joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101214c0
Capabilities:
Create pipe

Disassembly:
push edi
xor edi, edi
push edi
push 0x101a80f8
push 0x101a810c
push 0x101a79a0
mov dword [0x101a810c], edi
mov dword [0x101a79a4], edi
mov dword [0x101a79a0], edi
mov dword [0x101a80f4], edi
mov dword [0x101a8108], edi
mov dword [0x101a7994], edi
mov dword [0x101a7990], edi
mov dword [0x101a7998], 1
mov dword [0x101a80f8], 0xc
mov dword [0x101a80fc], edi
mov dword [0x101a8100], 1
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x1012152d
pop edi
ret
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 1
push edi
push 0x101a80f4
call esi
push eax
mov eax, dword [0x101a810c]
push eax
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push eax
call ebx
test eax, eax
je 0x10121581
push 2
push edi
push edi
push 0x101a79a4
call esi
mov ecx, dword [0x101a79a0]
push eax
push ecx
call esi
push eax
call ebx
test eax, eax
je 0x10121581
push 0x101a79a0
call fcn.10082e10
test eax, eax
jne 0x10121587
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov dword [0x101a79a0], edi
mov eax, 1
pop edi
ret

Function at 0x10121d40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10145ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
mov eax, dword [0x10189710]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x30], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x10121d8d
mov eax, dword [eax]
jmp 0x10121d8f
xor eax, eax
mov ecx, dword [esi]
lea edx, [esp + 0xc]
push edx
push eax
mov eax, dword [ecx + 0x3c]
push esi
call eax
test eax, eax
jge 0x10121dad
push 0x1017f060
push esi
push eax
call fcn.101451f0
push 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x10
push ebx
call fcn.10128fa9
mov esi, dword [esp + 0x44]
xor edx, edx
add esp, 0x10
mov word [esp + 0xc], dx
test esi, esi
je 0x10121e06
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x10121e06
test esi, esi
je 0x10121e06
mov eax, dword [esi]
test eax, eax
je 0x10121ded
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
test eax, eax
je 0x10121dfd
push eax
call fcn.10128f5b
add esp, 4
push esi
call fcn.10128f9e
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x28
ret 4
Function at 0x10127db1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10189710]
jne 0x10127dbb
repz ret
jmp fcn.10130dc4

Function at 0x1013fca0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10131c38
and dword [ebp - 4], 0
cmp dword [0x101a6820], 0
mov ebx, eax
jne 0x1013fd51
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1013fe02
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1014c9d0
push edi
call esi
test eax, eax
je 0x1013fe02
push eax
call fcn.10131bc6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101a6820], eax
call esi
push eax
call fcn.10131bc6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101a6824], eax
call esi
push eax
call fcn.10131bc6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101a6828], eax
call esi
push eax
call fcn.10131bc6
pop ecx
mov dword [0x101a6830], eax
test eax, eax
je 0x1013fd51
push 0x1014c978
push edi
call esi
push eax
call fcn.10131bc6
pop ecx
mov dword [0x101a682c], eax
mov eax, dword [0x101a682c]
cmp eax, ebx
je 0x1013fda9
cmp dword [0x101a6830], ebx
je 0x1013fda9
push eax
call fcn.10131c41
push dword [0x101a6830]
mov esi, eax
call fcn.10131c41
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1013fda9
test edi, edi
je 0x1013fda9
call esi
test eax, eax
je 0x1013fda0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1013fda0
test byte [ebp - 0xc], 1
jne 0x1013fda9
or dword [ebp + 0x10], 0x200000
jmp 0x1013fde2
mov eax, dword [0x101a6824]
cmp eax, ebx
je 0x1013fde2
push eax
call fcn.10131c41
pop ecx
test eax, eax
je 0x1013fde2
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1013fde2
mov eax, dword [0x101a6828]
cmp eax, ebx
je 0x1013fde2
push eax
call fcn.10131c41
pop ecx
test eax, eax
je 0x1013fde2
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101a6820]
call fcn.10131c41
pop ecx
test eax, eax
je 0x1013fe02
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1013fe04
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10011620
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100578ce
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esi + 4]
cmp dword [ecx + 0x16], 0
mov eax, 0x32
je 0x1001172e
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp + 8]
call fcn.1000c280
mov edi, dword [esi + 4]
mov dword [ebp - 4], 0
call sym.ScCore.dll_public:_static_class_ScCore::Encoder_const____cdecl_ScCore::Encoder::getBinary_void_
cmp dword [edi + 0x12], eax
setne al
cmp byte [ebp + 0xc], 0
je 0x10011692
test al, al
je 0x10011692
mov eax, dword [edi + 0x22]
push eax
lea ecx, [ebp + 8]
call fcn.1000c280
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x12]
push edx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp + 8]
call fcn.1000c280
mov edi, eax
test edi, edi
jne 0x100116d7
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100116d7
mov edx, dword [esi + 4]
mov ecx, dword [edx + 0x16]
mov edx, dword [ebp - 0x14]
push ecx
push 1
push eax
push edx
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
cmp eax, 1
je 0x100116d7
mov edi, 0x34
mov eax, dword [esi + 4]
mov ecx, dword [eax + 0x16]
push ecx
call dword [sym.imp.msvcr100.dll_ferror]
add esp, 4
test eax, eax
je 0x10011702
mov edx, dword [esi + 4]
mov eax, dword [edx + 0x16]
push eax
call dword [sym.imp.msvcr100.dll_clearerr]
add esp, 4
mov edi, 0x34
jmp 0x1001171d
mov ecx, dword [esi + 4]
mov edx, dword [ecx + 0x16]
push edx
call dword [sym.imp.msvcr100.dll_ftell]
mov esi, dword [esi + 4]
add esp, 4
cmp eax, dword [esi + 0x1a]
jle 0x1001171d
mov dword [esi + 0x1a], eax
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call sym.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x10012490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057a25
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x10083a30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
mov edx, dword [edi]
mov dword [ebp - 0x814], eax
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x820], edi
call eax
mov eax, dword [edi + 4]
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x828]
push edx
add eax, 4
push eax
call fcn.1000c280
add esp, 0xc
test eax, eax
jne 0x1001253e
mov ecx, dword [edi + 4]
push 0x1005f994
push ecx
call fcn.1000c280
mov esi, eax
add esp, 8
test esi, esi
jne 0x10012672
mov edx, dword [edi + 4]
mov ebx, dword [edx + 0x16]
mov esi, dword [sym.imp.msvcr100.dll_fseek]
push 2
push eax
push ebx
call esi
add esp, 0xc
test eax, eax
je 0x10012548
mov eax, dword [edi]
mov edx, dword [eax + 0x10]
mov ecx, edi
call edx
mov eax, 0x34
jmp 0x10012674
mov esi, 0x30
jmp 0x10012672
push ebx
call dword [sym.imp.msvcr100.dll_ftell]
push 0
push 0
push ebx
mov edi, eax
call esi
add esp, 0x10
test eax, eax
je 0x10012576
mov ecx, dword [ebp - 0x820]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
call edx
mov eax, 0x34
jmp 0x10012674
mov eax, dword [ebp - 0x814]
push eax
lea ecx, [ebp - 0x81c]
call fcn.1000c280
mov ecx, dword [ebp - 0x818]
push 0x1005f9ec
push ecx
mov dword [ebp - 4], 0
call fcn.1000c280
mov esi, eax
add esp, 8
test esi, esi
jne 0x10012653
mov edx, dword [ebp - 0x818]
mov eax, dword [edx + 0x16]
mov dword [ebp - 0x814], eax
test edi, edi
je 0x10012611
mov esi, edi
cmp edi, 0x800
jbe 0x100125cf
mov esi, 0x800
push ebx
push 1
lea ecx, [ebp - 0x810]
push esi
push ecx
call dword [sym.imp.msvcr100.dll_fread]
add esp, 0x10
test eax, eax
je 0x10012692
mov edx, dword [ebp - 0x814]
push edx
push 1
lea eax, [ebp - 0x810]
push esi
push eax
call dword [sym.imp.msvcr100.dll_fwrite]
add esp, 0x10
test eax, eax
je 0x10012692
sub edi, esi
jne 0x100125c0
lea ecx, [ebp - 0x81c]
call sym.ScCore.dll_public_virtual:_int___thiscall_ScCore::File::close_void_
mov esi, eax
test esi, esi
jne 0x10012653
mov ecx, dword [ebp - 0x818]
add ecx, 4
push ecx
call fcn.1000c280
mov edx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x818]
push edx
push eax
add ecx, 4
push ecx
call fcn.10035870
add esp, 0x10
mov esi, eax
mov ecx, dword [ebp - 0x820]
mov edx, dword [ecx]
mov eax, dword [edx + 0x10]
call eax
lea ecx, [ebp - 0x81c]
mov dword [ebp - 4], 0xffffffff
call fcn.1000c280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10054c72
mov esp, ebp
pop ebp
ret 4
mov esi, 0x34
jmp 0x10012653
Function at 0x100374a0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
test esi, esi
jne 0x100374cb
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov eax, esi
call fcn.1000c280
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
je 0x100374f9
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x100374f2
mov eax, esi
mov dword [ebp - 4], eax
jmp 0x100374f5
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1003750b
lea ecx, [ebp - 8]
push ecx
push 0x10037470
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10037510
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x10083a30]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.1000c280
mov dword [ebp - 0x188], eax
test eax, eax
je 0x1003768b
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
test esi, esi
je 0x10037565
mov edi, dword [sym.imp.USER32.dll_GetWindow]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 4
push esi
call edi
test eax, eax
jne 0x10037561
push esi
call ebx
test eax, eax
je 0x10037565
mov esi, eax
jmp 0x10037551
push 0x100
lea eax, [ebp - 0x184]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x1003767b
push 0x80
lea ecx, [ebp - 0x84]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetClassNameA]
test eax, eax
je 0x1003767b
lea edx, [ebp - 0x184]
push edx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, esi
jne 0x1003767b
test esi, esi
je 0x1003767b
push 0xfffffffffffffffc
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push esi
mov ebx, eax
call edi
mov ecx, dword [ebp - 0x188]
push 0
push ecx
mov esi, eax
call edi
mov edi, eax
test ebx, ebx
je 0x1003767b
cmp edi, esi
je 0x1003767b
mov ebx, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x10037628
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
push esi
push edi
call ebx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054c72
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2000
call esi
push 2
lea ecx, [ebp - 0x190]
push ecx
push 0
push 0x2001
mov dword [ebp - 0x190], 0
call esi
mov edx, dword [ebp - 0x188]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 2
lea eax, [ebp - 0x18c]
push eax
push 0
push 0x2001
call esi
mov ecx, dword [ebp - 0x188]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10054c72
mov esp, ebp
pop ebp
ret
Function at 0x10037780
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0xc], 0
jne 0x10037790
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100377b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b5b3
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10083a30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [esi], vtable.ScCore::Thread.0
mov dword [esi + 0xc], edi
mov byte [esi + 0x10], 1
call fcn.1000c280
mov ebx, eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push sym.ScCore.dll_private:_static_unsigned_int___stdcall_ScCore::Thread::go_void__
push edi
push edi
mov dword [ebp - 0x18], edx
call dword [sym.imp.msvcr100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
cmp eax, 0xffffffff
jne 0x10037839
mov dword [esi + 0xc], 0x20
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov dword [esi + 8], ecx
mov eax, dword [0x10083aa8]
cmp eax, edi
jne 0x1003784d
call sym.ScCore.dll_public:_static_class_ScCore::Context____cdecl_ScCore::Context::get_void_
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x52], ebx
mov dword [eax + 0x56], edx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037b30
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083674]
cmp eax, 0xffffffff
je 0x10037b80
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10037b71
cmp esi, dword [0x10083be8]
jne 0x10037b5a
mov dword [0x10083be8], 0
mov ecx, esi
call fcn.10020480
mov ecx, esi
call fcn.1000c280
push esi
call sub.msvcr100.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [0x10083674]
push 0
push eax
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x10037b90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083be8]
test eax, eax
jne 0x10037bfa
mov eax, dword [0x10083674]
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10037bfa
push esi
push 0x16c
call sub.msvcr100.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x10037bc6
mov ecx, eax
call fcn.1000c280
mov esi, eax
jmp 0x10037bc8
xor esi, esi
cmp byte [0x10083be4], 0
jne 0x10037be2
mov ecx, esi
mov dword [0x10083be8], esi
call fcn.10020740
mov eax, esi
pop esi
ret
mov ecx, dword [0x10083674]
push esi
push ecx
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.10020740
mov eax, esi
pop esi
ret

Function at 0x100437a0
Capabilities:
Encode data using xor

Disassembly:
movzx ecx, word [edx]
xor eax, eax
test cx, cx
je 0x100437c6
lea ebx, [ebx]
imul eax, eax, 0xf4243
movzx ecx, cx
add edx, 2
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x100437b0
ret
Function at 0x10054c72
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10083a30]
jne 0x10054c7c
repz ret
jmp fcn.100553b9
Function at 0x485524
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x49cdb0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0047c542
and dword [ebp - 0x14], 0
cmp dword [0x49f260], 0
mov dword [ebp - 0x18], eax
jne 0x4855d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x48567f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x48567f
mov esi, dword [fcn.004759f0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x49f260], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x49f264], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x49f268], eax
call edi
push eax
call esi
mov dword [0x49f270], eax
test eax, eax
je 0x4855d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x49f26c], eax
mov eax, dword [0x49f26c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.004759f4]
cmp eax, ecx
je 0x485630
cmp dword [0x49f270], ecx
je 0x485630
push eax
call esi
push dword [0x49f270]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x485630
test ebx, ebx
je 0x485630
call edi
test eax, eax
je 0x485627
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x485627
test byte [ebp - 8], 1
jne 0x485630
or dword [ebp + 0x10], 0x200000
jmp 0x485663
mov eax, dword [0x49f264]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x485663
mov eax, dword [0x49f268]
cmp eax, dword [ebp - 0x18]
je 0x485663
push eax
call esi
test eax, eax
je 0x485663
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x49f260]
call esi
test eax, eax
je 0x48567f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x485681
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047f404
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1055d8d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push esi
push 0x100478c
lea ecx, [ebp - 0x10]
call fcn.01038347
call fcn.01032a62
inc eax
test al, 0x59
pushal
push esi
add eax, dword [eax]
mov al, byte [0xa02cd41c]
push ss
adc al, 0xa
and al, ch
push ebx
jmp 0x1055de3
add byte [eax], al
pushal
nop
cmp ch, byte [eax + esi*2]
cmp dword [ebp + 0xc], 0
jne 0x1055e24
call int.0121d60e
cmp bl, bh
sub al, 0x10
pop esp
pop es
add byte [ebx], ah
add byte [eax], al
and byte [ebx + edi*8], dh
sub al, 0
call fcn.0108ab6c
sub byte [ebx - 0x150bffd4], dh
or al, 0x40
fild word [ecx]
add byte [eax + 0x402cb32c], al
mov esi, 0x80070057
jmp 0x10560eb
call fcn.01032a62
sbb dword [esi + 0x57], edi
loopne 0x1055e34
add al, byte [eax]
xor byte [eax], cl
mov edi, 0xd70e102b
adc byte [esi], cl
xlatb
sub byte [eax - 0x7d], dh
jge 0x1055e54
add esi, dword [ebp - 0x4f]
call fcn.01077ff4
wait
add byte [eax], al
cmp ah, 3
sub eax, 0x7165850
xor al, bh
add ebp, dword [0x4d13e810]
add eax, dword [eax]
call fcn.0108ab6c
aam 0xfd
sub al, 0
ret 0x750
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x105613a
test byte [eax + 0x3c], 2
je 0x105613a
call fcn.01254918
sub al, 0
add byte [eax - 0x2fd36ce8], ah
sbb al, 0x93
sub al, 0x80
xchg edx, eax
or al, 0xe
xor al, ch
dec ebx
leave
std
push dword [eax]
push cs
pop eax
pushal
push cs
add byte [eax], al
adc byte [edi + eax], dl
sub al, 0x60
xchg byte [edx + 0x24], bl
adc byte [esi + 0x68], dl
pushfd
add byte es:[ecx], al
push 0x36
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
invalid
call int.0121d60e
push eax
sbb ch, byte [eax + esi*4]
push edi
and eax, dword [eax - 0x7fffffdc]
dec esp
sbb ch, byte [eax + esi*4]
lea ecx, [ebp - 0x10]
call fcn.01038364
call fcn.01032a62
mov byte [edx], cl
pop esi
and byte [edi], dl
add byte [eax], al
pushal
inc eax
add eax, 0x3170902f
add edx, eax
call fcn.01031025
mov edi, 0x24001447
shr dword [eax + edx*2], cl
and bl, dl
sub al, 0x50
lds eax, [eax + eax]
add al, ch
xor al, 0x5e
and byte [eax], al
xchg edx, eax
loope 0x1056139
inc eax
aas
mov ebp, 0x38682021
sub al, 0xf0
and dword [eax], eax
add al, ah
lea ecx, [ebp - 8]
call fcn.01033b21
call fcn.01254918
wait
add byte [eax], al
loopne 0x105620c
out 0x1f, eax
add byte [ebx + 0x64e00000], bl
or eax, 0xd68b02d
sub eax, 0x6d348f0
add al, ch
pushal
out 0x1f, eax
add byte [ebp - 0x2f400000], al
push cs
sub al, 0x70
aam 0xe
sub al, 0xd0
jo 0x10561a0
and esp, dword [eax]
lea ecx, [ebp - 4]
call fcn.0104c14e
call fcn.0125bfba
add esp, dword [edx + esi*4 - 0x40]
xor eax, 0x4300ddd
cdq
sub al, 0xb0
pop ss
add byte [eax], al
and byte [ebx - 0x3d36a13a], cl
adc al, 0
add al, 0x55
in al, 0x89
jge 0x10561f8
Function at 0x107ba2c
Capabilities:
Encode data using xor

Disassembly:
call [edi - 0x75]
invalid
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x18
mov ecx, dword [0x12d430c]
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push esi
mov esi, dword [0x12d4308]
push edi
add ecx, 4
call fcn.010538b5
call fcn.0108ab6c
sbb byte [esi + 0x2c], ah
mov al, 0x2b
leave
sbb eax, 0x1e8f0
inc eax
sbb al, 0x66
sub al, 0
mov ecx, dword [esi]
lea edx, [ebp - 4]
push edx
push 0x1001d44
push dword [ebx + 8]
push eax
push esi
call dword [ecx + 0x14]
call fcn.01031025
mov dh, 0xf
inc ebp
loopne 0x107ba22
sub dword [eax + edx], ebp
mov byte [ecx], ch
sub al, 0x90
std
add dword [eax], eax
shr al, 1
dec esi
invalid
Function at 0x10908a0
Capabilities:
Encode data using xor

Disassembly:
loopne 0x10908b3
sub eax, 0x2d22dc50
adc byte [eax - 0x16300000], al
adc bh, dl
invalid
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
and al, 4
mov ebp, esp
sub esp, 0x28
push esi
push edi
lea eax, [ebp - 0x18]
push eax
push dword [ebx + 8]
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], edi
call fcn.01040848
call fcn.0125bfba
inc ecx
jns 0x109088f
sbb byte [ecx + 0x54d0044b], 0x1e
sub eax, 0x3390
push eax
call fcn.012049f6
aam 0x1b
sub eax, 0x2d1bd880
adc byte [esi], dl
add byte [eax], al
invalid