joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
nop
mov ecx, 0x27b11fbc
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x4f4c08bc
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x60
push 0x118dd64
call fcn.0040121c
mov edi, 0x94
mov eax, edi
call fcn.004011dc
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x118dd64], ecx
mov eax, dword [esi + 4]
mov dword [0x118dd68], eax
mov edx, dword [esi + 8]
mov dword [0x118dd6c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x118dd70], esi
cmp ecx, 2
je 0x401060
or esi, 0x8000
mov dword [0x118dd74], esi
shl eax, 8
add eax, edx
mov dword [0x118dd64], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40109b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40109b
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4010b3
cmp eax, 0x20b
je 0x4010a0
mov dword [ebp - 0x1c], esi
jmp 0x4010c7
cmp dword [ecx + 0x84], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4010c1
cmp dword [ecx + 0x74], 0xe
jbe 0x40109b
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00401224
pop ecx
test eax, eax
jne 0x4010f3
cmp dword [0x118dd64], 1
jne 0x4010e0
call fcn.00401224
push 0x1c
call fcn.00401224
push 0xff
call fcn.00401224
pop ecx
pop ecx
call fcn.00401224
mov dword [ebp - 4], esi
call fcn.00401224
test eax, eax
jge 0x40110c
push 0x1b
call fcn.00401224
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x118dd64], eax
call fcn.00401224
mov dword [0x118dd68], eax
call fcn.00401224
test eax, eax
jge 0x401132
push 8
call fcn.00401224
pop ecx
call fcn.00401224
test eax, eax
jge 0x401143
push 9
call fcn.00401224
pop ecx
push 1
call fcn.00401224
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401159
push eax
call fcn.00401224
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401224
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40117a
movzx eax, word [ebp - 0x40]
jmp 0x40117d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401228
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x40119b
push edi
call fcn.00401220
call fcn.00401224
jmp 0x4011cd
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401224
ret

Function at 0x401228
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
push edi
push ebx
lea eax, [ebp - 4]
push eax
push 0x40
push 0x1c7000
push section..rdata
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x401252
push 0xfc737c
jmp 0x40125e
pop ebx
pop edi
pop esi
leave
ret 0x14
ret
Function at 0x44999f
Capabilities:
Check for software breakpoints

Disassembly:
cli
pop ds
mov gs, word [edi + 0xc9652bd]
clc
xor al, 0x7a
dec edi
sub eax, 0x78ce2e76
adc eax, 0xbd5f1ecc
xor dword [esi + 0x43], 0x8495cdc3
fisubr word [eax]
test dword [eax + 0x70], ecx
jge 0x449970
sbb al, byte [ebx + 0x4e]
or eax, 0xd6eedd59
mov esp, 0xa88b3d63
cmp eax, 0x6421a88b
sahf
cld
cmp eax, 0x6421a88b
sahf
cld
in eax, 0xc3
sub byte [edi - 0x75604f43], bh
push ebx
in eax, 0xe0
mov al, byte [0x2c9caa3c]
salc
das
or ebp, dword [ecx - 0x52]
pop esp
fcomp dword [edi - 2]
pop ecx
push 0xce6c779f
fild dword [0x1ffe4709]
pop ds
dec ecx
mov ah, 0x9c
mov edi, 0x4ecb9db7
mov bl, 0xc
jnp 0x449a23
loopne 0x4499d6
jecxz 0x4499f3
dec esi
jge 0x449970
invalid
fimul dword [ebp - 0x30fb7393]
dec edi
enter 0xffffffffffffc90a, 0x6d
adc byte [ecx], bl
cmp edi, dword [0x44be383d]
into
mov edx, 0x152ec1c9
adc edx, ebp
invalid
loop 0x4499a8
mov ch, 0x35
mov dh, 0x6c
mov edx, 0x5667e422
xlatb
mov word [edi + 0x19], fs
push cs
rcr dword [edi + 0x2d], 1
pop esp
shr byte [ebx + ebx + 0x6f], 1
cmp ebx, dword [esp + 9]
pop ds
dec edx
push bx
or dword [eax], ebx
fidiv word [ebp - 0x663cc4da]
mov ecx, 0xc9df8b0
push ebp
dec esp
dec ebp
sub al, 0xcb
jl 0x449aaa
ret
aas
pop edi
xchg ebp, eax
lodsb al, byte [esi]
lea esi, [edi - 0x42]
mov ch, 0x40
pop esp
sbb al, 0xc5
cmp al, 0xcc
push ecx
popfd
jl 0x449a4d
lodsb al, byte [esi]
cld
sub ebx, dword [edx - 0x54]
test al, 0xac
insb byte es:[edi], dx
pop edi
iretd
std
inc esp
adc byte [esi + 0x4a36aff3], cl
sar dword [edi + 0x552daf06], cl
lodsd eax, dword [esi]
das
jne 0x449af4
xor ecx, dword [ecx + 0x6beb281c]
mov byte [eax + 0x39], bh
jbe 0x449a9c
rcr byte [ebx], cl
sbb ch, byte [edi + ecx*8]
pushfd
sub eax, 0xd62b9c1d

Function at 0x44a010
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.kernel32.dll
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 5
mov esi, eax
call sub.MPR.dll_WNetCloseEnum
push str.GetFirmwareEnvironmentVariableA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x44a088
test esi, esi
je 0x44a066
mov ecx, dword [0x650d9c]
push 0x650ab8
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
push 0
push 0
push str.CLSIDB530CB63_D9DF_4B49_9439_34539662E598Version
push 0x850ee8
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
pop edi
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
pop ecx
ret
pop edi
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x4dba6f
Capabilities:
Encode data using xor

Disassembly:
push ecx
lodsd eax, dword [esi]
xchg ebx, eax
fcom dword [ebp - 0x1d]
mov esp, 0xa42f4256
adc al, 0x37
aaa
inc ebx
cmp dh, bl
xor al, dl
add eax, 0x798751ae
jne 0x4dba7b
inc eax
test al, 0xc1
mov bl, 0x72
pushfd
pop edx
mov edx, 0x7a6c2113
ljmp 0x1c4d
Function at 0x56e66e
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
retf
sbb dword [esi], esi
std
and byte [edx], 0xcf
scasb al, byte es:[edi]
adc byte [edx], bl
push 0x4318d6de
or dword [ecx + 0x5505556d], ebp
jnp 0x56e672
fnstenv [ebp - 0x38]
or ch, al
and eax, 0xb158399
ret
js 0x56e694
mov dl, 0xb
jbe 0x56e66c
mov ebx, 0x1901607b
mov ecx, dword [eax]
popfd
sbb edx, dword [edx + eax*2 + 0x52754bf0]
sub esp, dword [esi - 0x265176e]
nop
loopne 0x56e617
add al, 0xe7
jp 0x56e6b9
dec edx
in eax, dx
inc eax
sub eax, 0x1975ddbe
jne 0x56e6af
jns 0x56e6b1
je 0x56e6f6
and ecx, esp
adc dword [edx + 0x4dc29551], esp
fdiv dword [eax + 0x32683ed]
adc byte [ecx + 0xa], al
js 0x56e644
jo 0x56e6ea
xor dword [edx], eax
inc ebp
mov eax, 0x90599efb
test byte [0x8a75da6e], 0x47
outsb dx, byte [esi]
fidiv dword [ebp - 0x76]
inc edi
push ebp
and eax, 0x403c83c6
xor eax, 0x89e1ca65
inc ebp
cmp ah, byte [esi + 0x73bdc70e]
push 0xb1556dd3
fnstsw word [ecx + 0x16]
insd dword es:[edi], dx
push ebp
mov cl, 0xdd
jns 0x56e6ee
mov cs, word [esp + ebp*2]
ja 0x56e6fd
inc edi
fnstenv [0xa633c26d]
mov ebp, 0x769b0267
call 0x63957286
xor esp, dword [esi - 0x64fd9843]
jbe 0x56e6d2
cwde
mov edi, dword [esi]
arpl word [edx*8 + 0x5b3e274d], di
cmp al, 0xd5
dec ebp
daa
pop ebx
push es
movsd dword es:[edi], dword [esi]
out 0xbf, al
mov es, word [ebx + 0x17122009]
pop ss
push es
xor eax, 0xd5d858e0
and al, byte [esi - 0x1b7a5488]
mov byte [ebp - 0x2c5b790a], ch
and al, 0x2d
pushfd
lodsd eax, dword [esi]
test byte [esi + 0x2d24d3a4], 0x9c
or bl, ah
or cl, byte [eax + 0x1c73f4da]
dec ebp
out 0x6b, eax
fnstenv [0x72a8daa8]
fadd qword [ebp - 0x7bb2ea58]
jge 0x56e6e2
jno 0x56e77e
fistp qword [edi + 0x1b080342]
dec ebp
or al, 0x48
push ebp
xor eax, ebx
jl 0x56e735
adc byte [ebp + 0x35], ch
pop edx
in eax, 0x58
out 0x1f, eax
or dword [ebp + 0x66a9c8a5], 0x5744aef3
push ebx
fistp dword [bp + si - 0x1b]
cmc
adc byte [edi], ah
xchg ebp, eax
std
in eax, 8
cmc
and al, 0x46
inc esi
fmul dword [edi - 0x42]
movsb byte es:[edi], byte [esi]
rol edi, 0xae
add byte [esi + 0x2cf6e9c1], 0x53
xchg esi, eax
jecxz 0x56e70b
pop esi
or byte [0x44689df4], ah
invalid
ja 0x56e75d
mov eax, 0xe39bc478
cdq
sbb ecx, dword [eax - 0x1b]
retf

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x3203c0da
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x3203c0e9
pop dword [ebp - 0x30]
mov eax, 0xbfe8e85e
add eax, 0x721ad88b
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x67489c49
sub dword [ebp - 0x40], 0x18f656fe
mov dword [ebp - 0x3c], 0x900ca834
add dword [ebp - 0x3c], 0xa226a411
mov dword [ebp - 0x38], 0xbdbb562a
sub dword [ebp - 0x38], 0x716f11fc
mov dword [ebp - 0x34], 0xfbca6f67
sub dword [ebp - 0x34], 0xfbca6f67
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x7bacf531
add dword [ebp - 0x40], 0xf8c57425
mov dword [ebp - 0x3c], 0x41419bbd
sub dword [ebp - 0x3c], 0xffd53a48
mov dword [ebp - 0x38], 0x9f35ad0d
add dword [ebp - 0x38], 0xc439bf5f
mov dword [ebp - 0x34], 0xd00786be
sub dword [ebp - 0x34], 0xd00786be
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0xbb468bb5
sub eax, 0x89413b3d
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x47061
push 0
call eax
mov ecx, 0x45f5
mov edx, eax
mov edi, 0xbfb48d80
sub edi, 0x8dacb780
add edi, dword [ebp - 0x30]
mov esi, 0x93710087
sub esi, 0xe3e0f0b1
xor dword [ebp - 0x20], 0x328861c1
mov ebx, dword [edi]
add dword [ebp - 0xc], edx
add ebx, esi
xor dword [ebp - 0x10], 0xd8aea13c
mov dword [edx], ebx
mov dword [ebp - 0x28], 0x664f836f
add edx, 0x24430d75
add edx, 0xdbbcf28f
add edi, 0x7fd86c89
add edi, 0x8027937b
loop 0x3203c200
add eax, 0xd5c1eb79
add eax, 0x2a3f1f2e
mov ebx, eax
add eax, 0x183fe066
sub eax, 0x183fe061
mov ecx, 0x293c3264
add ecx, 0x8c3cd9c
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x624c1ee0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x624c1f3b
cmp byte [esi + ebx - 1], 0xa
je 0x624c1f0f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x624c7084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x624c2490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0xf0
mov edi, dword [0x624c7094]
mov esi, dword [ebp + 8]
test edi, edi
je 0x624c2650
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [0x624c7094]
movzx eax, al
bt eax, esi
jae 0x624c26b0
mov ecx, dword [0x624c7084]
xor eax, eax
mov edx, dword fs:[0x18]
cmp dword [edx + 0x24], ecx
je 0x624c2556
test byte [0x624c3030], 8
jne 0x624c25f0
lea ebx, [esp + 0x28]
mov edi, ebx
test byte [0x624c3040], 8
jne 0x624c25a0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov dword [esp + 4], str._04x:
mov dword [esp], edi
mov dword [esp + 8], eax
call dbg.sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x624c2525
cmp esi, 3
jbe 0x624c2560
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.ucrtbase.dll_strlen]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add eax, edi
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x14], edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 8], str._s:_s:_s
lea edx, [edi + 1]
mov dword [esp], eax
mov dword [esp + 0x10], edx
mov edx, dword [esi*4 + str.HaLbNaLbRaLbWaLbGCC:__GNU__13.2.0]
mov dword [esp + 0xc], edx
mov edx, ebx
sub edx, eax
add edx, 0xc8
mov dword [esp + 4], edx
call sym._snprintf.constprop.0
jmp 0x624c2525
mov ecx, dword [0x624c7094]
test ecx, ecx
je 0x624c2690
mov dword [esp], 0x624c3040
call dword [0x624c7094]
test al, 8
je 0x624c24fc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov dword [esp], edi
mov dword [esp + 4], str._04x:
mov dword [esp + 8], eax
call dbg.sprintf
add edi, eax
jmp 0x624c24fc
mov ebx, dword [0x624c7094]
test ebx, ebx
je 0x624c2670
mov dword [esp], 0x624c3030
call dword [0x624c7094]
test al, 8
je 0x624c24e9
call dword [sym.imp.kernel32.dll_GetTickCount]
lea ebx, [esp + 0x28]
mov dword [esp + 4], str._3u._03u:
mov ecx, eax
mov eax, 0x10624dd3
mov dword [esp], ebx
mul ecx
shr edx, 6
imul eax, edx, 0x3e8
mov dword [esp + 8], edx
sub ecx, eax
mov dword [esp + 0xc], ecx
call dbg.sprintf
lea edi, [ebx + eax]
jmp 0x624c24ef
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x624c7094
call sym._load_func.part.0
jmp 0x624c24b0
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x624c7094
call sym._load_func.part.0
jmp 0x624c25fa
mov ecx, dbg.fallback__wine_dbg_get_channel_flags
mov edx, str.__wine_dbg_get_channel_flags
mov eax, 0x624c7094
call sym._load_func.part.0
jmp 0x624c25ae
mov eax, 0xffffffff
jmp 0x624c2556
Function at 0x451bf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0xc]
push edi
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x451c80
mov edi, dword [esp + 0x20]
mov dword [esp + 8], 1
test esi, esi
mov eax, dword [edi]
mov dword [esp + 0x14], eax
jne 0x451c31
lea esi, [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0xc]
push esi
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x451c6b
mov eax, dword [esp + 0x14]
mov dword [edi], eax
pop edi
xor eax, eax
pop esi
pop ecx
ret
cmp esi, 0xea
jne 0x451c80
mov ecx, dword [esp + 0x14]
or eax, 0xffffffff
mov dword [edi], ecx
pop edi
pop esi
pop ecx
ret
pop edi
mov eax, 1
pop esi
pop ecx
ret

Function at 0x451c90
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
sub esp, 0x104
lea ecx, [esp + 4]
push esi
mov esi, dword [esp + 0x110]
push eax
push str.Software_s
push ecx
mov dword [esi], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push 0x20019
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x451d9c
mov edx, dword [esi]
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0xc]
push 0x100
push ecx
push edx
push eax
call ebx
test eax, eax
jne 0x451d8c
push ebp
mov ebp, dword [esp + 0x11c]
push edi
mov edi, dword [esp + 0x118]
mov al, byte [esp + 0x14]
xor edx, edx
test al, al
lea ecx, [esp + 0x14]
je 0x451d3e
cmp al, 0x2e
je 0x451d3e
movsx eax, al
sub eax, 0x30
lea eax, [eax + eax*4]
lea eax, [edx + eax*2]
lea edx, [eax + eax*4]
mov al, byte [ecx + 1]
shl edx, 1
inc ecx
test al, al
jne 0x451d21
cmp byte [ecx], 0x2e
jne 0x451d44
inc ecx
mov al, byte [ecx]
test al, al
je 0x451d57
movsx eax, al
sub eax, 0x30
inc ecx
lea eax, [eax + eax*4]
lea edx, [edx + eax*2]
mov cl, byte [ecx]
test cl, cl
je 0x451d64
movsx ecx, cl
lea edx, [edx + ecx - 0x30]
mov eax, dword [esi]
cmp eax, ebp
jge 0x451d72
mov dword [edi + eax*4], edx
mov eax, dword [esi]
inc eax
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push 0x100
push edx
push eax
push ecx
call ebx
test eax, eax
je 0x451d13
pop edi
pop ebp
mov eax, dword [esi]
pop ebx
test eax, eax
setne al
pop esi
add esp, 0x104
ret
xor al, al
pop esi
add esp, 0x104
ret
Function at 0x451db0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
push ebp
push esi
mov esi, 1
push eax
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x451f01
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebx
push edi
push str.gsapi_new_instance
push ebp
call esi
push str.gsapi_init_with_args
push ebp
mov edi, eax
call esi
mov ebx, eax
push str.gsapi_run_string
push ebp
mov dword [esp + 0x28], ebx
call esi
push str.gsapi_exit
push ebp
mov dword [esp + 0x1c], eax
call esi
push str.gsapi_delete_instance
push ebp
mov dword [esp + 0x20], eax
call esi
xor esi, esi
mov dword [esp + 0x24], eax
cmp edi, esi
je 0x451eee
cmp ebx, esi
je 0x451eee
cmp dword [esp + 0x14], esi
je 0x451eee
cmp dword [esp + 0x18], esi
je 0x451eee
cmp eax, esi
je 0x451eee
lea ecx, [esp + 0x30]
push esi
push ecx
call edi
test eax, eax
jl 0x451eee
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], esi
test eax, eax
jle 0x451e9c
mov ebx, dword [esp + 0x34]
mov edx, dword [ebx]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
push edx
not ecx
dec ecx
push esi
add eax, ecx
push str.ARG__d__s__n
mov dword [esp + 0x1c], eax
call fcn.004b1ba8
mov eax, dword [esp + 0x44]
add esp, 0xc
inc esi
add ebx, 4
cmp esi, eax
jl 0x451e65
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
push edx
push str.___d__n
call fcn.004b1ba8
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x38]
add esp, 8
push eax
push ecx
push edx
call ebx
test eax, eax
jne 0x451edc
mov ecx, dword [esp + 0x30]
lea eax, [esp + 0x28]
push eax
push 0
push str.systemdict__start_get_exec_n
push ecx
call dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x30]
push edx
call dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
push eax
call dword [esp + 0x28]
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x1c]
pop edi
pop ebx
pop esi
pop ebp
add esp, 0x1c
ret
mov eax, esi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x454270
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push esi
push edi
push eax
call fcn.00476c70
mov edi, str.ldf.dll
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x454415
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ILD_Compress_EndProcess
push esi
call edi
push str.ILD_Compress_Compress
push esi
mov dword [0x5092b8], eax
call edi
push str.ILD_Compress_SetCallback
push esi
mov dword [0x5092bc], eax
call edi
push str.ILD_Compress_SetProp
push esi
mov dword [0x5092c0], eax
call edi
push str.ILD_Compress_StartProcess
push esi
mov dword [0x5092c4], eax
call edi
push str.ILD_Compress_AppendPage
push esi
mov dword [0x5092c8], eax
call edi
mov ecx, dword [0x5092b8]
mov dword [0x5092cc], eax
test ecx, ecx
je 0x454401
mov ecx, dword [0x5092bc]
test ecx, ecx
je 0x454401
mov ecx, dword [0x5092c0]
test ecx, ecx
je 0x454401
mov ecx, dword [0x5092c4]
test ecx, ecx
je 0x454401
mov ecx, dword [0x5092c8]
test ecx, ecx
je 0x454401
test eax, eax
je 0x454401
push 0x498
push 1
call fcn.004b26c8
mov edi, eax
add esp, 8
test edi, edi
jne 0x454395
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov ax, 1
pop ebx
add esp, 0x104
ret
lea ebx, [edi + 4]
push ebx
call fcn.00454430
mov ecx, dword [esp + 0x118]
push 0x13
push ecx
call fcn.00475c50
add esp, 0xc
mov dword [edi], eax
test eax, eax
jne 0x4543d4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push edi
call fcn.004b17e0
add esp, 4
mov ax, 5
pop edi
pop esi
pop ebx
add esp, 0x104
ret
push eax
push ebx
mov dword [edi + 0x490], esi
call fcn.00454500
mov edx, dword [esp + 0x124]
add esp, 8
mov byte [edi + 0x494], 1
xor ax, ax
mov dword [edx], edi
pop edi
pop esi
pop ebx
add esp, 0x104
ret
push str.Cant_get_address_of_function__n
call fcn.004b1ba8
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
mov ax, 2
pop ebx
add esp, 0x104
ret
Function at 0x474d00
Capabilities:
Enumerate pe sections

Disassembly:
movsx eax, word [esp + 0xc]
test eax, eax
jle 0x474e2c
push ebx
push ebp
movsx ebp, word [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
xor eax, eax
test ebp, ebp
jle 0x474e16
mov bl, byte [edi]
mov cl, al
shr bl, cl
shl bl, 7
mov byte [esi], bl
mov dl, byte [edi + 1]
shr dl, cl
and dl, 1
shl dl, 6
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 2]
shr bl, cl
and bl, 1
shl bl, 5
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 3]
shr dl, cl
and dl, 1
shl dl, 4
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 4]
shr bl, cl
and bl, 1
shl bl, 3
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 5]
shr dl, cl
and dl, 1
shl dl, 2
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 6]
shr bl, cl
and bl, 1
shl bl, 1
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 7]
shr dl, cl
and dl, 1
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 8]
shr bl, cl
inc esi
shl bl, 7
mov byte [esi], bl
mov dl, byte [edi + 9]
shr dl, cl
and dl, 1
shl dl, 6
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 0xa]
shr bl, cl
and bl, 1
shl bl, 5
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 0xb]
shr dl, cl
and dl, 1
shl dl, 4
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 0xc]
shr bl, cl
and bl, 1
shl bl, 3
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 0xd]
shr dl, cl
and dl, 1
shl dl, 2
or dl, bl
mov byte [esi], dl
mov bl, byte [edi + 0xe]
shr bl, cl
and bl, 1
shl bl, 1
or bl, dl
mov byte [esi], bl
mov dl, byte [edi + 0xf]
shr dl, cl
and dl, 1
or dl, bl
mov byte [esi], dl
inc esi
inc eax
cmp eax, ebp
jl 0x474d2c
mov eax, dword [esp + 0x1c]
add edi, 0x10
dec eax
mov dword [esp + 0x1c], eax
jne 0x474d22
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x476470
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov ecx, dword [esp + 0x108]
lea edx, [esp]
push ecx
push 0
push 0x4ffee4
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
add esp, 0x104
ret