joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007f713
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x100d7204
call fcn.100cece0
sub esp, 0x64
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
mov ecx, dword [ebp + 8]
push esi
mov dword [esi + 0x10], eax
mov al, byte [ebx + 0x2c]
mov byte [esi + 0x69], al
cmp dword [ebx], 0x10900
mov edx, ebx
sete al
mov byte [esi + 0x68], al
call fcn.1007f8eb
xor edi, edi
cmp eax, edi
jne 0x1007f8da
mov ecx, dword [ebx + 0x80]
lea eax, [ebx + 0x80]
or ecx, dword [eax + 4]
jne 0x1007f76b
push 1
pop eax
jmp 0x1007f76d
xor eax, eax
test al, al
lea ecx, [ebp - 0x70]
mov dword [ebp + 0xc], edi
sete byte [ebp + 0x17]
call fcn.100786d5
mov eax, dword [esi + 0x24]
mov dword [ebp - 4], edi
cmp eax, edi
mov dword [ebp - 0x14], edi
jbe 0x1007f8bf
mov dword [ebp - 0x10], edi
mov eax, dword [esi + 0x20]
add eax, dword [ebp - 0x10]
cmp word [ebx + 0x20], 1
mov dword [ebp - 0x1c], eax
jne 0x1007f892
cmp word [eax + 0x20], 1
jne 0x1007f892
cmp byte [esi + 0x68], 0
mov eax, dword [esi + 0x60]
sete cl
movzx edi, cl
lea ecx, [esi + 0x5c]
add edi, eax
call fcn.10080f40
mov ecx, eax
mov edx, edi
mov dword [ebp - 0x18], ecx
call fcn.1002a3b4
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x70]
push dword [ebp - 0x18]
push esi
push ebx
push edi
push dword [ebp + 8]
call fcn.1007e9a8
test eax, eax
jne 0x1007f8aa
add edi, 0x2c
push 0x14
lea eax, [ebp - 0x30]
push edi
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
je 0x1007f826
cmp byte [ebx + 0x2c], 0
je 0x1007f8c5
xor eax, eax
cmp byte [edi + eax], 0
jne 0x1007f8c5
inc eax
cmp eax, 0x14
jb 0x1007f816
mov edi, dword [ebp - 0x18]
and dword [edi + 0x1c], 0
cmp dword [esi + 0x3c], 0
jne 0x1007f83e
push dword [ebp + 0x10]
lea ecx, [esi + 0x38]
call fcn.10080ecb
push 0xffffffffffffffff
push edi
mov ecx, esi
call fcn.1002a3b4
test eax, eax
jne 0x1007f8aa
cmp byte [ebp + 0x17], al
je 0x1007f892
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebx + 0x78]
cmp ecx, dword [eax + 8]
jne 0x1007f8a6
mov ecx, dword [ebx + 0x7c]
cmp ecx, dword [eax + 0xc]
jne 0x1007f8a6
and byte [ebp + 0x17], 0
mov cl, 1
cmp byte [ebx + 0x2d], 0
je 0x1007f892
cmp dword [eax + 0x24], 1
jne 0x1007f892
inc dword [ebp + 0xc]
mov eax, dword [ebx + 0x28]
cmp eax, dword [ebp + 0xc]
sete al
test cl, cl
je 0x1007f88a
test al, al
je 0x1007f8c5
test al, al
je 0x1007f892
test cl, cl
je 0x1007f8ae
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x40
mov eax, dword [ebp - 0x14]
cmp eax, dword [esi + 0x24]
jae 0x1007f8bf
jmp 0x1007f792
xor cl, cl
jmp 0x1007f86a
mov esi, eax
jmp 0x1007f8cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
push 1
pop eax
jmp 0x1007f8da
cmp byte [ebp + 0x17], 0
je 0x1007f8ca
push 1
pop esi
jmp 0x1007f8cc
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.1007dfbb
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
Function at 0x1008095a
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get process heap flags

Disassembly:
mov eax, 0x100d729c
call fcn.100cece0
sub esp, 0x18
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push str.CREATIONTIME
mov ecx, edi
lea edx, [esi + 4]
call fcn.10080ade
push str.LASTMODIFICATIONTIME
lea edx, [esi + 0xc]
mov ecx, edi
mov byte [esi], al
call fcn.10080ade
mov byte [esi + 1], al
lea eax, [ebp - 0x18]
push str.NAME
push eax
mov ecx, edi
call fcn.1002a3b4
and dword [ebp - 4], 0
lea edx, [esi + 0x14]
mov ecx, eax
call fcn.1002a3b4
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
mov byte [esi + 2], al
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.DIRCOUNT
push eax
mov ecx, edi
call fcn.1002a3b4
lea edx, [esi + 0x20]
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.1002a3b4
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x18]
mov dword [esp], str.FILECOUNT
push eax
mov ecx, edi
call fcn.1002a3b4
lea edx, [esi + 0x28]
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.1002a3b4
push dword [ebp - 0x18]
or dword [ebp - 4], 0xffffffff
call fcn.100034b3
lea eax, [ebp - 0x24]
mov dword [esp], str.INDEX
push eax
mov ecx, edi
call fcn.1002a3b4
lea edx, [esi + 0x30]
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.1002a3b4
push dword [ebp - 0x24]
mov byte [esi + 3], al
call fcn.100034b3
pop ecx
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x10080f88
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x100d731b
call fcn.100cece0
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [ebp - 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
or dword [esi + 0x20], 0xffffffff
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.1000250f
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x100851fe
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Get kernel32 base address

Disassembly:
mov eax, 0x100d78af
call fcn.100cece0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ax, word [edi]
lea ecx, [esi + 0x24]
mov word [esi], ax
mov ax, word [edi + 2]
mov word [esi + 2], ax
mov ax, word [edi + 4]
mov word [esi + 4], ax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x20]
mov dword [esi + 0x20], eax
lea eax, [edi + 0x24]
push eax
call fcn.10001da4
and dword [ebp - 4], 0
add edi, 0x30
push edi
lea ecx, [esi + 0x30]
call fcn.10085281
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x100c1f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, 1
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x44], eax
or eax, 0xffffffff
xor edi, edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov eax, dword [esi + 4]
mov dword [esi + 0x78], edi
mov dword [esi + 0x68], edi
cmp eax, 0x20
mov dword [esi + 0x7c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x70], edi
mov dword [esi + 0x88], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x84], edi
jbe 0x100c1fcb
mov eax, 0x20
mov ecx, dword [esi + 0x20]
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x58], edi
cmp eax, ecx
je 0x100c200c
lea ebx, [esi + 0xc8]
mov ebp, 0x20
cmp dword [ebx + 8], edi
je 0x100c1ff1
mov ecx, ebx
call fcn.100c1c50
add ebx, 0x28
dec ebp
jne 0x100c1fe5
mov edx, dword [esi + 0x5c]
cmp edx, edi
je 0x100c2007
mov ecx, dword [esi + 0x14]
call dword [ecx + 4]
mov dword [esi + 0x5c], edi
mov ecx, dword [esi]
mov dword [esi + 0x20], ecx
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.100c1b20
mov eax, dword [esi + 0x58]
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
lea edx, [eax + eax*4 + 0x19]
inc eax
mov dword [esi + 0x58], eax
lea ebp, [esi + edx*8]
mov ecx, ebp
call fcn.100c20b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x20]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
lea ecx, [ebp + 0x1c]
call fcn.100c86b0
mov ebx, eax
cmp ebx, edi
jne 0x100c206f
push ebp
call fcn.1002a3b4
mov ebx, eax
cmp ebx, edi
je 0x100c2084
mov ecx, esi
mov dword [esi + 0x44], edi
call fcn.100c20e0
cmp ebx, edi
jle 0x100c207f
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
je 0x100c2084
mov dword [esi + 0x40], ebx
cmp dword [esi + 0x38], edi
jne 0x100c2096
cmp dword [esi + 0x40], edi
jne 0x100c2096
cmp dword [esi + 0x3c], edi
jne 0x100c2096
mov dword [esi + 0x44], edi
mov eax, dword [esi + 0x44]
pop edi
neg eax
sbb eax, eax
pop esi
not eax
and eax, ebx
pop ebp
pop ebx
ret
Function at 0x421744
Capabilities:
Encode data using xor

Disassembly:
ja 0x4217af
dec ebx
or al, 0xa3
pop edx
push ds
add ch, ah
pop edi
jnp 0x42176f
mov word [esi - 0x5f], ds
inc esi
fistp dword [edi + 0x114fd891]
pop esi
mov eax, dword [0x919fdb46]
fmul dword [edi + 0x11]
or al, dh
lahf
xor byte [ebx - 0x6d79a229], dh
lds esp, [ebx]
in al, 0xbd
dec ebx
je 0x421751
xchg ebp, eax
inc edx
invalid
rol dword [ebx + 0x237ec39c], 1
out 0x11, eax
push ecx
btc dword [edi - 0xe9b31dc], ecx
invalid
push cs

Function at 0x47c4b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x46f490
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48cc80]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [0x48f4f0]
push eax
lea ecx, [esp + 0x34]
call fcn.0049fc04
lea esi, [esp + 0x34]
mov dword [esp + 0x6c], 0
call fcn.0047e7a4
push 0x47ba28
push eax
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x78], 1
call fcn.00475094
add esp, 0xc
mov byte [esp + 0x6c], 3
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x47c538
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x50]
call fcn.004b0d1a
mov ebx, dword [esp + 0x74]
lea eax, [ebx + 0x2d8]
push 0x47ba48
push eax
lea ecx, [esp + 0x30]
push ecx
mov byte [esp + 0x78], 4
call fcn.00475094
add esp, 0xc
lea edx, [esp + 0x50]
mov byte [esp + 0x6c], 5
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x38]
call fcn.0049fb34
mov byte [esp + 0x6c], 4
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x47c59e
mov ecx, dword [eax]
mov edx, dword [ecx]
adc dword [eax - 0x75], edx
inc edx
add al, 0xff
invalid
xor esi, esi
cmp dword [esp + 0x58], esi
Function at 0x4888a4
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
das
or dword [eax + ebp*2 - 0x53], esp
and byte [esi - 0x6f2cc66], dl
lahf
jbe 0x488924
adc eax, 0x29f7a7d5
add esi, ebp
fdivrp st(5)
nop
sbb byte [edi], dh
pop esi
nop
scasb al, byte es:[edi]
xchg dword [eax], ecx
mov bh, 0xef
out 0x85, al
ja 0x4888b1
xor ebx, dword [ebp + 3]
dec byte [ebx + 0x37]
mov bh, 0x59
sub dword [0xcf3dd15a], ebx
out dx, al
or bh, byte [esi]
sub dword [esi + esi*4 - 0x20], 0xffffffba
invalid
add ah, byte [edi]
push edx
pop esp
jp 0x48899d
xchg esi, eax
imul ebx, dword [edi + 0x5f], 0xb
hlt
mov fs, ebp
stc
jge 0x488965
cmp al, 0x88
push esi
mov ch, 0xfc
fstp dword [ebx + esi*2]
sbb al, 0x73
out 0x48, eax
sub dh, byte [edi + 0x4f]
stosd dword es:[edi], eax
xor dh, byte [ebx + 0x36]
pop ds
jae 0x488984
add bl, byte [eax + esi*4 + 0xdbc2737]
stosd dword es:[edi], eax
xor esi, dword [ecx - 0x19]
jno 0x48896d
call 0x9ffcf3b0
outsd dx, dword [esi]
in al, 0x24
in eax, dx
test al, 0x5d
inc esi
cmpsd dword [esi], dword es:[edi]
sub al, 0xc5
cwde
push eax
mov dword [0xe220ac4e], eax
sbb ebp, esp
in al, dx
jo 0x4889b1
sub dword [eax - 0x7c42f764], ecx
rcl dword [ebp + 0x47eddda8], 4
mov eax, dword [0x7a5016af]
scasd eax, dword es:[edi]
jp 0x488962
shr byte [ecx + ebx*2 + 0x30f8763f], 1
xchg byte [0xb8fabdf4], al
mov dh, 0xa7
nop
enter 0x2604, 0xffffffffffffffb3
les esi, [ebx + esi]
pop eax
dec byte ds:[edi - 0x4ed171b4]
xor ebx, dword [eax + 0x3e]
dec byte [edi - 0x4ed171b4]
sub edx, esp
pushfd
loopne 0x488974
xlatb
pushfd
rcr ecx, cl
sbb dword [ebx], edx
xchg edi, eax
pop eax
mov al, 0
jle 0x4889c9
lodsd eax, dword [esi]
jo 0x488a46
in al, dx
or dword [edx], 0x10
pop ebp
xor dword [ebp + edx + 0x729b0510], ebx
out 0xfd, al
out dx, eax
adc byte [edi - 0x2cff1e79], dl
add edi, ebx
add eax, 0xbc7937a3
sbb dword [eax], ebx
xchg esp, eax
push edi
add dword [eax - 0x77], esp
jnp 0x4889e7
cld
xchg edi, eax
out 0xc6, al
mov ebx, 0x2c419616
dec ebp
and ebx, ecx
loop 0x488a4b
xor al, 0xfb
daa
xchg edx, eax
imul eax, dword [ebx - 0x264c4fdd], 0x10
pushfd
add byte [eax - 0x3da297ea], 0x59
sbb al, 0x5b
pushal
cmp eax, dword es:[edx - 0x9781caf]
ret 0xbf21
imul eax, dword [ecx], 0x6555c8db
add byte [ebx], bl
add byte gs:[ebx], bl
push esp
das
outsb dx, byte [esi]
ljmp 0x7010
Function at 0x4970b4
Capabilities:
Encode data using xor

Disassembly:
pop ss
or edx, dword [ecx - 0x4a74e4bc]
xlatb
xor eax, 0x1bac69e5
push eax
pushal
dec esi
xchg esi, eax
mov bh, 0xb
ror dword [ebx + 0x14470a10], cl
and al, 0xc2
push esp
jp fcn.004970b4
and al, 0xb6
push ss
inc edi
cdq
push esi
or ebx, ecx
sbb byte [esi + 0x1f11064c], cl
pop ds
bnd je 0x4970c1
cmp dh, byte [edx - 0x32b3f27b]
xor eax, 0x371eddf3
test eax, 0x5ae631ac
cmp dword [esi - 0x34fa7488], eax
cld
and ebx, dword [ecx + 0xb]
xor eax, 0x3eaaf0f7
or cl, byte [eax + 0x2c]
jno 0x497128
inc edx
jno 0x4970e1
mov edi, 0x6914c030
add eax, 0xf52cf79
invalid
pop ebp

Function at 0x49761c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cli
aam 0x2e
lcall 0xc158, 0xedf37c94
in eax, dx
pop eax
invalid
inc ebp
invalid

Function at 0x497640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movsd dword es:[edi], dword [esi]
jns 0x4975ef
leave
out dx, eax
cmp dword [ecx + esi], eax
add al, 0x31

Function at 0x4ac00a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
js 0x4ac011
add byte [ebx - 0x3f7af73c], al
Function at 0x4acc2f
Capabilities:
Encode data using xor

Disassembly:
pop ebp
or byte [ecx - 0x10], dh
sbb eax, 0xc560465
mov eax, dword [0x95bc63b9]
xlatb
out 0xdc, eax
mov byte [edx + eax + 0x41], dh
and eax, esi
mov cl, byte [ebx - 0x2ec58c1b]
jecxz 0x4acc16
jae 0x4acc6d
shl esp, 1
fmul dword [esi - 0x316d83dc]
jecxz 0x4acc16
jae 0x4acc6d
shl esp, 1
fmul dword [esi - 0x316d83dc]
jecxz 0x4acc52
dec esp
jae 0x4acc50
std
invalid
mov eax, dword [0xc0d431cc]
arpl word [eax], di
popal
jo 0x4acc48
cmc
test dword [edi], edx
push 0x6417e146
adc al, 0x50
xor ecx, dword [eax - 5]
cmp ch, ah
cdq
mov cl, 0xba
push esi
mov esp, 0x6bafb025
add eax, edx
lcall 0x8b64, 0xee5b5a2c
or al, 8
sub al, 0x5a
pop ebx
out dx, al
mov ecx, dword fs:[eax + ecx]
add byte [esi + 0x3545350f], dl
adc di, si
mov eax, 0x45aef481
mov eax, dword [0xd6168024]
mov esp, 0xcd8faef
add dword [ecx], esp
test eax, 0x7065c35b
rcl byte [0x631f535f], 0x17
and byte [ebp + 0x44], dl
sub eax, 0xfdc0d2d7
cld
sub eax, 0xe6f6c7d6
push eax
pop es
idiv dword [edx + 0x2841ed3]
mov edi, ebx
xchg ecx, eax
pop esp
mov edx, 0x5e071119
sub dword [esi + 0x32], ebx
push 0xf01e4379
push ds
invalid
invalid

Function at 0x4ad612
Capabilities:
Encode data using xor

Disassembly:
aas
xor dword [edx + edi*2 - 0x3da0a7a2], ecx
nop
xor dh, byte [edx + 0x4b]
pop esp
mov bh, 0x79
fcmovnb st(0), st(5)
adc dword [ebp - 0x7d4ca9e9], esp
fsub st(1), st(0)
push ebx
fadd st(5), st(0)
push ebx
mov dword [0x337d97cf], eax
mov dword [0x54b12c81], eax
retf
or byte ss:[ebx], bh
push edi
mov eax, dword [0xb6f916d1]
push esp
add al, 0xc4
fist word [ecx + ebx - 0x63]
jmp 0x4ad588
dec edi
push cs
out dx, al
popaw
dec esi
stc
shr dword [0x7cb941a7], cl
jne 0x4ad5b5
mov dl, 0xb5
inc ebp
invalid

Function at 0x4ad8a4
Capabilities:
Encode data using xor

Disassembly:
int1
sti
call 0xf6e6a9e8
mov ah, 0xfd
invalid
mov dl, 0x4e
iretd
cwde
adc esp, dword [ebx]
std
in eax, dx
loope 0x4ad860
inc eax
jne 0x4ad8f2
int 0xac
div byte [ecx + 0x2f]
dec esi
invalid
lodsd eax, dword [esi]
xchg edx, eax
setnp byte [edi - 0x45eb1210]
adc al, 0xba
loope 0x4ad86d
sub al, 0xc5
enter 0x549d, 0x35
add dh, byte [ebp + 0x40]
mov dword [0x1dc2d9c0], eax
xchg ebp, eax
scasd eax, dword es:[edi]
lahf
and ecx, dword [ebx + ebp*2 - 0x40]
xchg ebx, eax
add al, 0x19
sub dh, ch
sbb al, 0xb7
loop 0x4ad900
jmp 0x4ad8c3
aam 0xaf
cmp al, 0x6a
test eax, 0x316de7de
xchg edx, esi
sbb dh, dh
and al, 0xab
xor dword [edi + 0x24f61af2], eax
stosd dword es:[edi], eax
mov dword [eax], ebx
add esp, dword [ecx + 0x2445d4e3]
mov eax, dword [0x2445d4e3]
js 0x4ad8fa
fdivr qword [ebp - 0x73]
mov ah, 0x34
xchg ecx, eax
push eax
mov dword [0x1c4376f7], eax
sbb byte [ebx + 0x67ef915b], 0x72
and eax, 0xd1f1d474
and dword [edi], ebp
into
and edi, ebp
push edi
shl dword [edi + 0x70], 0x91
inc edx
jns 0x4ad8bc
invalid

Function at 0x4b0fec
Capabilities:
Encode data using xor

Disassembly:
pop ecx
cmc
cmp dh, ah
fstp xword [edx]
cmc
cmp dl, dh
clc
xor dh, bh
push ecx
mov esi, 0xfd52be71
xor bh, ch
sar dword [esp + ecx*2], cl
xor ebx, edi
idiv byte [edx]
sti
push esi
mov esi, 0xfb58b24c
xor eax, 0xf903d1f9
xor eax, 0xf934fbdb
push eax
xor edi, dword [edx + esi*4 + 0x5e]
invalid
Function at 0x4bcbc1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c6348
cmp edx, dword [eax]
je 0x4bcbe3
add eax, 8
inc ecx
cmp eax, 0x4c63d8
jl 0x4bcbd4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c6348]
jne 0x4bcd11
mov eax, dword [0x4caccc]
cmp eax, 1
je 0x4bcceb
test eax, eax
jne 0x4bcc14
cmp dword [0x4c6274], 1
je 0x4bcceb
cmp edx, 0xfc
je 0x4bcd11
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bcc4b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bd5a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bda30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bcc8e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bda30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c1cf4
push edi
call fcn.004bf900
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bd5a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bd5b0
lea eax, [ebp - 0xa0]
push 0x4c1cd4
push eax
call fcn.004bd5b0
push dword [esi + 0x4c634c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bd5b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bf874
add esp, 0x2c
pop edi
jmp 0x4bcd11
lea eax, [ebp + 8]
lea esi, [esi + 0x4c634c]
push 0
push eax
push dword [esi]
call fcn.004bda30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x403f80
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
push esi
push edi
xor edx, eax
mov edi, ecx
imul ecx, edx, 0x1000193
mov eax, ebx
shr eax, 0x10
movzx eax, al
mov edx, dword [edi + 0xc]
mov esi, dword [edi + 4]
xor ecx, eax
mov dword [ebp - 4], edi
imul ecx, ecx, 0x1000193
mov eax, ebx
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edi + 0x18]
and ecx, eax
mov eax, dword [edx + ecx*8]
add ecx, ecx
mov edi, dword [edx + ecx*4]
lea edx, [edx + ecx*4]
cmp edi, esi
jne 0x403fea
mov ecx, esi
jmp 0x403fef
mov ecx, dword [edx + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x403ffc
cmp dword [eax + 8], ebx
je 0x403ffe
mov eax, dword [eax]
jmp 0x403fe2
mov eax, esi
cmp eax, esi
jne 0x404059
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
mov esi, dword [eax]
lea eax, [ebp - 0xc]
push eax
mov edi, dword [esi + 4]
push edi
push esi
call fcn.00407180
mov edx, eax
mov ecx, 0xffffffe
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x404078
inc eax
mov ecx, ebx
mov dword [ebx + 8], eax
mov dword [esi + 4], edx
mov dword [edi], edx
mov eax, dword [ebx + 4]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00406a90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebx
push str.error_command_table_add__08X
push 0x4be530
push 0
call dword [sym.imp.PAL.dll_PalDebugPrintf]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push str.list_T__too_long
call fcn.004703b0
int3
Function at 0x405560
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ebx, ecx
movzx eax, byte [edi + 8]
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
movzx eax, byte [edi + 9]
xor edx, eax
movzx eax, byte [edi + 0xa]
imul edx, edx, 0x1000193
xor edx, eax
movzx eax, byte [edi + 0xb]
imul ecx, edx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
lea edx, [ecx*8]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x4055d3
cmp eax, edi
jne 0x4055cb
mov eax, dword [ebx + 4]
mov dword [ecx], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 4]
mov dword [edx + ecx + 4], eax
jmp 0x4055db
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x4055db
cmp eax, edi
jne 0x4055de
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0x10
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.004704a4
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x408a70
Capabilities:
Print debug messages

Disassembly:
push ebx
push esi
push edi
push 0
call dword [sym.imp.PAL.dll_PalTaskGetTaskData]
add esp, 4
xor esi, esi
lea ebx, [eax + 0x338]
lea edi, [ebx + 0x25acc]
nop dword [eax]
mov eax, dword [edi]
test eax, eax
je 0x408aa4
push eax
call dword [sym.imp.PAL.dll_PalSoundPlayIs]
add esp, 4
test eax, eax
jne 0x408b11
inc esi
add edi, 0x44
cmp esi, 8
jl 0x408a90
mov ecx, ebx
call fcn.00408980
cmp eax, 0xffffffff
je 0x408b11
imul edi, eax, 0x2c
add edi, ebx
cmp dword [edi + 0x262c8], 0
je 0x408b11
cmp dword [edi + 0x262d0], 0
mov dword [edi + 0x262c8], 0
je 0x408b11
push 2
push dword [ebx + 0x55e58]
mov edx, 2
mov ecx, ebx
call fcn.00467dd0
mov eax, dword [ebx + 0x55e5c]
lea ecx, [ebx + 0x55e50]
add esp, 8
add eax, dword [edi + 0x262d0]
mov dword [ebx + 0x55e58], eax
pop edi
pop esi
pop ebx
jmp fcn.004669e0
pop edi
pop esi
pop ebx
ret

Function at 0x40c1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x4d4008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 5
lea eax, [ebp - 0x310]
mov esi, ecx
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
js 0x40c29b
mov eax, dword [esi + 4]
push edi
add eax, 0x208
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [esi + 4]
lea ecx, [edi + 0x410]
lea edx, [edi + 0x104]
push ecx
test eax, eax
je 0x40c23b
lea eax, [edi + 0x208]
push eax
push edx
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push str._s_s_s_s_save
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
jmp 0x40c258
push edx
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push str._s_s_s_save
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x108]
mov ecx, esi
mov edx, eax
sub ecx, edx
pop edi
lea edx, [ecx + 8]
nop dword [eax + eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x40c270
mov dword [esi + 0x214], 1
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00470463
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00470463
mov esp, ebp
pop ebp
ret