joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b54bf
Capabilities:
Parse pe header

Disassembly:
inc ecx
pop esi
push ebp
outsd dx, dword [esi]
push 0x5a
dec ebp
popal
imul ebp, dword [eax + ebp*2 + 0x55], 0x40
imul esp, dword [esi + 0x45], 0x4d67575d
inc edi
pop esi
bound ecx, qword [ebp + 0x44]
dec esi
outsb dx, byte [esi]
inc esi
push 0x65785364
inc ebx
pop edi
inc ecx
outsb dx, byte [esi]
pop edx
inc ebp
push ecx
dec ebp
pop edi
push esp
push ecx
cmp ebx, 0x330f2b4f
je 0x4b21e1
mov dword [eax], ecx
cmp ebp, 0xaf2650af
cmove edi, ecx
call fcn.004b21c5
mulpd xmm6, xmm4
add eax, 0xc
push 0
test eax, eax
push 0xeb36745b
add ebx, dword [ecx - 0x78]
pop ebp
invalid
invalid
idiv bh
push word [esp + 4]
popf
mov eax, dword [ecx]
pop ebx
lea esp, [esp + 2]
cmp dword [esp + 0x18], 0xc1997c51
cmove edi, ecx
push 0x20
cmp dword [esp - 0x20], 0x8d88fd85
je 0x4b214e
and eax, 0x1f
cmp dword [esp + 0x40], 0x11bef9ef
jne 0x4b5519
inc eax
out dx, eax
stc
mov esi, 0x421f7511
inc edx
inc edx
js 0x4b555e
inc ebp
jne 0x4b550f
mov ecx, dword [eax + 4]
dec ebp
popal
pop esp
dec esp
jns 0x4b54f3
cmp edi, 0x41a0f815
inc ecx
add byte [ebx + 0x47], bh
pop esi
inc eax
pop ebp
test esi, esi
pop ebp
pop ecx
push 0x78666a65
push ebx

Function at 0x4b551a
Capabilities:
Parse pe header

Disassembly:
cmp esi, 0x14f6a961
jne 0x4b5571
pop ebp
insd dword es:[edi], dx
push dx
inc edx
jnp 0x4b557e
push ebx
pop esi
outsd dx, dword [esi]
inc esi
dec ebp
js 0x4b5575
dec esi
imul ebx, dword [esi + 0x67], 0x5c
pop ebp
arpl word [edi + 0x56], cx
push 0x786a405c
jnp 0x4b55ae
dec esp
push esp
dec eax
pop edi
pop esi
push esp
arpl word [edi + 0x78], bx
insb byte es:[edi], dx
insd dword es:[edi], dx
dec edx
pop esi
inc ecx
inc eax
bound edx, qword [ebp + 0x45]
js 0x4b55d0
push ebp
outsb dx, byte [esi]
push 0x56
pop edi
imul esp, dword [ecx + 0x68], 0x65
push 0x66
js 0x4b55b7
insb byte es:[edi], dx
pop edx
inc ebp
inc eax
dec ebx
insb byte es:[edi], dx
inc esi
dec eax
dec ebp
pop ecx
bound ebp, qword [ebx]
enter 0xfffffffffffffe81, 0x25
cmp edi, dword [ebp - 0x3b]
sub ecx, eax
cmp esi, 0xc57d3b25
and eax, 0x74c57d3b
inc eax
je 0x4b55bb
ror esi, cl
jl 0x4b55a4
call 0x2da66538
dec eax
inc ebp
dec eax
push edi
Function at 0x4b55ec
Capabilities:
Parse pe header

Disassembly:
lds esi, [eax + eax*2 - 0x2d]
into
cmp dword [esp - 0x18], 0x2d5b0fb3
je 0x4b5590
pushf
call 0x4b55ec
push esp
jns 0x4b55d3
inc edx
js 0x4b55de
pop ebp
push ecx
pop bp
bound esp, qword [ebp + 0x6a]
inc esi
insb byte es:[edi], dx
inc esi
inc ebx
push 0x484b4366
push edx
inc eax
pop edx
dec eax
inc ecx
pop esi
imul ebp, dword [edi + 0x69], 0x57674845
push ebx
push edi
dec esp
pop esp
push esp
jnp 0x4b5632
pop edx
jnp 0x4b561d
inc esp
outsd dx, dword [esi]
inc ebp
dec esp
dec ebx
inc edx
push esi
imul edi, dword [ebx + 0x5c], 0x64685765
dec eax
dec edi
dec ebx
inc ebx
inc ebx
inc ebx
jnp 0x4b563c
push 0x6e45494a
dec edx
dec ecx
inc ebp
outsb dx, byte [esi]
pop edx
pop ebx
pop edx
arpl word [edx + 0x63], cx
push eax
popal
arpl word [eax + 0x61], dx
outsd dx, dword [esi]
pop edx
outsd dx, dword [esi]
dec esp
inc ebp
pop eax
push esi
pop ebp
pop esi
jnp 0x4b5578
cmp al, 0x24
lea esp, [esp + 4]
lea ebp, [esp + 2]
lea esp, [esp - 4]
mov dword [esp], eax
call 0x4b5606
mov dword [esp], edx
mov eax, edi
add eax, 0xfff6baf2
push word [esp + 8]
popf
add byte [esi - 0x63], ah
xor esi, dword [eax]
pop edx
mov eax, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
cmp ebp, 0xb65e69f7
je 0x4b564d
xchg dword [ebx], esi
xor eax, eax
cmp ebx, 0x626ac749
je 0x4b5617
pop edi
cmp dword [esp + 0x68], 0x25be7351
jne 0x4b566c
push esp
outsb dx, byte [esi]
push esp
imul edi, dword [ebx + 8], 0
inc ebp
inc esi
add esp, 0x18
push dword [ebp + 0x18]
sbb byte [ebp + 0x4a], dh
mov esi, dword [ebx]
jmp 0x4b56db
pop esi
cmp edi, 0x7083c3eb
je 0x4b563d
pop ebx
adc al, byte [eax]
add byte [eax], al
add byte [eax], al
dec ecx
dec edx
pop ebx
jns 0x4b5744
dec eax
dec eax
pop ebx
push ecx
dec esp
dec esi
dec ecx
inc eax
arpl word [ebp + 0x5e], sp
jns 0x4b575a
pop ecx
dec esi
pop esi
pop ebx
dec ebp
pop esi
jns 0x4b5774
pop ecx
add byte [edi + 0x56], al
Function at 0x4c1ddf
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
pop edi
push edx
lea edx, [esp + 0xa]
push esi
call 0x4c1dee

Function at 0x4c2f32
Capabilities:
Encode data using xor
Parse pe header
Resolve function by parsing pe exports

Disassembly:
popal
dec eax
inc edi
dec ebp
inc eax
dec esp
pop edi
pop esi
push ebx
pop edx
outsb dx, byte [esi]
inc ecx
inc ebx
push edx
imul eax, dword [ebp + 0x59], 0x55
outsd dx, dword [esi]
inc ebp
dec eax
push 8
or byte [edi], cl
mov bh, 0xc0
pop ecx
cmp ax, cx
ja 0x4c386b
push esi
push edx
push 0x32
push 0x1be
push ax
Function at 0x4c7d2a
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
dec esi
jne 0x4c7d38
push eax
imul edx, dword [ebp + 0x6a], 0x4e585708
push 8
push edi
pop eax
dec esi
push 8
push edi
pop eax
dec esi
mov byte [ecx], al
pop edx
insd dword es:[edi], dx
je 0x4c7d6f
add bl, al
cmp dword [esp - 0x1c], 0xd7da11a9
jl 0x4c7d5e
in al, 0xa9
adc edx, ebx
xlatb
je 0x528adf
mov byte [edi], bl
cmp ebx, 0x87737737
je 0x4c7dc6
mov byte [edi + 1], 0
cmp esi, 0x7189aa77
cmove edx, ebx
xor eax, eax
cmp dword [esp + 0x54], 0x748673c5
je 0x4c7d24
pop ebx
cmp dword [esp + 0x74], 0xfd2c0bd3
sub al, 0xfd
je 0x4c7def
pop edi
cmp dword [esp + 0x24], 0xdf659525
cmove ecx, ecx
pop esi
cmp dword [esp + 0x3c], 0x53ef83ff
jne 0x4c7dbd
inc esp
pop edi
dec ecx
inc esp
dec esp
dec ecx
push ebp
dec eax
inc esi
popal
inc edx
dec edi
dec esi
push ebx
dec esp
inc edx
dec esi
dec ebp
inc edx
js 0x4c7de7
bound ebx, qword [ecx + 0x66]
push edi
pop ecx
pop ecx
dec edx
push 0x794e4b5e
inc edi
dec ebx
pop eax
dec esp
imul ecx, dword [ebp + 0x6f], 0x45
outsd dx, dword fs:[esi]
dec ebp
dec edx
dec ebp
push esi
inc esp
push edi
pop ebx
leave
cmp edi, 0x832c9d2f
jne 0x4c7de0
push ss
add byte [eax], al
add byte [ecx + 0x5a], bl
pop ecx
pop edx
push 0x4a
dec esi
push eax
bound ecx, qword [edi + 0x79]
pop esi
push 0x50
insd dword es:[edi], dx
inc esi
dec esi
dec ebx
pop edx
push esp
inc ebp
outsb dx, byte [esi]
insd dword es:[edi], dx
ret
fcmovnu st(0), st(1)
dec esp
js 0x528b4f
outsw dx, word [esi]
bound ebp, qword [ebx + 0x64]
pop ebp
inc edi
insd dword es:[edi], dx
arpl word [eax + 0x61], bp

Function at 0x4c8001
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub dh, byte [esi + 0xf]
inc esp
xlatb
je 0x4c7fd3
dec eax
pop edi

Function at 0x4c81a5
Capabilities:
Encode data using base64
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
pop esp
imul esp, dword [ecx - 0x7b], 0xffffffd2
pop edx
outsd dx, dword [esi]
pop ecx
pop ebx
or ecx, 0xffffffff
cmp dword [esp + 0x74], 0x4ad5ce1d
aad 0x4a
je 0x511bfa
add esp, 0x1c
mov edx, eax
cmp dword [ebp + 0x10], ecx
push edx
push ecx
push eax
push eax
push ecx
push 0x32f0
push edx
push edi
push 0xf9207781
pushf
push esi
call 0x4c820d
insb byte es:[edi], dx
jnp 0x4c8210
pop si
je 0x4c83d2
push 0x6c576c58
dec esp
pop ecx
inc esi
dec eax
inc ecx
mov dword [ebp - 0x2c], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
call fcn.004c7fdd
push 0x4205c8
mov cl, 6
mov eax, edi
mov eax, dword [eax]
mov eax, dword [ebp - 0xc]
arpl word [ebp + 0x75], ax
sbb eax, 0x6610c483
dec ecx
mov byte [esi], 0xd
push esi
push esi
jnp 0x4c8186
ror byte [ebx + eax*4], 0xef
and byte [esi + eax*2 + 0x6e], al
push edx
push ebp
lock xchg dword [esp], esi
lea esp, [esp + 4]
and al, 0x8d
and al, 4
call 0x4c821a
mov dword [esp], ebp
mov ebp, 0xf9207721
cmove ebp, dword [esp + 0xa]
lea ebp, [esi + ebp + 0x6df89c5]
lock xchg dword [esp + 0xa], ebp
pop ebp
pop esi
popf
ret 0x1e
add dword [edx + 0x33d6440f], esp
leave
Function at 0x4d209a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esp - 0x10], 0x1af57b51
invalid

Function at 0x4d20a3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
fimul word [ebx - 0x4e057f00]
sal edx, cl
jmp 0x9da5c0
Function at 0x4e6dcd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004eac29
dec esp
pop ebp
push ebx
mov ebp, esp
test edx, edx
invalid
pop edx
ret
outsb dx, byte [esi]
pop eax

Function at 0x4e75bb
Capabilities:
Read file on windows

Disassembly:
js 0x4e755a
push esp
outsb dx, byte [esi]
imul ecx, dword [ebx + 0x60], 0x65745c6d
push eax
dec ecx
push ebx
js 0x4e7575
call fcn.004e759c
push eax
insb byte es:[edi], dx
dec ebx
push ebp
push ecx
inc esp
dec esp
pop ebp
pop edi
inc edi
dec eax
push 0x47
pop esi
push edi
dec esi
inc eax
inc edi
pop ebx
push 0x6a
jnp 0x4e757c
imul sp, word [ecx + 0x67], 0x4346
dec ebp
inc esp
arpl word [eax + 0x49], sp
inc eax
dec ebx
push edi
insd dword es:[edi], dx
pop ebx
js 0x4e758f
pushal
inc ebp
inc edi
js 0x4e75a9
inc edi
imul ecx, dword [ecx + edx*2 + 0x42], 0x47
push 0x50
inc esi
inc ecx
dec ebx
popal
imul ebp, dword [eax + 0x48], 0x41
pop eax
inc ecx
push edi
outsb dx, byte [esi]
pop eax
pop esi
push edx
pop ebp
popal
inc ebx
push ebp
dec esp
inc ecx
inc eax
dec ecx
outsd dx, dword [esi]
outsb dx, byte [esi]
pop edx
insd dword es:[edi], dx
pushal
inc ebx
push ebp
dec edx
dec edx
insb byte es:[edi], dx
pop eax
jns 0x4e75ce
inc esi
dec esi
outsb dx, byte [esi]
pop esi
inc ebx
pop eax
dec ecx
inc esi
outsb dx, byte [esi]
dec ebp
pop edx
pop esp
pop edx
jnp 0x4e75ea
pop edi
pushal
outsb dx, byte [esi]
imul ebx, dword [edi + 0x5d], 0x53
jns 0x4e75f2
inc esi
pop edi
dec ebp
pop eax
and al, 4
xlatb
add byte [eax], al
add bl, al
inc ebx
pop ecx
dec ebp
pop ecx
bound edx, qword [ebp + 0x6c]
dec ebx
pop ebx
push esp
push 0x57475c4a
dec edx
pop esp
inc edi
push edi
jnp 0x4e763a
inc esp
arpl word [ecx + 0x63], dx
dec ecx
pop eax
imul ebx, dword [ebx + 0x68], 0x5f5f5567
pop esi
inc ebp
dec edi
dec eax
pop ecx
push ebp
js 0x4e763f
pop edi
inc ebp
jns 0x4e7636
bound edi, qword [eax + 0x5c]
push esp
jnp 0x4e7623
inc edx
pop ecx
pushal
push 0x436c6757
insb byte es:[edi], dx
inc ebx
dec edx
outsb dx, byte [esi]
js 0x4e7636
inc ebp
inc ecx
outsd dx, dword [esi]
push ebx
push edx
jnp 0x4e7661
outsb dx, byte [esi]
inc ebp
dec esp
outsb dx, byte [esi]
cmp ebx, 0xa2f0930b
cmove ecx, edi
push 0
cmp dword [esp + 0x34], 0x4d0c94d3
jne 0x4e7659
call fcn.004de187
mov ecx, dword [ebp - 8]
je 0x4e762d
push esi
inc eax
pop eax
je 0x4e769a
push esi
push esp
push esi
imul ebp, dword [edx + 1], 0x504c6443
push 1
inc ebx
dec esp
push eax
add byte [ebp + 0x56], al
inc eax
mov al, byte [esi + 0x2d]
dec esp
dec edx
push edi
inc eax
push edi
dec eax
jne 0x4e761a
jmp 0x8a401c1
or dword [ebx + 0x4a570855], 0xffffffc3
sub eax, 1
jne 0x4e75e6
dec edx
ret
dec eax
pop ecx
dec edx
pushal
dec edi
arpl word [ecx - 0x74743], cx
mov ebp, 0xfffff8b8
outsb dx, byte [esi]
inc esi
bound ecx, qword [edi + 0x79]
Function at 0x4e764d
Capabilities:
Read file on windows

Disassembly:
mov ebp, 0xfffff8b8
outsb dx, byte [esi]
inc esi
mov eax, dword [ebp + 0x10]
mov byte [edi], cl
mov dword [esi], eax
cmp edi, 0x4bc8602b
jne 0x4e7684
inc esi
dec edi
push eax
pop edx
push edx
inc esp
pop esp
outsd dx, dword [esi]
js 0x4e76d7
js 0x4e76da
dec ebx
insd dword es:[edi], dx
pop esi
imul ebp, dword [ebp + 0x46], 0x46
dec edx
insb byte es:[edi], dx
inc ebx
dec ebx
arpl word [esi + ebx*2 + 0x78], sp
imul dx, word [ebx + 0x56], 0xe851
ja 0x4e7687
call 0x4e7700
add byte [eax], al
pop esi
pop ebx
push eax
push esi
push edi
insb byte es:[edi], dx
jns 0x4e76eb
inc eax
js 0x4e773b
insb byte es:[edi], dx
inc edi
dec ebx
sub eax, 0x7468445e
add edi, dword [ebx]
rol dword [eax + 0x47], 0x44
pop esp
pop ecx
dec ebx
jmp 0x4e777f
adc byte [ebx + edi*2 - 0x75], dh
push es
cmp ebp, 0x52b87e35
jne 0x4e77c6
pop edi
dec ebp
inc ecx
pop edx
dec edx
pop esi
push esi
jnp 0x4e7801
push esp
dec ebp
pop esp
pop ebx
inc edi
jnp 0x4e7818
pop edi
dec ecx
push 0x4c66654f
pop edx
outsd dx, dword [esi]
dec ebp
push ebp
jns 0x4e7810
imul ebx, dword [eax + 0x6a], 0x426a5c43
insd dword es:[edi], dx
push esi
pushal
jnp 0x4e7801
outsd dx, dword [esi]
dec esi
dec ecx
imul ebp, dword [esi + 0x48], 0x416e4b62
push ebx
add esp, 0xc
test eax, eax
je 0x4e792f
cmp ecx, 0xddc6939d
jne 0x4e782d
inc esp
inc ebp
dec edx
imul edi, dword [eax + 0x4c], 0x6e
mov dword [esi + 4], eax
cmp dword [esp + 0x34], 0x86acf503
je 0x4e7874
add eax, 0x10
mov dword [esi + 8], eax
push ecx
push ecx
Function at 0x4ebd84
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], edx
lea edx, [esp + 0xa]
lea esp, [esp - 4]
mov dword [esp], eax
push edi
mov eax, ecx
add eax, 0xfff364fc
push word [esp + 0x10]
popf
mov dword [eax], 1
pop edi
pop eax
mov edx, dword [esp]
lea esp, [esp + 4]
mov ecx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
cmp ebp, 0x7ac2eb03
je 0x527afa
call 0x4ebe55
je fcn.004ebd82
push eax
pop ecx
push esi
push ebp
popal
push edi
dec edi
pop ecx
push dword [ebp + 0xc]
outsb dx, byte [esi]
js 0x4ebe4b
pop ebx
push edx
mov esi, 0x1cc
mov dword [esp + 8], edx
inc edx
arpl word [edx + eax], cx
mov eax, dword [eax + ecx + 0x18]
push ebp
push 0x53
je 0x4ebe5d
pushal
push ebx
inc edi
inc eax
mov edx, edi
imul ebp, dword [ebx + 0x23], 0x75
and byte [esi + 0x68], ah
push 0x27e8d4e
inc edx
insb byte es:[edi], dx
push 0x43
js 0x4ebe68
popal
inc ebp
je 0x4ebe65
je 0x4ebe2e
call fcn.004ee71d
mov edi, dword [esi]
push eax
imul edx, dword [esi + 0xd], 0x67
push 0x1075ff42
or eax, 0xff426867
jne 0x4ebe45
push eax
inc ebp
inc edi
pop edi
pop ecx
inc esp
inc esp
shl ecx, 2
jnp 0x4ebe59
inc esi
pop edx
dec eax
inc esp
inc edx
push eax
jns 0x4ebe89
push edi
imul ebx, dword [eax + 0x64], 0xffffff89
or eax, 0
push eax
push dword [esp]
lea esp, [esp - 4]
and al, 0xfc
mov dword [esp], edx
adc al, 0x24
add dword [esp + 4], 0xfff2e2e1
mov edx, dword [esp + 4]
dec dword [ebx - 0x74fbdbac]
adc cl, byte [ecx - 0x7efbdbac]
inc esp
and al, 8
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
add al, dh
xchg dword [esp], edx
push esp
and al, 4
mov edx, dword [edx]
mov dword [esp + 4], edx
add dword [esp + 8], 0xa7
lock xchg dword [esp], edx
lea esp, [esp + 4]
ret
rcpps xmm2, xmmword [ebp + 0x52]
push ebp
call fcn.004ebee2
jne 0x4ebebc
jne 0x4ebea4
mov esi, eax
outsd dx, dword [esi]
dec eax
pushal
dec ebp
dec eax
push ebp
bound esp, qword [ebx + 0x75]
mov dh, 0xc3
pop ecx
push 0x4d8b666c
cld
add eax, ecx
add al, byte [eax]
imul ebp, ebx, 0x62037402
dec eax
dec esp
arpl word [edx + 0x74], ax
pop ss
ret
dec eax
dec ebx
push 0x886b7b63
pop ebp
clc
outsd dx, dword [esi]
xor eax, eax
jmp 0x4ebfab
je 0x4ebfdb
outsd dx, dword [esi]
dec ebx
pop edx
push edi
push edi
dec ecx
push ebx
inc ebp
call fcn.004eb288
mov eax, dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test byte [edx + esi + 0x3c], al
iretd
mov ebx, 0x7825de1
cmovne ebx, dword [esp + 0xa]
lea ebx, [esi + ebx - 0x7825ce8]
mov dword [esp + 0xa], ebx
mov ebx, dword [esp]
pop eax
imul esp, dword [edx + 0x48], 0x76a6f47
xor eax, eax
push edi
or edi, 0xffffffff
jmp 0x5990d4
Function at 0x4f74fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
dec ebp
inc ebx
inc ebx
bound ecx, qword [esi + 0x69]
js 0x4f756e
inc esi
push eax
jns 0x4f7551
pop eax
outsb dx, byte [esi]
insb byte es:[edi], dx
push eax
jnp 0x4f757a
pop ebp
dec edi
dec esi
dec edx
push esp
pop eax
push 0x795b6048
inc esp
push edx
js 0x4f7599
dec esp
push eax
cmp ebp, 0x1364807b
cmove ebx, ebp
push esi
cmp ebp, 0x6efb89a9
je 0x4f755f
push ebx
cmp eax, 0x85207abf
jne 0x4f758b
inc ebp
js 0x4f758f
imul edx, dword [ecx + 0x64], 0x62
inc esp
dec edx
dec edi
push 0x60656765
pop edi
dec esp
inc eax
push 0x54
outsd dx, dword [esi]
push 0x53646643
pushal
pop esi
outsd dx, dword [esi]
pop eax
inc ebp
dec edi
inc ecx
inc esp
pop ecx
jns 0x4f75b2
popal
imul edx, dword [edi + 0x4e], 0x4b
imul edx, dword [ecx + 0x57], 0x4c
dec edx
dec ecx
imul edx, dword [eax + 0x78], 0x79795779
js 0x4f75e9
push edi
jns 0x4f75ec
push 0x5061786e
push bp
inc esp
push esi
dec edi
push ebx
dec ebx
dec ecx
inc eax
inc edi
pop ebp
bound ebp, qword [di + 0x50]
inc esi
dec ebp
pop esp
push esi
push ebx
cmp ebp, 0x2ee11a75
cmove esi, edx
sbb ah, cl
cmove esi, edx
mov dword [ebp - 8], eax
mov dword [ecx], esi
test eax, 0x49850f
add byte [eax], al
Function at 0x4ff5bd
Capabilities:
Read file on windows

Disassembly:
inc edi
insb byte es:[edi], dx
push esp
jns 0x4ff615
push ebp
push ebp
js 0x4ff612
outsb dx, byte [esi]
popal
bound eax, qword [edi + 0x78]
dec esp
inc ebx
dec eax
inc edi
dec ecx
inc edi
pushal
outsd dx, dword [esi]
inc edx
inc esp
and al, 0x38
jne 0x4ff612
cld
test byte [esp + esi*2 + 0x25], ah

Function at 0x4ff6f2
Capabilities:
Read file on windows

Disassembly:
pop esi
cmp eax, 0xecf6597b
cmove eax, esi
pop ebx
cmp ecx, 0xe2fe640f
jne 0x4ff70f
dec esi
pop edi

Function at 0x5040da
Capabilities:
Write file on windows

Disassembly:
lock xchg dword [esp], edx
lea esp, [esp + 4]
push ebx
lea ebx, [esp + 0xa]
lea esp, [esp - 4]
mov dword [esp], ecx
call 0x5040f6
mov dword [esp], ebp
mov ecx, edx
add ecx, 0xfff1d774
push word [esp + 0x10]
popf
cmp eax, dword [ecx]
mov ebp, dword [esp]
lea esp, [esp + 4]
pop ecx
mov ebx, dword [esp]
lea esp, [esp + 4]
mov edx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
je 0x5041f2
cmp esi, 0xa6879d5d
jne 0x504165
push esi
dec esp
inc ebp
js 0x5041a4
pop eax
inc eax
inc ebp
inc esi
dec ecx
popal
inc ebx
dec ebp
push edi
dec ecx
pop edi
arpl word [eax + 0x5e], di
push 0x53
pop esi
jns 0x504197
dec edx
inc esp
push edi
inc ecx
pop edi
inc esp
pop edi
popal
inc edx
pop edi
dec edx
push ebp
dec ebx
insb byte es:[edi], dx
imul ebp, dword [ecx + 0x78], 0x47
push eax
cmp esi, 0xa954171
je 0x588d99
call 0x5041ba
dec eax
dec ebx
dec ebx
pop ebp
pop esp
pop edx
sub esp, 0x38
dec ecx
popal
cmp byte [ecx + 0x61], cl
inc edi
push esp
dec ebx
add esp, 0x18
push esi
jne 0x50419f
mov esi, 0x1cc
push esi
pushal
dec edx
mov eax, dword [eax*4 + 0x422020]
push dword [esp]
add dword [esp], 0xfffaedee
add dword [esp + 4], 0x7a
ret
mov eax, dword [esi + 0x4c]
pushf
push ecx
call 0x504222
arpl word [ebx + 0x48], dx
push esp
inc ecx
dec edx
dec ebp
push edx
pushal
pushal
inc edx
popal
arpl word [edx + 0x54], dx
popal
push ebp
outsb dx, byte [esi]
arpl word [ecx + 0x46], cx
push edi
jns 0x504281
push ebp
dec eax
js 0x504275
jnp 0x504272
push 0x43
pop eax
inc ecx
push esp
pop ecx
lea esp, [esp - 4]
mov dword [esp], edx
lea edx, [esp + 0xa]
push ebp
call 0x504237
mov dword [esp], ebx
mov ebp, ecx
add ebp, 0xfff1d61f
push word [esp + 0x10]
popf
cmp eax, dword ds:[ebp]
pop ebx
pop ebp
pop edx
mov ecx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
je 0x504437
cmp dword [esp], 0xd30635ad
jne 0x5042da
push dword [ebp - 0x954]
pop edx
push esp
idiv bh
call [edx + 0x54]
pop ebp
cmp al, 0x64
dec eax
mov ecx, 0xf
add byte [eax], al
push dword [ebp + 0x1c]
pop eax
pop eax
mov edx, dword [eax + 8]
je 0x5042eb
call fcn.004f82b3
jae 0x504299
mov byte [edi + 2], al
push str.InitializeCriticalSectionEx
imul ebx, dword [esp + ebx*2 - 1], 0x75
or byte [eax + 0x6e], ch
test cl, 4
lodsb al, byte [esi]
inc ecx
add byte [ebx + 0x5c], ch
pop esp
push dword [ebp + 8]
push 0x4c1f66e
or eax, 0xffffffff
mov ecx, dword [eax + 4]
insb byte es:[edi], dx
push eax
cmp eax, 0x85410d83
jne 0x504306
push esp
inc edi
dec esi
popal
dec esp
inc ecx
outsb dx, byte [esi]
dec eax
push eax
inc ebx
pop ebx
push ebp
jnp 0x50436e
dec esp
dec edi
pop ebp
pcmpeqb xmm1, xmm3
Function at 0x504222
Capabilities:
Write file on windows

Disassembly:
lock xchg dword [esp], edx
lea esp, [esp + 4]
push ebx
lea ebx, [esp + 0xa]
lea esp, [esp - 4]
mov dword [esp], ecx
call 0x5040f6
mov dword [esp], ebp
mov ecx, edx
add ecx, 0xfff1d774
push word [esp + 0x10]
popf
cmp eax, dword [ecx]
mov ebp, dword [esp]
lea esp, [esp + 4]
pop ecx
mov ebx, dword [esp]
lea esp, [esp + 4]
mov edx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
je 0x5041f2
cmp esi, 0xa6879d5d
jne 0x504165
push esi
dec esp
inc ebp
js 0x5041a4
pop eax
inc eax
inc ebp
inc esi
dec ecx
popal
inc ebx
dec ebp
push edi
dec ecx
pop edi
arpl word [eax + 0x5e], di
push 0x53
pop esi
jns 0x504197
dec edx
inc esp
push edi
inc ecx
pop edi
inc esp
pop edi
popal
inc edx
pop edi
dec edx
push ebp
dec ebx
insb byte es:[edi], dx
imul ebp, dword [ecx + 0x78], 0x47
push eax
cmp esi, 0xa954171
je 0x588d99
call 0x5041ba
dec eax
dec ebx
dec ebx
pop ebp
pop esp
pop edx
sub esp, 0x38
dec ecx
popal
cmp byte [ecx + 0x61], cl
inc edi
push esp
dec ebx
add esp, 0x18
push esi
jne 0x50419f
mov esi, 0x1cc
push esi
pushal
dec edx
mov eax, dword [eax*4 + 0x422020]
push dword [esp]
add dword [esp], 0xfffaedee
add dword [esp + 4], 0x7a
ret
mov eax, dword [esi + 0x4c]
pushf
push ecx
call 0x504222
arpl word [ebx + 0x48], dx
push esp
inc ecx
dec edx
dec ebp
push edx
pushal
pushal
inc edx
popal
arpl word [edx + 0x54], dx
popal
push ebp
outsb dx, byte [esi]
arpl word [ecx + 0x46], cx
push edi
jns 0x504281
push ebp
dec eax
js 0x504275
jnp 0x504272
push 0x43
pop eax
inc ecx
push esp
pop ecx
lea esp, [esp - 4]
mov dword [esp], edx
lea edx, [esp + 0xa]
push ebp
call 0x504237
mov dword [esp], ebx
mov ebp, ecx
add ebp, 0xfff1d61f
push word [esp + 0x10]
popf
cmp eax, dword ds:[ebp]
pop ebx
pop ebp
pop edx
mov ecx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp + 2]
je 0x504437
cmp dword [esp], 0xd30635ad
jne 0x5042da
push dword [ebp - 0x954]
pop edx
push esp
idiv bh
call [edx + 0x54]
pop ebp
cmp al, 0x64
dec eax
mov ecx, 0xf
add byte [eax], al
push dword [ebp + 0x1c]
pop eax
pop eax
mov edx, dword [eax + 8]
je 0x5042eb
call fcn.004f82b3
jae 0x504299
mov byte [edi + 2], al
push str.InitializeCriticalSectionEx
imul ebx, dword [esp + ebx*2 - 1], 0x75
or byte [eax + 0x6e], ch
test cl, 4
lodsb al, byte [esi]
inc ecx
add byte [ebx + 0x5c], ch
pop esp
push dword [ebp + 8]
push 0x4c1f66e
or eax, 0xffffffff
mov ecx, dword [eax + 4]
insb byte es:[edi], dx
push eax
cmp eax, 0x85410d83
jne 0x504306
push esp
inc edi
dec esi
popal
dec esp
inc ecx
outsb dx, byte [esi]
dec eax
push eax
inc ebx
pop ebx
push ebp
jnp 0x50436e
dec esp
dec edi
pop ebp
pcmpeqb xmm1, xmm3