joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410da0
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x4b7a00
push edi
call fcn.0049e90a
mov esi, eax
add esp, 8
test esi, esi
jne 0x410dd9
push 0x3e8
call dword [0x4b72d0]
push 0x4b7a00
push edi
call fcn.0049e90a
mov esi, eax
add esp, 8
test esi, esi
je 0x410df1
push esi
push 1
lea eax, [esp + 0x18]
push 4
push eax
call fcn.0049ea83
push esi
call fcn.0049e6ae
add esp, 0x14
pop edi
pop esi
ret

Function at 0x428267
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x52f83c]
mov ecx, dword [0x529fec]
push eax
push ecx
push edi
push 0x4b7b68
lea edx, [esp + 0x1c]
push 0x400
push edx
call fcn.0049e50b
lea eax, [esp + 0x24]
push 0x4b7a00
push eax
call fcn.0049e90a
mov esi, eax
add esp, 0x20
test esi, esi
je 0x428293
mov ecx, dword [0x52a5bc]
mov edx, dword [0x52a5c0]
push ecx
push 0x61a8
push edx
call fcn.004118a0
push esi
push 1
mov dword [0x52a5bc], eax
mov eax, dword [0x52a5c0]
push 0x186a0
push eax
call fcn.0049ea83
push esi
call fcn.0049e6ae
add esp, 0x20
inc dword [0x52f83c]
sub ebx, 1
jne 0x428220
jmp 0x4283c8
jmp 0x4283d2
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e2ba
add esp, 0x404
ret

Function at 0x439d88
Capabilities:
Encode data using xor

Disassembly:
push edi
adc ch, byte [edx]
or bh, byte [edi]
jnp 0x439de6
mov edi, 0x16521a47
ja 0x439e13
in al, 0xbd
xor ah, byte [ebx]
mov dl, byte [esi + 0x1e]
aas
adc dl, byte [edi + esi*8]
xor byte [ecx + 0x62fcaa1], 0x41
push es
inc ecx
das
ja 0x439da6
neg byte [esi + eax*4 + 0x283208e3]
rcl cl, 1
pop ebx
xor bl, byte [esi + esi*8 + 0x12b19572]
imul esi, dword [ebx + 0x26ebb646], 0x43ca7053
inc ebx
sub dword [ecx + 0x239be55a], eax
lcall 0x456b, 0x5012e5c2
jns 0x439e4b
pop ss
push edx
fmul dword [edi]
or bl, byte [edx]
fdiv qword [ebx]
sbb byte [ebp + esi*4 + 0x582f5cc0], cl
das
pop eax
test eax, 0x63d8d0dc
add ah, cl
wait
adc edi, ecx
inc ecx
in eax, dx
les eax, [ecx + 0x7831a6c0]
xor byte [edx + 0x30], 0xc0
not dword [ebx - 0x3e]
test al, 0x16
jae 0x439de4
in eax, dx
push edx
fiadd dword [edx + 0x5e]
scasd eax, dword es:[edi]
inc esi
arpl word [ebx + 0xc8260c1], bp
mov bh, 0xe4
adc byte [esp + ebx*8], bh
in al, 0x10
cmp al, 0xdc
jne 0x439e97
cmp dword [ebp + 0x1a3ffc6d], 0x53
push ss
fldenv [edx - 0x717d1dc0]
pop esp
scasb al, byte es:[edi]
adc al, 0x30
or byte [ebp + 0x31d24ed3], cl
cmp bh, byte [esi + 0xa]
mov esp, 0xd1b3853f
adc al, byte [esi - 0x2e52cfa2]
cdq
dec ah

Function at 0x442181
Capabilities:
Encode data using xor

Disassembly:
push edx
and dword [eax], edx
mov gs, word [ebp + 0xf]
push ebp
pop edx
outsb dx, byte [esi]
push 0xf9c38f9c
pop ecx
invalid
Function at 0x454ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push fcn.004b5c46
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x528ab0]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x528ab0]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
jmp 0x454d25
xor ebp, ebp
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov eax, dword [0x4ba2e0]
mov ecx, dword [0x4ba2e4]
mov edx, dword [0x4ba2e8]
mov byte [0x4489004b], al
and al, 0x54
mov ax, word [0x4ba2ec]
mov dword [esp + 0x58], ecx
mov cl, byte [0x4ba2ee]
mov dword [esp + 0xf0], ebp
mov dword [esp + 0x5c], edx
mov word [esp + 0x60], ax
mov byte [esp + 0x62], cl
cmp dword [0x52bf88], ebp
je 0x454da0
mov edx, dword [0x4ba2d0]
mov eax, dword [0x4ba2d4]
mov ecx, dword [0x4ba2d8]
mov dword [esp + 0x54], edx
mov dl, byte [0x4ba2dc]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x60], dl
call fcn.00407890
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.00439610
add esp, 8
test eax, eax
jne 0x454dd5
cmp dword [0x52bf88], ebp
je 0x454e3b
mov eax, dword [0x52c4e4]
push 0x1388
push eax
call dword [0x4b72c0]
xor esi, esi
cmp dword [0x52f794], ebp
jle 0x454e26
jmp 0x454e00
mov eax, dword [esi*4 + 0x52e498]
push eax
call fcn.00493611
mov eax, dword [esi*4 + 0x52a9d8]
push eax
call fcn.00493611
inc esi
add esp, 8
cmp esi, dword [0x52f794]
jl 0x454e00
mov ecx, dword [0x52c4e4]
push ecx
mov dword [0x52f794], ebp
call fcn.00405340
add esp, 4
push 1
push ebp
push 0x4b850c
lea ecx, [esp + 0x28]
call fcn.004299f0
mov esi, eax
cmp esi, ebp
jl 0x454f6c
Function at 0x454d46
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push fcn.004b5c46
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x528ab0]
xor eax, esp
mov dword [esp + 0xd0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x528ab0]
xor eax, esp
push eax
lea eax, [esp + 0xe8]
mov dword fs:[0], eax
jmp 0x454d25
xor ebp, ebp
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebp
mov byte [esp + 0x20], 0
mov eax, dword [0x4ba2e0]
mov ecx, dword [0x4ba2e4]
mov edx, dword [0x4ba2e8]
mov byte [0x4489004b], al
and al, 0x54
mov ax, word [0x4ba2ec]
mov dword [esp + 0x58], ecx
mov cl, byte [0x4ba2ee]
mov dword [esp + 0xf0], ebp
mov dword [esp + 0x5c], edx
mov word [esp + 0x60], ax
mov byte [esp + 0x62], cl
cmp dword [0x52bf88], ebp
je 0x454da0
mov edx, dword [0x4ba2d0]
mov eax, dword [0x4ba2d4]
mov ecx, dword [0x4ba2d8]
mov dword [esp + 0x54], edx
mov dl, byte [0x4ba2dc]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], ecx
mov byte [esp + 0x60], dl
call fcn.00407890
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x58]
push ecx
call fcn.00439610
add esp, 8
test eax, eax
jne 0x454dd5
cmp dword [0x52bf88], ebp
je 0x454e3b
mov eax, dword [0x52c4e4]
push 0x1388
push eax
call dword [0x4b72c0]
xor esi, esi
cmp dword [0x52f794], ebp
jle 0x454e26
jmp 0x454e00
mov eax, dword [esi*4 + 0x52e498]
push eax
call fcn.00493611
mov eax, dword [esi*4 + 0x52a9d8]
push eax
call fcn.00493611
inc esi
add esp, 8
cmp esi, dword [0x52f794]
jl 0x454e00
mov ecx, dword [0x52c4e4]
push ecx
mov dword [0x52f794], ebp
call fcn.00405340
add esp, 4
push 1
push ebp
push 0x4b850c
lea ecx, [esp + 0x28]
call fcn.004299f0
mov esi, eax
cmp esi, ebp
jl 0x454f6c
Function at 0x454edd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.00407cf0
cmp dword [esp + 0x34], 0x10
jb 0x4554af
mov edx, dword [esp + 0x20]
push edx
jmp 0x4554a7
push 1
lea edx, [esi + 1]
push edx
push 0x4b850c
lea ecx, [esp + 0x28]
call fcn.004299f0
mov ebp, eax
cmp ebp, 0xffffffff
je 0x454dbb
mov ebx, ebp
sub ebx, esi
lea eax, [ebx + 2]
push eax
call fcn.0049361c
add esp, 4
cmp dword [esp + 0x34], 0x10
mov edi, eax
mov eax, dword [esp + 0x20]
jae 0x454e96
lea eax, [esp + 0x20]
inc ebx
push ebx
add eax, esi
push eax
push edi
call fcn.0049f180
add esp, 0xc
push 1
mov ecx, edi
sub ecx, esi
push ebp
mov byte [ecx + ebp + 1], 0
push 0x4b7d20
lea ecx, [esp + 0x28]
call fcn.004299f0
mov esi, eax
push 2
inc esi
push esi
push 0x4b8508
lea ecx, [esp + 0x28]
call fcn.004299f0
mov ebp, eax
test esi, esi
je 0x45548d
cmp ebp, 0xffffffff
je 0x45548d
dec ebp
mov eax, ebp
sub eax, esi
mov dword [esp + 0x14], eax
add eax, 2
push eax
call fcn.0049361c
add esp, 4
cmp dword [esp + 0x34], 0x10
mov ebx, eax
mov eax, dword [esp + 0x20]
jae 0x454f0b
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x14]
inc edx
push edx
add eax, esi
push eax
push ebx
call fcn.0049f180
mov eax, ebx
sub eax, esi
push ebx
push edi
mov byte [eax + ebp + 1], 0
call fcn.00407220
add esp, 0x14
cmp dword [0x52bf88], 0
jne 0x454f40
push ebx
push edi
call fcn.0043e820
add esp, 8
push edi
call fcn.00493611
push ebx
call fcn.00493611
add esp, 8
push 1
push ebp
push 0x4b850c
lea ecx, [esp + 0x28]
invalid
nop
dec edx
Function at 0x455586
Capabilities:
Write file on windows

Disassembly:
push edx
lea eax, [esp + 0x68]
push eax
call fcn.0049f180
lea eax, [esp + 0x184]
add esp, 0x10

Function at 0x455617
Capabilities:
Write file on windows

Disassembly:
mov ebx, edx
cmp dword [0x52f814], esi
je 0x455605
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [0x52f814], esi
mov eax, dword [0x52f78c]
cmp eax, esi
je 0x45564a
mov esi, ebp
sub esi, dword [esp + 0x38]
mov ecx, ebx
sbb ecx, dword [esp + 0x3c]
dec esp
and al, 0x3c
cdq
cmp ecx, edx
jl 0x455648
jg 0x455625
cmp esi, eax
jbe 0x455648
cmp dword [0x51a0b8], 0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
je 0x45563b
call fcn.00429610
push 0x4b7a90
call fcn.00423150
add esp, 4
xor esi, esi
mov eax, ebp
sub eax, dword [esp + 0x24]
mov ecx, ebx
sbb ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
js 0x4556d0
jg 0x455663
cmp eax, 0x3c
jbe 0x4556d0
mov edi, 1
cmp dword [0x52f808], edi
jne 0x4556aa
cmp dword [0x52f804], esi
jne 0x4556aa
cmp dword [0x52f80c], esi
jne 0x4556aa
mov edx, dword [0x52d87c]
push 0x1388
push edx
call dword [0x4b72c0]
mov eax, dword [0x52d87c]
push eax
mov dword [str.FindNextFileA], 0xb4
call fcn.00405340
add esp, 4
push esi
lea ecx, [esp + 0x44]
inc esp
push ecx
lea edx, [esp + 0x17c]
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
call fcn.0042ede0
add esp, 0xc
test eax, eax
jne 0x455a6c
mov edi, dword [str.FindNextFileA]
mov esi, ebp
sub esi, dword [esp + 0x14]
mov ecx, ebx
sbb ecx, dword [esp + 0x18]
mov eax, edi
cdq
cmp ecx, edx
jl 0x455997
jg 0x4556f7
cmp esi, eax
jbe 0x455997
lea eax, [esp + 0x5c]
mov eax, dword [0x52e0d8]
push 0x1388
push eax
call dword [0x4b72c0]
mov ecx, dword [0x52e0d8]
push ecx
mov dword [0x52f7e0], edi
call fcn.00405340
add esp, 4
jmp 0x456059
jmp 0x456063
cmp dword [esp + 0x58], 0x10
jb 0x456077
mov edx, dword [esp + 0x44]
push edx
call fcn.00493611
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
Function at 0x45563f
Capabilities:
Write file on windows

Disassembly:
mov ebx, edx
cmp dword [0x52f814], esi
je 0x455605
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [0x52f814], esi
mov eax, dword [0x52f78c]
cmp eax, esi
je 0x45564a
mov esi, ebp
sub esi, dword [esp + 0x38]
mov ecx, ebx
sbb ecx, dword [esp + 0x3c]
dec esp
and al, 0x3c
cdq
cmp ecx, edx
jl 0x455648
jg 0x455625
cmp esi, eax
jbe 0x455648
cmp dword [0x51a0b8], 0
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebx
je 0x45563b
call fcn.00429610
push 0x4b7a90
call fcn.00423150
add esp, 4
xor esi, esi
mov eax, ebp
sub eax, dword [esp + 0x24]
mov ecx, ebx
sbb ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
js 0x4556d0
jg 0x455663
cmp eax, 0x3c
jbe 0x4556d0
mov edi, 1
cmp dword [0x52f808], edi
jne 0x4556aa
cmp dword [0x52f804], esi
jne 0x4556aa
cmp dword [0x52f80c], esi
jne 0x4556aa
mov edx, dword [0x52d87c]
push 0x1388
push edx
call dword [0x4b72c0]
mov eax, dword [0x52d87c]
push eax
mov dword [str.FindNextFileA], 0xb4
call fcn.00405340
add esp, 4
push esi
lea ecx, [esp + 0x44]
inc esp
push ecx
lea edx, [esp + 0x17c]
push edx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x34], ebx
call fcn.0042ede0
add esp, 0xc
test eax, eax
jne 0x455a6c
mov edi, dword [str.FindNextFileA]
mov esi, ebp
sub esi, dword [esp + 0x14]
mov ecx, ebx
sbb ecx, dword [esp + 0x18]
mov eax, edi
cdq
cmp ecx, edx
jl 0x455997
jg 0x4556f7
cmp esi, eax
jbe 0x455997
lea eax, [esp + 0x5c]
mov eax, dword [0x52e0d8]
push 0x1388
push eax
call dword [0x4b72c0]
mov ecx, dword [0x52e0d8]
push ecx
mov dword [0x52f7e0], edi
call fcn.00405340
add esp, 4
jmp 0x456059
jmp 0x456063
cmp dword [esp + 0x58], 0x10
jb 0x456077
mov edx, dword [esp + 0x44]
push edx
call fcn.00493611
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi

Function at 0x455706
Capabilities:
Write file on windows

Disassembly:
push 0x4b7a00
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
pop esp
and al, 0x20
mov dword [esp + 0x24], edi
call fcn.0049e90a
add byte [ebx + 0x8c483f0], cl
test esi, esi
jne 0x45573e
invalid
push 0x3e8
call dword [0x4b72d0]
lea ecx, [esp + 0x5c]
push 0x4b7a00
push ecx
call fcn.0049e90a
mov esi, eax
add esp, 8
test esi, esi
je 0x455756
push esi
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.0049ea83
push esi
call fcn.0049e6ae
add esp, 0x14
cmp dword [0x52bf88], 0
jne 0x4557c1
cmp byte [0x51a034], 0
jne 0x4557c1
lea eax, [esp + 0x40]
push eax
push 0x4b83d4
call fcn.00439610
add esp, 8
test eax, eax
je 0x4557c1
cmp dword [esp + 0x54], 4
jbe 0x4557a4
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0x455794
lea eax, [esp + 0x44]
push 0xb
push eax
push 0x51a034
call fcn.0049e2d0
add esp, 0xc
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0x4557b3
lea eax, [esp + 0x44]
push eax
push 0x4b9174
call fcn.00407220
add esp, 8
lea ecx, [esp + 0x40]
push ecx
push 0x4ba314
call fcn.00439610
add esp, 8
test eax, eax
jne 0x4557f1

Function at 0x45571a
Capabilities:
Write file on windows

Disassembly:
and ebp, dword [eax - 0x18]
add eax, dword [eax]
add bh, bh
adc eax, 0x4b72d0
Function at 0x455729
Capabilities:
Write file on windows

Disassembly:
push 0x4b7a00
push eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
pop esp
and al, 0x20
mov dword [esp + 0x24], edi
call fcn.0049e90a
add byte [ebx + 0x8c483f0], cl
test esi, esi
jne 0x45573e
invalid
push 0x3e8
call dword [0x4b72d0]
lea ecx, [esp + 0x5c]
push 0x4b7a00
push ecx
call fcn.0049e90a
mov esi, eax
add esp, 8
test esi, esi
je 0x455756
push esi
push 1
lea edx, [esp + 0x24]
push 4
push edx
call fcn.0049ea83
push esi
call fcn.0049e6ae
add esp, 0x14
cmp dword [0x52bf88], 0
jne 0x4557c1
cmp byte [0x51a034], 0
jne 0x4557c1
lea eax, [esp + 0x40]
push eax
push 0x4b83d4
call fcn.00439610
add esp, 8
test eax, eax
je 0x4557c1
cmp dword [esp + 0x54], 4
jbe 0x4557a4
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0x455794
lea eax, [esp + 0x44]
push 0xb
push eax
push 0x51a034
call fcn.0049e2d0
add esp, 0xc
cmp dword [esp + 0x58], 0x10
mov eax, dword [esp + 0x44]
jae 0x4557b3
lea eax, [esp + 0x44]
push eax
push 0x4b9174
call fcn.00407220
add esp, 8
lea ecx, [esp + 0x40]
push ecx
push 0x4ba314
call fcn.00439610
add esp, 8
test eax, eax
jne 0x4557f1
Function at 0x4557d7
Capabilities:
Write file on windows

Disassembly:
xor esi, esi
push esi
call fcn.0049df09
add esp, 4
mov ebp, eax
lea edx, [esp + 0x40]
push edx
push 0x4ba314
call fcn.00439610
add esp, 8
test eax, eax
je 0x4558c0
push 6
push 0
push 0x4ba30c
lea ecx, [esp + 0x4c]
mov dword [esp + 0x28], 1
call fcn.004299f0
test eax, eax
jl 0x455829
push 0
push 0
push 0
push 0x440b00
push 0
push 0
call dword [0x4b722c]
jmp 0x455997
push 4
push 0
push 0x4ba304
lea ecx, [esp + 0x4c]
call fcn.004299f0
test eax, eax
jl 0x4558a5
lea eax, [esp + 0x40]
push eax
call fcn.00442820
mov ecx, dword [0x52d87c]
add esp, 4
push 0x1388
push ecx
call dword [0x4b72c0]
mov esi, dword [0x52f7ac]
mov edi, dword [0x52f7b0]
cmp esi, 2
jne 0x45589d
mov edx, dword [0x52d87c]
push edx
call fcn.00405340
push 0x4b7d19
mov eax, dword [0x52d87c]
push eax
jmp 0x4558ec
mov ecx, dword [0x52d87c]
push 0x1388
push ecx
call dword [0x4b72c0]
mov edx, dword [0x52d87c]
push edx
jmp 0x4558e0
mov eax, dword [0x52d87c]
push 0x1388
push eax
mov dword [esp + 0x24], 0
call dword [0x4b72c0]
mov ecx, dword [0x52d87c]
push ecx
mov edi, dword [0x52f7b0]
mov esi, dword [0x52f7ac]
call fcn.00405340
add esp, 4
cmp esi, 2
jne 0x455984
cmp dword [0x52bf88], 0
jne 0x455997
test edi, edi
jne 0x455937
cmp dword [0x52f840], 3
jge 0x455940
inc dword [0x52f840]
push edi
lea edx, [esp + 0x44]
push edx
push 0x4ba2f0
push 0x4b9298
call fcn.00430370
add esp, 0x10
jmp 0x455940
cmp dword [0x52f7e4], 0
je 0x455949
push edi
call fcn.00442310
add esp, 4
call fcn.00433010
call fcn.00432bd0
cmp dword [esp + 0x1c], 0
je 0x455997
mov eax, ebp
sub eax, dword [esp + 0x2c]
mov ecx, ebx
sbb ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
js 0x455997
jg 0x455975
cmp eax, 0xe10
jbe 0x455997
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebx
call fcn.004400e0
jmp 0x455997
call fcn.0044a350
test eax, eax
je 0x455997
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
push 0
push 0x4b7d19
lea ecx, [esp + 0x48]
call fcn.0042dc20
mov eax, dword [str.FindNextFileA]
cmp dword [esp + 0x34], eax
je 0x455a1d
push 0x52dd9c
mov dword [esp + 0x38], eax
call fcn.00423150
mov edx, dword [str.FindNextFileA]
lea eax, [esp + 0x60]
push 0x4b7a00
push eax
mov dword [esp + 0x28], edx
call fcn.0049e90a
mov esi, eax
add esp, 0xc
push 0x3e8
call dword [0x4b72d0]
push 0x52dd9c
call fcn.00423730
add esp, 4
test eax, eax
jne 0x4555e0
cmp dword [0x52f7e8], eax
jne 0x4555e0
cmp dword [0x52f7f4], eax
jne 0x4555e0
push 0x52e0e8
push 0x529ff0
call fcn.004029b0
add esp, 8
jmp 0x4555e0
Function at 0x456939
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
mov eax, dword [ebx]
lea edx, [ebp + 0x14]
push edi
push edx
lea edx, [ebp + 0x10]
push 1
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
or al, 0x52
push dword [ebx]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x45699d
cmp dword [ebp + 0x14], 1
jne 0x45699d
push dword [ebp + 0x10]
call dword [0x969504]
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [0x96986c]
add esp, 0xc
mov edi, eax
push dword [ebp + 0x10]
call dword [0x96951c]
test edi, edi
je 0x45699d
mov ecx, esi
call fcn.00456ba1
mov esi, eax
test esi, esi
jne 0x4569a1
xor eax, eax
jmp 0x4569ca
and word [esi + 4], 0
or edi, 4
push esi
mov dword [esi + 0xc], edi
push dword [ebx + 0x10]
call 0x5a4e550e
inc esi
mov es, word [edx + 0x4e]
push edi
pop ss
xor ebp, ecx
jecxz 0x4569b9
invalid
int3

Function at 0x469eb2
Capabilities:
Encode data using xor

Disassembly:
mov word [eax + 0x64a30096], ds
push 0xffffffffffffffb3
add byte [ebx], dh
sar byte [edi + 0xb36a68], 0xc7
add eax, 0xb36a54
sbb edi, dword [edi + 0x42]
add bh, al
add eax, 0xb36a58
loope 0x469f2a
inc edx
add byte [ebx - 0x74aa3ca1], ch
in al, dx
mov ecx, dword [ebp + 0xc]
push ebx
xor eax, eax
push esi
cmp word [ecx], 0xffff
push edi
jne 0x469ed4
mov edx, dword [ecx + 4]
mov edi, dword [ecx + 8]
mov cx, word [ecx + 2]
mov word [ebp + 0xc], cx
jmp 0x469edb
mov edx, ecx
xor edi, edi
mov dword [ebp + 0xc], eax
cmp edx, eax
jne 0x469ee6
shr edi, 2
mov eax, edi
jmp 0x469f2f
lea esi, [edx + 4]
mov dx, word [edx + 2]
cmp edi, eax
je 0x469f1a
inc edx
xor ebx, ebx
cmp dx, ax
jbe 0x469f2f
cmp bx, word [ebp + 0xc]
jne 0x469f08
mov ecx, edi
shr ecx, 2
xor eax, ecx
jmp 0x469f12
mov ecx, dword [esi]
shr ecx, 2
xor eax, ecx
add esi, 4
inc ebx
cmp bx, dx
jb 0x469ef9
jmp 0x469f2f
cmp dx, ax
jbe 0x469f2f
movzx ecx, dx
mov edx, dword [esi]
add esi, 4
shr edx, 2
xor eax, edx
dec ecx
jne 0x469f22
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x46a0b4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
mov ecx, dword [ecx + 4]
and eax, 0x7fffffff
mov dl, byte [ecx]
test dl, dl
je 0x46a0dc
push esi
mov esi, eax
shr esi, 0x1c
shl eax, 4
xor esi, eax
movzx eax, dl
xor eax, esi
inc ecx
mov dl, byte [ecx]
test dl, dl
jne 0x46a0c5
pop esi
ret
Function at 0x4773bb
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov eax, dword [esi]
cmp byte [esi + 0x41], 2
mov edi, dword [eax + 4]
jne 0x4773da
push ebx
push esi
call fcn.00476f31
pop ecx
pop ecx
mov eax, dword [esi + 0x18]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x4773ec
mov ecx, dword [eax + 0x48]
cmp ecx, dword [esi + 0x14]
je 0x477418
lea eax, [ebp + 8]
push ebx
push eax
push dword [esi + 0x14]
push edi
call fcn.00476e6b
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x477409
mov byte [esi + 0x41], bl
jmp 0x47745c
push dword [esi + 0x18]
call fcn.004763b1
mov eax, dword [ebp + 8]
pop ecx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov word [esi + 0x3a], bx
cmp word [eax + 0x14], bx
jne 0x47744c
cmp byte [eax + 4], bl
jne 0x47744c
movzx ecx, byte [eax + 8]
mov eax, dword [eax + 0x44]
lea eax, [ecx + eax + 8]
push eax
call fcn.00476370
push eax
push esi
mov byte [esi + 0x41], 1
call fcn.00477461
add esp, 0xc
mov eax, dword [esi + 0x18]
cmp word [eax + 0x14], bx
seta al
mov byte [esi + 0x41], al
mov eax, dword [ebp - 4]
pop edi
invalid
out dx, eax
add dword [eax], eax

Function at 0x477906
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push esi
push dword [ebp + 0x10]
call dword [0x9698cc]
mov ecx, dword [ebp + 0x24]
add esp, 0x1c
cmp eax, ebx
mov dword [ecx], eax
je 0x477928
mov eax, dword [ebp + 0x20]
mov dword [eax], esi
jmp 0x477928
xor eax, eax
pop edi
pop esi
pop ebx
jmp 0x477bcc
jmp 0x4781de
jmp 0x47850d
jmp 0x47862e
cmp dword [0x52f788], 0
jne 0x47b188
jmp 0x478640

Function at 0x478614
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [eax + 0x2c]
push dword [ebp + 0x14]
mov eax, dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi

Function at 0x47b114
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
mov dx, word [eax]
cmp dx, 4
add al, 0x73
invalid
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
test ecx, ecx
jg 0x47b12a
mov eax, 0x80070057
jmp 0x47b2f6
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov eax, dword [eax]
lea ecx, [ebx + ecx*2]
mov dword [ebp + 0x10], ecx
movzx ecx, dx
lea esi, [eax + edi]
cmp ecx, eax
mov dword [ebp - 4], esi
mov esi, ebx
jle 0x47b179
push eax
mov eax, dword [ebp + 0x1c]
sub eax, ecx
push edi
add eax, 4
push eax
call 0x9b0cd3
mov eax, dword [ebp + 0x14]
add esp, 0xc
and dword [eax], 0
mov eax, dword [ebp + 0xc]
mov cx, word [eax]
mov eax, dword [ebp + 0x18]
sub word [eax], cx
mov eax, 0x50000c
jmp 0x14b1b2f6
push eax
call 0x979087
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xb4], edi
jl 0x47b369
cmp byte [esi + eax], bl
je 0x47b369
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xb4]
push esi
push eax
call fcn.00484f06
add esp, 0xc
Function at 0x47d9e7
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov eax, dword [esi]
mov edi, dword [esi + 0x18]
mov eax, dword [eax + 4]
mov dword [ebp - 4], eax
call fcn.0047d7bf
pop ecx
movzx ecx, word [esi + 0x34]
add ecx, dword [esi + 0x20]
mov dword [ebp + 8], ecx
cmp byte [edi + 3], 0
je 0x47d9d0
xor eax, eax
jmp 0x47d9d3
mov eax, dword [esi + 0x28]
cmp dword [ebp + 0x18], 0
mov edi, dword [ebp + 0xc]
je 0x47d9de
add edi, eax
mov ebx, dword [ebp + 0x10]
mov edx, dword [esi + 0x30]
add edx, eax
lea eax, [edi + ebx]
add al, 0x1f
cmp eax, edx
jbe 0x47d9f5
xor eax, eax
inc eax
jmp 0x47dad0
movzx eax, word [esi + 0x36]
cmp edi, eax
jge 0x47da34
lea edx, [edi + ebx]
mov dword [ebp + 0xc], ebx
cmp edx, eax
jle 0x47da0c
sub eax, edi
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
add ecx, edi
push ecx
push dword [ebp + 0x14]
call 0x983492
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp eax, ebx
je 0x47dace
add dword [ebp + 0x14], eax
mov ecx, dword [ebp + 8]
xor edi, edi
sub ebx, eax
jmp 0x47da36
sub edi, eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x16]

Function at 0x47da3d
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub eax, 4
test ebx, ebx
mov dword [ebp + 0x18], eax
jle 0x47dace
movzx eax, word [esi + 0x36]
add eax, ecx
push eax
call fcn.0047cb72
pop ecx
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x47dac5
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push dword [eax]
call fcn.004940c3
add esp, 0xc
add bl, ch
daa
cmp eax, 0x72
je 0x47dae3
cmp eax, 0x74
clc
je 0x47db45
je 0x47dae3
adc dword [ebx + 0xc7422f8], eax
cmp eax, 0x22
je 0x47dae3
cmp eax, 0x27
je 0x47dae3
push 0xae580c
jmp 0x47dae8
push 0xae57ec
mov ecx, ebx
call fcn.004702e0
mov edx, dword [esi]
and byte [esi + 0x56], 0
lea eax, [esi + 0x19c]
mov ecx, esi
push eax
push ebx
call dword [edx + 0x90]
and byte [esi + 0x5d], 0
cmp dword [ebp + 8], 0xffffffff
jne 0x47db1d
cmp word [ebx + 0x40], 0
jne 0x47db1d
push ebx
call fcn.0047df84
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
push dword [ebp + edx - 0x75]
dec esi
sbb byte [ebx + 0x513b3c51], cl
dec esp
jbe 0x47db5d
test ebx, ebx
jle 0x47db5d
dec edx
mov dword [ecx + 0x3c], edx
mov byte [edx], bl
mov edx, dword [esi]
push eax
push edi
mov ecx, esi
call dword [edx + 0x60]
pop edi
pop esi
pop ebx
pop ebp
ret 4