joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100243f0], 0
push esi
je 0x100045c1
xor esi, esi
nop
cmp esi, 0x50
jae 0x1000457f
inc esi
cmp byte [esi + str.vm_text____START___n], 0
jne 0x10004570
test esi, esi
je 0x100045c1
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x100045c1
push dword [ebp - 0x10c]
push esi
push 1
push str.vm_text____START___n
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x8adfff
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004665
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x104]
push str.VirtualProtect___Error_Code:__d_n
push eax
call fcn.10004ac0
add esp, 0xc
cmp byte [0x100243f0], 0
je 0x10004665
xor esi, esi
cmp byte [ebp - 0x104], 0
je 0x10004665
cmp esi, 0x50
jae 0x10004621
inc esi
cmp byte [ebp + esi - 0x104], 0
jne 0x10004611
test esi, esi
je 0x10004665
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x10004665
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push esi
push 1
push eax
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
call fcn.10003c10
push 0
push dword [ebp - 0x108]
push 0x8adfff
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004714
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x104]
push str.VirtualProtect___Error_Code:__d_n
push eax
call fcn.10004ac0
add esp, 0xc
cmp byte [0x100243f0], 0
je 0x10004771
xor esi, esi
cmp byte [ebp - 0x104], 0
je 0x10004714
nop dword [eax]
cmp esi, 0x50
jae 0x100046d0
inc esi
cmp byte [ebp + esi - 0x104], 0
jne 0x100046c0
test esi, esi
je 0x10004714
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x10004714
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push esi
push 1
push eax
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
cmp byte [0x100243f0], 0
je 0x10004771
xor esi, esi
nop
cmp esi, 0x50
jae 0x1000472f
inc esi
cmp byte [esi + str.vm_text____OK___n], 0
jne 0x10004720
test esi, esi
je 0x10004771
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x10004771
push dword [ebp - 0x10c]
push esi
push 1
push str.vm_text____OK___n
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10004b6e
mov esp, ebp
pop ebp
ret
Function at 0x10004780
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100243f0], 0
push esi
je 0x100047f1
xor esi, esi
nop
cmp esi, 0x50
jae 0x100047af
inc esi
cmp byte [esi + str.vm_rdata____START___n], 0
jne 0x100047a0
test esi, esi
je 0x100047f1
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x100047f1
push dword [ebp - 0x10c]
push esi
push 1
push str.vm_rdata____START___n
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push 0x40
push 0x1026db
push 0xcaf924
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10004895
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x104]
push str.VirtualProtect___Error_Code:__d_n
push eax
call fcn.10004ac0
add esp, 0xc
cmp byte [0x100243f0], 0
je 0x10004895
xor esi, esi
cmp byte [ebp - 0x104], 0
je 0x10004895
cmp esi, 0x50
jae 0x10004851
inc esi
cmp byte [ebp + esi - 0x104], 0
jne 0x10004841
test esi, esi
je 0x10004895
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x10004895
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push esi
push 1
push eax
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
push 0
push dword [ebp - 0x108]
push 0x1026db
push 0xcaf924
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1000493c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x104]
push str.VirtualProtect___Error_Code:__d_n
push eax
call fcn.10004ac0
add esp, 0xc
cmp byte [0x100243f0], 0
je 0x10004998
xor esi, esi
cmp byte [ebp - 0x104], 0
je 0x1000493c
cmp esi, 0x50
jae 0x100048f8
inc esi
cmp byte [ebp + esi - 0x104], 0
jne 0x100048e8
test esi, esi
je 0x1000493c
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x1000493c
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push esi
push 1
push eax
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
cmp byte [0x100243f0], 0
je 0x10004998
xor esi, esi
cmp esi, 0x50
jae 0x10004956
inc esi
cmp byte [esi + str.vm_rdata____OK___n], 0
jne 0x10004947
test esi, esi
je 0x10004998
push 0x100208ac
lea eax, [ebp - 0x10c]
push str.._elementclient.log
push eax
call fcn.1000b85d
add esp, 0xc
test eax, eax
jne 0x10004998
push dword [ebp - 0x10c]
push esi
push 1
push str.vm_rdata____OK___n
call fcn.1000bb69
push dword [ebp - 0x10c]
call fcn.1000bcc8
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10004b6e
mov esp, ebp
pop ebp
ret
Function at 0x100049b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
jne 0x100049f3
call fcn.10004550
call fcn.10004780
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 0
push 0
push 0x10004200
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
call fcn.10004320
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.10004b6e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000c449
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000c488
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000c488
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000c488
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000c488
cmp dword [ecx + 0x74], 0xe
jbe 0x1000c488
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x1000d458
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c610
push 0x1001c608
push str.FlsAlloc
push 0x1f
call fcn.1000d374
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d48c
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b14c]
call esi
jmp 0x1000d492
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1000d4d6
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c620
push 0x1001c618
push str.FlsGetValue
push 0x21
call fcn.1000d374
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d50d
push dword [ebp + 8]
mov ecx, esi
call dword [0x1001b14c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1000d515
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1001c628
push 0x1001c620
push str.FlsSetValue
push 0x22
call fcn.1000d374
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000d54f
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1001b14c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100122fc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10012399
push ebx
push esi
call fcn.100122c5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10012259
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10012346
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012398
push edi
push eax
call fcn.1000d6b4
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10012366
call fcn.1000d67a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10012397
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10012259
add esp, 0x20
test eax, eax
jne 0x10012385
push edi
call fcn.1000d67a
jmp 0x1001238d
push ebx
call fcn.1000d67a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x1001611e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10024000]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x1001615e
cmp byte [ebx], 0xa
jne 0x1001615e
or byte [edi + eax + 0x28], 4
jmp 0x10016163
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10016262
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10016245
inc eax
cmp dl, 0xd
je 0x1001618f
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x100161b5
cmp eax, ecx
jae 0x100161c3
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10016177
jmp 0x10016262
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10016240
cmp dword [ebp - 0x10], 0
je 0x10016240
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10024000]
test byte [eax + edi + 0x28], 0x48
je 0x1001621a
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10016205
mov byte [esi], dl
jmp 0x10016216
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10024000]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10016262
cmp byte [ebp - 1], 0xa
jne 0x10016229
cmp esi, ebx
jne 0x10016229
mov byte [esi], 0xa
jmp 0x10016261
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.1001608e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10016262
mov byte [esi], 0xd
jmp 0x10016261
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10024000]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x1001625f
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10016262
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x1001626b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10024000]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x100162b1
cmp word [ebx], dx
jne 0x100162b1
or byte [eax + edi + 0x28], 4
jmp 0x100162b6
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10016419
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x100163f9
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x100162f7
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x1001632d
cmp eax, edx
jae 0x1001633b
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x100162d2
jmp 0x10016419
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100163f4
cmp dword [ebp - 0x18], 0
je 0x100163f4
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10024000]
test byte [eax + edi + 0x28], 0x48
je 0x100163ca
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x1001638e
mov word [esi], cx
jmp 0x100163c5
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10024000]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10024000]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10024000]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10016419
pop eax
cmp word [ebp - 4], ax
jne 0x100163da
cmp esi, ebx
jne 0x100163da
mov word [esi], ax
jmp 0x10016416
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.1001608e
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10016419
push 0xd
pop eax
jmp 0x100163d5
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10024000]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10016413
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10016419
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10018121
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1001809d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10018290
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10018290
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10018245
jg 0x1001817d
test eax, eax
je 0x1001823b
push 1
push 0x1000
call fcn.10010e00
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100181a0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10018232
push 0x8000
push ebx
call fcn.10017fce
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100181c9
jg 0x100181c4
cmp ecx, 0x1000
jb 0x100181c9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001023b
add esp, 0x10
cmp eax, 0xffffffff
je 0x1001820e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100181c4
jl 0x100181f5
test ecx, ecx
jne 0x100181b6
push dword [ebp - 0xc]
push ebx
call fcn.10017fce
push esi
call fcn.1000d67a
add esp, 0xc
xor ebx, ebx
jmp 0x1001829e
cmp byte [edi + 0x24], 0
je 0x10018225
cmp dword [edi + 0x20], 5
jne 0x10018225
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10018230
mov ebx, dword [edi + 0x18]
jmp 0x10018232
xor ebx, ebx
push esi
call fcn.1000d67a
pop ecx
jmp 0x1001829e
test ecx, ecx
jg 0x10018207
jl 0x10018245
test eax, eax
jae 0x10018207
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001608e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10018265
cmp byte [edi + 0x1c], 0
je 0x10018207
jmp 0x10018296
push ebx
call fcn.10015313
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10018207
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1001829e
cmp byte [edi + 0x1c], 0
je 0x1001829b
mov ebx, dword [edi + 0x18]
jmp 0x1001829e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001608e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001a2d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001a2fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001a2fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43ab47
Capabilities:
Encode data using xor

Disassembly:
invalid
int 0x60
jmp 0x43ab72
inc byte [ecx - 0x47]
sub byte [edx + 0x41], ch
scasd eax, dword es:[edi]
fsubr dword [esi - 0x1f]
rcl byte [edx], cl
xchg ecx, eax
inc ecx
pop esp
bound ecx, qword [esp + edi*2]
mov ch, 0x91
add al, 0x2b
insb byte es:[edi], dx
jno 0x43ab2e
add esi, ecx
sbb ch, byte [ebp + 0x5d]
outsd dx, dword [esi]
add byte [ebx - 0x7c], bl
in eax, dx
out dx, eax
fld dword [edx - 0x51]
ja 0x43ab95
int1
inc ebx
mov dl, 0xed
pop edx
pop ds
fsubr st(4)
pop edi
ljmp 0x2c7
jne 0x43ab3b
add al, byte [eax]
invalid
add byte [edi + 0x68c81866], cl
add eax, 0x84e63404
mov esp, 0xdbd609e4
xor esi, ecx
outsb dx, byte [esi]
and ah, dh
inc ebp
dec esi
lcall 0x87c6, 0x8f042003
mov al, byte [0xe1dcdbd2]
pushfd
fcmovnu st(0), st(4)
loope 0x43ab35
pop es
push es
sti
add edi, ebx
popfd
out 0x7c, eax
xchg byte [eax + 0x1b], ah
adc byte [edx + 0x66c4d8b4], 0x49
inc ebx
vmovhps xmm2, xmm0, qword [ecx - 0x7d38af69]
pop esi
xchg ebp, eax
push ss
xchg esi, eax
sbb ebp, dword [ecx - 0x44b943c6]
outsb dx, byte [esi]
movsd dword es:[edi], dword [esi]
sar byte [edi], cl
inc esi
mov ebx, 0x3fd2a56e
xor al, 0x58
stosb byte es:[edi], al
fld qword [esi + 0x3fb9a0d8]
dec ebx
dec edx
jno 0x43abbd
mov ebx, 0xd8de10d1
test esp, edx
jp 0x43ab75
mov ah, byte [ebp - 0x1b]
mov al, byte [0x1a6899dd]
adc al, 0xae
lodsb al, byte [esi]
cmp eax, 0x5af1f714
cmp dword [0x14d4bbe4], esp
and dword [0xacf8eb22], 0xdc2168d9
mov bl, 0xb8
mov dh, byte [ebp + 0x39]
mov esp, 0x4ead918
cmp dword [ecx + 0x7b], eax
cli
cmpsb byte [esi], byte es:[edi]
mov al, byte [0xdfb30ef0]
mov dh, 0x7a
add edi, dword [edi]
ret 0xc118

Function at 0x497897
Capabilities:
Encode data using xor

Disassembly:
sub al, 2
out 0x15, eax
dec eax
cmpsb byte [esi], byte es:[edi]
stosd dword es:[edi], eax
daa
xor dword [ecx - 0x5f5612a0], ebp
adc edx, dword [edx]
add esi, esp
pop ebx
mov byte [0xaec353a3], al
hlt
fstp dword [eax]
sti
jmp 0xa94b480a
xor dword [edx + edx - 0x4854bd25], ecx
mov al, byte [0x88fbfcae]
sub edx, edx
push edi
xor byte [edx - 0x1e25cf5e], dl
mov ecx, 0xe91d8462
invalid
invalid
invalid
loope 0x49782f
loope 0x49784f
bound eax, qword [ebp + ebx - 0x326c1e17]
test byte [0xcd93e1e9], bl
int 0x17
pop ss
mov bl, 0x77
mov dh, 0x36
idiv cl
bnd jne 0x497880
mov ecx, 0x6aab00ed
popfd
int 0xe8
jle 0x497894
daa
sub edi, dword [esi]
shl byte [eax + 0x77d00e84], 0xf5
int 0xcc
lahf
test byte [esi], dl
cmc
aas
cmpsb byte [esi], byte es:[edi]
or esp, edx
sar ecx, 1
or al, bl
push cs
mov ah, byte [ebp - 0x228169ce]
test al, ah
inc edi
or al, 9
iretd
Function at 0x4a3213
Capabilities:
Encode data using xor

Disassembly:
mov esi, esi
mov ebx, ebx
mov esi, esi
mov edi, edi
mov esi, esi
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
in eax, 0x2b
loope 0x4a3121
clc
nop
out 0xad, eax
adc eax, 0x36c9457b
or ebp, dword [ecx + 0x4bf452df]
mov dh, 0x52
xchg dword [esi], esp
popal
mov al, byte [0x679e12d3]
aad 0xc1
xor byte [ebx - 0x44c03593], dh
outsd dx, dword [esi]
mov dh, 0xcd
add esi, ebx
shl dword [ebp - 0x73], 0xa4
sbb bl, dh
pop edx
invalid
jnp 0x4a318d
adc edx, ebx
salc
popal
xchg byte [edi + ebp*4 - 0x7575651e], ah
mov esi, 0xc9174e08
jnp 0x4a31d0
int 0x3e
xor esp, dword [ebx + 0x52]
out dx, eax
mov eax, 0xf45b5bb6
mov ebx, 0x7a219a6
mov dword [0x9c0e8e8d], eax
lodsb al, byte [esi]
mov ah, cl
scasb al, byte es:[edi]
push es
std
mov dh, 0x66
invalid
mov dword [0x80e4dbdc], eax
in eax, 0x77
wait
push es
je 0x4a322e
add eax, 0xcaa07e54
jge 0x4a32a5
lodsb al, byte [esi]
clc
dec ecx
and dword [ebp - 0x5e], 0xffffffbe
daa
mov edx, 0x694e5476
vmptrld qword [ecx + edx*2]
inc eax
scasb al, byte es:[edi]
sbb ecx, esp
and eax, 0xe09d89c4
popfd
ja 0x4a31d2
and eax, 0xcd63f0d1
push esp
or ebp, dword [ecx]
fistp dword [ecx - 0x4d5097b5]
xor al, 0x49
insd dword es:[edi], dx
les esp, [eax]
ror dword [edx - 0xd944198], 0x49
xchg esi, eax
push ss
invalid
sub dh, byte [ecx - 0x1f2300f]
xor eax, 0x772ecadd
or eax, 0xd1304d1c
or eax, 0xcadd35fe
ja 0x4a32ba
sbb al, 0x4d
xor cl, dl
out dx, eax
neg ah
rcr ah, 0xae
mov ah, 0xa9
invalid
push edi
cmp bl, byte [edx + 0x6e591f85]
mov al, 0x22
jle 0x4a32a1
jnp 0x4a32e6
test eax, eax
cdq
sbb byte [esi + ecx*2], 0x53
jle 0x4a32db
test dword [ebp - 0x1746a35e], 0x96275024
xor al, 0x68
sal byte [ebx + 0xd], 0xbd
push 0xbd0d73c0
cmpsd dword [esi], dword es:[edi]
les edx, [bx - 0x68dd]
scasb al, byte es:[edi]
sti
loope 0x4a3364
cmp eax, dword [esp + ebp*4]
popal
scasb al, byte es:[edi]
pop ds
sbb cl, bh
push 0x59d1a509
sub eax, 0xfe75c3cc
inc edi
push edx
cmp esp, edi
or byte [eax + 0x3b], 0x52
jle 0x4a3364
pop ecx
clc
sub dh, ah
bound ecx, qword [ebp + 0x15d03681]
pop edx
jo 0x4a3340
or ebx, dword [eax]
std
test dword [esi], edx
xor ebx, dword [eax + 0x76855e26]
xor ebp, dword [esi - 0x369870ba]
xchg esi, eax
test al, 0x2c
pop edi
add byte [edi + edx*4 + 0x3f2584cd], 0x62
xchg edi, eax
int1
mov ebx, 0x3f3317a3
cmp eax, 0xec53cf67
jl 0x4a3311
rol byte [eax - 0x55], 1
inc eax
stosd dword es:[edi], eax
add al, 0x54
mov eax, dword [0x20677f44]
outsd dx, dword [esi]
insd dword es:[edi], dx
iretd
mov ch, 0xa4
push eax
scasd eax, dword es:[edi]
enter 0x46c2, 0x2c
or al, 0x8f
or esp, 0xd0508f1f
sbb al, 0x43
cmc
out dx, al
xor bl, byte [edx]
pop eax
inc bh
mov bh, byte [edx - 0x43e92158]
jg 0x4a33cc
test eax, 0x89db8957
in eax, dx
mov eax, eax
mov edi, edi
mov ecx, ecx
mov esi, esi
mov esi, esi
mov ecx, ecx
mov edx, edx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cld
invalid
Function at 0x4af835
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x96bb65c5
wait
cmp ah, byte [esi]
test cl, 0x28
mov bl, 0x76
arpl di, bp
stosb byte es:[edi], al
movsb byte es:[edi], byte [esi]
sbb ecx, edi
int3
aad 0xbe
xchg byte [edi + 0x1b], ch
ficomp dword [ecx - 0x5f233740]
mov byte [ebx], bl
salc
js 0x4af80a
mov al, byte [0xa343f816]
pop esi
mov dword [0x4f768a6e], eax
out dx, al
fucompi st(6)
inc ebx
in al, 0x43
in eax, 0xc7
sub ebp, edi
scasb al, byte es:[edi]
invalid

Function at 0x4b58b1
Capabilities:
Encode data using xor

Disassembly:
insb byte es:[edi], dx
cwde
or byte [eax + ebp*4 - 0x3392f0af], bh
pop ecx
wait
cmp dword [ebx - 0x131753b7], ebp
pop esp
salc
xor byte [ecx - 0xf], ch
xor eax, dword [ebp - 0x17]
jno 0x4b5884
ret
popfd
rcr byte [edx - 0x3b5751e6], cl
xor byte [di - 6], ch
sbb byte [edx], ah
add eax, ebx
pop ecx
fldcw word [ecx - 0x61]
mov byte [0x2891ed41], al
fdivr qword [edx + 0x39]
adc byte [edi - 0x4771e3fd], ch
aad 0x66
xor dword [eax - 0x44fea4ed], ecx
inc ebp
out dx, al
test eax, 0xa6b8ffd8
loopne 0x4b5883
lahf
cmpsd dword [esi], dword es:[edi]
pop ebx
mov eax, dword [0xf638f879]
mov dword [0x43071470], eax
outsb dx, byte [esi]
clc
mov eax, dword [0xd6febbca]
push ds
invalid

Function at 0x4ba400
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0x10], eax
push str.TEdit2213
push str.TCaption2212
call fcn.00417e10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4ba44b
lea edx, [ebp - 0x14]
push edx
mov eax, dword [0x4c7aac]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp fcn.007541a0