joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436cd0
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532d0b
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x581a60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push edi
lea ecx, [ebp - 0x324]
call fcn.004307e0
lea ecx, [ebp - 0x324]
mov dword [ebp - 4], 0
call fcn.00436f80
lea ecx, [ebp - 0x324]
call fcn.00435220
push 6
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x324]
call fcn.00430220
mov eax, dword [eax]
push 0x55fc94
push eax
call fcn.0053c469
add esp, 8
test eax, eax
mov eax, dword [ebp - 0x328]
sete bl
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436d71
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 5
test bl, bl
je 0x436dae
push edi
call dword [0x536430]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x324]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436da7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x436f58
push 0
push 0
push edi
push 0x55ec64
push 0
call dword [0x5364f4]
mov dword [ebp - 0x328], eax
cmp eax, 0x20
ja 0x436f29
lea ecx, [ebp - 0x320]
push ecx
push 1
push 0
push 0x55fc9c
push 0xb3ae0855
jnp 0x436e12
inc ebp
push ecx
popal
and dl, byte [esi + 0x51]
push esi
push ecx
xor dword [ebp - 0x12229bdc], ecx
xor eax, 0xaaacf5bc
invalid
cmp eax, 0xeeac78af
pop eax
mov dh, 0x8b
or dword [eax + 0x27a6dc25], esp
mov esi, 0x35d9bb87
sbb al, 0x75
stc
mov dword [0xce397674], 0x958fcd45
cwde
in eax, 0x69
lds esi, [eax + 0x6f54595]
mov bh, 0xb9
and eax, 0xcc18a281
loop 0x436e6a
fnstcw word [ebp - 7]
mov byte [ecx + 0x5b30fcbd], cl
xor dword [edx*2 + 0x71f235a8], esp
out dx, eax
cmp byte [ebp + ecx*8 - 0x76bf6b74], 0xbc
movsb byte es:[edi], byte [esi]
shl dword [esi], 0x38
jns 0x436ea8
movsd dword es:[edi], dword [esi]
jbe 0x436dea
mov ah, 0x1f
xor eax, 0x8c1a541c
cmp bh, dh
adc bh, bh
lodsd eax, dword [esi]
sbb al, 0x54
sbb cl, byte [eax + edi - 0x5200ed09]
mov al, 0x38
mov ebp, 0x8334dbb2
invalid
rcr byte [ecx - 0xb16a562], cl
cdq
cmp cx, word [ecx + 0x4c12ac39]
add eax, 0xc8f3ddb8
xchg edx, eax
clc
mov ah, byte [ebp - 0x783a74fc]
test byte [edx], 0x7c
imul dword [0x59462d25]
clc
sub ch, byte [edi - 0x3cba902b]
mov dword [0x257e739e], eax
pop esp
ret 0xf0ae
invalid
cld
dec esp
and eax, 0xf1ecd55c
push ds
mov ecx, 0x8dc47e51
sbb al, 0x76
sub dword [esp + ecx*2 + 0x283b7405], esi
adc esp, esp
retf 0xd18c

Function at 0x44252d
Capabilities:
Encode data using xor

Disassembly:
stc
push cs
inc eax
sti
inc esi
call 0xb67fb721
pop edx
mov dl, 0xb4
cli
inc ecx
invalid
Function at 0x452f90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [ebp + 0x31710def], dl
or dword gs:[ecx], esp
push ss
aad 0xfe
invalid
xor eax, 0x65cdeaf4
cmp ah, byte ds:[edi - 0x32]
dec esp
jbe 0x452f70
and eax, 0xd777ab91
jns 0x452f9a
mov bh, 0x1d
mov bh, 0xc7
sub byte [edx + 0x1dc6a586], bh
call 0xf7495175
out dx, eax
pushal
dec esi
pop edx
dec ebx
in eax, 0xb5
jno 0x452feb
pop esi
std
xor ebx, ebx
loopne 0x452f88
cmp ch, al
int 0xa3
pop esi
jp 0x452f52
xchg dword [ecx], ecx
add dword [edx + 0x5a5e06c], ecx
loopne 0x452f37
add eax, 0x18606dae
jecxz 0x452fa8
xchg edi, eax
push ecx
insb byte es:[edi], dx
loopne 0x452f37
add eax, 0x18606dae
jecxz 0x452fa8
xchg edi, eax
push ecx
insb byte es:[edi], dx
adc esi, dword [ecx]
and al, 0xc1
xor dword [ecx + eax*8], esp
cmp dl, ch
pop ecx
sub bh, byte [edx - 0x62]
stosb byte es:[edi], al
jo 0x452f9d
hlt
sub esi, edi
inc ecx
add byte [edi + edi - 6], 0xc8
xchg esp, eax
jno 0x452f7f
push cs
pop ebp
add ebx, dword [ecx]
inc ecx
dec edi
sub dword [ebx - 0x54c232fe], 0x7fc29736
wait
imul esp, dword [ecx - 0x26ae0651], 0x28
pop ss
ret
rcr byte [edx - 0x14], cl
pop edx
in al, dx
jl 0x452fec
xor byte [esi - 0x6e], bl
rol byte [eax], cl
or al, cl
fcom qword [edx + 0x4053b968]
ret 0xf87f

Function at 0x4552ef
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0x2c
cdq
jno 0x4552ee
xor eax, 0x3d3cd315
jno 0x455315
wait
mov edx, 0x1c31340f
add al, 0xf6
js 0x455347
add dl, byte [ebx - 0x56]
mov dl, byte [edi + 0x604fbb85]
or al, 0xed
test dword [ebx - 0x12f39fb1], edi
mov dword [0xc615f578], eax
jbe 0x455313
out 0x75, eax
movsb byte es:[edi], byte [esi]
and byte [edx - 0x14], 0x55
sub dword [ecx - 0x4f], edx
pop esi
push ecx
mov cl, 0x5e
push 0x66
rcr dh, cl
jns 0x455347
mov dh, byte [ecx]
sbb ebx, ebx
cmp dword [esi + eax*8], esi
cdq
and eax, 0x44e14dd7
dec ebp
loope 0x455349
xchg byte [eax + 0x14498877], bh
leave
push ecx
lodsb al, byte [esi]
xor dh, bl
dec edx
out dx, al
not byte [edx - 0x15]
push edx
jmp 0x4552bf
test eax, 0x524b5843
push 0x20d64b46
sub dword [edi + 0x78], eax
sub ecx, ecx
add eax, 0x2b9e37a8
jge 0x455389
xchg edx, eax
push ecx
and dword [eax + 0x495321a3], eax
push ecx
cmp bl, byte [edi]
push cs
xchg edx, eax
jmp 0x455373
jle 0x4552da
push eax
invalid
les ebx, [edi + 0x74]
insd dword es:[edi], dx
je 0x4553b8
and al, 0x7a
aaa
or al, 0x49
sbb al, 0xe
and edi, ebp
dec edi
inc esi
xchg esi, eax
mov dh, 0x13
push ss
push cs
insd dword es:[edi], dx
jnp 0x455302
aad 0x67
imul ebx, dword [0xc73f4f6d], 0xffffff85
xchg edi, eax
pop edi
cmp bl, al
test al, 2
xchg ebx, eax
pop ecx
jge 0x45530b
jl 0x45533d
wait
invalid
xor dword [edx - 0x68], ecx
dec edx
cwde
sub al, 0x67
xor esp, dword [eax + edi*2 - 0x868b181]
cmp edx, ebx
rcr ecx, 1
push 0x42
push 0xffffffffffffffcb
sal esp, 0x4c
leave
test al, 0xd
cmp dword [edi - 0x70938bb6], ecx
dec esi
out dx, eax
outsb dx, byte [esi]
xchg esi, eax
jp 0x455388
ret
mov dh, 6
lds edi, [eax - 0xc]
mov al, byte [0xf5d7cb8]
xor al, 0xdc
iretd
Function at 0x45b14b
Capabilities:
Encode data using xor

Disassembly:
or byte [ebx - 0x4f], dh
inc ebp
insb byte es:[edi], dx
ror byte [ebp + 0x53d05d7f], 1
iretd
jg 0x45b141
mov edi, 0x52b25358
lodsb al, byte [esi]
pushal
xchg ebp, eax
lock add ebx, dword [ecx + 0x787708c3]
inc ebp
mov byte [0x65d8eb10], al
cmp esi, eax
pop edi
mov ah, 0xba
mov eax, 0x716f97d2
imul ebp, esp, 0x1b
mov ebp, 0x55aaea6a
jnp 0x45b0c5
invalid
mov ch, 0xbe
mov al, byte [0x52dac9f5]
push eax
mov esi, 0x169d981e
push ss
mov bh, 0x83
std
sbb eax, 0x98897830
mov eax, 0xdc93a90e
pop ebx
mov byte [0xd23a4c31], al
mov esp, 0xc4fd7a23
mov dword [0xb8e868aa], eax
jg 0x45b13f
call 0x9b1a3124
movsd dword es:[edi], dword [esi]
in al, dx
daa
lahf
imul ebp, dword [ebp - 0xb], 0x87f8d6ab
xor dword [ecx + 0x11], ebx
xchg ebx, eax
or eax, 0x19418df8
cmp byte [ebx - 0x60289d04], 0xed
lcall 0x6d69, 0x9f27eca5
cmc
stosd dword es:[edi], eax
salc
clc
xchg dword [ecx], esi
pop ecx
adc dword [ebx + 0x418df80d], edx
sbb dword [edx - 0x289d0345], eax
lahf
in eax, dx
push ebp
mov ecx, 0xb383b153
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
aas
fsubrp st(1)
enter 0x374, 0x17
out 0xce, al
jo 0x45b167
jmp 0xa6015eba

Function at 0x45d4b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38
Function at 0x469120
Capabilities:
Encode data using xor

Disassembly:
and dword [ebp + 0x6781a7a3], 0x5e
push 0x292f280e
or al, 0x6b
insd dword es:[edi], dx
insb byte es:[edi], dx
mov ch, byte [edx + ebp*4 + 0x696d8bad]
popal
pop es
and esp, dword [0x60640223]
sbb byte [esi - 0x70575158], cl
imul ebp, dword [edi + 0x69], 0x2a2c2a0c
or ebp, dword [esi + 0x66]
popal
xchg dword [ecx + 0x6684a2a7], esp
push cs
push 0x2a2c2a0f
or eax, 0x886e6b6d
scasb al, byte es:[edi]
test eax, 0x626384a0
add esp, dword fs:[0x58012620]
outsb dx, byte [esi]
imul ecx, dword [ecx - 0x7f5c5a51], 0x3f676b28
sub byte [esi], ch
sub dword [edi], ecx
imul ebp, dword [edx + ebp*2 - 0x74], 0x8dabadaa
imul ebp, dword [ebp + 0x6c], 0xa
sub al, 0x2b
sub eax, 0x6f686e0b
mov dword [edi + 0x6186a0a9], ebp
bound eax, qword [si]
and esp, dword [0x6f693f24]
imul ecx, dword [edi - 0x73555357], 0xc6a6c6a
sub ch, byte [ebx + ebp]
or eax, 0x8d6b6d6b
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lea ebp, [edx + ebp*2 + 0x6c]
or ch, byte [edx + ebp]
sub al, 0x2a
sub al, 0xa
insb byte es:[edi], dx
imul ebp, dword [ebp - 0x75], 0xffffffad
stosd dword es:[edi], eax
lodsd eax, dword [esi]
mov byte [esi + 0x68], ch
outsb dx, byte [esi]
or byte [esi], ch
sub dword [edi], ebp
or dword [edi + 0x66], ebp
pushal
xchg byte [ecx + 0x6683a4a5], ah
popal
pop eax
push cs
sub dword [0x666f082c], ebp
popal
test dword [esi + 0x698ea82e], esp
insb byte es:[edi], dx
imul ecx, dword [0xb2d2b2c], 0x6f
pushaw
xchg byte [ecx + 0x5882a1a7], ah
outsd dx, dword [esi]
imul eax, dword [ebx], 0x6c
movsb byte es:[edi], byte [esi]
cmpsb byte [esi], byte es:[edi]
mov bh, 0x87
shl al, 1
xor byte [edi + ebx], cl
adc al, 4
xor al, 0xd0
loopne 0x4691b9
adc byte [eax - 0x2d7f4f60], 0xe3
cmp al, 0xd
push ds
sub byte [edx], bh
or esp, esp
in al, 0xb4
test dword [ebp - 0x2979495b], edx
out 0x36, al
push es
pop ss
and byte [ecx], dh
add dl, dl
out dx, eax
mov eax, 0xbaa99988
mov ebx, ebx
aam 0x34
add al, 0x15
daa
xor byte [ecx], al
fsubp st(0)
mov ecx, 0xbbaa9989
mov ah, 0xe4
in al, 0x35
push es
pop ss
and dh, byte [ebx]
or al, 0xde
jmp 0xa1eb4705
Function at 0x47321d
Capabilities:
Encode data using xor

Disassembly:
inc eax
xor al, 0x94
xchg edx, eax
sub edi, dword [esi]
lcall 0x344e, 0xa53156ab
add dword [ebx - 2], eax
in al, 0xe4
lodsb al, byte [esi]
push 0xb09a21da
dec edx
outsd dx, dword [esi]
add eax, 0xb56dbb5
xor byte [esi + ecx*2 + 0x60], 0x6b
xlatb
xchg esi, eax
sbb eax, dword [0x7804b18e]
rcl byte [ebx + edi*4]
out 0x87, al
push edi
mov eax, dword [0xa49a2692]
adc ebx, dword [eax + 0x21]
adc ecx, dword es:[ecx + edi*4 + 0x10db143c]
cmp al, 0x14
fist dword [eax]
push es
push 0x334c1ddc
mov bl, 0x9d
pop esi
jno 0x473236
fist dword [ecx + eax*2 - 0x7c]
push esp
inc ebp
push ds
xchg ecx, eax
mov dword [0xda5b4528], eax
inc edx
xchg cl, al
inc ebp
xor byte [eax], dl
into
adc dh, cl
adc eax, 0x9e53989c
clc
pop ebx
les ebx, [ecx + 0x161cd50b]
test dword [esi - 0x1635e4c2], ecx
cmp esi, edx
xor ebx, edx
mov byte [0x625dbf7a], al
add byte [edx], cl
lcall 0x9e86, 0xe1ac8406
pop ebx
jle 0x47324e
int1
inc dh
bound esi, qword [edi + 0x12076504]
pop ebp
jns 0x47325b
arpl di, di
cmpsd dword [esi], dword es:[edi]
jp 0x47327c
arpl bp, ax
pop ecx
test al, 0x41
fbld tbyte [edi]
cmpsb byte [esi], byte es:[edi]
cmp esi, dword [eax + ecx*4 - 0x62]
aad 0xec
and bl, byte [esi + esi*8 + 0x221fbd08]
sar dh, 0x2d
invalid
Function at 0x4744b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586d80
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x474578
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586d80
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00580a5b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x47461e
cmp edi, dword [esi + 0x7c]
jge 0x47461e
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488ec2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488ec2
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586d80
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586d80
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x474570
jmp 0x474540
call 0x48d0e9
int3
Function at 0x48bd90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call int.0059e660
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48be58
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call int.0059e660
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0059833b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48befe
cmp edi, dword [esi + 0x7c]
jge 0x48befe
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004a07a2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004a07a2
fld qword [esi + 0x88]
fmul qword [0x560e70]
call int.0059e660
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call int.0059e660
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48be50
jmp 0x48be20
call fcn.004a49c9
int3

Function at 0x492f46
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0x20
ja 0x4930a9
lea ebp, [edi + edx*2]
int1
inc edi
inc ecx
jbe 0x492f79
push es
dec esi
bound edi, qword [esi + 0x29]
push ecx
cmp byte [esi], bl
push edi
iretd
or eax, 0xf0c60725
shr byte [edi + esi*4 - 0x3ecb7b72], cl
jl 0x492f5d
xchg edx, eax
push edx
invalid
xor eax, 0x766bf991
push ecx
sbb byte [ecx + 0x11715381], cl
push edi
xor al, byte [edi]
invalid
fdiv dword [ecx + 0x6d64c014]
pop ebx
aam 0xc7
cli
inc esi
nop
jg 0x4930ce
jecxz 0x49310d
or byte [edi + edx], ch
mov byte [0xc7277761], 0xa
invalid
sbb esp, dword [edi + 4]
loope 0x49308d
div dword [ebx + 0x78]
and eax, 0xc1142cd0
cmp byte [ecx + 0x1157d994], ch
sub ecx, esi
xlatb
aad 0xe6
push edx
lahf
mov ebp, 0x786c7286
ret
pop ebx
invalid
Function at 0x49674a
Capabilities:
Encode data using xor

Disassembly:
sbb bh, 0x95
into
inc edi
push ecx
sub edx, esp
pushal
invalid
jecxz 0x496702
lds edi, [ebp - 0x34]
pop esi
and byte [ebx + 0x7d8ac1bd], 0xe5
out 0x29, al
call 0x971df19c
ror dword [edx + 0x29e6e57d], 0xe8
mov dl, ah
xchg esi, eax
mov byte [0xdf3e508], al
test eax, 0x42ece6a5
inc edx
xor bh, cl
sub byte [ecx + 0x15], dh
xor ebp, dword [esi + 0x4a]
sbb dl, byte [edi + 0x77]
mov esi, 0x84fbd9c
xchg esi, eax
mov esp, 0x84bb310
xchg ebx, eax
ficomp word [edx]
pop ebx
movsd dword es:[edi], dword [esi]
or byte [edi - 0x14], 0x9e
in al, dx
pop ecx
or eax, 0xcfd7491
xchg ebx, eax
pop es
pop eax
dec ebp
inc ebp
adc ebx, dword [ebp - 0x25]
mov word [ebx], ss
adc ecx, dword [ecx]
or eax, 0x7c986783
loopne 0x496753
mov dword [edi], edx
inc edi
jle 0x496750
sti
pop edi
loopne 0x496767
pushal
cmc
inc edx
pop ss
dec ebx
insd dword es:[edi], dx
mov esp, dword [edi]
jno 0x496806
pop ebx
mov ebp, 0x409bc6e1
bound edx, qword [esi + 0xf449e4b]
mov ebx, 0x9ae02770
sbb byte [esi], bl
inc edi
jg 0x4967fe
test eax, 0x8aacb598
inc edi
bnd jle 0x4967b5
scasb al, byte es:[edi]
push ebx
scasd eax, dword es:[edi]
jmp dword [ebx]
xchg esi, eax
mov dword [ebp + ecx - 0xf18e5ed], eax
mov dword [0x742c0dcc], eax
mov edx, 0x1753321b
xor dl, byte [ebx + 0x17]
in eax, dx
pop esp
push ebx
int 0x12
mov bh, 0xdb
int1
inc eax
adc ch, byte [ebx]
adc dl, byte [ebx]
dec edi
outsd dx, dword [esi]
xchg ebx, eax
test byte [edi], dl
movsb byte es:[edi], byte [esi]
or byte [edx + edi*8 - 0x23742fbc], bl
dec ebp
inc ebp
sbb dword [ebx + 0x53f64e1f], edi
loop 0x4967f7
out 0xd2, al
stosd dword es:[edi], eax
xchg dh, cl
xchg bl, ch
jge 0x4967f5
jno 0x49683d
sub ch, byte [edi + ecx*2 - 0x7d]
retf 0xa16a
push 0xffffffffffffffa1
dec ebp
neg bl
and dl, byte [ebx + 0x57]
dec ebx
fstp xword [esi + 0xbb4557]
mov bl, 0xf7
mov ecx, 0x5689c5b9
push ebx
outsd dx, dword [esi]
or ah, byte [ecx]
jmp 0x6ae758ed

Function at 0x4a1afd
Capabilities:
Encode data using xor

Disassembly:
imul edx, dword ds:[0x7f645ac1], 0xffffffd3
adc edi, ecx
jp 0x4a1b53
mov ebx, 0x64f0ea25
push ecx
add esi, ebx
pop ebx
push esi
sub dword [0xfb3c889c], ebp
xor edx, esp
invalid
xchg byte [ebp + edx*4 + 0x63bde0c4], cl
cmp byte [edi], bh
test dword [eax + 0x6a9a7e4a], 0x4b8fcd56
push ecx
pop ss
xchg edi, eax
out 0xf7, al
mov edi, dword [edi]
lodsd eax, dword [esi]
insd dword es:[edi], dx
shl dword [edx], 0xf0
and dh, al
insd dword es:[edi], dx
mov edi, 0x36cc3a3e
rol al, 0xd3
rcr esp, 0x2b
rcl bl, 0xc1
fsubr qword [ebx]
mov dl, 0x9e
cmp dl, dh
sahf
aad 0xf9
idiv byte fs:[ebp - 0x24]
lodsb al, byte [esi]
jge 0x4a1b36
je 0x4a1b5c
insd dword es:[edi], dx
mov dh, 0xb
cdq
and eax, esp
pop eax
fsub st(6), st(0)
inc al
lodsd eax, dword [esi]
iretd
Function at 0x4a2e70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b5740
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a2f38
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b5740
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005af41b
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js fcn.004a2fde
cmp edi, dword [esi + 0x7c]
jge fcn.004a2fde
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b7882
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b7882
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b5740
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b5740
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a2f30
jmp 0x4a2f00

Function at 0x4b9af7
Capabilities:
Terminate process

Disassembly:
or bh, bh
adc eax, sym.imp.KERNEL32.dll_GetCurrentProcess
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x4c6d7c], edi
mov byte [0x4c6d78], bl
jne 0x4b9b59
mov eax, dword [0x4c7410]
test eax, eax
je 0x4b9b48
mov ecx, dword [0x4c740c]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b9b47
mov eax, dword [esi]
test eax, eax
je 0x4b9b3c
call eax
sub esi, 4
cmp esi, dword [0x4c7410]
jae 0x4b9b34
pop esi
push 0x4c2018
push 0x4c2014
call fcn.004b9b9a
pop ecx
pop ecx
push 0x4c2020
push 0x4c201c
call fcn.004b9b9a
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b9b76
call fcn.004b9b91
pop edi
ret
push dword [esp + 8]
mov dword [0x4c6d80], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4ba0bb
Capabilities:
Query environment variable

Disassembly:
insb byte es:[edi], dx
dec ebx
add byte [ebx + 0xffb3bf8], cl
test dl, ch
add byte [eax], al
add bh, al
add eax, 0x4c6e88
add al, byte [eax]
add byte [eax], al
jmp 0x4ba167
cmp edi, ebx
jne 0x4ba177
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov edi, eax
cmp edi, ebx
je 0x4ba1b3
cmp byte [edi], bl
mov eax, edi
je 0x4ba187
inc eax
cmp byte [eax], bl
jne 0x4ba17d
inc eax
cmp byte [eax], bl
jne 0x4ba17d
sub eax, edi
inc eax
mov ebp, eax
push ebp
call fcn.004bbb02
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x4ba19d
xor esi, esi
jmp 0x4ba1a8
push ebp
push edi
push esi
call fcn.004bbc40
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, esi
jmp 0x4ba1b5
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret

Function at 0x4ba651
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23b0
cmp edx, dword [eax]
je 0x4ba673
add eax, 8
inc ecx
cmp eax, 0x4c2440
jl 0x4ba664
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23b0]
jne 0x4ba7a1
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4ba77b
test eax, eax
jne 0x4ba6a4
cmp dword [0x4c22d8], 1
je 0x4ba77b
cmp edx, 0xfc
je 0x4ba7a1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba6db
lea eax, [ebp - 0x1a4]
push 0x4bf990
push eax
call fcn.004bb030
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb4c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba71e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb4c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
cmp ebp, dword [edx + 3]
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23b4]
push 0
push eax
push dword [esi]
call fcn.004bb4c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]