joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42db80
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x47a648
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
mov ebx, ecx
push edi
mov esi, dword [ebp]
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x10]
dec ecx
cmp eax, ecx
jge 0x42dbb9
inc eax
mov dword [esi + 0x10], eax
jmp 0x42dccc
mov eax, dword [ebx + 0x3c]
mov ecx, dword [esi + 8]
cmp ecx, eax
jne 0x42dbcd
mov eax, 0xffffffc7
jmp 0x42dcce
mov esi, dword [esi]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp edx, ecx
jl 0x42dbde
cmp dword [esi + 8], eax
jne 0x42dbcd
cmp dword [esi + 8], eax
jne 0x42dbf7
mov eax, dword [esi + 0x10]
mov ecx, dword [esi + 0xc]
cmp eax, ecx
jl 0x42dbf7
mov eax, 0xffffffc7
jmp 0x42dcce
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x42dc0b
push eax
mov ecx, ebx
call fcn.0042d3b0
mov dword [esi + 4], edi
mov dword [ebp], esi
mov ecx, dword [esi + 0x10]
inc ecx
mov dword [esi + 0x10], ecx
lea ecx, [esp + 0x10]
call fcn.00401730
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x3c]
test edi, edi
jne 0x42dc3c
mov ecx, dword [ebx + 4]
mov edx, dword [ecx + 8]
lea ecx, [esp + 0x10]
push edx
call fcn.00401750
mov edi, eax
mov eax, dword [esi + 8]
push edi
push eax
mov ecx, ebx
call fcn.0042cb20
test eax, eax
mov dword [esp + 0x38], eax
je 0x42dc6f
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x606070
call fcn.00401930
mov eax, dword [esp + 0x38]
jmp 0x42dcce
mov ecx, dword [esi + 0x10]
push ecx
push edi
mov ecx, ebx
call fcn.0042d9e0
mov dl, byte [edi]
and dl, 1
cmp dl, 1
jne 0x42dcb3
mov ecx, dword [esp + 0x34]
push ebp
push ecx
push edi
push eax
mov ecx, ebx
call fcn.0042da00
mov esi, eax
test esi, esi
jne 0x42dce3
mov edx, dword [ebp]
push eax
push edi
mov ecx, ebx
mov dword [edx + 0x10], eax
call fcn.0042d9e0
mov cl, byte [edi]
and cl, 1
cmp cl, 1
je 0x42dc85
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x606070
call fcn.00401930
xor eax, eax
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], 0x606070
call fcn.00401930
mov eax, esi
jmp 0x42dcce

Function at 0x4326a0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x432700
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x432700
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x432700
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x432700
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x432740
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x43e420
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47af38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00473d98
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0043dd80
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00473cc6
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0047058a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0047058a
push 1
push 0
push 0
mov ecx, esi
call fcn.00470532
push 1
push 0
push 1
mov ecx, esi
call fcn.00470532
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00473e0a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x43e5a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47af58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00473d98
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.0043dd80
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00473cc6
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x43e664
cmp dword [esp + 0x40], 1
jne 0x43e662
cmp ecx, eax
jge 0x43e664
mov eax, ecx
cmp eax, 0xc8
jge 0x43e670
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.0043e420
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00473e0a
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x43ee60
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47b003
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046e9aa
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], method.CBrush.virtual_0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00474040
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0047555c
test eax, eax
je 0x43ef7c
mov ecx, dword [esp + 0x3c]
call fcn.0047406d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43ef40
push edi
mov ecx, esi
call fcn.004716d1
mov ecx, esi
call fcn.0043f120
cmp dword [esp + 0x38], 1
jne 0x43ef75
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047180c
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x441190
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4411c3
push esi
call fcn.0044f530
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4411bc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441249
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441232
mov eax, dword [esi + 8]
test eax, eax
je 0x4411e7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44122e
cmp eax, 2
je 0x441232
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4411da
cmp eax, 3
je 0x44120d
cmp eax, 1
jne 0x4411da
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4411da
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4411da
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441270
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441258
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441270
add esp, 4
pop esi
ret

Function at 0x441ae0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441b01
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441b01
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441b01
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46f7a0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46f7d8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046d854
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046d82c
jmp 0x46f7e4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x470e8e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x470ed0
call fcn.00476947
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x470ed0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x470ec7
xor eax, eax
jmp 0x470ed8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00470ede
pop edi
pop esi
pop ebx
ret 4
Function at 0x476e77
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x476ea5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x476ec3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00476ddd
jmp 0x476ec3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x476ec3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00476ddd
test edi, edi
mov eax, edi
jne 0x476ead
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4060ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406112
xor eax, eax
test eax, eax
je 0x406124
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406124
xor ecx, ecx
jmp 0x406127
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x40a014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x4061d1
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42cdfc], 0
push esi
jne 0x406208
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4061e2
mov dword [ecx*4 + 0x42cdf8], eax
inc ecx
cmp ecx, 0x100
jl 0x4061dd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406239
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42cdf8]
xor eax, esi
inc ecx
dec edx
jne 0x40621b
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b639
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x43b3c1
sub esp, 4
mov dword [esp], edx
mov edx, dword [esp]
add esp, 4
mov edx, eax
call fcn.0043b677
push eax
pop edx
and edx, edx
xor dword [esi], ebx
add edx, 0x70fb5886
inc esi
mov edx, eax
and edx, eax
or eax, eax
cmp esi, edi
jne fcn.0043b639
add eax, 0x2535ebb9
ret
Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x4b9a90]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4b9070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]

Function at 0x417a7a
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
nop
scasb al, byte es:[edi]
or al, 0xd5
mov ecx, dword [ecx]
jl 0x417a2a
xchg esi, eax
aad 0xc2
or byte [eax + 0x14], ch
popal
adc al, 0x61
ror dword [ebx + edi*2 - 0x17fc67d8], 0xd3
pop eax
xchg esi, eax
push esi
mov edi, 0xce6ea3c9
test byte [ecx + 0x61], bh
leave
mov dword [0x7984ce6e], eax
popal
xor al, byte [edi]
cwde
jge 0x417a79
imul byte [ebx + 0x5eb42252]
cmpsd dword [esi], dword es:[edi]
popfd
or al, dl
inc esi
mov dword [ebp + 0x7db4e78c], 0x23e54912
cli
loope 0x417b1c
ror dword [esi + edx + 0x57], cl
jb 0x417a5f
in eax, dx
pop edx
mov al, 0xbe
lds ebp, [ebx + 0x2c]
jnp 0x417a6c
mov esi, 0x48b0a126
dec ebx
invalid
nop
sub dh, cl
cwde
pop esi
loop 0x417afb
clc
invalid
mov byte [ebp + edx*4 + 0x34], ch
mov edx, 0xc880843d
sub al, 0xf9
sbb dword [0xe2d40e21], 0x41d0439d
aam 0xe2
popfd
inc ebx
rol byte [ecx - 0x3c], 1
or esi, dword [edi - 0x675cc622]
lahf
out dx, al
loop 0x417ba0
cmc
cmp al, 0x9d
test al, 0xdf
cdq
add al, 0x6c
leave
loope 0x417af6
mov ebp, 0x4aaf11
stc
mov ecx, dword [edi - 0x60e58c0c]
sub eax, 0xfe79efd5
call 0x2a67c39b
test al, 0x7b
test dword ss:[eax + edi*8], edx
iretd
Function at 0x4219ef
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
and esi, dword [esi - 0x43eec3af]
pop ss
pop ecx
pop edi
xchg esp, eax
add al, 0x51
Function at 0x45b478
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0xcbaee86a
push edi
sbb eax, 0xff1a3591
mov bh, 0xf5
mov byte [0x17a0b2d0], al
Function at 0x45e0c9
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045e2bc
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00468e11
xor ebx, ebx
cmp eax, ebx
jne 0x45e277
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045e2bc
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00465af0
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4b73e5
add esp, 0x10
test eax, eax
jne 0x45e192
push esi
call fcn.0045b77b
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45e192
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45e17d
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45e192
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e18b
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0046a324
cmp byte [esp + 0x13], bl
je 0x45e1c2
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045e2f9
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45e232
push 0x14
call fcn.004b6652
cmp eax, ebx
pop ecx
je 0x45e1ec
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45e1ee
xor edi, edi
cmp edi, ebx
je 0x45e232
push esi
push edi
call fcn.0045d81f
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045d8e7
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045da10
add esp, 0x18
call fcn.0045e2bc
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004684de
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45e249
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45e25b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45e29e
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45e29e
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045d8e7
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045da10
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47f2d4
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x22
sti
loope 0x47f2b0
fld dword [edi - 9]
outsd dx, dword [esi]
fimul dword [ecx]
jne 0x47f353
push ebp
test al, 0xa0
mov edi, 0x3c4cb933
push ss
mov dh, byte [edx + ecx + 0x43]
lodsb al, byte [esi]
jp 0x47f34e
jno 0x47f35d
pop esi
sti
inc edi
lahf
sar ebp, cl
ret
rcr dword [0xdff06f99], cl
iretd
invalid
pop ebx
fst st(2)
rol dword [ecx - 0x6454470c], 0xae
adc edi, dword [ecx + 0x455b9742]
or ah, byte [eax - 0x1b]
movsd dword es:[edi], dword [esi]
sub al, 0xd5
pop ebx
invalid
Function at 0x495dc4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esp + edi - 0x1d485712], bh
cmp al, 0xb6
lodsd eax, dword [esi]
lodsd eax, dword [esi]
pop ecx
add byte [esi - 0x6b5bf858], bh
add eax, 0x8ab6bcab
mov dh, 0x35
xchg bx, ax
mov eax, ebx
adc edx, ecx
xor al, 0xeb
salc
fsub st(7), st(0)
fcom dword [esi - 0x503ff94e]
aam 0xe7
test eax, 0x938a46a3
mov dl, 0x91
push edi
cmp byte [ebx - 0x68c6a7f2], al
leave
dec eax
call 0xa63e60d1
add byte [ebx + 0x2589deed], ch
fild dword [ebx - 0x25a059ec]
sal byte [esi + 0x344b4795], 1
xchg ebp, eax
out 0xdc, eax
int3
xchg edi, eax
pop ss
inc ecx
imul esi, dword [0xa8c73fb1], 0xa288f08
cmpsd dword [esi], dword es:[edi]
adc eax, 0xc469b789
jnp 0x495c71
les edi, [ebx - 0x78]
idiv dword [ecx - 0x79]
mov ebp, 0xb882f1af
aaa
xchg ebp, eax
or eax, 0x40afe9b0
mov ebp, 0x4939b7bb
or byte [edx], bl
cmp al, 0x38
push ss
les ebp, [ebp - 0x4f]
push 0xb69f9e13
test eax, 0x20ee0b27
jbe 0x495ce6
or ebp, esi
and byte [esi - 0x2d], dh
stosb byte es:[edi], al
fisub word [edx - 0x78]
mov eax, 0x17f20148
ror dword [ecx - 0x5be4998a], 1
mov ss, word [ebp + 0x77]
adc eax, 0x1e474f44
stosd dword es:[edi], eax
test ebx, esi
jnp 0x495d9f
xchg dword [edi - 0x7543ccea], esp
movsd dword es:[edi], dword [esi]
sbb byte [eax + 0x7af00bb], bh
pop es
pop es
jle 0x495cd4
pop ss
loop 0x495d0e
xchg ebp, eax
cmc
stc
push ebp
add ah, al
sbb ebx, ebx
dec edi
pop esi
or dword [eax + 0x78], ebx
sub byte [edx + ebp*4], bl
cmc
jbe 0x495d69
mov dl, byte [esi]
mov dword [0x5683bd0f], eax
push ss
or dword [edx + 0x16458af5], esp
push esi
test dword [edx], edx
adc al, 0x3b
and eax, 0xdbcd1531
cmp esp, dword [0xdbcd1531]
pushal
nop
mov esi, 0x1494b059
xor esp, 0x97b664eb
inc ebx
in eax, dx
mov edi, dword [ebx - 0x37]
sub eax, dword [ebp - 0x6a2821c6]
and eax, 0x3f36b44d
sti
sub bh, bl
invalid
daa
and al, 0xf3
in al, 0x5f
xchg ebp, eax
xor eax, 0x95726852
push eax
mov bh, 0x6d
push 0xb7509572
insd dword es:[edi], dx
cmpsd dword [esi], dword es:[edi]
xchg edi, eax
or eax, 0xb337585e
adc eax, 0x14bb42b4
in eax, dx
add eax, 0x15659b37
inc ebp
and dh, byte [esi + 0x5785626f]
lahf
adc bh, byte [eax - 0x7f]
inc edx
xor dword [ebx + edx*8 - 5], edx
scasd eax, dword es:[edi]
dec edi
ja 0x495da7
push edi
lahf
cmc
ror byte [ebx + 0xa], cl
pop ebp
mov bh, 0xfa
vpunpckhwd ymm4, ymm5, ymmword [eax]
outsd dx, dword [esi]
xchg ebp, eax
aaa
invalid
Function at 0x4ad3b4
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
aaa
push edx
inc esp
xor eax, 0xae36d04e
jl 0x4ad324
test dword [ecx], esp
mov dh, 0x68
push es
cmpsd dword [esi], dword es:[edi]
mov ah, 0xeb
sbb eax, 0x1dfdb71c
xor dword [ebp + 0x31], edx
xor cl, ah
inc ebx
fdiv qword [ebp + 0x76752337]
rcr dword [eax + 0x11492095], 0x90
adc byte [edx - 0x72153ea1], 0xa0
invalid
jne 0x4ad321
in al, dx
adc esp, dword [eax]
push eax
salc
movsb byte es:[edi], byte [esi]
xlatb
jp 0x4ad3b3
clc
fdivr st(2), st(0)
mov ebp, 0x12f1ab76
or al, byte [ebx + 0x6218cb21]
pop esp
in eax, 0xaf
xor dh, dl
invalid
invalid
cmp al, byte [edi - 0x4b]
movsd dword es:[edi], dword [esi]
in eax, 0x59
add dword [edx], edx
sub dl, byte [edx - 0xd86037d]
out 0xf4, eax
jbe 0x4ad38d
pop edx
mov esi, dword [ebx - 0x3ae904b8]
and byte [ebp + 0x4e1a0d12], 0x66
sbb al, 0xe9
push esp
inc edx
pop ds
xor dword [edx], ebx
mov bl, 0x24
push edx
les esp, [eax]
add dh, al
xor eax, 0x872b44b0
hlt

Function at 0x4b6a10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
jmp fcn.006471f6
Function at 0x7dfb80
Capabilities:
Encode data using xor

Disassembly:
xor al, al
xor ecx, ecx
mov dl, byte [esp + ecx + 5]
xor al, dl
inc ecx
cmp ecx, 5
jl 0x7dfb84
xor ecx, ecx
mov dl, byte [esp + ecx + 0xa]
xor al, dl
inc ecx
cmp ecx, 0x12
jl 0x7dfb92
ret

Function at 0x7e66f0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, edi
xor ecx, ecx
sub ebp, edx
xor eax, eax
mov bl, cl
or bl, al
add bl, byte [eax + edi]
inc eax
add byte [edx], bl
cmp eax, 8
jl 0x7e6704
xor esi, esi
mov al, byte [esi + edi]
dec al
imul cl
xor byte [edx], al
inc esi
cmp esi, 8
jl 0x7e6715
mov al, byte [edx + ebp]
shl al, cl
inc ecx
inc edx
xor byte [edx - 1], al
cmp ecx, 8
jl 0x7e6702
pop edi
pop esi
pop ebp
pop ebx
ret