joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42d520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x569338
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d5ac
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x42d5ac
cmp esi, 0x15f90
jl 0x42d5a3
cmp esi, 0x1d4c0
jge 0x42d580
mov eax, 0x32
jmp 0x42d5a5
cmp esi, 0x2bf20
jge 0x42d58f
mov eax, 0x64
jmp 0x42d5a5
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x42d5a5
mov eax, 0xfa
jmp 0x42d5a5
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d5c0
inc esi
cmp esi, 0x57e40
jl 0x42d538
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d5da
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00448f20
add esp, 4
mov eax, dword [0x56933c]
test eax, eax
jne 0x42d608
cmp dword [0x50fa40], 1
je 0x42d648
xor edi, edi
xor esi, esi
call fcn.0042d6e0
mov dword [0x56933c], 1
cmp dword [0x50fa40], 1
je 0x42d633
mov dword [0x569338], 0
push dword [0x569334]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42d663
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00484e80
push edi
push 0x16
call fcn.00484e80
add esp, 0x10
jmp 0x42d608
push 1
push 2
call fcn.00484e80
mov esi, eax
push 1
push 0x16
call fcn.00484e80
add esp, 0x10
mov edi, eax
jmp 0x42d5f0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004384e0
add esp, 0xc
test eax, eax
je 0x42d68d
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x50f99c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x50f998]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x50f994]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x50f990]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x42d695
push dword [ebp - 0x10]
push dword [0x569334]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [ebp - 0x10]
jmp 0x42d622

Function at 0x42d6e0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x569328], 0
je 0x42d6f0
mov esp, ebp
pop ebp
ret
mov dword [0x569328], 1
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x569334], eax
cmp eax, 0xffffffff
jne 0x42d716
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esp, ebp
pop ebp
ret
push 0x42d500
call fcn.004858a0
push 0x42d4c0
call fcn.004858a0
add esp, 8
jmp 0x42d6ec
Function at 0x42d730
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], esi
mov esi, 1
mov dword [ebp - 0x10], 0
push 1
push 0x569338
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d7bc
mov eax, 0x51eb851f
mov ecx, esi
imul esi
sar edx, 5
mov eax, esi
sar ecx, 0x1f
sub edx, ecx
imul edi, edx, 0x64
sub eax, edi
jne 0x42d7bc
cmp esi, 0x15f90
jl 0x42d7b3
cmp esi, 0x1d4c0
jge 0x42d790
mov eax, 0x32
jmp 0x42d7b5
cmp esi, 0x2bf20
jge 0x42d79f
mov eax, 0x64
jmp 0x42d7b5
mov eax, 0x1482
cmp esi, 0x57d78
jl 0x42d7b5
mov eax, 0xfa
jmp 0x42d7b5
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d7d0
inc esi
cmp esi, 0x57e40
jl 0x42d748
mov eax, dword [ebp - 4]
test eax, eax
je 0x42d7ea
mov dword [ebp - 0x14], 0x98
lea eax, [ebp - 0x14]
push eax
call fcn.00448f20
add esp, 4
mov eax, dword [0x56933c]
test eax, eax
jne 0x42d818
cmp dword [0x50fa40], 1
je 0x42d866
xor edi, edi
xor esi, esi
call fcn.0042d6e0
mov dword [0x56933c], 1
cmp dword [0x50fa40], 1
je 0x42d851
mov dword [0x569338], 0
push dword [0x569334]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
je 0x42d8a1
mov eax, dword [ebp + 8]
mov dword [eax], esi
cmp dword [0x50fa40], 1
je 0x42d884
xor eax, eax
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
push esi
push 2
call fcn.00484e80
push edi
push 0x16
call fcn.00484e80
add esp, 0x10
jmp 0x42d818
push 1
push 2
call fcn.00484e80
mov esi, eax
push 1
push 0x16
call fcn.00484e80
add esp, 0x10
mov edi, eax
jmp 0x42d800
push 1
push 2
call fcn.00484e80
push 1
push 0x16
mov dword [esi + 0x64], eax
call fcn.00484e80
add esp, 0x10
mov dword [esi + 0x68], eax
jmp 0x42d845
lea eax, [ebp - 0x10]
push eax
push 0
push 0x70
call fcn.004384e0
add esp, 0xc
test eax, eax
je 0x42d8c8
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov edx, 0x70
mov ecx, dword [edx + 0x50f99c]
mov dword [eax + edx - 4], ecx
mov esi, dword [edx + 0x50f998]
mov dword [eax + edx - 8], esi
mov edi, dword [edx + 0x50f994]
mov dword [eax + edx - 0xc], edi
mov ecx, dword [edx + 0x50f990]
mov dword [eax + edx - 0x10], ecx
sub edx, 0x10
jne 0x42d8d0
push dword [ebp - 0x10]
push dword [0x569334]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x10]
jmp 0x42d837
Function at 0x439120
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x439f50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp eax, 0xfffffffa
mov dword [ebp - 0x10], ebx
mov ebx, ecx
lea ecx, [eax + 5]
jg 0x439f65
mov ecx, eax
mov dword [ebp - 4], eax
mov eax, 0xfb93e673
mov dword [ebp - 8], esi
mov esi, edx
mul ecx
shr edx, 9
mov dword [ebp - 0xc], edi
imul edi, edx, 0x209
sub ecx, edi
mov edi, dword [0x50fa40]
cmp edi, 2
lea eax, [ecx + 0x69]
mov dword [esi], eax
jge 0x439fc1
lea ecx, [ecx*4 + 0x1a4]
lea edx, [ecx*8]
sub edx, ecx
mov ecx, dword [edx + 0x569bc4]
test ecx, ecx
jne 0x43a04a
mov dword [edx + 0x569bc4], 1
mov eax, dword [esi]
jmp 0x43a04a
lea eax, [ecx*4 + 0x1a4]
lea edx, [eax*8]
sub edx, eax
lea ecx, [edx + 0x569bc4]
push ecx
call fcn.0042d970
add esp, 4
test eax, eax
jne 0x43a042
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
cmp dword [edx + 0x569bc0], 0
je 0x43a0ba
mov dword [edx + 0x569bc4], 0
mov edx, dword [esi]
push 0xffffffffffffffff
lea eax, [edx*4]
shl edx, 5
sub edx, eax
push dword [edx + 0x569bc0]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esi]
lea eax, [edx*4]
shl edx, 5
sub edx, eax
lea ecx, [edx + 0x569bc4]
push ecx
call fcn.0042d970
add esp, 4
mov edi, dword [0x50fa40]
mov eax, dword [esi]
cmp edi, 1
je 0x43a09b
mov edx, dword [ebp + 0x14]
lea ecx, [eax*4]
shl eax, 5
sub eax, ecx
mov ecx, dword [eax + 0x569bd8]
xor eax, eax
mov dword [ebx], ecx
test ecx, ecx
je 0x43a093
mov esi, dword [ebp - 4]
cmp esi, dword [ecx + 0x100]
jbe 0x43a082
mov eax, ecx
mov ecx, dword [ecx + 0x28]
test ecx, ecx
mov dword [ebx], ecx
jne 0x43a06f
mov dword [edx], eax
xor eax, eax
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
jmp 0x43a084
lea edx, [eax*4]
shl eax, 5
sub eax, edx
lea eax, [eax + 0x569bd0]
push eax
call fcn.0042d920
add esp, 4
mov eax, dword [esi]
jmp 0x43a04f
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [esi]
lea edx, [ecx*4]
shl ecx, 5
sub ecx, edx
mov dword [ecx + 0x569bc0], eax
mov dword [ecx + 0x569bc4], 0
jmp 0x43a009
Function at 0x43c2a0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
Function at 0x448f20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
call fcn.00440a30
mov ebx, dword [ebp + 8]
cmp dword [0x573a40], 0
jne 0x448f47
test ebx, ebx
je 0x448f3c
mov eax, dword [ebx]
jmp 0x448f3e
xor eax, eax
push eax
call fcn.00483510
add esp, 4
test ebx, ebx
je 0x448f4f
mov eax, dword [ebx]
jmp 0x448f51
xor eax, eax
push eax
call fcn.004d1280
add esp, 4
jmp 0x448f34
Function at 0x4494f0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ebx
mov esi, dword [eax + 0x7c]
test esi, esi
mov dword [ebp - 0xc], edi
je 0x4496ac
mov edx, dword [0x50fa40]
mov edi, dword [esi + 0x14]
lea eax, [edi*4]
shl edi, 5
sub edi, eax
cmp edx, 2
lea ebx, [edi + 0x56e0e8]
jge 0x44953f
mov eax, dword [ebx]
test eax, eax
jne 0x449580
mov dword [edi + 0x56e0e8], 1
jmp 0x449580
push ebx
call fcn.0042d970
add esp, 4
test eax, eax
jne 0x44957a
cmp dword [edi + 0x56e0e4], 0
je 0x44968c
mov dword [edi + 0x56e0e8], 0
push 0xffffffffffffffff
push dword [edi + 0x56e0e4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebx
call fcn.0042d970
add esp, 4
mov edx, dword [0x50fa40]
cmp edx, 1
je 0x449678
mov eax, dword [esi + 0x18]
dec eax
mov dword [esi + 0x18], eax
test eax, eax
jle 0x4495ef
mov eax, dword [0x50fa40]
cmp eax, 1
je 0x4495d4
cmp eax, 2
jge 0x4495af
mov dword [edi + 0x56e0e8], 0
jmp 0x4495c5
mov dword [edi + 0x56e0e8], 0
push dword [edi + 0x56e0e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor eax, eax
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
push dword [edi + 0x56e0f8]
push dword [edi + 0x56e0f4]
call fcn.0042d950
add esp, 8
mov eax, dword [0x50fa40]
jmp 0x44959e
mov edx, dword [esi]
test edx, edx
je 0x4495fb
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov eax, dword [esi + 4]
test eax, eax
je 0x449606
mov dword [eax], edx
jmp 0x44960c
mov dword [edi + 0x56e0e0], edx
mov eax, dword [ebp + 8]
mov dword [eax + 0x7c], 0
mov eax, dword [0x50fa40]
cmp eax, 1
je 0x44965d
cmp eax, 2
jge 0x449631
mov dword [edi + 0x56e0e8], 0
jmp 0x449647
mov dword [edi + 0x56e0e8], 0
push dword [edi + 0x56e0e4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [esi + 8]
call fcn.004385a0
push esi
call fcn.004385a0
add esp, 8
jmp 0x4495c5
push dword [edi + 0x56e0f8]
push dword [edi + 0x56e0f4]
call fcn.0042d950
add esp, 8
mov eax, dword [0x50fa40]
jmp 0x449620
lea eax, [edi + 0x56e0f4]
push eax
call fcn.0042d920
add esp, 4
jmp 0x449589
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0x56e0e4], eax
mov dword [edi + 0x56e0e8], 0
jmp 0x449563
xor eax, eax
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x45c1f0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]

Function at 0x45c1fc
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], esi
mov esi, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ebx
mov ebx, edx
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ecx], 0
cmp dword [0x573a40], 0
je 0x45c2d1
cmp dword [ebp + 0x20], 2
je 0x45c233
cmp dword [ebp + 0x20], 1
jne 0x45c242
mov eax, 0xffffffff
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x18], 0
je 0x45c252
cmp dword [ebp + 0x20], 0xfffffffa
je 0x45c396
cmp dword [ebp + 0x20], 0
je 0x45c3a2
xor ecx, ecx
cmp dword [ebp + 0x18], 0
je 0x45c285
cmp dword [ebp + 0x1c], 0
je 0x45c285
push edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], edx
call fcn.004d1030
push edi
call fcn.004d11a0
mov edx, dword [ebp - 0x10]
add esp, 8
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x45c2d1
push edi
push esi
push ebx
call fcn.004d10d0
add esp, 0xc
mov esi, eax
mov eax, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [eax], esi
je 0x45c3c6
push 0
push edi
push 2
push 0x4ee3ac
call fcn.004d1090
add esp, 0x10
mov edx, dword [ebp + 0x14]
mov eax, 1
mov byte [esi + ebx], 0xa
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc dword [edx]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x10], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x24]
test ecx, ecx
mov edx, dword [ebp - 0x10]
mov dword [edi], 0
je 0x45c2f9
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x45c2fe
mov edi, 0x20000
cmp esi, edi
jbe 0x45c372
cmp dword [ebp + 0x20], 0
je 0x45c372
test ecx, ecx
je 0x45c316
mov edi, dword [ecx + 0x140]
test edi, edi
jne 0x45c31b
mov edi, 0x20000
mov dword [ebp - 0x10], edx
push 0
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x45c360
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
add ebx, edx
sub esi, edx
add dword [ecx], edx
cmp dword [ebp + 0x24], 0
je 0x45c355
mov edx, dword [ebp + 0x24]
mov edx, dword [edx + 0x140]
test edx, edx
jne 0x45c35a
mov edx, 0x20000
cmp esi, edx
ja 0x45c360
mov edi, esi
test esi, esi
je 0x45c389
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0x18]
jne 0x45c389
test eax, eax
jne 0x45c31e
jmp 0x45c389
push 0
lea ecx, [ebp - 0x18]
push ecx
push esi
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x18]
mov dword [ecx], edx
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edi, edx
mov ecx, 1
jmp 0x45c264
mov dword [ebp - 0x10], edx
call fcn.004d12c0
mov edx, dword [ebp - 0x10]
mov edi, eax
cmp dword [0x573a40], 0
je 0x45c289
mov ecx, 1
jmp 0x45c25e
xor eax, eax
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x49f880
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x510138]
jne 0x49f88a
repz ret
jmp fcn.004b1ef0
Function at 0x4d1240
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 0xc], 0
mov dword [ebp + 8], 0x28f
mov esp, ebp
pop ebp
jmp fcn.00423530
Function at 0x155cb00
Capabilities:
Encode data using xor

Disassembly:
lahf
mov byte [edi - 1], 0
pushfd
cwde
lahf
lea esp, [esp + 4]
jne 0x15829d1
push ebx
jmp 0x157ec1a
lea esp, [esp + 0x2c]
ja 0x180d9eb
pushfd
lea esp, [esp + 4]
ja 0x15590bb
push 0x68b29993
rcl al, 3
rcr al, 1
sub ebx, edi
cmp ch, 0x7b
movsx di, al
xor al, 0x6b
add esp, 4
add ebx, esp
test edx, edi
clc
mov edi, ebx
bt cx, bx
mov al, 0x2e
jmp 0x15601f7
repne scasb al, byte es:[edi]
pushal
lea esp, [esp + 0x20]
jne 0x155e4b6
lea eax, [esi*4 - 0x456ff996]
lahf
jmp 0x155c587
movsx eax, cl
cwde
bswap ax
bswap eax
lea eax, [0x15656a3]
push eax
mov dword [esp], 0x155cf17
pushal
call fcn.015827f2
cmp ebp, 0xdd9a4e66
test eax, 0x5a0df6b5
rol dword [edx + 0x35412f1e], 2
lodsb al, byte [esi]
lcall 0x8c4e, 0xc21a11c2
test ecx, ebp
fidiv word [eax]
mov eax, dword [0xcb03ae5]
push ds
sbb dl, ah
sub dword [ebx - 0xe1f17ab], ebx
stosd dword es:[edi], eax
xor ah, byte [ebp - 0x3dac5428]
and dword [esi + 0x20], edi
add byte [esi], 0xb2
mov word [eax + 0x5cb36ade], es
loope 0x157ec1f
mov al, 0x39
add al, 0x58
push ss
xchg esi, eax
push edx
out 0x95, eax
push esp
out dx, eax
mov eax, dword [0x8c32d8af]
mov dl, 0xfc
xor al, byte [edi]
pop ebx
pop ebx
mov byte [0x492502ee], al
insb byte es:[edi], dx
push ebx
jne 0x157ecba
and eax, 0xec031bd8
sub bl, byte [edx]
xchg esi, eax
daa
jmp [ebx]
retf
sub edx, ebx
xchg esp, eax
sti
cmpsd dword [esi], dword es:[edi]
cmp cl, bl
pop edx
mov ah, 0xb4
into
cmc
dec esp
scasb al, byte es:[edi]
inc ebp
loopne 0x157ecb4
inc esp
invalid
and dword [ecx - 0x5aec0daa], ebx
cmc
cdq
fimul dword [edx]
das
push 0x42
idiv edi
cwde
push ebx
mov al, 0x76
push eax
movsx eax, cl
lea eax, [0x15656a3]
call fcn.01580293
jno 0x15829b9
add al, 0xc4
pop ebp
invalid

Function at 0x28330fb
Capabilities:
Encode data using xor

Disassembly:
lcall 0xed1b, 0x6a81e7f3
invalid
cmpsb byte [esi], byte es:[edi]
mov byte [0xe96f8835], al
xchg byte [edx], cl
xor al, bh
pop ecx
or byte [edi + 0x68], 0x77
mov dl, 0xfc
out dx, al
push 0xeefcb277
mov dword [esp + 0x20], 0x155d078
call fcn.02832585
pushfd
lodsb al, byte [esi]
shl ecx, cl
mov esi, 0x5266a9df
xchg ecx, eax
push cs
mov al, 0x2d
push esi
div dword [eax - 0x1f4e3f7c]
test byte [ecx - 0x41], bl
inc esp
ja 0x155c80f
loop 0x155c7f8
push ss
int 0xf4
adc al, 0x34
ljmp 0x1e3c
stc
cmc
sub edi, 4
test bl, 0x18
push dword [edi]
pop dword [esp]
stc
cmp edi, ebx
pushal
mov word [esp + 8], 0x339f
mov word [esp + 4], bx
lea esp, [esp + 0x20]
ja 0x15590bb
setg al
stc
bt ax, 3
sub ebx, edi
bsf di, di
clc
rcl al, 1
add ebx, esp
btc di, sp
mov edi, ebx
sbb al, dl
bt si, bx
sar al, cl
cmp bh, 0xe3
mov al, 0x2e
call int.01563fda
lea eax, [0x15656a3]
jmp 0x155c81c
Function at 0x44d9ee
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44da3a
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44da1f
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44da2f
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44da4a
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44da89
test ebx, ebx
je 0x44da5e
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44da53
cmp ecx, 0xfff1
jb 0x44da6c
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44db74
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44daae
Function at 0x4981de
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x49822a
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x49820f
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x49821f
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x49823a
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x498279
test ebx, ebx
je 0x49824e
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x498243
cmp ecx, 0xfff1
jb 0x49825c
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x498364
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x49829e
Function at 0x4e2a3e
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2a8a
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2a6f
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2a7f
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2a9a
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2ad9
test ebx, ebx
je 0x4e2aae
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e2aa3
cmp ecx, 0xfff1
jb 0x4e2abc
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e2bc4
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2afe
Function at 0x6268be
Capabilities:
Encode data using xor

Disassembly:
adc al, 0xc0
push esi
inc ebp
jl 0x626878
cmp al, 0x60
dec esp
add byte [esi], bh
in eax, 0x88
int1
dec eax
and dword [esi - 0x29], edi
nop
ret 0xf095
in eax, 0xb0
vpshuflw ymm6, ymmword [ebx + 0x52], 0x10
mov al, byte [ecx]
lcall 0x638d, 0x58d615cf
pop esi
mov dl, 0xa6
sbb ecx, dword fs:[esi]
jae 0x62681f
mov al, 0x97
mov edi, 0xb6e2e3c3
sub eax, dword [esi - 0x44]
inc eax
fsub qword [eax - 0x5ada85ec]
mov edi, dword [edi + 4]
mov dl, 0x15
xchg esp, eax
inc esi
popal
cmc
int3
invalid
or dword [ebp + 0x3951d46f], edx
cwde
xor ch, byte [ebx + 0x3c]
xchg esi, eax
and dword [eax], edx
pop ds
adc byte [ebx], bl
shr byte [ecx - 0x2b91ab13], 0xa3
xor al, 0xe8
out 0x7c, eax
jl 0x6268e8
push eax
add al, 0x60
jl 0x6268e8
push eax
add al, 0x60
and eax, 0xf460ed70
in eax, 0x98
js 0x6268a2
in al, dx
jb 0x62685d
adc ebx, dword [eax + 0x1c]
dec eax
sub al, 0x84
add dl, byte [edi]
jb 0x62689e
jle 0x6268f6
fcompi st(6)
pushal
sub ecx, dword [eax + 6]
mov ecx, 0x44244f32
mov eax, 0x500a8469
out 0x64, eax
dec esi
or esi, esi
inc esi
add dword [esi - 0x60], 0x1adb10a3
imul eax, dword [edx + ecx + 0x4e64e750], 0x8146f60b
inc esi
mov al, byte [0x1adb10a3]
adc bl, bl
sbb dl, byte [ecx + 0x2884132b]
xchg ecx, eax
sub edx, dword [ebx]
test byte [eax], ch
stosd dword es:[edi], eax
div cl
mov esi, dword [ecx + 0x6ff4cbf2]
jne 0x62691f
aam 0xee
pop edi
cli
inc esp
sub dl, byte [esi + 0x67]
leave
ror byte [ebx - 6], 0xee
hlt
pushfd

Function at 0x658efc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x663490
cmp edx, dword [eax]
je 0x658f1e
add eax, 8
inc ecx
cmp eax, 0x663520
jl 0x658f0f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x663490]
jne 0x65904c
mov eax, dword [0xa66d00]
cmp eax, 1
je 0x659026
test eax, eax
jne 0x658f4f
cmp dword [0x6612d4], 1
je 0x659026
cmp edx, 0xfc
je 0x65904c
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x658f86
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0065a060
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a150
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x658fc9
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a150
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dc7c
push edi
call fcn.0065ab10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0065a060
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a070
lea eax, [ebp - 0xa0]
push 0x65dc5c
push eax
call fcn.0065a070
push dword [esi + 0x663494]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a070
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065aa82
add esp, 0x2c
pop edi
jmp 0x65904c
lea eax, [ebp + 8]
lea esi, [esi + 0x663494]
push 0
push eax
push dword [esi]
call fcn.0065a150
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret