joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407d7a
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x41e210
call fcn.0040d880
xor esi, esi
cmp dword [0x422fe8], esi
jne 0x407c3a
push esi
push esi
push 1
push esi
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov eax, 0x5a4d
cmp word [0x400000], ax
je 0x407c4d
mov dword [ebp - 0x1c], esi
jmp 0x407c83
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x407c48
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x407c48
cmp dword [eax + 0x400074], 0xe
jbe 0x407c48
xor ecx, ecx
cmp dword [eax + 0x4000e8], esi
setne cl
mov dword [ebp - 0x1c], ecx
call fcn.0040d85e
test eax, eax
jne 0x407c94
push 0x1c
call fcn.0040c0f5
pop ecx
call fcn.0040d6e3
test eax, eax
jne 0x407ca5
push 0x10
call fcn.0040c0f5
pop ecx
call fcn.0040d2f3
mov dword [ebp - 4], esi
call fcn.0040c0f5
test eax, eax
jns 0x407cbe
push 0x1b
call fcn.0040c0f5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x422fe4], eax
call fcn.0040c0f5
mov dword [0x421270], eax
call fcn.0040105b
test eax, eax
jns 0x407ce4
push 8
call fcn.0040c0f5
pop ecx
call fcn.0040cf3b
test eax, eax
jns 0x407cf5
push 9
call fcn.0040c0f5
pop ecx
push 1
call fcn.0040c0f5
pop ecx
cmp eax, esi
je 0x407d08
push eax
call fcn.0040c0f5
pop ecx
mov eax, dword [0x421294]
mov dword [0x421298], eax
push eax
push dword [0x42128c]
push dword [0x421288]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], esi
jne 0x407d35
push eax
call fcn.0040c0f5
call fcn.00408d12
jmp 0x407d6a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.0040d8c5
ret
call fcn.0040c0f5
jmp 0x407c19

Function at 0x4085d9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420030]
jne 0x4085e3
repz ret
jmp fcn.004101ab
Function at 0x40c0f5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x40c104
pop dword [ebp - 0xc]
mov eax, 0x40c104
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x6bcf74b
add dword [ebp - 0x1c], 0x47954e00
mov dword [ebp - 0x18], 0x816ec44a
add dword [ebp - 0x18], 0xb0c487fb
mov dword [ebp - 0x14], 0xf342986b
add dword [ebp - 0x14], 0x5909abc3
mov dword [ebp - 0x10], 0x26763587
add dword [ebp - 0x10], 0xd989ca79
lea eax, [ebp - 0x1c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x8473154f
sub dword [ebp - 0x1c], 0x1000abf9
mov dword [ebp - 0x18], 0x70f098c0
add dword [ebp - 0x18], 0xd07bc8b5
mov dword [ebp - 0x14], 0xf6876474
add dword [ebp - 0x14], 0x6ce807f8
mov dword [ebp - 0x10], 0xb4cc6e51
add dword [ebp - 0x10], 0x4b3391af
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x8fc3c02a
add eax, 0x707dc022
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x38cf6
push 0
call eax
mov ecx, 0x3dc0
xor edi, edi
add edi, eax
mov ebx, 0x830f2d79
add ebx, 0x7d33aa87
add ebx, dword [ebp - 0xc]
mov esi, 0x587dc1f9
sub esi, 0xdbfe9415
add dword [ebp - 8], esi
mov edx, dword [ebx]
add dword [ebp - 8], eax
xor edx, esi
xor dword [ebp - 8], 0xcf45b74e
mov dword [edi], edx
sub dword [ebp - 4], edx
add edi, 0xfbaea1a7
add edi, 0x4515e5d
add ebx, 4
loop 0x40c218
add eax, 0x48c5c61a
sub eax, 0x48c4dc47
mov ebx, eax
add eax, 0x875275b1
sub eax, 0x875275ac
mov ecx, 0x88ced09e
add ecx, 0x77712f62
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x5091c7
Capabilities:
Encode data using xor

Disassembly:
push ds
ret
pop ds
xchg edi, eax
mov ebx, 0xb7af0a9d
and al, 0x3d
mov esp, 0xa033f984
jno 0x5091d4
xor esp, dword [eax - 0x7f89038f]
jbe 0x50915a
cmp dword [eax + 0x5bf3c747], ebx
adc dword [ebx + 0x71eb65ab], eax
lcall 0xe7cb, 0xd77bd65f
jo 0x5091fe
cwde
invalid
push 0x55
adc eax, 0x8503a6b4
lds ebx, [ebx + edi*2]
lodsd eax, dword [esi]
push edx
pushfd
dec edi
xchg ebp, eax
push edx
xchg edi, eax
std
or eax, 0x21c44a4d
cdq
mul bh
push edx
cwde
push edi
sal dword [edx], 1
dec eax
das
outsb dx, byte [esi]
mov bh, 0x1c
or dword [esi + eax], 0x7353d641
pop esi
and al, 0x3e
add ebp, dword [eax]
push ecx
xor byte [edi], dl
and al, 0x85
invalid

Function at 0x51e14e
Capabilities:
Encode data using xor

Disassembly:
daa
push ecx
adc al, 0xd3
xchg esp, eax
rol byte [edi], 0x10
inc edi
mov ebx, 0xcf34fdd5
shl byte [ebx - 0x4f6f4145], cl
outsd dx, dword [esi]
cmp al, 0xe7
push 0xffffffffffffffa1
xor ecx, dword [ecx]
add al, byte [eax]
jle 0x51e163
dec edx
adc al, 0xe6
xchg ecx, eax
invalid

Function at 0x634170
Capabilities:
Encode data using xor

Disassembly:
ret
mov al, byte [0x46180bb4]
invalid
in eax, dx
jecxz 0x634155
add eax, 0xa9d0ef45
std
in al, dx
mov ebp, 0x81935193
jb 0x6341c0
inc ebx
imul ecx, ebx, 0x9bb14529
inc ebp
mov cl, 0x9b
wait
mov word [eax], es
retf 0xe96b
jne 0x634167
jne 0x634187
push dword [ebp + 0x101a147]
rol ebp, 1
invalid
push ss
sal byte [ebp + 0x72], 1
lodsd eax, dword gs:[esi]
mov cl, 0x33
dec esi
adc dword [esi - 0x5c5c29fd], edx
inc esi
ja 0x634185
aas
mov ecx, 0x67f4ee34
rol dword [ecx - 0x3da2ff8f], 1
imul ebp, esp, 0xa98d7397
les esi, [eax]
mov al, byte [0x3b25de44]
pop esi
das
daa
dec eax
clc
xchg esi, eax
dec esi
push 0x3aed269
inc esp
mov esp, dword [edx]
test edx, edx
xor dword [ecx + 0x46530c66], esp
or al, dh
mov ebx, 0xd2972e66
xor eax, dword [ebx]
adc bh, dh
jnp 0x6341d8
arpl word [ebp + 0x74030d83], dx
loop 0x6341b7
lodsd eax, dword [esi]
jo 0x6341aa
retf 0x16b

Function at 0x637d0e
Capabilities:
Encode data using xor

Disassembly:
jmp 0x637ce0
invalid
mov bl, 0xa2
push 0xbcd12752
adc byte [esp + ecx - 0x284c547c], cl
daa
sar dword [eax + edx - 0x547bf374], 1
mov bl, 0xd7
sub al, 0x26
mov eax, dword cs:[0x42632d22]
jno 0x637ccb
inc eax
xchg esp, eax
or eax, 0xe602fa2e
popal
and al, 0x23
adc byte [eax + 0xc], al
jb 0x637cd2
lahf
fistp dword [esi + 0x29e527d4]
aaa
add dl, dh
mov ebx, 0x3ce27502
and bl, byte [ebp + 0x13]
push ecx
mov esp, 0x5d0e4a5c
adc dword [ecx + 0x66993c8b], 0xffffff8e
test byte [ecx + 0x76], ah
loopne 0x637d67
test byte [edx + 0x13], dh
and dword [edi + 0xe500e30], ebx
or esp, dword [0xb2f3686b]
pushfd
in al, 0x75
xchg ecx, eax
inc eax
inc esp
push ds
loope 0x637ce4
mov esi, 0xd59b9bcb
wait
clc
add esi, dword [esi]
jmp 0xb4a665c
outsd dx, dword [esi]
ficomp word [ebx]
invalid
Function at 0x639a66
Capabilities:
Check for software breakpoints

Disassembly:
ror byte [ecx + esi*8 - 0x35444cc4], 0x1e
in eax, 0x5e
inc edx
jnp 0x639abf
xchg esp, eax
inc eax
xlatb
and dword [edi + 0x3ee38132], edx
iretd
mov bl, 0x61
fadd qword [eax - 0x3e955a84]
adc eax, 0xe3c522d3
jnp 0x639a7c
out 0x2f, eax
je 0x639ad6
xor ebp, dword [esi - 0x5ea15d03]
adc ch, bl
pop ebp
pop eax
pop esi
mov eax, dword [0x585ddd10]
js 0x639b16
push 0xffffffffffffffbe
and eax, 0x6252574a
and al, 0xba
loope 0x639b2c
fidiv dword [ebx + 0x4b3db2d2]
popal
xchg esp, eax
int1
fdiv qword [ebx]
push 0x62
xchg ebp, eax
adc al, 0x83
mov cl, 0xc6
sbb dword [eax], edx
popal
mov dword [0x4aeba396], eax
jae 0x639b0c
inc ebp
and dword [ecx + 0x2c], ebp
enter 0x7113, 0x31
enter 0x7113, 0x31
push ds
rcl byte [eax], 0x92
cmp eax, 0x7b2ebc11
wait
mov dh, 0x3f
mov esp, 0x649b7b2e
mov dh, 0x3f
test al, 0x61
dec edx
push ecx
loopne 0x639b63
add al, 0x46
rol dword [edx + 0x79], cl
fisttp qword [ebp + 0x1032b011]
int3
mov al, 0x32
adc ah, cl
or al, 0x56
adc dword [edx - 0x1c219b3f], edx
or ecx, ebp
inc ebx
loop 0x639b7d
adc eax, 0x52c15f00
jne 0x639b86
mov bl, 0x53
push edi
mul byte [ebx + 0x59]
arpl word [eax], dx
add dword [edi], esp
in eax, 0x61
popal
jae 0x639b96
and eax, 0x26e161c1
pushal
outsb dx, byte [esi]
mov ch, 0
cld
jg 0x639b11
cmp al, 0x58
push edx
jo 0x639bb8
ja 0x639b97
mov bh, 0x75
mov al, byte [0x891b73f5]
xchg ebp, eax
jns 0x639be5
sbb ecx, dword [ecx - 0x109c866b]
out dx, eax
call dword [ecx - 0xc64ee54]
idiv dword [ecx - 0x529173c7]
bound esp, qword [eax]
pop eax
in al, 4
pop esi

Function at 0x43b635
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
and esi, esi
sub edi, edi
call fcn.0043b66d
add esi, 1
and edi, esi
mov esi, edi
xor dword [edx], ecx
inc esi
add edx, 1
sub esi, edi
cmp edx, ebx
jne fcn.0043b635
sub esi, 0xa1b42e50
sub edi, 0xe0ea05f5
inc edi
ret
Function at 0x4abbf8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x4abc0f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.004ab921
aad 0xc0
inc esi
mov byte [0x50c0458d], al
call fcn.004ab931
push eax
push esi
push dword [ebp + 8]
call fcn.004ab8e6
add esp, 0x10
mov dword [ebp - 0x88], eax
call fcn.004ab921
push edx
jg 0x4abc5f
sub cl, byte [ebp + 0x5d88e845]
call 0xe9a844e2
mov byte [ebp - 0x16], 0x40
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], 0xe9
mov byte [ebp - 0x13], 0xd6
mov byte [ebp - 0x12], 0xcd
mov byte [ebp - 0x11], 0xcb
mov byte [ebp - 0x10], 0xca
mov byte [ebp - 0xf], 0xde
mov byte [ebp - 0xe], 0xd3
mov byte [ebp - 0xd], 0xf9
mov byte [ebp - 0xc], 0xcd
mov byte [ebp - 0xb], 0xda
mov byte [ebp - 0xa], 0xda
mov byte [ebp - 9], 0xbf
call fcn.004ab931
push eax
push esi
push dword [ebp + 8]
call fcn.004ab8e6
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 0x6c], bl
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.004ab931
push eax
push esi
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.004ab8e6
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.004ab931
push eax
push esi
push dword [ebp + 8]
call fcn.004ab8e6
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.004ab921
push 0xfffffffffffffff6
in eax, dx
loopne 0x4abd2c
popfd
jl 0x4abda6
invalid
invalid
Function at 0x405b50
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x405b6d
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x405bb4
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
je 0x405b9a
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
test eax, eax
jne 0x405b78
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x405bb2
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x405bce
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x20
jle 0x405bce
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x405bb4
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
test edx, edx
je 0x405bf2
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x405bf2
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x405bce
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x18]
and ecx, 1
test ecx, ecx
je 0x405c1b
mov edx, dword [ebp - 0x14]
and edx, 0xffff
mov dword [ebp - 0x50], edx
jmp 0x405c22
mov dword [ebp - 0x50], 0xa
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6b924805
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x3bfa69ef
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x402fec
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x402fed
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x402f97
stosb byte es:[edi], al
call fcn.00401b97
and al, 9
scasb al, byte es:[edi]
sbb eax, dword [eax - 0x72b5b]
inc dword [eax]
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54

Function at 0x403020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
push edx
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00401b97
loop 0x4030c7
lahf
cmp ecx, dword [ebp - 0x72b7b]
call dword [eax - 0x18]
pop ss
jmp 0x40308e
invalid
add eax, 0xfc6c858d
invalid

Function at 0x40540d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24004
call fcn.00430a90
push esi
push edi
mov edi, edx
lea edx, [ebp - 0x24004]
push ecx
call fcn.004137d3
mov esi, eax
pop ecx
test esi, esi
je 0x40549f
cmp dword [0x4779d4], 0
jg 0x405445
push str.Writing_LAME_Tag...
call fcn.0040638d
pop ecx
mov eax, 0x24000
cmp esi, eax
ja 0x43741a
push 0
push dword [ebp + 8]
push edi
call fcn.0041a517
add esp, 0xc
test eax, eax
jne 0x43742b
push edi
push esi
lea eax, [ebp - 0x24004]
push 1
push eax
call fcn.0041a76a
add esp, 0x10
cmp eax, esi
jne 0x43743e
cmp dword [0x4779d4], 0
jg 0x405497
push str.done_n
call fcn.0040638d
pop ecx
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x405499
push esi
push eax
push str.Error_writing_LAME_tag_frame:_buffer_too_small:_buffer_size_d__frame_size_d_n
call fcn.0043a0b8
add esp, 0xc
jmp 0x437436
push str.fatal_error:_cant_update_LAME_tag_frame__n
call fcn.0043a0b8
pop ecx
or eax, 0xffffffff
jmp 0x405499
push str.Error_writing_LAME_tag__n
jmp 0x437430
Function at 0x40607e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1a4
fldz
lea eax, [esp + 0x48]
push ebx
push ebp
push esi
push edi
xor esi, esi
mov ebx, ecx
push 0x40
push esi
fst qword [esp + 0x28]
push eax
fstp qword [esp + 0x5c]
mov dword [esp + 0x28], ebx
mov ebp, esi
call fcn.004172a0
add esp, 0xc
mov dword [0x477a30], esi
lea edx, [esp + 0xd0]
mov ecx, ebx
call fcn.00413191
lea edx, [esp + 0x98]
mov ecx, ebx
call fcn.00413203
lea edx, [esp + 0x40]
mov ecx, ebx
call fcn.004131da
lea edx, [esp + 0x28]
mov ecx, ebx
call fcn.00413167
fld qword [esp + 0x20]
mov edi, esi
mov ebx, esi
mov edx, esi
mov ecx, dword [esp + edx + 0x98]
add ebx, ecx
mov eax, dword [edx + 0x4779f8]
imul eax, ecx
mov dword [esp + 0x10], eax
fild dword [esp + 0x10]
faddp st(1)
cmp edi, ecx
jl 0x406273
test ecx, ecx
jne 0x40625f
add edx, 4
cmp edx, 0x38
jl 0x4060ee
mov dword [esp + 0x18], ebp
lea ebp, [esp + 0xd0]
mov dword [esp + 0x10], edi
mov edi, esi
mov esi, dword [esp + 0x18]
fstp qword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esp + edi*4 + 0x98]
test edx, edx
jne 0x406265
cmp edi, dword [0x4779f4]
jg 0x406170
cmp edi, dword [0x4779f0]
jl 0x406170
push ebx
push dword [esp + 0x14]
mov ecx, edi
push dword [ebp]
call fcn.0040627e
add esp, 0xc
inc edi
add ebp, 0x10
cmp edi, 0xe
jl 0x40613f
xor esi, esi
mov eax, esi
add esi, dword [esp + eax*4 + 0x40]
inc eax
cmp eax, 4
jl 0x40617d
fld qword [0x452260]
mov dword [esp + 0x10], esi
test ebx, ebx
jle 0x4061b7
fild dword [esp + 0x14]
mov eax, ebx
sub eax, esi
mov dword [esp + 0x14], eax
fld qword [esp + 0x20]
fdiv st(1)
fstp qword [esp + 0x50]
fild dword [esp + 0x14]
fmul st(2)
fdivrp st(1)
fstp qword [esp + 0x58]
test esi, esi
jle 0x4061dd
fldz
fstp qword [esp + 0x60]
fild dword [esp + 0x10]
fild dword [esp + 0x40]
fmul st(2)
fdiv st(1)
fstp qword [esp + 0x68]
fild dword [esp + 0x48]
fmul st(2)
fdivrp st(1)
fstp qword [esp + 0x70]
cmp dword [esp + 0x3c], 0
jle 0x40627a
fild dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
add eax, ecx
mov dword [esp + 0x14], eax
fild dword [esp + 0x28]
fmul st(2)
fdiv st(1)
fstp qword [esp + 0x78]
fild dword [esp + 0x14]
fmul st(2)
fdiv st(1)
fstp qword [esp + 0x80]
fild dword [esp + 0x30]
fmul st(2)
fdiv st(1)
fstp qword [esp + 0x88]
fild dword [esp + 0x38]
fmulp st(2)
fdivp st(1)
fstp qword [esp + 0x90]
push ebx
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004130e6
pop ecx
mov ecx, dword [esp + 0x20]
mov edx, eax
call fcn.00405a06
pop ecx
lea ecx, [esp + 0x50]
call fcn.00405e82
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a4
ret
inc ebp
jmp 0x40611a
cmp esi, 1
jg 0x40615e
jmp 0x40614e
mov edi, ecx
jmp 0x406112
fstp st(0)
jmp 0x406233
Function at 0x40781e
Capabilities:
Terminate process

Disassembly:
mov eax, 0x26e4
call fcn.00430a90
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x2f0]
push 0x2400
push 0
push eax
mov esi, edx
lea ebp, [edi + 0x134]
call fcn.004172a0
add esp, 0xc
lea eax, [esp + 0x28]
mov edx, esi
mov ecx, edi
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x8c]
push eax
push dword [esp + 0x270c]
call fcn.00407e13
mov ebx, eax
add esp, 0x14
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
cmp dword [edi + 0x50], eax
jle 0x407936
mov ebx, ebp
lea esi, [esp + 0x2f0]
lea ebp, [esp + 0x34]
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebp
and dword [esp + 0x30], 0
cmp dword [edi + 0x4c], 0
jle 0x407903
mov dword [esp + 0x2c], ebp
mov eax, esi
mov esi, dword [esp + 0x2c]
mov ebp, ebx
mov ebx, dword [esp + 0x30]
mov dword [esp + 0x14], eax
push eax
mov edx, ebp
mov ecx, edi
call fcn.00407a47
pop ecx
test eax, eax
je 0x407a1f
mov eax, dword [esp + 0x14]
inc ebx
add eax, 0x900
add ebp, 0x1484
add esi, 4
mov dword [esp + 0x14], eax
cmp ebx, dword [edi + 0x4c]
jl 0x4078c4
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
inc eax
add ebp, 8
add ebx, 0x2908
mov dword [esp + 0x18], eax
add esi, 0x1200
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], esi
cmp eax, dword [edi + 0x50]
jl 0x4078a5
mov ebx, dword [esp + 0x10]
lea ebp, [edi + 0x134]
lea eax, [esp + 0x34]
mov ecx, edi
push eax
lea eax, [esp + 0x84]
push eax
lea edx, [esp + 0x2f8]
call fcn.00408ca7
cmp dword [edi + 0x9c], 0
mov esi, eax
pop ecx
pop ecx
jne 0x43788b
test ebx, ebx
jne 0x407a27
mov ecx, dword [edi + 0x74]
mov edx, dword [edi + 0x78]
cmp ecx, edx
jge 0x40797d
cmp esi, dword [esp + ecx*4 + 0x44]
jle 0x40797d
inc ecx
jmp 0x407970
cmp ecx, edx
jg 0x437884
cmp dword [esp + 0x28], 0
jle 0x407a3c
cmp edx, ecx
jle 0x4079a3
mov eax, dword [esp + edx*4 + 0x44]
sub eax, esi
cmp eax, dword [esp + 0x28]
jle 0x4079a3
dec edx
jmp 0x407990
mov dword [edi + 0x14b08], edx
mov eax, dword [edi + 0x14b08]
cmp esi, dword [esp + eax*4 + 0x44]
jg 0x437897
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.0041247a
xor edx, edx
cmp dword [edi + 0x50], edx
jle 0x407a09
mov eax, dword [edi + 0x4c]
lea esi, [ebp + 0x12a0]
xor ebx, ebx
test eax, eax
jle 0x4079fd
mov ebp, dword [edi + 0xcbac]
mov ecx, esi
mov eax, dword [ecx + 0x4c]
add eax, dword [ecx]
lea ecx, [ecx + 0x1484]
sub ebp, eax
inc ebx
mov dword [edi + 0xcbac], ebp
mov eax, dword [edi + 0x4c]
cmp ebx, eax
jl 0x4079e2
inc edx
add esi, 0x2908
cmp edx, dword [edi + 0x50]
jl 0x4079d4
mov edx, dword [esp + 0x10]
mov ecx, edi
call fcn.004077a2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26e4
ret
and dword [esi], 0
jmp 0x4078d7
cmp dword [edi + 0x80], 0
jne 0x40796a
xor ecx, ecx
inc ecx
jmp 0x40796d
mov dword [edi + 0x14b08], ecx
jmp 0x4079a9
mov ecx, edx
jmp 0x407985
and dword [edi + 0x14b08], 0
jmp 0x4079a9
push str.INTERNAL_ERROR_IN_VBR_NEW_CODE__please_send_bug_report_n
push edi
call fcn.0043e7c6
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.0042208d
int3
Function at 0x409d01
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 0x10]
cmp dword [ecx + 0x50], 2
jne 0x409d1f
call fcn.0040aa30
test eax, eax
jne 0x437c1d
pop esi
ret
call fcn.0044064a
jmp 0x409d15
push str.INTERNAL_ERROR_IN_VBR_NEW_CODE__986___please_send_bug_report_n
push dword [esi + 0xc]
call fcn.0043e7c6
pop ecx
pop ecx
push 0xffffffffffffffff
call fcn.0042208d
int3
Function at 0x4120f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov ebx, edx
mov esi, ecx
test edi, edi
jle 0x412121
movzx edx, word [esi]
movzx ecx, byte [eax + ebx]
inc eax
xor ecx, edx
shr dx, 8
movzx ecx, cl
xor dx, word [ecx*4 + 0x455398]
mov word [esi], dx
cmp eax, edi
jl 0x412101
pop edi
pop esi
pop ebx
ret

Function at 0x412256
Capabilities:
Encode data using xor

Disassembly:
push ebp
push esi
push edi
push 8
mov esi, edx
mov edi, ecx
pop ebp
cmp esi, ebp
jge 0x41229a
cmp esi, 0x20
jge 0x4122de
cmp esi, 1
jge 0x412272
pop edi
pop esi
pop ebp
ret
mov edx, dword [edi + 0xcba8]
mov ecx, edi
push 1
call fcn.00412303
pop ecx
xor eax, eax
cmp dword [edi + 0x94], eax
sete al
xor dword [edi + 0xcba8], eax
sub esi, 1
jne 0x412272
jmp 0x41226e
push ebp
push 0x4c
pop edx
call fcn.00412303
sub esi, ebp
pop ecx
cmp esi, ebp
jl 0x412264
push ebp
push 0x41
pop edx
mov ecx, edi
call fcn.00412303
sub esi, ebp
pop ecx
cmp esi, ebp
jl 0x412264
push ebp
push 0x4d
pop edx
mov ecx, edi
call fcn.00412303
sub esi, ebp
pop ecx
cmp esi, ebp
jl 0x412264
push ebp
push 0x45
pop edx
mov ecx, edi
call fcn.00412303
pop ecx
sub esi, ebp
jmp 0x412264
push ebx
xor ebx, ebx
cmp esi, ebp
jl 0x4122fd
movsx edx, byte [ebx + 0x454860]
mov ecx, edi
push ebp
sub esi, ebp
call fcn.00412303
inc ebx
pop ecx
cmp ebx, 5
jl 0x4122e1
pop ebx
jmp 0x412269