joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a3c0
Capabilities:
Terminate process

Disassembly:
push esi
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [0x488fcc]
add eax, 0x2880011
mov dword [0x488fcc], eax
mov eax, dword [0x4a7358]
mov ecx, esp
mov dword [ecx], eax
call fcn.00417660
mov dx, word [0x49d0c6]
movsx ecx, dx
mov esi, dword [0x487b5c]
add ecx, esi
or ecx, 0xecdfa222
mov esi, dword [0x493f18]
cmp ecx, esi
mov byte [esp + 0xb], al
jne 0x43a471
mov eax, 0xc451b5bf
mov cx, word [0x49f0ee]
movsx edx, cx
xor edx, 0xffffffff
or edx, 0x5dbafc82
cmp eax, edx
jne 0x43a44f
mov eax, dword [0x482dc4]
mov ecx, dword [0x489f90]
and eax, ecx
and eax, 0xd7e0027c
mov dword [0x489f90], eax
jmp 0x43a46c
mov eax, 0x25b4b74d
mov ecx, dword [0x48c3e0]
cmp eax, ecx
jne 0x43a467
jmp 0x43a467
jmp 0x43a46c
jmp 0x43a471
mov eax, 1
mov dword [esp], 1
mov dword [esp + 4], eax
call fcn.00455698
int3
Function at 0x441f20
Capabilities:
Hash data with md5

Disassembly:
push edi
push esi
push eax
mov dword [esp], ecx
mov eax, dword [0x4917fc]
imul eax, eax, 0x747c1f98
mov dword [0x4917fc], eax
mov dword [ecx], 0
mov eax, dword [0x48f620]
shr eax, 6
imul eax, eax, 0xc4b9ff17
mov dx, ax
mov word [0x4a436a], dx
mov dword [ecx + 4], 0
mov dx, word [0x49d032]
mov ax, dx
inc eax
mov si, ax
mov word [0x49d032], si
movsx eax, dx
add eax, 0xb38948dc
mov edi, dword [0x48be84]
and edi, eax
mov dword [0x48be84], edi
mov dword [ecx + 8], 0x67452301
mov eax, dword [0x4833ec]
or eax, 0xf99d05ff
mov dword [0x4833ec], eax
mov dword [ecx + 0xc], 0xefcdab89
mov eax, dword [0x4943fc]
add eax, 0x778f33cf
mov edi, dword [0x47f980]
xor eax, edi
xor eax, 0x793f9e27
mov dword [0x47f980], eax
mov dword [ecx + 0x10], 0x98badcfe
mov eax, dword [0x48a340]
mov edi, dword [0x48d518]
add edi, eax
mov dword [0x48d518], edi
mov dword [ecx + 0x14], 0x10325476
mov eax, dword [0x48a99c]
or eax, 0xd26ade74
mov dword [0x48a99c], eax
add esp, 4
pop esi
pop edi
ret
Function at 0x45cb0e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x47e6f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00458b50
mov dword [ebp - 0x14], eax
cmp dword [0x4a85bc], esi
jne 0x45cc01
push 0x800
push esi
push 0x473260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x45cb8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x45cce1
push esi
push esi
push 0x473260
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x45cce1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x45cce1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4a85bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4a85c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4a85c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a85cc], eax
test eax, eax
je 0x45cbfe
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4a85c8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45cc26
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45cc19
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x45cc3b
push 4
pop eax
jmp 0x45cce3
cmp dword [ebp - 0x14], esi
je 0x45cc3b
push dword [0x4a85bc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x45cc20
mov eax, dword [0x4a85c8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x45cc99
cmp dword [0x4a85cc], edi
je 0x45cc99
push eax
call ebx
push dword [0x4a85cc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x45cc99
test eax, eax
je 0x45cc99
call ecx
test eax, eax
je 0x45cc8e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x45cc8e
test byte [ebp - 8], 1
jne 0x45cc99
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x45ccc9
mov eax, dword [0x4a85c0]
cmp eax, edi
je 0x45ccc6
push eax
call ebx
test eax, eax
je 0x45ccc6
call eax
mov esi, eax
test esi, esi
je 0x45ccc6
mov eax, dword [0x4a85c4]
cmp eax, edi
je 0x45ccc6
push eax
call ebx
test eax, eax
je 0x45ccc6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4a85bc]
call ebx
test eax, eax
je 0x45cce1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x45cce3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045cd12
mov esp, ebp
pop ebp
ret
Function at 0x100b60d7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100b5f56
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.DLL_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x403870
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00403a63
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0040e5b8
xor ebx, ebx
cmp eax, ebx
jne 0x403a1e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00403a63
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0040b297
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0045cb8c
add esp, 0x10
test eax, eax
jne 0x403939
push esi
call 0x400f22
mov esi, eax
cmp esi, ebx
pop ecx
je 0x403939
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x403924
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x403939
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x403932
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0040facb
cmp byte [esp + 0x13], bl
je 0x403969
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00403aa0
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4039d9
push 0x14
call fcn.0045bdf9
cmp eax, ebx
pop ecx
je 0x403993
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x403995
xor edi, edi
cmp edi, ebx
je 0x4039d9
push esi
push edi
call fcn.00402fc6
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0040308e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004031b7
add esp, 0x18
call fcn.00403a63
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0040dc85
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4039f0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x403a02
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x403a45
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x403a45
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0040308e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004031b7
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40dc85
Capabilities:
Encode data using xor

Disassembly:
xchg ecx, eax
sub dword [esp + ebx*2], ecx
add eax, 0x1b850bd6
imul ecx, edx, 0xffffff8f
imul esi, dword [ebp + 0x34], 0xffffffc4
xor byte [edi], cl
push ebx
and eax, 0x7b0e532a
fsub qword [edi + 0x62]
and al, 0x2c
sub esi, dword [edx - 0x1c]
arpl ax, sp
sbb dword ds:[esi - 0x55a94072], esp
sbb dword [esi - 0x55a94072], esp
sbb ebp, dword [ebx - 0x36]
invalid
and al, 0x9a
lea ebp, [ecx - 2]
imul ecx, dword [ecx - 0x240e87d2], 0x5a3d8598
scasd eax, dword es:[edi]
adc dword [edx], 0x1a
or ebx, esp
push edx
dec eax
cmp al, 0x6c
adc ah, dl
out 0x75, eax
jno 0x40dc6a
xchg ecx, eax
scasd eax, dword es:[edi]
and al, 0xdc
pop ebp
cmp byte [ecx + 0x1b213a56], al
retf

Function at 0x40e3eb
Capabilities:
Encode data using xor

Disassembly:
enter 0xffffffffffff9e9a, 0x1a
fmul st(7), st(0)
or byte [ecx], 0xe6
pop edi
mov ch, pe_nt_image_headers32
xor dword [ebp - 0x448a7b59], 0xcba3d34c
les esp, [ebx - 0x38e8d734]
jno 0x40e441
imul ebx, dword [ebp + 0x7faee3e7], 0x42
out dx, eax
pop edx
lcall 0xfc03, 0x42040cce
invalid
push ebp
or dword [edi + 0x1cfdf4cb], 0xffffffc5
std
sbb al, 0xc5
push ebp
outsd dx, dword [esi]
push edx
push ds
ror dword [esi + 0x28], 1
sbb byte [eax], al
aaa
adc eax, 0x5c682b19
pop esi
xor byte [eax - 0xff5aafe], dh
leave
or al, 0x22
les eax, [edx]
mov byte [eax + 0x6d], ch
push edx
test byte [0x6e7edb47], dl
xor edx, dword [eax]
jnp 0x40e43c
cmp eax, 0xd581b4af
xor edi, 0x643cf594
cwde
jbe 0x40e4e3
mov ebp, 0xc2be95aa
mov bl, ch
add esi, 0xffffffcc
push ebp
outsd dx, dword [esi]
mov edi, 0x5b60c83
pop es
test cl, dh
and dh, byte [ecx]
insd dword es:[edi], dx
mov eax, 0x8fd5d56f
shl dword [edx - 0x64], cl
add al, 0x63
xor byte [eax], 0xd4
arpl word ds:[ebp - 0x212031d], cx
or byte [edx + 0x589285e2], ch
rol byte [edx + 0x51], 1
cdq
push ss
invalid
fdiv dword [ebp - 0x3c]
fstp qword [ecx]
test ebx, esp
and byte [esp + edi], ch
mov ah, 0xa1
sbb dword [ebx - 0x3ccabfc7], edx
pop eax
and esi, dword [ecx + 0xd]
wait
retf

Function at 0x40facb
Capabilities:
Encode data using xor

Disassembly:
dec esi
and dword [ecx + 0x76b9ecf4], ebx
outsb dx, byte [esi]
sal bh, cl
mov bh, 0xd6
imul ecx, dword [0xb220940e], 0x3d
lcall 0xd2b2, 0x8554ba5d
invalid
Function at 0x417610
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417636
mov eax, dword [0x4baa90]
test eax, eax
je 0x41762c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x4baa90], eax
test eax, eax
pop ebx
je 0x4176d1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov ecx, dword [0x4baa90]
push str.DirectSoundEnumerateA
push ecx
mov dword [0x4baa8c], eax
call esi
mov ecx, dword [0x4baa8c]
mov dword [0x4baa94], eax
test ecx, ecx
je 0x4176c7
test eax, eax
je 0x4176c7
mov eax, 1
pop esi
add esp, 0x50
ret
invalid
invalid
nop
Function at 0x4219b6
Capabilities:
Check for vm using instruction vpcext

Disassembly:
mov eax, dword [0x79cfc904]
xchg edx, eax
sbb byte [edi + 8], dh
js 0x421a2e
aas
xchg byte [edx - 0x3657d6b9], dl
invalid
and ebx, edi
int3
Function at 0x45282c
Capabilities:
Encode data using xor

Disassembly:
invd
push ecx
mov bl, 0x31
xchg ecx, eax
mov edi, 0x8a92c77b
mov bl, 0xa4
wait
mov bl, 0xb2
scasd eax, dword es:[edi]
sub edi, dword [esp + ecx*2]
dec esp
push esp
ror byte [ebx], 4
mov esi, 0x2cae1611
or al, 0x4b
or ch, bl
cmp dh, dh
stc
insd dword es:[edi], dx
xor ch, bl
cwde
sal dword [ecx], cl
adc bl, byte [esi - 0x1403c6f0]
jb 0x4527f0
leave
js 0x4527e9
dec edx
out dx, eax
jb 0x452879
and ecx, ebp
clc
jle 0x452845
std
pop ebp
push eax
sbb al, 0xf2
fild dword [ecx + 0x7f]
mov ebp, 0x6086500
jg 0x452809
add byte [ebp + 8], ah
push es
pop ds
fcomp dword gs:[ebx + eax*4]
mov ch, 0x6c
fld dword [edi + 0x11]
sub al, cl
mov bh, 0x26
or bh, cl
pop ecx
jno 0x45282f
jns 0x4528b9
sar dword [esi], 0x75
or al, 0x64
nop
add eax, 0x696a8ac
mov bh, 0xd7
dec esi
pop es
cmpsd dword [si], dword es:[di]
push ecx
popal
scasb al, byte es:[edi]
sahf
jne 0x452818
or cl, dh
jno 0x4528f7
cmp byte [edx - 0x12], bl
dec ecx
and cl, ch
adc eax, 0xb7432622
into
mov byte [0x207829f8], al
js 0x4528b2
inc esi
mov ss, word [edx]
or eax, dword [esi + 0x46ec4538]
dec esp
lds edi, [esi - 0x95d2d6b]
cmp al, 0xd1
jle 0x45284a
xchg ebx, eax
lcall 0xaa41, 0x2053a23c
out 0x47, eax
jge 0x452865
sub edi, ebx
or eax, 0x685a4ddb
insb byte es:[edi], dx
push ebx
ljmp 0x98bc
cmpsb byte [esi], byte es:[edi]
bnd jno 0x452890
test esi, edx
mov edi, ebx
adc eax, 0x37960aa3
inc edx
xor byte [esi - 0x6d], bl
sbb eax, 0xbd02c989
add esp, dword [edi - 0x467103f7]
inc ebx
jbe 0x452977
invalid
nop
cli
int1
fadd st(2), st(0)
jmp 0x550a9d32
Function at 0x47c6d7
Capabilities:
Encode data using xor

Disassembly:
daa
stc
cmpsd dword es:[esi], dword es:[edi]
dec edx
stc
cmp dl, bh
out dx, al
out dx, al
int 0x2c
mov ah, 0x88
dec ebp
fcmove st(0), st(2)
sub dword fs:[ebp + 0x3c6fad4c], ebp
cmc
adc al, byte [esi - 0x70b5a038]
adc ebp, esp
mov esp, 0x1d5f6e49
iretd
jnp 0x47c6db
ja 0x47c680
push ebx
push ss
push 0x9d07c411
push cs
test eax, 0xa49f0ca8
mov edx, 0xb5349c9f
lahf
pushfd
xor al, 0xb5
mov al, 0x6e
cmp dword [edi + 0x48], edi
lea edi, [esi - 0x3b24e004]
les ecx, [ebx - 0x64]
mov edx, 0x80d7e980
or al, 0xab
leave
push esi
sub al, 0xc3
insb byte es:[edi], dx
pop ss
outsd dx, dword [esi]
xchg dword [ebx], esi
aaa
movsb byte es:[edi], byte [esi]
mov ecx, 0xf165f34e
test byte [ebx + 0x6d], dh
xor ecx, dword [ebx + 0x16]
out 0x8b, al
xor al, byte [edx - 9]
xchg ecx, eax
enter 0x689c, 2
call 0x3dfa674d
push esi
test byte [edx + eax], cl
in eax, 0xfc
mov byte [ebx - 0x11], ch
jge 0x47c6e9
imul ebp, edi, 0x7d
mov bh, 0x7d
push esi
jge 0x47c78a
jno 0x47c74e
sbb dword [ebx + 0x2b], esi
inc ebx
retf
insb byte es:[edi], dx
mov al, 0x64
xor esp, ebx
arpl word [eax + 0x47], bx
fsub dword [ebp - 0x1a]
adc edi, dword [eax + 0x36]
sbb bl, byte [0x2284ffad]
pushal
retf
jle 0x47c72e
pop ss
and esi, ebp
sbb eax, 0xb7ec14e
and al, 0x80
dec edi
xchg bh, ch
test dword [edi + 0x29], ebp
jge 0x47c7c1
push edi
pop esp
sbb dword [ebx], eax
push ebp
and ecx, esi
rcr dword [0x29a11e40], 0x30
add dword [ebx], ecx
jle 0x47c7e6
xchg dword [ebp + 0x27], edx
adc al, 0x63
shr byte [esi - 0x7f], cl
out 0x82, eax
add byte [edi + 2], bh
jg 0x47c7c0
mov cl, 0x26
add al, 0x5f
add al, 0x5f
push eax
jbe 0x47c819
aaa
or al, 0x84
out dx, eax
les esp, [ebx]
inc esp
or dword [edi - 0x2efe4c5], esi
and dl, byte [ebp + 0x252a99e2]
jbe 0x47c7a5
cmp byte [ebp + 0x3b], 0x9d
mov bl, 0x58
ja 0x47c80c
xlatb
jl 0x47c7bc
xchg edx, eax
test byte [edi - 0x6d], dl
jmp [esi + ecx*2]
into
dec esp
or dh, 0x5b
sbb bl, bl
mov edx, 0xbe7ba89
shr byte [ebx + 0xac0492b], 0xdd
stosd dword es:[edi], eax
sub ecx, dword [ecx - 0x40]
or bl, ch
push ecx
jmp 0x47c85b
pop edi
iretd

Function at 0x47ea9b
Capabilities:
Encode data using xor

Disassembly:
popfd
and dword cs:[esi - 0x3a83dc50], eax
add al, 7
out dx, eax
fld st(3)
inc ecx
pop edx
jae 0x47ea86
mov al, byte [0xf0ba3c24]
lodsb al, byte [esi]
mov cl, 0x78
adc eax, 0xbb85ea9d
retf
Function at 0x48b920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048bb13
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00496668
xor ebx, ebx
cmp eax, ebx
jne 0x48bace
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048bb13
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00493347
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e4c3c
add esp, 0x10
test eax, eax
jne 0x48b9e9
push esi
call fcn.00488fd2
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48b9e9
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48b9d4
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48b9e9
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48b9e2
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.00497b7b
cmp byte [esp + 0x13], bl
je 0x48ba19
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048bb50
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48ba89
push 0x14
call 0x4e3ea9
cmp eax, ebx
pop ecx
je 0x48ba43
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48ba45
xor edi, edi
cmp edi, ebx
je 0x48ba89
push esi
push edi
call fcn.0048b076
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048b13e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b267
add esp, 0x18
call fcn.0048bb13
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00495d35
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48baa0
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48bab2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48baf5
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48baf5
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048b13e
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b267
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495bf3
Capabilities:
Encode data using xor

Disassembly:
dec esi
push esi
ja 0x495bb4
sub edi, dword [ecx + ebp*4 - 0x47]
cdq
dec esp
push ebx
movsd dword es:[edi], dword [esi]
adc byte [ebx], 0x1f
loop fcn.00495bf3
push ss
jns 0x495c18
idiv byte [ebp - 0x330ad7aa]
mov ebp, 0xccf52856
les ecx, [ebx + 0x64]
loopne 0x495c00
mov eax, 0x6977365c
xor dword [edi], ecx
push eax
mov ebx, 0xa4120093
popfd
aad 0xd9
lea ebx, [ebx + 0x29f865cc]
movsb byte es:[edi], byte [esi]
jge 0x495bc1
out dx, al
dec edx
out dx, eax
add eax, 0xeec441ac
push esi
jl 0x495bac
ror cl, 1
mov dh, 2
push edx
and dword [edi], esp
push 0xa9e60341
sub ecx, dword [ebx + ebx*4 - 0x152ced7d]
adc dl, bl
ljmp 0xc4c3
shr edx, cl
dec ecx
jp 0x495bff
test al, 0xc3
les ecx, [esp + ecx*8]
push cs
bound edi, qword [ebx]
invalid
nop
invalid
Function at 0x4ac5c5
Capabilities:
Encode data using xor

Disassembly:
adc esi, ebx
push edx
lodsd eax, dword [esi]
ficom word [edx - 0x53]
xor dword [0x614bee24], eax
sub byte [ecx + 0x2e21c340], al
in al, 0x6a
inc ebx
mov bl, byte [ebp - 0xd23c09e]
popfd
bound edi, qword [edi]
fdivr st(2), st(0)
imul esp, dword [ebp + 0x22875029], 0x5d13737b
lodsb al, byte [esi]
xchg ebp, eax
loope 0x4ac5c8
in eax, 0x43
fadd st(1), st(0)
pop edi
jo 0x4ac5d8
xchg dword [ebx], ecx
pop ecx
sar bh, cl
mov eax, dword [0x7343ff50]
mov al, 0xd4
cmp al, 0x74
mov al, byte [0xa02a72d0]
lodsb al, byte [esi]
inc edx
jp 0x4ac5c4
push ss
stosb byte es:[edi], al
mov ch, 3
das
arpl sp, bx
inc ecx
invalid