es:[edi], dx
sub ebp, dword [ebx - 0x80]
jecxz 0x563f67
cmp cl, 0xaf
popfd
push ebx
fdivr dword [edx]
push 0xb5f2f0e3
jb 0x564010
sbb dh, byte [ecx + 0x2937eba3]
or edi, esp
pop es
stosd dword es:[edi], eax
bound ebx, qword [eax]
jno 0x564043
or dword [eax + 0x12], 0xffffffbf
scasb al, byte es:[edi]
hlt
aam 0x7d
lodsd eax, dword [esi]
aas
mov ebp, dword [0x59123b6b]
ret
les eax, [esi + 0x3b]
inc eax
loopne 0x563f89
cmp byte [edi - 0x340d3f9f], dh
cmc
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
fldcw word [edi - 0x28]
ror dword [eax], cl
mov dh, byte fs:[ebx]
aaa
invalid
mov dh, 0x63
call 0xe4980a6d
and edi, dword [ebp - 0x7b]
dec eax
sub al, 0xdb
or byte [edi - 0x73], dh
ficom dword [ecx + 0x20bd8974]
fld xword [ecx]
mov eax, 0xd9af2902
invalid
and bl, bl
sub dword [eax - 0x2650d6fe], edi
mov ax, 0x60f6
iretd
mul byte [eax - 0x31]
xor al, 0x8b
and al, 0x32
mov cl, 0x8f
mov dl, bh
jno 0x563ff9
push ds
or al, 0x62
cmp byte [edi], bh
fsub dword [ebx - 0x3206625a]
or al, 0x51
scasd eax, dword es:[edi]
pop ds
fcmovnb st(0), st(2)
pushal
jae 0x5640dd
add byte [ecx + 0xb], ch
push es
mov eax, dword [0x8011223f]
inc ecx
xchg cl, ah
sub byte [edx + 0x295b9949], 0x66
test eax, 0x29452923
add byte [esp - 0x2d8bed29], dl
cmpsd dword [esi], dword es:[edi]
xchg esp, eax
in al, 0xd7
adc dh, byte [edx + edx*8 - 0x59]
std
cmp byte [eax], ah
xchg ebp, eax
add al, ch
mov bh, 5
scasd eax, dword es:[edi]
jnp 0x564034
out 0x7d, eax
std
stosb byte es:[edi], al
enter 0xffffffffffffe54a, 0x19
cmp esp, dword [esi + 0x739866a9]
je 0x564049
jns 0x564104
xchg esp, eax
salc
dec ebx
int1
emms
stc
stc
rcr ch, cl
push cs
leave
popfd
pop ds
push esi
stc
jbe 0x56408e
inc ecx
mov edx, 0x3b8063df
and al, 0xa8
and ch, bh
ficomp word [ecx + 0x482c5bb2]
clc
cmp ebp, dword [edx - 0x17]
out 0x79, al
insb byte es:[edi], dx
aam 0x92
xchg edx, eax
xchg byte [esi], ah
bound esp, qword [ecx - 0x17]
jmp 0x458e8af7
inc edi
and eax, 0x71fa69dc
cli
xlatb
lodsb al, byte [esi]
inc ecx
pop esp
xchg edx, eax
salc
ret 0x7a76
Function at 0x567689
Capabilities:
Encode data using xor

Disassembly:
loop 0x567677
jb 0x5676e9
ret
or dword [edx - 0x2b], eax
cwde
movsd dword es:[edi], dword [esi]
and dh, byte [ebp - 0x1a3b7a08]
mov ebx, 0xf2a2a2b5
inc ebp
push cs
sbb eax, 0x7275623d
or dword [esi + 0x32e9d217], ecx
stc
jle 0x56771a
sahf
or byte [edi + 0x32792aa5], al
pop esp
push cs
fst dword [edx]
loop 0x567768
mov dh, 0x89
mov dh, 0x99
shl byte [0x5d9b35a2], cl
ret 0x52fd
xor eax, 0xfdc25d9b
push edx
loope 0x567784
in eax, 0x6e
or eax, 0xa9129d52
jb 0x5676e4
xor al, byte [ebp + 0x351d5916]
mov byte [0xc23e56b9], al
push ebp
mov byte [0xf635a269], al
leave
stc
push ecx
xchg edx, eax
jmp 0xc9d570b3
movsd dword es:[edi], dword [esi]
in al, 0x39
ja 0x567782
sbb byte [ecx + 0x28e26942], 0x3e
or dword [ebx + 0x7ed7809e], eax
cmp dword [edx], esi
or al, 0x8e
adc byte [ebp + edx*8 + 0x47], cl
aad 0xbd
test dword [edi], edx
cdq
push edx
in eax, 0x23
pushal
dec edi
leave
add al, 0x95
clc
imul ebp, esi, 0x845f229
pop ecx
aam 0x83
outsb dx, byte [esi]
xor eax, 0xce4a0577
mov bh, 0x2b
and ch, byte [0xd94ec9b2]
pop esi
pushal
xchg esi, eax
jne 0x567782
dec ecx
push cs
pop ebx
sub dword cs:[edi - 0x3dba0dc7], esi
push ebp
sbb eax, 0xb2f98626
pop ecx
adc byte [0x28afe558], 0x5c
mov bl, 0x5c
fst dword [eax]
stosb byte es:[edi], al
pop ss
cmc
stc
dec edi
fist word [edx + edx*8 + 0x25]
sub eax, 0xe332b2
push 0x1f
insd dword es:[edi], dx
xor dword [eax], ebx
shr byte [edx], 0xd9
pop ebx
je 0x56777c
mov byte [0x8942a5be], al
push edx
movsd dword es:[edi], dword [esi]
ljmp 0x2395
Function at 0x57cfdd
Capabilities:
Encode data using xor

Disassembly:
cmc
cmpsb byte [esi], byte es:[edi]
sub byte [ecx - 0x486b1440], cl
mov dword [0xbb8b6969], edx
clc
adc eax, 0x115f6577
int1
sub dl, byte ds:[ebx]
mov word [ecx*2 + 0xc3203a8], ss
dec ebp
xchg esi, eax
jmp 0x40202672
xlatb
jbe 0x57cfbe
and ah, al
aas
dec eax
pop es
lds ebp, [eax + ebp*4]
mov edx, dword [esi - 0x18]
mov edi, ebp
pop edx
jnp 0x57cfc3
inc edi
jne 0x57cfab
into
cmp byte [ebp - 0x68fa32e6], cl
lea ebx, [edx]
int 5
xchg edi, eax
dec eax
push eax
inc eax
or bl, byte [eax - 0x1b]
add ebp, esi
lcall 0x1967, 0x2073cb1
inc esp
jg 0x57cf64
invalid
xor eax, 0x594adea6
pop ecx
push 0xe67edfeb
and al, 0x8b
je 0x57cfdb
jmp 0x57cfa5
pop esi
add al, 0xb5
jg 0x57d04c
mov byte [ecx - 0x4b85a7ec], dh
sti
outsb dx, byte [esi]
out dx, al
push ecx
je 0x57d03b
imul edx, ecx, 0xb
adc dl, 0x96
or eax, 0xb09e98a6
cli
ret
jp 0x57d084
xchg ecx, eax
not byte [edi]
xchg esp, eax
sbb bh, byte [edx - 0x62]
push esi
popfd
and al, 0x9a
invalid
sti
sbb ah, bl
test cl, 2
movsd dword es:[edi], dword [esi]
in al, dx
popfd
mov ebp, 0x4d6f115f
cmpsb byte [esi], byte es:[edi]
inc esi
jbe 0x57cfdf
in al, 0x9a
and byte [eax + ecx*4 + 0x7b], 0x68
xchg byte [esi + esi*8 - 0x35], dl
clc
and ch, byte [edi + 0x24]
andnps xmm5, xmm4
fdivr qword [eax - 0x19fd9c6]
xchg edx, eax
sub dword [0xeed90764], eax
pop es
fldz
pop eax
jecxz 0x57d07c
xor dword [0x49a5c8e7], ecx
out 0xc8, eax
movsd dword es:[edi], dword [esi]
dec ecx
mov dword [edi + ebx*8 - 0x5b4156f3], esi
cdq
sub esi, dword gs:[eax]
jnp 0x57d0c0
fdiv st(0)
sbb al, 0x6f
stosd dword es:[edi], eax
pushfd
stosb byte es:[edi], al
ljmp 0x74d2
je 0x57d030
test byte [ebp + 0x130d25f2], bh
invalid
cmp ebp, dword [edx - 0x4a]
push ebx
inc ebp
sbb dl, ah
enter 0x7874, 0x50
fcom dword [ebx]
fst dword [ebx - 0x76]
ja 0x57d0a2
stosd dword es:[edi], eax
wait
xor byte [edi], 0x17
enter 0xffffffffffff9422, 0xffffffffffffffc5
sub byte [0x755bc5ab], ah
push ebx
and al, 0xa9
in eax, dx
pop ds
test ebx, 0x15bb6da5
mov cl, byte [ebx - 0x55]
xor al, 0x4d
mov dword [edi + 0x7bd06267], edi
pop ds
sbb al, 0x82
mov edx, 0x2bf59028
invalid

Function at 0x5cec6d
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
loop 0x5cec69
or al, byte [esi]
fcomp dword [esi - 0x7e]
sbb edx, dword [edi]
fisubr word [esi - 0x3f]
adc eax, 0xa1bcbc1a
mov dword [edi], esp
dec esp
ret 0x9eba
adc ch, byte [esi - 0x2332f1e4]
mov bh, 0x11
leave
sbb al, byte [ebp - 0x61718994]
mov word [eax - 0x57], es
push esi
invalid
lodsd eax, dword [esi]
lodsb al, byte [esi]
invalid
xchg esi, eax
jecxz 0x5cebf6
jle 0x5cec4f
invalid
Function at 0x5e2e9b
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
mov esp, 0xb17c9ee7
sbb dl, byte [esi + 0x1cbb0c62]
mov ch, 0xb
or ebx, esi
xchg ebx, eax
and dword [edx - 0x6d], edx
jge 0x5e2e8f
inc edi
outsb dx, byte [esi]
jle 0x5e2f08
hlt
mov edi, 0xd2f25a6b
jmp [esi + 0x3d]
outsd dx, dword [esi]
mov ss, eax
pop ecx
inc edx
pop esi
push es
jb 0x5e2f1a
adc dword [eax + 0x32af0b8d], ebx
salc
cwde
lea ecx, [ebx]
scasd eax, dword es:[edi]
xor dl, dh
cdq
pop esp
jne 0x5e2f6d
mov bh, 0x2e
or byte [edx + eax*2], ch
nop
jl 0x5e2f79
pop esi
lodsd eax, dword [esi]
in al, dx
cld
jle 0x5e2ea3
stosb byte es:[edi], al
sar ecx, 1
or eax, 0x27225df4
jnp 0x5e2eee
into
fld xword [esi + 0x4e165033]
mov al, 0x38
sub ch, ah
daa
in al, dx
invalid
aaa
js 0x5e2f00
dec esi
adc edx, dword [ecx - 0x6c]
lds eax, [edi]
or eax, 0x72d95e05
bound ebx, qword [ebx - 0x78]
sub eax, 0x1a82be9a
fnstenv [edx + 0x62]
pop ebx
mov byte [0x1a82be9a], ch
sub dword [eax + ebx*8 - 0x4f], 0x24e08267
invalid

Function at 0x5f9bd6
Capabilities:
Encode data using xor

Disassembly:
jp 0x5f9bac
and edi, dword [ebx + 0x7853de91]
out dx, eax
outsb dx, byte [esi]
dec edi
lds ebp, [0x9640e1d]
stosd dword es:[edi], eax
add bl, byte [edi + 0x2d34c20a]
or dword fs:[ebx - 0x3df560fe], ebp
xor al, 0x2d
sbb bh, byte [ecx + ecx*8 - 0x677c7184]
sub bh, byte [edi + ebp + 0x13]
cmp dword [eax + edx*8 + 0x51c01d17], 0x872c2e13
xor al, 0x6e
mov ebx, 0x201e317c
add esi, dword [ebx]
pop es
aad 0x6a
push 0xfffffffffffffffb
push 0xfffffffffffffffb
xchg esp, eax
dec eax
push 0x6e0101b7
movsb byte es:[edi], byte [esi]
push ebp
insb byte es:[edi], dx
imul edi, dword [ebp + 0x7a], 0x76
push ebx
lcall 0xeb2f, 0x650dd05f
rcr byte [eax + 0x7a], 0xf6
dec edi
jl 0x5f9bb3
rcr byte [esi - 0x20156724], cl
scasb al, byte es:[edi]
jg 0x5f9b9c
in eax, 0x56
adc esp, dword [edx + 0x66]
fnstcw word [esi]
sbb cl, 0x46
rcl dh, 1
mov word [ebx], ss
stosb byte es:[edi], al
mov dl, 5
ficomp dword [ebx + eax*8]
mov ebx, ss
mov eax, 0x1cf62f68
sahf
sbb al, 0x9e
mov word [ebx - 0x25c55cd6], ss
je 0x5f9c18
dec esp
push ebx
mov esp, 0xd3f8fa63
insd dword es:[edi], dx
retf
Function at 0x65038e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6582c0
cmp edx, dword [eax]
je 0x6503b0
add eax, 8
inc ecx
cmp eax, 0x658350
jl 0x6503a1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6582c0]
jne 0x6504de
mov eax, dword [0xa5b93c]
cmp eax, 1
je 0x6504b8
test eax, eax
jne 0x6503e1
cmp dword [0x658204], 1
je 0x6504b8
cmp edx, 0xfc
je 0x6504de
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x650418
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00650aa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00650cd0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x65045b
lea eax, [ebp - 0x1a4]
push eax
call fcn.00650cd0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x654b38
push edi
call fcn.006524a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00650aa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00650ab0
lea eax, [ebp - 0xa0]
push 0x654b18
push eax
call fcn.00650ab0
push dword [esi + 0x6582c4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00650ab0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00652414
add esp, 0x2c
pop edi
jmp 0x6504de
lea eax, [ebp + 8]
lea esi, [esi + 0x6582c4]
push 0
push eax
push dword [esi]
call fcn.00650cd0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret