joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e433
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
jno 0x4326d4
shl cl, 0x20
jo 0x40e445
invalid
jo 0x4326d4
or byte [edi], 0x8d
inc ebp
cld
push 0
jmp 0x40e453
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push 6
push ecx
lea edx, [ebp - 0xc]
push 0x440675
ret
push esi
ja 0x418307
xchg bl, ch
xchg ch, bl
jbe 0x4326e3
jecxz 0x43274a
xchg bx, di
xchg ebx, edi
xchg di, bx
mov esi, dword [ebp + 8]
shl dx, 0x20
mov ebp, ebp
jmp fcn.00426895
add byte [eax - 0x627df0fe], ch
retf 0
Function at 0x413c17
Capabilities:
Check os version
Encrypt data using speck

Disassembly:
jno 0x4267a1
jo 0x413c23
adc bh, byte ds:[ecx - 0x59]
jo 0x4267a1
adc byte [ecx + 0x2df226ff], 0xf
xchg dword [edx - 0x69], esp
mov ebp, esp
sub esp, 0x14
shr bh, 0x40
mov eax, dword [ebp + 8]
mov dword [ebp - 8], 0
push ebp
js 0x424695
jns 0x4267ac
cmc
lds ecx, [edi]
mov ebx, esp
fdivp st(7)
inc edi
cmp eax, 0x10820f
add byte [eax], al
shr cl, 0x40
jae 0x4267c3
jns 0x424695
invalid
nop
cpuid
ret 0x768d
lea esi, [esi + 8]
jmp dword [esi]

Function at 0x416b7f
Capabilities:
Authenticate hmac
Check os version
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
js 0x41c209
jns 0x416b8b
invalid
jns 0x41c209
sub dl, 0xff
mov ebx, 0x66c98845
xchg esi, edx
xchg dx, si
mov ecx, dword [esi + 4]
mov dh, dh
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
rol byte [ebx], cl
jmp dword [esi]
mov ax, ax
jno 0x4251a3
jo 0x41c218
cpuid
ret
jo 0x4251a3
xor al, 0x77
call fcn.0040d83c
add esp, 0x24
test ax, ax
jb 0x42ea33
je 0x41c25e
jne 0x41c23e
cmp ax, 0x1a
je 0x41c25e
jne 0x41c24e
cmp ax, 0xa
jne 0x429905
push ebp

Function at 0x4174c1
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
jne 0x438a68
je 0x4174d1
mov word [eax - 0x51], ds
ja 0x4269dc
jbe 0x4174db
test ecx, 0x1000
jb 0x44ba6d
push ebx
pop ebx
jne 0x41bf1e
push eax
pop eax
je 0x41e8fd
cpuid
nop
ret
popfd
mov ebx, ebx
jmp dword [esi - 4]
shr si, 0x40
mov eax, dword [esi + 4]
movzx eax, byte [ebp + eax]
cmc
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x44ba62
jne 0x42c6ba
je 0x438a97
nop
cpuid
ret
xchg ebx, edi
xchg edi, ebx
mov ecx, dword [esi]
sub cx, 0
add esi, 8
jne 0x41e8e1
je 0x438ab4
cpuid
nop
ret
je 0x41e8e1
in al, dx
sub eax, dword [ebx]
pop ds
pushal
pop esp
Function at 0x41b925
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
invalid
push ebp
mov cx, cx
mov ebp, esp
mov eax, dword [ebp + 8]
and eax, 0xff
jb 0x4309a1
add eax, 0xffffffd8
cmp eax, 0xc2
lea edi, [edi]
ja 0x41b97b
jbe 0x41b951
nop
cpuid
ret
xor ecx, ecx
jb 0x43d4b8
shr ecx, 0x40
mov cl, byte [eax + 0x44c224]
jmp dword [ecx*4 + 0x44c21c]
xor eax, eax
jb 0x43d4d1
pop ebp
jne 0x41d5d7
mov dx, dx
je 0x41b993
cpuid
ret
je 0x41d5d7
add eax, 0x83df5f4
add byte [eax], al
add byte [esi - 0x3f], ah
out 0x20, al
mov byte [ebp + ebx], al
jmp dword [esi]
and dword [ebx - 0x75], ebx
pop ebp
inc esp
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
lea esi, [esi + 0xc]
test byte [ebx + edx], al
jb 0x4128c9
jmp dword [esi]
mov byte [0x40eac073], al
mov ebx, dword [ebp + 0x44]
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
jne 0x448dac
je 0x43d4ea
sub dword [ebx], ecx
inc ecx
je 0x448dac
fld dword [esi]
imul byte [ebp + ebx]
lea esi, [esi + 0xc]
shr cl, 0x40
jne 0x42a5aa
je 0x43d508
cpuid
ret
je 0x42a5aa
fidiv dword [edx + 0x1b]
inc ebx
add byte [eax], al
popal
add byte [eax + 0x34], al
add byte [ecx], ah
add byte [eax], al
mov esp, 0
adc byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
xor byte [eax], al
add byte [eax], al
popal
push ds
inc ecx
add byte [edi], cl
int3
Function at 0x421689
Capabilities:
Check os version

Disassembly:
push ebp
shl edi, 0x20
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
shr dh, 0x40
call fcn.00441b54
add esp, 4
mov dword [ebp + 8], eax
xor ecx, ecx

Function at 0x42204c
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
js 0x43e0e7
xchg bl, ah
xchg ah, bl
jns 0x422060
jns 0x43e0e7
fadd st(7)
xchg ecx, edx
xchg si, dx

Function at 0x422bcc
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
mov eax, dword [esi + 4]
shl ah, 0x20

Function at 0x42333e
Capabilities:
Check os version

Disassembly:
pop dword [esp - 4]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
mov edi, edi
mov dl, dl
mov al, byte [eax]
lea esi, [esi + 0xc]
jmp 0x43c35c
stc
jb 0x43c363
popfd

Function at 0x428d8e
Capabilities:
Check os version
Encode data using base64
Encrypt data using aes mixcolumns step
Encrypt data using speck

Disassembly:
pop dword [esp - 4]
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
jne 0x42b26f
je 0x428da9
and al, 0xc5
je 0x42b26f
invalid
push eax
shl cl, 0x20
lea eax, [eax]
jmp 0x42b277
push esi
mov word [esi + 0xbc], dx
shl cl, 0x20
call fcn.0041b6d2
shl eax, 0x20
call fcn.0044304d
fnstcw word [ecx + 0x5b]
mov esp, ebp
pop ebp
ret
Function at 0x428e20
Capabilities:
Check os version

Disassembly:
mov al, byte [esi + edx]
push eax
call fcn.00429864
and bp, bp
add esp, 4
test eax, eax
jb 0x424222
je 0x429850
jne 0x40cfaf
sbb cl, byte [edi]
mov byte [0xed0946c3], al
inc esi
or ebp, ebp
shl dx, 0x20
jno 0x40cfbc
leave
sub dword [eax + 0xc810f14], esp
and eax, 0x99d90001
jno 0x41f4ce
fstp dword [ecx - 0x74bba275]
inc esi
add al, 0x88
in eax, dx
jmp 0x41028e
mov bl, 0xcb
jmp 0x43603b
lea esp, [esp + 4]
mov edx, dword [ebp + 8]
jne 0x40cf89
je 0x428dc2
bound ebx, qword [edi + ecx - 0x7c]
rol dword [ecx - 2], 0xff
je 0x40cf89
mov ax, word [ecx + 8]
add ecx, 8
inc edx
cmp ax, 0xffff
jne 0x42fb8e
je 0x428de2
cmpsd dword [esi], dword es:[edi]
jne 0x41eeca
jne 0x41eeca
je 0x428ded
rcr dword [esi + 0x36], 1
je 0x41eeca
xor al, 0x42
mov edi, dword [ebp + 0x10]
shl cl, 0x20
mov eax, dword [edi]
ja 0x42bc6b
shr ax, 0x40
jbe 0x428e0b
push 0xffffffffffffffce
jbe 0x42bc6b
and eax, 0xd289664c
mov edx, dword [ebp + 0x38]
call fcn.00431cb6
and eax, 0x24448f81
cld
js 0x438f7b
xchg ecx, ebp
mov di, di
xchg ebp, ecx
jns 0x428e37
cpuid
nop
ret
jns 0x438f7b
invalid
push eax
ja 0x41c1f5
jbe 0x42bc77
or dword [edx], 0x78860fe6
add eax, 0x3835ffff
add al, 0xd3
inc ecx
jbe 0x41c1f5
xor eax, 0x41d30438
add byte [esi + 0xa], bh
inc edx
add byte [edx], cl
pop es
inc ebx
add byte [edx - 0x44ffbd44], dl
push esp
or al, byte [edi]
inc ebx
add byte [esi + 0xa], bh
inc edx
add bh, al
jae 0x42bc85
cmc
jne 0x42bca1
add byte [ebx - 0x531617bb], cl
aaa
add byte [eax], al
cmp byte [eax], 0xc0
loopne 0x42bcce
mov eax, dword [ebp - 0x18]
jmp 0x42f455
mov al, byte [ebp + eax]
lea edi, [edi]
push 0x413bb1
ret
add byte [edi], cl
adc byte [edx + 0x38], 0
add byte [ebp + 0x40fd04], cl
add byte [eax], al
push eax
call fcn.004341e7
mov ebx, eax
add esp, 8
test ebx, ebx
jb 0x42f545
push 0x41bbfa
ret
xchg ebp, eax
outsb dx, byte [esi]
mov eax, dword [esi + 4]
mov ebx, dword [esi + 8]
push 0x415dbb
ret
pop es
invalid
add ah, 0
cmp ax, word [ebp + 8]
je 0x410274
jne 0x42fba1
nop
cpuid
ret
jno 0x428dc8
mov bh, bh
jo 0x42fbae
js 0x42fb83
test eax, 0x9214800f
invalid
jo 0x428dc8
ficom dword [edi - 0x75]
push esi
pop esi
jmp dword [esi]
mov cl, byte [ebp + 0x34]
xchg di, ax
xchg di, ax
mov ebx, dword [esi + 4]
lea esi, [esi + 8]
rol word [ebx], cl
shl cl, 0x20
jmp dword [esi]
mov al, byte [ebp + 0xb]
mov bl, bl
shl cl, 0x20
Function at 0x429227
Capabilities:
Authenticate hmac
Check os version

Disassembly:
push ebp
ja 0x434f36
jbe 0x413412
dec edi
sbb dword [esi], edx
sbb dword [edi], ecx
xchg byte [esi], bl
sbb eax, dword [edx]
add byte [edx + 0x40eac150], al
jbe 0x434f36
adc byte [eax - 0x3f], 0xea
inc eax
jno 0x413405
jo 0x429232
dec edi
xor edi, ecx
jo 0x413405
xor eax, 0xfbe1e8e0
invalid
jne 0x410792
je 0x4447e3
add al, 0x47
je 0x410792
xor byte [edi + ecx - 0xc96d7b], 0xff
je 0x4447f7
pushal
cpuid
ret
mov dh, dh
mov cl, cl
mov eax, dword [esi + 4]
add esi, 8
and ecx, ecx
add ebx, eax
push esi
pop esi
test ecx, 0x80000000
jb 0x42c6ec
jne 0x43047e
je 0x444822
nop
cpuid
ret
je 0x43047e
xor al, 0x5c
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
mov eax, dword [0x579db9]
test eax, eax
jb 0x4296e2
je 0x4258d5
jne 0x44484b
nop
cpuid
ret
mov eax, dword [0x579db5]
test eax, eax
jb 0x4296e9
je 0x410305
jne 0x444864
clc
or esi, 0x53
mov eax, esi
pop esi
or esi, esi
jno 0x44486f
nop
cpuid
ret 0x810f
jno 0x4258bb
xor ch, 0xf
test dword [edi + 0x60], esp
invalid

Function at 0x42a6cf
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
jmp fcn.004161f3

Function at 0x42cc80
Capabilities:
Check os version

Disassembly:
lea esp, [esp + 4]
mov ebx, dword [esi + 8]
shr ebx, 0x40
mov ecx, dword [esi + 4]
mov ebx, dword [ebp + ebx]
call fcn.0041e1f0
ficom dword [0xff5ffeb]
test dword [edi], edi
and edi, esi
push dword [ebx + eax - 0x2c]
xchg dword [edi + ecx - 0x1dccb7c], edx
invalid
Function at 0x4362d1
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
pop dword [esp - 4]
mov ebx, dword [ebp + 8]
xchg di, bx
xchg bx, di
lea ecx, [ebp - 0x100]
push ebx
xchg al, cl
xchg cl, al
shr dx, 0x40
push ecx
call fcn.00434832
lea edx, [ebp - 0x100]
js 0x42edfc
jns 0x436303
sub eax, 0xf3890f0b
mov bh, bh
inc dword [0xd4850fdf]
jns 0x42edfc
add eax, 0xd4850fdf
jo 0x436310
add byte [ebx + eax + 0x35], dh
sahf
outsb dx, byte [esi]

Function at 0x439b54
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
push 1
js 0x4423e7
jns 0x439b64
and bh, dl

Function at 0x43a150
Capabilities:
Check os version

Disassembly:
jle 0x4252d4
xchg bp, ax
mov esi, dword [esi + 4]
mov esi, dword [ebp + esi]
mov esi, dword [esi]
jmp dword [esi]
ret
pop dword [esp - 4]
mov esp, ebp
pop ebp
mov al, al
jne 0x4271a6
je 0x43a164
outsb dx, byte [esi]
pop es
xchg esi, eax
je 0x4271a6
xor al, 0x6a
ja 0x4252b9
jbe 0x43a178
sbb al, 0x3e
insb byte es:[edi], dx
ja 0x43a188
jbe 0x4252b9
xchg byte [ebx], bh
mov cl, 0xfe
invalid
fnstcw word [ebx + 0x4c481]
add byte [eax], al
xor word [ebp + ebx], ax
jb 0x43fa82
inc esp
sbb eax, 0xf1820f00
pop eax
add byte [eax], al
jmp dword [esi]
mov ch, 0x25
je 0x4403ff
and eax, 0x4350662e
add byte [eax], bh
add byte [eax], al
add byte [eax], bh
add byte [eax], al
add byte [ebx + 0x300040e9], bh
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [ecx + 0x41], al
add byte [ecx + esi*4 + 0x41], ah
add byte [ecx - 0x6effbd7b], dh
pop ds
inc ecx
add ch, ah
fadd dword [ebx]
xor byte [eax], al
add byte [eax], al
dec esp
add byte [eax], al
add ch, ah
fadd dword [ebx]
dec esp
add byte [eax], al
add byte [eax], dh
add byte [eax], al
add byte [edx + 0x44], al
inc esp
add dh, dl
cli
inc ebx
add byte [eax + 0x12], al
inc edx
inc esp
inc esp
add byte [ecx + 0x2500411f], dl
push eax
add dh, 0xe8
sub dh, 0xe8
add esi, 8
shl eax, cl
add ebx, eax
test ecx, 0x80000000
jb 0x44c06c
jne 0x433f46
je 0x43fb08
and byte [edx], 0x1c
imul esp, dword [esi - 0x77], 0xffffffdb
mov bx, bx
call fcn.004301df
mov di, di

Function at 0x43ce21
Capabilities:
Check os version

Disassembly:
add esp, 4
xor eax, eax
jb 0x438161
sub cl, 0x34
shl al, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x42cc96
add dl, 0x58
xchg bl, dh
xchg dh, bl
mov byte [ebp + eax - 8], dl
mov dx, dx
inc eax
cmp eax, 8
jl 0x43ce35
jge 0x43ce64
add dword [eax], esi
pop ss
enter 0x73e9, 0xfffffffffffffff8
invalid
jmp fcn.0043c6dc
Function at 0x43d817
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x426963
ret
lea esp, [esp + 4]
mov byte [esi + 0xba], bl
mov ah, ah
mov di, di
mov byte [esi + 0xbb], dl
mov si, si
mov word [esi + 0xbc], di
shl edx, 0x20
call fcn.0043e102
mov bl, bl
mov cl, byte [ebp + 0xc]
jno 0x428fef
mov ax, ax
shl ah, 0x20
jo 0x427b4e
inc esp
push esp
lea eax, [ecx + 0xf]
sbb byte [ebx + 0x25000014], 0x2d
mov esi, dword [ebp + 0x48]
jo 0x428fef
and eax, 0x48758b2d
shl dl, 0x20
mov edi, dword [ebp + 0x4c]
call dword [ebp + 0x50]
mov dword [ebp + 0x40], esp
shl bx, 0x20
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x30], eax
mov dword [ebp + 0x3c], ebx
jno 0x41328f
jo 0x427b7c
shl si, 0x20
mov dx, word [ebp + 0x10]
jno 0x43d7ec
jo 0x429001
dec esp
fisttp qword [edi]
and ch, 0x47
add dword [eax], eax
jo 0x43d7ec
and eax, 0x3b24f782
mov esi, eax
jne 0x41d32a
shl dl, 0x20
je 0x43d7e4
sal ch, 0x4e
je 0x41d32a
or byte [edx], 0xeb
jmp 0x43d7ed
push eax
xchg bl, dl
mov edx, edx
xchg dl, bl
mov ax, ax
jne 0x42ba01
je 0x43d802
cli
xchg esi, eax
je 0x42ba01
fld dword [ecx + 0x6a]
add byte [ebp + 0x3e68d855], cl
inc ecx
add bl, al
and eax, 0x24448f7d
cld
push 0x9c40244c
push edx
call fcn.0041a722
jne 0x4317d5
je 0x43d832
loopne 0x43d84d
jae 0x43d7d6
je 0x4317d5
invalid
or al, 0x85
inc esp
sbb eax, 0xe3820f00
mov cl, 0xfe
dec dword [ebp + 0x3326ff36]
invalid

Function at 0x43fbb0
Capabilities:
Check os version
Encode data using base64

Disassembly:
clc
lodsb al, byte [esi]
call fcn.0042cc80
add eax, 0x24648dec
add al, 0xf5
sub word [ebp + ebx], ax
jmp dword [esi]
pop dword [esp - 4]
je 0x446558
jne 0x43fbbf
pop ebx
out 0x6e, al
xor eax, eax
jb 0x435879
pop esi
mov esp, ebp
jne 0x446551
je 0x43fbd4
sahf
dec dword [edi]
test byte [edi + 0x69], dh
add byte [eax], al
je 0x446551
invalid
pop ebp
ret
shr bh, 0x40
mov al, byte [ebp - 0x62]
cmp al, 1
jne 0x4465ad
je 0x44656a
cwde
dec esp
mov cl, byte [ebp - 0x60]
xor eax, eax
jb 0x435882
sub cl, 0x34
shl eax, 0x20
mov dl, byte [ebp + eax - 0xf0]
xor dl, cl
jb 0x43815a
add dl, 0x58
mov bp, bp
mov byte [ebp + eax - 8], dl
lea ecx, [ecx]
inc eax
cmp eax, 8
jl 0x44657b
jge 0x4465a6
in eax, dx
mov ch, 0xe9
xor dword [ecx - 1], esp
push dword [0x89023cb3]
imul al
or cl, byte [edx]
add bh, al
dec esp
xchg ecx, edx
xchg edx, ecx
mov eax, edx
shr bl, 0x40
shr eax, 0x1f
add edx, eax
shr ah, 0x40
mov eax, ecx
shr eax, 0x40
mov edi, edx
shl bl, 0x20
cdq
and edx, 3
jb 0x42fcfc
jmp fcn.0043c6dc
cmp al, 2
mov esi, esi
call 0x44afc0
invalid
add eax, edx
sar ebx, 2
jne 0x41f617
je 0x4465f1
shr bl, 0x70
clc
je 0x41f617
invalid
Function at 0x441f5a
Capabilities:
Check os version
Encrypt data using aes mixcolumns step

Disassembly:
push 0x41cf89
ret
mov dl, byte [ebp + 0xb]
test al, 0xc3
add esp, 0x2c
mov byte [esi + 0xba], bl
test ax, ax
jb 0x4220f4
shr di, 0x40
mov bp, bp
mov byte [esi + 0xbb], dl
lea esi, [esi]
shr bx, 0x40
xchg ebp, edi
xchg edi, ebp
mov ch, ch
push edx
mov dx, 0x7d1d
xchg dh, dh
pop edx
shr si, 0x40
mov word [esi + 0xbc], di
mov cx, cx
jne 0x412d39
je 0x42dc89
push cs
sub byte [eax], ch
jmp 0x40d0a0
lea esp, [esp + 4]
shl bl, 0x20
mov eax, dword [ebp - 8]
lea eax, [eax]
jne 0x42dc35
shr edi, 0x40
je 0x441f73
push ebx
out dx, al
je 0x42dc35
and eax, 0x4468b9b
mov cx, cx
mov ebx, dword [esi + 8]
lea esi, [esi + 0xc]
adc byte [ebp + ebx], al
shr al, 0x40
jmp dword [esi]
Function at 0x446ae9
Capabilities:
Check os version
Encode data using base64

Disassembly:
push 0x26
push ebx
pop ebx
push edx
call fcn.0042cb65
add esp, 8
pop edi
pop esi
mov ebx, ebx
pop ebx
xchg dx, ax
xchg dx, ax
mov esp, ebp
shr di, 0x40
pop ebp
mov cl, cl
ret
mov eax, dword [0x579e69]
or ebx, 0xffffffff
jb 0x40f439
add ah, 0
cmp eax, ebx
jne 0x44898d
push edi
pop edi
je 0x41eab6
xlatb
add ebp, eax
das
imul eax, dword [ecx], 0
call fcn.004355ea
shr eax, 0x1e
sub eax, 3
mov eax, 0x57a748
je 0x434caf
jne 0x41ead4
push edi
daa
cwde
cmp dword [eax + 0x57a75c], 0x61d0870f
add dword [eax], eax
mov eax, 0x57a75c
ja 0x434caf
jbe 0x41eae4
call 0x86513bb0
lds esp, [ecx + 1]
add dl, bl
sub eax, 0xfb21c35d
jbe 0x434caf
fisubr dword [0xfb21c35d]
push ebp
mov ebp, esp
sub esp, 0x24
mov cl, cl
push ebx
push esi
mov esi, dword [ebp + 8]
mov dl, dl
push edi
xchg si, dx
xchg dx, si
mov eax, dword [esi]
call fcn.00435d82
invalid
add esp, 4
cmp bl, bl
test al, 1
jb 0x433a1e
jne 0x41ea94
shr edi, 0x40
je 0x420a23
fsubr st(5), st(0)
push 0
call fcn.00413c17
add esp, 4
test eax, eax
jb 0x433a25
je 0x41ea94
jne 0x420a44
cpuid
cmpsd dword [esi], dword es:[edi]
ret
mov edx, dword [edi]
ja 0x41ea6c
jbe 0x420a50
rcr eax, 0xf
xchg byte [esi], dl
loopne 0x420a54
jbe 0x41ea6c
invalid
push dword [ecx + ecx]
xor al, 9
push 3
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, ebx
mov dword [0x579e69], eax
jne 0x40d8bc
je 0x42b397
test eax, 0xf9870ff4
and al, 0xfe
push dword [esi + 4]
ja 0x40d896
jbe 0x42b3a3
ljmp 0xed86:0xf032a37
jbe 0x40d896
invalid
cmc
test eax, eax
jb 0x40f458
je 0x42da70
jne 0x42da56
or byte [edi + 0x1d687d8c], ah
cmpsd dword [esi], dword es:[edi]
push edi
add bh, al
add eax, 0x57a011
add byte [eax], al
add byte [eax], al
push 0x57a71d
mov dword [0x57a011], 0
call fcn.00457d40
add esp, 4
push 0x57a71d
lea eax, [ebp + 8]
push 2
push eax
call fcn.00457cf0
mov ecx, dword [ebp + 8]
mov ch, ch
mov edx, dword [edi]
shr ah, 0x40
push ecx
push 2
ja 0x4105c5
jbe 0x42da98
push ds
outsb dx, byte [esi]
jbe 0x4105c5
xor al, 0x47
lea esi, [esi + 0xc]
shl dx, 0x20
sar dword [ebp + ebx], cl
mov bx, bx
jmp dword [esi]
sub dword [0xfdba06e8], esi
inc dword [0x895e40ea]
add eax, 0x895e40ea
in al, dx
pop ebp
ret
xchg esi, eax
xchg esi, eax
push 0
push 0
ja 0x42b373
jbe 0x434cbf
add eax, 0xae860f15
invalid
jbe 0x42b373
js 0x43c085
jns 0x434cd0
push edx
nop
invalid
jns 0x43c085
xor al, 0xfd
pop dword [esp - 4]
je 0x446b2d
jne 0x446af8
iretd
cmp ax, 0x100
je 0x446b2d
jne 0x446b07
stc
invalid
cmp ax, 0x12c
xchg edx, ebx
xchg ebx, edx
je 0x446b2d
push esi
pop esi
jne 0x446b1d
mov edi, 0x662af420
cmp eax, 0x850f0028
cmp ax, 0x28
jne 0x41ea94
insd dword es:[edi], dx
jg 0x446b23
push dword [esp + eax + 0x7e]
add dword [ebp + 0x5b], edx
je 0x446b2d
jle 0x446b2c
push ebp
pop ebx
mov ecx, dword [edi]
push ecx
call fcn.004375c0
ja 0x420a06
jbe 0x446b42
cpuid
nop
ret
jbe 0x420a06
xor al, 0x89
jmp dword [esi]
xchg di, si
xchg si, di
mov eax, dword [0x57a011]
add ecx, 0
jno 0x4489a1
ljmp 0x9a81:0xfc3a20f
jno 0x42da41
and eax, 0xbe89668a
mov esp, 0xe8000000
cli
cmp bh, ch
invalid
Function at 0x449400
Capabilities:
Get file size

Disassembly:
add esp, 4
push ebp
mov ebp, esp
js 0x413bd6
jns 0x44940f
mov eax, 0x890fe59b
shl dword [edi + 0x6fdafffc], 0x8b
jns 0x413bd6
fisubr dword [edi - 0x75]
push es
jmp 0x44941a
push eax
call fcn.00434abe
jno 0x448dbe
jo 0x44942d
cpuid
test ebx, 0xf98b800f
invalid
jo 0x448dbe
mov dword [edi - 0x2cd2618], 0xc1168bff
jecxz 0x44945f
Function at 0x44cbc0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x108
cmp dword [esp + 0x10c], 0
push ebx
push esi
push edi
push ebp
jne 0x44cbe4
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
cmp dword [esp + 0x124], 0
jne 0x44cbfe
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor eax, eax
mov edx, dword [esp + 0x11c]
mov ax, word [edx]
add eax, 7
cdq
and edx, 7
add eax, edx
mov edx, dword [esp + 0x11c]
sar eax, 3
mov si, ax
lea eax, [esp + 0x18]
movzx ebp, si
push ebp
push edx
push eax
call fcn.0045c4f0
add esp, 0xc
cmp si, 0xfc
jbe 0x44cc49
mov eax, 0xc9
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x124]
push eax
call fcn.004592e0
mov esi, dword [esp + 0x124]
add esp, 4
test esi, esi
jne 0x44ccf7
xor cx, cx
mov eax, dword [esp + 0x124]
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x44cc79
xor di, di
xor edx, edx
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
mov edx, dword [esp + 0x11c]
xor eax, eax
mov cl, byte [esi]
mov al, byte [ebx + edx + 2]
xor edx, edx
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x44cc95
jmp 0x44cdba
mov edx, dword [esp + 0x11c]
push ebp
lea eax, [esp + 0x1c]
push edx
push eax
add esi, 2
call fcn.0045c4f0
lea eax, [esp + ebp + 0x24]
add esp, 0xc
push 4
push esi
push eax
call fcn.0045c4f0
xor cx, cx
mov eax, dword [esp + 0x130]
add esp, 0xc
add eax, 0x5c
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
movsx eax, cx
mov byte [eax + edx], cl
inc cx
cmp cx, 0x100
jl 0x44cd31
xor di, di
xor edx, edx
add ebp, 4
mov byte [esp + 0x13], dl
xor ebx, ebx
mov esi, dword [esp + 0x14]
movsx eax, di
inc di
mov bl, dl
add esi, eax
xor edx, edx
xor eax, eax
mov cl, byte [esi]
mov al, byte [esp + ebx + 0x18]
mov dl, cl
sub eax, edx
xor edx, edx
mov dl, byte [esp + 0x13]
add eax, edx
cdq
xor eax, edx
sub eax, edx
and eax, 0xff
xor eax, edx
sub eax, edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x13], al
xor eax, eax
mov al, byte [esp + 0x13]
add edx, eax
mov al, byte [edx]
mov byte [esi], al
lea eax, [ebx + 1]
mov byte [edx], cl
cdq
idiv ebp
cmp di, 0x100
jl 0x44cd50
lea eax, [esp + 0x18]
push 0
push pe_nt_image_headers32
push eax
call fcn.0045c4d0
add esp, 0xc
mov edx, dword [esp + 0x14]
push pe_nt_image_headers32
mov eax, dword [esp + 0x128]
push edx
push eax
call fcn.00459330
add esp, 0xc
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x44cf20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x174
push esi
push edi
mov esi, dword [esp + 0x194]
mov dword [esi], 0
mov ecx, dword [eax]
test ecx, ecx
jne 0x44cf4c
mov ax, 0xcc
pop edi
pop esi
add esp, 0x174
ret
lea eax, [esp + 0x20]
mov edx, dword [esp + 0x184]
push eax
push edx
push ecx
call fcn.0044cbc0
add esp, 0xc
test ax, ax
jne 0x44d098
xor eax, eax
mov al, byte [esp + 0x190]
test eax, eax
je 0x44cf94
cmp eax, 1
je 0x44d00e
mov ax, 0xa
pop edi
mov dword [esi], 0
pop esi
add esp, 0x174
ret
mov eax, dword [esp + 0x188]
test eax, eax
je 0x44cfb5
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00459330
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00459490
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 0x18
shr cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x44cfcb
xor eax, eax
mov dword [esp + 8], edi
lea ecx, [esp + 0xb]
mov dl, byte [esp + eax + 0x1c]
sub ecx, eax
inc eax
xor byte [ecx], dl
cmp eax, 4
jb 0x44cff6
mov eax, dword [esp + 8]
jmp 0x44d07f
mov eax, dword [esp + 0x188]
test eax, eax
je 0x44d02f
mov ecx, dword [esp + 0x18c]
push ecx
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00459330
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
xor edi, edi
push ecx
call fcn.00459490
add esp, 8
xor eax, eax
xor ecx, ecx
xor edx, edx
mov cl, byte [esp + eax + 0xc]
inc eax
mov cl, byte [esp + ecx + 0x7c]
and cl, 3
mov dl, cl
lea ecx, [eax*2 - 2]
shl edx, cl
or edi, edx
cmp eax, 0x10
jb 0x44d045
xor eax, eax
mov dword [esp + 8], edi
mov cl, byte [esp + eax + 0x1c]
xor byte [esp + eax + 8], cl
inc eax
cmp eax, 4
jb 0x44d06d
mov eax, dword [esp + 8]
push 0
mov dword [esi], eax
lea eax, [esp + 0x24]
push 0x15c
push eax
call fcn.0045c4d0
xor ax, ax
add esp, 0xc
pop edi
pop esi
add esp, 0x174
ret