joyce8/EMBER2024-capa huggingface dataset:
Function at 0x593820
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [sym.imp.msvcrt.dll__iob]
lea eax, [esp + 0x34]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
add ebx, 0x40
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
mov dword [esp + 0x1c], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x1c]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x593880
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x5c
mov dword [esp + 0x4c], ebx
mov ebx, eax
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x50], esi
mov esi, edx
mov dword [esp + 0x54], edi
mov edi, ecx
mov dword [esp + 0x58], ebp
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x593976
mov eax, dword [esp + 0x38]
cmp eax, 4
jne 0x5938f0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
cmp eax, 0x40
je 0x5938c5
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
cmp eax, 0x40
setne byte [esp + 0x1e]
cmp eax, 4
setne byte [esp + 0x1f]
call sub.msvcrt.dll_memcpy
cmp byte [esp + 0x1f], 0
je 0x5938d5
cmp byte [esp + 0x1e], 0
je 0x5938d5
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
jmp 0x5938d5
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00593820
nop

Function at 0x593c10
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x65fa6c
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x65fa84]
sub esp, 4
test ebx, ebx
je 0x593c5b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x593c54
test esi, esi
je 0x593c54
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x593c30
mov dword [esp], 0x65fa6c
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
Function at 0x599db5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, eax
mov edi, dword [eax]
mov ebx, dword [edi + 0x160]
cmp edx, 0x1f
jne 0x599f97
lea ebp, [ebx + 0x1cb0]
lea edx, [ebx + 0x1eb0]
mov byte [ebx + 0x1cb0], 0xff
lea eax, [ebx + 0x1cb1]
mov dword [ebx + 0x1eb0], eax
cmp edx, eax
jbe 0x599e05
mov byte [ebx + 0x1cb1], 0xfa
lea eax, [ebx + 0x1cb2]
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599e19
mov byte [eax], 0x1f
inc eax
mov dword [ebx + 0x1eb0], eax
movzx eax, word [ebx + 0x1ca8]
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.WS2_32.dll_htons
push edx
mov word [esp + 0x2c], ax
movzx eax, word [ebx + 0x1caa]
mov dword [esp], eax
call sub.WS2_32.dll_htons
push ecx
mov word [esp + 0x2e], ax
mov eax, dword [ebx + 0x1eb0]
mov edx, dword [esp + 0x1c]
cmp edx, eax
jbe 0x599e62
mov cl, byte [esp + 0x2c]
mov byte [eax], cl
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599e79
mov cl, byte [esp + 0x2d]
mov byte [eax], cl
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599e90
mov cl, byte [esp + 0x2e]
mov byte [eax], cl
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599ea7
mov cl, byte [esp + 0x2f]
mov byte [eax], cl
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599ebb
mov byte [eax], 0xff
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
cmp edx, eax
jbe 0x599ecf
mov byte [eax], 0xf0
inc eax
mov dword [ebx + 0x1eb0], eax
mov eax, dword [ebx + 0x1eb0]
mov dword [ebx + 0x1eb4], eax
mov dword [ebx + 0x1eb0], ebp
lea ecx, [ebx + 0x1cb2]
sub eax, ebp
sub eax, 2
mov dword [esp], eax
mov edx, 0x3e
mov eax, edi
call fcn.00599a1c
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], ebp
mov eax, dword [esi + 0x154]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x599f3d
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 8], eax
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp], edi
call fcn.0040dcf0
lea edx, [ebx + 0x1cb3]
mov ecx, 4
mov eax, esi
call fcn.00425bec
mov dword [esp + 0xc], 0
mov dword [esp + 8], 2
add ebx, 0x1cb7
mov dword [esp + 4], ebx
mov eax, dword [esi + 0x154]
mov dword [esp], eax
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
jns 0x599f97
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 8], eax
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp], edi
call fcn.0040dcf0
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x59a0e0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push ebx
sub esp, 0x34
mov ebx, eax
mov esi, dword [eax]
mov byte [esp + 0x2d], 0xff
mov byte [esp + 0x2e], cl
mov al, byte [esp + 0x40]
mov byte [esp + 0x2f], al
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
lea eax, [esp + 0x2d]
mov dword [esp + 4], eax
mov dword [esp], edx
mov dword [esp + 0x1c], ecx
call sub.WS2_32.dll_send
sub esp, 0x10
test eax, eax
mov ecx, dword [esp + 0x1c]
jns 0x59a146
call sub.WS2_32.dll_WSAGetLastError
mov dword [esp + 8], eax
mov dword [esp + 4], str.Sending_data_failed___d_
mov dword [esp], esi
call fcn.0040dcf0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov edx, str.SENT
mov eax, dword [ebx]
call fcn.00599f9f
add esp, 0x34
pop ebx
pop esi
ret
Function at 0x59a490
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00593bf0
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x59a4c6
jmp 0x59a505
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x59a4c3
cmp al, 0x20
je 0x59a4c3
cmp al, 0x22
jne 0x59a4e9
jmp 0x59a554
cmp al, 0x20
lea esi, [esi]
je 0x59a4f0
test al, al
je 0x59a505
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
jne 0x59a4d7
movzx eax, byte [ebx]
cmp al, 0x20
jne 0x59a56a
add ebx, 1
movzx eax, byte [ebx]
cmp al, 9
je 0x59a4f7
cmp al, 0x20
je 0x59a4f7
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x59a514
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00401820
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
cmp al, 0x22
je 0x59a55e
add ebx, 1
movzx eax, byte [ebx]
test al, al
jne 0x59a550
cmp al, 0x22
sete al
movzx eax, al
add ebx, eax
jmp 0x59a4f0
cmp al, 9
je 0x59a4f7
jmp 0x59a505
Function at 0x416b8f
Capabilities:
Encode data using xor

Disassembly:
aad 0x13
push edx
call 0x8b20f401
xchg edi, eax
mov ah, 0xb7
out dx, al
jp 0x416bb3
inc edx
test byte [eax], 0xf0
adc al, 0xe5
sub dh, byte [ebx]
jg 0x416be1
sbb ah, byte [esi - 0x58937009]
invalid
mov edi, 0x728d0860
mov esp, 0xc4ebcce
pop ds
add edx, dword [esi]
dec esi
add al, 0xa6
adc al, 0x9c
outsb dx, byte [esi]
inc esp
lodsb al, byte [esi]
enter 0xffffffffffffe36f, 0xffffffffffffffd4
push edx
add al, 0xe6
pop eax
xor al, 0x90
jnp 0x416bcd
daa
pop eax
aaa
pushal
movsd dword es:[edi], dword [esi]
int 0x8c
scasd eax, dword es:[edi]
not byte [esi + 9]
iretd
jb 0x416c42
outsd dx, dword [esi]
stc
popfd
mov eax, 0xbfe360dc
xor dword [0x686e2aac], eax
jg 0x416c66
mov bl, 0xf7
push esp
mov byte [esi + 0x5f], al
ret 0x3b28
out dx, al
call 0x9c506e79
xor byte [edi + 0x7c450bd9], dl
and cl, cl
mov dword [0x85c460e4], eax
pushfd
stc
sub bh, byte [edi]
int 0xc1
and eax, 0x3524d9c1
test eax, 0x97576518
xor byte [edx + 0x5bf3b9a2], ah
mov byte [0x5bf3b9a2], al
jmp [ebx]

Function at 0x4175cb
Capabilities:
Encode data using xor

Disassembly:
dec eax
out 0x28, al
xchg byte [edx - 0x1f579df0], dh
xor dword [ecx + 0x6d], edi
jns 0x41763a
jns 0x41763a
push edx
dec esp
xchg ah, al
jbe 0x4175c2
cmp eax, edi
sub al, 0x18
mov edi, 0x367e85b6
adc ebp, esp
xor dh, byte [0x3152cd58]
push ds
inc esi
jmp 0x41761b
sbb byte [edi + 0x5687b7a0], al
add eax, esi
loope 0x4175b8
xchg esp, eax
add dword [edi + 0x34420f55], esp
scasb al, byte es:[edi]
invalid
dec eax
nop
adc byte [edx - 0x1d28dd0a], 0xee
add edi, 0x48c5c022
invalid
Function at 0x437e7e
Capabilities:
Encode data using xor

Disassembly:
mov dword [ebp + 0x44], eax
mov bh, 0x38
push edx
xor ecx, dword [edx + 0x1c]
adc al, 0xc0
test dword [ecx + 0xa361c1e], ebx
pop ecx
xor eax, 0x787744ad
fild dword [eax]
loop 0x437eab
add al, 0x72
loopne 0x437e45
test dword [eax + 0x5d], ecx
or byte [esi - 0x39d5c3a8], dh
outsb dx, byte [esi]
xchg ecx, eax
pushal
pushfd
mov esp, 0x25f162d4
inc ecx
push ds
xor edx, esp
adc edi, eax
mov eax, 0x34491015
adc eax, 0xcb344910
adc eax, 0xcb344910
in eax, dx
mov ebx, 0xbd2cc1b3
cmp al, 0xc
and eax, dword [ebp + 0x64]
test eax, 0xe9faf402
push ebp
lodsd eax, dword [esi]
fidiv dword [ebp - 0x2745bfbb]
mov byte [0x6ffb9a14], al
pop ss
jp 0x437e57
push 0x2e
movsd dword es:[edi], dword [esi]
and ah, byte [eax - 0x7636d46d]
mov esp, 0x9bc2ddc3
sub ebx, dword [ebp - 0x1d9739a]
pop esi
stosd dword es:[edi], eax
mov dword [0x841dc66f], eax
lodsd eax, dword [esi]
cmpsb byte [esi], byte es:[edi]
xchg esp, eax
loop 0x437f0c
mov dword [ebx + eax*8 + 0x2b9bc2dd], edi
popfd
mov word [esi], fs
invalid
pop esp
out 0x26, al
xor dword [ebx - 0x78a0091b], esp
popal
out dx, al
cmpsb byte [esi], byte es:[edi]
sub esp, dword [edi - 0x78d4d982]
sub dword [esi - 0x3b73b3ef], esp
popfd
sbb byte [ebp + 0x26], 0x16
scasb al, byte es:[edi]
xor byte [ebp - 0x33], ch
dec ecx
dec ebx
vshufps ymm7, ymm0, ymmword [esi + 0x3d47d0f4], 0xd1
dec esp
push edi
or ecx, dword [0xecd1b498]
shr esp, 1
mov edx, 0x234cb921
and cl, dl
cmpsb byte [esi], byte es:[edi]
mov al, 0xdb
sbb bl, byte [ecx - 0x957b5d3]
popfd
lcall 0xa3f1, 0x9c59e69d
inc ebx
in eax, 0x1e
adc al, 0x50
pop ecx
pushfd
int1
mov dword [0x141ee543], eax
push eax
salc
xor al, 0x59
xchg edx, eax
sbb dword [esi + 0x1a], ebp
call 0xdcf1bb35
pop ecx
jle 0x437ef6
scasb al, byte es:[edi]
or eax, 0x166d6559
arpl word [ebp + 0x68], dx
pop esi
mov eax, dword [0xb618f84d]
adc eax, 0x9c2bf8ad
or byte fs:[esi + 0x37e32bdf], ah
lahf
scasb al, byte es:[edi]
xor byte [esi], bh
popfd
dec esi
sahf
cmpsb byte [esi], byte es:[edi]
retf

Function at 0x43a34c
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [esi - 0x174895d3]
mov bh, 0xe8
aas
enter 0x6c, 0x61
setne bl
loope 0x43a396
movsd dword es:[edi], dword [esi]
sub byte [esi + ecx*2 - 0x6a], bl
mov ah, 0x29
sub dword [edx + 0x5633d77a], esp
out 0xbb, eax
clc
fidivr word [eax - 0x108bb58a]
outsd dx, dword [esi]
imul eax, dword [esi], 0xffffff94
jbe 0x43a3bd
adc byte [edx - 9], bl
mov byte [0xdc176a09], al
cmc
push esi
loopne 0x43a33e
stc
add dh, ch
pop edx
idiv dword [ebx + 0x1f]
pop ebx
and ch, al
mov esi, 0xe14d6296
xchg ebp, eax
aaa
adc eax, 0x86c92bf9
jle 0x43a342
jle 0x43a3c3
mov gs, word [edx]
out dx, eax
sub eax, 0xd266c28a
outsb dx, byte [esi]
cmp eax, 0xa54ad212
cdq
sbb esi, ecx
enter 0x2a37, 0x68
or byte [edx - 0x790b685e], cl
imul ebx, dword [eax + 0x17229e68], 0xffffff84
push esp
inc eax
sub eax, 0x3b2abe2d
mov ah, 0x86
ret 0xd266
inc esp
inc ebx
mov eax, 0xe8d7e9cd
fidivr dword [eax - 0x17]
cmp byte [eax + ebx*8], dl
call 0x392d1ca2
adc al, 0xd8
leave
mov ah, 0x61
test dh, bl
mov byte [edi - 0x6089d999], al
cwde
salc
stosd dword es:[edi], eax
mov ah, 0x48
in al, dx
add al, 0xb5
sysret
Function at 0x473af0
Capabilities:
Encode data using xor

Disassembly:
push ds
std
or byte [edi + 0x4cd48a89], ch
mov dword [ebx + edx + 0x14339541], ebx
setp bl
wait
push es
and byte [esi - 0x7cf0a757], al
sbb dword [eax + 0x6a], ebp
add al, 0x1f
xchg ebp, eax
xor edx, dword [edi + ecx]
lcall 0xa986, 0x20069be3
pop eax
jae 0x67b1a2cd
add al, 0x1f
inc ebx
in eax, dx
adc eax, 0x689bce96
xchg esi, eax
into
wait
push 0x123a47b4
xchg esi, eax
into
wait
push 0x123a47b4
push edx
bswap esi
add eax, 0x3818c2da
or cl, byte fs:[edi]
and eax, 0x8e77b90f
pop eax
xor eax, 0x1f0d2b23
add eax, 0x3c7d35cf
jl 0x473aa2
loop 0x473a96
sub dword [ebp + ebp + 0xa], ecx
cmp ch, byte [0x89d55979]
mov ch, 0x5d
sub dword [edi - 0x4a68e4f5], ecx
xchg edi, eax
mov ch, 0xcd
inc ebx
popfd
popfd
jl 0x473af5
popfd
sub ax, 0xab73
je 0x473abc
lcall 0x553e, 0x4ce6db5
jg 0x473aad
jo 0x473b21
sub bh, byte [edx + 0x11]
fsubr dword [edi + edx + 2]
invalid
lea edx, [ebx + 4]
dec ebp
sbb al, 0x3c
xchg ebp, eax
clc
sbb al, 0xc5
dec ebx
and ecx, dword [esi + 0x29fae082]
xchg ebp, eax
dec ecx
invalid

Function at 0x48ab97
Capabilities:
Encode data using xor

Disassembly:
fsub qword [ebp - 0x1ecbb598]
dec edx
xor al, 0xe1
out 0xaf, al
and eax, 0x16472aa1
mov edi, 0xe9e30d4a
push 0x9a876db8
pop ebp
xor eax, dword [eax + 0x47b23db0]
cmpsb byte [esi], byte es:[edi]
lea edx, [eax]
jge 0x48ab9a
pop ecx
mov esi, 0x270d06d1
stosb byte es:[edi], al
and al, byte [esi]
xor dword [ebx], 0xff2ddde4
hlt
Function at 0x495fc8
Capabilities:
Encode data using xor

Disassembly:
sub ecx, dword [ebx - 0x1e]
out 0x68, al
mov dl, byte [esi + 0x24]
cmp byte [edi], dh
int3
movsb byte es:[edi], byte [esi]
lahf
dec esi
push ecx
loop 0x496017
push ss
invalid
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
movsd dword es:[edi], dword [esi]
popal
leave
adc ecx, dword [ebx - 0x39fa9a6c]
jne 0x495fbd
mov edi, 0x2110b8fb
shl dword [ecx + 0x780f6a97], cl
lds esi, [eax - 0xe37350f]
add dword [edi + edx*4 - 0x7f], 0xdd405cda
adc esi, eax
inc ecx
sahf
and dword [eax + 0x55487732], edx
xchg dword [ebp + 0x250b97cb], esi
mov al, 0xaa
retf 0xf094
jg 0x495fd5
test al, 0xbc
mov ah, 0xa6
inc eax
fdivr st(0), st(0)
les ebp, [edx]
fsub st(6), st(0)
test eax, eax
xchg dword [esi - 0x58], ebp
popfd
loop 0x49603c
ror byte [ecx], 1
adc ch, byte [edx + 0x4bcc5905]
cwde
js 0x4960b3
les edx, [ebx - 0x41638553]
mov ah, 0
popfd
inc esi
jp 0x495fd8
mov esi, 0x469d00b4
pop ebx
fpatan
dec esi
add dword [ecx + 0x29560487], esp
lcall 0xa830, 0xa82643d8
clc
push esi
les ebx, [esi]
fmul dword [edx]
push edx
je 0x49603a
jl 0x4960ce
or dl, byte [ebp + 0x66]
fidiv dword [edi + ecx*2 - 0x70]
cdq
xchg esi, eax
invalid
aas
lodsd eax, dword [esi]
xor al, byte [esp + ebx*8 - 0x32d6ad07]
sub eax, 0xb8d85e3e
cdq
hlt
sub bh, byte [ebp - 0x74c8462e]
xor eax, 0x92a8228
mov ecx, 0x28358b37
sub byte [edx], 9
sub eax, 0xacb958ec
pop es
inc eax
sbb esp, dword [edi + 0x2108761b]
jg 0x4960cb
mov dword ds:[eax], esp
inc ebx
mov esp, 0x88cb3f35
and byte [ebx + 0x3e], al
mov esp, 0x88cb3f35
mov bh, 0xba
mov edi, 0x7e984b59
or ecx, dword [eax + esi*4 + 0x148c1e33]
aas
outsd dx, dword [esi]
jno 0x4960e7
cmp byte [ebp - 0x473b6736], cl
aam 0xad
cmp al, 0xbb
das
stosb byte es:[edi], al
inc esp
sbb ah, byte [edx]
out dx, al
pop ebx
xor al, 0xed
and al, 0x3a
mov es, esi
test al, 0x16
mov eax, 0x40b1a0a5
cmp ebx, esi
push ebp
mov ecx, 0x65a729a3
invalid

Function at 0x4acfc2
Capabilities:
Encode data using xor

Disassembly:
mov cl, 0x71
out 0xfe, eax
fabs
and dh, ah
sub al, 0x2d
or ebp, ecx
mov al, byte [0x228aed6b]
mov ebp, 0x83e450f9
imul ebp, ebp, 0x2a78ed11
stc
imul eax, dword [ecx + eax*8 - 0x3afb07dc], 0xaa6a37cc
mov dh, 0xe4
xor dword [edi - 0x80], edi
and al, 0x21
aad 0xf6
pop es
jp 0x4acfc6
fidiv dword [esi]
mov eax, dword [0xbdabb86c]
mov dword [0xd2e9ad96], eax
mov eax, 0xf9356436
and al, 0x1b
sub eax, 0x282c7352
rol byte [ecx - 0x4e], cl
mov byte [edi], ah
or ah, 0xe1
pop es
mov ch, 0xdb
xchg edi, eax
scasd eax, dword es:[edi]
sub byte [edi + 0x5c], bl
and eax, ebp
cmp ch, ch
loopne 0x4ad078
rcl dword [ecx - 0x78]
inc ebx
daa
movsd dword es:[edi], dword [esi]
mov edi, 0x8ea562b4
add al, 0x9d
add al, 0xe6
cmp eax, 0xa919219a
or byte [ecx], ah
fmulp st(7)
test al, 0x37
push 0x34
insd dword es:[edi], dx
call [edx - 0x3a7b4e62]
push cs
and ebp, dword [esi + 0x78]
push edi
js 0x4ad087
fldenv [0x847fd6e8]
out 0xf4, al
cdq
and al, 0x25
movsd dword es:[edi], dword [esi]
xchg edx, eax
popal
or edx, edi
jmp 0xfa4a49cb
inc esi
dec ecx
and eax, 0xa7882579
invalid
jmp 0xb4b1181a
Function at 0x4af572
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
js 0x4af5c2
sar dword [eax + 0x7a], cl
adc bl, ah
mov ecx, 0x68811aef
jbe 0x4af5c2
in eax, 0xb
test eax, 0xfcfd604b
aas
jmp 0xfb77333e
sbb eax, 0x7ac70867
sar byte ss:[edx - 4], 0x52
daa
bound eax, qword [edx]
invalid

Function at 0x4bb47d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c3418
cmp edx, dword [eax]
je 0x4bb49f
add eax, 8
inc ecx
cmp eax, 0x4c34a8
jl 0x4bb490
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c3418]
jne 0x4bb5cd
mov eax, dword [0x4c7d9c]
cmp eax, 1
je 0x4bb5a7
test eax, eax
jne 0x4bb4d0
cmp dword [0x4c3344], 1
je 0x4bb5a7
cmp edx, 0xfc
je 0x4bb5cd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4bb507
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004bbe60
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bc2f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bb54a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bc2f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4c091c
push edi
call fcn.004be1c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004bbe60
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbe70
lea eax, [ebp - 0xa0]
push 0x4c08fc
push eax
call fcn.004bbe70
push dword [esi + 0x4c341c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbe70
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004be134
add esp, 0x2c
pop edi
jmp 0x4bb5cd
lea eax, [ebp + 8]
lea esi, [esi + 0x4c341c]
push 0
push eax
push dword [esi]
call fcn.004bc2f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100013b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001beda
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100281bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x28], esi
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x2c], esi
call fcn.10005a2c
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x10001470
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], vtable.std::exception.0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], str.bad_locale_name
xorps xmm0, xmm0
mov byte [ebp - 0x14], 1
push eax
movq qword [ebp - 0x20], xmm0
call fcn.10007e36
add esp, 8
mov dword [ebp - 0x24], vtable.std::runtime_error.0
lea eax, [ebp - 0x24]
push 0x10026dac
push eax
call fcn.10009b34
push edi
push esi
call fcn.10005d74
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006c11
mov esp, ebp
pop ebp
ret 4
Function at 0x10004210
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001c228
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x100281bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x1000433e
cmp byte [ebx + 0x3d], 0
je 0x1000433e
mov eax, dword [ebx]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10004269
xor al, al
jmp 0x10004340
push 0
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.10003d60
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
lea eax, [ebp - 0x2c]
mov ecx, dword [ebx + 0x38]
lea edi, [ebp - 0x28]
cmovae edi, dword [ebp - 0x28]
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x18]
mov edx, dword [ecx]
add eax, edi
push eax
push esi
lea eax, [ebx + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x100042cf
sub eax, 1
je 0x100042d3
mov ecx, dword [ebp - 0x14]
sub eax, 2
je 0x10004326
xor bl, bl
jmp 0x10004328
mov byte [ebx + 0x3d], 0
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov edx, dword [ebp - 0x28]
cmp ecx, 0x10
mov esi, dword [ebp - 0x2c]
cmovae eax, edx
sub esi, eax
je 0x10004308
push dword [ebx + 0x4c]
cmp ecx, 0x10
lea eax, [ebp - 0x28]
push esi
cmovae eax, edx
push 1
push eax
call fcn.1000ccee
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp esi, eax
jne 0x100042cb
cmp byte [ebx + 0x3d], 0
je 0x10004326
test esi, esi
jne 0x10004291
push esi
push 8
lea ecx, [ebp - 0x28]
call fcn.10003ed0
jmp 0x1000428e
mov bl, 1
cmp ecx, 0x10
jb 0x1000433a
inc ecx
push ecx
push dword [ebp - 0x28]
lea ecx, [ebp - 0x28]
call fcn.100045c0
mov al, bl
jmp 0x10004340
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10006c11
mov esp, ebp
pop ebp
ret