joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44559d
Capabilities:
Encode data using xor

Disassembly:
adc dword [ebx + ecx*8], edi
js 0x445557
out dx, al
dec ecx
in al, dx
ror ebx, cl
invalid
xchg ebx, eax
mov esp, dword [esp + eax - 0x2f4c3b2b]
mov cl, 0x56
retf
add al, 0xd5
les esi, [ebx - 0x34a94e30]
push esp
rcl dword [eax + 0x28d4a133]
pop eax
je 0x44550e
dec eax
xor dword [edi - 0x3309d21e], ecx
sbb byte [ebp + ecx + 0x22f27bcf], 0xfa
iretd
jnp 0x44556b
and bh, dl
sar dword [ecx - 0x78], cl
in al, 0xba
dec edi
in eax, 0x84
aas
rcl bh, 1
add ebx, dword [edx + 0x5a]
pop edx
pop edx
or al, 0xb2
shr dword [ebx - 0x2184c01], cl
jecxz 0x44558e
mov bl, 0xe7
std
loopne 0x445595
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
push esi
push 0x11d59308
shl dword [eax - 0x731a444a], 0xad
mov al, byte [0x8ce5bbb6]
lodsd eax, dword [esi]
mov al, byte [0x8ce5bbb6]
lodsd eax, dword [esi]
aaa
mov ah, byte [ebp - 0x52978e7b]
dec eax
jns 0x4455d5
jae 0x44555a
cli
cmpsb byte [esi], byte es:[edi]
mov ecx, 0xf0c4712c
lcall 0x2537, 0xc41a9f88
adc dword [ecx + esi - 0x60], eax
sub eax, 0xf4f46536
retf 0x3c0d
ja 0x445621
ja 0x445587
push ss
daa
lodsb al, byte [esi]
ret
and ah, byte [ecx]
jnp 0x44564d
mov bh, 0x71
out dx, al
scasd eax, dword es:[edi]
daa
imul ebx, esi, 0x26225805
and al, 0xcf
adc ebp, dword [ecx]
add eax, 0xbab7b891
jmp 0xb4b9fec5
xor dword [esi + 0x4e], eax
inc esp
ja 0x4455fd
fcompi st(2)
jecxz 0x445698
insd dword es:[edi], dx
mov bl, 0xa7
not eax
push eax
imul ebp, esp, 0xbbd2b5be
xor eax, 0xbdddcc06
sbb eax, 0x327f7720
mov eax, 0x4e05d244
sar byte [ebx - 0x33f9cad2], cl
fnstsw word [ebp + 0x7f77201d]
xor bh, byte [eax + 0x4e05d244]
pop ss
movsd dword es:[edi], dword [esi]
add eax, 0xd89e359a
pop ecx
mov ebx, 0xc9b5822f
push ss
push edx
xor esi, dword [eax]
fcomp dword [ecx - 0x45]
das
xor byte [ebp + 0x335216c9], 0x34
pushal
and al, 0x74
aas
inc esp
call 0xcaefdf95
or bl, byte [eax]
cmp al, 0x67
adc ecx, dword es:[eax]
loope 0x445635
retf 0xdd12
adc bl, ch
ja 0x44566a
inc edx
cli
xchg esi, eax
ja 0x44562a
shr byte [edx], 0x34
ret 0xf5d4
out dx, al
xor al, 0x7c
mov bh, 0xeb
insd dword es:[edi], dx
pop ebx
xor edi, dword [ebp - 0x35d887f7]
push dx
dec edi
fild word [eax - 3]
and eax, 0xc2665905
inc ebp
mov esp, 0x3cfba206
mov edx, fs
int 0x2b
cmp dword [ecx + 0x58], esi
wait
fcmove st(0), st(6)
imul edx, dword [ecx], 0x64

Function at 0x44675b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x44e249
Capabilities:
Encode data using xor

Disassembly:
ret 0xb1b2
xchg ecx, eax
and bl, byte [edx + 0x45]
sbb dword [eax], esp
dec ebx
dec ebx
fist word [edx]
or eax, 0x294bc7d8
jbe 0x44e1b2
sub ebx, dword [ebx - 0x253d4379]
add dl, bh
cdq
clc
mov al, 0x9a
lds edi, [ebx + ebp*2]
ret
pushfd
leave
add ecx, dword [edx]
enter 0xfffffffffffff0ce, 0x7e
adc ah, byte [edi - 0x1f]
pop ebx
xor dword [edx - 0x3b], ebx
cmp al, 0x44
cwde
les esp, [eax + 0x74]
adc edx, esp
ja 0x44e1f2
xor byte [eax + 0x36b3ca2d], ah
mov al, byte [0x36b3ca2d]
add byte [ecx + 0x75], dh
fst qword [eax - 3]
mov ebx, 0xe7bb9fda
sbb byte [edx], bh
pushal
xchg ebx, eax
mov es, ebp
mov ch, 0x87
add al, 0x61
pop edx
mov dh, 0xc7
add edi, eax
xor eax, edx
jno 0x44e24c
adc bh, byte [esi - 0x31]
cmpsd dword [esi], dword es:[edi]
jg 0x44e281
inc edi
or byte [esi + 4], bl
and ebp, dword [ebp - 0x29]
inc eax
inc edi
shl byte [eax + 0x24d4b7a0], cl
les ebp, [ebx]
dec ecx
adc eax, ecx
retf 0x58bb
mov al, byte [0xc424d4b7]
sub ecx, dword [ecx + 0x13]
ror edx, 0xbb
pop eax
adc byte [ecx - 0x113629aa], ch
out dx, al
out 0xbe, al
pop edx
loop 0x44e231
fisubr dword [edx + 0x5ab701e4]
inc ebp
pop dword [esi]
scasd eax, dword es:[edi]
cmc
dec ebx
insd dword es:[edi], dx
stc
hlt

Function at 0x450108
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
movsb byte es:[edi], byte [esi]
sub al, 0x4f
pop ss
sti
push esi
xor ebp, edx
imul esp, dword [ebx], 0xc
inc ebx
pop es
sahf
invalid

Function at 0x454453
Capabilities:
Encode data using xor

Disassembly:
lcall 0x9efc, 0x3e268233
push ebx
inc ecx
lds eax, [edi + ebx*4 + 0x1e]
stosb byte es:[edi], al
pop ebx
fcom st(5)
adc al, cl
sub eax, 0xd4ef372a
dec dword [edx - 0x17]
fcompi st(1)
sbb ah, byte [ecx]
sub al, 0x6e
wait
jnp 0x45446b
fidiv dword [ebx + 0x703b92a0]
and byte cs:[0x3b027e67], dh
insb byte es:[edi], dx
mov esi, 0x286d1e07
xor ah, cl
sbb dword [ebx - 0x5cb614e2], 0xc7977662
sbb dl, byte [ebx - 0x423660b7]
movsb byte es:[edi], byte [esi]
wait
push ds
lahf
cmp bl, byte [edi - 0x60e564e6]
cmp dh, byte [edi - 0x48]
xchg edi, eax
or eax, 0x60194db6
jae 0x45448e
push ds
jmp 0x4544da
jp 0x45452c
mov ebx, 0xde1a9f3a
mov ebx, dword [ebp + eax*2 + 0x12]
push ds
push ss
and dword [eax + 0x36], edi
mov edi, 0x705ba324
sahf
rcr dword [ebp - 0x7b], 1
loopne 0x454461
insd dword es:[edi], dx
push 0x72636f15
xor ch, dh
xchg edx, eax
in eax, dx
jns 0x4544f6
xchg dword [eax - 0xd7e261], esi
mov bl, byte [edi - 0x2ce6c271]
lahf
sbb byte [ecx + 0x28], al
xchg edx, eax
add esi, dword [esi - 0x6351e787]
clc
jl 0x4544b8
mov al, 0x9f
sbb eax, 0x9f8aff28
invalid
jnp 0x4544d9
add eax, 0x146c960e
invalid
push cs
xchg esi, eax
insb byte es:[edi], dx
adc al, 0xf
cmp dword [eax], edx
and byte [ebx], bh
popal
adc dword [esi], edi
sbb bl, byte [ebp + 0x423f224d]
pop edi
invalid
jmp 0x454576
popfd
mov al, byte [0xe2d12a8a]
lea edi, [eax + ebp*2]
add ebp, dword [ebx]
sbb dword [edi - 0x2ac5a7f1], 0x1cd7fa81
aaa
rcr dword [edi], cl
cmp dword [esi], 0x24
dec ebp
pushfd
mov bh, 0xf4
invalid
Function at 0x4551fa
Capabilities:
Encode data using xor

Disassembly:
out 0xbe, al
wait
lahf
les eax, [edx - 0x5ee1ba50]
lea esi, [ecx + 0x71]
sbb byte [ebx + edi*2 - 0x33], 0xae
xchg esp, eax
inc eax
js 0x45519f
add ch, byte cs:[ebp - 0x7c5a26d2]
ja 0x4551ab
lodsb al, byte [esi]
mov byte [0x6afc46a5], al
cmpsb byte [esi], byte es:[edi]
hlt
stosb byte es:[edi], al
out dx, al
and al, 0x72
in eax, dx
leave
xchg edi, eax
and dl, dh
dec ecx
push esp
dec esi
sub ah, ah
jns 0x45515e
inc edi
mov esi, 0x26d8366c
std
bswap ecx
push 0xd00ee880
xor eax, 0x949abd6
adc bx, word [edi]
dec ecx
or dword [esi + 0x13], esp
pop ds
mov edi, 0x4e2f6a4e
jmp 0x4551a1
insb byte es:[edi], dx
mov al, 0xca
dec eax
adc bh, byte [ecx + 0x74]
jbe 0x4551ea
dec eax
xor byte [ecx - 0x37], dl
insd dword es:[edi], dx
stosd dword es:[edi], eax
adc ebp, dword [ecx - 0x1e40addb]
pop edi
in al, dx
lcall 0xf4b5, 0x4b5eaa98
out dx, al
and byte [edi - 0x109afbbc], dh
out dx, eax
out dx, eax
out dx, eax
mov eax, gs
inc eax
test byte [eax - 0x7c4bdce], bl
xor byte [ecx], al
mov al, byte [0xfb0071a7]
ror dword [edx + 0x3c], 0xe2
jge 0x4551f9
imul edx
dec ebx
inc edi
lahf
scasb al, byte es:[edi]
int 0xe8
jo 0x4551c2
test dword [edx], esi
outsb dx, byte [esi]
scasd eax, dword es:[edi]
xchg ebx, eax
xchg edx, eax
and ebp, dword [0x29ca4873]
xchg ebx, eax
or dh, byte [esi - 0x31]
push ss
jb 0x4551d3
add dword cs:[edi], 0x53
stosb byte es:[edi], al
push edi
add al, 0x87
mov dl, 0x1e
invalid

Function at 0x45d3bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x466527
Capabilities:
Encode data using xor

Disassembly:
call 0x68474930
xchg edi, eax
ficomp dword [esi - 0xb5a9046]
stosb byte es:[edi], al
sub byte [ebp + ebp*8 - 0x47], 0xdf
mov eax, 0xd6375807
push es
mov ah, 0x18
test esi, ebx
sub dh, cl
sbb dword [esi - 0x4a], esi
adc al, 0x53
cmp al, bl
inc esi
das
jb 0x466529
in al, 0
push 0xba9eda97
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
hlt
test eax, 0x3190c626
in eax, dx
enter 0x3203, 0xffffffffffffffba
adc dl, byte [edi + esi + 0x223177d4]
pop edx
push ecx
invalid
Function at 0x4743bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586c8b
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x474483
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586c8b
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00580966
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x474529
cmp edi, dword [esi + 0x7c]
jge 0x474529
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488dcd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488dcd
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586c8b
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586c8b
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x47447b
jmp 0x47444b
call fcn.0048cff4
int3

Function at 0x48bc3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
and al, 0x2c
Function at 0x48bc56
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and al, 0x2c
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059e50b
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48bd03
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059e50b
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005981e6
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48bda9
cmp edi, dword [esi + 0x7c]
jge 0x48bda9
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004a064d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004a064d
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e50b
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059e50b
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48bcfb
jmp 0x48bccb
call fcn.004a4874
int3
Function at 0x4af45b
Capabilities:
Encode data using xor

Disassembly:
sub esp, dword [edx + 0x97ca9bc]
or eax, dword [ebx - 0x3e]
add byte [edi - 0x5f], ch
cwde
jno 0x4af496
ficomp word [edi + 0x5b]
pop esp
jb 0x4af4c7
and esi, esp
dec eax
xor al, byte [eax - 0x594dd1e4]
jg 0x4af4dc
hlt
ja 0x4af49c
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0x8de34978]
cdq
and byte [eax], bl
cmc
mov esi, 0x56a82dc9
xchg cl, bl
jae 0x4af471
cmpsd dword cs:[esi], dword es:[edi]
xchg esi, eax
push es
cmp bh, byte [ecx + 0x61]
jns 0x4af4f9
retf
mov dword [ebp - 0x72589f1b], ecx
fiadd dword [edi + 0x117c8f10]
leave
mov esi, 0xe9ce3a88
add al, 0xf5
cmp cl, dh
jmp 0xa7e2e9b7
xchg edi, eax
cmpsd dword [esi], dword es:[edi]
mov bl, 0x27
mov dh, 0x42
out 0x5c, eax
imul esi, ebx, 0x27894bcf
imul eax, dword [ebx - 0x3e60fec2], 0xdfb0927e
mov al, 0xdf
aam 0xb8
add eax, 0x57b55d9e
mov esi, 0x563c82d3
invalid
fadd st(2), st(0)
popal
in al, 0xe0
jle 0x4af4ae
xchg edx, eax
push dword [edx]
test al, 0x2c
pop ds
scasd eax, dword es:[edi]
loope 0x4af4ac
pop esi
mov edx, 0x3e5e988a
xor eax, 0x21ffbfc8
add byte [ecx + 0x68], dl
mov esi, 0xad9d8ef0
push 0x9d8ef0be
lodsd eax, dword [esi]
int1
dec esi
fstp xword [ecx]
js 0x4af4b1
inc esi
pop ecx
hlt
Function at 0x4b17ba
Capabilities:
Encode data using xor

Disassembly:
shl dword [eax + 0xb], cl
nop
mov ch, 0x76
test al, 0xf0
scasd eax, dword es:[edi]
mov ecx, 0x46b9607b
mov ebp, 0x7e2b234d
push ss
jmp 0x77995719
sub ecx, dword [edx + 0x75]
shr dword [ecx + 0xd], 0x3f
stosb byte es:[edi], al
mov al, byte [0xc2ae4f9b]
outsd dx, dword [esi]
dec edx
jne 0x4b1723
imul ecx, dword [0x9ba0aa3f], 0x6fc2ae4f
lds eax, [esi - 0x80]
aas
jbe 0x4b1715
mov dword [0x9a51653c], eax
sub al, 1
loop 0x4b1786
cmp al, 0x65
push ecx
lcall 0x32f3, 0xce2012c
test al, 0x6e
xor dh, bl
test al, 0x6e
fld dword [edi]
pop es
salc
loopne 0x4b1771
jo 0x4b17da
push ebx
mov bh, dl
pop edi
fisubr dword [ebx - 0x6fedf45d]
mov dl, 0x5f
fdivp st(4)
je 0x4b1723
cdq
sub dh, byte [ebx + ebx*4 + 0x35]
fcomp st(2)
outsb dx, byte [esi]
mov byte [0x87b9da05], al
fcomp st(7)
invalid
mov eax, dword [0xded9c25c]
cmpsd dword [esi], dword es:[edi]
mov bl, bh
in al, dx
cdq
dec eax
push ss
mov esi, 0x371e5176
jbe 0x4b181a
push ds
aaa
out 0x2b, al
jg 0x4b184c
mov al, byte [0x40ef137e]
scasd eax, dword es:[edi]
je 0x4b175e
out 0x2f, eax
jno 0x4b175f
test ch, al
lodsd eax, dword [esi]
cmovp esp, dword [eax - 0x15]
lds ebp, [ebp - 0x149fb5f1]
loope 0x4b17c7
pop eax
cmp dl, byte [edx + 0x1a]
test al, 0x93
dec edi
xchg edx, eax
adc ch, cl
daa
outsb dx, byte [esi]
fidiv word [0x94803900]
rcr dword [ebp - 0x4f7885b4], 0x75
and ah, ah
dec edx
push ecx
cmp eax, 0xa96e39c0
pop edx
mov word [eax], cs
add al, byte [edi - 0x78ceefc8]
dec esi
mov al, dh
fstp qword [esi - 0x1fda80e0]
cdq
fld qword [edi]
pop es
xor byte [esi + 0x41], 0xcc
loopne 0x4b1896
pop es
add ah, byte [edi]
fstpnce st(4), st(0)
sbb dh, byte [ecx + 6]
salc
inc edx
mov esp, 0x27e5bca1
and dword [eax], ebx
add dword [eax], edi
add eax, 0xeecc931
cwde
movsd dword es:[edi], dword [esi]
aas
mov cl, 0x9c
in eax, 0xfc
and dword [ecx + 0x3c565021], edx
in eax, 0xf8
shl byte [esi], 1
jecxz 0x4b18c7
jp 0x4b1848
cli
cmp byte [esi], bh
cmp al, 0x41
ljmp 0xb8d8
in eax, 3
test eax, 0x86c84f63
cdq
out 0x9e, al
sub dl, bh
sbb al, 6
arpl word [ecx - 8], di
jb 0x4b18f3
cmp eax, 0x9d57400e
enter 0x7475, 0x13
cmp dword [edi], eax
push eax
into
inc ebp
add al, 0x76
sbb byte [edi + 0x23], bh
fsubp st(6)
std
cdq
or dword [edi + 0x7b4007b8], eax
mov dl, 0x5d
lcall 0xfa8b, 0xd64b854
in eax, dx
inc ebx
adc al, 0xf2
add eax, 0xbe6b1f2a
and byte [ecx + 0x11], 0x5c
cwde
mov edi, 0xa19f5a0b
add byte [ecx - 0x52], bl
in eax, 0x95
sub dh, byte [ebx + edi]
pushfd
mov esi, dword [ebx - 0x13]
mov eax, 0x10f8665f
leave
adc cl, cl
sbb ch, ch
rcl dword [esi]
pushfd
rol byte [ebx + 0x2e], 0xb0
out 0xec, eax
inc edi
dec ebx
and eax, 0xfdace4c6
invalid
Function at 0x4ba5d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2410
cmp edx, dword [eax]
je 0x4ba5f3
add eax, 8
inc ecx
cmp eax, 0x4c24a0
jl 0x4ba5e4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2410]
jne 0x4ba721
mov eax, dword [0x4c6db4]
cmp eax, 1
je 0x4ba6fb
test eax, eax
jne 0x4ba624
cmp dword [0x4c2338], 1
je 0x4ba6fb
cmp edx, 0xfc
je 0x4ba721
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba65b
lea eax, [ebp - 0x1a4]
push 0x4bf958
push eax
call fcn.004bafb0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb440
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba69e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb440
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf954
push edi
call fcn.004bd310
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf938
push eax
call fcn.004bafb0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bafc0
lea eax, [ebp - 0xa0]
push 0x4bf934
push eax
call fcn.004bafc0
push dword [esi + 0x4c2414]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bafc0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf90c
push eax
call fcn.004bd284
add esp, 0x2c
pop edi
jmp 0x4ba721
lea eax, [ebp + 8]
lea esi, [esi + 0x4c2414]
push 0
push eax
push dword [esi]
call fcn.004bb440
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x409f80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0x14
push ebx
mov bl, byte [ecx + 8]
push esi
mov esi, dword [esp + 0x20]
cmp bl, 3
je 0x40a11f
push ebp
mov ebp, dword [ecx]
push edi
mov dword [esp + 0x10], 0
test bl, 2
je 0x409fd6
movzx eax, byte [ecx + 9]
movzx esi, byte [edx]
mov edi, eax
sub edi, esi
movzx esi, byte [edx + 1]
mov dword [esp + 0x14], edi
mov edi, eax
sub edi, esi
movzx esi, byte [edx + 2]
sub eax, esi
mov esi, dword [esp + 0x28]
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
mov edi, 3
jmp 0x409fe9
movzx eax, byte [edx + 3]
movzx edi, byte [ecx + 9]
sub edi, eax
mov dword [esp + 0x14], edi
mov edi, 1
test bl, 4
je 0x409ffd
movzx edx, byte [edx + 4]
movzx eax, byte [ecx + 9]
sub eax, edx
mov dword [esp + edi*4 + 0x14], eax
inc edi
xor edx, edx
xor eax, eax
cmp edi, edx
jle case.0x40a04b.3
lea esp, [esp]
cmp dword [esp + eax*4 + 0x14], edx
jg 0x40a01c
mov dword [esp + eax*4 + 0x14], edx
jmp 0x40a024
mov dword [esp + 0x10], 1
inc eax
cmp eax, edi
jl 0x40a010
cmp word [esp + 0x10], dx
je case.0x40a04b.3
movzx eax, byte [ecx + 9]
add eax, 0xfffffffe
cmp eax, 0xe
ja case.0x40a04b.3
movzx eax, byte [eax + 0x40a13c]
jmp dword [eax*4 + 0x40a128]
mov ecx, dword [ecx + 4]
mov eax, esi
cmp ecx, edx
jbe case.0x40a04b.3
nop
mov dl, byte [eax]
shr dl, 1
and dl, 0x55
mov byte [eax], dl
inc eax
sub ecx, 1
jne 0x40a060
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
mov edi, dword [ecx + 4]
mov edx, dword [esp + 0x14]
mov ecx, edx
mov eax, 0xf0
sar eax, cl
mov ebx, 0xf
sar ebx, cl
and al, 0xf0
or al, bl
test edi, edi
jbe case.0x40a04b.3
lea ebx, [ebx]
mov bl, byte [esi]
mov cl, dl
shr bl, cl
inc esi
and bl, al
sub edi, 1
mov byte [esi - 1], bl
jne 0x40a0a0
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x40a04b.3
mov eax, ebx
xor edx, edx
div edi
inc ebx
inc esi
mov cl, byte [esp + edx*4 + 0x14]
shr byte [esi - 1], cl
cmp ebx, ebp
jb 0x40a0c2
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
imul ebp, edi
xor ebx, ebx
test ebp, ebp
jbe case.0x40a04b.3
xor edx, edx
mov eax, ebx
div edi
movzx ax, byte [esi]
mov ecx, pe_nt_image_headers32
imul ax, cx
movzx ecx, byte [esi + 1]
add ax, cx
inc esi
inc ebx
inc esi
movzx ecx, word [esp + edx*4 + 0x14]
shr ax, cl
movzx eax, ax
mov edx, eax
shr edx, 8
mov byte [esi - 2], dl
mov byte [esi - 1], al
cmp ebx, ebp
jb 0x40a0e6
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x42cd70
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55a008
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x58605c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.004c8750
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], vtable.CEffectHotaru.0
push 0x3840
call fcn.004134e0
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [edx + 0x10], eax
push 0x21c
call fcn.004134e0
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 0x14], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x18], 0x258
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x1c], 0x12c
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x20], 0x64
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x24], 0x64
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x28], 0xffffff9c
mov edx, dword [ebp - 0x1c]
mov dword [edx + 0x2c], 0xa
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x30], 0
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 0x44], 0xf
mov dword [ebp - 0x10], 0
jmp 0x42ce4a
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x258
jge 0x42ce61
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0042dcd0
jmp 0x42ce41
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4