joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446104
Capabilities:
Encode data using xor

Disassembly:
sbb ah, byte [ebx]
pushal
adc edi, dword [esi]
inc esi
pop edx
insb byte es:[edi], dx
or dl, bl
xor byte [ebp + 0x4f], bl
mov al, byte [0x3baa45df]
pop es
inc eax
test byte [ebx - 0x14a9aa8a], ch
adc eax, 0xe8664896
push 0x3b
call fcn.00449c8f
fstp xword [esi - 0x798448b2]
sub al, byte [ecx]
loop 0x446189
mov esi, 0xe9e5accd
xchg dword [edx + 0x2df57342], ecx
pop ss
push es
test eax, 0x5abb7154
test dword [edi - 0x1d], ecx
test eax, 0xf220e001
xor al, byte [0x2ceb170c]
sal ebp, 0x79
sbb al, byte [edi - 0x744b44a7]
stosd dword es:[edi], eax
out dx, eax
lcall 0xfaeb, 0xa1808a1b
inc esp
fcmovnbe st(0), st(0)
adc dword [ecx], esp
push ds
not dword [edx]
pop edx
pushfd
jnp 0x446121
dec esp
mov esp, 0x78e14c8a
jne 0x4461d1
dec esp
dec ecx
cmpsd dword [esi], dword es:[edi]
xchg ebx, eax
stc
leave
mov ah, 0xe9
frstor dword [edx - 0x659b5fb9]
mov byte [eax], bl
lea ecx, [esi + 0x23]
cld
and edi, esp
dec esp
ret
out 0x53, eax
sar esi, 0xda
push ds
cwde
mov dword cs:[eax], 0x3cf132fb
mov edi, 0x73ba73bb
fadd dword [ebx]
mov edx, 0x1a84fa66
mov ebx, 0x4e08b30e
outsb dx, byte [esi]
fcomp dword [ebx + 0x56]
stosb byte es:[edi], al
sbb eax, 0x991a0202
inc esi
stc
leave
jle 0x446268
or byte [ebp + 0x73], dh
imul esp, dword [ebx - 0x1e], 0xffffffba
mov al, byte [0x293bba33]
lcall 0x8766, 0x263e67c1
pop esi
inc eax
sbb ecx, edi
fsubp st(0)
mov bl, byte [edx - 0x7cda8370]
scasd eax, dword es:[edi]
xchg ebp, eax
xor cl, cl
stosb byte es:[edi], al
xor ebx, 2
lodsb al, byte [esi]
add dh, ch
push ebx
sub al, 0x7e
lds ebx, [edx + 0x52]
mov ch, 0x94
popfd
pop ds
sub dword [esi + 0x5c], ebp
test dword [ebx + 0x7b], 0xc2b29cd2
cwde
mov bh, 0xf1
cmpsd dword [esi], dword es:[edi]
sub dword [eax - 0x54c60a03], 0x21
lcall 0x6503, 0xa460eadd
int3
jecxz 0x4462b3
add byte [edx], ch
invalid
mov eax, dword [ebp + 8]
mov dword [ebx], edx
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
mov eax, dword [ebp + 0xc]
mov dword [eax], 5
jmp 0x44628f
inc ebp
cld
jb 0x4462e3
mov ebx, eax
cmp bx, word [ebp - 8]
ja 0x4462e0
imul ecx, edi, 0xa
add esi, 2
movzx edi, bx
add edi, 0xffffffd0
add edi, ecx
cmp edi, 0xffff
jg 0x446296
movzx eax, word [esi]
mov ebx, eax
cmp ax, word [ebp - 4]
jae 0x4462b9
mov ebx, dword [ebp - 0xc]
cmp edi, edx
jge 0x446288
mov eax, dword [ebp + 0xc]
mov dword [eax], 4
int3

Function at 0x487525
Capabilities:
Encode data using xor

Disassembly:
cli
sar eax, cl
push edi
adc eax, 0xeda7a44d
adc edx, ecx
scasd eax, dword es:[edi]
pop ss
cwde
invalid
Function at 0x4948a4
Capabilities:
Encode data using xor

Disassembly:
movsd dword es:[edi], dword [esi]
sbb eax, 0x510353bf
xor eax, ebp
das
or al, byte [edi - 0x5305399]
test byte [eax - 0x69216acc], ah
xchg edi, eax
in al, dx
dec edi
mov dword [0x96b206d6], eax
and al, 0x4c
cmp al, 0xa6
mov eax, 0x819ecb17
push ss
out dx, eax
fcom st(2)
push edi
xchg esi, eax
cmp byte [edx - 0x7821400f], 0x9e
push edi
imul eax
mov byte [0xc75fb6fd], al
sahf
salc
adc dl, byte [edi]
inc edi
wait
invalid
rol esi, 0x1b
mul dword [edi]
out 0x45, eax
test byte [ebp + 0x2e2b0096], bh
arpl word [edi - 0x7c], ax
stosd dword es:[edi], eax
popal
jb 0x49490c
dec edx
adc dword [eax], ecx
sub byte [edi], 0xf6
add dword [edi + 0x2bbafc8f], ecx
mov al, byte [0xbaceab33]
and eax, 0x461f8a07
jbe 0x494857
xchg dword [ecx], ecx
sub bl, byte [edi]
or dword [edx], ebp
pop ds
pop ebx
dec ebp
pop eax
pop ss
fstp xword [eax - 0x79]
arpl word [ecx - 0x21], cx
cmpsd dword [esi], dword es:[edi]
aam 0x25
pop es
fsubr qword [edx - 0x2a595471]
pop ebx
cmpsd dword [esi], dword es:[edi]
or dword [esi + 0x577b59bf], ecx
xchg edi, ecx
sub al, 4
out dx, eax
pop esi
jnp 0x4948cf
xlatb
cmp dh, cl
movsb byte es:[edi], byte [esi]
out 0xd1, eax
imul edi, edi
imul ecx
call 0xa244dcbf
xor dword [eax + 0x9f527b9], esp
loope 0x4948f7
cmc
or ecx, esp
out 0x5e, eax
pop esi
xor eax, 0x22c148f
aas
jnp 0x494978
adc al, 0x87
inc ecx
jmp esp
retf 0x6feb

Function at 0x4ab734
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566aa0
mov eax, dword fs:[0]
add byte [eax], al
push eax
sub esp, 0x28
mov eax, dword [0x5c81a4]
xor eax, ebp
push eax
jo 0x4ab742
invalid
Function at 0x4afb26
Capabilities:
Check for software breakpoints

Disassembly:
push esp
clc
arpl word [edx + edi*4 + 0xb], di
popfd
nop
lcall 0x9d1, 0xfecc1a46
xor eax, 0xc699b768
mov dl, byte [ebx - 0x8f99264]
mov bl, 0x85
loop 0x4afb24
cwde
bound ebx, qword [ebx + 0x21]
sbb ah, dh
jge 0x4afba7
pop esp
push eax
pop ss
pop ebp
jb 0x4afb4a
pop esp
int3
and edx, ebp
retf
jge 0x4afb89
sub dh, byte [ecx]
invalid
je 0x4afc19
dec edx
xor eax, 0xafb33a12
popal
sbb byte [ecx + 0x51127c7e], dl
push ecx
inc edi
imul edx, dword [ebp + 0x3db4671a], 0xffffffb4
xor dword [ecx + 2], edi
cdq
sbb byte [ebp - 0x11e64dc8], ah
jno 0x4afc04
push es
jbe 0x4afbcc
call [ebp*4 + 0x3c1550dd]
int3
sbb al, 0xad
fst qword [eax + 0x15]
cmp al, 0xcc
pushfd
in eax, 0x81
je 0x4afc12
wait
in eax, 0xf1
jne 0x4afb82
push ecx
jge 0x4afb89
and eax, 0x78ecd2ba
mov al, byte [0xa13c0cc8]
mov word [eax - 4], ds
push ecx
jno 0x4afbd4
int3
and eax, 0x11a4c0a8
sti
test al, 0xc0
movsb byte es:[edi], byte [esi]
adc ebx, edi
lahf
jns 0x4afbb5
popal
in eax, 0xb7
push ecx
mov ecx, 0x6631b1e8
and dword [ebp + 0x50], ebx
mov cl, 0x31
and word [ebp + 0x50], bx
insb byte es:[edi], dx
add esp, edi
xchg esi, eax
mov al, 0x8c
popal
jns 0x4afc03
adc dword [ecx + eax*8 + 0x7c], ebp
lodsb al, byte [esi]
fst dword [bx + di + 0x27]
xchg esi, eax
jno 0x4afc3f
mov cl, 0xbf
pop esp
pop edx
push 0xffffffffffffffbf
mov esp, 0xf135a221
mov esp, 0x1121fbb1
mov edi, 0xf25151df
pop es
fist word [ecx + 0x51]
pop es
dec esp
fbstp tbyte [edi + edi*2 + 0x669c5be1]
add byte [ebp + 0x1220b1a6], cl
mov ebp, 0x59ff5d8d
lea ebx, [ebp - 1]
pop ecx
lodsd eax, dword [esi]
adc dword [ecx - 0x48], 0x5ad3fcef
sub dl, byte [edx - 0x7c368393]
xchg dword [edx + ecx*2 - 0xb], ebx
in al, dx
stosd dword es:[edi], eax
or eax, 0xee41fc81
push ecx
xchg ebp, eax
inc edx
fild word [edi + 0x3c]
mov eax, dword [0xc315716c]
pop ds
mov ebx, 0x720dfa19
pushal
mov cl, 0x4c
or eax, 0x4cb16072
dec esp
add byte [esi - 0x176bf5d4], ch
jl 0x4afcaf
pop edi
jl 0x4afcbd
dec edi
jns 0x4afc7f
stosb byte es:[edi], al
cwde
rcl dword [ecx], 0xe1
sbb esi, esi
adc dword [ebp + 0x12df8236], ecx
nop
jl 0x4afc53
mov byte [0x332451db], al
je 0x4afd16
adc byte [ebp - 0x34], cl
mov eax, 0x81118c4f
sbb dword [esi + edi*4 + 0x41], ecx
mov al, byte [0xc1f01f90]
jnp 0x4afc93
dec edi
mov word [ecx], ss
sbb dword [ecx], 0xa041be4c
nop
pop ds
invalid
aad 0xa2
fsubr qword [ecx]
adc dword [esi + 2], esp
xchg ebx, eax
xchg edx, eax
test eax, 0xfc31e99d
mov byte [0x661129dc], al
add dl, byte [ebx - 0x1662566e]
xor esp, edi
in eax, 0xb
add al, 0x25
or bh, cl
insb byte es:[edi], dx
xchg edx, eax
cmp al, 0x4b
cmp eax, 0x2194ccf1
int1
lodsb al, byte ss:[esi]
std
movsd dword es:[edi], dword [esi]
les ebp, [ebp + edi*8 + 0x5f]
invalid
insb byte es:[edi], dx
cmp al, 0xce
dec esi
call 0x1599e34
pop eax
hlt
Function at 0x4ba630
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ba67b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x4c8aac]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push str.TImage2202
push str.TBitmap2202
call fcn.00417e10
mov dword [ebp - 0xc], eax
jmp fcn.0074f3d9

Function at 0x4bbb81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c5368
cmp edx, dword [eax]
je 0x4bbba3
add eax, 8
inc ecx
cmp eax, 0x4c53f8
jl 0x4bbb94
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c5368]
jne 0x4bbcd1
mov eax, dword [0x4c9cec]
cmp eax, 1
je 0x4bbcab
test eax, eax
jne 0x4bbbd4
cmp dword [0x4c5294], 1
je 0x4bbcab
cmp edx, 0xfc
je 0x4bbcd1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bbc0b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bc560
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc9f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bbc4e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc9f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c0cbc
push edi
call fcn.004be8c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bc560
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bc570
lea eax, [ebp - 0xa0]
push 0x4c0c9c
push eax
call fcn.004bc570
push dword [esi + 0x4c536c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bc570
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be834
add esp, 0x2c
pop edi
jmp 0x4bbcd1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c536c]
push 0
push eax
push dword [esi]
call fcn.004bc9f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10007920
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push ebx
push esi
push eax
push 0x20119
push 0
push str.SOFTWAREAMDFuel
push 0x80000002
mov ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1000798b
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push 0
push str.ServiceStatus
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007986
cmp dword [ebp - 0xc], 4
jne 0x10007986
push dword [ebp - 4]
call esi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call esi
lea eax, [ebp - 4]
push eax
push 0x20219
push 0
push str.SOFTWAREAMDFuel
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100079e6
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push 0
push str.ServiceStatus
push dword [ebp - 4]
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100079e1
cmp dword [ebp - 8], 4
jne 0x100079e1
push dword [ebp - 4]
call esi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 4]
call esi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100079f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x10007ab7
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push str.SOFTWAREAMDFuel
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007a4d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.PerUserPath
push dword [ebp - 0x10]
mov dword [ebp - 0xc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10007a4d
cmp dword [ebp - 0x14], 1
je 0x10007aae
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x1001041c
mov dword [ebp - 8], 0
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x10007abd
push dword [ebp - 8]
push 0x104
push dword [ebp - 4]
call dword [sym.imp.MSVCR110.dll_wcscpy_s]
push 0x10010498
push 0x104
push dword [ebp - 4]
call dword [sym.imp.MSVCR110.dll_wcscat_s]
push str.AMDFuel_
push 0x104
push dword [ebp - 4]
call dword [sym.imp.MSVCR110.dll_wcscat_s]
add esp, 0x24
push dword [ebp - 8]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x14], str.Could_not_retrieve_the_Program_Data_directory_for_Profiles
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x1001254c
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], vtable.std::runtime_error.0
call sub.MSVCR110.dll__CxxThrowException
int3
Function at 0x5768b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x4ab00d
lea edi, [esi - 0xaa00d]
lea eax, [edi + 0x103724]
push dword [eax]
mov dword [eax], 0xe4dedce7
push eax
push edi
jmp 0x5768da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5768e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5768d0
mov eax, 1
add ebx, ebx
jne 0x5768f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x576904
jne 0x576923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x576923
dec eax
add ebx, ebx
jne 0x576910
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5768e8
add ebx, ebx
jne 0x57691f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x576975
xor ecx, ecx
sub eax, 3
jb 0x57693b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5769aa
sar eax, 1
mov ebp, eax
jmp 0x576946
add ebx, ebx
jne 0x576946
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x576914
inc ecx
add ebx, ebx
jne 0x576954
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x576914
add ebx, ebx
jne 0x576961
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x576956
jne 0x576972
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x576956
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x576994
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x576986
jmp 0x5768d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x576994
add edi, ecx
jmp 0x5768d6
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0x509f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5769b6
cmp byte [edi], 0x1a
jne 0x5769b6
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5769bb
lea edi, [esi + 0x16e000]
mov eax, dword [edi]
or eax, eax
je 0x576a2a
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x177dbc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x177e90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5769e8
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x177e98]
or eax, eax
je 0x576a24
mov dword [ebx], eax
add ebx, 4
jmp 0x576a05
call dword [esi + 0x177e94]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x576a5b
cmp al, 0xef
ja 0x576a4e
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x576a30
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x576a3d
mov ebp, dword [esi + 0x177e9c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x197]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x576a8f
sub esp, 0xffffff80
jmp 0x49fbd6
Function at 0x4094c0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x4094e2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 3
jb 0x4094d0
mov byte [esi + 4], 0
mov eax, esi
pop esi
ret

Function at 0x4094f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 6], 0
je 0x409512
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 5
jb 0x409500
mov byte [esi + 6], 0
mov eax, esi
pop esi
ret
Function at 0x40a420
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 3], 0
je 0x40a442
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 2
jb 0x40a430
mov byte [esi + 3], 0
mov eax, esi
pop esi
ret

Function at 0x40a450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movaps xmm0, xmmword [0x525dc0]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
movups xmmword [ebp - 0x31], xmm0
mov dword [ebp - 0x21], 0x5b544a58
mov dword [ebp - 0x1d], 0x5052554f
mov word [ebp - 0x19], 0x100
nop word [eax + eax]
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x31], al
inc ecx
cmp ecx, 0x18
jb 0x40a480
mov byte [ebp - 0x18], 0
xor ecx, ecx
mov dword [ebp - 0x17], 0x464d5c49
mov dword [ebp - 0x13], 0x42490247
mov word [ebp - 0xf], 0x43
mov byte [ebp - 0xd], 1
nop dword [eax + eax]
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x17], al
inc ecx
cmp ecx, 9
jb 0x40a4b0
push ebx
push esi
push edi
lea eax, [ebp - 0x17]
mov byte [ebp - 0xd], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [ebp - 0x31]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
xor edi, edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 4], eax
test eax, eax
je 0x40a56b
mov esi, dword [0x53449c]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call ebx
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
jne 0x40a54c
mov ebx, dword [ebp - 4]
push edi
push 0
push ebx
call eax
add esi, esi
cmp esi, 0x10000000
ja 0x40a561
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push esi
mov edi, eax
push edi
push 0x40
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp ebx, 0xc0000004
je 0x40a515
test ebx, ebx
jns 0x40a571
push edi
push 0
push dword [ebp - 4]
call eax
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov eax, dword [0x53449c]
cmp esi, 0x200000
cmovbe eax, esi
mov dword [0x53449c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edi
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a5a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xa], 0
je 0x40a5c2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 9
jb 0x40a5b0
mov byte [esi + 0xa], 0
mov eax, esi
pop esi
ret

Function at 0x40a5d0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x19], 0
je 0x40a5f2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 0x18
jb 0x40a5e0
mov byte [esi + 0x19], 0
mov eax, esi
pop esi
ret
Function at 0x40a710
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0xe], 0
je 0x40a732
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 0xd
jb 0x40a720
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret

Function at 0x40a740
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x16], 0
je 0x40a762
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 0x15
jb 0x40a750
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret
Function at 0x40ab70
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 0x12], 0
je 0x40ab92
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 0x11
jb 0x40ab80
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret
Function at 0x40b880
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 5], 0
je 0x40b8a2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 4
jb 0x40b890
mov byte [esi + 5], 0
mov eax, esi
pop esi
ret

Function at 0x40b8b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
je 0x40b8d2
xor eax, eax
nop dword [eax + eax]
lea edx, [eax + esi]
lea ecx, [eax + 0x27]
inc eax
xor byte [edx], cl
cmp eax, 7
jb 0x40b8c0
mov byte [esi + 8], 0
mov eax, esi
pop esi
ret

Function at 0x40b8e0
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503606
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov dword [ebp - 0x18], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1004a55
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40b944
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push edi
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2f00
mov edi, eax
add esp, 8
test edi, edi
je 0x40b9dd
push 2
push 0
push edi
call fcn.004e6cd6
push edi
call fcn.004e2a8b
push 0
push 0
push edi
mov dword [ebp - 0x14], eax
call fcn.004e6cd6
mov ecx, dword [esi + 0x10]
add esp, 0x1c
mov eax, dword [ebp - 0x14]
cmp eax, ecx
ja 0x40b9b1
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b9a8
mov ecx, dword [esi]
mov dword [esi + 0x10], eax
mov byte [ecx + eax], 0
jmp 0x40b9c0
sub eax, ecx
mov ecx, esi
push 0
push eax
call fcn.004686d0
mov eax, dword [ebp - 0x14]
cmp dword [esi + 0x14], 0x10
mov ecx, esi
jb 0x40b9ca
mov ecx, dword [esi]
push edi
push eax
push 1
push ecx
call fcn.004eb77f
push edi
call fcn.004e6788
add esp, 0x14
mov ecx, dword [ebp + 0x1c]
pop edi
cmp ecx, 0x10
jb 0x40ba0e
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40ba04
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40ba1f
push ecx
push edx
call fcn.004dd0b2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e2350
int3
Function at 0x40ba30
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x503646
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 1
call fcn.00469df0
mov dword [ebp - 0x14], 1
xor ecx, ecx
mov dword [ebp - 0x10], 0x1004a55
lea eax, [ecx + 0x27]
xor byte [ebp + ecx - 0x10], al
inc ecx
cmp ecx, 2
jb 0x40ba74
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x10]
push ebx
lea eax, [ebp + 8]
mov byte [ebp - 0xd], 0
cmovae eax, dword [ebp + 8]
push ecx
push eax
call fcn.004e2f00
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40bb0a
push edi
push 2
push 0
push ebx
call fcn.004e6cd6
push ebx
call fcn.004e2a8b
push 0
push 0
push ebx
mov edi, eax
call fcn.004e6cd6
mov ecx, dword [esi]
add esp, 0x1c
mov edx, dword [ecx + 0x10]
lea eax, [ecx + 0x10]
cmp edi, edx
ja 0x40bae0
cmp dword [ecx + 0x14], 0x10
jb 0x40bad8
mov ecx, dword [ecx]
mov dword [eax], edi
mov byte [ecx + edi], 0
jmp 0x40baec
mov eax, edi
push 0
sub eax, edx
push eax
call fcn.004686d0
mov eax, dword [esi]
cmp dword [eax + 0x14], 0x10
jb 0x40baf6
mov eax, dword [eax]
push ebx
push edi
push 1
push eax
call fcn.004eb77f
push ebx
call fcn.004e6788
add esp, 0x14
pop edi
mov ecx, dword [ebp + 0x1c]
pop ebx
cmp ecx, 0x10
jb 0x40bb3b
mov edx, dword [ebp + 8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40bb31
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40bb4c
push ecx
push edx
call fcn.004dd0b2
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.004e2350
int3