joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4782b0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d91b8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push 1
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
sub esp, 0xc
mov dword [esp + 0x34], 0
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.0047d4e0
mov ecx, esi
call fcn.00475dd0
lea ecx, [esp + 0x14]
mov dword [esi], 0x4dd5a0
mov dword [esp + 0xc], 0xffffffff
call fcn.0047d600
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x24

Function at 0x479780
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d9505
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push esi
mov esi, ecx
push 0
push 5
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], 0
call fcn.0044c3d0
mov eax, dword [esi + 0x98]
mov esi, dword [ebp + 8]
mov dword [esp + 0xd0], 1
mov ecx, dword [eax]
mov edx, dword [eax + 4]
fld qword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
fld qword [esp + 4]
fadd qword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x1c], ecx
fmul qword [0x4db760]
mov dword [esp + 0x20], edx
fstp qword [esp + 0x24]
fld qword [esp + 0xc]
fsub qword [esp + 4]
fmul qword [0x4db760]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fsqrt
fld st(0)
fadd qword [esp + 0x24]
fstp qword [eax]
fld qword [esp + 0x1c]
mov ecx, dword [esp + 0xc0]
fstp qword [ecx + 8]
fld qword [esp + 0x24]
mov edx, dword [esp + 0xc0]
fsub st(1)
fstp qword [edx + 0x10]
mov eax, dword [esp + 0xc0]
fstp st(0)
fpatan
fmul qword [0x4db760]
fstp qword [eax + 0x18]
mov ecx, dword [esp + 0x38]
mov dword [esi], 0x4db768
push ecx
mov ecx, esi
call fcn.0044c390
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.0044c4a0
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0xd0], 0
call fcn.0044c440
mov ecx, dword [esp + 0xc8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47b0d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4d98d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc4
push esi
mov esi, ecx
push 0
push 4
lea ecx, [esp + 0x38]
mov dword [esp + 0x20], 0
call fcn.0044c3d0
mov eax, dword [esi + 0x98]
mov esi, dword [ebp + 8]
mov dword [esp + 0xd0], 1
mov ecx, dword [eax]
mov edx, dword [eax + 4]
fld qword [eax + 0x10]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
fld qword [esp + 4]
fadd qword [esp + 0xc]
mov ecx, dword [eax + 0x18]
mov edx, dword [eax + 0x1c]
mov eax, dword [esp + 0xc0]
mov dword [esp + 0x1c], ecx
fmul qword [0x4db760]
mov dword [esp + 0x20], edx
fstp qword [esp + 0x24]
fld qword [esp + 0xc]
fsub qword [esp + 4]
fmul qword [0x4db760]
fld st(0)
fmul st(1)
fld st(2)
fmul st(3)
faddp st(1)
fsqrt
fld st(0)
fadd qword [esp + 0x24]
fstp qword [eax]
fld qword [esp + 0x1c]
mov ecx, dword [esp + 0xc0]
fstp qword [ecx + 8]
fld qword [esp + 0x24]
mov edx, dword [esp + 0xc0]
fsub st(1)
fstp qword [edx + 0x10]
mov eax, dword [esp + 0xc0]
fstp st(0)
fpatan
fmul qword [0x4db760]
fstp qword [eax + 0x18]
mov ecx, dword [esp + 0x38]
mov dword [esi], 0x4db768
push ecx
mov ecx, esi
call fcn.0044c390
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.0044c4a0
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x30]
mov byte [esp + 0xd0], 0
call fcn.0044c440
mov ecx, dword [esp + 0xc8]
mov eax, esi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x47d780
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ecx + 8]
xor eax, eax
mov edx, dword [ecx]
mov cl, byte [edx]
test cl, cl
je 0x47d79c
movsx ecx, cl
add eax, eax
xor eax, ecx
mov cl, byte [edx + 1]
inc edx
test cl, cl
jne 0x47d78d
ret

Function at 0x47d920
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d9c18
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esp + 0x2c]
xor ebx, ebx
push edi
push 0x3fe00000
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
sub esp, 0xc
mov dword [esp + 0x34], ebx
mov ecx, esp
mov dword [esp + 0x4c], esp
push eax
call fcn.0047d4e0
mov ecx, esi
call fcn.00416260
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esi + 0x9c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esi + 0xa4], edx
mov edx, dword [esp + 0x3c]
mov dword [esi + 0xa8], eax
mov eax, dword [esp + 0x40]
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xb8], ebx
lea ecx, [esp + 0x1c]
mov dword [esi + 0xa0], edi
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb4], edx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xc0], eax
mov dword [esi], 0x4dd768
mov dword [esp + 0x14], 0xffffffff
call fcn.0047d600
mov ecx, dword [esp + 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret 0x28
Function at 0x4830a0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4da368
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push 2
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x34]
imul ecx, eax
push eax
push ecx
push edx
lea eax, [esp + 0x34]
sub esp, 0xc
mov dword [esp + 0x38], 0
mov ecx, esp
mov dword [esp + 0x64], esp
push eax
call fcn.0047d4e0
mov ecx, esi
call fcn.0041c770
lea ecx, [esp + 0x14]
mov dword [esi], 0x4dd8a0
mov dword [esp + 0xc], 0xffffffff
call fcn.0047d600
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x28

Function at 0x484b70
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4da6e8
push eax
mov dword fs:[0], esp
push esi
mov esi, ecx
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push 1
push ecx
mov ecx, dword [esp + 0x30]
push edx
mov edx, dword [esp + 0x30]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
sub esp, 0xc
mov dword [esp + 0x34], 0
mov ecx, esp
mov dword [esp + 0x5c], esp
push eax
call fcn.0047d4e0
mov ecx, esi
call fcn.004830a0
lea ecx, [esp + 0x14]
mov dword [esi], 0x4dd92c
mov dword [esp + 0xc], 0xffffffff
call fcn.0047d600
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0x24
Function at 0x48500d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, dword [esp + 0x18]
mov ebp, esp
sub esp, 0xcd4
mov dword [ecx], 0
push ebx
push esi
mov eax, dword [ebp + 0x10]
push edi
cmp eax, 1
mov dword [ebp - 8], 0xc30
je 0x485041
cmp eax, 2
je 0x485085
mov eax, 0xe
jmp 0x485245
push 0
mov esi, dword [ebp + 8]
push esi
call sub.MSVCRT.dll__access
add esp, 8
cmp eax, 0xffffffff
jne 0x485177
test byte [ebp + 0xc], 8
je 0x485240
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.00489299
cmp eax, 1
je 0x485177
jmp 0x485245
xor edi, edi
mov esi, dword [ebp + 8]
mov al, byte [edi + esi]
test al, al
je 0x4850a9
movsx eax, al
push eax
inc edi
call sub.MSVCRT.dll_toupper
add esp, 4
add al, 7
mov byte [ebp + edi - 0x41], al
cmp edi, 0x32
jl 0x48508a
push str.softwareclasses_vdsp
lea eax, [ebp - 0xa4]
mov byte [ebp + edi - 0x40], 0
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp byte [esi], 0x3a
jne 0x4850fc
xor eax, eax
cmp byte [esi + 4], 0x3a
je 0x4850e2
mov cl, byte [eax + esi + 4]
inc eax
cmp byte [eax + esi + 4], 0x3a
mov byte [ebp + eax - 0xa5], cl
jne 0x4850cf
mov byte [ebp + eax - 0xa4], 0
add eax, esi
lea ecx, [ebp - 0x40]
add eax, 5
push eax
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 4]
lea ecx, [ebp - 0xa4]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x48514f
lea eax, [ebp - 8]
lea ecx, [ebp - 0xcd4]
push eax
lea edx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x40]
push edx
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48514f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x485177
mov eax, 0x2c
jmp 0x485245
test byte [ebp + 0xc], 8
je 0x485237
mov eax, dword [ebp + 0xc]
and eax, 7
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0
push esi
call fcn.00489299
cmp eax, 1
jne 0x485245
push 0x1ae
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x485194
mov eax, 0x10
jmp 0x485245
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
push 0
push esi
push ebx
call fcn.0048924c
add esp, 0xc
cmp dword [ebp + 0x10], 3
jne 0x4851b3
push 0x11
jmp 0x4851bf
cmp dword [ebp + 0x10], 4
jne 0x4851bd
push 0x1a
jmp 0x4851bf
push 0
push dword [ebp + 0x14]
lea ecx, [ebx + 0x104]
push ecx
call fcn.0048924c
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov byte [ebx + 0x181], cl
mov edx, dword [ebp + 0xc]
mov dword [ebx + 0x182], ecx
push edi
mov dword [ebx + 0x100], eax
mov dword [ebx + 0x186], ecx
mov dword [ebx + 0x1a6], ecx
mov dword [ebx + 0x1a2], ecx
mov dword [ebx + 0x1aa], edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [ebp - 0xcd4]
push eax
push edi
call fcn.0048524e
add esp, 8
mov esi, eax
cmp esi, 1
je 0x48522b
push edi
call fcn.004868eb
mov eax, esi
jmp 0x485245
mov ecx, dword [ebp + 0x18]
mov eax, 1
mov dword [ecx], edi
jmp 0x485245
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0xf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x489910
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x4899ac
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ecx, dword [esp + 0xc]
mov ebp, esp
sub esp, 0x18
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov word [ebp - 0x16], ax
push esi
mov word [ebp - 0x12], dx
mov ecx, dword [ecx + 8]
mov word [ebp - 0x18], cx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov word [ebp - 0x10], ax
mov ecx, dword [ecx + 8]
mov word [ebp - 0xe], dx
lea eax, [ebp - 8]
mov word [ebp - 0xc], cx
push eax
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
push eax
push eax
push 3
push eax
push eax
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov esi, eax
mov eax, 0
je 0x489a2c
lea eax, [ebp - 8]
push eax
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp eax, 1
sbb eax, eax
inc eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x489ad5
Capabilities:
Delete file

Disassembly:
push 0
push dword [esp + 8]
call fcn.00489901
add esp, 8
test eax, eax
mov eax, 0xf
je 0x489b02
push dword [esp + 4]
call sub.MSVCRT.dll_remove
add esp, 4
cmp eax, 1
sbb eax, eax
and al, 0xf7
add eax, 0xa
ret 4
Function at 0x48e17c
Capabilities:
Enumerate pe sections

Disassembly:
jne 0x49d18e
je 0x48e186
pop esp
xchg byte [edi], cl
test byte [edx], al
lock add byte [eax], al
je 0x49d18e
invalid
imul ecx, dword [ebp + 0x53], 0x5b
push 0x4a4dda
ret
push ebp
mov edx, dword [esp + 8]
mov ebp, esp
push ebx
mov ecx, dword [ebp + 0x10]
mov eax, ecx
dec ecx
test eax, eax
jb 0x49134f
mov cx, cx
je 0x49ad93
jne 0x49d1b3
or ecx, dword [esi - 0x77f3a276]
sbb al, byte [edx - 0x77]
enter 0xffffffffffff8349, 0xffffffffffffffc0
add byte [ecx + 4], dh
mov bl, byte [ebp + 0xc]

Function at 0x48e51b
Capabilities:
Encode data using xor

Disassembly:
pop dword [esp - 4]
mov bx, bx
xchg bh, ch
xchg ch, bh
mov eax, dword [esi + 4]
shr dl, 0x40
inc eax
push word [eax]
lea esi, [esi + 8]
mov dword [ebp + 0x60], esp
jno 0x4914b7
jo 0x48e541
add dword [edi], ecx
mov byte [0x70800fc3], al
das
add byte [eax], al
jo 0x4914b7
xor al, 0x8b
loop 0x48e52b
dec ecx
add byte [eax + eax], ah
add byte [eax], ah
xchg edx, eax
dec ecx
add byte [eax + eax], ch
add dl, ah
loopne 0x48e5a5
add byte [eax + eax], ch
add byte [ecx - 0x2f], al
dec ebx
add byte [eax], dl
add byte [eax], al
push eax
add byte [eax], al
add byte [eax + 0x1e004ab2], bh
and dword [edi + 0x40004aff], ecx
add byte [eax], al
add byte [ebp], dl
add byte [eax], al
mov edi, 0x100498d
add byte [eax], al
add byte [eax], dl
add byte [eax], al
leave
mov cl, 0x4b
add byte [eax + eax], ch
add byte [eax], ch
add byte [eax], al
leave
mov cl, 0x4b
add byte [eax], ch
add byte [eax], al
insb byte es:[edi], dx
add byte [eax], al
add dl, ah
loopne 0x48e5ef
dec ecx
add byte [eax + eax], ah
add byte [eax - 0x37ffb54e], bh
cmpsd dword [esi], dword es:[edi]

Function at 0x490326
Capabilities:
Authenticate hmac

Disassembly:
pop dword [esp - 4]
pop edi
shl bx, 0x20
pop esi
call fcn.004ae702
invalid
Function at 0x49483b
Capabilities:
Inspect section memory permissions

Disassembly:
xor al, 0x1a
inc eax
push 0x494e3a
ret
lea esp, [esp + 4]
add esi, 8
add edi, eax
test ecx, 0x80000000
jb 0x49279a
mov bx, bx
jne 0x4b40c7
je 0x494862
invalid
xchg bx, dx
xchg dx, bx
shr eax, 0x40
add esi, 4
call fcn.004ae48b
sbb dword [ebp + 0x4a], edi
add byte [eax], al
add dword [eax], eax
add byte [ecx], al
add dword [eax], eax
add byte [eax], al
popal
add byte [eax + 0x68], al
add byte [ecx], ah
add byte [eax], al
push es
add byte [eax], al
add byte [ecx], dl
sub cl, byte [edx]
add eax, 0xc004946
add byte [eax], al
add byte [eax], dl
add byte [eax], al
loop 0x494888
dec ecx
add byte [eax], ch
add byte [eax], al
aaa
xchg ecx, eax
dec edx
add byte [ecx], dl
add byte [eax], al
pop eax
add byte [eax], al
add byte [edi], dh
xchg ecx, eax
dec edx
add byte [eax], bl
add byte [eax], al
push ecx
add byte [eax], al
add dl, ah
loopne 0x494912
add byte [eax + eax], ah
add byte [eax + 0x550048de], bh
add byte [eax], al
add byte [ebp], dl
add byte [eax], al
mov eax, 0x97004ab2
push esp
Function at 0x494f61
Capabilities:
Authenticate hmac

Disassembly:
ret
lea esp, [esp + 4]
xchg bl, cl
xchg cl, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
jno 0x4946ac
jo 0x494f7a
xor al, 0xcc
add esi, dword [edi + ecx]
sub byte [edi + esi*8], 0xff
inc edi
xchg edx, eax
xor edx, edx
jb 0x4a2fc3
jo 0x4946ac
invalid
jne 0x4a7dbc
je 0x494f95
xor eax, 0x840f720a
and dword [esi], ebp
add dword [eax], eax
je 0x4a7dbc
fdivr dword [ecx + eax*4]
les eax, [eax + eax]
add byte [eax], al
mov eax, dword [ebp - 8]
push eax
jmp 0x49b9a9
sub byte [ebp + ebx], al
jmp dword [esi]
stc
invalid
pop edx
fild word [ebx + 0xf]
test byte [ebp - 0x27000091], bl
lea esi, fs:[esi + 0xc]
jne 0x4950c9
fsub dword [ebp + ecx*4 + 0x76]
or al, 0xf
test edx, esi
and bh, bh
dec dword [eax - 0x1afd8b1c]
pop ebx
mov ah, ah
je 0x4a2fdd
in eax, 0x5b
je 0x4950c9
xor eax, 0xc1f7a8
add dword [eax], eax
add byte [edi], cl
or byte [edi], 0x8c
invalid
shr cx, 0x40
shl di, 0x20
xchg dx, cx
xchg cx, dx
mov cx, word [esi + 0xbc]
push edi
xchg di, di
pop edi
mov al, byte [ebp + edx - 0xc]
cmp esi, esi
cmp bx, bx
add ax, 0
sub al, 0x58
cmc
sub cl, 0x34
add dh, 0
xor al, cl
jb 0x4a2fcc
enter 0xffffffffffff820f, 0xffffffffffffffd8
mov cl, 0xff
dec dword [ecx - 0x2d769901]
mov edi, edi
mov dx, dx
inc edx
clc
stc
cmp edx, 8
lea esi, [esi]
mov bp, bp
mov byte [esi + edx + 0x2b], al
push esi
pop esi
jl 0x4a7dbc
mov bl, bl
jge 0x4a7e1a
jno 0x4a7ded
mov edx, 0x5ae9ff89
out 0xff, al
inc dword [esi - 0x35]
mov edi, edi
jmp fcn.004a647b
Function at 0x498981
Capabilities:
Authenticate hmac

Disassembly:
lea ebp, [ebp]
jne 0x4b6d71
je 0x498990
sti
sbb eax, 0x840f5f6a
fninit
add dword [eax], eax
je 0x4b6d71
xor al, 6
lea edx, [ebx + ecx*2]
pop ecx
insd dword es:[edi], dx
dec ebx
add byte [ecx - 0x7244052c], ch
push esp
dec ebx
add byte [edi + 0x5004bd3], dh
pop esp
call fcn.00494a57
invalid
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0x10]
jno 0x496fff
jo 0x4b6d8a
cpuid
jns 0x4b6d4d
jo 0x496fff
jno 0x4b024e
jo 0x4b6d9a
xchg ebx, eax
xchg ebp, eax
jo 0x4b024e
fdiv dword [edi - 0x17df1c40]
or dword [edx - 3], esp
jmp dword [esi - 0x77]
Function at 0x499f04
Capabilities:
Inspect section memory permissions

Disassembly:
lea esp, [esp + 4]
jmp 0x4903b3
Function at 0x49a7b9
Capabilities:
Inspect section memory permissions

Disassembly:
lea esp, [esp + 4]
push 0xa
mov eax, dword [ebp - 0x10]
push ecx
push edx
jmp 0x4accdb

Function at 0x49ad98
Capabilities:
Enumerate pe sections

Disassembly:
test ch, bh
add eax, 0x788b0000
cmp al, 3
clc
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x49adf5
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x49ade6
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0049aba1
mov eax, 0x8dbe5b13
inc ebp
test al, 0x50
call fcn.0049abb1
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0049ab66
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x49ae8f
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13

Function at 0x49eb56
Capabilities:
Inspect section memory permissions

Disassembly:
pop dword [esp - 4]
push 0x104
push ecx
mov dword [ebp - 0x18], edi
call fcn.004aa3b4
add esp, 8
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.004abe45
add esp, 8
lea eax, [ebp - 0x238]
push 0
mov ax, ax
shl di, 0x20
push eax
lea esi, [esi]
call fcn.0048cfb3
push esi
pop esi
add esp, 8
lea eax, [ebp - 0x238]
push 0
push eax
call fcn.0049ef2c
add esp, 8
lea eax, [ebp - 0x238]
shr dh, 0x40
push 0
push eax
call fcn.004b78a7
jno 0x4ae200
jo 0x49ebd2
xor eax, dword [edx + 0xf]
sub byte [eax], 0xf6
add byte [eax], al
jo 0x4ae200
invalid
add esp, 8
lea eax, [ebp - 0x238]
push eax
push edx
Function at 0x49f0a7
Capabilities:
Inspect section memory permissions

Disassembly:
pop dword [esp - 4]
test ebx, ebx
jb 0x49098c
jne 0x49f07e
je 0x4941b6
cmpsb byte [esi], byte es:[edi]
cpuid
ret
cmp dword [ebp - 0x10], 0
je 0x4941da
jne 0x4941c7
int 0x40
mov eax, dword [ebp - 0x10]
push eax
shr cx, 0x40
call fcn.0048e6f0
add esp, 4
push 0x27
shr bx, 0x40
mov eax, dword [esi]
jmp 0x4941e3
push eax
call fcn.004b6571
add esp, 8
pop edi
pop esi
pop ebx
jmp 0x49f06f
mov ax, ax
push eax
shl dl, 0x20
mov byte [esi + 0xba], cl
shl bp, 0x20
shr edx, 0x40
push edi
pop edi
shr eax, 0x40
mov byte [esi + 0xbb], 0
mov edi, edi
shl bp, 0x20
mov ax, ax
push esi
call fcn.004984a9
mov word [esi + 0xbc], di
or ebx, ebx
shr bp, 0x40
shr cl, 0x40
jae 0x4985d7
mov byte [0x66830f11], al
mov byte [0x3fda0000], al
jae 0x4a2843
fidivr dword [edi]
add esi, 4
test ecx, 0x1000
jb 0x4a7a63
jne 0x494271
je 0x4985fc
cmp edx, esi
call 0x5b44e8
add byte [ebp + 0x368d0c76], cl
call fcn.004997bf
mov esp, ebp
pop ebp
shr cl, 0x40
ret
lea eax, [ebp - 2]
push eax
ja 0x4b5765
jbe 0x49f08d
fisttp qword [eax - 0x2d79f040]
add word [eax], ax
jbe 0x4b5765
fidivr dword [edx - 0x35a177f1]
add byte [eax], al
jns 0x49f09f
stosb byte es:[edi], al
or byte [edi], 0x89
push esp
retf 0
jns 0x4abaf9
fmul st(1)
lea esp, [esp + 4]
mov word [esi + 0xbc], dx
shr cx, 0x40
xchg ebp, esi
xchg esi, ebp
mov eax, eax
mov cl, byte [ebp + 0xc]
ja 0x498593
mov ch, ch
shr di, 0x40
jbe 0x49f0cf
imul ecx, dword [edi], 0xf
xchg byte [esi - 0x2700006c], bh
pop es
jbe 0x498593
fadd dword [edi]
mov eax, dword [edi]
ja 0x4a1edd
jbe 0x49f0e4
dec byte [esi - 0xc79f0d7]
sub eax, 0xc5580000
dec ecx
add byte [eax], al
popal
add byte [eax + 0x60], al
add byte [ecx], ah
add byte [eax], al
cld
jbe 0x4a1edd
pop eax
lds ecx, [ecx]
add byte [ecx], ah
and byte [eax], 0
add byte [eax], al
and dword [eax], eax
add ah, bh
invalid
push 0x15
push eax
mov dx, dx
call fcn.004b6571
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test eax, 0xfb5e5d51
call fcn.004bf320
add esp, 0x14
jmp dword [esi]
push 0x48fb7f
push 0
push 0x51eb04
push ebx
ja 0x4a430e
jbe 0x4b577e
nop
cpuid
ret 0x860f
jbe 0x4a430e
add dl, 0x66
shr ebp, 0x40
xchg ebp, eax
xchg ebp, eax
jl 0x4b3520
jge 0x4b5797
int3
mov dx, dx
jmp fcn.0049d2b8

Function at 0x4a101b
Capabilities:
Inspect section memory permissions

Disassembly:
lea esp, [esp + 4]
mov ah, ah
jne 0x499a83
je 0x4a102d
int 0x6e
leave
aad 0xc0
loope 0x4a1050
shl cl, 0x20

Function at 0x4a10db
Capabilities:
Inspect section memory permissions

Disassembly:
call fcn.0048e6f0
add esp, 4
mov eax, dword [ebp - 0x20]
mov ecx, dword [esi]
push eax
jmp 0x4a0d38
push ecx
shl cx, 0x20
call fcn.004b6571
add esp, 8
pop edi
mov al, al
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop dword [esp - 4]
mov bx, bx
call fcn.004ac081
jmp 0x4bd03b
js 0x4b6d63
xchg ebp, eax
xchg ebp, eax
shr edx, 0x40
jns 0x4b482f
mov gs, word [eax - 0x7e]
jns 0x4b6d63
invalid
pop ebx