joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44020f
Capabilities:
Packed with generic packer

Disassembly:
lea eax, [ebp - 0x570]
sub eax, 1
lea edi, [ebp - 0x14]
pop edi
je 0x440227
mov dword [ebp - 0x10], ecx
nop
jne 0x440225
cmp dword [ebp + 8], 0
mov ecx, dword [0x421eec]
push 0

Function at 0x441712
Capabilities:
Packed with generic packer

Disassembly:
push dword [edi + 0x14]
cmp dword [esp + 0x20], 0x15be359b
je 0x44176b
lea eax, [edi + 8]
cmp dword [esp + 0x30], 0xfc7b46ff
cmove edi, edx
cli
push eax
cmp dword [esp + 0x34], 0xc76ec06f
cmove edx, eax
push ecx
cmp edx, 0x60c591d
je 0x44172c
call fcn.0044176c
pop eax
inc si
push ecx
popal
push edi
bound ecx, qword [edi + 0x64]
insd dword es:[edi], dx
pop eax
dec esp
dec esp
push ebx
dec ebx
inc ecx
pushal
pop ebx
insb byte es:[edi], dx
dec esp
dec ebx
js 0x4417bb
push ebx
popal
pop esp
jns 0x4417cc
pop edx
insd dword es:[edi], dx
inc eax
push ecx
pop edi
jne 0x4417bd
mov edi, edi
jmp 0x4417ef
xor ecx, dword [edi + 0x43]
inc ebx
dec edx
dec ecx
pop ebx
je 0x4417cd
jmp 0x4417b6
or al, 0x24
jmp 0x44180a
invalid
and al, 0xeb
add byte [eax], al
add byte [ebp - 0x7c3c0bbb], cl
call 0x4c2a2ff
or eax, 0
push edi
imul ebx, dword [esi + 0x59], 0x60247c81
push edi
rol dword [ebx - 0x49], 0xf
mov bh, 0xf
test dword [eax], ebx
add byte [eax], al

Function at 0x442612
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
mov eax, dword [edx + 4]
test eax, eax
push 0xeede7c61
push ax
lahf
lock xchg word [esp], ax
push edi
call 0x44268a
dec edi
push ax
inc ecx
pop eax
pop edx
inc edx
pop eax
pop edi
dec esp
popal
outsd dx, dword [esi]
inc esi
inc esi
dec esp
pop esi
push 0x68
popal
pushal
inc ecx
inc esi
pop esp
insd dword es:[edi], dx
js 0x442694
pop edx
outsb dx, byte [esi]
arpl word [ecx + 0x64], cx
pop ecx
push edx
arpl word fs:[edx + 0x5a], dx
dec edx
pushal
imul eax, dword [edi + 0x51], 0x676c5679
push 0x5c
pop edx
push edi
bound esp, qword [edx + 0x4d]
dec ecx
pop ebp
imul edx, dword [ebx + 0x79], 0x595d4447
pop edi
dec ebp
pushal
dec edi
inc ebx
pop edi
dec esp
push edx
insb byte es:[edi], dx
inc esp
dec esp
jnp 0x4426e2
inc eax
inc esi
insd dword es:[edi], dx
popal
dec edi
imul ecx, dword [edi + 0x47], 0x3c8b4352
and al, 0x8d
and al, 4
call 0x442696
add byte [eax], al
mov dword [esp], ecx
mov ecx, 0xeede7052
cmove ecx, dword [esp + 0xa]
lea edi, [edi + ecx + 0x112190b2]
mov dword [esp + 0xa], edi
mov ecx, dword [esp]
lea esp, [esp + 4]
pop edi
lock xchg word [esp], ax
sahf
mov ax, word [esp]
lea esp, [esp + 2]
ret
leave
mov dword [ebp - 8], eax
pop ebp
jge 0x4426f2
push ebp
add ecx, 0x14
inc ebx
pop ebx
dec esp
js 0x442762
outsd dx, dword [esi]
pushal
xor eax, ebp
jne 0x442700
mov eax, esi
pop ecx
je 0x442704
push dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
pop esi
sub eax, 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x445f38
Capabilities:
Parse pe header

Disassembly:
popal
jns 0x445fa8
inc ebp
bound ebp, qword [esi + 0x63]
outsd dx, dword [esi]
dec ebp
pop eax
push 0x5c
js 0x445f92
pushal
arpl word [ebp + 0x49], dx
outsd dx, dword [esi]
js 0x445f94
push edx
pop sp
dec ecx
pop edi
inc edx
push ebp
pop edi
push edx
inc esi
push esp
inc edi
pop ebp
push 0x62
bound eax, qword [edi + 0x45]
inc edx
dec edx
dec edi
inc ebp
jns 0x445fc4
pop edx
inc edx
js 0x445fbd
push ebp
inc esi
arpl word [edx + 0x68], bx
pop edi
imul edx, dword [eax + 0x4e], 0x4e
and al, 0x8d
and al, 4
jmp 0x445fc7
add al, 0x42
add byte [eax], al
add byte [ecx], al
add dword [edi], ecx
Function at 0x4460a8
Capabilities:
Parse pe header

Disassembly:
dec ecx
pop ecx
bound edi, qword [ebx + 0x4d]
push esp
dec esp
insb byte es:[edi], dx
bound ebp, qword [ecx + 0x54]
push edi
dec ebx
pop edi
dec edi
outsd dx, dword [esi]
dec ebp
push ebx
pop bx

Function at 0x4471fe
Capabilities:
Terminate process

Disassembly:
add byte [ecx - 0x387edbcc], cl
leave
or ah, byte [ebp + 0x36]
arpl word [ebp + 0x60], dx
inc ebx
outsb dx, byte [esi]
dec ebp
inc ebx
jnp 0x447177
push ecx
push eax
bound esp, qword [eax + 0x64]
push ebp
dec ecx
pop eax
push edi
inc edx
inc eax
inc esi
dec edx
inc edx
push ecx
pop edi
pop edx
pop esp
pop edx
outsd dx, dword [esi]
outsb dx, byte [esi]
outsb dx, byte [esi]
push esi
inc ecx
pop eax
inc ebx
js 0x4471a6
insb byte es:[edi], dx
outsb dx, byte [esi]
inc esp
dec ecx
pop esp
inc eax
pushal
dec esi
push ecx
dec edi
dec ebx
imul bp, word [esi + 0x5b], 0x60
pop eax
push esi
bound ebx, qword [eax + 0x6f]
jns 0x4471a9
xor al, 0x88
push esi
push edi
je 0x4471e6
add esp, 0x2c
call fcn.0044755f
je 0x44730a
stosd dword es:[edi], eax
add eax, dword [eax]
add byte [edi], cl
test byte [eax + 1], dl
add byte [eax], al
inc al
push 1
mov dword [esi + 0x10], ebx
push edx
dec edi
inc ebp
pop esi
lea eax, [ebp - 0xc]
push 8
pop ebx
xor edx, edx
je 0x4471e3
jne 0x4471eb
fld qword [0x41ee70]
pop eax
add esp, 0x1c
mov eax, dword [ebp + 0xc]
je 0x4471ee
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.004460a8
mov al, byte [0xbae80041]
inc ecx
add al, ch
mov edx, 0x6effffee
out dx, al
invalid
outsb dx, byte [esi]
jnp 0x4471e7
pop es
or byte [eax + 0x65], ch
aaa
cmp eax, dword [esi]
push ax
lahf
lock xchg word [esp], ax
add al, 0x24
push ecx
call 0x447230
mov dword [ebp - 0x10], ecx
je 0x44721f
push 0xe8835952
add edx, ecx
clc
je 0x44723b
jne 0x447228
je 0x4471b0
or ecx, edx
jbe 0x44722e
and dword [eax + 0x60], 0xffffffe1
jne 0x447252
pushal
loope 0x447297
das
push esi
xor edi, edi
jmp 0x44726b
pop ecx
cmp edi, 0xffffffff
mov ecx, ebx
inc ebp
pop ebp
pop ecx
call 0x447236
mov dword [esp], esi
mov esi, 0x63b3756
aaa
cmp eax, dword [esi]
cmove esi, dword [esp + 0xa]
lea ecx, [ecx + esi - 0x63b36c6]
mov dword [esp + 0xa], ecx
mov esi, dword [esp]
lea esp, [esp + 4]
invalid
and al, 4
mov ecx, dword [esp]
lea esp, [esp + 4]
lock xchg word [esp], ax
sahf
mov ax, word [esp]
lea esp, [esp + 2]
ret
pop eax
pop edx
pop esp
inc ecx
pop esp
outsd dx, dword [esi]
popal
inc esp
pop edx
inc ecx
pop esi
push ebp
inc esp
insb byte es:[edi], dx
pop ecx
push esp
dec eax
inc esp
inc ebx
push 0x4e
outsb dx, byte [esi]
push 0x5f4e5763
dec ebx
push esi
inc ecx
dec esi
inc edi
pop esp
inc edi
jnp 0x4472d1
push 0x59
pop eax
js 0x44730e
dec ebp
cmp dword [esp - 4], 0xf4609a9
je 0x447248
jl 0x4472bd
cld
test eax, 0x740f4609
test al, 0xbb
add byte [eax - 0x67], al
invalid
invalid
invalid
push ebp
mov ebx, 0x1994000
invalid
invalid
push ebp
Function at 0x4483dd
Capabilities:
Terminate process

Disassembly:
mov edx, dword [esp]
lea esp, [esp + 4]
lea ecx, [esp + 2]

Function at 0x4491d1
Capabilities:
Get thread local storage value
Resolve function by parsing pe exports

Disassembly:
jne 0x4301b5
lea eax, [ebp + 8]
jmp 0x43023d
mov dword [ebp - 0x24], ecx
sbb al, 0x24
in al, dx
cmp esi, eax
cmp dword [esp + 0x54], 0x977e8601
cmove esi, eax
push 0xc
cmp ebp, 0xe59a5fa7
je 0x449222
call 0x4491d1
insd dword es:[edi], dx
insb byte es:[edi], dx
insd dword es:[edi], dx
pop ebp
inc esi
inc edi
inc edx
pop ecx
inc dword [esi + 8]
push dword [edi]
push 4
jne 0x4491ce
inc esp
pop ebp
push edi
mov dword [edi + 0x18], eax
pop esi
push ebp
add eax, ecx
mov byte [eax + 0x1c], 1
mov dword [ebp - 8], eax
add ecx, eax
jmp 0x449214
inc ebx
pop ebx
push esp
lock xchg dword [esp], ebx
lea ebx, [ebx - 0x28ea8]
lock xchg dword [esp], ebx
cmp dword [esp + 0x24], 0xf4b21423
je 0x4301ab
call fcn.0043091d
and dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
cmp dword [esp + 0x1c], 0x792dca03
je 0x449189
push dword [eax]
cmp dword [esp + 0x54], 0x6d2c806b
cmove esi, edx
call 0x44926c
jnp 0x44926a

Function at 0x44f052
Capabilities:
Read file on windows

Disassembly:
in al, dx
add dword [eax], eax
add byte [edi - 1], bl
jne 0x44f03d
je 0x44f0bd
mov dword [eax + 8], ecx
push edi
dec ebp
mov ebx, eax
add ebx, 0xffffffff
and eax, 0x3f
mov ebp, esp
pop ecx
jmp 0x44f0e2
inc ecx
dec esi
inc eax
arpl word [ecx + 0x5d], cx
dec esp
inc edx
push esp
pop ebx
dec eax
push ebx
dec edi
insb byte es:[edi], dx
jns 0x44f156
dec edx
pop edx
push edi
inc esi
push 0x58
inc bp
pop esp
inc ebp
arpl word [ecx + 0x6b], di
pushal
inc edx
push ebx
bound esp, qword [esi + 0x64]
dec eax
popal
insb byte es:[edi], dx
imul edx, dword [ebx + 0x4c], 0x46
push esp
dec ecx
push 0x5c515b62
dec ecx
push 0x7b646b54
dec eax
inc ecx
dec ecx
inc edi
dec edi
pop ebx
push esp
push esi
js 0x44f191
arpl word [ebx - 0x27ee3ba], cx
and al, 0xfc
mov dword [esp], ecx
call fcn.0044f1ab
mov dword [edi + 0x1c], eax
dec ebx
mov dword [ebp - 0x1c], esi
inc dword [edi]
push 0xffffffffffffffff
lea eax, [ecx + 1]
test edi, edi
mov dword [esp + 8], edx
add byte [eax + 0x69], ch
sbb edx, edx
lea eax, [edi - 1]
mov eax, dword [ebp - 0x2c]
movsx eax, word [ecx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x770], eax
test eax, eax
leave
jne 0x44f234
mov word [eax], cx
je 0x44f291
mov dword [ebp - 0x30], edx
mov eax, dword [0x421080]
js 0x44f1eb
dec esi
dec edx
inc eax
dec ecx
push esp
dec ebx
inc eax
jns 0x44f25a
push 0x4b
insd dword es:[edi], dx
push eax
push edx
push eax
dec esp
push ebp
dec edx
popal
imul edx, dword [esi + 0x4d], 0x79
dec ebp
jns 0x44f24e
outsb dx, byte [esi]
push 0x6b537853

Function at 0x452aea
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ecx
push 0xedcbcf17
pushfd
push esi
call 0x452b3c
inc edx
push ebp
push 0x5f
outsb dx, byte [esi]
inc esi
insb byte es:[edi], dx
inc esi
pop edi
dec esi
pop edx
Function at 0x452fb1
Capabilities:
Encode data using xor
Query environment variable
Resolve function by parsing pe exports

Disassembly:
inc esi
pop ebp
push edx
popal
inc ebx
pop edi
dec ebp
jnp 0x453006
push edi
insd dword es:[edi], dx
pop edi
dec ecx
push 0x4c
push eax
inc esi
dec esp
dec esp
dec edi
jnp 0x453022
push ecx
pop ebx
js 0x453038
imul ebp, dword [esi + 0x62], 0x6f694351
outsb dx, byte [esi]
js 0x453038
bound ebp, qword [edx + 0x4e]
dec ebx
bound ebx, qword [edi + 0x7b]
dec edi
pop edi
pop ebx
outsd dx, dword [esi]
outsb dx, byte fs:[esi]
arpl word [ecx + 0x4e], bp
jns 0x453049
pop ebx
pop bp
js 0x45303a
js 0x45303c
push ebp
dec ecx
mov dword [esi + 0x24], 1
call 0x45302c
push 9
mov byte [ecx], al
mov dword [ebp - 8], eax
mov edi, edi
jne fcn.00453018
push dword [ebp + 0xf]
push eax
je 0x4530bf
push 0x5c
push esi
jnp 0x453064
outsd dx, dword [esi]
pop eax
pop eax
cmc
jmp 0x453056
sbb dword [edx + 0x30], ebp
cmp dword [edi], 0
push str.minkernelcrtsucrtinccorecrt_internal_strtox.h
fcomp qword [ecx]
cmp edx, 0x4000
push 0
call fcn.004533f6
xor esi, esi
xor edx, edx
cmp al, 0x54
cli
adc ebp, dword [0x840f8e69]
adc al, 0
add byte [ebp + 0x76ff3c4e], cl
and al, 0x81
jl 0x4530f7
inc eax
mov bh, 0x6c
inc esp
imul ecx, dword [edi], 0x44
ret 0x7e89

Function at 0x453d4c
Capabilities:
Write file on windows

Disassembly:
inc edx
push eax
push edx
imul eax, dword [edi + 0x5e], 0x6a
dec ebx
pushal
outsd dx, dword [esi]
push 0x46
pop ebp
push 0x41
push edi
insd dword es:[edi], dx
push edx
dec esi
inc edx
imul edx, dword [ebx + ecx*2 + 0x7b], 0x5e65455c

Function at 0x4541df
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
pop eax
jns 0x45422c
outsd dx, dword [esi]
dec eax
jns 0x454243
pop edx
inc eax
arpl word [ebx + 0x45], cx
push edi
push 0x4a
pop ebx
pop esp
push ebx
dec esp
push eax
pop ebp
inc ecx
pop ebp
push eax
push ecx
dec esp
inc ecx
push esi
imul edx, dword [edi + 0x41], 0x6c
dec edx
pop ebp
push ebp
pop edx
inc edx
dec edx
js 0x454272
push 0x555c4a43
push ecx
arpl word [esi + 0x40], dx
dec esp
pop eax
cmp edi, 0xcae36291
jne 0x454267
add byte [eax], al
imul bx, word [esi + 0x6d], 0x6e51
bound ebx, qword [bp + si + 0x61]
Function at 0x457ad7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push 0x4e
inc ebp
inc eax
push 0x4c5a6e65
pop edi
outsb dx, byte [esi]
cmp ebp, 0x6e3e00b1
cmove eax, edx
mov esi, dword [edi + 0x20]
cmp ecx, 0x5b2841cd
jne 0x457b3c
push ecx
dec ecx
pop esp
pop esi
dec edi
pop edx
push 0x40
pop eax
pop ebp
dec ebp
pushal
inc edi
inc edi
pushal
pop edi
popal
pushal
jns 0x457b78
push ebp
jns 0x457b6b
push 0x57
push 0x61
inc eax
dec edi
pop eax
insb byte es:[edi], dx
bound ecx, qword fs:[edx + 0x45]
bound ebx, qword [ebp + 0x4e]
insb byte es:[edi], dx
pop edi
pop edx
bound edx, qword [ebx + 0x4f]
dec edx
push edi
inc eax
pop esp
inc eax
bound ebp, qword [eax + ebx*2 + 0x78]
inc edi
push 0x50524045
dec edx
dec ecx
outsb dx, byte [esi]
popal
dec esi
mov ecx, edi
cmp ebp, 0xf8ea542d
cmove ecx, eax
call fcn.00457b6d
jnp 0x457ba1
dec ebx
jns 0x457b94
inc ecx
push 0x5b
inc edx
inc ebp
push edi
push 0x50
arpl word [ebx + 0x57], bp
js 0x457bb2
inc ecx
insd dword es:[edi], dx
pop ebx
inc ebx
push bp
inc esi
outsd dx, dword [esi]
inc ecx
jns 0x457bc5
pop edi
bound ebx, qword [ebx + 0x4d]
pop ebx
dec ebp
pop eax
push edi
push dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
inc esp
pushal
mov dword [ebp - 4], 0xfffffffe
cmp edi, edx
push dword [ebp + 0x10]
push eax
arpl word [ebp + ecx*2 + 0x4e], ax
mov dword [eax + 0x14], esi
invalid
cmp dword [esp + 4], 0x8d1c13cd
sub al, 0x56

Function at 0x458637
Capabilities:
Check os version

Disassembly:
in al, 0xeb
adc ecx, ebp
mov eax, dword [ecx + 0x60]
test esi, esi
mov eax, dword [ecx + 0x20]
movsx eax, cl
push dword [ebp - 0x464]
cmp dword [esp - 0x18], 0x5f3a7c31
cmove edx, edx
call fcn.004586bd
inc edi
push edi
push esp
pop ebx
outsd dx, dword [esi]
inc eax
push edi
push 0x65
pop ebp
inc edi
jnp 0x4586d5
push 0x4f
push edx
push 0x50424e5f
push esi
pop ebx
push esp
dec dx
push edi
arpl word [ecx + 0x5e], cx
pop esi
pop ebx
pop ebp
push 0x575d496a
insd dword es:[edi], dx
push 0x44606563
imul edx, dword [edi + 0x57], 0x51
inc ebx
imul esp, dword [ecx + 0x4a], 0x4c4f5048
dec edi
dec esi
inc edi
push esp
dec edi
bound edx, qword [ebx + 0x66]
popal
dec esp
pop ecx
dec esi
js 0x458729
popal
jns 0x45874a
js 0x45872f
dec edx
pop ebx
dec esi
outsd dx, dword gs:[esi]
dec esi
push eax
push sp
dec eax
dec ebp
arpl word gs:[ecx + 0x64], ax
insb byte es:[edi], dx
pop ecx
dec ebx
dec ebp
pop ebx
outsd dx, dword [esi]
imul eax, dword [ebx + 0x5a], 0x4e
dec eax
arpl word [ecx + 0x51], bp
dec edi
pop edx
bound edx, qword [ebx + 0x64]
dec di
jns 0x458773
pop ebx
inc ebp
push eax
inc esi
and al, 0x40
add esi, esp
shl byte [edx], cl

Function at 0x460e7f
Capabilities:
Parse pe header

Disassembly:
outsd dx, dword [esi]
mov edi, edi
cmp dword [esp + 0x60], 0x7c35ac03
je 0x47c2f0
pop ecx
cmp ecx, eax
pop ebp
mov dword [ebp - 4], 0xfffffffe
je 0x47c304
mov dword [ebp + 0x10], ecx
push dword [ebp + 8]
dec ebx
Function at 0x4659c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
outsd dx, dword [esi]
je 0x4659cf
je 0x465974
mov edi, edi
inc ecx
jmp 0x4659a3
jg 0x4659e0
sbb byte [ecx], 0xff
invalid
insb byte es:[edi], dx
push ebx
mov eax, dword [eax]
jb 0x4659c1
invalid
push esp
pop ebx
pop esi
Function at 0x466992
Capabilities:
Set environment variable

Disassembly:
pop ebp
dec ebp
imul edx, dword [edi + 0x6f], 0x5b445251
popal
pop esi
jns 0x4669eb
pop ebx
push eax
imul ebx, dword [edi + 0x45], 0x56
inc ebp
push esi

Function at 0x466b16
Capabilities:
Set environment variable

Disassembly:
mov ecx, esi
nop
adc edx, 0
xor ebx, ebx
push eax
lea eax, [ebp - 0x18]
push ebp
jne 0x466b58
dec al
jmp 0x1cd1bc73
invalid
invalid
jns 0x466bd5
insb byte es:[edi], dx
dec edx
insd dword es:[edi], dx
pushaw
js 0x466bb7
dec edi
dec esp
insb byte es:[edi], dx
push ebp
js 0x466bcf
add byte [eax], al
add byte [ecx + 0x6ae8240c], cl
add byte [eax], al
add byte [ebp + 0x6a], ch
inc esp
push 0x52

Function at 0x46b62b
Capabilities:
Terminate process

Disassembly:
inc ebp
pop eax
push esp
pop ecx
push esp
push 0x6f
dec ecx
jns 0x46b68d
push 0x57
insd dword es:[edi], dx
inc edi
insd dword es:[edi], dx
js 0x46b6a0
pop esp
arpl word [bp + si + 0x43], bx
dec ebx
dec ebx
bound esp, qword [esi + 0x57]
dec eax
dec ebp
dec esp
dec esp
push ebx
push ebx
pop esi
jns 0x46b6ac
pop edi
dec edi
push esi
js 0x46b6bf
dec esi
insd dword es:[edi], dx
inc ebx
dec edx
inc esp
dec esi
pop ebp
pop esi
pop ebp
outsb dx, byte [esi]
dec ebx
pop eax
dec di
inc edx
pop ecx
pop ecx
inc esi
push ecx
pop cx
dec ebp
outsb dx, byte [esi]
js 0x46b6c1
outsb dx, byte [esi]
pop esp
push ebp
inc ebp
pop esi
cmp dword [esp - 0x80], 0x8bedb081
jne 0x46b6b6
shl ecx, 0xb
push eax
jmp 0x46b692
call 0xff9d7fc5
add dword [ebx], edi
inc ebp
or al, 0xf0
xadd dword [eax], ecx
inc esi
inc ebp
outsb dx, byte [esi]
idiv dword [ebx + 3]
add byte [edx + 0x62], ch
mov edi, esi
mov di, ax
mov ebp, esp
in al, dx
dec eax
and dword [ebp - 4], 0
push ebp
call fcn.0046b760
ret
cld
add byte [ebp - 0x18], dl
stosd dword es:[edi], eax
add byte [eax], al
add bl, al
mov ecx, esi
cmp ebx, 0x300c1d1f
je 0x46b739
jns 0x46b6a9
call fcn.0046b6ed
sub byte [eax], al
add byte [eax], al
mov dword [ebp - 0x10], esi
push cx
popaw
mov eax, dword [ebp - 0x10]
push eax
push esi
pop ebx
cmp al, 0x80
pop esi
add esi, ecx
add dword [ebx + 4], 4
push esp
push edi
push edi
inc ebx
mov edi, dword [ebp - 0x20]
fldz
jns 0x46b727
pop ebx
bound ecx, qword [esi + 0x78]
inc eax
dec esp
pop esi
push eax
pop eax
push ebx
popal
jnp 0x46b786
pop esi
push esi
inc edi
dec eax
dec esp
dec esp
jns 0x46b781
pop edi
push 0x6a42486a
inc eax
push 0x48
inc edx
push 0x40
jns 0x46b785
push ebp
inc ebp
dec esi
inc edi
inc esp

Function at 0x46b745
Capabilities:
Terminate process

Disassembly:
pop esi
pushal
imul ebx, dword [ebp + 0x40], 0x40514145
jns 0x46b7a7
push eax
jnp 0x46b7c1
pop ebx
push ecx
pop ebp
jns 0x46b7a0
pop esp
push eax
inc dx
insb byte es:[edi], dx
outsb dx, byte [esi]
pop ebx
Function at 0x46b760
Capabilities:
Terminate process

Disassembly:
pop ecx
inc esi
dec esi
push edx
dec ecx
insb byte es:[edi], dx
push ebp
pushal
inc edx
pop esi
cmp dword [esp + 4], 0x7254047b
jne 0x46b7d5
je 0x46b7c1
and edx, 3
and ecx, 0xffffffe0
pop esp
inc esi
pop ebx
cmp al, 0x35
push esi
add esi, 4
call fcn.0046b745
jae 0x46b7a3
setne al
push str.InitializeCriticalSectionEx
mov dword [eax], 9
mov esi, eax
or ebx, 0xffffffff
mov byte [edi + 2], al
push ebp
dec ebp
call fcn.0046b593
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add al, ch
invalid
mov byte [ebp - 7], al
cmp dword [esp + 0x48], 0x7347a26d
cmove ebx, eax
push dword [ebp - 7]
cmp eax, 0xab1ba06b
jne 0x46b83b
mov dword [ecx + 8], edx
outsb dx, byte [esi]
mov ecx, esi
cmp ecx, 0x6a02ab09
push 0xf
test byte [ebx], al
invalid
add eax, dword [eax]
call 0x46b8b4
call 0x46b87d

Function at 0x470339
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
lcall 0x574, 0x32753e35
setne cl
cmp dword [esp + 0x48], 0xde348129
je 0x46978b
shl ecx, 0x1f
cmp edi, 0x61368b0f
je 0x4702f4
or ecx, 0x7ff00000
push ebx
push 0x4f
push ebp
push esi
push ebp
push 0xffffffffffffff95
push edi
call fcn.004703e7
xor esi, esi
lea edi, [esi + 2]
ret
Function at 0x476c80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x476cc7
mov ecx, dword [eax]
cmp dword [esp + 0x60], 0xe2da075d
cmove edx, ebp
mov eax, dword [eax + 4]
cmp ebx, 0x7c2667db
je 0x4abfde
mov dword [edx + 4], eax
cmp dword [esp + 0x20], 0x2b086f71
cmove esi, edx
mov al, 1
cmp edi, 0xb7877881
je 0x4c2816
mov dword [edx], ecx
cmp dword [esp + 0x40], 0xb72469b7
jne 0x476cfe
pop esp
pop ebx
dec edi
pushal
insd dword es:[di], dx
imul edi, dword gs:[eax + 0x60], 0x664a4644
dec edx
dec esi
pop esp
push edx
inc ebx
push edx
dec ecx
inc esi
pop edi
pushal
imul esp, dword [edx + 0x6c], 0x60
inc ebx
pop ebx
inc edx
jns 0x476d53
dec ecx
inc cx
push 0x42
insb byte es:[edi], dx
push ecx
inc esp
push ebp
imul dx, word [esp + ecx*2 + 0x47], 0x6d63
dec esp
outsb dx, byte [esi]
push ebx
jnp 0x476d4b
insb byte es:[edi], dx
pop ebp
cmp dword [esp - 0x14], 0xdcbbd9ad
cmove edx, edi
inc esp
inc edx
add byte [eax], al
inc edi
push es
add byte [eax], al
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
pop esp
cmp eax, dword [ebp - 0xc]
push 0xfffff9bc
pushfd
push ebx
call fcn.004ac04c
dec ecx
push 0x42
inc ecx
push eax
xor al, 0x24
call 0x4c2885
jns 0x4c285f
pop ebx
push edi
outsb dx, byte [esi]
arpl word [ecx + 0x79], bx
push edi
pop ebp
dec esp
bound ebx, qword [eax + 0x60]
inc ebx
push edx
outsd dx, dword [esi]
jns 0x4c289c
insb byte es:[edi], dx
dec edx
dec esp
pushal
inc esi
popal
pop esp
push ecx
outsd dx, dword [esi]
dec esp
pop ebx
jns 0x4c28ad
dec esi
dec ebx
inc esi
push ebx
dec ebx
popal
inc eax
push ecx
push edx
inc esp
push esp
imul ebx, dword [edx + 0x4d], 0x42
inc eax
dec esp
dec ebp
pop esi
pop eax
push ebx
push eax
push ecx
dec eax
inc esi
inc esi
push esi
push esp
inc ecx
pop edx
arpl word [edx + 0x59], dx
push edx
pop ecx
inc esp
inc esp
push 0x63
dec ebx
push dx
bound esp, qword [ecx + 0x7b]
outsd dx, dword [esi]
jnp 0x4c28d3
dec ebp
inc edi
pop esi
pop edx
inc edx
push esp
bound bp, dword [eax + 0x66]
pop esp
popal
inc ebx
js 0x4c28cc
outsd dx, dword [esi]
push edi
insd dword es:[edi], dx
dec eax
push 0x5a
mov esi, dword [esp]
lea esp, [esp + 4]
push edi
mov edi, 0x105
cmovne edi, dword [esp + 0xc]
add esi, edi
mov dword [esp + 0xc], esi
lock xchg dword [esp], edi
or al, 0xf0
xchg dword [esp], edi
lea esp, [esp + 4]
mov esi, dword [esp]
lea esp, [esp + 4]
lock xchg dword [esp], eax
xchg dword [esp], eax
xchg al, ah
sahf
pop eax
ret
sal byte [eax], 3
add byte [ebp + 0x44], al
inc esi
add esi, 4
push ecx
outsb dx, byte [esi]
insb byte es:[edi], dx
dec ebp
mov dword [ecx], eax
mov dword [ebp - 0x10], eax
mov edi, edi
pop esp
inc ebx
push ecx
or byte [ecx + edx + 0x28], 2
mov ebp, 0x60545a60
cmp edi, eax
bound edx, qword [esi + ebx*2 + 0x6f]
inc ebx
imul ecx, dword [edi - 0x18], 0xffffff94
push es
add byte [eax], al
push eax
push ebp
imul ecx, dword [ebp + ebx*2 + 0x78], 0x4b
jnp 0x4c2957
pop ecx
inc ecx
dec eax
inc ebx
push edx
bound eax, qword [ebp + 0x50]
outsd dx, dword [esi]
pop edi
mov dword [ebx + 0x18], 0x1c
push edx
mov ax, word [esp]
pop eax
cmp esi, edi
mov eax, dword [ebx + 0x10]
push 4
pop eax
call fcn.004c2999
Function at 0x479f94
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add al, 0x51
test byte [ebp - 0x76000000], ch
ror dword [ecx + 0x4a56f045], 0x5f
inc edi
pop eax
cdq
mov dword fs:[0], ecx
je 0x479fa2
test cl, cl
mov dword [esi + 0x350], ecx
cmp eax, 0x800
push 0xff337455
jne 0x479fe5
mov dword [esi + 8], edi
lea ecx, [eax - 1]
mov byte [ebp - 8], bl
pop ebx
arpl word [ebp - 0x18], dx
add al, 0x60
invalid
push ebp
mov ecx, ebx
cmp dword [esp + 0x68], 0x36cecd87
jne 0x47a002
imul esp, dword [eax + 0x43], 0x535b6b78
push ebx
inc ebp
dec esp
pop ebx
inc ebp
dec ebp
push edi
outsd dx, dword [esi]
add ecx, 0x20
add ecx, 0x20
cmp dword [esp + 0x38], 0xb569bc1
jne 0x47a05d
mov edi, edi
push dword [ebp + 8]
push eax
inc esp
or eax, 0xffffffff
mov edx, dword [ebp - 4]
jne 0x47a011
mov esp, ebp
movzx eax, bl
mov eax, dword [ebp - 0x944]
add byte [edi - 0x75], dh
retf 0x877
mov eax, dword [ebp + 0x1c]
cmp ecx, 0x41ce171b
cmove ebp, eax
mov dl, byte [eax + 4]
cmp edx, 0x71294eb3
cmove edx, esi
mov byte [ebp - 1], dl
cmp esi, 0xdc4f6da3
cmove ebp, ebp
xor edx, edx
cmp byte [ebp - 1], dl
sete dl
cmp ebx, 0xe16542cd
je 0x47a0ee
xor eax, eax
cmp ebp, 0xc2311df
je 0x469583
dec edx
cmp ebx, 0x6454dd01
jne 0x47a0d2
jmp 0x47a0de
and edx, 0x1d
cmp dword [esp + 0x68], 0x4f65610b
jne 0x47a119
cmp al, cl
out dx, al
add eax, 0x5446536d
shr esi, 5
insd dword es:[edi], dx
push ebx
inc esi
push esp
dec eax
outsb dx, byte [esi]
push esi
inc ebx
push 0xffffffffffffffff
push ebp
dec eax
dec ebp
imul ebx, dword [ebx + 0x6b], 0x6fd88a4e
push esi
dec esp
jne 0x47a123
setne al
shr eax, 0xd
mov ebp, esp
jne 0x47a12a
test al, al
add edx, 0x18
cmp dword [esp + 0x28], 0x8c907d91
jge 0x47a0b3
invalid
je 0x47a11b
cmp eax, dword [esi - 0x79]
adc eax, 0x8bd3440f
dec ebp
adc byte [ecx + 0x7328247c], al
cmp byte [ecx], 0x21