joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a121
Capabilities:
Resolve function by parsing pe exports

Disassembly:
ja 0x47a185
idiv ebx
mov eax, dword [eax*4 + 0x422020]
push edx
pop ebp
jmp 0x4b7094
jge 0x47a0b3
invalid
cmp dword [0x4219ec], 1
mov eax, dword [edi]
sub ecx, 1
mov esi, dword [ebp + 0x10]
je 0x47a1a0
push eax
imul edi, dword [ecx + 0x65], 0x41f01ebb
add byte [ebx + 0xe18106], cl
push es
and ecx, 0xffffff00
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x47a1b4
int3
imul esp, dword [edi + 0x6f], 0x5f
inc ecx
inc esp
insb byte es:[edi], dx
inc eax
inc edi
inc esp
dec edx
jnp 0x4b7102
dec edx
js 0x4b70fe
inc ebp
dec edi
jns 0x4b7104
dec ebx
dec ebx
jnp 0x4b70fa
inc eax
outsb dx, byte [esi]
js 0x4b7108
pop esi
dec esp
push bx
push esp
push ecx
inc ebp
cmp dword [esp + 0x44], 0x751012bf
and al, 0x44
mov edi, 0x75751012
pop esi
dec eax
push ecx
dec eax
imul esp, dword [esi + 0x4c], 0x79
jns 0x4b7114
push edi
push eax
push esi
imul ebp, dword [edi + edx*2 + 0x45], 0x6b
push edx
inc esp
dec eax
insd dword es:[edi], dx
inc eax
js 0x4b7136
pop ecx
push esi
dec esp
push ebx
push edi
js 0x4b7143
dec edi
pop edi
arpl word [eax + edi*2 + 0x53], cx
push edx
jnp 0x4b7142
dec ebx
imul eax, dword [esi + 0x56], 0x66
insb byte es:[edi], dx
dec esp
dec esp
pop esi
push esp
dec edi
jns 0x4b715f
dec ecx
inc ebx
dec esp
outsb dx, byte [esi]
outsb dx, byte [esi]
dec edi
dec edi
jns 0x4b715e
pop ebx
inc esi
push ebx
dec ebx
dec esp
jns 0x4b7185
insb byte es:[edi], dx
dec ebx
push esp
push eax
dec ebp
pop edx
popal
push ebp
js 0x4b715a
jns 0x4b7164
dec esp
pop eax
inc ebx
dec ecx
push eax
pop edx
dec ebp
inc edx
arpl word [esi - 1], bp
jne 0x4b712f
push dword [ebp + 0xc]
cmp dword [esp + 0x48], 0x5c2d6621
cmove ecx, edx
mov ecx, esi
into
cmp edx, 0xf7fef807
jne 0x4b716b
pop edi
test eax, eax
pop edx
popal
dec ebp
dec edx
pushal
popal
push dword [esi + 0x158]
call 0x4b7164
mov dh, 0x58
pop eax
add dword [eax], eax
add al, ch
sbb byte [eax], al
add byte [eax], al
mov dword [ebp - 4], esi
mov ecx, edi
push edi
push edx
inc ebx
call fcn.004b731d
dec edx
inc ebp
dec eax
mov ecx, dword [ebp + 8]
or byte [ebx + 0x6a], bl
add byte [esi + 0x41], bl
pop ebx
push 0
pop esi
inc ecx
dec esi
dec ebx
jne 0x4b718b
inc ecx
dec eax
push dword [ebp + 8]
cmp eax, 0x20c62c8f
je 0x4b71c1
call fcn.004b71f5
pop ebx
jmp 0x4fa6e6
add byte [eax], al
neg ecx
push eax
popal
inc edi
pop edi
test eax, eax
push dword [ebp - 8]
push ecx
sub eax, 1
movapd xmm2, xmmword [0x41ee40]
cmp dword [ebx], 0x2d
je 0x4b72a5
inc esi
push edx
inc edi
cmp dword [ebp + 8], 0xc00002b4
pushal
arpl cx, ax
loope 0x4b71b9
or byte [eax], al
jnp 0x4b720a
push eax
sub eax, 1
jns 0x4b7204
pop edx
pop esi
ret
add al, 0x8b
sbb ecx, dword [ecx - 0x7efbdba4]
add al, 0x81
inc esp
and al, 8
mov eax, dword [0x8b000000]
sbb al, 0x24
lea esp, [esp + 4]
ret
dec dword [ebx - 0x74f7db8c]
mov dword ss:[esp + 8], esi
mov esi, dword [esp]
lea esp, [esp + 4]
popfd
ret
invalid
Function at 0x47a2f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
insb byte es:[edi], dx
pop ecx
pop ecx
popal
insd dword es:[edi], dx
xor eax, eax
cmp byte [ebp - 1], al
sete al
cmp edi, 0xb94ef8cd
jne 0x47a332
call fcn.00471320
je 0x47a31f
leave
je 0x47a320
push eax
push ebp
dec esi
call fcn.0047961a
call dword [ecx + 0x33]
leave
push ecx
xor ecx, ecx
Function at 0x47d07c
Capabilities:
Write file on windows

Disassembly:
imul edx, dword [ebp + 0x67], 0x42
popal
dec ebp
pop esi
inc edi
imul esp, dword [edx + 0x5e], 0x6c496666
outsb dx, byte [esi]
inc esp
inc esp
inc ebp
inc esi
push 0x5b
dec edx
push 0x42
push 0x61
inc ecx
push esi
imul ecx, dword [ebx + 0x4e], 0x4c
imul ebx, dword [eax + 0x53], 0x78
push cx
jnp 0x47d0ed
push ecx
push esp
insd dword es:[edi], dx
push edi
push ecx
inc ebx
pop esp
bound edi, qword [eax + 0x4d]
inc esi
push ecx
dec edx
push ecx
jns 0x47d118
push edx
popal
inc ecx
pop eax
bound ebp, qword [ebx + 0x5e]
pop eax
push esp
outsd dx, dword [esi]
arpl word [eax + 0x59], bx
inc edx
push esi
pop ebx
jnp 0x47d183
jnp 0x47d1a3
dec sp
jns 0x47d19b
pop edx
push ebx
push 0x42
arpl word [edx + 0x66], ax
push eax
inc eax
pop ebx
pop ebp
dec eax
imul ebp, dword [edx + 0x68], 0x58416042
insb byte es:[edi], dx
dec edi
pop ebp
dec esi
pop edx
push 0x5d
dec ecx
imul eax, dword [eax + eax*8 + 0x7147d168], 0x8c6866a9
mov word [ecx + 0x6652f26a], ss
push 0xffffffffffffffa0
push 0x714
push ax
lahf
lock xchg word [esp], ax
call 0x47d16c
mov dword [esp], ecx
call 0x47d1a0
push bx
push ebp
imul edx, dword [ecx + 0x6b], 0x635a404c
dec esi
pop esp
inc ebp
inc edx
arpl word [ebp + 0x55], bp
insd dword es:[edi], dx
push ebp
pop ebx
imul edi, dword [ecx + 0x65], 0x40
dec ebp
push ebx
dec esi
pop edx
imul ecx, dword [esi + 0x56], 0x5d
jnp 0x47d1d9
imul ebx, dword [ecx + 0x4f], 0x5c53644c
push ebx
pop esp
js 0x47d1ef
pop ecx
push ebp
mov ebp, 0x80
add byte [eax], 0
add byte [edi], cl
cmove ebp, dword [esp + 0xa]
test eax, eax
je 0x47d2b5
sub al, 0xa
jne 0x47d1f8
ret
jo 0x47d217
cmove ecx, esi
call 0x47d22c
inc ecx
push ecx
dec ebx
pop ebx
outsd dx, dword [esi]
pushal
pop esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jne 0x47d21c
mov dword [ebp - 8], esi
pop ecx
push ebx
xor esi, esi
push 2
imul byte [edx + 2]
push 0
push ecx
popal
push esi
jne 0x47d22b
or byte [eax + edi + 0x28], 4
push esi
mov edx, esi
pop ebp
push ebp
push dword [esp]
add dword [esp], 0xfff91a29
add dword [esp + 4], 0xbd
ret
dec esi
mov ebp, esp
mov dword [esi + 0x18], ebx
cmp ah, al
ret

Function at 0x47d10b
Capabilities:
Write file on windows

Disassembly:
inc eax
inc ebx
pop esi
inc edx
outsb dx, byte [esi]
push ebp
dec edx
arpl word [bp + 0x64], ax
pushal

Function at 0x4801a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushaw
outsd dx, dword [esi]
inc ebp
pop ecx
push ebx
push 0x445b474f
dec ebx
dec esp
dec esi
dec esi
imul ecx, dword [eax + 0x6c], 0x78535b79
push ecx
insb byte es:[edi], dx
pop ecx
pop sp
pop eax
pushal
push esp
dec edx
pop cx
dec edi
inc ebp
js 0x480210
insd dword es:[edi], dx
inc ebp
imul eax, dword [ebx + 0x52], 0x58
call 0x4801d9
mov dword [esp], ecx
mov ecx, 0xd9
cmovne ecx, dword [esp + 0xa]
add ecx, eax
mov dword [esp + 0xa], ecx
pop ecx
lock xchg dword [esp], eax
lea esp, [esp + 4]
lock xchg word [esp], ax
sahf
pop ax
ret 0x16
invalid

Function at 0x480ca9
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
add dword [esp], 0x177d9
add dword [esp + 4], 0xbc
ret
Function at 0x486707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
js 0x48675a
ret
adc eax, 0xfcbeb67
test dword [0x56000000], ebx

Function at 0x486758
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ecx, 0xcbeb6715
jne 0x486781
push esi
jne fcn.00486775
push ebx
test edi, edi
push 0
pop edx
mov esi, dword [ebp + 0xc]
pop ebp
push dx
jmp 0x486856
add byte [eax], al
invalid
mov edx, dword [ebp + 8]
cmp edx, 0x4380c11d
cmove ecx, esi
xor ecx, ecx
leave
cmp ecx, eax
mov dword [esi], edi
sbb ecx, ecx
cmp esi, 0x9e3f2e1b
cmove ecx, edx
neg ecx
cmp dword [esp + 0x68], 0x1650086f
je 0x48678e
retf 0xd9f7
mov dword [edx + 8], eax
cmp eax, 0x77d07529
je 0x48679d
mov eax, dword [ebp - 0xc]
cmp ecx, 0xe77c1507
je 0x4867f9
inc ecx
cmp dword [esp + 0x54], 0xbba3a6c7
jne 0x486804
insd dword es:[edi], dx
imul ebp, dword [ebx + 0x4b], 0x41c7d284
sub byte [eax], cl
add byte [eax], al
add byte [ebx], bh
retf 0x840f
push ebx
pop ecx
add esp, 0x1c
xchg ecx, eax
push es
add byte [ebp - 0x75], bl
add edi, edi
xor al, ch
sub byte [esi + 0x558bffff], ch
cld

Function at 0x4877c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ebp
push 0x56
imul ebx, dword fs:[eax + 0x50], 0x6e
js 0x487810
pop esi
imul ebx, dword [ebp + 0x60], 0x41
dec edx
pop esp
dec ecx
dec esi
bound edx, qword [ecx + 0x62]
js 0x487827
push 0x4e
push esi
jnp 0x48785b
pop edi
inc ebp
inc edi
dec edi
insd dword es:[edi], dx
outsd dx, dword [esi]
dec eax
dec ebx
imul edx, dword [esi + 0x60], 0x53
insb byte es:[edi], dx
inc ecx
push eax
push ecx
outsd dx, dword [esi]
push 0x5d57666c
inc esp
push edx
dec ebp
imul ebx, dword [edx + 0x6d], 0x79
dec ebp
js 0x487861
push edx
inc esi
dec esi
inc ecx
pop esi
inc ecx
inc eax
outsb dx, byte [esi]
push edx
dec esi
inc edx
insb byte es:[di], dx
dec eax
push 0x585e5645
outsd dx, dword [esi]
outsb dx, byte [esi]
imul ecx, dword [ecx + 0x4a], 0x4c
push ebp
inc edx
pop edi
pop ebx
arpl word [edx + 0x4d], cx
push 0x5b
inc edi
outsd dx, dword [esi]
dec edi
pop ebp
pop esi
arpl word [edi + 0x63], dx
insd dword es:[edi], dx
arpl word [ecx + 0x67], cx
outsd dx, dword [esi]
dec edx
cmp dword [esp - 4], 0x7bfcee7f
je 0x487808
mov ecx, dword [ebp - 0x2c]
cmp ebx, 0x4710c6fd
je 0x4933c2
mov edi, ebx
cmp dword [esp + 0xc], 0x3f23653f
jne 0x4878ad
add byte [eax], al
add byte [esi + 0x51], cl
dec esi
push ecx
pop eax
inc ebx
pop esi
push edi
inc esi
inc esi
pop esi
push esp
inc ebp
inc ecx
pushal
insb byte es:[edi], dx
pop esp
imul edx, dword [ecx + 0x41], 0x57505752
dec ecx
push edi
dec ebp
outsd dx, dword [esi]
pop esi
pop esi
inc edi
dec edi
push 0x44
insb byte es:[edi], dx
inc edx
imul ebx, dword [ecx + 0x6a], 0x4b
push 0x78
pop ecx
imul edx, dword [edx + 0x40], 0x69
push ecx
inc edi
push edi
inc edx
bound edx, qword [edx + 0x5b]
inc ebp
cld
Function at 0x48d74e
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
ror cl, 0x67
pop edx
pop eax
je 0x48d7a9
cmp word [edx], di
jb 0x48d85b
mov ecx, dword [ebp - 4]
clc
invalid
inc ecx
inc edi
dec ecx
pushal
inc edx
inc ebp
jnp 0x48d8cb
inc ebp
jne 0x48d847
cmp al, 0x54
ret
pop eax
push eax
push edi
pop eax
inc esi
push esi
push esi
imul esp, dword [edi + 0x6b], 0x674f4769
inc edi
pop eax
dec eax
dec esp
push 0x4c584c49
dec eax
push eax
dec eax
dec eax
inc edx
pop esp
inc ecx
dec ecx
inc ebp
inc ebx
popal
dec esp
mov edi, edi
cmp dword [esp - 0x10], 0x7bfec489
je 0x48d8af
push esi
cmp esi, 0x9910dc3d
jne 0x48d912
pop esi
imul edx, dword [ecx - 0x73], 0x45
invalid
mov esi, ecx
cmp edi, 0xb68cebdf
cmove esi, eax
mov eax, dword [esi + 0x20]
cmp eax, 0x545e45a7
jne 0x48d94a
pop ecx
jns 0x48d98f
call fcn.00484f50
fldz
push eax
pop esi
pop esi
jmp 0x48d93f
retf
dec eax
cmp edi, 0xa91785af
cmove edi, ebx
sub eax, 1
push 0x709
pushfd
call fcn.0048d962
dec edx
dec eax
push ecx
leave
push edi
imul eax, dword [ebx - 0x17a8fe01], 0x75
mov edx, 0xdffff
add al, dh
jg 0x48d9e1
add byte [eax], al
add byte [ebx], dh
adc eax, 0x421080
push 0x59

Function at 0x48f8fc
Capabilities:
Parse pe header

Disassembly:
add byte [eax + 0x2b2b384c], cl
enter 0x5a46, 0x43

Function at 0x4905e0
Capabilities:
Set thread local storage value

Disassembly:
push edi
imul ecx, dword [ebx + 0x56], 0x63594143
push edi
pop eax
Function at 0x49069a
Capabilities:
Packed with generic packer
Set thread local storage value

Disassembly:
inc esi
dec eax
mov ebp, esp
mov eax, ecx
dec ebx
jne 0x49077e
fabs
cmp dword [esi + 0x14], 0x19930521
push dword [eax + 0x360]
add eax, 0x2e7c100
push edx
pop ebx
insb byte es:[edi], dx
inc edi
dec ecx
dec ebx
arpl ax, bp
mov esp, 0xffffff6c
jne 0x4906d6
lea eax, [ebp - 0x40]
push esi
shl eax, cl
push esi
mov dword [ebp - 4], ecx
test dword [eax], eax
push 0x43
cmp ebp, 0xb35a561d
je 0x490717
mov ecx, esi
cmp dword [esp + 0x7c], 0x32473cdd
cmove ebp, eax
call 0x490755
je 0x490709
and dword [ebp - 0x3a4], 0
pop edi
test esi, esi
rep movsd dword es:[edi], dword [esi]
mov dword [eax + 0x350], ecx
push ebp
dec edx
push ecx
or eax, 0x300
xor eax, eax
shl eax, 0x1f
sub eax, 1
call 0x280ef1a
add byte [eax], al
aaa
add al, byte [eax]
add bh, al
add byte [eax - 0x47], dh
inc ecx
add bh, al
inc ebp
loopne 0x490729
mov dword [eax], 0x41b970
mov dword [ebp - 0x20], 4
mov eax, dword [esi + 4]
push ecx
add byte [eax], al
add byte [ebx + 0x58510446], cl
inc esi
add al, 0x51
pop eax
pop esi
jmp 0x490741
leave
push ebp
mov ecx, dword [eax]
or ecx, 8
add eax, 4
mov dword [ebp - 0x110], edx
mov ecx, dword [ebp - 0x10]
push ebp
push dword [esp]
add dword [esp], 0x3ff4
dec ebp
push ebx
dec ebp
push 0x6662525e
inc esi
inc eax
dec ecx
push ebx
pop edx
pushal
push 0x6e
push 0x6f41585a
inc esp
dec esi
insb byte es:[edi], dx
dec edi
push esi
mov dword [esi + 0x28], 1
call fcn.0049080d
je 0x4908ab
push eax
pop esi
mov ecx, dword [edi]
inc eax
cmp dword [edx], 0
add byte [ebx], cl
enter 0x676a, 0x4f
imul ebp, dword [edx + 0x46], 0x5d4e5a63
neg eax
mov ebp, esp
or ecx, 0xffffffff
xor bh, bh
jnp 0x490814
inc eax
setge al
mov ecx, dword [ebp - 0xc]
sub al, 0x30
push ebx
mov dword [eax], ebp
jge 0x490830
mov byte [ebp - 3], ah
jne 0x4907f4
lea eax, [ebp - 0x1d0]
leave
push dword [ebp - 8]
push ebx
outsd dx, dword fs:[esi]
dec ecx
mov eax, 0x1410
mov ecx, dword [ebp - 4]
dec esp
popal
push 0x66
mov ebp, esp
push ecx
push ebx
pop esi
push esp
inc esi
push edi
dec edx
jne 0x49081f
cmp ecx, eax
pop ecx
ret
in al, dx
invalid
pop ax
ret
add cl, byte [ebx + 0xf72fc51]
push 8
cmp ecx, 0x20
and eax, 3
mov eax, dword [ebp - 0x748]
inc ebp
inc eax
test bl, bl
add esi, ecx
dec esi
pop esi
inc ebp
jns 0x4908b9
inc ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
inc esp
and al, 4
pop esi
mov dword [ebp - 0x18], eax
cmp esi, 0x73
mov eax, dword [edi]
js 0x490919
add eax, 4
push edi
push 0x16
mov dword [ebp - 0x14], ebx
ret
mov eax, 0x5bfffff8
pop ebx
push 0xdd04598b
add al, 0xdd
inc ebp
adc byte [ebx - 0x17b1fd20], al
add al, 0xd
add byte [eax], al
dec ebx
outsb dx, byte [esi]
push ecx
jmp 0x490922
Function at 0x49c0c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], edx
call 0x49c017
insb byte es:[edi], dx
push ecx
dec esp
inc edi
js 0x49c007
call 0x49c16f
movzx eax, byte [edi]
pushal
pop esi
pop ecx
insb byte es:[edi], dx
push 0x54
dec esp
jmp 0x49bffc
adc eax, sym.imp.KERNEL32.dll_GetProcAddress
inc esi
imul edx, dword [ebp - 0x2e], 0xff6fa1e8
inc ebx
lea eax, [edi + 1]
mov ecx, dword [ebp - 0x18]
cmp ebx, 0x73
jne 0x49c01a
outsd dx, dword [esi]
invalid
dec ebp
call 0x75bdbb98
add al, 0x55
push ebp
pop edx
push ebp
lea ebp, [esp + 0xa]
push ecx
lea esp, [esp - 4]
lodsb al, byte [esi]
and al, 0xa
add byte [eax], al
add byte [ecx - 0x73], dl
and al, 0xfc
mov dword [esp], ebx
mov ecx, edx
add ecx, 0xfff85f51
push word [esp + 0x10]
popf
mov dword [ecx], esi
pop ebx
mov ecx, dword [esp]
lea esp, [esp + 4]
mov ebp, dword [esp]
lea esp, [esp + 4]
mov edx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
cmp edi, 0xfc270add
je 0x49c00f
pushf
call 0x49c065
mov dword [esp], ebp
call 0x49c0c8
inc esp
imul ebx, dword [ecx + 0x40], 0x6f6a5353
inc ebx
inc esi
dec edx
pop edi
imul edx, dword [edi + 0x62], 0x40556e57
arpl word [ebx + 0x4c], bx
push edx
inc esi
dec edx
push edx
bound edx, qword [eax + 0x4f]
push edi
inc ebx
inc ebp
imul eax, dword gs:[edi + 0x6f], 0x4f
dec edx
dec ebx
pop edi
push esp
push 0x565b5746
push 0x4c4d
jnp 0x49c0f8
bound esp, qword [ebp + 0x54]
jnp 0x49c104
pop edi
push ecx
dec edx
push ecx
push edi
pop esi
dec esp
pop edx
inc eax
inc esp
push ecx
pop eax
push ecx
imul esp, dword [ebp + 0x6a], 0x58
jnp 0x49c12b
push ebx
pop edi
imul bp, word [edx + 0x49], 0x6a62
dec esp
arpl word [edi + 0x60], sp
mov ebp, dword [esp]
lea esp, [esp + 4]
push ebx
lea ebx, [esp + 0xa]
lea esp, [esp - 4]
mov dword [esp], ecx
push esi
mov ecx, ebp
add ecx, 0xfff85e8b
push word [esp + 0x10]
popf
and al, 4
and al, 2

Function at 0x49cd98
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
inc dx
js 0x49cdf4
push 0x46426c4b
Function at 0x4a626e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], ebx
call 0x4a6184
popal
imul ecx, dword [ebp + 0x57], 0x68544a45
dec esp
outsd dx, dword [esi]
jnp 0x4a61e4
jnp 0x4a61c8
push ecx
dec ecx
push edi
inc ecx
dec eax
insd dword es:[edi], dx
dec eax
inc edi
push ecx
push eax
pop esp
arpl word [ecx + 0x66], cx
insb byte es:[edi], dx
arpl word [eax + 0x43], bp
dec eax
mov ebx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], ecx
mov ecx, 0x2c4e6d2
cmove ecx, dword [esp + 0xa]
lea ecx, [ebx + ecx - 0x2c4e62e]
mov dword [esp + 0xa], ecx
pop ecx
pop ebx
lock xchg word [esp], ax
sahf
mov ax, word [esp]
lea esp, [esp + 2]
ret
inc ebx
pop ebx
inc ebx
inc edi
pop edx
push esi
dec ebx
dec edi
jns 0x4a6224
imul ebx, dword [esi + 0x58], 0x43606f4d
pop esi
insb byte es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
insd dword es:[edi], dx
inc esi
pop eax
push esi
dec esp
insb byte es:[edi], dx
push edi
inc ecx
bound eax, qword [esi + 0x57]
pop edi
inc ecx
insd dword es:[edi], dx
pop ecx
push esi
pop eax
push ecx
push esi
pushal
pop esp
dec esi
jns 0x4a623a
push edx
dec ebx
outsb dx, byte [esi]
dec ecx
insd dword es:[edi], dx
inc eax
dec edi
pushal
inc edx
dec eax
push edx
bound eax, qword [ecx + 0x1364247c]
out dx, eax
sbb dh, ah
jne 0x4a626c
dec esi
push esp
imul ecx, dword [esi + 0x46], 0x5159534d
dec edi
pop ebx
arpl word fs:[edi + 0x56], bp
dec eax
inc ecx
pushal
imul ebx, dword [edx + 0x60], 0x6c
push 0x45
dec ecx
pop edx
outsd dx, dword [esi]
pop esp
push ebx
push edi
popal
push edx
inc edx
pop edi
push 0x69
dec eax
dec ecx
inc eax
inc eax
dec edi
insd dword es:[edi], dx
outsb dx, byte [esi]
push esi
pop edi
dec esp
pop edi
inc esp
dec eax
imul ebx, dword [ecx + 0x50], 0x4a
push ecx
dec ebx
dec ebp
jnp 0x4a6293
inc esi
inc edi
dec esi
arpl word gs:[esi + 0x68], sp
dec ecx
inc eax
pushal
insw word es:[edi], dx
push edi
pop eax
push eax
pop ecx
pop eax
dec esi
jns 0x4a62bb
jnp 0x4a62cd
push edi
dec esp
outsd dx, dword [esi]
push edx
push esp
popal
dec ebp
push ecx
push dword [ebp + 8]
cmp dword [esp + 0x50], 0x9f7a2e2d
je 0x4f26a4
call 0x4a62bb
mov byte [eax + 0x1c], 1
push dword [ebp - 8]
push esp
je 0x4a6294
push esi
cmp edx, 0x7fffffff
cmp edi, 0x4211e8
palignr xmm5, xmm4, 8
test ah, ah
je 0x4a62b9
invalid
js 0x4a62fe
bound eax, qword [ecx + 0x76]
or al, 0x65
insd dword es:[edi], dx
imul ebp, dword [ebx + 0x4b], 0x5c6e03d9
push edi
pop eax
je 0x4a62b9
push 1
ret
dec esi
jnp 0x4a62bb
push dword [esp]
xor al, 0x24
add dword [esp], 0xaf8
add dword [esp + 4], 0x8a
ret
add bl, al
call dword [sym.imp.KERNEL32.dll_RaiseException]
imul edx, dword [ebx + 0x41], 0xffffffc1
loop 0x4a62f8
pop ebx
pushal
add esi, ecx
inc edx
ret
mov eax, edi
test esi, esi
push ebp
dec eax
mov edx, dword [ebp - 0xf8]
pop edi
mov esi, dword [ebp + 8]
cmp ecx, edi
jne 0x4a6344
cmp dword [esp + 0x5c], 0x6e21619
je 0x4a6394
pop ecx
cmp ebp, 0x67af6799
je 0x4a6367
invalid
Function at 0x4a9fb2
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, ecx
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, dword [eax]
push edi
mov esi, dword [eax]
test esi, esi
imul byte [eax + 0x67]
adc eax, dword [eax]
add byte [esi - 0x64], ah
call 0x4a9fbf
mov dword [esp], ebp
call 0x4a9fea
pop esi
push 0x4c474445
inc edx
inc edx
inc ecx
dec ebp
outsb dx, byte [esi]
inc edx
outsd dx, dword [esi]
insd dword es:[edi], dx
jnp 0x4aa035
dec eax
push ebp
jns 0x4aa034
dec esp
pop ecx
dec esp
pop ebp
imul ebp, dword [eax + 0x6f], 0x6262785d
inc ebp
pop esi
mov ebp, dword [esp]
lea esp, [esp + 4]
call 0x4a9ff6
mov dword [esp], esi
mov esi, 0x75
cmove esi, dword [esp + 0xa]
add esi, ebp
mov dword [esp + 0xa], esi
pop esi
pop ebp
lock xchg word [esp], ax
xchg al, ah
sahf
mov ax, word [esp]
lea esp, [esp + 2]
ret
pushal
arpl word [ecx + 0x42], bx
outsb dx, byte [esi]
insb byte es:[edi], dx
popal
jnp 0x4aa07c
push eax
arpl word [ecx + 0x78], bx
pop eax
dec edi
pop ecx
push 0x3d
pop esi
pop esi
jne 0x4aa024
cmp eax, 0xea755e5e
mov dword [eax], esi
cmp edx, 0x94aad29f
jne 0x4aa05b
dec edi
js 0x4aa08d
arpl word [edx + 0x41], bp
bound eax, qword [eax + 0x47]
dec ecx
push ebx
pop edi
pop esp
dec edi
inc ebp
imul esp, dword [esi - 0x64], 0xffffffe8
push eax
add byte [eax], al
add byte [ebx - 0x77403c0], cl
pushf
call fcn.004aa0b2
mov eax, dword [eax - 4]
mov edi, eax
mov esi, eax
push edi
inc eax
jg fcn.004aa071
pop ecx
push ebx
imul esi, dword [ebp + 0x10], 0xffffff83
invalid
and eax, 0x3f
inc eax
outsb dx, byte [esi]
dec edx
arpl word [ebp + 0x6b], dx
dec esp
pop ebp
js 0x4aa0e0
and al, 0x8d
and al, 4
lea ebx, [esp + 2]
push edx
mov ecx, edi

Function at 0x4ac649
Capabilities:
Parse pe header

Disassembly:
and dword [eax], 0xffffffe3
jnp 0x4ac6af
push ebx
js 0x4ac6bf
push ecx
push esi
push ecx
mov ecx, ebx
mov dword [ebp - 4], eax
push 0
js 0x4ac6a8
inc ebp
inc ecx
inc edx
push 0x64
push dword [ebp - 0x64]
push 0x53
push eax
mov byte [edi], 0
inc ebx
dec si
push ecx
push 0xffffffffffffff89
inc ebp
call 0xbd38c5f8
jp 0x4ac6f8
adc byte [eax], al
cmp ecx, 0x41c268
call fcn.004aa817
push 0x57514d5e
call fcn.004aa687
imul ebx, dword [esi + 0x56], 0xb8e9655b
add byte [eax], al
add byte [ebp + 0x46], bl
pop esi
dec eax
pop ecx
push edx
inc esi
pop eax
jns 0x4ac72a
insb byte es:[edi], dx
invalid
jmp 0x4ac76c
push ebp
jns 0x4ac64c
push ebp
cld
mov edi, edi
push 0x10
je 0x4acc3d
mov al, cl
imul eax, esi, 0x18
call fcn.004ad568
je 0x4ac6f1
push 0x80515278
cmp dword [eax], eax
jecxz 0x4ac693
ret 0x850f
add byte [eax], al
inc ebx
arpl word [edi - 0x7d], ax
les edx, [eax]
jmp 0x4ac737
invalid
add bl, al

Function at 0x4ac8a4
Capabilities:
Parse pe header

Disassembly:
pop ebp
bound ebp, qword [ecx + 0x5f]
inc ebx
dec esi
pushal
inc edi

Function at 0x4aca73
Capabilities:
Parse pe header

Disassembly:
mov ebp, dword [esp]
lea esp, [esp + 4]
call fcn.004aca7f
Function at 0x4ae948
Capabilities:
Get number of processors

Disassembly:
xor byte [edi - 0x7f], ch
inc eax
pop edi
jne 0x4ae8e1
dec esi
cmp dword [edi], ecx
pop edx
pop esi
push esi
outsb dx, byte [esi]
outsd dx, dword [esi]
pop edi
inc edi
pop ecx
cmp ebp, 0xc6cfa9ef
jne 0x4ae91a
push ebp
imul esp, dword [ecx + 0x55], 0x4b
inc ebp
dec eax
sub eax, 1
mov esi, dword [ebp + 8]
dec edi
inc edx
pop ebx
xor edx, edx
movzx eax, word [ebx*4 + 0x41b6a4]
push 0x17
push 0x5e406f5c
push edx
pop ecx
insd dword es:[edi], dx
test edx, edx
call fcn.004a5deb
jne 0x4ae92c
ret
pop ecx
cmp dword [esp - 0x14], 0x630e44c5
je 0x52c331
mov dword [esi], eax
cmp dword [esp + 0x70], 0x5724979b
jl 0x4ae952
jo 0x4ae8cb
xchg edi, eax
and al, 0x57
jne 0x4ae986
arpl word [edi + 0x68], sp
inc edx
mov edx, 0x68016afa
inc ebp
dec esi
pop esi
push eax
push 1
push 0x505e4e45
push 0x54
push eax
dec esi
arpl word [edi + 0x51], ax
push ecx
test al, 0x40
test si, si
mov edx, 0x8040
push eax
push ebx
add byte [eax + 0x53], dl
dec edx
dec esi
test eax, eax
call fcn.004b24d6
mov bl, byte [eax]
mov edx, dword [ebx + 0x1c]
push 0
call 0x4ae97d
add byte [ecx + 0x78], ch
imul ebp, dword [edx + 0x5a], 0x6f
push ecx
insd dword es:[edi], dx
push esp
inc esp
mulpd xmm2, xmm0
jmp 0x508e92
call 0x4ae9f5
pop ecx
palignr xmm0, xmm2, 0xc
je 0x4ae9c0
popal
inc eax
inc ecx
pop edi
imul ebp, dword [eax - 0x18], 0x50004204
inc esp
imul ecx, dword gs:[ecx - 0x91b73], 0xffffffff
pop eax
push edi
pop ebx
push dword [0x4211e0]
push dword [eax]
push ebx
js 0x4ae93b
call dword [ebp - 0x42]
cmp byte [edi], bl
inc edx
add byte [esi - 0x75], ah
dec ebp
cld
outsb dx, byte [esi]
mov eax, dword [esp + 0x14]
jmp 0x4aea0b
inc ebp
dec esi
pop edx
push ebp
add esp, 0xc
imul ebp, ecx, 0xffffff72
mov eax, dword [ebx + 0x10]
push ebx
push dword [esi + 0x30]
inc ebp
js 0x4aea74
push 0x1cc
outsb dx, byte [esi]
pop edi
insd dword es:[edi], dx
push eax
popal
inc edi
mov eax, edi
mov edi, edi
add eax, dword [ebp - 0x748]
lea eax, [esi + ebx*4]
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 8]
push esi
call fcn.004ada7f
invalid
je 0x4aea66
push edi
pop esp
mov dword [eax + 0x18], esi
je 0x4aeaa3
xor eax, eax
ret
aaa
neg dword [edi]
mov word [edi], cs
inc esp
fsubr dword [edx + 0x16]
outsb dx, byte [esi]
push ebx
add byte [eax], al
add byte [ebx + 0x9f00cc0], al
or byte [ebx + 0x78810845], cl
sbb byte [eax], al
add al, byte [eax]
add byte [eax - 7], ch
add al, byte [eax]
add al, ch
add byte [eax], al
add byte [eax], al