joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401834
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x514104
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4018fc
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x514104
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50dddf
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4019a2
cmp edi, dword [esi + 0x7c]
jge 0x4019a2
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00416246
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00416246
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x514104
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x514104
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4018f4
jmp 0x4018c4
call fcn.0041a46d
int3

Function at 0x42618d
Capabilities:
Encode data using xor

Disassembly:
salc
mov dword [ebp - 0x71], 0xb342a40b
push esp
sub ebp, edi
out dx, eax
mov ebx, 0xcf9b3f26
std
insd dword es:[edi], dx
inc ebp
jno 0x4261c9
jmp 0x42620a
push es
dec eax
invalid
lodsd eax, dword [esi]
invalid

Function at 0x42ce92
Capabilities:
Encode data using xor

Disassembly:
inc edx
cmpsb byte [esi], byte es:[edi]
mov eax, 0xaa92e15
dec ebp
sbb eax, 0x6b466835
sub dword [ebp - 0x31b4c4bb], ebx
xor eax, 0x296b4668
popfd
inc ebp
cmp ecx, dword [ebx - 0x32]
test eax, 0x31b5c340
pop ecx
sbb ebp, ebx
jbe 0x42ce9c
xchg ecx, eax
sbb ebx, ecx
stosd dword es:[edi], eax
push cs
invalid
Function at 0x445994
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558264
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445a5c

Function at 0x445ab5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558264
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x551f3f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445b02
cmp edi, dword [esi + 0x7c]
jge 0x445b02
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0045a3a6
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0045a3a6
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558264
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558264
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445a54
jmp 0x445a24
call fcn.0045e5cd
int3
Function at 0x45c1f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x56eac4
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c2bc

Function at 0x45c349
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56eac4
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x56879f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45c362
cmp edi, dword [esi + 0x7c]
jge 0x45c362
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00470c06
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00470c06
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56eac4
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56eac4
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c2b4
jmp 0x45c284
call fcn.00474e2d
int3

Function at 0x4640c2
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [0xbcb2b8ec]
add edx, esi
lcall 0x92a7, 0xc6bd6d38
inc edi
mov dh, 0x76
adc byte [ebp - 0x7d], bl
add dl, byte [edi]
xor byte ss:[ecx + 0x5a], ah
mov al, byte [0xca909311]
nop
or bl, 0x81
mov ch, 0x46
rcl byte [ebx]
lds edx, [edx - 0x10]
cmp edx, ebx
rol byte [edi + 0x765b2552], cl
add byte [ebx], 0x61
mov dword [0x42243344], eax
mov bh, 2
add esi, dword [edi - 0x62]
les eax, gs:[edi + 0x224dc78a]
invalid
Function at 0x46449a
Capabilities:
Encode data using xor

Disassembly:
sub eax, 0xba7d7cf5
cmp bl, byte [edx - 0x6fb252b7]
cmp eax, 0xf5edf570
invalid
jne 0x46440b
stosb byte es:[edi], al
cmpsd dword [esi], dword es:[edi]
pop ss
daa
push ebx
and al, 0x73
push esp
leave
mov dword [0x6ffc688c], eax
cwde
cmp dword [edx], edi
sbb al, 0
xchg ecx, eax
mov cx, 0xe11e
add byte [ecx - 0x1ee1469a], dl
mov dl, 0xeb
mov esi, 0xd614ba1c
bound ebp, qword [ebx + 0x6a]
xor dword [eax], esp
jae 0x4644fb
sar cl, cl
inc esi
pushal
xchg ebx, eax
mov bh, 0x25
dec edx
xchg edx, eax
jl 0x464514
cld
mov edx, 0x9d15b7fa
mov bh, 0x15
popfd
push ecx
mov edx, 0xe29ac2c0
cmpsd dword [esi], dword es:[edi]
jb 0x46446f
imul edx, ecx, 0x237ab362
loopne 0x4644ef
in eax, 0xb9
push 0x5693a3fc
xchg dword [ebp - 0xe], esp
mov esi, 0x1ace53a5
push ecx
jae 0x464483
cmp dh, byte [ebx + edx*4 - 0x1d23acc2]
test esp, 0xb25873a3
insd dword es:[edi], dx
mov edi, fs
sbb ch, byte [eax - 0x4f]
fist dword [ebx - 0x2f338d10]
jmp 0x7179b96e
jno 0x464522
jl 0x4644a7
or al, 0xb4
jl 0x46449e
out dx, al
fsubr dword [ebx + 0x5b2422b5]
stosd dword es:[edi], eax
mov ch, 0x22
and al, 0x5b
scasd eax, dword es:[edi]
fsub dword [ebp - 0x54fc53ce]
sbb dword [ebp + 0x30a49284], esp
test al, 0xae
push eax
push eax
push esi
xor dword [ecx - 4], esp
mov byte [edi + 0xc], cl
les edx, [ebx]
in eax, 0x92
pop edx
push ebp
jnp 0x464511
cmp dh, byte [ebx - 0x1f0aaf7c]
das
scasd eax, dword es:[edi]
ljmp 0x9215

Function at 0x467710
Capabilities:
Encode data using xor

Disassembly:
ror byte [esi + 0x4bd43f35], cl
sub byte [ebx], ch
daa
sub ch, byte [eax - 0x69]
or dword [edi + 0x75], ebx
invalid
Function at 0x47a922
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x34b8d583
mov ebx, 0xded6f30
and al, 0x16
jg 0x47a86a
dec ebp
xchg esp, eax
dec edi
in eax, 0x57
push edi
xlatb
mov edi, 0xbea0fec5
movsb byte es:[edi], byte [esi]
cmp eax, 0x3c1d46be
adc dword [esi + edx*8 - 0x78559b78], edi
mov byte [edx + ebp*4 - 0x79], ah
test al, 0x55
inc edi
in al, 0x75
and ebp, dword [eax + 0x7935cc16]
lcall 0x444, 0xfad33057
jl 0x47a857
mov edi, 0x3d251224
test byte [ebp - 0x25], dh
das
insb byte es:[edi], dx
cmp byte [edi], 0xd4
cmp eax, 0x7b972b25
push eax
add al, 0x5e
movsd dword es:[edi], dword [esi]
add al, byte [eax - 0x63]
js 0x47a89a
jnp 0x47a8f5
invalid
mov ch, 0x54
sbb edi, ecx
fbstp tbyte [ecx + 0x3d]
push eax
dec ebx
push esp
pop ds
sub eax, 0x441fb1dd
mov dh, 0x69
sbb ebx, edi
sti
jge 0x47a87a
lodsb al, byte [esi]
add byte [eax], al
or al, 0xbc
sub bl, 0x35
lodsd eax, dword [esi]
cmp ch, ch
push cs
invalid
pop ebp
cmp ch, 0xcf
outsd dx, dword [esi]
iretd
sbb dword [ebx + 0x70], ecx
insd dword es:[edi], dx
jl 0x47a8b5
leave
dec ecx
pop ebp
je 0x47a8c9
ja 0x47a9aa
lahf
cmp al, 0xe3
pop bx
or dword [edi], 0xc19b5cb
inc edi
daa
in eax, dx
inc ebp
sbb dword [edi - 0x62], edx
invalid
movsb byte es:[edi], byte [esi]
xor dword [ebx], ecx
insd dword es:[edi], dx
dec esp
fldcw word [ecx + 0x4f4d01a7]
test eax, 0x4f4d01a7
adc ebx, esi
or edi, dword [ebx - 0x27226ef0]
scasb al, byte es:[edi]
inc ebx
inc esp
wait
mov ebp, 0x8a6c8f5e
sar byte [ebx + 0x7e85b7a1], 9
mov dh, 0xed
sal dword [esi - 0x31dca177], 1
push es
sbb ah, dh
xlatb
arpl sp, cx
inc esi
xor dword [ecx], esi
push esi
pop edx
je 0x47a9b0
inc edx
cmova edi, dword [edi - 0x6c]
pop ebx
hlt
Function at 0x48a164
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059ca34
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a22c
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059ca34
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x59670f
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a2d2
cmp edi, dword [esi + 0x7c]
jge 0x48a2d2
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049eb76
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049eb76
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca34
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca34
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a224
jmp 0x48a1f4
call fcn.004a2d9d
int3

Function at 0x497e5c
Capabilities:
Encode data using xor

Disassembly:
aad 0xfa
mov byte [0x8c45bd3a], al
popfd
mov ebp, 0x7b08f88
and edx, esp
inc esp
Function at 0x4a0e44
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b3714
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a0f0c
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b3714
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ad3ef
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a0fb2
cmp edi, dword [esi + 0x7c]
jge 0x4a0fb2
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.004b5856
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.004b5856
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3714
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3714
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a0f04
jmp 0x4a0ed4
call fcn.004b9a7d
int3

Function at 0x4b7306
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
mov ecx, eax
and ecx, 0xff
mov dword [0x4c4cfc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c4cf8], ecx
shr eax, 0x10
mov dword [0x4c4cf4], eax
push 1
call fcn.004b83e7
pop ecx
test eax, eax
jne 0x4b733b
push 0x1c
call fcn.004b73fd
pop ecx
call fcn.004b81a4
test eax, eax
jne fcn.004b734c
push 0x10
call fcn.004b73fd
pop ecx
Function at 0x4b791b
Capabilities:
Terminate process

Disassembly:
dec ebp
dec esp
add byte [ebp + 0x11], dh
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0xc], 0
push ebx
mov ebx, dword [esp + 0x14]
mov dword [0x4c4d2c], edi
mov byte [0x4c4d28], bl
jne 0x4b7985
mov eax, dword [0x4c53b0]
test eax, eax
je 0x4b7974
mov ecx, dword [0x4c53ac]
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b7973
mov eax, dword [esi]
test eax, eax
je 0x4b7968
call eax
sub esi, 4
cmp esi, dword [0x4c53b0]
jae 0x4b7960
pop esi
push 0x4c0018
push 0x4c0014
call fcn.004b79c6
pop ecx
pop ecx
push 0x4c0020
push 0x4c001c
call fcn.004b79c6
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b79a2
call fcn.004b79bd
pop edi
ret
push dword [esp + 8]
mov dword [0x4c4d30], edi
invalid
invalid

Function at 0x4b847d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c0368
cmp edx, dword [eax]
je 0x4b849f
add eax, 8
inc ecx
cmp eax, 0x4c03f8
jl 0x4b8490
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c0368]
jne 0x4b85cd
mov eax, dword [0x4c4cec]
cmp eax, 1
je 0x4b85a7
test eax, eax
jne 0x4b84d0
cmp dword [0x4c0294], 1
je 0x4b85a7
cmp edx, 0xfc
je 0x4b85cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b8507
lea eax, [ebp - 0x1a4]
push 0x4bd8d8
push eax
call fcn.004b8e60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004b92f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b854a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004b92f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bd8d4
push edi
call fcn.004bb1c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bd8b8
push eax
call fcn.004b8e60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b8e70
lea eax, [ebp - 0xa0]
push 0x4bd8b4
push eax
call fcn.004b8e70
push dword [esi + 0x4c036c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b8e70
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bd88c
push eax
call fcn.004bb134
add esp, 0x2c
pop edi
jmp 0x4b85cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c036c]
push 0
push eax
push dword [esi]
call fcn.004b92f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100443d3
Capabilities:
Encode data using xor

Disassembly:
call 0x1004434c
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1004437c
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10044398
xor edx, 0
jmp 0x100443a3
xor edx, edx
jmp 0x100443ba
jmp 0x100443c6
xor eax, eax
push 0x8427d7c0
call 0x100443d3
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1004440f
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x100443e8
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x10044426
add eax, 0
jno 0x1004442b
add esi, 0
ret 0x10

Function at 0x10045194
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x100451b6
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x10045358
cmp edi, dword [ebp + 0x10]
jb 0x10045358
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10044c80
inc edi
jmp 0x1004523f
jmp 0x1004524c
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c80
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c80
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x100452a0
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x10045284
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.100452ce
add dword [eax], 0x39
jle 0x100452aa
sub al, 0xf5
mov ch, al
call fcn.100452e3
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10