joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd3b4
Capabilities:
Accept command line arguments

Disassembly:
dec edi
je 0x4dd3bf
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ecx
ret
test esi, esi
jle 0x4dd545
mov edi, dword [esp + 0x14]
cmp edx, 3
ja 0x4dd4ac
jmp dword [edx*4 + 0x415438]
fild dword [esp + 0xc]
add edi, 4
dec esi
fmul qword [0x41e400]
fstp dword [edi - 4]
jne 0x4dd3cb
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
jmp fcn.00abe5ca

Function at 0x4e981b
Capabilities:
Encode data using xor

Disassembly:
xor dl, byte [edx]
cmc
sub esi, dword [edi - 0x63]
cmpsd dword [esi], dword es:[edi]
les eax, [edx + 0x6c]
mov al, byte [0x730e4e82]
arpl word [edi], si
and dword fs:[ecx - 0x20], esp
popal
cmp dword [edi + 0xe], edx
sbb esi, esi
mov eax, dword [0xe849d37]
jecxz 0x4e97ce
or dword [ecx - 0x73338caa], esi
retf 0xa5f8

Function at 0x4f8421
Capabilities:
Encode data using xor

Disassembly:
lock sbb dword [ecx + 0x43], 0xffffffe4
ja 0x4f83ac
sub al, 0x9d

Function at 0x528fa4
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp eax, 0x50
ja 0x528fc2
movzx ecx, byte [eax + 0x403108]
jmp dword [ecx*4 + 0x4030f8]
jmp fcn.00532285
Function at 0x53224d
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp al, 0x66
fstp dword [ecx]
adc al, 3
invalid
push ss
int1
aam 0x90
xchg edi, eax
sahf
xlatb
wait
pop esp
mov word [esi + 0x38], fs
xor dword [ecx + 0x7153d767], ebp
sub dword [edi - 0x3f], ebp
shl esi, 0x78
shl esi, 0x78
leave
cmpsd dword [esi], dword es:[edi]
or dword [esi + 0x32], edx
jne 0x5322d3
adc edi, dword [ecx - 0x21]
dec ebp
fld dword [edi]
dec eax
test al, 7
or byte [edx - 0x73], bl
jecxz 0x532206
cmp dword [ebp + 0x79febcc2], edi
or dword [ebx], edi
xor eax, 0x860b39f8
inc esi
pop edx
xchg ebx, eax
fsubr qword [edi]
lds eax, [ebp - 0x58]
xor dword [ebp + 0x79], edx
mov ecx, 0xf090c9e2
lea edx, [edi - 0x42743665]
wait
leave
invalid
invalid
jns 0x53229e
fucompi st(1)
outsd dx, dword [esi]
cmp dword [edi], esi
mov cs, esi
aad 0x76
popfd
js 0x5322c3
dec edi
xor bl, al
xchg dword [ecx - 0x23], ebp
mov byte [0xac5b6739], al
les edi, [edx]
in eax, 0x13
jnp 0x532239
sub cl, 0xb9
enter 0x65a2, 0xffffffffffffffc7
mov dword [edi - 0x1836d067], 0xc7d80a90
push es
jno 0x53231b
int3
dec eax
xor dword [edi + 6], ebx
aas
loope 0x532349
int1
xchg byte [edx], dh
mov cl, byte [ecx + 0x37cb7781]
and dword [edx + 0x313b30db], edx
adc al, 0xac
retf
test dword [ecx], ebx
insb byte es:[edi], dx
dec edi
mov ebp, 0x33f9799
cmp al, 0xf6
mov byte [ecx + 0x4ed04d2e], bl
lodsd eax, dword [esi]
push ss
fdiv dword [ecx]
mov dword [edi], esp
jbe 0x53239c
enter 0x7425, 0xffffffffffffff93
fcmovu st(0), st(4)
mov esi, 0xbcd96c6b
adc al, 0x4d
cmp al, 1
invalid
cmp dword [eax - 0x6a357ba4], edi
or dword [eax], ebx
test al, 0x7e
cli
lahf
cmp dword [edx - 7], eax
sub cl, ah
xor cl, byte [eax + 0x36]
add dword [edx + 0x7f33040d], 0x99dab3b5
jg 0x5323c2
fstp xword [ebx - 0x7c53cd74]
dec esp
sahf
sbb dword [eax], ebx
scasd eax, dword es:[edi]
aas
div dword [ebp + 0x758983b6]
cmpsd dword [esi], dword es:[edi]
pop ecx
stosd dword es:[edi], eax
sal dword [edi + 0x458e50e8], 1
xchg ebp, eax
popaw
out dx, al
pop eax
lahf
sub al, 0x44
rcr edi, 0x4a
mov ebx, 0xfa28cc49
cli
bound ebp, qword [edi + edx*4 + 0x369c816e]
mov esp, 0x208f7919
mov fs, ebp
sbb dword [esi + esi + 0x7919c4c7], 0xe58e208f
fistp dword [eax]
xchg esp, eax
fld dword [esi + 0x12]
mov ah, 0x25
jae 0x532388
or byte [esi + 0x53], dl
add al, 0xfb
push esp
adc al, 0x66
sub al, 0x93
sub dword [ecx], esi
push esp
adc eax, 0x2f0b53c8
or ebp, dword [edi]
test dword [edi + 0x7d], eax
loopne 0x532426
int3
sbb dword [ecx], ebp
or byte [ecx - 0x25], al
push ecx
movsb byte es:[edi], byte [esi]
popal
cmp esi, edi
push eax
lahf
xchg word [edx + 0x75], ax
cmp al, 0x87
out dx, al
lahf
ret
Function at 0x532285
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cmp al, 0x66
fstp dword [ecx]
adc al, 3
invalid
push ss
int1
aam 0x90
xchg edi, eax
sahf
xlatb
wait
pop esp
mov word [esi + 0x38], fs
xor dword [ecx + 0x7153d767], ebp
sub dword [edi - 0x3f], ebp
shl esi, 0x78
shl esi, 0x78
leave
cmpsd dword [esi], dword es:[edi]
or dword [esi + 0x32], edx
jne 0x5322d3
adc edi, dword [ecx - 0x21]
dec ebp
fld dword [edi]
dec eax
test al, 7
or byte [edx - 0x73], bl
jecxz 0x532206
cmp dword [ebp + 0x79febcc2], edi
or dword [ebx], edi
xor eax, 0x860b39f8
inc esi
pop edx
xchg ebx, eax
fsubr qword [edi]
lds eax, [ebp - 0x58]
xor dword [ebp + 0x79], edx
mov ecx, 0xf090c9e2
lea edx, [edi - 0x42743665]
wait
leave
invalid
invalid
jns 0x53229e
fucompi st(1)
outsd dx, dword [esi]
cmp dword [edi], esi
mov cs, esi
aad 0x76
popfd
js 0x5322c3
dec edi
xor bl, al
xchg dword [ecx - 0x23], ebp
mov byte [0xac5b6739], al
les edi, [edx]
in eax, 0x13
jnp 0x532239
sub cl, 0xb9
enter 0x65a2, 0xffffffffffffffc7
mov dword [edi - 0x1836d067], 0xc7d80a90
push es
jno 0x53231b
int3
dec eax
xor dword [edi + 6], ebx
aas
loope 0x532349
int1
xchg byte [edx], dh
mov cl, byte [ecx + 0x37cb7781]
and dword [edx + 0x313b30db], edx
adc al, 0xac
retf
test dword [ecx], ebx
insb byte es:[edi], dx
dec edi
mov ebp, 0x33f9799
cmp al, 0xf6
mov byte [ecx + 0x4ed04d2e], bl
lodsd eax, dword [esi]
push ss
fdiv dword [ecx]
mov dword [edi], esp
jbe 0x53239c
enter 0x7425, 0xffffffffffffff93
fcmovu st(0), st(4)
mov esi, 0xbcd96c6b
adc al, 0x4d
cmp al, 1
invalid
cmp dword [eax - 0x6a357ba4], edi
or dword [eax], ebx
test al, 0x7e
cli
lahf
cmp dword [edx - 7], eax
sub cl, ah
xor cl, byte [eax + 0x36]
add dword [edx + 0x7f33040d], 0x99dab3b5
jg 0x5323c2
fstp xword [ebx - 0x7c53cd74]
dec esp
sahf
sbb dword [eax], ebx
scasd eax, dword es:[edi]
aas
div dword [ebp + 0x758983b6]
cmpsd dword [esi], dword es:[edi]
pop ecx
stosd dword es:[edi], eax
sal dword [edi + 0x458e50e8], 1
xchg ebp, eax
popaw
out dx, al
pop eax
lahf
sub al, 0x44
rcr edi, 0x4a
mov ebx, 0xfa28cc49
cli
bound ebp, qword [edi + edx*4 + 0x369c816e]
mov esp, 0x208f7919
mov fs, ebp
sbb dword [esi + esi + 0x7919c4c7], 0xe58e208f
fistp dword [eax]
xchg esp, eax
fld dword [esi + 0x12]
mov ah, 0x25
jae 0x532388
or byte [esi + 0x53], dl
add al, 0xfb
push esp
adc al, 0x66
sub al, 0x93
sub dword [ecx], esi
push esp
adc eax, 0x2f0b53c8
or ebp, dword [edi]
test dword [edi + 0x7d], eax
loopne 0x532426
int3
sbb dword [ecx], ebp
or byte [ecx - 0x25], al
push ecx
movsb byte es:[edi], byte [esi]
popal
cmp esi, edi
push eax
lahf
xchg word [edx + 0x75], ax
cmp al, 0x87
out dx, al
lahf
ret
Function at 0x536f2e
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x4a
jns 0x536f83
lodsb al, byte [esi]
add edx, esp
mov al, byte [0xb278f211]
add eax, 0xb9966449
xor byte [ecx - 0x61ed96b9], bl
sahf
outsb dx, byte [esi]
lodsb al, byte [esi]
jne 0x536f35
mov dword gs:[0xbc7e1fc4], eax
cmp al, 0x2b
cdq
sub ebp, eax
stosb byte es:[edi], al
sub eax, dword [esi + 0x135af65d]
test eax, 0x18ac6585
push edi
xchg dword [ecx + 0x72af6109], edi
ja 0x536fc1
retf 0x9a7a
sub dl, byte [edi]
xor eax, 0xf31ce110
int1
aaa
pop ecx
wait
pop eax
pop es
dec esp
sal byte [edi], cl
in al, dx
invalid
retf 0x87c1
mov dl, 0xb
test eax, 0x3f67ed25
test al, cl
insb byte es:[edi], dx
loop 0x536f44
mov ah, byte [esi - 0x33]
xchg esp, eax
js 0x536f6f
sbb al, 0x85
or dword [eax - 0x17], esp
out 0x29, al
ja 0x536fac
mov bh, 0x82
invalid
mov bl, 0xe1
mov al, 0x8e
je 0x536f94
test eax, 0x487620
xchg ecx, eax
and esp, dword [ebx + 0x39]
jno 0x536fdd
pushal
mov ecx, 0x9483f739
mov ebx, 0x60ea5f54
push ss
bound edx, qword [edi]
pop esp
pop ebx
fmul st(3), st(0)
mov cl, 0x28
fstp dword [eax + ecx*4 - 0x1689b6c4]
stosd dword es:[edi], eax
pop ecx
fcomp dword [ecx - 0x3e442384]
mov ebx, 0xdc6760c1
jbe 0x536fd4
ljmp 0x5b5c:0x17621660
stc
mov dh, 0x52
out 0x29, eax
popal
arpl word [eax + 0x48], bx
mov ebx, 0x4037890f
inc eax
mov edx, 0x606d37a1
pop ebx
sbb eax, dword [edx]
dec esp
or edi, eax
add cl, byte [ebx + ecx - 8]
mov ecx, 0xc34be892
pop ss
pop ecx
call 0x596b3368
test al, 0x5c
pop ds
xchg ebp, eax
push esp
mul dword [edx + 4]
jge 0x537098
cmp al, 0x49
cwde
cld
mov dh, 0xf8
idiv bh
jg 0x537012
sbb byte gs:[esi - 0x58c7552e], dl
sbb byte [esi - 0x58c7552e], dl
fsubr qword [ecx - 0x48b6652b]
lea eax, [eax + 0x61]
pushal
cmp dword [edi - 0x6b], edx
sbb esp, dword [esi + 0x1fc2610]
push edi
sub ebx, esp
jo 0x537083
sbb bh, dl
jg 0x537018
jbe 0x53700a
imul edx, ebp, 0xd74990dc
pop edx
xchg esp, eax
push edi
scasd eax, dword es:[edi]
mov eax, dword [0xa8c3a867]
pop edx
xchg edi, eax
push edi
sub eax, 0x7df8918b
jg 0x537098
scasb al, byte es:[edi]
or bl, byte [ebp + ebp*8 - 0x61]
mov ebp, 0x6ee17036
iretd
jle 0x537032
or ebx, dword [edx + 0x7442ee63]
pop ds
xchg dl, ah
test eax, 0x20ce649e
invalid
pop edi
dec esp
add dword [ebp + 0x78], esi
arpl word [edx], sp
movsd dword es:[edi], dword [esi]
xchg ebx, eax
fimul word [ecx + 0x4c129aaf]
pop esi
bound eax, qword [ebx + 0xb]
das
test bh, al
jo 0x5370d6
scasb al, byte es:[edi]
xchg edi, eax
mov dword [eax + 0x30], ecx
xor bh, byte [ebx]
mov byte [0xe752c731], al
in al, 0xed
call 0xb8eefc97
scasb al, byte es:[edi]
sub dword [esi + eax*4], esp
aad 0x28
out 0xda, al
or byte [ecx + ebp - 0x6cf2ab1f], bh
add dh, byte [edi]
clc
std
test eax, 0x79987ee6
mov al, 0xa2
cmp al, 0x1c
daa
nop
inc ecx
test al, 0x5b
and byte [edx], dl
test al, 0xc9
call [eax + 0x21]
adc al, 0x7f
outsb dx, byte [esi]
call 0xe329795f
invalid

Function at 0x5389d4
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x2e
mov ecx, 0x40fa77e0
mov eax, 0x53c6439a
cdq
push esi
sbb dword [edi - 0x1e], esi
inc eax
invalid
Function at 0x5414f2
Capabilities:
Authenticate hmac

Disassembly:
cmp al, 0xa4
push ebx
pop ss
std
add dword [ebx], esi
invalid
mov ecx, 0xb67cd1cc
pop ss
mov eax, 0xd90a6d95
cmp ch, byte [esi]
pop ebp
je 0x5414df
mov edi, 0x79778686
cmp byte [ebx + 0x78], ah
scasd eax, dword es:[edi]
out 0xa4, eax
sbb byte [esp + ecx*4], dl
dec ecx
mov eax, dword [0xe8548d1]
or cl, byte [edx + 0x220b05ce]
add eax, 0x98042a7d
fstpnce st(2), st(0)
test byte [edi], dl
mov dl, 0x26
add byte [eax + 0x52], dl
retf

Function at 0x57a816
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
dec ebp
xchg dword [eax + 0x7136b332], ecx
push ss
xor ebx, esp
add byte [eax], bl
mov dl, 0x3b
cmp byte [ebx], 0x82
xor cl, cl
adc eax, 0x38f9ca05
mov ecx, 0x3990814c
xchg esp, eax
mov edi, dword [ebx - 0x1957c4c7]
mov ah, 0x91
jecxz 0x57a784
cmc
mov eax, 0x4954ff49
pushal
xlatb
adc dword [ecx], ecx
mov dword [0xd1f34c25], eax
mov al, byte [0xa1dee8e3]
push ecx
int1
add eax, 0x7ee7f5b9
add edx, ebp
jp 0x57a7bd
push ss
sbb ebp, eax
push eax
jl 0x57a7f4
add al, 0x5a
je 0x57a7b7
int1
imul edx, dword [ebp - 0x18ad9e5f], 0x59b14433
pop ss
jle fcn.0057a84d
xor byte [eax], 0xe7
mov bl, 0x5d
Function at 0x57bc5d
Capabilities:
Encode data using xor

Disassembly:
dec edi
mov ah, byte fs:[edi]
nop
daa
mov edi, 0xd1ab81e0
pop ebp
push edi
dec ecx
movsb byte es:[edi], byte [esi]
mov edx, 0xf858d63d
scasb al, byte es:[edi]
test ebp, 0xd114191a
mov ebx, 0x558f61b6
stosb byte es:[edi], al
fldenv [ecx - 0x5daa136a]
mov eax, dword [0xa255ec96]
xchg edi, eax
or dword [ebp - 0x5abf48f6], ebx
bswap ebp
sub dh, byte [edi]
inc esi
inc ebp
push eax
lds ebp, [esi]
inc edx
adc dword [edi + 0x10], eax
rcr dword [edx + 0x47], 0x56
mov dword [0x83309103], eax
invalid
ret
add ebx, 0xffffff87
jns 0x57bc3b
wait
and ebx, edi
das
movsd dword es:[edi], dword [esi]
shl byte [edi - 0x2d], 0xc7
xor esp, eax
lea ebx, [edi + eax*2]
aas
out 7, al
loope 0x57bc18
cmp dword [edi - 0x26], ecx
pop es
ror byte [ebx + esi*4], cl
ja 0x57bcb5
invalid
mov ah, 0x9f
neg dword [esi + 0x5d]
sal byte [edx - 0x39], 1
invalid
aad 0x9e
push ebp
push ebp
mov edx, 0x8a3280d8
sbb edi, ecx
mov bl, byte [ebx]
stc
sbb esi, ebp
je 0x57bcd9
push edi
add dword [ebx + 0x2b97898d], esp
and dl, bl
mov ebp, fs
jge 0x57bca4
and dword [ecx], ebx
in al, dx
and dl, dl
lahf
jnp 0x57bd49
xchg ebx, eax
push edi
movsb byte es:[edi], byte [esi]
jnp 0x57bcbd
js 0x57bce0
ret 0xa041
cmp byte [edx], bl
arpl bx, cx
xchg edx, eax
invalid
into
aad 3
out dx, eax
arpl word [esi], bx
rcl byte [eax + 0x6a538830]
movsd dword es:[edi], dword [esi]
push ebx
push 0xffffffffffffffa5
inc esp
adc cl, byte [edx - 0x47]
and eax, esi
int 0x11
push esi
movsd dword es:[edi], dword [esi]
push ebp
pop ss
mov edx, 0xf09fbdee
push ebx
inc ebp
jb 0x57bd87
and eax, 0x8885b1a6
mov byte [0xf2e72237], al
cmp dword [eax + eax*8], eax
pop esi
xor esp, ecx
push ss
jae 0x57bd53
movsb byte es:[edi], byte [esi]
adc dl, dh
add eax, 0xa60d5d87
jne 0x57bd0b
and dword [edi - 0x5b], 0xffffffbc
sbb bl, byte [edi - 0x46759b68]
fistp qword [ecx + ebx*8]
ljmp 0x2a4a
movsd dword es:[di], dword [si]
mov esp, 0x64989f1a
mov bh, byte [ecx - 0x1526c321]
rol esp, 1
aam 0xb3
dec edx
sub ch, byte [edi]
and dword [edx - 0x7827e13], esi
cmp al, 0xb1
mov ah, 0x3b
invalid
Function at 0x57ed33
Capabilities:
Encode data using xor

Disassembly:
bound esi, qword [ebx + 0x69d76394]
xor eax, 0xbb1cae7c
wait
in al, 0x2e
in eax, 0x6a
cmpsd dword [esi], dword es:[edi]
ret
cld
mov edx, 0x5b0358b8
cmc
xor ebp, eax
lds eax, [ebp + 0x458442e0]
cmp eax, 0x9071ea39
lds eax, [ebp + 0x458442e0]
cmp eax, 0x9071ea39
insb byte es:[edi], dx
jle 0x57edbc
add dword [eax + 0x6d2a2eb5], 0x8c753305
out dx, al
mov esi, gs
loope 0x57edcb
fbstp tbyte [eax]
int1
sbb esi, edx
cmc
in eax, dx
pushal
mov ecx, eax
test byte [ebp + edi*4 - 0x620f3000], al
pop esp
sti
cdq
lodsb al, byte [esi]
loopne 0x57ed4b
arpl word [edx - 0x6310de9f], si
mov cl, 0x71
sal dword [ecx + ecx*8 + 0x77], 0xef
out dx, eax
jo 0x57edd7
popal
movsd dword es:[edi], dword [esi]
jns 0x57ed9e
nop
test eax, 0x793eaf41
xchg dword [edx + 0x781d5775], ebp
invalid
mov si, 0xfa8a
or dword [ecx - 0x5b], esp
jae 0x57ed2b
inc ecx
rol bl, 0x45
mov al, 0xac
xchg ecx, eax
pop edx
push ss
dec esp
rcl dword [esi], cl
mov eax, 0xe006fff8
jp 0x57ed75
xor eax, 0x6fe9531
xchg ebp, eax
inc byte [esi]
mov esi, 0x61236384
xchg byte [edx - 0x2cef9ea0], ah
pop esp
mov cl, 0x84
or byte [eax], dl
jp 0x57ed73
rcl dword [ecx]
out dx, eax
fld xword [edx]
sbb byte [edx - 0x53], 0xd0
aam 0xf4
shr eax, 0xcd
xor dword [eax + 0x537a73e6], 0xc1ea5046
and al, 0xbc
xchg ebx, eax
inc esp
stc
inc ecx
cdq
mov cl, 0x39
mov eax, dword [0xcd31013f]
fld qword [ebx - 0x5f]
lea esp, fs:[edi + 0x16348983]
jge 0x57ee81
xchg dword [ecx - 0x4d], ebp
adc eax, 0xe521512a
loope 0x57ee32
sub eax, 0x386607a7
call dword [ecx + 0x4f]
sbb eax, 0xce5fafa5
adc dword [edx + 0x7dbdf87b], 0xa5d5b186
dec ebp
invalid
ret
xchg ecx, eax
push es
inc edx
or eax, 0x5f52b1c0
int 0x22
test al, 0x89
xor dword [edi + 0x17636561], esi
dec ecx
fsubr st(4), st(0)
shl dword [eax - 0x55d630e], 0x1f
sub byte [ecx - 0x61], ah
cld
and byte gs:[0x75911c7f], dl
cmp eax, 0x2f11b185
das
lds edi, [ecx - 0x1e807edc]
cmc
sub bl, dl
push 0x9b41c1b5
sbb esi, esi
add al, 0x6e
je 0x57ee55
cmp dword [ebx], ecx
movsd dword es:[edi], dword ss:[esi]
mov ss, word [eax - 0x6256adcf]
test dword [ebx + 0x1f], ebx
shr dword [ebx + 0x3c], 0x58
pop esi
adc al, 0xf3
jb 0x57eeeb
ljmp 0xa5dc:0x1b13e5b5
add byte [edx], bh
inc ebp
mov ecx, 0xe74010f0
adc dword [edi - 0x40], edi
invalid
Function at 0x5cca66
Capabilities:
Encode data using xor

Disassembly:
xor eax, 0x52913262
xor al, 0xe
call 0x65fc8617
pop es
fsub dword [ebx + 0x4ba8af5]
cmp ch, bh
dec esp
sub dword [eax], esi
dec ecx
sar ch, 1
push ss
popfd
adc byte [eax - 0x5c], ch
invalid
fcmovu st(0), st(2)
mov edi, 0x8da99ab9
stosd dword es:[edi], eax
mov eax, cs
xchg esi, eax
dec esp
or byte [0x6b0e0e8b], bh
sub ch, byte [ecx]
or ecx, dword [eax + 0x7c]
imul ebx, eax, 0x16
mov ebx, 0x799bb9d6
clc
and al, 0x27
xor dword [esi], edi
mov word [edi + 0xed62fd1], cs
and ch, byte [eax + 0x52]
mov dh, 9
sbb byte [eax + ecx*2 + 0xd69573d], al
popal
nop
insd dword es:[edi], dx
in al, 0x93
pushal
sbb ecx, dword [edi]
mov bl, 0xc1
adc dh, byte [esi + 0x2df98b79]
stc
lea edx, [edx]
out dx, eax
aad 0x6c
sbb ebx, dword [0xa31b7026]
jnp 0x5cca0e
inc edi
jp 0x5ccb06
or eax, 0xb4bf265f
pop es
js 0x5cca36
xor dword [ebp - 0x20], 0xffffffd5
pushfd
jb 0x5cca96
scasd eax, dword es:[edi]
mov esi, 0x7cd911c9
xchg esp, eax
sbb ebx, ebx
or al, 0xd
adc dword [0x47f6e8c7], ebx
pop eax
invalid
xchg esp, eax
cld
push edi
invalid
mov ebx, 0x4b6d7ff7
insd dword es:[edi], dx
dec ebx
xor ah, bh
adc dword [ebp - 0x4d11e6c8], ebp
idiv dword [ecx]
fidiv word [ecx]
mov edi, 0xb27ddefd
into
mov eax, 0xd1779540
imul dword [ecx - 0x46]
and eax, 0x6c1146e9
stosb byte es:[edi], al
xchg esp, eax
sal byte [edi], 1
cld
in al, 0xcc
jg 0x5ccb60
dec esp
nop
cmp eax, 0x99624c80
leave
add eax, 0xdd5d0943
xor byte [ebp + 0x7a], ah
push ebp
pop eax
fsubr qword [ecx + 0x42]
mov edx, 0x6bfdeb28
or dword [ebx + 0x22a1a7b], ecx
rcl byte [ecx - 0x3d], 0x6a
stosb byte es:[edi], al
insd dword es:[edi], dx
add al, 0x46
xtest
fistp dword [edi + edi*8]
not byte [eax - 0x65885e8e]
jb 0x5ccb03
ja 0x5ccafe
pop esi
stosd dword es:[edi], eax
inc ebp
adc al, byte [esi + 0xa96962a]
invalid

Function at 0x61dab8
Capabilities:
Encode data using xor

Disassembly:
jne 0x61db35
leave
cmp byte [edx], 0xf8
pop edi
outsb dx, byte [esi]
xor esi, dword [edi - 0x3f190b79]
mov byte [0xc3b00fce], al
iretd
mov edi, 0x521b44ea
pop esp
xor dword [eax + 0x641f7373], ecx
pop ebp
sub dword [ecx - 0x3f4ab781], 0xa97fe302
push ss
sub eax, 0xdaee01fb
cmp dword [ecx], esp
fidivr dword [ecx]
and al, 0x21
jge 0x61db51
jl 0x61db9c
sub byte [edx], cl
inc edx
invalid
mov ebp, cs
or ebx, edx
fld xword [eax + 0x60b77cf]
nop
fst dword [eax + 0x622f78f0]
int 0xbe
xchg esi, eax
invalid

Function at 0x61e5d8
Capabilities:
Encode data using xor

Disassembly:
xor byte [edx], ah
pop ds
push es
sbb ch, dl
popal
pop es
cli
mov esp, 0x999b4d23
cmc
insb byte es:[edi], dx
adc cl, ch
mov edi, 0xd8354022
jo 0x61e5ac
dec ebx
ret
Function at 0x40273a
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x406018
push 0x406014
call fcn.00402d64
push 0
push 0x406020
push 0x40601c
call fcn.00402d64
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x403402
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a44]
test eax, eax
je 0x40341b
call eax
test eax, eax
jne 0x40341b
push 0xfffffffffffffffe
jmp 0x403435
push 1
push 0x406010
push 0x406008
call fcn.00402d64
add esp, 0xc
test eax, eax
je 0x40343b
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402d64
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403461
mov esi, 0x405bd1
mov cl, 0x20
jmp 0x40346a
cmp al, 0x20
ja 0x403474
inc esi
mov al, byte [esi]
test al, al
jne 0x403465
cmp al, 0x20
jbe 0x40348b
mov al, byte [esi]
cmp al, 0x22
jne 0x40347d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403476
jmp 0x40348b
cmp al, cl
ja 0x403491
inc esi
mov al, byte [esi]
test al, al
jne 0x403486
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4034ba
movzx eax, word [ebp - 0x14]
jmp 0x4034bd
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x4034f8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x406391], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4068a0
push 0x406908
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403542
xor eax, eax
jmp 0x403559
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x40892c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
sub esp, 4
mov dword [esp], edi
pop esi
and edi, edi
call fcn.00408954
xor dword [edx], ebx
add edx, 1
cmp edx, ecx
jne fcn.0040892c
add edi, 0xa124a8b0
add edi, edi
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
mov ecx, 0x36567a87
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1cb25926
nop
nop
nop
nop
test eax, eax
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x40de38
mov ecx, 0x338b03c2
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
mov ecx, 0x329726f5
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0xe9a370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0xe9a38e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0xec3074
push ecx
mov edi, eax
call fcn.00eae198
mov esi, eax
add esp, 8
test esi, esi
jne 0xe9a3cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.00eae02e
push esi
call fcn.00eadfb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret