joyce8/EMBER2024-capa huggingface dataset:
Function at 0x143b410
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x15b9de8]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x143b456
cmp word [ebx], dx
jne 0x143b456
or byte [eax + edi + 0x28], 4
jmp 0x143b45b
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x143b5be
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x143b59e
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x143b49c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x143b4d2
cmp eax, edx
jae 0x143b4e0
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x143b477
jmp 0x143b5be
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x143b599
cmp dword [ebp - 0x18], 0
je 0x143b599
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x15b9de8]
test byte [eax + edi + 0x28], 0x48
je 0x143b56f
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x143b533
mov word [esi], cx
jmp 0x143b56a
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x15b9de8]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x15b9de8]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x15b9de8]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x143b5be
pop eax
cmp word [ebp - 4], ax
jne 0x143b57f
cmp esi, ebx
jne 0x143b57f
mov word [esi], ax
jmp 0x143b5bb
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0143be49
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x143b5be
push 0xd
pop eax
jmp 0x143b57a
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x15b9de8]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x143b5b8
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x143b5be
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x143dbcf
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x143dc6c
push ebx
push esi
call fcn.0143db98
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0143db2c
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x143dc19
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143dc6b
push edi
push eax
call fcn.01438a59
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x143dc39
call fcn.014370ef
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x143dc6a
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0143db2c
add esp, 0x20
test eax, eax
jne 0x143dc58
push edi
call fcn.014370ef
jmp 0x143dc60
push ebx
call fcn.014370ef
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x14406db
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.01438208
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x144074a
cmp esi, dword [ebp - 4]
je 0x1440745
cmp dword [ebp + 0xc], 0
je 0x1440745
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1440722
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0144022d
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x144074c
xor eax, eax
inc eax
jmp 0x144074c
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x14407b1
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x15b6008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.01438208
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.01438208
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1440828
cmp word [ecx], dx
je 0x1440828
mov eax, dword [0x1583f44]
push edi
dec eax
push eax
push 0x1583e30
call fcn.01440750
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x144089b
cmp word [eax], dx
je 0x144089b
mov eax, dword [edi]
test eax, eax
je 0x144084c
cmp word [eax], dx
je 0x144084c
lea eax, [ebp - 0x10]
push eax
call fcn.01440133
jmp 0x1440855
lea eax, [ebp - 0x10]
push eax
call fcn.014401ce
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x14408c5
mov eax, dword [0x1583e2c]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1583b20
call fcn.01440750
add esp, 0xc
test al, al
je 0x14408c5
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1440890
cmp word [eax], di
je 0x1440890
lea eax, [ebp - 0x10]
push eax
call fcn.01440133
pop ecx
jmp 0x14408c7
lea eax, [ebp - 0x10]
push eax
call fcn.014401ce
jmp 0x144088d
mov eax, dword [edi]
test eax, eax
je 0x14408b2
cmp word [eax], dx
je 0x14408b2
lea eax, [ebp - 0x10]
push eax
call fcn.014400e8
pop ecx
jmp 0x14408c5
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1440990
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.014405d5
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1440990
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1440990
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1440990
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x144091d
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.01437703
test ebx, ebx
je 0x144098b
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.01437703
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1440990
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1440990
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.01444944
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1440992
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.014244b9
leave
ret
Function at 0x1444bde
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.01444b5a
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1444d4d
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1444d4d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1444d02
jg 0x1444c3a
test eax, eax
je 0x1444cf8
push 1
push 0x1000
call fcn.01437092
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1444c5d
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1444cef
push 0x8000
push ebx
call fcn.0143471a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1444c86
jg 0x1444c81
cmp ecx, 0x1000
jb 0x1444c86
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0143a817
add esp, 0x10
cmp eax, 0xffffffff
je 0x1444ccb
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1444c81
jl 0x1444cb2
test ecx, ecx
jne 0x1444c73
push dword [ebp - 0xc]
push ebx
call fcn.0143471a
push esi
call fcn.014370ef
add esp, 0xc
xor ebx, ebx
jmp 0x1444d5b
cmp byte [edi + 0x24], 0
je 0x1444ce2
cmp dword [edi + 0x20], 5
jne 0x1444ce2
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1444ced
mov ebx, dword [edi + 0x18]
jmp 0x1444cef
xor ebx, ebx
push esi
call fcn.014370ef
pop ecx
jmp 0x1444d5b
test ecx, ecx
jg 0x1444cc4
jl 0x1444d02
test eax, eax
jae 0x1444cc4
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0143be49
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1444d22
cmp byte [edi + 0x1c], 0
je 0x1444cc4
jmp 0x1444d53
push ebx
call fcn.0143e5ab
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1444cc4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1444d5b
cmp byte [edi + 0x1c], 0
je 0x1444d58
mov ebx, dword [edi + 0x18]
jmp 0x1444d5b
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0143be49
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x14465e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x144660d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x144660d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.10007073
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10007073
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.10007073
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.10007073
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.10007073
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.10007073
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.10007073
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.10007073
push 0xd008
push edi
call fcn.10007073
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.10007073
int3

Function at 0x10007073
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10007082
pop dword [ebp - 0xc]
mov eax, 0x50be60a0
add eax, 0xbf420fe2
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x35549
push 0
mov eax, 0xc7e0d02d
sub eax, 0xb7df8fc9
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x3934
mov edx, eax
mov ebx, 0xec5c7aa2
sub ebx, 0xdc5af4a2
add ebx, dword [ebp - 0xc]
mov esi, 0x203a7cf
add esi, 0x346aeae
mov dword [ebp - 8], 0xb966b7c
mov edi, dword [ebx]
sub dword [ebp - 4], edi
add edi, esi
add dword [ebp - 4], 0x925fef36
mov dword [edx], edi
xor dword [ebp - 4], edx
add edx, 0x8565efe5
add edx, 0x7a9a101f
add ebx, 4
loop 0x100070db
add eax, 0xf0e00ee6
sub eax, 0xf0df3743
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x437a30
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xbd
std
inc edx
xor dword [esi + 0x4bff0334], esp
push eax
cmpsb byte [esi], byte es:[edi]
xor al, 3
dec dword [ebx + 0x50]
jae 0x437a35
inc ebp
pop es
cli
mov byte [eax], al
test byte [eax], 0x30
xor eax, 0x22cf0227
pop es
add dword [edx + 0x43], eax
ljmp 0x9390

Function at 0x43af34
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x98345241
inc eax
xchg edx, eax
cmp eax, 0xd6d434b2
aam 0xd6
aam 0xd6
fist word [edx - 1]
bound esi, qword [esi]
jbe 0x43af2a
idiv dword [ebx + edi]
push ebx
adc dword [ebx + edx*8 - 0x2e], edx
enter 0x61c8, 0x16
cli
jge 0x43af99
sbb dh, cl
out 0xd, al
fisub dword [eax + 0x48]
adc esp, dword [edx - 0xc]
ja 0x43af91
nop
out dx, al
or al, 0x6f
pop es
in al, dx
adc eax, 0x6b403fe0
cmp eax, 0x1e1ab0c7
push esi
xchg ecx, eax
salc
cdq
ret 0x77b8
sbb byte [esp + edi*4], 0xc4
invalid
popfd
mov ch, 0x8c
push 0xffffffffffffff94
jb 0x43afee
inc ecx
xchg edx, eax
popal
je 0x43af7e
fisub dword [eax + 0x36]
push eax
pushal
push eax
add al, 0x78
nop
cwde
lodsb al, byte cs:[esi]
jnp 0x43afad
lcall 0xe6f5, 0xd83537b1
xchg byte [edi], dl
popfd
and byte ds:[eax + ecx*8 + 0x56864678], al
imul edx, esi, 0xda3f9dab
push 0x472c9fb3
and esi, esi
pop edi
in al, 0x1a
out dx, al
xchg dword [edx], esp
rol dword [edi - 0x3d836925], 0xdc
mov dl, 0x7d
mov esp, 0x7676525c
sbb al, 0x16
invalid
jp 0x43af8c
xchg esi, eax
jo 0x43b06b
inc esp
fcomp qword [esi + esi*2]
cld
push ds
jge 0x43b061
mov ebp, 0x5e168f16
lcall 0xd26e, 0xaa59c2fc
mov esi, ss
sal dl, 1
push eax
cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
pushf
lcall 0x733c, 0xb645b6e9
mov ebx, 0x8e032117
adc eax, 0xdf58c7e8
cmp al, 0x9f
std
pop esp
sub al, 6
pop ebp
adc bl, byte [eax + esi]
retf
inc edx
wait
pop ebp
out 0xa9, al
push cs
sub al, 0x26
popfd
salc
enter 0xffffffffffffb097, 0xffffffffffffff96
mov al, 0x96
push esp
xor al, 0x40
xor al, byte [ecx + 0x74]
pop ebp
mov bh, byte [eax - 0x55223552]
xor byte [ebx + 0x3ccf361], ch
dec edx
dec esi
jnp 0x43b03b
sub byte [ecx + 0x46], ah
invalid
push ecx
daa
add dh, dh
mov ah, 0xf6
loop 0x43b010
imul esi, dword [esi - 0x69], 0xffffffa6
xchg edi, eax
cmpsb byte [esi], byte es:[edi]
sbb byte [edi + edx*8 - 0x3669dc7a], bh
dec ebp
sub dh, byte [eax]
jmp 0x43b02f
Function at 0x470651
Capabilities:
Encode data using xor

Disassembly:
daa
xor ch, byte [edi + esi + 0x5bfbe951]
jle 0x47066e
sbb dword [eax], 0x1e
mov dh, byte [0xb18d630f]
std
fisubr word [eax + 0xc]
enter 0x7f1e, 0xffffffffffffffee
and esp, dword [0xa52e82af]
xchg dword [edx - 0x50149929], esi
rcr edi, cl
cmp eax, 0x461bb8e
sar ch, cl
add al, 0xd2
std
das
leave
aam 0x57
lcall 0xb9da, 0xe5bf0330
fldenv [edi - 0x1417e7b6]
aam 0xdb
and dword [eax - 0x50], esp
add esp, dword [edi - 0x29]
sub al, 0x63
stosd dword es:[edi], eax
push 0xf422e719
sbb edi, esp
and dh, ah
jle 0x4706a3
in al, dx
pop ds
push es
pop esp
adc eax, 0x56eeb4ed
xchg edi, eax
out dx, al
dec edi
and eax, 0x7b7ad26a
sar byte [edx + 0x7b], cl
jno 0x470677
ja 0x4706eb
stosb byte es:[edi], al
xchg edx, eax
dec dl
cmp dword [edx - 0x33], edx
mov esp, 0xfaf58d73
jae 0x470621
cmc
cli
rcr byte [ebx - 0x1f], 0x17
xchg byte [ecx], bl
je 0x470683
push ss
mov ecx, 0xddb0c00c
cmp ecx, dword [edx]
sbb eax, 0x2809ae5b
fnstsw word [ebx]
or bl, byte [0x2809ae5b]
mov dword [edx + edi], esi
mov bl, 0x3e
fstpnce st(6), st(0)
ja 0x47064e
mov esi, 0x1d2be61c
sahf
mov byte [ebx - 0x17], 0xdd
in al, dx
xchg byte [ecx - 0x4b], dh
movsb byte es:[edi], byte [esi]
xor al, 0x19
xor eax, 0xc4519df0
xchg edx, eax
sal dword [edi + 0x51abb74c], cl
xor bh, byte [edi + 0x33e03794]
dec ebp
loopne 0x47072b
sub eax, 0xaadc8e6c
insb byte es:[edi], dx
xchg edi, eax
invalid
and ebx, esp
xor byte [edx - 0x5aade8b0], bh
pop ss
push edx
movsd dword es:[edi], dword [esi]
inc ecx
clc
pop esp
xchg ecx, eax
jne 0x470692
and byte [0x5d31163e], cl
invalid
jae 0x47078f
push ebp
dec edx
fiadd word [edi - 0x30]
jb 0x47074c
mov esi, 0x329a2b99
sub byte [ecx], ah
sar dword [ebx - 0x1f], 0x85
fld qword [esp + edi*8]
out 0x11, al
sahf
pop edi
pushal
xchg eax, ebx
push es
xlatb
fbld tbyte [ebx - 0x4a]
jns 0x4706f0
push ecx
popal
stosd dword es:[edi], eax
ret
inc esp
int3
jb 0x4707ff
in al, dx
and esp, ecx
cmpsd dword [esi], dword es:[edi]
int 0xa5
xor esi, dword [0x9258ffdb]
jb 0x470813
invalid
mov esp, dword [ecx - 0x2b]
adc byte ds:[ecx + 0x5bf770ee], 0x21
xor eax, 0x54e5adbe
popfd
xchg edi, eax
lahf
mov edx, 0x183f9f7e
aas
jbe 0x470753
adc byte [ebx - 0x2dd57f36], 0xdc
stosd dword es:[edi], eax
add dh, 0x47
adc dword [edi - 0x411ef99c], 0x666a894d
push ss
in al, 0x2f
mov eax, dword [0xa0b3e359]
test al, 0xe3
inc eax
aas
add al, 0xb2
loop 0x470786
iretd
lahf
push ebp
cmp byte [ecx], al
aam 0x78
in al, 0x99
ror dword [ebx - 0x55d3d5], cl
retf
dec ecx
outsb dx, byte [esi]
or eax, 0xf76ca866
dec ch
jecxz 0x4707b5
inc ebp
cli
inc ebx
loope 0x470885
out dx, eax
les edi, [edx + 0x32d70442]
ljmp 0x6e2d
xor dword [esi + 0x3d], edx
or dword [edi + ebx*2 + 0x5c], 0x2e
aad 0xa1
std
lcall 0x83de, 0x69994f30
retf
Function at 0x494fa0
Capabilities:
Encode data using xor

Disassembly:
and bh, ah
push ecx
push ss
inc eax
adc ah, byte [ecx - 0x45]
retf 0x9f8b
pushfd
js 0x495016
xor dword [edx + 0x25db7894], ebx
xor eax, 0x14c47711
rcl dword [edx], cl
pop edx
pop esp
sub byte [ebx - 0x5a627c93], dh
arpl word [0x778fa412], si
mov cl, 0x42
rcr dword [eax], 1
push es
xchg edi, eax
cli
pushfd
sal ah, cl
shl ch, cl
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
jp 0x494f81
push edi
jl 0x495000
pop eax
xor edx, dword [ebp + 0x48]
mov dword [edi + 0x14], eax
xchg ecx, eax
shl dword [edi + 0x39de5d46], 1
xor byte [esi], cl
push cs
mov eax, dword [0xe4d1801c]
leave
xchg byte [edx], ch
js 0x494fff
cmp eax, 0x49e7de2a
xchg ebp, eax
aad 0xa4
popfd
push ss
pop esp
popfd
invalid

Function at 0x4ab530
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
sub eax, dword [eax + edi*2 - 0xc691ca0]
sbb dword [esi - 0x15], edi
pop ebp
pop ebx
jg 0x4ab571
invalid
fldenv [edi - 0x75]
invalid
stosd dword es:[edi], eax
mov ah, 0x14
arpl word [ecx], ax
push ebp
mov ah, 0x13
cmp edx, dword [eax]
dec ecx
jne 0x4ab5f9
popal
cmp ebx, dword [ebp - 0xe]
in al, 0xc8
arpl di, dx
adc cl, dl
lcall 0xa007, 0xafd63200
xor byte [eax + 0x2070f0c3], bl
arpl ax, dx
outsd dx, dword [esi]
xchg ebx, eax
iretd
jmp 0x4ab551
xchg ebx, eax
pop esi
sbb bl, bh
mov edx, 0xfbbb4b5d
sti
adc bl, dh
jb 0x4ab627
sti
push ebx
leave
jo 0x4ab67e
jo 0x4ab5cf
jo 0x4ab5f1
xor byte [edi + 0x12], bl
mov esi, 0x8212191
adc byte [ecx], bh
adc byte [ebx - 0x464f9cfd], dl
push es
movsb byte es:[edi], byte [esi]
inc esp
or edi, dword [esi - 0x1084c9f9]
out dx, eax
invalid
inc esi
imul dword [ecx - 0x1c1f3c4d]
jnp 0x4ab63b
dec ebx
pop ecx
mov ecx, 0x202a31d3
imul esp, edx, 0x6a8b2264
sti
xor dword [edx], ebp
and byte [ecx - 0x1e], ch
and cl, byte fs:[ebx + 0x1230fb6a]
mov ebp, dword [edx - 5]
xor byte [edx], dl
shl dword [ecx + 0x4bc485c2], 0x4e
insb byte es:[edi], dx
inc esp
dec ebp
push eax
jbe 0x4ab671
int1
jo 0x4ab685
inc edx
push ds
stosd dword es:[edi], eax
jmp 0x2182d2e6

Function at 0x4ae994
Capabilities:
Encode data using xor

Disassembly:
mov esp, 0x51bb40a3
and bh, byte [eax + 0x6e]
jns 0x4ae9ed
add ebp, esp
cli
sub dword [eax], esi
invalid
push es
pop ss
inc edx
in eax, dx
wait
jno 0x4aea5e
mov ecx, 0x69d6984e
ja 0x4aea50
sbb ebx, dword [ecx - 0x7c627bc]
dec ebx
dec ecx
cmc
inc ebx
fnstcw word [esi + 0x4da7d389]
pop edx
sub ecx, dword [ebx + ebp + 0x7be36568]
hlt
sti
outsb dx, byte [esi]
in eax, 0xca
jno 0x4aea9e
wait
stosd dword es:[edi], eax
jne 0x4aea5b
stc
jmp 0x4aead2
mov bl, 0x66
test dword [eax - 0x76fa5f8d], 0xcbd16cb3
pop ecx
out 0xbc, eax
popal
salc
cmpsd dword [esi], dword es:[edi]
jno 0x4ae9f9
das
imul ebp, dword [ecx + 0x6966154b], 0xffffff8a
sahf
mov ecx, dword [edx]
pop ebx
push ds
invalid
invalid
or eax, esi
push es
dec ebx
dec ebp
retf 0xdb94
Function at 0x4bb37d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3338
cmp edx, dword [eax]
je 0x4bb39f
add eax, 8
inc ecx
cmp eax, 0x4c33c8
jl 0x4bb390
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3338]
jne 0x4bb4cd
mov eax, dword [0x4c7cbc]
cmp eax, 1
je 0x4bb4a7
test eax, eax
jne 0x4bb3d0
cmp dword [0x4c3264], 1
je 0x4bb4a7
cmp edx, 0xfc
je 0x4bb4cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb407
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbd60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc1f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb44a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc1f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c089c
push edi
call fcn.004be0c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbd60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbd70
lea eax, [ebp - 0xa0]
push 0x4c087c
push eax
call fcn.004bbd70
push dword [esi + 0x4c333c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbd70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be034
add esp, 0x2c
pop edi
jmp 0x4bb4cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c333c]
push 0
push eax
push dword [esi]
call fcn.004bc1f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret