joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45107b
Capabilities:
Check if file exists
Print debug messages

Disassembly:
push 0x83c
mov eax, 0x4584aa
call fcn.004240ea
mov esi, ecx
lea eax, [ebp - 0x844]
xor ebx, ebx
push 7
mov dword [ebp - 0x848], eax
xor eax, eax
pop edi
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x834], ebx
mov word [ebp - 0x844], ax
push str.Uninst.dar0
push esi
lea ecx, [ebp - 0x848]
mov dword [ebp - 4], ebx
call fcn.00403e3f
lea eax, [ebp - 0x828]
mov dword [ebp - 0x814], edi
mov dword [ebp - 0x82c], eax
xor eax, eax
mov dword [ebp - 0x818], ebx
mov word [ebp - 0x828], ax
push str.Uninst.dar1
push esi
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 1
call fcn.00403e3f
mov eax, dword [ebp - 0x848]
push 8
pop ebx
cmp dword [eax + 0x14], ebx
jb 0x45110c
mov eax, dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call esi
test eax, eax
je 0x4511f8
mov eax, dword [ebp - 0x82c]
cmp dword [eax + 0x14], ebx
jb 0x45112a
mov eax, dword [eax]
push eax
call esi
test eax, eax
je 0x4511f8
mov esi, dword [ebp - 0x848]
cmp dword [esi + 0x14], ebx
jb 0x451142
mov esi, dword [esi]
call fcn.0040446c
push esi
mov ecx, eax
call fcn.00450925
test eax, eax
jne 0x4511ac
mov esi, str.hwang
lea edi, [ebp - 0x810]
push 0x7f2
push eax
lea eax, [ebp - 0x802]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004262f0
mov eax, dword [ebp - 0x848]
add esp, 0xc
cmp dword [eax + 0x14], ebx
jb 0x451185
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x804]
push str.DoLua__s_failed_
push eax
call fcn.00406ba3
add esp, 0xc
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x451272
mov esi, dword [ebp - 0x82c]
cmp dword [esi + 0x14], ebx
jb 0x4511b9
mov esi, dword [esi]
call fcn.0040446c
push esi
mov ecx, eax
call fcn.00450925
test eax, eax
jne 0x4511f4
mov esi, str.hwang
lea edi, [ebp - 0x810]
push 0x7f2
push eax
lea eax, [ebp - 0x802]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004262f0
mov eax, dword [ebp - 0x82c]
jmp 0x45117b
mov bl, 1
jmp 0x451274
mov esi, str.hwang
lea edi, [ebp - 0x810]
push 0x7f2
lea eax, [ebp - 0x802]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.004262f0
mov ecx, dword [ebp - 0x82c]
add esp, 0xc
cmp dword [ecx + 0x14], ebx
jb 0x45122b
mov ecx, dword [ecx]
mov eax, dword [ebp - 0x848]
cmp dword [eax + 0x14], ebx
jb 0x451238
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0x804]
push str.pathGlobalVarLua___s__r_n_pathUnInstallLua___s
push eax
call fcn.00406ba3
add esp, 0x10
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10010
push 0x466e40
push 0x466e48
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004016ce
push 0
push 1
lea ecx, [ebp - 0x844]
call fcn.004016ce
mov al, bl
call fcn.00424094
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x1bba6b06
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data_1
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3f6728f6
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x55555762
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x60b01e0a
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x276238c7
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x357e6c0f
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x417015
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x421dc0
call fcn.00417964
push 1
call fcn.004173af
pop ecx
test al, al
jne 0x416ebe
push 7
call fcn.00417ad7
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041737a
mov byte [ebp - 0x24], al
mov eax, dword [0x424890]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x416eb7
test eax, eax
jne 0x416f28
mov dword [0x424890], ecx
push 0x41a404
push 0x41a3ec
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x416f0b
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x41700f
push 0x41a3e8
push 0x41a3bc
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x424890], 2
jmp 0x416f2d
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0041750c
pop ecx
call fcn.00417acb
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x416f5d
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f5d
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00417d06
call esi
call fcn.00417ad1
mov esi, eax
cmp dword [esi], edi
je 0x416f7b
push esi
call fcn.0041747f
pop ecx
test al, al
je 0x416f7b
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00417bec
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_wide_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.00417c1f
test al, al
jne 0x416fb4
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x416fbd
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.00417529
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x41700f
call fcn.004179aa
ret
call fcn.00416d24
jmp 0x416e9f

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40ee11
Capabilities:
Encode data using xor

Disassembly:
invalid
cwde
lodsb al, byte [esi]
sbb al, 0x3d
clc
cli
pop ss
xor byte [edi - 0x31], bh
jecxz 0x40ee0b
invalid

Function at 0x467d5b
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
or byte [edx], bh
scasd eax, dword es:[edi]
dec ecx
cmp byte [ebx + 0x53], cl
in eax, 0xf5
lds edi, [ebx + ebp*4 - 0x5b]
xor al, 0x3d
movsd dword es:[edi], dword [esi]
adc byte [eax + 9], cl
movsd dword es:[edi], dword [esi]
mov es, word [ebx + 0x111b433c]
mov bh, 0x57
popal
mov dword [ecx], esp
call 0xb2ae7f28
or byte [edi], cl
push ds
mov ah, 0x79
in eax, dx
xor esp, ebp
cmp eax, 0xa14277d2
movsb byte es:[edi], byte [esi]
sub esp, ebp
pop ecx
add dword [esi], ecx
invalid

Function at 0x468905
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xec
xchg dword [eax], esi
xor bh, dl
lodsd eax, dword [esi]
in eax, dx
xchg byte [ecx], ch
inc edi
ficomp dword [esi + 0x5bb5f83f]
or eax, 0xb749c9e6
mov bh, 0x21
xor ecx, dword [edx + edx*4]
mov bh, 0x21
xor ecx, dword [edx + edx*4]
mov bl, 0x92
inc edx
clc
loop 0x4688f0
xor ah, ah
int3
Function at 0x47e5f7
Capabilities:
Encode data using xor

Disassembly:
inc ebp
fisttp dword [edi - 0x780bf4d1]
invalid
sub dl, byte [esi - 0x8506567]
pop ss
xor byte [esp + ecx*4 + 4], bl
mov cl, 0x33
inc esi
mov cl, byte [ebp - 0x52246a98]
cdq
or byte [esi], 0x52
out 0xab, eax
sahf
mov es, word [esi - 6]
push es
mov ebx, 0xe0c62c60
aam 0x5f
jg 0x47e5e7
loope 0x47e5fc
jge 0x47e62a
int 0x9c
dec ebp
mov bh, 0x54
push 0x48cba7e
and al, 0xb3
dec esi
mov word [esp], es
mov bl, 0x4e
dec eax
mov dl, 0xaa
out dx, eax
out 0xde, eax
dec eax
xor ebp, dword [esi]
shl eax, 0xdb
xor byte [ebp + 0x24], ch
loope 0x47e6ad
int 0xf0
jo 0x47e694
mov byte [edx + 0x186900b6], ch
jle 0x47e5f6
into
int 0xb1
mov esp, 0xb44ea19e
invalid
dec ecx
mov esi, 0xcac1da70
jg 0x47e635
jmp 0xbc8653fc
mov gs, word [ebp + 0x3e]
mov esp, 0x249c85cf
xchg sp, ax
mov eax, 0x637e1b6d
add eax, 0xc43d6032
sbb ebp, ebx
enter 0xffffffffffff92d1, 0xffffffffffffffdf
fdivr st(6), st(0)
mov edi, 0x712ca3ed
push 0xee8208cf
hlt
sub dh, 0xf4
mov ebp, dword [ebx - 0x72362963]
lahf
pop ss
salc
mov esp, 0x37121720
stosd dword es:[edi], eax
popfd
salc
leave
lea ebx, [edi - 0x4329e89b]
and byte [edi], dl
adc dh, byte [edi]
pop ds
int3
pop ds
or al, 0x2b
mov al, 0x6d
dec ebx
wait
sal byte [esi - 0x7b], cl
mov ecx, 0xc10df7eb
lodsb al, byte [esi]
mov al, 0x4a
or dh, byte [ebp + ebx*4 + 0x48]
insd dword es:[edi], dx
cmc
fmul st(6)
cwde
fisttp word [ecx + ebx - 0x23e70056]
js 0x47e6d2
adc byte [edi], al
pop es
loop 0x47e690
add dh, 0x9c
out dx, eax
jmp 0x47e66a
Function at 0x4845c3
Capabilities:
Encode data using xor

Disassembly:
or ch, al
xchg edi, ebp
mov edi, 0xecd3a9ec
or dword [eax], edi
cmpsd dword [esi], dword es:[edi]
push ebx
sub al, 0x5a
jbe 0x4845d4
sub cl, byte [eax - 0x65]
sahf
fidivr word [esi]
mov cl, byte [eax + ebp - 0x10]
nop
adc byte [ecx + 0x2031d9e], bl
call 0x7190ff93
rcl byte [esi + 0x2f], cl
pop ds
xor byte [edx - 0x48], ch
stosd dword es:[edi], eax
outsb dx, byte [esi]
push es
test eax, 0xfa9fddcb
out 0x98, eax
and cl, byte [ecx + edx*2 + 0x4a58db3c]
cmp al, 0xdb
pop eax
dec edx
retf
cmp al, 0xdb
pop eax
dec edx
add al, 0x32
je 0x4845ba
popal
sbb eax, 0x59980e6c
out 0xed, al
push eax
mov esi, 0x9941d5c9
out 0x27, al
adc al, 0x2b
push esp
or byte [edi + edx*8], cl
mov cl, 0x18
bound edx, qword [edi]
mov bh, bl
ja 0x484588
add ecx, esi
inc esp
push edi
adc dword [edi - 0x29548a19], ebp
cmp byte [ebx + 0x337e12c6], cl
and eax, 0x9870934b
inc edi
mov dh, 0xc1
adc eax, 0x10d6fd40
cvtps2pi mm1, qword [ebx]
clc
out dx, al
add byte [ebx], cl
add dl, byte [ebx - 0x2c]
in eax, dx
sbb cl, ch
stosb byte es:[edi], al
pop ss
dec edx
dec edx
cmp al, 0x19
out dx, al
push ecx
xor eax, 0x73451ec1
sbb esp, esi
push ebx
pop esi
push ebx
bnd jle 0x484601
test al, 0xe7
je 0x48469b
xchg ecx, eax
adc byte [edi + 0x7fc035b0], al
adc dword [ebx + edx*8 + 0x7830f3c6], 0x56
xor eax, 0x9dd58192
pop ecx
mov bl, 0xf5
hlt
stosd dword es:[edi], eax
pop ebx
adc dword [ebp - 0x7a2444b9], eax
mov dword [0x8dcfc6db], eax
jge 0x4846b8
fidiv dword [ecx]
cmp al, 0xe1
pop ebp
out 0x3d, eax
adc dword [ebp - 0x15acaabf], 0x5e8ca28d
or byte [ecx + 0x33], al
inc eax
xchg edi, eax
lea esp, [edx + 0x41085e8c]
xor eax, dword [eax - 0x69]
mul byte [esi + 0x4f]
mov dword [0x22d797e1], eax
bound ecx, qword [eax - 0x23]
fucom st(0)
invalid
and dword [edi - 0x46], eax
mov dh, 0x72
out 0x8f, eax
loope 0x484716
sbb bl, byte [ecx - 0x59]
pop ecx
fdivr qword [ebx + 0xc1aeff0]
xor al, 0xf3
int 0x32
adc esi, edx
adc eax, 0x79f2c480
xor al, 0x53
popfd
sbb edi, esi
retf 0x9a4c
wait
mov al, byte [0x47cbdd9b]
sub al, 0x7e
sub eax, 0x234f90cd
sbb eax, 0xd4949b1
wait
or eax, 0xd9f6dcbd
lodsd eax, dword [esi]
sti
fiadd dword [eax - 0x5b]
sub ecx, dword [esi + esi*8]
xchg ebp, eax
jnp 0x4847b5
int 0x1a
mov ebx, 0xc3f18a6b
xchg ecx, eax
pop ebx
mov esp, 0xb377416b
enter 0x7b75, 0xffffffffffffffef
ret 0xbc16
fstp st(7)
mov ah, 0x25
nop
cld
or al, byte [ebx + esi*8]
jl 0x484768
ret 0x268
push cs
add eax, 0x1dde4e93
fst qword [edi]
mov bl, 0x96
jecxz 0x4847eb
xor bl, byte [ecx]
mov edi, 0x3f7ff13e
push esi
push ebp
int1
popal
dec esp
adc dl, byte [edx + 0x4f943165]
add cl, cl
mov al, 0xda
sub eax, 0x6b2c7bae
jo 0x484761
pushfd
push ebx
insb byte es:[edi], dx
stosb byte es:[edi], al
sar byte [ebx], 0xc6
imul eax, dword [ebx], 0x65
xchg ebx, eax
xor dl, ch
xchg edi, eax
xor byte [esi - 0x72], ah
inc ecx
mov bl, 0x39
pop es
and eax, 0x508e2607
xchg ecx, eax
stc
movsd dword es:[edi], dword [esi]
invalid
Function at 0x4938db
Capabilities:
Encode data using xor

Disassembly:
rcl byte ss:[ebp + 0x6e02b644], cl
rol dword [ebx], 0xb2
xchg edx, eax
add esp, dword [ebx - 0x38]
inc ecx
and eax, 0x70d67755
push ds
idiv dword [0x656539c6]
invalid
invalid
cmp dword [ebp + 0x65], esp
push esi
push esi
push ebx
adc ah, ah
movsd dword es:[edi], dword [esi]
shl byte [eax + 0x5e5e95f7], 0xb4
mov al, byte [0xe417d5b3]
xor esi, eax
push es
inc ecx
add al, 0x45
dec edi
inc esi
sub eax, 0x1e666c57
push ebp
pop es
jg 0x4938c2
aaa
div dword [edx + 0x67d39256]
sub byte [0x13d1bba8], 0xb
leave
inc byte [edx]
popal
pop esp
push edx
in eax, 0x5e
and ah, byte [ebx - 0x1a38150e]
xor eax, dword [esi + 0x736fdc01]
add eax, 0x4f485795
xor eax, 0xdd185d4d
mov bl, 0xa0
push eax
mov ebx, ds
outsb dx, byte [esi]
pop edi
sbb dword [ebx - 0xe], edx
das
jle 0x49394e
mov ah, 0x29
fst qword [0x7dbeb150]
outsb dx, byte [esi]
xor ecx, dword [edi]
leave
adc al, 0xc
jae 0x4938da
and byte [ebx], al
push edi
jae 0x4939af
test dword [ebx - 0x4b297a23], esi
retf
scasd eax, dword es:[edi]
and dword [esi + 0x68], 0x73b224aa
neg byte [esi + edx*4 + 0x7277c4fd]
stosb byte es:[edi], al
and al, 0xb2
jae 0x4939aa
pushfd
xchg esi, eax
std
les esi, [edi + 0x72]
out dx, eax
out 0x38, al
cli
test byte [edx + 0x3ca46f7c], dh
and dword [ebx + 0x37], edx
scasd eax, dword es:[edi]
inc edx
and al, byte [ebp + 0x73]
cld
mov bl, 0xc9
mov al, 0xa2
add ah, byte [ebp - 9]
pop esi
push ebx
or ebp, dword [edx + edx - 0x26]
outsb dx, byte [esi]
push edi
loop 0x493a1d
movsd dword es:[edi], dword [esi]
xchg edx, eax
aad 0xb7
loop 0x4939af
mov ebx, dword [ecx + 0x47f37ee2]
scasb al, byte es:[edi]
fild dword [edi - 0x21]
xchg esp, eax
cmp ebx, dword es:[esi]
aaa
add eax, 0x6c0d6c20
mov byte [0x33537070], al
out dx, al
xor al, byte [ebx]
cmpsb byte [esi], byte es:[edi]
add byte [ebx], ah
arpl word [eax - 0x7d], si
call 0x5c9916a8
adc dword [edi + 0x3ac5032b], ebx
ja 0x493a16
ret
mov edx, 0x1b207beb
xor bh, dl
pop ebx
test byte [0xc2e8ce71], cl
mov dword [edx + 2], ecx
sub esp, 0xdbe433d2
sub ecx, dword [esi - 0x4a]
nop
ret 0x2079

Function at 0x49651b
Capabilities:
Encode data using xor

Disassembly:
push ecx
aas
bound edx, qword [edi]
jg 0x496553
pushal
or eax, 0xd63cbd54
mov dword [ecx - 0x4d], ecx
out dx, al
psubusb mm7, qword [esi + eax*4 - 0x43]
adc dh, byte [esi]
out 0x73, eax
adc eax, 0xe38722e
and al, 0xba
push esp
or dword [ebp - 0x150013bc], edi
inc ebx
jne 0x4964fd
into
add dword [eax + ecx - 0x44], esi
pop esi
sbb eax, 0xbc326a0c
push cs
cmp dword [ecx + 0x19], 0x4a
push ss
test dword [esi - 0x54], ebp
aam 0xb0
into
bound edi, qword [edx + 0x596cd524]

Function at 0x4b99b6
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esi]
test eax, eax
je 0x4b99b8
call eax
sub esi, 4
cmp esi, dword [0x4c7430]
jae 0x4b99b0
pop esi
push 0x4c2018
push 0x4c2014
call fcn.004b9a16
pop ecx
pop ecx
push 0x4c2020
push 0x4c201c
call fcn.004b9a16
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b99f2
call fcn.004b9a0d
pop edi
ret
push dword [esp + 8]
mov dword [0x4c6db4], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4ba2f0
Capabilities:
Check os version
Query environment variable

Disassembly:
mov ebp, esp
mov eax, 0x122c
call fcn.004bc2e0
lea eax, [ebp - 0x98]
push ebx
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ba332
cmp dword [ebp - 0x88], 2
jne 0x4ba332
cmp dword [ebp - 0x94], 5
jb 0x4ba332
push 1
pop eax
jmp 0x4ba434
lea eax, [ebp - 0x122c]
push 0x1090
push eax
push str.__MSVCRT_HEAP_SELECT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4ba421
xor ebx, ebx
lea ecx, [ebp - 0x122c]
cmp byte [ebp - 0x122c], bl
je 0x4ba374
mov al, byte [ecx]
cmp al, 0x61
jl 0x4ba36f
cmp al, 0x7a
jg 0x4ba36f
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4ba361
lea eax, [ebp - 0x122c]
push 0x16
push eax
push str.__GLOBAL_HEAP_SELECTED
call fcn.004bc2a0
add esp, 0xc
test eax, eax
jne 0x4ba396
lea eax, [ebp - 0x122c]
jmp 0x4ba3df
lea eax, [ebp - 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x19c], bl
lea ecx, [ebp - 0x19c]
je 0x4ba3ca
mov al, byte [ecx]
cmp al, 0x61
jl 0x4ba3c5
cmp al, 0x7a
jg 0x4ba3c5
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4ba3b7
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.004bc220
pop ecx
pop ecx
cmp eax, ebx
je 0x4ba421
push 0x2c
push eax
call fcn.004bc160
pop ecx
cmp eax, ebx
pop ecx
je 0x4ba421
inc eax
mov ecx, eax
cmp byte [eax], bl
je 0x4ba406
cmp byte [ecx], 0x3b
jne 0x4ba401
mov byte [ecx], bl
jmp 0x4ba402
inc ecx
cmp byte [ecx], bl
jne 0x4ba3f8
push 0xa
push ebx
push eax
call fcn.004bbf32
add esp, 0xc
cmp eax, 2
je 0x4ba434
cmp eax, 3
je 0x4ba434
cmp eax, 1
je 0x4ba434
lea eax, [ebp - 4]
push eax
call fcn.004ba2c2
cmp byte [ebp - 4], 6
pop ecx
sbb eax, eax
add eax, 3
pop ebx
leave
ret
Function at 0x4ba4cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23e8
cmp edx, dword [eax]
je 0x4ba4ef
add eax, 8
inc ecx
cmp eax, 0x4c2478
jl 0x4ba4e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23e8]
jne 0x4ba61d
mov eax, dword [0x4c6d70]
cmp eax, 1
je 0x4ba5f7
test eax, eax
jne 0x4ba520
cmp dword [0x4c2314], 1
je 0x4ba5f7
cmp edx, 0xfc
je 0x4ba61d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba557
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baeb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb340
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba59a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb340
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf93c
push edi
call fcn.004bd210
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baeb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baec0
lea eax, [ebp - 0xa0]
push 0x4bf91c
push eax
call fcn.004baec0
push dword [esi + 0x4c23ec]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baec0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd184
add esp, 0x2c
pop edi
jmp 0x4ba61d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23ec]
push 0
push eax
push dword [esi]
call fcn.004bb340
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x66941585
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x20043713
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x40f080
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40b015
lea edi, [esi - 0xa015]
push edi
or ebp, 0xffffffff
jmp 0x40f0a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f0a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f098
mov eax, 1
add ebx, ebx
jne 0x40f0bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f0b0
jne 0x40f0cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0b0
xor ecx, ecx
sub eax, 3
jb 0x40f0e0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f152
mov ebp, eax
add ebx, ebx
jne 0x40f0eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f0f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f11c
inc ecx
add ebx, ebx
jne 0x40f108
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f0fd
jne 0x40f119
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f0fd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f13c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f12d
jmp 0x40f09e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f13c
add edi, ecx
jmp 0x40f09e
pop esi
mov edi, esi
mov ecx, 0x265
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f15a
cmp byte [edi], 2
jne 0x40f15a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40f15f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f1ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f18c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf068]
or eax, eax
je 0x40f1c8
mov dword [ebx], eax
add ebx, 4
jmp 0x40f1a9
call dword [esi + 0xf06c]
popal
jmp 0x40354a

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6cca524c
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..text_1
mov ebx, 0x4304d8
nop
mov ecx, 0x13af2143
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219