joyce8/EMBER2024-capa huggingface dataset:
Function at 0x433a84
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov edx, dword [ebp + 8]
mov ecx, edx
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, edx
sar ecx, 6
and eax, 0x3f
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x44d028]
mov dword [ebp - 0x18], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x433ac6
cmp byte [ebx], 0xa
jne 0x433ac6
or byte [edi + eax + 0x28], 4
jmp 0x433acb
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x433bce
mov cl, byte [eax]
cmp cl, 0x1a
je 0x433ba9
lea ebx, [eax + 1]
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 0xc]
cmp cl, 0xd
je 0x433afa
mov eax, dword [ebp - 8]
jmp 0x433b1a
mov edx, dword [ebp - 0x10]
cmp dword [ebp - 8], edx
mov edx, dword [ebp + 8]
jae 0x433b36
mov ebx, dword [ebp - 8]
cmp byte [ebx], 0xa
jne 0x433b14
add eax, 2
mov cl, 0xa
jmp 0x433b17
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0xc]
mov byte [esi], cl
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
add esi, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jb 0x433adc
jmp 0x433bce
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x433ba4
cmp dword [ebp - 0x10], 0
je 0x433ba4
mov edx, dword [ebp - 0x18]
mov eax, dword [edx*4 + 0x44d028]
test byte [eax + edi + 0x28], 0x48
je 0x433b83
mov cl, byte [ebp - 1]
cmp cl, 0xa
jne 0x433b73
mov byte [esi], 0xa
jmp 0x433bcd
mov byte [esi], 0xd
mov eax, dword [edx*4 + 0x44d028]
mov byte [eax + edi + 0x2a], cl
jmp 0x433bcd
cmp byte [ebp - 1], 0xa
jne 0x433b8d
cmp esi, ebx
je 0x433b6e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00434616
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x433bce
mov byte [esi], 0xd
jmp 0x433bcd
mov eax, edx
and edx, 0x3f
sar eax, 6
imul edx, edx, 0x38
mov edi, dword [eax*4 + 0x44d028]
mov al, byte [edi + edx + 0x28]
test al, 0x40
jne 0x433bcb
or al, 2
mov byte [edi + edx + 0x28], al
jmp 0x433bce
mov byte [esi], cl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x433bd7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 8]
and eax, 0x3f
push ebx
mov ebx, dword [ebp + 0xc]
sar edx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [edx*4 + 0x44d028]
mov dword [ebp - 8], edx
mov edx, dword [eax + edi + 0x18]
mov dword [ebp - 0x18], edx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x433c1b
push 0xa
pop esi
cmp word [ebx], si
jne 0x433c1b
or byte [eax + edi + 0x28], 4
jmp 0x433c20
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + edx*2]
mov eax, ebx
mov dword [ebp - 0x10], edx
mov esi, ebx
cmp ebx, edx
jae 0x433d8b
movzx edx, word [eax]
mov ecx, edx
mov dword [ebp - 0xc], ecx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 8]
cmp edx, 0x1a
je 0x433d63
lea ebx, [eax + 2]
mov dword [ebp - 4], ebx
push 0xd
pop ebx
cmp dx, bx
mov ebx, dword [ebp + 0xc]
je 0x433c6d
mov ebx, dword [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 4]
movzx ebx, bx
mov dword [ebp - 4], ebx
jmp 0x433c97
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x10]
jae 0x433cb6
push 0xa
pop ebx
cmp word [edx], bx
jne 0x433c84
push ebx
add eax, 4
pop edx
jmp 0x433c8c
mov eax, edx
mov edx, dword [ebp - 0xc]
movzx edx, dx
movzx edx, dx
mov dword [ebp - 4], edx
mov edx, esi
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], 2
mov word [esi], cx
mov esi, dword [ebp - 0xc]
add esi, edx
cmp eax, dword [ebp - 0x10]
jb 0x433c32
jmp 0x433d8b
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x433d5e
cmp dword [ebp - 0x14], 0
je 0x433d5e
mov eax, dword [ebp - 8]
push 0xa
mov eax, dword [eax*4 + 0x44d028]
test byte [eax + edi + 0x28], 0x48
pop eax
je 0x433d3a
mov dx, word [ebp - 4]
cmp dx, ax
jne 0x433d02
mov word [esi], ax
jmp 0x433d88
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebp - 8]
movzx ecx, dx
shr ecx, 8
push 0xa
mov eax, dword [eax*4 + 0x44d028]
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x44d028]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x44d028]
pop ecx
mov byte [eax + edi + 0x2c], cl
jmp 0x433d88
cmp word [ebp - 4], ax
jne 0x433d44
cmp esi, ebx
je 0x433cfa
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.00434616
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x433d8b
push 0xd
pop eax
jmp 0x433cfa
mov eax, ecx
and ecx, 0x3f
sar eax, 6
imul ecx, ecx, 0x38
mov edi, dword [eax*4 + 0x44d028]
mov al, byte [edi + ecx + 0x28]
test al, 0x40
jne 0x433d85
or al, 2
mov byte [edi + ecx + 0x28], al
jmp 0x433d8b
mov word [esi], dx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x439910
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43993d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43993d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x417585
Capabilities:
Encode data using xor

Disassembly:
cdq
mov eax, dword [0x53db871b]
in eax, 0xbd
mov cl, 0x25
or dword [esi - 0x59c8bf01], ecx
out 0x48, eax
cld
dec ecx
and ch, ah
clc
xor byte [edi - 0x1f5edf2c], 0x57
mov edi, 0x88d164da
call 0x401c1cf3
call 0x401c1cf3
xor ebx, dword [ecx]
xor eax, 0xfc363d46
sbb dh, byte [eax - 0x6d39959d]
pop ss
inc ebx
inc ebx
loopne 0x4175a9
mov ah, 0x67
cdq
in eax, dx
mov byte [0x31e33446], al
clc
out 0xa9, eax
test eax, 0x38af2e23
jne 0x4175dc

Function at 0x420540
Capabilities:
Encode data using xor

Disassembly:
push ecx
sub dword [eax + 0x69], edx
sbb al, 0x71
pop ds
jno 0x42058b
push ss
pop edx
sahf
pop ds
jg 0x4205ab
pop ebx
cmp esi, dword [ecx]
push ebx
in al, dx
fadd st(0), st(0)
int3
mov edi, 0x1b55cffd
mov bl, 0xf8
invalid

Function at 0x4217fd
Capabilities:
Encode data using xor

Disassembly:
cld
pop eax
xchg esi, eax
push 0x49
fistp word [eax]
pop edx
pop ecx
push edi
cwde
mov eax, 0x4f0af980
out 0xf1, eax
pop ecx
lahf
cmpsb byte [esi], byte es:[edi]
shr dword [edi - 0x29260931], 0xc
mov ah, 0x7e
mov edi, 0x74062461
pop eax
cld
sbb dword [ebx + 0x2884963e], 0x409f94e4
xchg ecx, eax
or byte [ebp + edx*8 - 0x21b9d750], dl
idiv dl
cmp byte [ebp + 0x67], ch
mov dword [0xf4f369f0], eax
mov byte [esi - 0x2208db74], bl
neg ebp
neg ebp
xor ch, byte [edi + 0x23]
mov bl, byte [esi*8 + 0x47fc5631]
cmc
cld
in al, dx
in al, dx
jnp 0x4217b8
and ah, byte [eax]
sub esp, dword [0x6a4b422a]
fmul dword [0xc33a80c0]
test al, 0x42
push esp
lodsb al, byte [esi]
xor byte cs:[0xe4c41b36], dl
ret 0xa090

Function at 0x437abf
Capabilities:
Encode data using xor

Disassembly:
pop edx
ja 0x437b3a
add al, bh
sti
push 0x61c25e86
and bl, byte [edi]
pmaxsw mm6, qword [0xf4ea569a]
add eax, dword [edi*8 - 0x2434ceb]
and dl, byte [ebx + 0x28]
lahf
mov word [ebx], ds
sbb byte [esi - 0x18], bh
xor byte fs:[ebx + 0x35a0f270], dh
inc edx
scasd eax, dword es:[edi]
dec edi
jne 0x437ac2
mov ebx, 0xcde8cc83
mov ah, 0x2e
inc edi
sub byte [esi + 0x3b623263], al
arpl word [edx], si
bound edi, qword [ebx]
cmp byte [edx], ah
loopne 0x437b77
xchg dword cs:[esi - 0xf382d3e], ebp
fistp dword [eax + 0x4b]
loopne 0x437b2c
pop es
ret 0xa663
int1
mov ch, 0x2f
mov esi, 0xfbf27fff
add al, 0xd3
adc eax, 0xcd4b9f27
push 0x6b5a286e
int 0x68
outsb dx, byte [esi]
sub byte [edx + 0x6b], bl
or ah, dl
jl 0x437bc0
loop 0x437bb9
cmp byte [edi - 0x3f], 0x79
lds eax, [esi - 0x4a]
test eax, 0x578459ff
or al, 0x94
jecxz 0x437af9
jb 0x437aec
cmp eax, ebx
stosd dword es:[edi], eax
xor al, 0x7c
bt dword [ecx + 0x2c174eb6], esp
adc dword [esi + esi*2 - 0xa], edi
fmul st(4)
xor al, ah
mov bh, 0x54
test eax, 0xba8f3ff4
cmpsb byte [esi], byte es:[edi]
insd dword es:[edi], dx
mov bh, 0x74
xor eax, 0xbfd6381f
cli
inc esi
out 0xc4, eax
je 0x437bae
pop ds
cmp dh, dl
mov edi, 0xc4e746fa
pop esp
sub eax, 0xb9c28999
jbe 0x437bbe
push ecx
fiadd dword [esi]
adc ah, ch
mov ebx, 0x4ef19bb7
cmpsb byte [esi], byte es:[edi]
repne lodsb al, byte [esi]
sahf
cmp al, 0xaf
invalid
retf 0x3ab
jge 0x437c27
push cs
or eax, 0x3756903a
nop
push esi
aaa
int3
pop ds
fld qword [eax - 0x1c89fa0c]
invalid
Function at 0x439e63
Capabilities:
Encode data using xor

Disassembly:
add ebp, dword [edx]
pop ds
push ss
out 0x36, al
mov bl, 0x3d
hlt
dec ecx
loope 0x439e5a
pop es
mov dh, 0x5f
sbb dword [ecx + 0x26], 0x4795cd51
popfd
xor al, 0xfc
mov cl, 0xa8
xor ch, al
lcall 0xae20, 0x14721a55
xchg esp, eax
jb 0x439e9a
adc al, 0x68
add bh, byte [eax]
mov cl, 0x3f
jae 0x439ee9
xor ebp, dword [edi]
das
inc ebx
adc byte [edx + esi*2 + 0x39], ch
and eax, 0xdf04527c
invalid
xor al, 0x22
fild dword [edi - 0x28497ec9]
add ch, bl
push ss
xor ch, dh
stosd dword es:[edi], eax
add cl, byte [ebx]
push es
shr byte [esi + 0x1d], 6
js 0x439ea3
jmp 0x439ebb
mov eax, 0x3a4074da
in al, 0xe8
lodsb al, byte [esi]
loop 0x439ee9
lcall 0xc6c7, 0x9b1d8974
dec edx
jno 0x439f32
pop eax
hlt
push ecx
cmpsd dword [esi], dword es:[edi]
sbb bl, 0x59
daa
pop edx
rol dl, 1
out 0x83, eax
retf
cdq
xor edi, eax
and cl, byte [ecx - 0x39]
mov dl, 0x64
invalid

Function at 0x43c64c
Capabilities:
Encode data using xor

Disassembly:
xchg edi, eax
sbb ch, cl
test al, 0x57
mov esp, 0xf7bd139c
dec esp
rol dword [edi + 0x1f], 1
cmp eax, 0xf1f72def
jle 0x43c6d4
xlatb
mov bh, 0xd9
xlatb
mov dh, 0xef
and al, 0xe6
invalid
xchg esp, eax
arpl word [eax + 0x5eb1339f], si
jne 0x43c705
daa
hlt
push edi
dec ebp
jl 0x43c6ab
cmp byte [ebp - 0x664c514f], dh
adc dh, byte [esi - 0x76]
mov ah, 0xc
add al, 0xfd
inc esi
mov cl, bh
fmulp st(3)
mov eax, 0x1213082d
aam 0x83
sub al, 3
sub dword [0xa662cc44], ebx
push ebx
jg 0x43c6f6
int3
dec esp
scasb al, byte es:[edi]
leave
mov dword [0xd8903f01], eax
iretd
xor al, 0x58
cmp ecx, esp
pop esp
mov ch, byte [ecx + 0x324df33b]
sti
mov ebp, 0x989d0f23
cmc
cmc
jp 0x43c772
sal edx, 1
jmp 0x43c6d5
mov ds, word [eax - 0x743427ab]
or dword gs:[eax - 0x2c23b842], ebp
pop ebx
out 0xd9, eax
test byte [edx - 0x1f], ch
cmp cl, byte [esi]
call 0xf5031f8f
adc eax, 0xe1deaced
pop es
xchg byte [eax + 0x5f9d4c5d], ah
mov cl, 0x7b
xchg ebp, eax
mov cl, 0x59
mov edx, edx
mov dl, 0xdf
mov eax, dword [0xd3236b9c]
xor ah, byte [esi]
inc edx
out 0xf3, al
inc esp
rcl byte [edi - 0x4753f3ce]
mov al, 0x56
mov cs, edx
rcr byte [ecx - 0x536bd0c0], 0xa2
jnp 0x43c7a1
inc eax
jo 0x43c7e6
jmp 0x4e36583e
in eax, dx
xchg dword [ebp + 0x43], ebp
mov al, 9
imul ecx, dword [edx - 0x39], 0x61
sbb dword [esi + 0x25], esi
les ebp, [edi + 0x155594eb]
inc edi
jecxz 0x43c856
add edx, dword [eax + 0x1f]
out dx, al
inc edx
adc eax, 0xb7625d22
xor byte [0xfd1c1d6], cl
das
invalid
mov dword [0xcb30cfae], eax
ror cl, 1
and dword [esi + 0x69962755], ebx
push ebp
call [eax]
insb byte es:[edi], dx
xor dword [ebp + eax*8 + 0x2e], ecx
push es
push ecx
movsd dword es:[edi], dword [esi]
sbb eax, 0x501ee7d
dec ebx
aam 0xe
cli
stosb byte es:[edi], al
dec ebp
sar byte [edx + esi*8 + 0x76], 0xb0
imul byte [edx + 0x5e]
push 0x5e
cmc
outsb dx, byte [esi]
jne 0x43c8aa
dec ecx
dec ecx
je 0x43c8d4
sahf
pop eax
out 0x94, al
cli
push esp
dec ebp
mov bl, 0x74
xchg esp, eax
int 0x8c
inc ecx
cmp dword [esi + 0x36], edi
jnp 0x43c8be
dec eax
mov ecx, 0xbbcebe58
adc ch, ah
invalid
xor esp, dword gs:[edx + 0x53a9368f]
adc dword [ebp + 0x58], edi
arpl si, ax
loope 0x43c87f
Function at 0x43e8c7
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0x9681121b]
pop edi
adc ebx, dword [edi]
pop ds
pop ds
cmp dh, byte [eax + 0x22]
cwde
mov esi, esi
in eax, dx
fcompi st(0)
popfd
push ebx
arpl word [edi + 0xf], cx
xor dl, cl
mov ecx, 0xaaffa2a5
aaa
xchg edi, eax
mov ah, 0xd
push edi
sub al, 0x4d
xor al, 0xec
jb 0x43e8c0
imul esp, dword [ebx + 0x35], 0x2b
popal
or dword [eax + 0x4adefeaa], 0xa97a1c59
xchg esp, eax
sbb eax, 0x7f6fafc1
enter 0xffffffffffff891c, 0xffffffffffffffb8
or eax, 0x5eebb998
int 0x54
mov ah, 0xd1
int 1
push 0x261a950
add bl, cl
test eax, 0xd9020261
push ebp
or byte [edi], dl
into
imul ebx, dword [ebx + 0x4afe60d9], 0x11b46973
fst dword [ecx - 0x5041904b]
js fcn.0043e8c7
fdivr qword [edi - 0x5d144d1f]
test dword [ebx + 0x203cd8eb], 0xe13dfe10
mov ch, 0xe0
sbb eax, ebp
add cl, byte [ebx]
pop ebx
xchg ebx, eax
lodsb al, byte [esi]
inc eax
push es
mov esi, 0x36b66af8
push es
arpl sp, dx
aas
sbb eax, 0xcf32f824
jno 0x43e95e
retf 0xfe98
cmp esp, dword [eax + 0x6dc139e8]
out 0x29, eax
in al, dx
sbb ecx, dword [edx]
pop esp
ror dword [esi - 0x15eee3f7], 0x91
loope 0x43e987
inc edx
pop eax
mov cl, 0xbd
nop
sub eax, 0xcaab3236
in eax, 0xf
salc
out 0xb4, al
xchg byte [esi], ah
mov edx, 0x857bb7fc
jnp 0x43e90e
jp 0x43e954
mov eax, 0xe7b90d90
outsb dx, byte [esi]
xchg edx, eax
xor eax, 0xa1b594d4
rol bl, cl
pushal
mov bh, 0x8e
and eax, edx
fnstsw word [ebp + 0x37]
std
int 0x8f
pop es
loopne 0x43ea23
lcall 0x87fc, 0xc8a74c2f
jo 0x43e980
invalid
mov eax, 0x1c772ca1
sbb esi, eax
nop
cdq
sahf
or al, 0x7d
pop ss
in al, dx
push ebp
sbb dword [esi - 0x22], eax
mov dword [ecx + edx*4], esp
dec eax
push ds
mov dword [0x6e1d344f], eax
adc eax, 0x272542f4
and ebp, dword [eax + 0x13]
xor dl, dh
rcl dword [edx + 0x5f5d65ad]
sbb al, 0x23
invalid

Function at 0x4446f0
Capabilities:
Encode data using xor

Disassembly:
push esi
insb byte es:[edi], dx
test cl, al
ja 0x444719
mov byte [0x35bf97cd], al
mov word [ebp - 0x5d], fs
scasd eax, dword es:[edi]
imul eax, esp, 0x59
pushal
cmp eax, 0x18bcfe04
insd dword es:[edi], dx
push esp
pop eax
pop esi
and eax, 0xc4408a4a
stosb byte es:[edi], al
iretd
jns 0x444711
dec eax
push es
ror byte [ebp - 0x25], cl
fisttp dword [edx]
mov ecx, 0x9506b5ca
jecxz 0x444761
les ebx, [ecx]
pushfd
and eax, 0xf52132a0
adc eax, 0x70ae0945
ljmp 0x6d2
mov bh, 0x77
fiadd dword [ebp + 0x5444d2ce]
add ecx, dword [edx - 0x441be845]
pushfd
push edx
invalid
Function at 0x4452e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x557a93
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x55176e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445331
cmp edi, dword [esi + 0x7c]
jge 0x445331
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00459bd5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00459bd5
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557a93
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557a93
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445283
jmp 0x445253
call fcn.0045ddfc
int3

Function at 0x45b261
Capabilities:
Encode data using xor

Disassembly:
mov bl, 0x98
iretd
imul edi, edi, 0xbdddbc0c
or edi, dword [eax + 0x76]
or eax, 0x1a32850b
xchg edx, eax
sar esp, 0xc
jb 0x45b1e2
dec esi
mov ss, word [eax + esi - 0xf]
cdq
lodsd eax, dword [esi]
rcr byte [ebx + 8], cl
movsd dword es:[edi], dword [esi]
mov dl, 0x7b
jnp 0x45b241
pop es
jnp 0x45b241
pop es
invalid

Function at 0x4726aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ebx, [ebx]
jl 0x472731
cmp byte [ebx + 0x148d7c46], cl
add byte [ebx], 0xd2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x584ef3
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x57ebce
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x472791
cmp edi, dword [esi + 0x7c]
jge 0x472791
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00487035
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00487035
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584ef3
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584ef3
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4726e3
jmp 0x4726b3
call fcn.0048b25c
int3
Function at 0x47ed63
Capabilities:
Encode data using xor

Disassembly:
adc byte [eax - 0x2e7d6e5d], 0xe5
xlatb
add al, 0x14
adc eax, 0xdae9ea06
mov byte [ebx - 0x21756755], bl
in eax, dx
fimul word [edi + ebx]
sub al, 0x1c
paddusb mm5, mm7
fld qword [ecx - 0x7c6f5f6d]
shl edx, 1
rol dword [edx], 1
adc dword [edx + 0x69], edx
and dword [eax - 0x1fcc5fad], 0xa033e013
push ebx
mov al, byte [0x619261b2]
mov dl, 0xa1
push edx
cmpsb byte [esi], byte es:[edi]
xor eax, 0x35e615e6
cmpsb byte [esi], byte es:[edi]
push ebp
cmpsd dword [esi], dword es:[edi]
mov ah, 0x67
xchg esp, eax
mov ah, 0xa7
push esp
movsb byte es:[edi], byte [esi]
aaa
in al, 0x17
in al, 0x37
movsb byte es:[edi], byte [esi]
push edi
movsd dword es:[edi], dword [esi]
mov dh, 0x1e
xchg esi, eax
salc
mov dh, 0x2e
push esi
stosb byte es:[edi], al
add edx, esp
lodsd eax, dword [esi]
loop 0x47ed71
jmp 0xabe37650
mov byte [0x5261a2a5], al
xchg ecx, eax
pop esi
mov al, 0xba
push eax
salc
xor byte [edx - 0x5c621cdf], dh
fldenv [ebx + 0x52516355]
arpl word [ecx + 0x52], dx
mov bl, 0xc6
push ebx
loop 0x47ee17
or dl, byte [ebx]
or byte es:[edx - 0x7bfb39b4], 0x26
cmp byte [edx + ebx*4 + 0x71], bl
xchg dword [eax], ecx
out dx, eax
sub byte [eax + 8], bh
or ch, byte [eax - 2]
in eax, 0x91
mov byte [0x80fd6aee], al
ret 0x3423
sub ch, byte [esi + 0x21]
mov dh, 0xc2
movsd dword es:[edi], dword ss:[esi]
out 0x85, al
xchg esi, eax
and dl, byte [edi - 0x2fde09bf]
cmp dl, byte [ecx - 0x6e1faf73]
popfd
jns 0x47ee41
xchg ecx, eax
pop ebp
pop edi
add dword [edi + ebp*8], edx
fsub dword [edx]
pop esp
std
xchg ecx, eax
insb byte es:[edi], dx
mov eax, dword [0x8d1402b4]
xchg esi, eax
int1
shl dword [edi], 1
xchg edx, eax
lea edx, [esi - 0x6dd82e0f]
pop ss
xchg edi, eax
jg 0x47eddc
lahf
push edx
mov byte [0xcb12e162], al
hlt

Function at 0x4a05dd
Capabilities:
Encode data using xor

Disassembly:
sahf
jbe 0x4a0623
add byte [eax], dl
mov esp, 0xc88b88a1
mov ecx, eax
nop
jnp 0x4a05e5
mov byte es:[ecx + 0x430ce8f], bl
outsb dx, byte [esi]
outsb dx, byte [esi]
sbb ecx, ecx
div byte [esi + 0xf]
clc
invalid
pop edx
adc al, 0x7e
sub esi, 0x575599b4
cmc
test eax, 0x23574130
mov al, byte [0x95d8f6dc]
xor byte [ecx + 0x57], al
and esp, dword [eax - 0x6a270924]
push es
jp 0x4a0624
jg 0x4a064f
pop eax
fsubr st(6)
cmp byte [ecx - 0x72], bl
mov edi, 0x28102389
out dx, al
outsd dx, dword [esi]
test al, 0xe3
aaa
sub byte [eax + 0x424657d1], dh
jne 0x4a06a5
ja 0x4a0619
aaa
js 0x4a062d
invalid
xchg edi, eax
sub bh, byte [eax + 0x7f87e503]
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
xor bh, ah
mov ebx, dword [esi + eax*2]
sbb al, 0x46
Function at 0x4b799e
Capabilities:
Terminate process

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x4c4d40], edi
mov byte [0x4c4d3c], bl
jne 0x4b79ed
mov eax, dword [0x4c53d0]
test eax, eax
je 0x4b79dc
mov ecx, dword [0x4c53cc]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b79db
mov eax, dword [esi]
test eax, eax
je 0x4b79d0
call eax
sub esi, 4
cmp esi, dword [0x4c53d0]
jae 0x4b79c8
pop esi
push 0x4c0018
push 0x4c0014
call fcn.004b7a2e
pop ecx
pop ecx
push 0x4c0020
push 0x4c001c
call fcn.004b7a2e
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b7a0a
call fcn.004b7a25
pop edi
ret
push dword [esp + 8]
mov dword [0x4c4d44], edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4b84e5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0370
cmp edx, dword [eax]
je 0x4b8507
add eax, 8
inc ecx
cmp eax, 0x4c0400
jl 0x4b84f8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0370]
jne 0x4b8635
mov eax, dword [0x4c4d00]
cmp eax, 1
je 0x4b860f
test eax, eax
jne 0x4b8538
cmp dword [0x4c029c], 1
je 0x4b860f
cmp edx, 0xfc
je 0x4b8635
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b856f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004b8ed0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b9360
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b85b2
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b9360
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd974
push edi
call fcn.004bb230
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004b8ed0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8ee0
lea eax, [ebp - 0xa0]
push 0x4bd954
push eax
call fcn.004b8ee0
push dword [esi + 0x4c0374]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8ee0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bb1a4
add esp, 0x2c
pop edi
jmp 0x4b8635
lea eax, [ebp + 8]
lea esi, [esi + 0x4c0374]
push 0
push eax
push dword [esi]
call fcn.004b9360
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret