joyce8/EMBER2024-capa huggingface dataset:
Function at 0x548208
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1a0], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x54831e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00405934
lea eax, [ebp - 0x19c]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x5482fd
mov eax, pe_nt_image_headers32
call fcn.00402d98
mov dword [ebp - 0xc], eax
push pe_nt_image_headers32
mov esi, dword [ebp - 0xc]
push esi
call sub.wsock32.dll_gethostname
test eax, eax
jne 0x5482eb
lea eax, [ebp - 4]
mov edx, dword [ebp - 0xc]
mov ecx, pe_nt_image_headers32
call fcn.00405ba4
push esi
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx esi, word [eax + 0xa]
dec esi
test esi, esi
jl 0x5482ca
inc esi
xor edi, edi
push dword [ebx]
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx eax, byte [eax + edi]
lea edx, [ebp - 0x1a0]
call fcn.0040a8f4
push dword [ebp - 0x1a0]
push 0x548334
mov eax, ebx
mov edx, 3
call fcn.00405cb8
inc edi
dec esi
jne 0x548296
mov eax, dword [ebx]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
test eax, eax
je 0x5482e1
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
mov eax, ebx
call fcn.00406080
mov edx, pe_nt_image_headers32
mov eax, dword [ebp - 0xc]
call fcn.00402db4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x548325
lea eax, [ebp - 0x1a0]
call fcn.00405934
lea eax, [ebp - 4]
call fcn.00405934
ret

Function at 0x10b1be4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10b1bee
pushal
call 0x10b1bf4
pop ebp
sub ebp, 0x10
sub ebp, 0xcb1be4
jmp 0x10b1c0a
mov eax, 0xcb1be4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c5
mov edx, 0x14def7c4
xor byte [eax], dl
inc eax
dec ecx
jne 0x10b1c21
jmp 0x10b1c34
dec edi
or dword [edi + 0x4d], ecx
clc
invalid
Function at 0x405590
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
sub esp, 0x10
push esi
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4055ae
or eax, eax
pop esi
add esp, 0x10
ret
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push ecx
mov dword [esp + 0xc], eax
mov word [esp + 8], 2
call dword [sym.imp.WS2_32.dll_htons]
lea edx, [esp + 4]
push 0x10
push edx
push esi
mov word [esp + 0x12], ax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4055ef
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
or eax, 0xffffffff
pop esi
add esp, 0x10
ret
mov eax, esi
pop esi
add esp, 0x10
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x409b1a
Capabilities:
Encode data using xor

Disassembly:
imul ebp, dword [edi + 0x7f], 0xffffffa5
imul esp, dword [ecx + esi], 0xd18717e6
xchg ecx, edx
xor eax, 0x4491fbb1
xor eax, dword [ebx]
push ecx
pop es
jno 0x409a60
sal dword [edi], 0xff
push eax
fild word [edi - 0x384e2d4f]
push es
arpl word [ecx], cx
stosd dword es:[edi], eax
and cl, byte [esi]
invalid
jb 0x409a69
sbb ebp, dword [ecx - 5]
invalid
lahf
jns 0x409ac4
jmp 0x3707fc72
outsd dx, dword [esi]
lodsd eax, dword [esi]
mov ecx, edi
in eax, dx
movsd dword es:[edi], dword [esi]
rcl dword [eax], cl
mov dh, 0x51
inc esi
js 0x409ac0
invalid
fisubr word [ebp - 0x380b33c0]
sbb eax, 0x58efd102
mov dword [0xd76ed332], eax
jecxz 0x409ab5
inc ecx
mov bl, 0x59
pop ss
int1
test al, 0x76
mov ch, byte [ebx + 0x49]
mov edx, 0x72f01303
xchg ebx, eax
mov al, byte [0x7af6a0d5]
loope 0x409b8f
jecxz 0x409ae9
cmp dword [ecx - 0x664a0df8], eax
invalid

Function at 0x413e15
Capabilities:
Encode data using xor

Disassembly:
and byte [edi], 9
and byte [edx + 0x4d], cl
daa
or dword [eax], esp
dec edx
dec ebp
cwde
or dword [ecx - 0x2f], edi
xchg edx, eax
mov dword [ecx], ebp
inc ebx
sar dword ds:[edi + 0x54], cl
mov al, byte [0x2d1ea514]
pop ebp
insd dword es:[edi], dx
scasd eax, dword es:[edi]
jge 0x413e13
inc eax
mov ch, 0x20
mov dword [0x3862c53], eax
in eax, 0x96
add edx, dword [esi + esi*4 + 0x10]
pushfd
add ebp, dword [ecx + 0x11723833]
clc
xchg edi, eax
les edx, [0xa9c3f30c]
push edx
lahf
dec byte [edi - 0x68db166b]
xor eax, 0xa136c7f
push esi
inc edi
loop 0x413eb2
and eax, 0x7245d035
jg 0x413ed8
stosb byte es:[edi], al
in eax, 0x3c
push ds
cmc
mov cl, 0x3e
lodsb al, byte [esi]
in eax, dx
test byte [ecx - 0x6b2b6b37], cl
movsd dword es:[edi], dword [esi]
loope 0x413e69
adc al, 0xc
mov eax, dword [0xcfc6450a]
in al, dx
mov bh, 0x3b
scasd eax, dword es:[edi]
jae 0x413e82
or eax, dword [eax]
sbb al, byte [0xd76af63a]
xor byte [ebx + ebx - 0x77], ch
inc ebp
xlatb
xor al, dl
cld
clc
rcl edx, 1
dec esp
ret
push es
xor dword [ebx - 0x11], ebp
out 0x8a, eax
sbb al, 0xda
sub dh, byte [esi + 0x14]
xchg esi, eax
fisub word [edi - 0x7860438f]
test eax, 0xe6081c55
push edx
xor ch, dh
cdq
jp 0x413eb6
shl byte [edi - 0x36b98bdd], cl
test eax, 0x64f4b6b0
xlatb
ret 0xe39b
hlt

Function at 0x42081a
Capabilities:
Encode data using xor

Disassembly:
aad 0x7e
mov al, byte [0xc9145db1]
adc al, 0x41
push ebp
xchg dword [ebx + edx*4 + 0x316acc7b], eax
xchg edx, eax
pop es
outsb dx, byte [esi]
xor al, 0x3c
stosd dword es:[edi], eax
xchg ecx, eax
push ecx
popal
and ah, byte [ebx + 0x2f]
mov word [ebp - 0x5b9690e0], ss
and byte [edi + 0x69], ch
movsb byte es:[edi], byte [esi]

Function at 0x420c3a
Capabilities:
Encode data using xor

Disassembly:
rol byte [ebx - 0x76], cl
add dword [0xa9e0fdac], edi
lodsd eax, dword [esi]
jecxz 0x420be1
out dx, al
invalid

Function at 0x44eaea
Capabilities:
Encode data using xor

Disassembly:
or ebp, dword [edx + 0x20bbcabe]
jge 0x44eaf4
jl 0x44ead6
ljmp 0xf8f5:0xcd84fbff
rol dword [eax - 0x44], cl
pop edx
add cl, byte [esp + ebx*2 + 0x5004a3a5]
cwde
sahf
retf
sbb al, 0x4b
jge 0x44eb69
xor al, 0
int3
sub al, 0xbb
invalid
mov dl, 0xd7
invalid
Function at 0x4655aa
Capabilities:
Encode data using xor

Disassembly:
call 0x321e18fc
push es
add ecx, 0xffffff90
sub ch, ah
and eax, 0xd0003de8
popal
mov byte [edx - 0xbfe6d95], dl
aaa
shr dword [edx*2 - 0x44bccdc9], 0xde
xor byte [edx + ecx*4 - 0x1d3ba695], al
loop 0x465583
loop 0x465583
sbb ah, ch
inc ebp
xor dl, byte [eax]
push 0xffffffffffffff9c
or edi, dword [ebx + 0x973b3a5]
outsd dx, dword [esi]
clc
adc edx, eax
adc ebp, ecx
invalid

Function at 0x4659ca
Capabilities:
Encode data using xor

Disassembly:
inc ebx
mov ebp, 0xea678171
neg byte [edi + 0x22]
aam 0xd3
or eax, 0x28c3c7b1
mov cl, 8
rol dword [esi - 0x79], cl
invalid
ljmp 0x157:0x12cd1223
jae 0x465a19
pop ebp
push edi
fidivr dword [edx - 0x3c128d4f]
sub byte [esi + 0x65], 0xed
aad 0x8d
inc esi
ret
stc
scasd eax, dword es:[edi]
jle 0x465975
jecxz 0x465a62
loop 0x465a08
retf 0x3bb7
and al, 0x6a
wait
aam 4
std
imul eax, dword [ecx - 0x4547dc9b], 0xffffff83
push ebx
jns 0x4659e1
or al, 0x63
inc esp
and dword [ecx], 0xffffffd0
and al, 0x8e
adc bl, dl
mov al, byte fs:[0x7e31a009]
bound ecx, qword [edi + eax - 0x74fc6ecd]
jbe 0x4659e5
shl byte [edi + 0x24], 1
mov ss, word [eax]
shl dword [eax + 9], cl
mov al, byte [0x8c627e31]
pop es
xor edx, dword [ecx - 0x4d8974fd]
jecxz 0x4659bc
invalid
cmp eax, 0xa2170cd8
repne insb byte es:[edi], dx
push esp
push edx
inc dword [esi]
loop 0x465a75
js 0x465a1e
cmpsd dword [esi], dword es:[edi]
add ecx, dword [edi + 0x405388d3]
pop esi
fiadd word gs:[ebx]
ror dword [eax + 0x655e4053], cl
fiadd word [ebx]
pushal
jg 0x465a95
retf
aam 0xd7
ror dword [ebx - 0x35], cl
outsd dx, dword [esi]
or al, 0x33
sbb edx, dword [edx + esi*8 + 0x32]
adc al, 0x11
pop es
mov esi, ebx
lea edi, [ecx + 0x12327587]
mov bh, 0xe4
imul ebp, dword [esi - 0x2e], 0xc6e8f347
outsb dx, byte [esi]
push ss
adc ebx, edi
sbb dword [edx + 0x70], ecx
mov esp, 0x3226df34
sbb esp, 0x419e0d03
popal
push 0xffffffffffffffcd
push esi
sbb byte [ebx - 0x4d], ch
xor esi, 0xaaa6742a
mov ebp, 0x1dd29845
or eax, 0xf6dd20ea
xchg ecx, eax
jb 0x465a9d
leave
pop esi
sub ebx, dword [edi + 0x73]
sbb eax, 0x7382411a
xchg esi, eax
or ch, ch
xor bh, byte [eax]
inc ebx
frstor dword [ecx]
inc ebp
dec esi
lodsd eax, dword [esi]
adc eax, 0x691c54f7
sbb al, 0x69
Function at 0x46fc92
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov dword [edx - 0x2670f0b0], edx
mov word [edx], gs
jp 0x46fcaa
xchg dword [eax], edx
pop ds
xor al, 9
push esi
daa
xchg ebp, eax
lodsd eax, dword [esi]
xchg ebp, eax
or ah, byte [edx + edi*2 - 0x1a4b9cc6]
xor dword [ecx], esp
push ebx
jbe 0x46fca4
jp 0x46fce6
arpl word [ebp + 0x76532131], si
invalid
lahf
dec edi
call 0x4a1a9ed9
mov byte [0x1e2e49d3], al
jge 0x46fce8
lea esp, [edx]
outsb dx, byte [esi]
sbb eax, edx
stosb byte es:[edi], al
xor al, 0x46
mov esi, es
out dx, al
fcomp dword [ebx]
aad 0
cmp cl, bl
xor dh, 0x3b
stosd dword es:[edi], eax
das
mov edx, 0x67609d7b
and dword [ecx - 0x2226dc9c], ecx
cmc
pushal
pushal
imul ecx, dword [ebp + 0x3198ce86], 0xffffffe5
into
cwde
xor ebp, esp
fisubr dword [esi]
sahf
outsb dx, byte [esi]
fcomp dword [ebp + ebx*4 + 0x4b8c483b]
dec ebx
cmp eax, 0xc1d426b0
mov byte [0x869531ad], al
aas
loop 0x46fcf4
and ebx, 0xffffffa0
aas
mov al, 0x34
mov al, byte [0x39a65315]
test dword [edi - 0x432568e7], eax
invalid

Function at 0x4949da
Capabilities:
Encode data using xor

Disassembly:
and ebx, 0xffffffb0
lds esi, [eax + 0x1e]
mov al, byte [0xcc95a2e]
arpl si, si
cmp dword [eax], ebx
xchg esi, eax
inc ebx
pop es
add al, 2
outsd dx, dword [esi]
or eax, 0x19482dc3
jbe 0x4949f3
sbb dword [esi - 3], esi
add eax, 0x38b60b2e
invalid
Function at 0x498c4c
Capabilities:
Encode data using xor

Disassembly:
invalid
xchg esi, eax
mov al, byte [0x965f60ba]
jne 0x498c24
ja 0x498cc9
cmp dword [edi], esp
int1
in al, dx
call 0xa59931a2
enter 0xffffffffffff8dc5, 0x52
add al, 0xfa
ffree st(7)
xor al, 0xba
invalid
push ebp
clc
mov edi, 0x8321e1d7
and edi, edx
adc ch, byte [ebx - 0x6f]
push eax
mov bh, dl
dec ecx
xchg edx, eax
push ecx
add eax, 0xd6214689
enter 0xffffffffffff9737, 0x17
iretd
test byte [edx + 0x16945712], ch
push eax
push edi
mov dl, bh
sbb esp, dword [esi]
dec eax
loopne 0x498ca0
rcl byte [ebx]
js 0x498d1b
enter 0x31f4, 0xffffffffffffffcf
pop ebx
sbb cl, al
dec eax
sbb byte [0x5c61d508], ch
cmc
imul ebx, eax, 0xd92ed8cf
ja 0x498d1f
hlt
inc edi
popal
movsb byte es:[edi], byte [esi]
invalid
fcom qword [esi + 0x137a9ec3]
jp 0x498d34
sbb eax, 0xf8bb2014
jmp 0x498d58
rcl dword [edx], cl
mov eax, 0xdc88d2ef
add al, 0x33
xchg edi, edi
rol dword [edi + 0x60], cl
jb 0x498da2
jno 0x498cde
cmpsb byte [esi], byte es:[edi]
mov bh, 0x56
popal
jbe 0x498d55
cmpsd dword [esi], dword es:[edi]
jno 0x498cd1
or edi, dword [ebx + 9]
jbe 0x498dcd
invalid
rcl dh, 0x36
sti
add byte [edi - 0x1d], dh
leave
cmpsd dword [esi], dword es:[edi]
cmp eax, 0xaa11f654
mov eax, 0x77f5058a
invalid
std
mov cl, bl
movsd dword es:[edi], dword fs:[esi]
fadd st(0)
dec eax
sbb eax, 0xdc3b75d4
nop
jb 0x498da3
or al, 0x45
and byte [edi], 0x9e
movsb byte es:[edi], byte [esi]
fsubr dword [ebx + esi - 0xdcd6591]
int1
dec ecx
mov eax, dword [0xb5dd750e]
cli
jne 0x498d81
fnsave dword [ebp + 0x2e85cfa]
push esi
jmp 0x94205d11
mov ch, 0xfa
pop esp
call 0x6332e3ae
iretd
loop 0x498e17
aam 0x5e
call 0x6e20d6a8
jbe 0x498e03
and dword [esi - 0xb], esp
retf 0x9c41
dec edi
or bh, byte [esi]
cmp eax, 0x316522b1
mov ch, dh
pop esi
cwde
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov ch, 0x6d
push edi
lodsd eax, dword [esi]
imul ebp, dword [esi - 0x16644ace], 0xcd98c85e
lodsb al, byte [esi]
scasb al, byte es:[edi]
xor dh, byte [ebp - 0x37a11665]
cwde
int 0xac
inc esp
xchg edi, eax
stosb byte es:[edi], al
lodsb al, byte [esi]
cli
mov esi, 0xafebb1e3
shr byte [edi + 0x68b026a4], cl
fst dword [0xf9c8426a]
leave
and eax, 0x395df6f4
lahf
or ecx, dword [ebx - 6]
mov ebp, 0xee4bff2e
mul dword [0xcbf5efdc]
xchg ecx, eax
salc
xor al, 0xeb
mov ebx, 0xd015594b
xor byte [edi + 0x42], al
fiadd dword [eax + 0x32]
dec eax
imul edi, edi, 0xffffffc8
sbb al, byte [edx]
invalid
Function at 0x4ba270
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
push ebx
push esi
push edi
lea eax, [ebp - 0x198]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x1a8], 1
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x1ac], eax
lea ecx, [ebp - 0x19c]
push ecx
push 0x2000000
mov edx, dword [ebp - 0x1ac]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4ba314
push 4
lea eax, [ebp - 0x1a8]
push eax
push 0x18
mov ecx, dword [ebp - 0x19c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4ba307
mov edx, dword [ebp - 0x19c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1ac], 0
je 0x4ba305
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x4ba314
mov eax, dword [ebp - 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x5cc005

Function at 0x4bb2f6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3310
cmp edx, dword [eax]
je 0x4bb318
add eax, 8
inc ecx
cmp eax, 0x4c33a0
jl 0x4bb309
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3310]
jne 0x4bb446
mov eax, dword [0x4c79b4]
cmp eax, 1
je 0x4bb420
test eax, eax
jne 0x4bb349
cmp dword [0x4c3250], 1
je 0x4bb420
cmp edx, 0xfc
je 0x4bb446
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb380
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bba10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbc40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb3c3
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbc40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfb00
push edi
call fcn.004bd410
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bba10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bba20
lea eax, [ebp - 0xa0]
push 0x4bfae0
push eax
call fcn.004bba20
push dword [esi + 0x4c3314]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bba20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd384
add esp, 0x2c
pop edi
jmp 0x4bb446
lea eax, [ebp + 8]
lea esi, [esi + 0x4c3314]
push 0
push eax
push dword [esi]
call fcn.004bbc40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x57a2cb
Capabilities:
Encode data using xor

Disassembly:
insd dword es:[edi], dx
push esi
punpckhdq mm3, qword [ecx - 0x32c9c8d9]
cli
jo 0x57a289
imul ebp, dword [ebx], 0xffffffe1
pushal
mov bl, 0x9f
jp 0x57a22c
push 7
pop es
inc edi
mov ch, ah
adc byte [0x318e29ef], dl
sbb dword [edi - 0x4b], esi
andps xmm5, xmmword [ecx - 0x2d813018]
inc esp
push ebp
mov dword [0x3d66cb60], eax
jns 0x57a2a9
xchg ecx, esp
int3
and eax, 0x6011e766
dec ebx
xor al, cl
mov ebx, 0xb3166f2
test al, 0x5e
pushal
enter 0xffffffffffffd020, 0xffffffffffffff9b
cmp eax, 0xefa9f262
mov ebx, dword [eax + ebp - 0x4c]
dec esp
xchg edi, eax
mov cl, 0xae
div dword [edx - 0x5e181223]
daa
lds ecx, [edx - 0x30]
mov eax, dword [0xd04ac527]
sal byte [eax - 0x408eca3f], 1
dec edx
mov dh, 0x7d
nop
mov al, 0xc1
xor eax, 0xb64abf71
jge 0x57a217
pop edx
invalid
loop 0x57a252
hlt
stc
mov bh, 7
cmpsd dword [esi], dword es:[edi]
xor eax, 0xf7b61f92
push es
or esi, dword [edx + 0x5f564e64]
push ebp
invalid
add edx, edi
dec ebp
or al, 0x16
xchg ecx, eax
bound ebx, qword [edi - 0x6897d670]
adc byte [ecx + 0x7d362017], bh
pushfd
push edx
mov ebp, 0xa07652b3
mov esp, 0x216cc561
mov es, word [ebx - 0x77]
ja 0x57a290
invalid
rcl dh, 1
sbb cl, ah
push ds
dec ecx
insb byte es:[edi], dx
lea eax, [ecx]
aas
sbb ebx, ebx
pushfd
xor ebx, esp
jae 0x57a27d
cmp edx, dword [ebx - 0xc]
int 0xe9
salc
xchg ecx, eax
jl 0x57a304
mov byte [ebx], dl
and dword [esi + 0x24367ed7], ebx
push esp
cdq
aas
jg 0x57a279
dec edx
or dword [esi + ebx*4], ebx
sub edx, esi
salc
fnsave dword [ecx + 0x47]
fdiv st(5), st(0)
mov dword [0x42ac9855], eax
push ebp
push 0xffffffffffffffbe
jbe 0x57a312
xchg ebx, eax
nop
push edi
cdq
js 0x57a2e5
jns 0x57a360
aam 0xb0
cmp eax, 0x2977aea7
jmp 0x57a36d
push ds
rcl bh, 0xda
iretd
mov eax, dword [0x4cbe9]
add bh, dh
fimul word [edi]
mov edx, dword [edi - 0x16ffffff]
add cl, ch
test dword [ecx], 0xc7810000
insd dword es:[edi], dx
je 0x57a357
jg 0x57a37b
test dword [ecx - 0x208b9211], 0xb8ef817f
popfd
mov bh, 0x7f

Function at 0x5bbb94
Capabilities:
Encode data using xor

Disassembly:
sub eax, dword [eax]
aaa
mov dh, ch
mov bh, 0x5f
salc
invalid
xchg edi, ebp
out 0x70, eax
stosb byte es:[edi], al
mov ebp, 0x599c13b5
das
xor eax, 0x71aedce1
push ebx
inc esi
xor dword [edx], ecx
sbb al, al
push eax
mov ebp, 0x82d79016
cmp eax, 0xe2418205
jecxz 0x5bbb80
ret

Function at 0x5d8758
Capabilities:
Encode data using xor

Disassembly:
and dl, byte [edx + 0x3b]
inc ebp
mov esp, 0xbd8a5d33
dec edi
pop ds
cmp al, 0xf1
test al, 0xd6
mov esp, 0x4fd35535
leave
sub edi, dword [0x2dfce1ef]
cmp eax, 0x850b582b
wait
or byte [esi + 0x287471f9], bl
xchg ebp, eax
aaa
xchg ecx, eax
push ecx
dec ebx
cld
xor ebx, dword [ebp + 0x5c]
cld
jae 0x5d876d
sub eax, 0x6edea560
invalid
Function at 0x401288
Capabilities:
Parse pe header

Disassembly:
test ecx, ecx
je 0x4012ae
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x4012ae
mov eax, dword [ecx + 0x3c]
cmp eax, 0x400
jg 0x4012ae
add eax, ecx
xor ecx, ecx
cmp dword [eax], 0x4550
cmovne eax, ecx
ret
xor eax, eax
ret
Function at 0x401b33
Capabilities:
Get disk information

Disassembly:
push 0x2fc
mov eax, 0x4e9870
call fcn.004e96d0
mov esi, ecx
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x218], esi
lea edi, [ebp - 0x230]
xor eax, eax
xor ebx, ebx
stosd dword es:[edi], eax
push 0xf
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop edi
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], edi
mov byte [ebp - 0x230], bl
push str.Error_:_string_is_null
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x230]
push dword [ebp - 0x218]
push 0x16
call fcn.00404a6a
mov ecx, 0xff
lea eax, [ebp - 0x114]
push ecx
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x218]
push eax
push ecx
lea eax, [ebp - 0x214]
push eax
push 0x7b9748
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x401c06
push 4
push str.null
lea ecx, [ebp - 0x230]
call fcn.004044ca
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.00403ffe
mov edx, dword [ebp - 0x21c]
cmp edx, edi
jbe 0x401cbe
mov ecx, dword [ebp - 0x230]
inc edx
call fcn.00404adc
jmp 0x401cbe
push 0xb0
lea eax, [ebp - 0x304]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
pop ecx
lea ecx, [ebp - 0x304]
call fcn.00403ef2
push 0x40163c
lea ecx, [ebp - 0x2f4]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
push dword [ebp - 0x218]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int_]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x2ec]
call fcn.0040439e
cmp dword [ebp - 0x238], 0
jbe 0x401c83
cmp dword [ebp - 0x234], edi
lea eax, [ebp - 0x248]
cmova eax, dword [ebp - 0x248]
add byte [eax + ebx], 6
inc ebx
cmp ebx, dword [ebp - 0x238]
jb 0x401c63
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call fcn.00403ffe
lea ecx, [ebp - 0x248]
call fcn.00403fdb
lea ecx, [ebp - 0x29c]
call fcn.00403ec2
lea ecx, [ebp - 0x29c]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_char__struct_std::char_traits_char__::destructor_void_]
lea ecx, [ebp - 0x230]
call fcn.00403fdb
mov eax, esi
call fcn.004e968e
ret