joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042ff5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x1006efc0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10043035
cmp byte [ebx], 0xa
jne 0x10043035
or byte [eax + edi + 0x28], 4
jmp 0x1004303a
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x10043138
mov al, byte [edx]
cmp al, 0x1a
je 0x1004311a
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x10043069
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x1004308e
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x10043098
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x1004304b
jmp 0x10043138
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10043115
cmp dword [ebp - 0xc], 0
je 0x10043115
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x1006efc0]
test byte [eax + edi + 0x28], 0x48
je 0x100430ef
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x100430da
mov byte [esi], dl
jmp 0x100430eb
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x1006efc0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10043138
cmp byte [ebp - 1], 0xa
jne 0x100430fe
cmp esi, ebx
jne 0x100430fe
mov byte [esi], 0xa
jmp 0x10043137
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10043c07
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10043138
mov byte [esi], 0xd
jmp 0x10043137
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x1006efc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10043134
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10043138
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10043141
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1006efc0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10043184
cmp word [esi], dx
jne 0x10043184
or byte [edi + eax + 0x28], 4
jmp 0x10043189
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x100432dc
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x100432bc
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x100431cb
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10043201
cmp eax, edx
jae 0x1004320d
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x100431a3
jmp 0x100432dc
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x100432b8
cmp dword [ebp - 0x14], 0
je 0x100432b8
mov eax, dword [ebx*4 + 0x1006efc0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10043290
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10043259
mov word [esi], cx
jmp 0x1004328c
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1006efc0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1006efc0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1006efc0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x100432dc
pop ebx
cmp word [ebp - 4], bx
jne 0x100432a1
cmp esi, dword [ebp + 0xc]
jne 0x100432a1
mov word [esi], bx
jmp 0x100432d9
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10043c07
add esp, 0x10
cmp word [ebp - 4], bx
je 0x100432dc
push 0xd
jmp 0x100432d5
mov ecx, dword [ebx*4 + 0x1006efc0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x100432d3
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x100432dc
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10047153
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100471f0
push ebx
push esi
call fcn.1004711c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10041b25
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1004719d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100471ef
push edi
push eax
call fcn.1003b4ca
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100471bd
call fcn.1003b490
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100471ee
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10041b25
add esp, 0x20
test eax, eax
jne 0x100471dc
push edi
call fcn.1003b490
jmp 0x100471e4
push ebx
call fcn.1003b490
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100471f3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10047204
pop esi
ret
push ebx
push edi
push esi
call fcn.1004711c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003b4ca
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1004722c
push ebx
push esi
push edi
call fcn.10020730
add esp, 0xc
push 0
call fcn.1003b490
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100475f0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10047241
Function at 0x1004e191
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004e10d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004e309
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004e309
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004e2b8
jg 0x1004e1ea
test eax, eax
je 0x1004e2ae
push 1
push 0x1000
call fcn.1003b433
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004e210
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1004e2a5
push 0x8000
push ebx
call fcn.1004e03e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004e23c
jg 0x1004e237
cmp ecx, 0x1000
jb 0x1004e23c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100413a5
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004e281
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004e237
jl 0x1004e268
test ecx, ecx
jne 0x1004e229
push dword [ebp - 0xc]
push ebx
call fcn.1004e03e
push esi
call fcn.1003b490
add esp, 0xc
xor edi, edi
jmp 0x1004e31a
cmp byte [edi + 0x24], 0
je 0x1004e298
cmp dword [edi + 0x20], 5
jne 0x1004e298
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004e2a3
mov edi, dword [edi + 0x18]
jmp 0x1004e2a5
xor edi, edi
push esi
call fcn.1003b490
pop ecx
jmp 0x1004e31a
test ecx, ecx
jg 0x1004e27a
jl 0x1004e2b8
test eax, eax
jae 0x1004e27a
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10043c07
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004e2db
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1004e27a
jmp 0x1004e312
push ebx
call fcn.1004b711
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004e27a
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1004e31a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1004e317
mov edi, dword [edi + 0x18]
jmp 0x1004e31a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10043c07
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004ef50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004ef7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004ef7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x475ef9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475f27
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475f45
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475e63
jmp 0x475f45
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475f45
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475e63
test edi, edi
mov eax, edi
jne 0x475f2f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c1a7c]
test ecx, ecx
je 0x475ff8
jmp 0x475ef8
ret 8

Function at 0x48d8d0
Capabilities:
Encode data using xor

Disassembly:
rol ecx, cl
jmp 0x9db372a
mov cl, 0x49
xor byte [esi - 0x1f77ee53], al
outsb dx, byte [esi]
jle 0x48d8a9
xor byte [esi + ebx - 0x71fd0fea], bh
or byte [esi - 0x16069d5d], ah
cmpsd dword [esi], dword es:[edi]
outsb dx, byte [esi]
pop esp
add byte [eax - 0x1f], bl
lodsb al, byte [esi]
xor al, 0x88
mov cl, 0x9f
mov ebp, 0x321fbd9c
pushal
fdivr qword [edi]
mov esp, 0x465e4ead
wait
sbb eax, 0x8e67e451
ficomp dword cs:[ecx]
in eax, 0x96
jae 0x48d8e3
int3

Function at 0x48de30
Capabilities:
Encode data using xor

Disassembly:
neg edx
inc eax
xlatb
inc eax
sub ch, byte [ebp + 0x3f]
dec ebp
mov edx, 0x6f8a87e4
outsd dx, dword [esi]
xchg edi, eax
xor byte [edi], ah
stosd dword es:[edi], eax
adc ah, byte [0xd69dcfc3]
mov ebp, 0xf399d473
pop ss
nop
mov dword [0xa70d66f0], eax
je 0x48de3e
fcom qword [ecx + ebx*8 - 0x5d]
invalid
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x70013af3
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x476317ea
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001930
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
test eax, eax
je 0x10001998
cmp byte [esi + eax - 1], 0xa
mov ebx, eax
je 0x10001990
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10007084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov eax, 1
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
xor eax, eax
jmp 0x1000195a
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop ebp
ret
Function at 0x10002010
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xe0
mov ebx, dword [ebp + 0xc]
mov dword [esp], ebx
call sym.___wine_dbg_get_channel_flags
movzx ecx, byte [ebp + 8]
movzx eax, al
sar eax, cl
test al, 1
je 0x100021f8
mov edx, dword [0x10007084]
mov eax, dword fs:[0x18]
cmp dword [eax + 0x24], edx
je 0x100021e8
test byte [0x10003030], 8
jne 0x10002190
lea edi, [ebp - 0xd4]
mov esi, edi
test byte [0x10003040], 8
jne 0x10002150
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
mov ecx, str._04x:
mov dword [esp + 4], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym._sprintf
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x1000209a
cmp dword [ebp + 8], 3
jbe 0x10002108
mov dword [esp], 2
mov ebx, edi
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov esi, dword [ebx]
add ebx, 4
lea ecx, [esi - 0x1010101]
not esi
and ecx, esi
and ecx, 0x80808080
je 0x100020a9
mov dword [esp + 0xc], eax
mov esi, ecx
mov eax, 1
mov dword [esp + 4], eax
shr esi, 0x10
test ecx, 0x8080
mov dword [esp], edi
cmove ecx, esi
lea esi, [ebx + 2]
mov dl, cl
cmove ebx, esi
add dl, cl
sbb ebx, 3
sub ebx, edi
mov dword [esp + 8], ebx
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0xe0
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0x10]
add eax, esi
inc ebx
mov dword [esp + 0x10], ebx
mov dword [esp], eax
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov ecx, dword [edx*4 + 0x10005308]
mov edx, str._s:_s:_s
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov ecx, edi
sub ecx, eax
add ecx, 0xc8
mov dword [esp + 4], ecx
call sym._snprintf.constprop.0
jmp 0x1000209a
mov dword [esp], 0x10003040
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x1000206f
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x20]
mov ecx, str._04x:
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._sprintf
add esi, eax
jmp 0x1000206f
mov dword [esp], 0x10003030
call sym.___wine_dbg_get_channel_flags
and al, 8
je 0x1000205a
call dword [sym.imp.kernel32.dll_GetTickCount]
mov edx, 0x10624dd3
mov esi, str._3u._03u:
mov dword [esp + 4], esi
lea edi, [ebp - 0xd4]
mov dword [esp], edi
mov ecx, eax
mul edx
shr edx, 6
mov dword [esp + 8], edx
imul eax, edx, 0x3e8
sub ecx, eax
mov dword [esp + 0xc], ecx
call sym._sprintf
lea esi, [edi + eax]
jmp 0x10002062
add esp, 0xe0
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x100020f7
Function at 0x407f3a
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x469f80
call fcn.00408690
push 1
call fcn.004080fd
pop ecx
test al, al
jne 0x407dbf
push 7
call fcn.00408442
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.00408000
mov byte [ebp - 0x24], al
mov eax, dword [0x46cedc]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x407db8
test eax, eax
jne 0x407e29
mov dword [0x46cedc], ecx
push 0x45b2fc
push 0x45b2e0
call fcn.004365cd
pop ecx
pop ecx
test eax, eax
je 0x407e0c
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x407f02
push 0x45b2dc
push 0x45b2d4
call fcn.00436571
pop ecx
pop ecx
mov dword [0x46cedc], 2
jmp 0x407e2e
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.00408257
pop ecx
call fcn.00408436
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x407e5e
push esi
call fcn.004081cd
pop ecx
test al, al
je 0x407e5e
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00408682
call esi
call fcn.0040843c
mov esi, eax
cmp dword [esi], edi
je 0x407e7c
push esi
call fcn.004081cd
pop ecx
test al, al
je 0x407e7c
push dword [esi]
call fcn.00436964
pop ecx
call fcn.0040855d
movzx eax, ax
push eax
call fcn.004364d8
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.00408593
test al, al
jne 0x407ea7
push esi
call fcn.0043699c
test bl, bl
jne 0x407eb0
call fcn.00436939
push edi
push 1
call fcn.00408274
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x407f02
call fcn.004086d6
ret
call fcn.00503000
jmp 0x407da0

Function at 0x43f15d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043e937

Function at 0x43f168
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043eb72

Function at 0x446d4c
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446b40

Function at 0x451e64
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451a69

Function at 0x451e6f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00451bea
Function at 0x428d40
Capabilities:
Encode data using xor

Disassembly:
jmp 0x428d4b
push 0xffffffffffffffd2
xchg byte [esi], ah
or byte [edx + 0x28], 0x45
dec eax
dec eax
fsub qword [edi]
in eax, dx
and bl, byte [ecx - 0x6a]
mov dword [0x4bf8e15a], eax
stosb byte es:[edi], al
out dx, al
sbb bh, byte [edx]
ja 0x428d94
cdq
insb byte es:[edi], dx
add dh, ah
invalid
invalid

Function at 0x42e822
Capabilities:
Encode data using xor

Disassembly:
or ecx, dword [esp + esi*8 + 0x58e525a7]
push esi
or dword [ecx - 0x18a6af59], edi
xchg dword [edi + 0x34], ebp
add eax, 0x62fa176c
mov es, esp
adc al, 0x16
fist dword [edx]
push ecx
nop
push edi
sbb dword [edx], eax
imul ebx, dword [ebp + 0x54d7b278], 0x39
int1
stosd dword es:[edi], eax
test eax, 0x419dd03a
and bl, byte [esi - 0x3e89b946]
mov dl, 0x36
adc al, 0x53
scasd eax, dword es:[edi]
out dx, al
sbb ebx, dword [esi]
mov dword [ebx + 0x484a6223], ebp
iretd
pop esi
sbb ecx, dword [ebp + 0x28968c66]
jo 0x42e7a8
clc
clc
dec ecx
pop edx
and eax, 0x8e29d902
js 0x42e81d
sub dword [esi - 0x7c6e0388], ecx
neg byte [ecx - 0x5b]
xchg ecx, eax

Function at 0x43d93c
Capabilities:
Encode data using xor

Disassembly:
pop ds
dec ebp
mov bh, 0xd9
std
inc ebx
inc esi
mov eax, 0xcc09304e
add bh, byte [ecx + edx + 0x5a2c09ad]
mov cl, 0xac
xchg ecx, eax
pop ebx
cmp byte [edi], 0xc6
js 0x43d830
dec esi
xor byte [ecx], cl
int3
and byte [0x2921ad7b], bl
jg 0x43d8bc
fcomp st(0)
in al, 0x81
hlt
rol esi, 1
adc ebx, dword [esi]
daa
outsb dx, byte [esi]
inc esi
salc
jg 0x43d827
invalid
adc bh, ah
sal ecx, 1
mov eax, dword [0xcc2448c9]
mov dword [0xde45bbae], eax
sal byte [edx + 0x200e15ec], cl
lea edx, [ecx + 0x1f6eb741]
inc esi
invalid
jl 0x43d878
dec ecx
push ss
jo 0x43d963
mov edx, 0xda9ed0c2
or ah, byte [0x22112151]
add eax, 0x7040979e
pop es
ljmp 0xf970
mov byte [0xff7b9e5c], al
push 0xcd1b4dbe
cmp al, 8
cmc
insd dword es:[edi], dx
js 0x43d8e6
test byte [ebx + 0x4a53a8b8], ah
xchg esp, eax
and eax, 0x6afd477
mov ebp, 0xaac25683
cmc
dec edi
rcl ebx, 1
push eax
jbe 0x43d9db
sub eax, 0x5313b605
mov byte [ecx], bh
sbb byte [ebp + 0x1e], dl
lodsd eax, dword [esi]
push cs
sub dword [ebx], 0xa5db2cbc
jmp [ecx + 0x6db76119]
test dword [esi + 0x65b2ba6f], edx
invalid

Function at 0x444b0a
Capabilities:
Encode data using xor

Disassembly:
test dword [ebx], esp
pop ebx
rol dword [edx], cl
stosb byte es:[edi], al
out dx, eax
adc eax, 0x96369e28
aam 0x3b
add byte [esi - 0x47], dh
jb 0x444b40
mov ecx, 0x85ae2272
cmc
scasb al, byte es:[edi]
test ebp, esi
cmp edx, dword [ecx + 0x627198e0]
add byte [ebx + eax*4 + 0x1caffb69], bl
outsd dx, dword [esi]
xor dh, byte [edx - 0xe]
inc ecx
in al, 0x66
sbb al, 0x80
jle 0x444b1b
push ecx
jg 0x444baa
sub byte [ebp + ecx + 0x1f], ah
pop es
in al, dx
inc edi
or eax, 0x343d8da7
sbb edx, dword [eax - 0x26f6e873]
and ch, cl
xchg edi, eax
and byte [edi + 0x29a6ff33], bl
push ebp
inc ebp
jmp 0x722e7364
leave
inc esi
in eax, 0x84
out dx, al
fisubr dword [edx + 0x2d]
invalid
Function at 0x45b74a
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x60c63461
int 0xa0
popfd
cmp esp, dword [edx + esi*2 + 0x6e]
xchg ebp, eax
invalid
movsb byte es:[edi], byte [esi]
pop ebp
or bl, al
sub eax, 0x964e85ff
cmp byte [ecx], dh
js 0x45b768
jbe 0x45b6eb
adc edi, dword [ebx + 0x69ea3b3]
mov bl, 0xa3
sahf
push es
push edi
xor dword [ebp + 0x77e6c407], edi
cmp edx, dword [0x6af26804]
jbe 0x45b7ea
add al, 0x68
push 0x76
jl 0x45b740
rcr dword [edx + 0x2d], 1
invalid
pop edx
sub eax, 0x99684a8f
mov byte [0x4594a0cc], al
jb 0x45b75b
push edi
xor eax, 0xe13421d0
adc cl, ah
imul ebx, dword [edx], 7
pop eax
inc eax
adc eax, 0x59215b17
adc al, 0x39
mov eax, dword [0x6c34b11c]
xor bl, byte [eax]
sbb ah, byte [edi + ebx*8]
sub ebx, ebx
mov ch, dl
retf 0x8f98
cmpsb byte [esi], byte es:[edi]
retf

Function at 0x4ad568
Capabilities:
Encode data using xor

Disassembly:
fld xword [eax + 0x13]
pop edi
test dword [ebp - 0x78], esi
mov ecx, 0xcf4925ed
pop esi
aaa
enter 0x6e46, 0x4b
lcall 0xfefe, 0x29bc0405
pop ds
inc ecx
lds edi, [edx + 0x66]
dec ebx
ror byte [eax], 1
ficomp word [0x39f7d4c4]
sbb eax, 0xb6fe0518
push edx
adc al, 0x3e
dec esi
adc eax, 0xa7992681
mov dword [edi], esi
or dl, byte [eax + eax]
in eax, 0xf2
loope 0x4ad5da
invalid
jno 0x4ad571
pop es
jne 0x4ad56f
add al, 0xa0
or eax, 0xe0bc7165
or eax, 0xf8adabaa
jno 0x4ad52e
mov esp, 0xabaa0de0
loopne 0x4ad581
stosb byte es:[edi], al
stosd dword es:[edi], eax
lodsd eax, dword [esi]
clc
and dword [edx - 0x15], ebx
popfd
jp 0x4ad52b
xor byte [ecx - 0x74], bl
pop ebx
and al, 0x47
xor bh, cl
imul esi, dword [ecx + 0x7472e560], 0x2b
sbb bl, byte [ebp - 0x7b38e353]
xchg ebp, eax
jnp 0x4ad582
mov al, byte [0x81f56144]
test dword [esp - 0x7b057ae0], esp
push eax
add dword [ebx - 0x14796864], esi
push cs
mov eax, 0x32982791
movsd dword es:[edi], dword [esi]
les esi, [edx + esi*4 - 0x3c]
or dword [ecx - 0x5f], ebp
push cs
imul ecx, dword [eax - 0x48d84a13], 0x13
mov bl, 0xa8
invalid
loop 0x4ad572
int1
shr byte [esi - 0x7a], 1
xchg byte [0x86030226], dl
lea ebp, [edx]
push es
lodsb al, byte [esi]
jecxz 0x4ad64f
and al, 0xb7
in al, dx
and byte [edi - 0x56], 0x9e
dec ebp
mov byte [0xa3148e67], al
mov dword [0xf1fdead2], eax
jbe 0x4ad68b
xchg edi, eax
ret 0x2e0a
inc ecx
scasd eax, dword es:[edi]
shl dword [edi + 0x1b9fce58], 1
neg dword [esi + ebp*8 - 0x59]
dec ebx
pop ebx
rep insd dword es:[edi], dx
inc edx
cli
and bh, byte [edi - 0x4d]
mov esp, 0x1ad78bb2
fcomp dword [esi + edx*4 + 0x7a77db4f]
xlatb
and byte [edi - 0x103f9e47], ch
mov ch, 5
ret