joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44619f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558a28
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x446220
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558a28
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x552703
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4462c6
cmp edi, dword [esi + 0x7c]
jge 0x4462c6
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045ab6a
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045ab6a
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558a28
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558a28
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446218
jmp 0x4461e8
call fcn.0045ed91
int3

Function at 0x45aa53
Capabilities:
Authenticate hmac

Disassembly:
jp 0x45a9e6
mov ch, 0x52
inc eax
dec esi
adc ah, byte [edx]
jp 0x45a9f4
push esi
fcmovnbe st(0), st(7)
sbb edx, ebx
jno fcn.0045aa53
inc edx
jae 0x45a9f0
inc ebp
or byte [edx], al
xchg ebp, eax
sbb eax, 0x3c63e09
cwde
mov word [edx + 0x56], ss
ror cl, cl
mov esp, 0x62e7f212
sti
mov ecx, 0xbffdadfa
sar byte [ebp + 0x41807ae1], 1
sub byte [edi + 0x2b97d49], ah
mov dh, 0xd3
fnsave dword [edx + 0x7e6a1dc2]
jno 0x45aaf8
imul esp, dword [ebx + 0x530a6118], 0xfdccda2c
fcomp qword [ecx - 0x59f8f53d]
adc al, 0x79
hlt
mov dword [0x530a6118], eax
sub al, 0xda
int3
xchg ecx, eax
popal
stosb byte es:[edi], al
xchg edx, eax
jge 0x45aa8e
je 0x45aaff
les eax, [ebp - 0x25d01d06]
std
mov dh, 0x55
xchg dword [esi + 0x63c77940], esi
jl 0x45ab56
push cs
mov edx, 0x553027c3
enter 0xfffffffffffff9b2, 0x54
push eax
xchg edx, eax
dec ebp
in al, dx
insb byte es:[edi], dx
mov byte [0x230b9a55], al
fiadd dword [ecx]
loope 0x45ab9a
ror dword [esp + ebp*4 + 0x759d24c4], 1
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
mov esp, 0x8138e22a
mov cl, 0xed

Function at 0x45bec5
Capabilities:
Encode data using xor

Disassembly:
pop es
out dx, eax
pop ds
and eax, dword [ebx - 0x6a45d77c]
pop eax
cmpsw word [esi], word es:[edi]
mov byte [0x131d115e], al
in eax, dx
arpl sp, di
or ebx, dword [esp + esi*2 + 0x3c8edf96]
invalid
Function at 0x45cdb8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x45cddf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x38
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x56f688
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45ce80
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56f688
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x569363
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45cf26
cmp edi, dword [esi + 0x7c]
jge 0x45cf26
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004717ca
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004717ca
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f688
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f688
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45ce78
jmp 0x45ce48
call fcn.004759f1
int3
Function at 0x464ac4
Capabilities:
Encode data using xor

Disassembly:
pop ss
xchg esp, eax
in al, 0x3c
mov al, 0x44
dec ecx
dec ebx
imul ah
push edx
pop edi
dec edi
xchg esp, eax
lodsb al, byte [esi]
xchg esp, eax
push 0x7af400ea
xchg dword [ebx - 0x18382b3f], esp
push eax
cli
pop es
xor eax, 0x65253583
cld
test ecx, esp
xor dword [0x85fc6525], 0xffffffe1
inc eax
xor al, 0x66
xor eax, 0x9c1af072
fdiv qword [edi]
dec esp
loope 0x464ae4
bound ebx, qword [esp + ecx*4 + 0x3c]
and cl, byte [esi]
cli
mov eax, dword [0x87a017f8]
jns 0x464b6b
mov ah, 0x18
shr dword [eax + 0x563854d6], cl
mov dl, 0xcc
rol dword [ecx + eax*2 - 0x543b971c], cl
mov ah, 0x1a
cmp esp, dword [esi + 0xfb635b0]
xchg byte [ebx + 0x76244ec2], dl
inc ebx
push esp
mov eax, dword [0xf755c625]
pop eax
ret
stosb byte es:[edi], al
or byte [edx + esi*2 + 0x72], 0x9b
sti
or dword [edi], edx
push 0xea71a6d1
lds esp, [edx + 0x22d5b094]
cmc
xchg edi, eax
out 0x33, eax
out dx, eax
push esi
sub byte [ebx], dl
inc eax
shl dword [ebp + esi + 0x57], 0x19
inc ebx
mov ch, 0x30
pop ebx
xchg byte [edx + 0x2a2d6cc8], dh
mov al, 0x7e
xchg edi, eax
adc esp, dword [ebp - 0x1a]
out 0x4c, eax
invalid
Function at 0x473db8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586688
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473e80
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586688
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x580363
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473f26
cmp edi, dword [esi + 0x7c]
jge 0x473f26
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004887ca
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004887ca
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586688
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586688
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473e78
jmp 0x473e48
call fcn.0048c9f1
int3
Function at 0x48b178
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059da48
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b240
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059da48
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00597723
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b2e6
cmp edi, dword [esi + 0x7c]
jge 0x48b2e6
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0049fb8a
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0049fb8a
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da48
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059da48
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b238
jmp 0x48b208
call fcn.004a3db1
int3
Function at 0x493b84
Capabilities:
Encode data using xor

Disassembly:
stc
loopne 0x493bc6
xor edi, dword [edi]
sub edx, dword [ebx + ebp*2 - 0x56]
mov al, 0x1c
mov fs, word [ebp + 0x49]
stc
add esi, dword [ebx + 0x2c]
jge 0x493b7b
mov cl, 0xe4
sub al, 0x37
mov ebx, 0xf9bd855e
invalid
push ebx
xor al, 0x65
push edx
xchg esp, eax
in eax, dx
push ecx
inc esi
add byte [edi + 0x66c26254], ah
movsb byte es:[edi], byte [esi]
pop ss
leave
cdq
xlatb
aaa
xor bh, 0xc5
xchg byte [edx - 0xccbcb4e], bh
xor al, 0xf3
enter 0xffffffffffffe1e6, 0xffffffffffffffab
scasb al, byte es:[edi]
sub dword [ebp + 0x4f], esi
js 0x493be1
cmpsd dword [esi], dword es:[edi]
or al, 0x37
out 0x6b, al
sbb dword [esi], esp
out 0x36, al
fidiv word [eax]
jne 0x493c63
insb byte es:[edi], dx
add edi, dword [eax + 0x27]
das
add dword [esi - 0x56193289], 0x4f
test dword [esp + ecx*8 - 0x78180759], ecx
dec eax
into
outsb dx, byte [esi]
fmul qword gs:[ecx]
sti
cld
add eax, 0x8c6fe46b
inc esp
and ah, cl
mov byte [0x14e3f0e7], al
stosb byte es:[edi], al
sbb al, 0x9b
jno 0x493c8e
outsb dx, byte [esi]
std
cmp al, 0x68
push es
sal dword gs:[esi - 0x1c], 0x74
outsd dx, dword [esi]
cmp dl, cl
push es
xor byte [esi + 0x34], 0xbc
test dword [ebp + esi*2 + 0x3936ef0a], esp
add byte fs:[eax + 0x5b843fc], cl
add al, dh
pop edx
xchg edi, eax
std
cmp al, byte [ebx + 0x2b07e093]
invalid
push cs
cmc
into
lea esp, [edi - 0x4111b44]
jmp 0xb4878f07
mov al, 0xb5
jmp 0xd2067105

Function at 0x4990ce
Capabilities:
Encode data using xor

Disassembly:
and byte [edx], bh
adc al, byte [eax + ebx*4]
sub al, 0xfd
push edx
imul ebx, esp, 0xffffff89
push es
das
adc al, 0x44
fdivr qword [eax]
dec edx
adc bl, ah
loop 0x4990a6
xchg esp, eax
nop
fdiv qword [ebx]
pop edi
xor dl, byte [esi + 0x63]
fstp xword [edx + 0x5b9c82e4]
das
add cl, dh
sar byte [edi + ebp*2], cl
shl byte fs:[eax], 0x18
xchg edi, eax
xor ch, byte [ecx]
mov ah, 0x6e
jl 0x4990b8
cwde
out 0xc9, al
mov eax, 0xac1616cc
ror dword [eax + 0x5a], 0xe9
inc ebp
and cl, byte [esi - 0x46e339d6]
stosd dword es:[edi], eax
js 0x499136
arpl word [esi + 0x2f], bp
push 0xffffffffffffff8c
add al, 0xb
insd dword es:[edi], dx
mov edi, 0x1c79dd6
push es
add dword [esi], eax
mov bl, 0x23
or eax, 0x25714244
jp 0x499163
inc esi
in al, 0xda
mov dh, 0xad
or al, dl
lahf
xor dword [ebx + 0x19], edx
idiv byte [edi - 0x33]
jecxz 0x499100
retf 0xea04
xor ax, 0x7dcb
jb 0x4991ae
adc esp, dword [eax + 0x42]
and eax, 0x61cb2119
pop ebp
push 0xba148ace
mov bl, 0x49
adc al, 0xcd
dec esi
cdq
dec esi
sbb eax, 0xb763f1d7
cwde
lds edi, [ecx - 0x76]
jecxz 0x4991b4
ret 0x5b5c
clc
cdq
adc dword [ecx - 0x65c518fb], 0x2e7b9a79
xchg edi, eax
push ebx
hlt
xchg edx, eax
mov ecx, 0x5eeb562b
jg 0x4991ce
sbb al, 0
aas
inc edx
and byte [esi], al
pop esp
mov dl, 0xfc
adc eax, 0x6b818348
test dword [0xea3db6c4], 0x76147da
inc ebp
wait
xchg ecx, eax
hlt

Function at 0x4a1dff
Capabilities:
Encode data using xor

Disassembly:
xor edx, edi
or eax, 0x42713ab3
scasd eax, dword es:[edi]
push 0x9858d542
push edx
xor byte [edi - 0x41250aa9], al
adc dword [edi - 0x2f], esp
bound ebp, qword [edi + edx*8 - 0x30]
add ecx, ebx
mov bl, 0x30
out 0x9d, eax
push edx
pop ecx
invalid
Function at 0x4a9ae4
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx + 0x77], dl
mov eax, 0xf5b6d165
sub ch, byte [eax + ecx + 0x54701304]
dec edx
movsb byte es:[edi], byte [esi]
sbb byte [edi + 0x434e4fd8], dl
cmp dword [edx + 0x19], esp
stc
xchg ecx, eax
sbb byte [edi + 0x78], 0xe4
call dword [edi - 0x28dbfd58]
cmp byte [edx + 0x12], ah
and ch, byte [ebx + ecx]
stc
or byte [ebp - 0x76], 0xdf
xchg dword [edi - 0x2b], ecx
adc al, 0x64
sar byte [esi + 0xae0c6e1], 0x64
sar byte fs:[esi + 0xae0c6e1], 0x64
mov edx, 0x6b6639f0
outsd dx, dword [esi]
out 0xc6, al
xlatb
sub dword [ebp + esi*2 - 0xfec2e97], ebp
add al, ah
mov dword [eax - 0x1c], 0xb6aeead0
mov cl, 0xc9
xor byte [eax - 0x71], cl
cmp eax, dword [eax - 0x32]
movsb byte es:[edi], byte [esi]
sub bl, byte [eax - 0x65]
inc edi
adc cl, byte gs:[0xab105b1d]
mov al, 0x2a
loopne 0x4a9b1a
mov al, 0x8a
adc dword [ecx], edx
push eax
pop es
jns 0x4a9b86
push es
ret 0xf76e
or edi, dword [edx - 0x7e]
adc byte [ecx - 0x603e0cd0], 0xf0
lcall 0x16c0, 0xf324bb3e
pop es
mov edx, 0x9cc077a7
xchg ecx, eax
in al, 0xec
adc dword [eax - 0x60780f5a], edi
xchg ebp, eax
daa
and byte [edi - 0x39], bl
push edx
test byte [ebx - 0x32], ch
cdq
and dword [edx + 0x33], ebp
mov bh, bh
cmp ecx, eax
scasd eax, dword es:[edi]
and dh, byte [eax]
push ds
lds ebp, [edi - 0x380f0165]
jno 0x4a9bd0
cwde
mov al, byte ds:[0xacc86f29]
sub edi, dword [edi + edx*8 - 0x2973d5d4]
and ebx, edi
xchg ecx, eax
out dx, eax
xchg ecx, eax
push ebx
adc eax, 0x9195337f
sbb dl, byte [ebx - 0xabe0193]
push 0x40
test eax, 0x4a36df56
add eax, 0x71ad5c2
cdq
outsd dx, dword [esi]
maskmovq mm3, mm7
enter 0xfffffffffffffb26, 0xffffffffffffff8d
xor eax, 0x940fe65a
je 0x4a9b66
movsd dword es:[edi], dword [esi]
inc eax
push ebp
cmp al, 0x69
sub bl, byte [edx]
add byte [ebp + 0x21], dh
lea ebx, [ebx + 0x10e7c1bd]
loopne 0x4a9bd5
xchg byte [0x8a3e6f8c], al
rcr byte [edx - 1], 0x58
pop ss
into
cmp ebx, ebp
ljmp 0x107a
Function at 0x4aaf44
Capabilities:
Encode data using xor

Disassembly:
dec ebx
cmc
daa
fsubr qword [ecx + 0x55]
lea eax, [esp + ecx*8 - 0x3a07e460]
rcr byte [0x1042cfdb], cl
salc
mov bl, 0x2c
xor byte [edi - 0x17a5832b], ch
aad 0x7c
pop edx
invalid
retf 0x50cc
aad 0x7c
pop edx
call 0x3a9b7c16
test al, 0x62
adc eax, 0x4e9f2c7a
lahf
dec esi
in eax, 0x6b
adc eax, 0xda0f41d
pop edi
sub bl, byte [esi + eax*2]
aam 0x86
dec esi
and eax, 0xb2e84f8f
out 0xc9, eax
xor ebp, dword [edx - 0x6e]
movsd dword es:[edi], dword [esi]
jp 0x4aaf2c
test edi, ebx
ror byte [edi - 0x31], 0x8b
xor al, 0xb5
sbb dword [ebp + 0x45], edi
adc dword [ebp - 0x5f], edi
add al, 0x9e
fisttp qword [eax]
mov dl, 0xaf
xor byte [esi], ah
clc
add byte [0x56a0571e], 0xda
jp 0x4aaf51
ffreep st(0)
dec edi
iretd
jp 0x4aaf6f
out 0xd9, al
sbb eax, 0xe2268865
lodsb al, byte [esi]
test dword [ebp + 0x58480997], esi
imul ecx, dword [ecx*4 - 0x49532d7d], 0xffffff85
adc dword [ebx + 0x33], eax
ja 0x4aafdf
push ebp
sub ebp, edi
enter 0xffffffffffffa2fe, 0x41
push 0xaa5aa120
aaa
mov esi, 0xf9e41ff8
cmpsb byte [esi], byte es:[edi]
inc ebx
or dword [ecx], ebp
add dword [edx + esi*2 - 0x44], 0x355650d2
outsd dx, dword [esi]
ja 0x4aaf6f
inc ebp
inc ebx
out dx, al
imul ebx, dword [eax + 0x51], 0xffffff8f
clc
test al, 0x49
outsd dx, dword [esi]
and al, byte [edi]
pop ds
jl 0x4ab006
sub esp, dword [edi - 0x41]
mov eax, dword [0x93b2b8de]
mov edi, 0xb2b8dea1
xchg ebx, eax
popfd
push ebx
into
invalid
into
fimul dword [eax - 0x65]
wait
xchg ecx, eax
xchg byte [edx + ebx*2 + 0x2a0aef39], ch
arpl word [esi + esi*4 - 0x251fd078], dx
xor al, 0xe9
aaa
mov ebx, 0xf60bf0e8
int 0xe
in eax, dx
jg 0x4aaff3
mov ebp, 0xfb0b8c78
mov ds, word [ebx]
shl dl, 0x38
mov al, 0x78
add byte [eax - 0x1c], dh
push es
fisubr dword [eax - 0x3b]
inc eax
and ch, byte [esi - 0x1f]
mov al, byte [0x53c7a081]
inc eax
out 0x30, al
inc esp
pushfd
mov dl, 0x75
inc edx
xchg esp, eax
dec ecx
jns 0x4aaff6
fmul st(2)
cli
retf 0x2756
Function at 0x4b9af3
Capabilities:
Query environment variable

Disassembly:
jne 0x4b9b28
call ebp
mov esi, eax
cmp esi, ebx
je 0x4b9b09
mov dword [0x4c5eac], 1
jmp 0x4b9b31
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x4b9c03
mov dword [0x4c5eac], 2
jmp 0x4b9bb7
cmp eax, 1
jne 0x4b9bb2
cmp esi, ebx
jne 0x4b9b41
call ebp
mov esi, eax
cmp esi, ebx
je 0x4b9c03
cmp word [esi], bx
mov eax, esi
je 0x4b9b56
inc eax
inc eax
cmp word [eax], bx
jne 0x4b9b48
inc eax
inc eax
cmp word [eax], bx
jne 0x4b9b48
sub eax, esi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
sar eax, 1
push ebx
push ebx
inc eax
push ebx
push ebx
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x4b9ba7
push ebp
call fcn.004bb552
cmp eax, ebx
pop ecx
mov dword [esp + 0x10], eax
je 0x4b9ba7
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x4b9ba3
push dword [esp + 0x10]
call fcn.004bb469
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x4b9c05
cmp eax, 2
jne 0x4b9c03
cmp edi, ebx
jne 0x4b9bc7
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x4b9c03
cmp byte [edi], bl
mov eax, edi
je 0x4b9bd7
inc eax
cmp byte [eax], bl
jne 0x4b9bcd
inc eax
cmp byte [eax], bl
jne 0x4b9bcd
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.004bb552
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4b9bed
xor esi, esi
jmp 0x4b9bf8
push ebp
push edi
push esi
call fcn.004bb690
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x4b9c05
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x4ba0a1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c13c8
cmp edx, dword [eax]
je 0x4ba0c3
add eax, 8
inc ecx
cmp eax, 0x4c1458
jl 0x4ba0b4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c13c8]
jne 0x4ba1f1
mov eax, dword [0x4c5d60]
cmp eax, 1
je 0x4ba1cb
test eax, eax
jne 0x4ba0f4
cmp dword [0x4c12f4], 1
je 0x4ba1cb
cmp edx, 0xfc
je 0x4ba1f1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba12b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004baa80
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004baf10
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba16e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004baf10
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf744
push edi
call fcn.004bcde0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004baa80
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004baa90
lea eax, [ebp - 0xa0]
push 0x4bf724
push eax
call fcn.004baa90
push dword [esi + 0x4c13cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004baa90
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bcd54
add esp, 0x2c
pop edi
jmp 0x4ba1f1
lea eax, [ebp + 8]
lea esi, [esi + 0x4c13cc]
push 0
push eax
push dword [esi]
call fcn.004baf10
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x41ca68
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x41ca6c]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call fcn.0040aa10
jmp 0x4011d3
mov eax, dword [0x41ca6c]
test eax, eax
jne 0x4011c9
mov dword [0x41ca6c], 1
mov dword [esp + 4], 0x41e014
mov dword [esp], 0x41e00c
call sub.ucrtbase.dll__initterm
jmp 0x4011d3
mov dword [0x41c01c], 1
mov eax, dword [0x41ca6c]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x41e008
mov dword [esp], section..CRT
call sub.ucrtbase.dll__initterm
mov dword [0x41ca6c], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x41ca68
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call fcn.00401e49
mov dword [esp], 0x401f64
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x41c074], eax
mov dword [esp], section..text
call sub.ucrtbase.dll__set_invalid_parameter_handler
call fcn.004017e8
mov eax, dword [0x41c004]
mov dword [esp + 4], 0x41c008
mov dword [esp], eax
call fcn.004013c8
call fcn.00401624
mov eax, dword [0x40d064]
mov edx, dword [0x41c00c]
mov dword [eax], edx
mov ecx, dword [0x41c00c]
mov edx, dword [0x41c008]
mov eax, dword [0x41c004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0040bf10
mov dword [0x41c014], eax
mov eax, dword [0x41c018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x41c014]
mov dword [esp], eax
call sub.ucrtbase.dll_exit
mov eax, dword [0x41c01c]
test eax, eax
jne 0x4012de
call sub.ucrtbase.dll__cexit
mov eax, dword [0x41c014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret