joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x48
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
lea eax, [esp + 0x24]
push edi
lea ecx, [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x3c]
push edx
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x70]
lea edx, [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x70]
push edx
push edi
push str.dummy
push edi
push edi
push eax
push ecx
mov dword [esp + 0x7c], edi
mov dword [esp + 0x80], edi
mov dword [esp + 0x84], edi
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
call fcn.004989a0
add esp, 0x38
test eax, eax
je 0x49741c
mov edx, dword [esi + 8]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x14]
push edx
push 1
push eax
push ecx
call fcn.00495fd0
mov esi, dword [esi]
add esp, 0x10
cmp esi, edi
je 0x49741c
mov edx, dword [esp + 8]
mov eax, dword [esi + 0x64]
push edx
push eax
call fcn.0041c1f0
add esp, 8
test al, al
je 0x497412
mov dword [esi + 0x94], 1
mov esi, dword [esi + 0x90]
cmp esi, edi
jne 0x4973f3
mov eax, dword [esp + 0x20]
mov ecx, 0x4de568
push eax
call fcn.0041e9a0
mov ecx, dword [esp + 8]
push ecx
mov ecx, 0x4de568
call fcn.0041e9a0
mov edx, dword [esp + 0x14]
mov ecx, 0x4de568
push edx
call fcn.0041e9a0
mov eax, dword [esp + 0x2c]
mov ecx, 0x4de568
push eax
call fcn.0041e9a0
mov ecx, dword [esp + 0x38]
push ecx
mov ecx, 0x4de568
call fcn.0041e9a0
mov edx, dword [esp + 0x44]
mov ecx, 0x4de568
push edx
call fcn.0041e9a0
pop edi
pop esi
add esp, 0x48
ret 8
Function at 0x498750
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
xor ebx, ebx
xor edx, edx
xor esi, esi
mov al, byte [edi]
mov dword [esp + 0x10], edx
cmp al, bl
mov dword [esp + 0x14], esi
je 0x4987b3
mov byte [esp + 0x1c], al
xor eax, eax
mov ecx, dword [esp + 0x1c]
and ecx, 0xff
mov al, byte [ecx + 0x4c6370]
xor eax, ecx
mov ecx, edx
shr ecx, 0x1b
shl edx, 5
or ecx, edx
add ecx, eax
mov edx, ecx
mov ecx, esi
shr ecx, 0x1a
shl esi, 6
or ecx, esi
add ecx, eax
mov al, byte [edi + 1]
inc edi
cmp al, bl
mov esi, ecx
jne 0x49876f
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov edi, dword [esp + 0x20]
mov ecx, 0x4de568
mov edx, dword [edi]
push edx
call fcn.0041e9a0
push 0x4dd570
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
call fcn.0041bfa0
lea ebp, [esp + 0x10]
mov dword [esp + 0x1c], 2
mov esi, dword [ebp]
mov ebx, 8
mov eax, esi
shr eax, 0x1c
push eax
call fcn.0041b9e0
add esp, 4
mov ecx, edi
push eax
call fcn.0041bb60
shl esi, 4
dec ebx
jne 0x4987ec
mov eax, dword [esp + 0x1c]
add ebp, 4
dec eax
mov dword [esp + 0x1c], eax
jne 0x4987e4
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4a6dd0
Capabilities:
Enumerate devices by category

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esp + 0x20]
push eax
call fcn.0041c330
mov ebx, eax
mov eax, dword [esi + 0x2c]
xor ebp, ebp
add esp, 4
cmp eax, ebp
mov dword [esp + 0x18], ebx
jne 0x4a6e6c
mov eax, dword [esi + 0x18]
lea edi, [esi + 0x18]
cmp eax, ebp
je 0x4a6e0e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi], ebp
push ebp
call dword [sym.imp.ole32.dll_CoInitialize]
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
push 0x4c9a00
push 1
push ebp
push 0x4c94d8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x4a6e50
mov eax, dword [esp + 0x20]
push ebp
push edi
push 0x4c94c8
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [esp + 0x20]
push eax
mov edx, dword [eax]
call dword [edx + 8]
push ebp
push str.999999
call fcn.0041c330
add esp, 4
mov ecx, esi
push eax
call fcn.004a6d60
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ebp
mov edi, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
cmp edi, eax
jge 0x4a6f82
mov ecx, dword [esi + 0x2c]
dec ecx
cmp ebx, ecx
jle 0x4a6f82
cmp edi, eax
mov dword [esp + 0x14], edi
jge 0x4a6f82
mov ecx, dword [esi + 0x20]
lea edx, [esp + 0x10]
inc ecx
push edx
mov dword [esi + 0x20], ecx
push edi
mov ecx, esi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebp
call fcn.004a6d60
cmp eax, edi
jne 0x4a6ec8
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push 0x4c99a0
mov ecx, dword [eax]
push ebp
push ebp
push eax
call dword [ecx + 0x20]
cmp dword [esp + 0x20], ebp
je 0x4a6f5f
mov eax, dword [esi + 0x28]
lea edi, [esi + 0x28]
cmp eax, ebp
je 0x4a6ee4
mov edi, eax
mov eax, dword [edi]
cmp eax, ebp
jne 0x4a6edc
mov eax, dword [esi + 0x2c]
push 0xa
push eax
call fcn.0045a420
push 0xa8
mov ebx, eax
call fcn.0041ed90
add esp, 0xc
cmp eax, ebp
je 0x4a6f0c
push ebx
mov ecx, eax
call fcn.0048b910
mov ebp, eax
push ebx
mov ecx, 0x4de568
call fcn.0041e9a0
push 0x3c
call fcn.0041ed90
add esp, 4
test eax, eax
je 0x4a6f38
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x24]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.004a6310
jmp 0x4a6f3a
xor eax, eax
push eax
mov ecx, ebp
mov dword [edi], eax
call fcn.0048ba00
mov edi, dword [esi + 0x2c]
mov eax, dword [esp + 0x20]
inc edi
push eax
mov dword [esi + 0x2c], edi
mov ecx, dword [eax]
call dword [ecx + 8]
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x4a6f6d
mov edx, dword [eax]
push eax
call dword [edx + 8]
cmp ebx, dword [esi + 0x2c]
jl 0x4a6f82
mov eax, dword [esi + 0x1c]
inc edi
cmp edi, eax
mov dword [esp + 0x14], edi
jl 0x4a6e92
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 4
Function at 0x4a74f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x74
push ebp
push esi
lea eax, [esp + 8]
push edi
xor ebp, ebp
push eax
push 1
push ebp
push str.SoftwareMicrosoftMultimediaSound_Mapper
push 0x80000001
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a7660
mov edi, dword [esp + 0x84]
mov eax, str.Record
test edi, edi
jne 0x4a7545
mov eax, str.Playback
mov edx, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a7660
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.0041ed90
add esp, 4
mov ebp, eax
test edi, edi
mov eax, str.Record
jne 0x4a7584
mov eax, str.Playback
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0
push 0
push eax
push edx
call esi
test eax, eax
jne 0x4a7660
test edi, edi
je 0x4a75aa
call dword [sym.imp.WINMM.dll_waveInGetNumDevs]
jmp 0x4a75b0
call dword [sym.imp.WINMM.dll_waveOutGetNumDevs]
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
jle 0x4a7660
mov eax, dword [esp + 0x84]
test eax, eax
je 0x4a760c
lea eax, [esp + 0x1c]
push 0x30
push eax
push edi
call dword [sym.imp.WINMM.dll_waveInGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x24]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a7601
test cl, cl
je 0x4a75fd
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a7601
add eax, 2
add esi, 2
test cl, cl
jne 0x4a75dd
xor eax, eax
jmp 0x4a7606
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a765c
jmp 0x4a764d
lea eax, [esp + 0x4c]
push 0x34
push eax
push edi
call dword [sym.imp.WINMM.dll_waveOutGetDevCapsA]
mov esi, ebp
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4a7644
test cl, cl
je 0x4a7640
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4a7644
add eax, 2
add esi, 2
test cl, cl
jne 0x4a7620
xor eax, eax
jmp 0x4a7649
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4a765c
mov eax, dword [esp + 0x18]
inc edi
cmp edi, eax
jl 0x4a75be
jmp 0x4a7660
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4a766f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4a767c
push ebp
call fcn.0041eda0
add esp, 4
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x74
ret
Function at 0x4a7980
Capabilities:
Capture microphone audio

Disassembly:
push ecx
push ebp
mov ebp, ecx
push esi
mov ecx, dword [ebp + 4]
add ecx, 0x24
call fcn.004a7e80
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
mov byte [eax], 0
inc esi
mov dword [esp + 8], esi
je 0x4a7a96
mov cl, byte [ebp + 0x2aa]
test cl, cl
jne 0x4a7a6b
mov ecx, dword [ebp + 0x28c]
test ecx, ecx
jle 0x4a7a6b
mov byte [eax], 1
push ebx
mov ebx, dword [ebp + 0x24c]
lea eax, [ebp + 0x290]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp + 0x48]
mov esi, dword [ebp + ebx*4 + 8]
mov edi, dword [esp + 0x18]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x28c]
xor ecx, ecx
dec esi
mov eax, esi
mov dword [ebp + 0x28c], esi
test eax, eax
jle 0x4a7a23
lea eax, [ebp + 0x24c]
mov edx, dword [eax + 4]
inc ecx
mov dword [eax], edx
mov edx, dword [ebp + 0x28c]
add eax, 4
cmp ecx, edx
jl 0x4a7a10
lea eax, [ebp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp]
push 0x20
shl ebx, 5
lea eax, [ebx + ebp + 0x4c]
push eax
push ecx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov al, byte [ebp + 0x2a8]
pop edi
test al, al
pop ebx
je 0x4a7a61
mov edx, dword [ebp]
push edx
call dword [sym.imp.WINMM.dll_waveInStart]
mov byte [ebp + 0x2a8], 0
mov eax, dword [esp + 8]
pop esi
pop ebp
pop ecx
ret 8
mov al, byte [ebp + 0x2a9]
test al, al
je 0x4a7a8e
mov eax, dword [ebp]
push eax
call dword [sym.imp.WINMM.dll_waveInStart]
mov eax, esi
mov byte [ebp + 0x2a9], 0
pop esi
pop ebp
pop ecx
ret 8
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
pop esi
pop ebp
pop ecx
ret 8
Function at 0x4a7b30
Capabilities:
Capture microphone audio

Disassembly:
sub esp, 0x18
lea eax, [esp + 4]
push ebx
push ebp
mov ebp, ecx
push esi
push edi
push eax
mov ecx, dword [ebp + 4]
add ecx, 0x9c
push ecx
call fcn.004a7470
mov edx, dword [esp + 0x34]
lea edi, [ebp + 8]
add esp, 8
mov dword [ebp + 0x28c], 0
mov byte [ebp + 0x2a8], 0
mov dword [ebp + 0x48], edx
mov esi, edi
mov ebx, 0x10
mov eax, dword [esp + 0x2c]
push eax
call fcn.0041ed90
mov dword [esi], eax
add esp, 4
add esi, 4
dec ebx
jne 0x4a7b72
mov edx, dword [ebp + 4]
push 0x30000
push ebp
lea ecx, [esp + 0x1c]
mov eax, dword [edx + 0x50]
push 0x4a7aa0
push ecx
push eax
push ebp
call dword [sym.imp.WINMM.dll_waveInOpen]
test eax, eax
jne 0x4a7c0b
xor ebx, ebx
lea esi, [ebp + 0x4c]
mov dword [esp + 0x10], edi
mov ecx, 8
xor eax, eax
mov edi, esi
push 0x20
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
push esi
mov edx, dword [ecx]
mov dword [esi], edx
mov dword [esi + 4], eax
mov dword [esi + 0xc], ebx
mov ecx, dword [ebp]
push ecx
call dword [sym.imp.WINMM.dll_waveInPrepareHeader]
mov edx, dword [ebp]
push 0x20
push esi
push edx
call dword [sym.imp.WINMM.dll_waveInAddBuffer]
mov edi, dword [esp + 0x10]
inc ebx
add edi, 4
add esi, 0x20
cmp ebx, 0x10
mov dword [esp + 0x10], edi
jl 0x4a7bb2
mov byte [ebp + 0x2a9], 1
mov byte [ebp + 0x2aa], 0
xor ecx, ecx
pop edi
test eax, eax
sete cl
pop esi
pop ebp
mov eax, ecx
pop ebx
add esp, 0x18
ret 4

Function at 0x4a7d60
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push edi
mov dword [esi + 0x1c], 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edi, edi
test ebx, ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ecx
je 0x4a7d9a
mov dword [esi + 0x28], ebx
jmp 0x4a7db2
lea edx, [esi + 0x28]
push edx
push 0
push esi
push 0x4a7ea0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
mov eax, dword [esp + 0x18]
dec eax
je 0x4a7dc0
dec eax
jne 0x4a7dc9
push 1
jmp 0x4a7dc2
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
test ebx, ebx
jne 0x4a7dd8
test edi, edi
je 0x4a7dd8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x4a7de0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea esi, [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
mov dword [edi], 1
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x4a7e37
push esi
call ebx
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
call ebp
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub eax, edx
cmp eax, ecx
jae 0x4a7e49
jmp 0x4a7e0c
push esi
mov edi, 1
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4
Function at 0x4bae90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push eax
push esi
xor edi, edi
call dword [0x5a1760]
mov ecx, eax
add esp, 8
add ecx, 0x20
mov ebx, 8
sar ecx, 6
xor eax, eax
mov al, byte [esi + 7]
sub eax, ecx
cdq
mov ebp, eax
xor eax, eax
mov al, byte [esi + 6]
xor ebp, edx
sub eax, ecx
sub ebp, edx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 5]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 4]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 3]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 2]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi + 1]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
add ebp, eax
xor eax, eax
mov al, byte [esi]
sub eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x18]
add eax, edi
add esi, edx
dec ebx
lea edi, [eax + ebp]
jne 0x4baeb6
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4bb430
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
mov eax, 2
sub eax, edi
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, 3
sub eax, edi
mov esi, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
mov eax, 4
sub eax, edi
mov ebp, 1
mov dword [esp + 0x14], eax
mov eax, 5
sub eax, edi
sub ebp, edi
mov dword [esp + 0x18], eax
mov eax, 6
sub eax, edi
lea ecx, [ebx + edi + 1]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], 8
xor eax, eax
xor edx, edx
mov al, byte [ecx - 1]
mov dl, byte [ebx]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov byte [esi], al
mov dl, byte [ecx]
xor eax, eax
mov al, byte [ebx + 1]
add ebx, edi
lea eax, [eax + edx + 1]
cdq
sub eax, edx
xor edx, edx
sar eax, 1
mov byte [esi + 1], al
mov dl, byte [ecx + 1]
xor eax, eax
mov al, byte [ecx + ebp]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x28]
sar eax, 1
mov byte [esi + 2], al
xor eax, eax
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [ecx + 2]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
mov byte [esi + 3], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 3]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x14]
sar eax, 1
mov byte [esi + 4], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 4]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x18]
sar eax, 1
mov byte [esi + 5], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 5]
lea eax, [eax + edx + 1]
cdq
sub eax, edx
mov edx, dword [esp + 0x1c]
sar eax, 1
mov byte [esi + 6], al
xor eax, eax
mov al, byte [ecx + edx]
xor edx, edx
mov dl, byte [ecx + 6]
add ecx, edi
lea eax, [eax + edx + 1]
cdq
sub eax, edx
sar eax, 1
mov byte [esi + 7], al
mov eax, dword [esp + 0x24]
add esi, edi
dec eax
mov dword [esp + 0x24], eax
jne 0x4bb48d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4bcad0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
shl esi, 0xe
mov eax, dword [edi]
xor ebp, ebp
add eax, 4
add esi, 0x4e1614
sar eax, 3
cmp eax, 1
jge 0x4bcafb
mov eax, 1
jmp 0x4bcb07
cmp eax, 0xfe
jle 0x4bcb07
mov eax, 0xfe
mov edx, dword [esp + 0x18]
mov ebx, 0x3f
sub edi, edx
mov dword [edx], eax
lea ecx, [edx + 4]
mov eax, dword [edi + ecx]
add ecx, 4
mov eax, dword [esi + eax*4]
mov dword [ecx - 4], eax
cdq
xor eax, edx
sub eax, edx
add ebp, eax
dec ebx
jne 0x4bcb17
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret

Function at 0x4bce30
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
xor ebx, ebx
shl esi, 0xe
add esi, 0x4e1614
sub edi, ecx
mov ebp, 0x40
mov eax, dword [edi + ecx]
add ecx, 4
mov eax, dword [esi + eax*4]
mov dword [ecx - 4], eax
cdq
xor eax, edx
sub eax, edx
add ebx, eax
dec ebp
jne 0x4bce52
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret
Function at 0x4c47e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov eax, ecx
mov ebx, dword [esp + 0x10]
cdq
and edx, 7
push ebp
add eax, edx
and ecx, 7
sar eax, 3
push esi
mov esi, dword [esp + 0x10]
test eax, eax
mov ebp, ecx
jle 0x4c482b
push edi
mov edi, eax
push 8
mov ecx, esi
call fcn.004bf660
xor ecx, ecx
and eax, 0xff
mov cl, bh
xor edx, edx
xor eax, ecx
mov dh, bl
mov ebx, dword [eax*4 + 0x4cf284]
xor ebx, edx
dec edi
jne 0x4c4806
pop edi
test ebp, ebp
jle 0x4c4857
push 1
mov ecx, esi
call fcn.004bf660
mov ecx, ebx
and ebx, 0x7fff
shr ecx, 0xf
and ecx, 1
xor eax, ecx
shl ebx, 1
test eax, eax
je 0x4c4854
xor ebx, 0x8005
dec ebp
jne 0x4c482f
pop esi
mov eax, ebx
pop ebp
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4ba1cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2338
cmp edx, dword [eax]
je 0x4ba1ef
add eax, 8
inc ecx
cmp eax, 0x4c23c8
jl 0x4ba1e0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2338]
jne 0x4ba31d
mov eax, dword [0x4c6cc4]
cmp eax, 1
je 0x4ba2f7
test eax, eax
jne 0x4ba220
cmp dword [0x4c2264], 1
je 0x4ba2f7
cmp edx, 0xfc
je 0x4ba31d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba257
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004babb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb040
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba29a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb040
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf834
push edi
call fcn.004bcf10
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004babb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004babc0
lea eax, [ebp - 0xa0]
push 0x4bf814
push eax
call fcn.004babc0
push dword [esi + 0x4c233c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004babc0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bce84
add esp, 0x2c
pop edi
jmp 0x4ba31d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c233c]
push 0
push eax
push dword [esi]
call fcn.004bb040
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x71d1c50
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x660f63f9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219