joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020f0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4030b8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push str.kmftptemp
lea ecx, [esp + 0x14]
mov dword [esp + 0x28], 0
mov ebp, 1
call sub.MFC42.DLL_CString::CString_2
lea eax, [esp + 0x14]
push ebp
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 1
call sub.MFC42.DLL_CString::Right
mov eax, dword [eax]
push 0x4050a0
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete bl
call fcn.00402a5c
test bl, bl
je 0x40218c
lea ecx, [esp + 0x10]
lea edx, [esp + 0x2c]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call sub.MFC42.DLL_CString::operator_1
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x14]
jmp 0x4021db
lea ecx, [esp + 0x2c]
push 0x4050a0
lea edx, [esp + 0x1c]
push ecx
push edx
call sub.MFC42.DLL_operator
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
mov bl, 3
push eax
push edx
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_operator_1
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 4
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.00402a5c
mov byte [esp + 0x24], 1
lea ecx, [esp + 0x18]
call fcn.00402a5c
mov eax, dword [esp + 0x10]
push 0
push 2
push 2
push 0
push 0
push Ordinal_1
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x402217
cmp esi, 0xb7
jne 0x402224
mov ecx, dword [esp + 0x10]
xor ebp, ebp
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call fcn.00402a5c
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call fcn.00402a5c
mov ecx, dword [esp + 0x1c]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x402260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4030e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], 2
sub eax, 0
mov dword [esp + 0xc], 0
je 0x4022ce
dec eax
jne 0x40233f
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.MSVCRT.dll__mbscmp]
mov esi, dword [esp + 0x24]
push 0x40518c
push eax
call edi
push 0x40518c
push esi
mov ebx, eax
call edi
add esp, 0x10
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test ebx, ebx
sete cl
or eax, ecx
je 0x40233f
jmp 0x402337
mov edx, dword [esp + 0x28]
mov esi, dword [sym.imp.MSVCRT.dll__mbscmp]
mov edi, dword [esp + 0x24]
push ebp
push 0x40518c
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x38]
push 0x40518c
push eax
call esi
mov ecx, dword [esp + 0x44]
push 0x40518c
push ecx
mov ebp, eax
call esi
push 0x40518c
push edi
mov dword [esp + 0x44], eax
call esi
mov edi, dword [esp + 0x44]
add esp, 0x20
neg eax
sbb eax, eax
xor edx, edx
inc eax
test edi, edi
sete dl
or eax, edx
xor ecx, ecx
test ebp, ebp
sete cl
or eax, ecx
xor edx, edx
test ebx, ebx
sete dl
or eax, edx
pop ebp
je 0x40233f
mov dword [esp + 0xc], 1
lea ecx, [esp + 0x24]
call fcn.00402a5c
lea ecx, [esp + 0x28]
mov byte [esp + 0x18], 1
call fcn.00402a5c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x18], 0
call fcn.00402a5c
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0xffffffff
call fcn.00402a5c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4010ce
Capabilities:
Check os version

Disassembly:
push 0x1cc
call fcn.00401639
push ebx
push ecx
push esi
push edi
push ebp
sub esp, 0x198
mov edi, eax
mov ebx, edx
xor ebp, ebp
mov dword [esp + 0x190], ebp
mov dword [esp + 0x194], ebp
mov dword [esp + 0xfc], 0x94
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
mov esi, dword [esp + 0x10c]
cmp esi, 1
jne 0x4011d6
push ebp
call dword [sym.imp.KERNEL32.DLL_SetLastError]
lea eax, [esp + 0x194]
push eax
lea eax, [esp + 0x194]
push eax
push ebp
push ebp
push 2
push ebp
push esi
call dword [sym.imp.WINSPOOL.DRV_EnumPrintersA]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x7a
jne 0x40119e
mov esi, dword [esp + 0x190]
test esi, esi
je 0x40119e
push esi
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
mov ebp, eax
test eax, eax
je 0x4012a2
lea eax, [esp + 0x194]
push eax
lea eax, [esp + 0x194]
push eax
mov eax, dword [esp + 0x198]
push eax
push esi
push 2
push 0
push 1
call dword [sym.imp.WINSPOOL.DRV_EnumPrintersA]
test eax, eax
jne 0x4011a5
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
xor eax, eax
jmp 0x4012a2
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, dword [ebx]
jb 0x4011c2
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov dword [ebx], eax
jmp 0x401197
mov eax, dword [esi + 4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov edx, dword [esi + 4]
push edx
jmp 0x401289
cmp esi, 2
jne 0x401292
cmp dword [esp + 0x100], 5
jb 0x40122f
push 0x40a026
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov esi, eax
test eax, eax
je 0x4012a2
push 0x40a033
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edx, eax
test eax, eax
jne 0x401219
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x40119e
push ebx
push edi
call edx
mov ebx, eax
push esi
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
test ebx, ebx
jne 0x401292
jmp 0x40119e
push 0xfa
lea eax, [esp + 4]
push eax
push 0x40a046
push 0x40a04a
push 0x40a051
call dword [sym.imp.KERNEL32.DLL_GetProfileStringA]
test eax, eax
je 0x4012a2
mov edx, 0x40a059
mov eax, esp
call fcn.00401b30
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
cmp eax, dword [ebx]
jb 0x40127c
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov dword [ebx], eax
jmp 0x40119e
mov eax, esp
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrcpyA]
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
inc eax
mov dword [ebx], eax
test ebp, ebp
je 0x40129d
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, 1
add esp, 0x198
Function at 0x402350
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x402367
inc edx
jmp 0x40235c
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x4026b0

Function at 0x402410
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov esi, ebx
mov dword [0x40b7f4], eax
mov dword [0x40a2bc], edx
call fcn.00403cb0
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentStringsA]
mov dword [0x40a56e], eax
xor eax, eax
mov dword [0x40be20], eax
call dword [sym.imp.KERNEL32.DLL_GetVersion]
mov edx, eax
mov byte [0x40a574], al
shr eax, 0x10
push 0x104
mov word [0x40a576], ax
xor eax, eax
mov ebx, 0x208
mov ax, word [0x40a576]
and edx, 0xffff
mov dword [0x40a578], eax
xor eax, eax
sar edx, 8
mov al, byte [0x40a574]
and edx, 0xff
mov dword [0x40a57c], eax
xor eax, eax
mov byte [0x40a575], dl
mov al, dl
mov edx, dword [0x40a57c]
push 0x40b7f8
shl edx, 8
push 0
or edx, eax
mov dword [0x40a580], eax
mov dword [0x40a584], edx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40b8fc
xor eax, eax
mov dword [0x40a53c], 0x40b7f8
call fcn.00403de0
mov dword [0x40a548], 0x40b8fc
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
call fcn.00403e80
mov edx, eax
mov bl, byte [eax]
mov dword [0x40b7f0], eax
cmp bl, 0x22
je 0x402504
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403ec1], 2
je 0x40251c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403ec1], 2
je 0x402523
inc eax
jmp 0x4024f4
inc eax
cmp bl, byte [eax]
je 0x402514
cmp byte [eax], 0
je 0x402514
inc eax
cmp byte [eax], 0x22
jne 0x402509
cmp byte [eax], 0
je 0x4024f4
inc eax
jmp 0x4024f4
test dl, dl
je 0x4024f4
inc eax
jmp 0x4024e7
mov dword [0x40a538], eax
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
test eax, eax
je 0x402597
call fcn.00403fc1
mov edx, eax
mov bx, word [eax]
mov dword [0x40b7ec], eax
cmp bx, 0x22
je 0x40256a
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403ec1], 2
je 0x40258c
xor edx, edx
mov dl, byte [eax]
test byte [edx + 0x403ec1], 2
je 0x40259c
add eax, 2
jmp 0x402558
add eax, 2
cmp bx, word [eax]
je 0x402581
cmp word [eax], 0
je 0x402581
add eax, 2
cmp word [eax], 0x22
jne 0x402572
cmp word [eax], 0
je 0x402558
add eax, 2
jmp 0x402558
cmp word [eax], 0
je 0x402558
add eax, 2
jmp 0x40254b
mov eax, 0x4023d0
mov dword [0x40a544], eax
test edi, edi
jne 0x4025ae
mov eax, 1
pop edi
pop esi
pop ecx
ret
push 0x104
push 0x40bb04
push esi
mov ebx, 0x208
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov edx, 0x40bc08
mov eax, esi
mov dword [0x40a540], 0x40bb04
call fcn.00403de0
mov dword [0x40a54c], 0x40bc08
mov eax, 1
pop edi
pop esi
pop ecx
ret
Function at 0x4029d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edx
sub esp, 4
mov dword [esp], eax
mov eax, dword [0x40a5ac]
test eax, eax
je 0x4029ec
cmp dword [0x40a534], 0xfffffffe
jne 0x4029f2
xor eax, eax
add esp, 4
pop edx
pop ecx
ret
mov eax, esp
call fcn.00402980
test eax, eax
je 0x4029ec
push 0x40
push 0x1000
mov ecx, dword [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov edx, eax
test eax, eax
je 0x4029ec
mov eax, dword [esp]
sub eax, 4
cmp eax, dword [esp]
ja 0x4029ea
mov dword [esp], eax
cmp eax, 0x38
jb 0x4029ea
mov dword [edx], eax
mov eax, edx
call fcn.00402900
mov ecx, eax
mov eax, dword [eax]
mov dword [esp], eax
or al, 1
mov dword [ecx], eax
mov dword [edx + 0x14], 0
lea eax, [ecx + 4]
inc dword [edx + 0x18]
call fcn.00401a20
mov eax, 1
add esp, 4
pop edx
pop ecx
ret

Function at 0x403530
Capabilities:
Read file on windows

Disassembly:
push ecx
sub esp, 4
test eax, eax
jl 0x403561
cmp eax, dword [0x40a6b8]
jae 0x403561
push 0
lea ecx, [esp + 4]
push ecx
push ebx
push edx
call fcn.00403be0
push eax
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x403575
mov eax, dword [esp]
add esp, 4
pop ecx
ret
mov eax, 4
call fcn.00402deb
mov eax, 0xffffffff
add esp, 4
pop ecx
ret
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
call fcn.00406260
cmp edx, 0x6d
jne 0x40358d
cmp dword [esp], 0
je 0x403559
mov eax, 0xffffffff
add esp, 4
pop ecx
ret

Function at 0x4063d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
push ebp
sub esp, 8
mov esi, eax
mov ebp, edx
mov edi, ebx
test eax, eax
jl 0x406464
cmp eax, dword [0x40a6b8]
jae 0x406464
call fcn.00403be0
mov edx, eax
mov dword [esp + 4], eax
mov eax, esi
xor ebx, ebx
call fcn.00406340
test al, 0x80
je 0x406428
mov eax, esi
call dword [0x40a2c4]
push 2
push 0
push 0
push edx
mov ebx, 1
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
cmp eax, 0xffffffff
je 0x406475
push 0
lea eax, [esp + 4]
push eax
push edi
push ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x406489
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov edx, eax
cmp ebx, 1
jne 0x406455
mov eax, esi
call dword [0x40a2c8]
mov eax, edx
call fcn.00406260
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
mov eax, 4
call fcn.00402deb
mov eax, 0xffffffff
jmp 0x40645c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov ebx, eax
mov eax, esi
call dword [0x40a2c8]
mov eax, ebx
jmp 0x406457
cmp edi, dword [esp]
je 0x406498
mov eax, 0xc
call fcn.00402deb
cmp ebx, 1
jne 0x4064a5
mov eax, esi
call dword [0x40a2c8]
mov eax, dword [esp]
add esp, 8
pop ebp
pop edi
pop esi
pop ecx
ret
Function at 0x40e4b3
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edx, 0x40b2a3ca
adc cl, al
invalid
inc esi
or ch, byte [ebx - 0x52]
xor dword [eax + 0x26], 0x23e59562
push eax
cmpsb byte [esi], byte es:[edi]
add byte [ecx + esi*2], bh
add byte [ebx - 0x24], ch
pop ebp
salc
push eax
inc esp
loop 0x40e52a
xor eax, 0x289c5668
aam 0xf9
mov bh, 0x1c
jl 0x40e47e
lcall 0xcc59, 0x6049a306
dec ecx
pushal
pop ecx
int3
xor eax, 0xad7bf3ec
insb byte es:[edi], dx
outsb dx, byte [esi]
insb byte es:[edi], dx
mov cl, 0xad
call 0x16ad9fa3
out 0x3c, al
cmp al, 0x54
jb 0x40e4c5
push ecx
rol dword [ecx], cl
mov dh, 0x7d
mov ebx, 0xd5915369
inc esi
in al, dx
daa
jnp 0x40e4eb
adc bh, byte [edi + 0x75]
mov esp, 0x419f0290
sbb eax, edx
pop ecx
dec ebp
fidiv dword [edx + 0x474909b]
in eax, dx
sbb cl, byte [ecx - 0x381da199]
jl 0x40e52c
add eax, 0xfae40fc8
shr dword [esp + edx*2 + 0x58], 0x48
jo 0x40e49c
add eax, 0x3c632405
sub ch, dl
xchg esi, eax
daa
daa
and al, 0x74
mov dl, 0xab
sahf
cmpsb byte [esi], byte es:[edi]
jne 0x40e585
sal dword [esp + edi*4], cl
xor eax, 0x68f222cf
iretd
push 0x57987b41
inc ecx
jnp 0x40e4c9
push edi
add esi, dword [0xf5827a3e]
mov esp, 0x7c0af723
pushal
mov byte [0x4e2806cf], al
mov ch, 0x63
sub al, 0xb4
mov edi, 0xd5b4e9b0
sub dl, cl
invalid
lahf
aas
jle 0x40e52e
cmp ch, cl
sti
xchg ecx, eax
sbb byte [ecx + ebp*8 - 4], dh
dec ebx
fld dword [ebp + ebx - 0x3014450d]
push esp
cmp ebx, dword [edx + 0x4e]
mov ch, 0xea
xchg esp, eax
ficom word [ecx]
jl 0x40e560
mov dword [edx - 0x6b], ebp
shl dword [eax], 0xa8
mov word [ebx], fs
jmp 0x23ae251e

Function at 0x4145a3
Capabilities:
Encode data using xor

Disassembly:
leave
adc ah, 0x48
wait
salc
push esp
or edi, esi
stc
or esp, ecx
out dx, al
push 0xc78dde5c
jge 0x4145cc
insd dword es:[edi], dx
xchg edx, eax
test cl, ah
jbe 0x414606
scasd eax, dword es:[edi]
das
sub edx, dword [eax + 0x4afd2b95]
stc
sub byte [ebx - 0x5e16c9b0], al
jmp dword [edi - 0x6125ab6c]
mov eax, dword [0x5494a7ff]
ficomp dword [esi + 0x1225eabe]
js 0x414616
invalid
test al, 0x4f
invalid
ljmp 0x876:0xe6e8ed62
Function at 0x417c10
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [0x4c3049]
mov dl, byte [0x4c3044]
and al, dl
mov edx, dword [0x4c3038]
or al, 0x2f
sub esp, 0xc
mov byte [0x4c3044], al
mov eax, dword [0x4c303c]
mov ecx, eax
push esi
shl ecx, 4
and edx, ecx
xor ecx, ecx
mov cl, byte [0x4c3045]
mov dword [0x4c3038], edx
mov edx, dword [0x4c3034]
xor esi, esi
and edx, 8
imul edx, ecx
or eax, edx
mov edx, dword [0x4c6b1c]
push edx
mov dword [0x4c303c], eax
call sub.WINSPOOL.DRV_StartPagePrinter
lea eax, [esp + 4]
push eax
push 0x20019
push esi
push str.CLSIDEC529B00_1A1F_11D1_BAD9_00609744111AInprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x417c91
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [0x4c6b1c]
mov dword [esp + 0xc], 0x104
push ecx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dl, byte [0x4c3049]
mov al, byte [0x4c3048]
xor al, dl
mov edx, dword [esp + 0x14]
and al, 0x14
mov byte [0x4c3048], al
mov al, byte [0x4c3043]
or al, 8
lea ecx, [esp + 0xc]
shr al, 3
and eax, 0xff
push ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 8]
fild dword [esp + 0xc]
push edx
push 0
push 0
push str.ThreadingModel
fdivr qword [0x4c69d0]
push eax
fadd qword [0x4c3050]
fstp qword [0x4c69c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417d08
mov esi, 1
push 0x4c7d38
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0xc
ret 4

Function at 0x455c76
Capabilities:
Encode data using xor

Disassembly:
test bl, bl
cmp eax, 0x58130859
mov ch, 0x37
xor bh, al
push es
invalid

Function at 0x46e065
Capabilities:
Encode data using xor

Disassembly:
iretd
invalid
fadd st(0), st(0)
movsd dword es:[edi], dword [esi]
cmpxchg byte [eax - 0x5dce9fa4], al
mov dh, cl
inc edx
xor byte [ebx + ecx], ah
mov dword [0xab9f167d], eax
xor dword [esi + ebp + 0x3a], esi
mov byte [0xc93aa324], al
jle 0x46e027
test byte [esp + ecx*8 - 0x79], 0x97
salc
or edx, dword [edx]
salc
mov byte [0xe6d99366], al
mov dh, 0x14
pushal
outsd dx, dword [esi]
leave
loop 0x46e0d2
jl 0x46e04a
adc dh, cl
sbb al, 0x8a
sbb byte [edx + edx*2 - 0x22], cl
popal
dec eax
push ds
arpl dx, sp
inc ecx
jb 0x46e0c3
out dx, eax
imul esp, dword [ebp - 0x1b073d7], 0xffffffd1
pop edx
lcall 0x8856, 0x86fe3df3
push 0xd3f0bae
loope 0x46e102
int1
jg 0x46e071
push edi
push ds
sub dword [esi - 0x438cf83b], esp
cmpsd dword [esi], dword es:[edi]
jmp dword [edi]
in al, dx
mov eax, dword [0xd96f5502]
cmp byte fs:[bp + si + 0x5c], dl
or bh, bh
nop
enter 0x5b62, 0xffffffffffffffa2
jp 0x46e15d
or byte [esi - 0x63ec9776], ah
mov esp, 0xb152c66b
stosd dword es:[edi], eax
stosd dword es:[edi], eax
sbb eax, 0x4a086997
xchg edi, eax
imul ecx, dword [eax], 0x397ad74a
sti
jno 0x46e1a8
invalid
or esp, dword [edi + ebp*8 - 5]
imul ebx, edx, 0xffffffe9
mov edi, 0x39027f2a
in eax, dx
mov ch, 0xca
test eax, 0x15183cb1
mov word [ecx], gs
adc dl, byte [edi + ebp*2 - 0x67]
invalid
Function at 0x46ee3f
Capabilities:
Encode data using xor

Disassembly:
int 0xce
ret
pop ebp
push dword [ebp + 0x31]
add ebp, 0xf66fb794
add byte [edi + 0x7ca9bf67], bh
jmp 0x46ee54
fucomi st(6)
cld
pop ss
jns 0x46ee12
lahf
salc
in eax, 0x5d
outsb dx, byte [esi]
mov dh, 0x94
push ds
push ecx
inc esi
sbb ch, byte [edx - 0x6e]
out 0x61, eax
sub eax, 0x66c55fa2
movsd dword es:[edi], dword [esi]
mov byte [0xa566c55f], al
mov eax, dword [0x7df14a43]
pop edx
jnp 0x46ee6a
call 0xa8b55bd
xchg ebp, eax
push edx
adc eax, 0xcae85bbc
wait
dec ecx
insb byte es:[edi], dx
invalid

Function at 0x493e0e
Capabilities:
Encode data using xor

Disassembly:
sahf
add dword [edi - 0x7c61fdba], esp
in eax, dx
add dh, byte [edi - 0x78]
pand mm0, qword [ebx - 0x126daf20]
dec eax
fucom st(1)
das
push ebx
inc edx
mov esp, 0x18300ac1
sahf
rcl esi, 1
invalid
mov ebx, 0xcdfba7f
lds eax, [ebx + 0x66]
rcl dword [esi], cl
jge 0x493e3e
jle 0x493db4
adc dword [ebx], ecx
out 0x52, eax
in eax, 0xc3
in eax, 0x1b
jb 0x493e55
leave
mov edi, 0xde752de1
dec eax
jae 0x493db5
jecxz 0x493e85
and edx, dword [eax]
in eax, 9
std
adc esp, ebx
mov al, 0xbb
mov ch, 0xd3
inc ebx
and byte [ebx + 0x73], bl
call 0xcd1af2b1
cli
lea esp, [edi - 0x16]
mov al, byte [0x53c2d6b9]
and byte [ebx + 0x29], dh
mov cl, 0x8f
mov ebp, 0x9634c759
or eax, 0x4dd8e72f
daa
cdq
shl byte [ebp + ebp + 0x13e11358], 1
jp 0x493e3e
pop ecx
invalid
xchg esp, eax
vpunpcklqdq xmm0, xmm3, xmmword [edx + 0x341ba130]
enter 0xffffffffffffd255, 0x73
cmc
xchg edi, eax
sbb eax, 0x13296919
enter 0xfffffffffffffeee, 4
popal
sbb edi, ebx
add dword [eax], 0x33
add byte [ebx], dh
test byte [esi], ah
mov ecx, 0x2ecaf059
sbb esi, 0xffffffef
xor esp, dword gs:[ebp + 0x795f0e63]
xor dl, byte [ebp - 0x41587965]
add cl, dl
sal byte [ebx - 0x1e], cl
invalid

Function at 0x49a79b
Capabilities:
Encode data using xor

Disassembly:
daa
popfd
iretd
push 0xfdd733d9
retf 0x25cc
lds esp, [ebx - 0x71b4a9a]
pop es
enter 0xfffffffffffff2d9, 0xffffffffffffffc0
arpl sp, cx
shr ch, 0x77
fstp qword [edi - 0x66]
sal byte [eax], cl
inc edi
push 0xdd57d8bd
jg 0x49a791
xchg edx, eax
js 0x49a786
outsb dx, byte [esi]
mov byte [edi], bh
not ch
adc ah, byte [0xadf2dd77]
xor byte [edi], bl
mov ah, 0xc0
mov dh, 0x7e
std
mov al, 0x5a
sal byte [esi - 0x4f02d182], 0x5a
xor dh, byte [eax - 0x12e1b9a]
jl 0x49a7c8
or eax, 0x58501a2f
mov fs, edx
std
xor bh, byte [ecx]
neg byte [eax]
push ecx
stc
clc
cli
push ecx
add ah, byte [edx + 0x63]
stc
jns 0x49a7c9
jle 0x49a7f0
loop 0x49a824
sub ch, bh
xlatb
sub esp, dword [ebx]
cdq
out dx, al
fidivr dword [esi + 0x6c1f7a0]
cmp esi, esi
wait
salc
enter 0xffffffffffff890d, 0x16
push ebx
cmp bh, ah
leave
cmc
xor edi, dword [eax + esi]
wait
cmpsb byte [esi], byte es:[edi]
invalid
mov dh, 0xd
or al, 0xa9
cwde
jo 0x49a86f
enter 0xffffffffffffee36, 1
invalid
iretd
Function at 0x4b23c6
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
out 0x15, eax
push cs
mov ebp, 0x9baf13a8
adc dword [ebp + 0x431a24a5], ebx
test al, 0xe8
add al, 0xa
mov fs, ecx
pop edx
pop eax
jbe 0x4b2418
aad 0x78
mov byte [esi + 0x4df94f66], cl
popal
xor al, 0x6e
pop edi
js 0x4b23b7
in al, dx
mov dl, 0xdf
push ebp
popfd
fist word [ebp - 0x63]
out dx, eax
invalid
jle 0x4b23e1
push ebp
test dword [esi - 0x2c], 0xe6e0d711
invalid

Function at 0x4b44fb
Capabilities:
Encode data using xor

Disassembly:
push esi
movsd dword es:[edi], dword gs:[esi]
ret
push 0xffffffffffffffc0
inc edx
imul ebx, dword [ecx], 0x3e
mov esi, 0x1aeb945a
outsd dx, dword [esi]
invalid
jns 0x4b44be
popal
inc ebx
cmc
xor eax, 0xe11657eb
dec ecx
rcl dword [eax - 0x45ac224b], 0x57
inc edx
xchg dword [edx], eax
mov edx, 0x2874257
scasb al, byte es:[edi]
dec eax
and byte [eax + ebx*4 - 0xa1523fd], dl
mov bl, 0x25
jnp 0x4b447c
xchg byte [ebx], ch
fiadd word [edi + 0x7f]
jg 0x4b44d0
sbb dl, byte [edi - 0x28d58ea4]
xchg edi, eax
pop esp
jno 0x4b4529
xlatb
mov dword [ecx + 0x5b1a48f0], ebp
pop ds
mov eax, dword [0x8928aaab]
xlatb
or byte [edx], cl
xchg edi, eax
into
pop ebx
rol byte [0x7d64be4b], 0x2f
push ecx
jmp 0xcba203ea
mov esi, 0x2e92cb56
int 4
loopne 0x4b44e1
mov esp, ebp
jecxz 0x4b4599
outsd dx, dword [esi]
mov es, word [ecx]
mov esi, 0x18d8b55b
aaa
jo 0x4b451d
push edi
inc esi
add eax, 0xc2995d39
pop esp
aas
cmpsb byte cs:[esi], byte es:[edi]
in al, 0xf3
or eax, 0x97bbf7de
mov dword [0x3a0ca426], eax
push 0xffffffffffffffe3
push ss
salc
aaa
aas
or byte [esp + ecx*2 + 0x30], 0x67
push ss
and dword [edx + ebx*8 - 0x27], ebp
fdivr qword [ebp - 0x6488ae32]
insb byte es:[edi], dx
push ss
and cl, byte [ecx]
xor dh, ah
xor al, 0xc7
dec esi
and ah, ch
js 0x4b4550
inc eax
insd dword es:[edi], dx
and eax, 0x1faf3aa3
pop ds
and al, 0x57
int 0x9c
jl 0x4b4531
xchg ebx, eax
out dx, eax
mov dh, 0
std
daa
pop ebx
adc dword [edi - 0x685af3e5], esi
mov edx, 0x2309dda4
movsb byte es:[edi], byte [esi]
test byte [edx - 0x12], al
inc esp
pop eax
in eax, dx
dec esp
jo 0x4b4594
out 0xf9, al
stc
loop 0x4b45bb
xchg edi, edi
add edx, dword ds:[ebx + esi*8 + 0x140d17ba]
jp 0x4b45b1
fisub word [esi]
add cl, byte [edx + ebp*8]
mov ah, dh
daa
xor byte [edi + 0x78199d84], ch
rcl dword [ebx + 0x6cf8c898]
loop 0x4b4575
jae 0xa606f79a
out dx, eax
inc edi

Function at 0x4b976a
Capabilities:
Terminate process

Disassembly:
add bh, bh
je 0x4b9792
add al, 0xe8
imul edx, dword [eax], 0x68590000
inc dword [eax]
add byte [eax], al
call dword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x4ba7dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c33d0
cmp edx, dword [eax]
je 0x4ba7ff
add eax, 8
inc ecx
cmp eax, 0x4c3460
jl 0x4ba7f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c33d0]
jne 0x4ba92d
mov eax, dword [0x4c7d9c]
cmp eax, 1
je 0x4ba907
test eax, eax
jne 0x4ba830
cmp dword [0x4c32f8], 1
je 0x4ba907
cmp edx, 0xfc
je 0x4ba92d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba867
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bb1c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb650
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba8aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb650
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bfa44
push edi
call fcn.004bd520
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bb1c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bb1d0
lea eax, [ebp - 0xa0]
push 0x4bfa24
push eax
call fcn.004bb1d0
push dword [esi + 0x4c33d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bb1d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bd494
add esp, 0x2c
pop edi
jmp 0x4ba92d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c33d4]
push 0
push eax
push dword [esi]
call fcn.004bb650
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret