joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477bf0
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov eax, 0x33
mov word [ebp - 0x1bc0], ax
mov ecx, 0x32
mov word [ebp - 0x1bbe], cx
mov edx, 0x2e
mov word [ebp - 0x1bbc], dx
mov eax, 0x64
mov word [ebp - 0x1bba], ax
mov ecx, 0x6c
mov word [ebp - 0x1bb8], cx
mov edx, 0x6c
mov word [ebp - 0x1bb6], dx
xor eax, eax
mov word [ebp - 0x1bb4], ax
push esi
push eax
add esp, 4
xor esi, 0x3b07
add esi, 0x17ab0
add esi, 0xa054
sub esi, 0x4a31
pop esi
push eax
or eax, 0x3e32
xor eax, 0x760e
and eax, 0x77f6
pop eax
mov byte [ebp - 0xb5c], 0x4c
mov byte [ebp - 0xb5b], 0x6f
mov byte [ebp - 0xb5a], 0x61
mov byte [ebp - 0xb59], 0x64
mov byte [ebp - 0xb58], 0x4c
mov byte [ebp - 0xb57], 0x69
mov byte [ebp - 0xb56], 0x62
mov byte [ebp - 0xb55], 0x72
mov byte [ebp - 0xb54], 0x61
mov byte [ebp - 0xb53], 0x72
mov byte [ebp - 0xb52], 0x79
mov byte [ebp - 0xb51], 0x57
mov byte [ebp - 0xb50], 0
mov ecx, dword fs:[0x18]
mov dword [ebp - 0x23e0], ecx
mov edx, dword [ebp - 0x23e0]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x23e4], eax
mov ecx, dword [ebp - 0x23e4]
Function at 0x4791fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.004791e3
add byte [edx + 0x4a], cl
xor ecx, dword ds:[edi + 0x36]
cmp bh, byte [0x4c48333]
add esp, 4
add esp, 4
pop eax
push eax
or eax, 0x17487
call 0x4791fb
add byte [eax + 0x3d], dl
dec ecx
cmp al, byte [edi + 0x4a]
inc ecx
add esp, 4
and eax, 0xba4c
pop eax
mov edx, dword [ebp - 0xf20]
mov ax, word [edx]
mov word [ebp - 0x1366], ax
mov ecx, dword [ebp - 0xf20]
add ecx, 2
mov dword [ebp - 0xf20], ecx
mov dx, word [ebp - 0x1366]
mov word [ebp - 0x280], dx
mov eax, dword [ebp - 0xf24]
mov cx, word [eax]
mov word [ebp - 0x1368], cx
mov edx, dword [ebp - 0xf24]
add edx, 2
mov dword [ebp - 0xf24], edx
mov ax, word [ebp - 0x1368]
mov word [ebp - 0x3c], ax
push edi
or edi, 0x56f9
add edi, 0x11527
jmp 0x47926f
add edi, 0x12840
pop edi
push edi
push esi
add esp, 4
add edi, 0xb5cf
or edi, 0x62ce
or edi, 0x119c1
pop edi
movzx ecx, word [ebp - 0x3c]
test ecx, ecx
jne 0x4792ab
movzx edx, word [ebp - 0x280]
movzx eax, word [ebp - 0x3c]
sub edx, eax
mov dword [ebp - 0x1a10], edx
jmp 0x479305
movzx ecx, word [ebp - 0x280]
movzx edx, word [ebp - 0x3c]
cmp ecx, edx
je 0x4791d3
movzx eax, word [ebp - 0x280]
xor eax, 0x20
movzx ecx, word [ebp - 0x3c]
cmp eax, ecx
je 0x4791d3
movzx edx, word [ebp - 0x280]
movzx eax, word [ebp - 0x3c]
cmp edx, eax
jge 0x4792ef
mov dword [ebp - 0x1a0c], 0xffffffff
jmp 0x4792f9
mov dword [ebp - 0x1a0c], 1
mov ecx, dword [ebp - 0x1a0c]
mov dword [ebp - 0x1a10], ecx
cmp dword [ebp - 0x1a10], 0
jne 0x47934e
push eax
sub eax, 0x198a
add eax, 0x17c60
or eax, 0x168dd
pop eax
push eax
push eax
add esp, 4
xor eax, 0x1868b
and eax, 0x112fb
add eax, 0xe6c0
sub eax, 0x689a
pop eax
mov edx, dword [ebp - 0x5fc]
mov dword [ebp - 0x8e4], edx
jmp 0x4793b6
push ecx
sub ecx, 0x2929
sub ecx, 0x40eb
and ecx, 0x174a6
add ecx, 0x43f0
pop ecx
push esi
push edi
add esp, 4
and esi, 0xa521
add esi, 0x105df
add esi, 0xefd4
pop esi
mov eax, dword [ebp - 0x5fc]
mov ecx, dword [eax]
mov dword [ebp - 0x5fc], ecx
invalid
xchg ebp, eax
Function at 0x47a28b
Capabilities:
Get number of processors

Disassembly:
add esp, 4
pop edx
push edx
sub edx, 0x5d28
pop edx
mov ecx, dword [ebp - 0x608]
mov edx, dword [ecx]
mov dword [ebp - 0x608], edx
mov eax, dword [ebp - 0x608]
cmp eax, dword [ebp - 0xf48]
je 0x47a2c3
mov ecx, dword [ebp - 0x608]
cmp dword [ecx + 0x30], 0
jne 0x47a08e
mov dword [ebp - 0x3a8], 0
Function at 0x47bba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
in al, dx
invalid
dec dword [ebx - 0xf8373]
inc dword [ebx - 0x7276fd3f]
jl 0x47bb9e
invalid
Function at 0x47c587
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
jmp 0x47c57b
call 0x47c587
add byte [ecx + 0x4a], cl
aas
dec edi
dec edx
xor al, 0x83
les eax, [edi + ebx*2]
mov dword [ebp - 0x94c], 0
mov edx, dword [ebp - 0x3d8]
mov dword [ebp - 0x1af8], edx
cmp dword [ebp - 0x1af8], 0
jne 0x47c5bb
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x624], eax
jmp 0x47c8ac
mov ecx, dword [ebp - 0x1af8]
mov edx, dword [ebp - 0x3d8]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1afc], edx
jne 0x47c5e3
mov eax, dword [ebp - 0x94c]
mov dword [ebp - 0x624], eax
jmp 0x47c8ac
add al, byte [eax]
invalid
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x1afc]
mov ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x1b00], ecx
cmp dword [ebp - 0x1b00], 0
jne 0x47c615
mov edx, dword [ebp - 0x94c]
mov dword [ebp - 0x624], edx
jmp 0x47c8ac
mov eax, dword [ebp - 0x3d8]
add eax, dword [ebp - 0x1b00]
mov dword [ebp - 0x940], eax
jne 0x47c63a
mov ecx, dword [ebp - 0x94c]
mov dword [ebp - 0x624], ecx
jmp 0x47c8ac
mov edx, dword [ebp - 0x940]
mov eax, dword [ebp - 0x3d8]
add eax, dword [edx + 0x20]
mov dword [ebp - 0x24d0], eax
mov ecx, dword [ebp - 0x940]
mov edx, dword [ebp - 0x3d8]
add edx, dword [ecx + 0x24]
invalid
xchg ebp, eax

Function at 0x480836
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
push ebx
push edx
add esp, 4
add ebx, 0x15c67
pop ebx
mov dword [ebp - 0xc3c], 0
push ebx
add ebx, 0xd07d
add ebx, 0x124e3
add ebx, 0xf28a
call 0x480836
add byte [esi + 0x4f], cl
dec eax
dec ebp
cmp dword [ebx + 0x42], eax
add esp, 4
pop ebx
push edi
sub edi, 0x1370f
add edi, 0x1501d
pop edi
mov byte [ebp - 0xa14], 0x45
mov byte [ebp - 0xa13], pe_nt_image_headers32
mov byte [ebp - 0xa12], 0x69
mov byte [ebp - 0xa11], 0x74
mov byte [ebp - 0xa10], 0x50
invalid
test ecx, esi
cmc
invalid

Function at 0x4808e0
Capabilities:
Get number of processors

Disassembly:
mov dword [ebp - 0x1b8e], edx
mov eax, 0x72
mov word [ebp - 0x1b8c], ax
mov ecx, 0x6e
mov word [ebp - 0x1b8a], cx
mov edx, 0x65
mov word [ebp - 0x1b88], dx
mov eax, 0x6c
mov word [ebp - 0x1b86], ax
mov ecx, 0x33
mov word [ebp - 0x1b84], cx
mov edx, 0x32
mov word [ebp - 0x1b82], dx
mov eax, 0x2e
mov word [ebp - 0x1b80], ax
mov ecx, 0x64
mov word [ebp - 0x1b7e], cx
mov edx, 0x6c
mov word [ebp - 0x1b7c], dx
mov eax, 0x6c
mov word [ebp - 0x1b7a], ax
xor ecx, ecx
mov word [ebp - 0x1b78], cx
push edx
add edx, 0xcf9e
pop edx
push ecx
push ecx
add esp, 4
or ecx, 0xcde
xor ecx, 0x66e4
or ecx, 0x5690
and ecx, 0xf30d
pop ecx
push eax
push edi
add esp, 4
or eax, 0xf95f
pop eax
push edi
push eax
add esp, 4
or edi, 0xf24a
jmp 0x4809aa
sub edi, 0x1946
pop edi
push esi
or esi, 0x9f95
or esi, 0xa109
xor esi, 0xa15c
xor esi, 0x7b48
pop esi
mov edx, dword fs:[0x18]
mov dword [ebp - 0x1f00], edx
mov eax, dword [ebp - 0x1f00]
mov ecx, dword [eax + 0x30]
mov dword [ebp - 0x1f04], ecx
mov edx, dword [ebp - 0x1f04]
mov dword [ebp - 0x1b4c], edx
push ecx
push eax
add esp, 4
jmp fcn.00480a00
Function at 0x4811f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
pop esi
cmp dword [ebp - 0x954], 0
jne 0x4811dd
push esi
sub esi, 0xf6a
pop esi
push esi
xor esi, 0xc700
sub esi, 0x14cbc
xor esi, 0x9336
pop esi
push eax
xor eax, 0x6eeb
sub eax, 0x10aec
pop eax
push eax
and eax, 0xea8
pop eax
mov dword [ebp - 0x9a0], 0
jmp 0x481d04
push eax
push edx
add esp, 4
call 0x4811f1
add byte [ebx + 0x3d], al
dec eax
cmp eax, 0x38484339
cmp eax, dword [ebx - 0x3f7efb3c]
pop ds
loop 0x4811f9
add byte [eax + 0x51], bl
push ebx
add esp, 4
sub ecx, 0xc947
pop ecx
push edi
sub edi, 0x11763
pop edi
mov eax, dword [ebp - 0x954]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3d4], ecx
mov dword [ebp - 0x964], 0
mov edx, dword [ebp - 0x3d4]
mov dword [ebp - 0x1b64], edx
cmp dword [ebp - 0x1b64], 0
jne 0x48124e
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x4c0], eax
jmp 0x48153f
mov ecx, dword [ebp - 0x1b64]
mov edx, dword [ebp - 0x3d4]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x1b70], edx
jne 0x481276
mov eax, dword [ebp - 0x964]
mov dword [ebp - 0x4c0], eax
jmp 0x48153f
mov ecx, 8
imul edx, ecx, 0
invalid
invalid

Function at 0x481390
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [ecx - 0x1f373], ecx
dec dword [ebx - 0x95f6b]
inc dword [ebx]
xchg ebp, eax
or al, 0xfe
invalid
Function at 0x4815ac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
call 0x4815ac
add byte [ebx + 0x3a], al
cmp al, 0x45
inc ecx
aas
inc ecx
xor al, byte [ebx + 0x4eb04c4]
aas
dec esi
xor al, 0x4d
xor eax, 0xf63b
pop eax
mov ecx, dword [ebp - 0x1f20]
mov dword [ebp - 0x1f24], ecx
lea edx, [ebp - 0x1b90]
push edx
call dword [ebp - 0x1f24]
test eax, eax
jne 0x48161a
push edi
push ebx
add esp, 4
sub edi, 0x15333
call 0x4815f1
add byte [ebp + 0x3c], cl
xor esi, dword [edx]
cmp bh, byte [ecx]
inc esi
add esp, 4
jmp 0x4815fc
xor edi, 0xb440
pop edi
push edx
xor edx, 0x133d6
pop edx
mov dword [ebp - 0x9a0], 0
jmp 0x481d04
push edi
add edi, 0x376f
jmp 0x481627
or edi, 0xca7f
pop edi
push edx
push esi
add esp, 4
and edx, 0x3843
sub edx, 0x16ec
sub edx, 0xe9d8
add edx, 0x9551
pop edx
mov eax, dword fs:[0x18]
mov dword [ebp - 0x1f28], eax
mov ecx, dword [ebp - 0x1f28]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1f2c], edx
mov eax, dword [ebp - 0x1f2c]
mov dword [ebp - 0x1aa8], eax
push ebx
push ecx
add esp, 4
xor ebx, 0xda80
jmp 0x481686
pop ebx
push esi
add esi, 0x139e1
pop esi
push edx
or edx, 0x6af4
pop edx
push ecx
or ecx, 0x14542
add ecx, 0x2390
pop ecx
cmp dword [ebp - 0x1aa8], 0
jne 0x4816bd
mov dword [ebp - 0x3a0], 0
jmp 0x481964
mov ecx, dword [ebp - 0x1aa8]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xfd8], eax
push edx
add edx, 0xf814
sub edx, 0xacdc
pop edx
push edx
push edx
add esp, 4
and edx, 0x759d
pop edx
push ebx
push edi
add esp, 4
and ebx, 0x17af4
add ebx, 0x573
and ebx, 0x16c46
pop ebx
cmp dword [ebp - 0xfd8], 0
jne 0x481719
mov dword [ebp - 0x3a0], 0
jmp 0x481964
mov ecx, dword [ebp - 0xfd8]
mov dword [ebp - 0x634], ecx
push eax
push esi
add esp, 4
or eax, 0x7f38
call 0x48173f
add byte [ebx + 0x32], al
cmp dword [edi + 0x3f], eax
cmp eax, dword [ebp + 0x39]
xor al, byte [ebx - 0x1f7efb3c]
mov ecx, 0x8100009c
invalid
push esi
push esi
add esp, 4
sub esi, 0x5f19
pop esi
push edx
add edx, 0x127ad
add edx, 0x16bb2
pop edx
push ebx
push ecx
add esp, 4
and ebx, 0x3a03
sub ebx, 0x11ede
sub ebx, 0x2e83
pop ebx
mov eax, dword [ebp - 0x3a0]
mov ecx, dword [eax + 0x18]
mov dword [ebp - 0x3d0], ecx
push esi
and esi, 0xe38e
add esi, 0x3526
xor esi, 0x16671
or esi, 0x30cd
pop esi
push edi
push eax
add esp, 4
add edi, 0xcade
pop edi
push esi
push eax
add esp, 4
or esi, 0x13ccc
pop esi
mov dword [ebp - 0x974], 0
mov edx, dword [ebp - 0x3d0]
mov dword [ebp - 0x1b40], edx
cmp dword [ebp - 0x1b40], 0
jne 0x481a07
mov eax, dword [ebp - 0x974]
mov dword [ebp - 0x638], eax
jmp 0x481cf8
mov ecx, dword [ebp - 0x1b40]
invalid
xchg ebp, eax
invalid
Function at 0x481828
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push ecx
add esp, 4
or ecx, 0xe012
add ecx, 0x412f
or ecx, 0x87ca
pop ecx
push edx
xor edx, 0x7fbb
xor edx, 0x8d34
sub edx, 0x1c0a
sub edx, 0x16280
pop edx
mov ecx, dword [ebp - 0xfd0]
mov dx, word [ecx]
mov word [ebp - 0x1402], dx
mov eax, dword [ebp - 0xfd0]
add eax, 2
mov dword [ebp - 0xfd0], eax
mov cx, word [ebp - 0x1402]
mov word [ebp - 0x2ac], cx
mov edx, dword [ebp - 0xfd4]
mov ax, word [edx]
mov word [ebp - 0x1404], ax
mov ecx, dword [ebp - 0xfd4]
add ecx, 2
mov dword [ebp - 0xfd4], ecx
mov dx, word [ebp - 0x1404]
mov word [ebp - 0x68], dx
push ebx
and ebx, 0xdeee
pop ebx
push esi
sub esi, 0x16a6a
call fcn.00481828
add byte [edi], bh
dec eax
xor ecx, dword [edi + 0x4e]
inc eax
inc ebx
xor ecx, dword [eax - 0x7d]
add esp, 4
jmp 0x481834
xor cl, byte [esi + 0x41]
aaa
push eax
inc esp
dec ebx
add esp, 4
jmp 0x481834
jmp 0x48183b
pop esi
movzx eax, word [ebp - 0x68]
test eax, eax
jne 0x481859
movzx ecx, word [ebp - 0x2ac]
movzx edx, word [ebp - 0x68]
sub ecx, edx
mov dword [ebp - 0x1b3c], ecx
jmp 0x4818b3
movzx eax, word [ebp - 0x2ac]
movzx ecx, word [ebp - 0x68]
cmp eax, ecx
je 0x481781
movzx edx, word [ebp - 0x2ac]
xor edx, 0x20
movzx eax, word [ebp - 0x68]
cmp edx, eax
je 0x481781
movzx ecx, word [ebp - 0x2ac]
movzx edx, word [ebp - 0x68]
cmp ecx, edx
jge 0x48189d
mov dword [ebp - 0x1b38], 0xffffffff
jmp 0x4818a7
mov dword [ebp - 0x1b38], 1
mov eax, dword [ebp - 0x1b38]
mov dword [ebp - 0x1b3c], eax
cmp dword [ebp - 0x1b3c], 0
jne 0x4818fc
push esi
xor esi, 0x706e
sub esi, 0x14f44
xor esi, 0x6a33
pop esi
push esi
push edi
add esp, 4
and esi, 0x8f96
xor esi, 0x13e0f
and esi, 0x62fd
or esi, 0x8836
pop esi
mov ecx, dword [ebp - 0x634]
mov dword [ebp - 0x3a0], ecx
jmp 0x481964
push eax
push edx
add esp, 4
and eax, 0x904a
and eax, 0x3130
add eax, 0x8ee8
pop eax
push ebx
push eax
add esp, 4
and ebx, 0xbdec
and ebx, 0x9fff
pop ebx
push esi
xor esi, 0x15c44
pop esi
mov edx, dword [ebp - 0x634]
mov eax, dword [edx]
mov dword [ebp - 0x634], eax
mov ecx, dword [ebp - 0x634]
cmp ecx, dword [ebp - 0xfd8]
je 0x48195a
mov edx, dword [ebp - 0x634]
cmp dword [edx + 0x30], 0
jne 0x481725
mov dword [ebp - 0x3a0], 0
Function at 0x482729
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movzx eax, word [ebp - 0x70]
sub edx, eax
mov dword [ebp - 0x1548], edx
jmp 0x4825e8
cmp dword [ebp - 0x1548], 0
jne 0x482631
push ecx
or ecx, 0xafb0
xor ecx, 0x27b5
pop ecx
push edi
push ebx
add esp, 4
sub edi, 0x12ee1
call 0x48261a
add byte [eax], bh
inc eax
aaa
inc ecx
xor eax, 0x83375048
les eax, [ebx + ebp*8]
add ecx, dword [ecx + 0x48]
inc eax
pop edi
mov edx, dword [ebp - 0x640]
mov dword [ebp - 0x978], edx
jmp 0x482699
push esi
push edi
add esp, 4
jmp 0x48263e
pop esi
push ebx
xor ebx, 0xe054
call 0x482653
add byte [eax + 0x43], dl
push eax
inc ebx
cmp eax, 0xc4833347
add al, 0x81
retf
push edx
and edx, 0x7854
or edx, 0x8a5e
pop edx
push esi
push eax
add esp, 4
add esi, 0x97ba
pop esi
push eax
push eax
add esp, 4
or eax, 0x3b19
xor eax, 0x6cdb
or eax, 0x3911
pop eax
cmp dword [ebp - 0x978], 0
jne 0x482715
push ebx
xor ebx, 0xab4d
or ebx, 0x5190
jmp 0x4826ea
pop ebx
push edi
push edi
add esp, 4
xor edi, 0x715a
call 0x482702
add byte [edx + 0x33], al
cmp byte [ebx], bh
inc edx
inc edi
add esp, 4
pop edi
mov dword [ebp - 0xc38], 0
jmp 0x48323d
push edi
or edi, 0x3934
call 0x482729
add byte [ebx], bh
xor bh, byte [ebx]
dec edx
xor al, 0x36
dec edx
add esp, 4
pop edi
push ebx
or ebx, 0xc6be
sub ebx, 0x13a2a
add ebx, 0x6c2
and ebx, 0x179ee
pop ebx
mov ecx, dword [ebp - 0x978]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3cc], edx
mov dword [ebp - 0x988], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x154c], eax
cmp dword [ebp - 0x154c], 0
jne 0x482786
mov ecx, dword [ebp - 0x988]
mov dword [ebp - 0x4c4], ecx
jmp 0x482a77
mov edx, dword [ebp - 0x154c]
mov eax, dword [ebp - 0x3cc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1550], eax
jne 0x4827ae
mov ecx, dword [ebp - 0x988]
mov dword [ebp - 0x4c4], ecx
jmp 0x482a77
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1550]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1554], edx
cmp dword [ebp - 0x1554], 0
jne 0x4827e0
mov eax, dword [ebp - 0x988]
mov dword [ebp - 0x4c4], eax
jmp 0x482a77
mov ecx, dword [ebp - 0x3cc]
add ecx, dword [ebp - 0x1554]
mov dword [ebp - 0x97c], ecx
jne 0x482805
mov edx, dword [ebp - 0x988]
mov dword [ebp - 0x4c4], edx
jmp 0x482a77
mov eax, dword [ebp - 0x97c]
invalid
lea esi, [esp + edi*8]
invalid
Function at 0x48bb20
Capabilities:
Encode data using xor

Disassembly:
dec ecx
mov cl, bl
or esp, dword [eax - 0x76]
les ecx, [ebx - 0x10]
push es
push es
pop es
jl 0x48bb44
into
invalid
dec ecx
adc edx, dword [edx - 0x6b6fecb1]
div ebp
push es
push es
pop ebp
pop edx
mov cl, bl
or ecx, dword [eax + 0x749b5f5]
pop es
out dx, eax
adc dword [edi], eax
pop es
pop es
pop es
inc eax
push esp
cmp dword [ebp + 0x4c], ecx
inc ebx
cmp dword [esi + 0x40], eax
mov cl, bl
or esi, edx
or bh, byte [esp + ecx*2]
inc edx
out dx, eax
push cs
pop es
pop es
pop es
pop es
push ebx
inc edx
dec esp
dec esp
inc eax
dec edi
mov cl, bl
or esp, dword [ebp - 0x76]
invalid

Function at 0x49c3e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x49c44b
movzx eax, word [esi]
cmp eax, 0x5a4d
jne 0x49c44b
mov eax, dword [esi + 0x3c]
cmp dword [esi + eax], 0x4550
jne 0x49c44b
mov edx, dword [esi + eax + 0x98]
xor eax, eax
test edx, edx
je 0x49c44d
add edx, esi
je 0x49c44d
cmp byte [edx + 8], 0x30
jne 0x49c44b
cmp byte [edx + 9], 0x82
jne 0x49c44b
movzx eax, word [edx + 0xa]
rol ax, 8
movzx eax, ax
add eax, 0x13
and eax, 0x1fff8
je 0x49c44b
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], edx
add edx, eax
add esi, dword [ecx + 0x10]
cmp edx, esi
jae 0x49c44b
cmp dword [edx], 0x74636159
je 0x49c453
xor eax, eax
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
movzx ecx, word [edx + 4]
rol cx, 8
movzx edi, cx
test esi, esi
je 0x49c480
cmp dword [eax], edi
jle 0x49c44b
add edx, 6
push edi
push edx
push esi
call fcn.004d3ed0
add esp, 0xc
mov byte [esi + edi], 0
jmp 0x49c483
inc edi
mov dword [eax], edi
mov al, 1
jmp 0x49c44d
Function at 0x4a0d90
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x230
mov edi, ecx
mov eax, dword [0x538010]
xor eax, ebp
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x14]
mov word [ebp - 0x28], ax
movzx eax, word [ecx + 0x16]
mov word [ebp - 0x26], ax
mov esi, dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
call esi
mov word [ebp - 0x24], ax
movzx eax, word [edi + 0x16]
mov word [ebp - 0x22], ax
mov dword [ebp - 0x23c], edi
movzx eax, word [edi + 0x14]
mov word [ebp - 0x20], ax
mov di, 0x4e4
mov word [ebp - 0x1e], di
call esi
mov word [ebp - 0x1c], ax
mov dword [ebp - 0x1a], 0x40904e4
mov dword [ebp - 0x16], 0x40904b0
mov word [ebp - 0x12], di
xor esi, esi
lea edi, [ebp - 0x230]
push 0x208
push 0xff
push edi
call fcn.004d4450
add esp, 0xc
movzx eax, word [ebp + esi*4 - 0x26]
movzx ecx, word [ebp + esi*4 - 0x28]
push dword [ebp + 8]
push eax
push ecx
push str.StringFileInfo_04x_04x_ls
mov eax, 0x104
push eax
push eax
push edi
call fcn.004a0f90
add esp, 0x1c
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x238], 0xffffffff
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push edi
mov eax, dword [ebp - 0x23c]
push dword [eax + 0x10]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
setne cl
mov eax, dword [ebp - 0x234]
test eax, eax
setne dl
and dl, cl
mov ecx, dword [ebp - 0x238]
test ecx, ecx
setne bl
and bl, dl
cmp bl, 1
je 0x4a0e9d
inc esi
cmp esi, 6
jne 0x4a0e02
jmp 0x4a0f3c
dec ecx
push ecx
push eax
call fcn.004ec960
add esp, 8
mov ecx, dword [ebp - 0x234]
test eax, eax
je 0x4a0eba
test ecx, ecx
je 0x4a0f55
mov dword [ebp - 0x23c], ecx
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + 0xb]
test dl, dl
js 0x4a0edb
mov esi, ecx
mov edi, eax
cmp eax, 4
jbe 0x4a0f09
mov esi, 4
jmp 0x4a0eed
mov esi, 0x7fffffff
and esi, dword [ecx + 8]
dec esi
mov edx, eax
cmp esi, eax
jae 0x4a0f05
mov edx, dword [ecx + 4]
mov edi, eax
sub edi, esi
push dword [ebp - 0x23c]
push eax
push edx
push 0
push edx
push edi
push esi
call fcn.00429fd0
jmp 0x4a0f3c
mov esi, dword [ecx]
mov edi, eax
lea ecx, [edi + edi]
push ecx
push dword [ebp - 0x23c]
push esi
call fcn.004d3ed0
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp byte [eax + 0xb], 0
js 0x4a0f31
cmp edi, 5
jae 0x4a0f66
mov ecx, edi
mov byte [eax + 0xb], cl
jmp 0x4a0f36
mov dword [eax + 4], edi
mov ecx, edi
mov word [esi + ecx*2], 0
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
mov eax, ebx
add esp, 0x230
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.string::assign_received_nullptr
push str.__n__0____s___nullptr
push 0x91f
jmp 0x4a0f75
push str.__s_should_never_be_greater_than_or_equal_to_the_short_string_capacity
push str.__s_____min_cap
push 0x6c6
push str....._buildtools_third_partylibc_trunkinclude_string
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
int3
Function at 0x4a2ee0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [0x538010]
xor edx, ebp
mov dword [ebp - 0x10], edx
lea esi, [ebp - 0x20]
push 3
push ecx
push eax
push esi
call fcn.004779d0
add esp, 0x10
mov eax, dword [esi + 4]
test eax, eax
je 0x4a303b
mov esi, dword [ebp - 0x20]
mov dword [ebx], esi
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x800
mov dword [ebp - 0x24], 0
push eax
push 0x529eac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
mov dword [ebp - 0x30], eax
je 0x4a2f64
push 0x529efc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4a2f72
mov ecx, eax
call dword [section..00cfg]
lea eax, [ebp - 0x14]
push eax
push esi
call ecx
jmp 0x4a2f6f
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x14]
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov edi, 0
mov dword [ebp - 0x28], 0
test esi, esi
je 0x4a2fe4
mov dword [ebp - 0x2c], ebx
shl esi, 2
cmp esi, 0x55555555
jae 0x4a306a
lea edi, [esi + esi*2]
push edi
call fcn.004d0575
add esp, 4
mov dword [ebp - 0x20], eax
mov ecx, eax
add ecx, edi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov edi, eax
test edi, edi
je 0x4a304f
mov ecx, edi
mov eax, dword [ebp - 0x24]
push dword [eax + ebx]
call fcn.0041f000
add edi, 0xc
add ebx, 4
cmp esi, ebx
jne 0x4a2fbf
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp - 0x2c]
mov ecx, ebx
lea eax, [ebp - 0x20]
push eax
call fcn.004a2d60
xor eax, eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x4a300d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [ebp - 0x28]
test ebx, ebx
je 0x4a303b
cmp edi, ebx
je 0x4a3032
lea esi, [edi - 0xc]
cmp byte [edi - 1], 0
jns 0x4a302c
push dword [edi - 0xc]
call fcn.004d05a5
add esp, 4
mov edi, esi
cmp esi, ebx
jne 0x4a3018
push ebx
call fcn.004d05a5
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d1573
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 8
push str.null_pointer_given_to_construct_at
push str.__location___nullptr
push 0x25
push str....._buildtools_third_partylibc_trunkinclude__memoryconstruct_at.h
push str._s:_d:_assertion__s_failed:__s
call fcn.00448430
lea ecx, [ebp - 0x20]
call fcn.00417b20
int3
Function at 0x4a55b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov edi, dword [ebp + 8]
cmp dword [ecx + 8], 0
mov eax, dword [ecx]
jne 0x4a55dc
test eax, eax
jne 0x4a55dc
xor eax, eax
cmp dword [esi + 0xc], 0
jne 0x4a55dc
xor eax, eax
cmp dword [esi + 4], 0
mov edx, 0
je 0x4a562d
lea ecx, [eax + 1]
cmp ecx, 2
jb 0x4a55fb
call fcn.00489980
push dword [esi]
call fcn.00476780
add esp, 4
mov dword [esi], 0
xor eax, eax
mov ecx, dword [esi + 4]
lea edx, [ecx + 1]
cmp edx, 2
jb 0x4a5621
call fcn.00489980
push dword [esi + 4]
call fcn.00476780
add esp, 4
mov dword [esi + 4], 0
mov eax, dword [esi]
xor ecx, ecx
mov edx, eax
xor eax, eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, ecx
mov ebx, dword [edi]
cmp edx, ebx
je 0x4a5674
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x4a5658
call fcn.00489980
push dword [esi]
call fcn.00476780
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4a5667
mov dword [esi], ebx
call fcn.00489980
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 4]
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 4]
cmp eax, ebx
je 0x4a56bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 4]
inc eax
cmp eax, 2
jb 0x4a56a3
call fcn.00489980
push dword [esi + 4]
call fcn.00476780
add esp, 4
mov dword [esi + 4], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4a56b3
mov dword [esi + 4], ebx
call fcn.00489980
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp + 8]
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
mov dword [esi + 0xc], eax
pop esi
pop edi
pop ebx
pop ebp
ret 4