joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
test eax, eax
je 0x462c92
test ebx, ebx
je 0x462c92
test esi, esi
je 0x462c9c
xor edx, edx
lea ecx, [esi + 1]
mov dl, byte [esi]
lea eax, [edx + edx]
shl edx, 5
sub edx, eax
movsx eax, byte [esi]
test al, al
je 0x462b09
mov ebp, edx
mov edi, edx
shl ebp, 5
shr edi, 3
add edi, ebp
add eax, edi
xor edx, eax
movsx eax, byte [ecx]
inc ecx
test al, al
jne 0x462af1
mov ecx, edx
mov eax, edx
shl ecx, 5
shr eax, 3
lea eax, [ecx + eax + 0x3a]
xor eax, edx
movsx edx, byte [ebx]
lea ecx, [ebx + 1]
test dl, dl
je 0x462b3b
mov ebp, eax
mov edi, eax
shl ebp, 5
shr edi, 3
add edi, ebp
add edx, edi
xor eax, edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x462b23
mov ebp, dword [esp + 0x3c]
test ebp, ebp
je 0x462b78
mov ecx, dword [esp + 0x3c]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x462b68
nop
mov ebp, eax
mov edi, eax
shl ebp, 5
shr edi, 3
add edi, ebp
add edx, edi
xor eax, edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x462b50
mov ecx, eax
mov edx, eax
shl ecx, 5
shr edx, 3
lea edx, [ecx + edx + 0x3a]
xor eax, edx
mov edi, dword [esp + 0x40]
test edi, edi
je 0x462ba8
mov ecx, dword [esp + 0x40]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x462ba8
lea esi, [esi]
mov ebp, eax
mov edi, eax
shl ebp, 5
shr edi, 3
add edi, ebp
add edx, edi
xor eax, edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x462b90
mov ecx, dword [esp + 0x44]
test ecx, ecx
je 0x462be8
mov ecx, dword [esp + 0x44]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x462bd8
lea esi, [esi]
mov ebp, eax
mov edi, eax
shl ebp, 5
shr edi, 3
add edi, ebp
add edx, edi
xor eax, edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x462bc0
mov ecx, eax
mov edx, eax
shl ecx, 5
shr edx, 3
lea edx, [ecx + edx + 0x3a]
xor eax, edx
mov edx, dword [esp + 0x48]
test edx, edx
je 0x462c18
mov ecx, dword [esp + 0x48]
movsx edx, byte [ecx]
inc ecx
test dl, dl
je 0x462c18
lea esi, [esi]
mov ebp, eax
mov edi, eax
shl ebp, 5
shr edi, 3
add edi, ebp
add edx, edi
xor eax, edx
movsx edx, byte [ecx]
inc ecx
test dl, dl
jne 0x462c00
mov ecx, dword [esp + 0x30]
xor edx, edx
div dword [ecx + 4]
mov eax, dword [ecx]
lea edx, [edx + edx*2]
lea edi, [eax + edx*8]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x462c92
mov ebp, dword [esp + 0x3c]
jmp 0x462c3c
mov edi, dword [edi]
test edi, edi
je 0x462c92
mov eax, dword [edi + 4]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], esi
call fcn.00445480
test eax, eax
je 0x462c36
mov eax, dword [edi + 8]
mov ecx, dword [esp + 0x40]
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], ebp
call fcn.00445480
test eax, eax
je 0x462c36
mov ecx, dword [esp + 0x48]
mov eax, dword [edi + 0xc]
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 8], eax
mov dword [esp], ecx
call fcn.00445480
test eax, eax
je 0x462c36
mov eax, dword [edi + 0x10]
jmp 0x462c94
xor eax, eax
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
movsx edx, byte [ebx]
xor eax, eax
mov al, dl
lea ecx, [eax + eax]
shl eax, 5
sub eax, ecx
jmp 0x462b1c
Function at 0x463460
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, ecx
mov edi, dword [esp + 0x14]
test edx, edx
jle 0x4634d7
add edx, eax
xor ebx, ebx
mov cl, byte [eax]
inc eax
and ecx, 0xff
add ebx, ecx
mov esi, ebx
shl esi, 0xa
add esi, ebx
mov ebx, esi
shr ebx, 6
xor ebx, esi
cmp eax, edx
jne 0x463472
add ebx, 0x3a
mov eax, ebx
shl eax, 0xa
add ebx, eax
mov eax, ebx
shr eax, 6
xor eax, ebx
test edi, edi
jle 0x4634c1
mov ecx, ebp
add edi, ebp
xor edx, edx
mov dl, byte [ecx]
inc ecx
add eax, edx
mov edx, eax
shl edx, 0xa
add edx, eax
mov eax, edx
shr eax, 6
xor eax, edx
cmp ecx, edi
jne 0x4634a8
lea edx, [eax + eax*8]
pop ebx
mov eax, edx
pop esi
shr eax, 0xb
pop edi
xor eax, edx
pop ebp
mov edx, eax
shl edx, 0xf
add eax, edx
ret
mov eax, 0xeb9a
jmp 0x4634a0

Function at 0x4636e0
Capabilities:
Encode data using xor

Disassembly:
push edi
test edx, edx
push esi
mov edi, edx
push ebx
jle 0x463724
test eax, eax
je 0x463724
xor ecx, ecx
xor ebx, ebx
mov dl, byte [eax + ebx]
inc ebx
and edx, 0xff
add ecx, edx
mov esi, ecx
shl esi, 0xa
add esi, ecx
mov ecx, esi
shr ecx, 6
xor ecx, esi
cmp edi, ebx
jg 0x4636f1
lea edx, [ecx + ecx*8]
pop ebx
mov eax, edx
pop esi
shr eax, 0xb
pop edi
xor eax, edx
mov edx, eax
shl edx, 0xf
add eax, edx
ret
pop ebx
xor eax, eax
pop esi
pop edi
ret
Function at 0x464a00
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, edx
sub esp, 0x18
test edx, edx
je 0x464c00
mov ecx, dword [edx + 4]
mov dword [eax + 0x74], edx
cmp ecx, 0xd
jbe switch.0x00464a40
lea edx, [eax + 0x80]
mov dword [esp + 4], ecx
mov dword [esp], str.Unknown_node_type__d_n
mov ecx, 0x1393
mov eax, ebx
call fcn.00464970
add esp, 0x18
pop ebx
ret
jmp dword [ecx*4 + 0x6ef110]
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x464a36
mov eax, dword [eax]
mov dword [esp + 8], 0xe
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.HTML_DOCUMENT_n
call sub.msvcrt.dll_fwrite
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_NOTATION_node_n
mov ecx, 0x1392
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_FRAGMENT_node_n
mov ecx, 0x1391
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_DOCTYPE_node_n
mov ecx, 0x1390
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
mov ecx, dword [eax + 0x7c]
test ecx, ecx
jne 0x464a36
mov eax, dword [eax]
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.DOCUMENT_n
call sub.msvcrt.dll_fwrite
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_COMMENT_node_n
mov ecx, 0x138f
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_PI_node_n
mov ecx, 0x138e
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_ENTITY_node_n
mov ecx, 0x138d
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_ENTITYREF_node_n
mov ecx, 0x138c
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_CDATA_node_n
mov ecx, 0x138b
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_TEXT_node_n
mov ecx, 0x138a
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_ATTRIBUTE_node_n
mov ecx, 0x1389
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
lea edx, [eax + 0x80]
mov dword [esp], str.Misplaced_ELEMENT_node_n
mov ecx, 0x1388
mov eax, ebx
call fcn.004648e0
jmp 0x464a36
mov ebx, dword [eax + 0x7c]
test ebx, ebx
jne 0x464a36
mov eax, dword [eax]
mov dword [esp + 8], 0x13
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.DOCUMENT__NULL___n
call sub.msvcrt.dll_fwrite
jmp 0x464a36
Function at 0x464ed0
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jne 0x464f66
push edi
push esi
push ebx
mov edi, eax
sub esp, 0x10
mov esi, ecx
test ecx, ecx
je 0x464f85
xor ebx, ebx
jmp 0x464f18
cmp dl, 0x20
je 0x464f26
cmp dl, 0xd
je 0x464f26
test dl, dl
js 0x464f67
mov eax, dword [edi]
and edx, 0xff
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.msvcrt.dll_fputc
inc ebx
cmp ebx, 0x28
je 0x464f3e
mov dl, byte [esi + ebx]
test dl, dl
je 0x464f60
lea eax, [edx - 9]
cmp al, 1
ja 0x464ef0
mov eax, dword [edi]
inc ebx
mov dword [esp + 4], eax
mov dword [esp], 0x20
call sub.msvcrt.dll_fputc
cmp ebx, 0x28
jne 0x464f18
mov eax, dword [edi]
mov dword [esp + 8], 3
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6ef224
call sub.msvcrt.dll_fwrite
add esp, 0x10
pop ebx
pop esi
pop edi
ret
and edx, 0xff
mov dword [esp + 4], 0x6ef220
mov dword [esp + 8], edx
mov eax, dword [edi]
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x464f12
mov eax, dword [eax]
mov dword [esp + 8], 6
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6ef228
call sub.msvcrt.dll_fwrite
jmp 0x464f60

Function at 0x464fb0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, edx
mov ebx, eax
call fcn.00464890
test esi, esi
je 0x465067
cmp dword [esi + 4], 0x12
jne 0x465020
mov edx, dword [esi + 8]
test edx, edx
je 0x465040
mov eax, dword [ebx + 0x7c]
test eax, eax
jne 0x46501a
mov eax, dword [esi + 0xc]
test eax, eax
je 0x465092
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov dword [esp + 4], str.namespace__s_href
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, ebx
mov ecx, dword [esi + 8]
mov edx, dword [ebx + 0x7c]
call fcn.00464ed0
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
add esp, 0x14
pop ebx
pop esi
ret
lea edx, [ebx + 0x80]
mov eax, dword [ebx + 0x74]
mov dword [esp], str.Node_is_not_a_namespace_declaration
mov ecx, 0x13a3
call fcn.004648e0
add esp, 0x14
pop ebx
pop esi
ret
mov ecx, dword [esi + 0xc]
lea edx, [ebx + 0x80]
mov eax, dword [ebx + 0x74]
test ecx, ecx
je 0x4650c0
mov dword [esp + 4], ecx
mov dword [esp], str.Incomplete_namespace__s_hrefNULL_n
mov ecx, 0x13a4
call fcn.00464e40
jmp 0x46501a
mov ecx, dword [ebx + 0x7c]
test ecx, ecx
jne 0x46501a
mov eax, dword [ebx]
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.namespace_node_is_NULL_n
call sub.msvcrt.dll_fwrite
jmp 0x46501a
mov eax, dword [ebx]
mov dword [esp + 8], 0x17
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.default_namespace_href
call sub.msvcrt.dll_fwrite
jmp 0x464ffb
mov dword [esp], str.Incomplete_default_namespace_hrefNULL_n
mov ecx, 0x13a4
call fcn.004648e0
jmp 0x46501a
Function at 0x465a30
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, eax
mov ebx, edx
test edx, edx
je 0x465a71
call fcn.00465bd0
mov eax, dword [ebx + 4]
cmp eax, 0x12
je 0x465a6b
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x465a6b
cmp eax, 5
je 0x465a6b
mov eax, dword [esi + 0x6c]
inc eax
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.00465ab0
mov eax, dword [esi + 0x6c]
dec eax
mov dword [esi + 0x6c], eax
add esp, 0x14
pop ebx
pop esi
ret
mov edx, dword [eax + 0x7c]
test edx, edx
jne 0x465a6b
call fcn.00464890
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0xd
mov dword [esp + 4], 1
mov dword [esp], str.node_is_NULL_n
call sub.msvcrt.dll_fwrite
jmp 0x465a6b

Function at 0x465ae0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, edx
mov ebx, eax
call fcn.00464890
test esi, esi
je 0x465b71
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x465b12
mov eax, dword [esi + 8]
test eax, eax
je 0x465b80
add esp, 0x14
mov edx, esi
mov eax, ebx
pop ebx
pop esi
jmp 0x4652f0
mov eax, dword [ebx]
mov dword [esp + 8], 0xa
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.ATTRIBUTE
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x7c]
mov ecx, dword [esi + 8]
mov eax, ebx
call fcn.00464ed0
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov edx, dword [esi + 0xc]
test edx, edx
je 0x465af9
mov eax, dword [ebx + 0x6c]
inc eax
mov dword [ebx + 0x6c], eax
mov eax, ebx
call fcn.00465ab0
mov eax, dword [ebx + 0x6c]
dec eax
mov dword [ebx + 0x6c], eax
jmp 0x465af9
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x465ba0
add esp, 0x14
pop ebx
pop esi
ret
lea edx, [ebx + 0x80]
mov eax, dword [ebx + 0x74]
mov dword [esp], str.Attribute_has_no_name
mov ecx, 0x1397
call fcn.004648e0
jmp 0x465b04
mov eax, dword [ebx]
mov dword [esp + 8], 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Attr_is_NULL
call sub.msvcrt.dll_fwrite
jmp 0x465b78
Function at 0x466a50
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, edx
test edx, edx
je 0x466baf
mov esi, eax
call fcn.00464a00
mov eax, dword [esi + 0x7c]
test eax, eax
jne 0x466b98
mov ecx, dword [ebx + 8]
test ecx, ecx
je 0x466ab9
mov eax, dword [esi]
mov dword [esp + 8], 5
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6efb70
call sub.msvcrt.dll_fwrite
mov eax, esi
mov ecx, dword [ebx + 8]
mov edx, dword [esi + 0x7c]
call fcn.00464ed0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov edx, dword [ebx + 0x38]
test edx, edx
je 0x466b01
mov eax, dword [esi]
mov dword [esp + 8], 8
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], 0x6efb76
call sub.msvcrt.dll_fwrite
mov eax, esi
mov ecx, dword [ebx + 0x38]
mov edx, dword [esi + 0x7c]
call fcn.00464ed0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x466b49
mov eax, dword [esi]
mov dword [esp + 8], 9
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.encoding
call sub.msvcrt.dll_fwrite
mov eax, esi
mov ecx, dword [ebx + 0x3c]
mov edx, dword [esi + 0x7c]
call fcn.00464ed0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x466b91
mov eax, dword [esi]
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.URL
call sub.msvcrt.dll_fwrite
mov eax, esi
mov ecx, dword [ebx + 0x48]
mov edx, dword [esi + 0x7c]
call fcn.00464ed0
mov eax, dword [esi]
mov dword [esp + 4], eax
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
mov eax, dword [ebx + 0x28]
test eax, eax
jne 0x466bb5
mov ebx, dword [ebx + 0x34]
test ebx, ebx
je 0x466baf
nop
mov edx, ebx
mov eax, esi
call fcn.00464fb0
mov ebx, dword [ebx]
test ebx, ebx
jne 0x466ba0
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [esi]
mov dword [esp + 8], 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.standalonetrue_n
call sub.msvcrt.dll_fwrite
jmp 0x466b98

Function at 0x466be0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, eax
mov ebx, edx
test edx, edx
je 0x466c20
call fcn.00466a50
mov eax, dword [ebx + 4]
and eax, 0xfffffffb
cmp eax, 9
jne 0x466c19
mov edx, dword [ebx + 0xc]
test edx, edx
je 0x466c19
mov eax, dword [esi + 0x6c]
inc eax
mov dword [esi + 0x6c], eax
mov eax, esi
call fcn.00465ab0
mov eax, dword [esi + 0x6c]
dec eax
mov dword [esi + 0x6c], eax
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [eax + 0x7c]
test eax, eax
jne 0x466c19
mov eax, dword [esi]
mov dword [esp + 8], 0x13
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.DOCUMENT__NULL___n
call sub.msvcrt.dll_fwrite
jmp 0x466c19
Function at 0x47bd00
Capabilities:
Encrypt data using rc4 ksa
Parse credit card information
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
pop ebx
jmp fcn.0047bec0

Function at 0x47e1b0
Capabilities:
Encrypt data using rc4 ksa
Parse credit card information
Parse pe header

Disassembly:
push ebx
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 1
pop ebx
jmp fcn.0047bec0
Function at 0x4914b0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
mov eax, dword [eax + 0x24]
test eax, eax
jle 0x491506
dec eax
mov edx, dword [ebx + 0x28]
mov dword [ebx + 0x24], eax
shl eax, 4
add eax, edx
mov edx, dword [eax]
mov dword [ebx + 0x14], edx
mov edx, dword [eax + 4]
mov dword [ebx + 0x38], edx
mov edx, dword [eax + 8]
mov dword [ebx + 0x18], edx
mov edx, dword [ebx + 8]
mov edx, dword [edx + 0x14]
test edx, edx
jle 0x491501
mov eax, dword [eax + 0xc]
test eax, eax
je 0x491511
mov ecx, dword [ebx + 0x2c]
mov dword [esp + 4], eax
shl edx, 2
mov dword [esp], ecx
mov dword [esp + 8], edx
call sub.msvcrt.dll_memcpy
add esp, 0x18
pop ebx
ret
mov dword [ebx], 0xffffffff
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1c
add eax, 0x40
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
mov dword [esp], str.exec_save:_allocation_failed
call sub.msvcrt.dll_fwrite
mov dword [ebx], 0xfffffffa
jmp 0x491501
Function at 0x492a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov edi, edx
test edx, edx
mov dword [esp + 0x1c], eax
je 0x492b27
mov eax, dword [eax + 0x4c]
mov ebp, ecx
and eax, 1
mov ecx, dword [edx + 0x14]
xor eax, 1
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test ecx, ecx
jle 0x492b27
xor ebx, ebx
mov dword [esp + 0x18], 1
jmp 0x492a8c
cmp dword [esi + 4], ebp
je 0x492af0
inc ebx
cmp ebx, dword [esp + 0x10]
je 0x492ae0
mov eax, dword [edi + 0x18]
lea edx, [ebx + ebx*4]
lea esi, [eax + edx*4]
mov eax, dword [esi]
test eax, eax
jne 0x492a80
mov eax, dword [esi + 4]
test eax, eax
js 0x492a85
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 0x34]
mov ecx, ebp
mov edx, dword [edx + eax*4]
mov eax, dword [esp + 0x40]
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call fcn.00492a40
mov ecx, dword [esp + 0x18]
test eax, eax
setne al
and eax, 0xff
inc ebx
neg eax
and ecx, eax
cmp ebx, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
jne 0x492a8c
nop
lea esi, [esi]
mov eax, dword [esp + 0x18]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, dword [esp + 0x40]
je 0x492b13
mov edx, dword [esp + 0x40]
test edx, edx
je 0x492a85
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x40]
call fcn.004923c0
test eax, eax
je 0x492a85
mov dword [esi + 0x10], 1
mov dword [esp + 0x18], 0
jmp 0x492a85
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x493970
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov dword [esp + 4], 0
jmp fcn.00491550
Function at 0x499ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, edx
mov dword [edx + 0x4c], 0
mov dword [edx + 0x50], 0
mov edx, dword [edx + 0x20]
mov edi, eax
test dl, 1
je 0x49a0a8
mov eax, dword [esi + 0xc]
test eax, eax
je 0x499f0c
mov dword [esp], eax
call dword [0x6713e0]
mov dword [esi + 0xc], 0
mov eax, dword [esi + 0x10]
test eax, eax
je 0x499f23
mov dword [esp], eax
call dword [0x6713e0]
mov dword [esi + 0x10], 0
mov edx, dword [esi + 0x20]
and edx, 2
je 0x49a09c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x499f46
mov dword [esp], eax
call dword [0x6713e0]
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x499f5c
mov dword [esp], eax
call fcn.0047a110
mov dword [esi + 0x18], 0
mov ebx, dword [esi + 0x38]
test ebx, ebx
je 0x49a004
add edi, 0x78
mov dword [esp + 0x18], edi
nop
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 0x1c], edx
test ecx, ecx
je 0x499fba
mov edi, dword [ebx + 0x1c]
test edi, edi
jle 0x499fba
xor ebp, ebp
jmp 0x499f93
mov ecx, dword [ebx + 0x18]
lea edi, [ebp*4]
mov ecx, dword [ecx + edi]
test ecx, ecx
je 0x499fb4
mov dword [esp], ecx
call dword [0x6713e0]
mov ecx, dword [ebx + 0x18]
mov dword [ecx + edi], 0
inc ebp
cmp ebp, dword [ebx + 0x1c]
jl 0x499f90
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x499fd7
cmp dword [ebx + 0x14], 0x18
je 0x49a067
call fcn.00498180
mov dword [ebx + 0x20], 0
mov edx, dword [esp + 0x18]
mov dword [ebx + 8], 0
mov eax, dword [edx]
test eax, eax
je 0x499feb
mov dword [ebx + 0xc], eax
mov edx, dword [esp + 0x18]
mov dword [edx], ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x499f70
mov dword [esi + 0x38], 0
mov eax, dword [esi + 0x34]
test eax, eax
je 0x49a024
nop
lea esi, [esi]
mov ebx, dword [eax]
call fcn.004983c0
mov eax, ebx
test ebx, ebx
jne 0x49a010
mov dword [esi + 0x34], 0
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x49a03a
mov dword [esp], eax
call fcn.004938b0
mov dword [esi + 0x3c], 0
mov eax, dword [esi + 0x40]
test eax, eax
je 0x49a05f
mov dword [esp], eax
call dword [0x6713e0]
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [eax + 4]
test edx, edx
jle 0x499fcb
xor ebp, ebp
mov eax, dword [eax]
mov edi, dword [eax + ebp*4]
inc ebp
mov ecx, dword [edi + 4]
mov dword [esp], ecx
call dword [0x6713e0]
mov dword [esp], edi
call dword [0x6713e0]
mov eax, dword [ebx + 0x20]
cmp ebp, dword [eax + 4]
jl 0x49a074
jmp 0x499fcb
mov dword [esi + 0x14], 0
jmp 0x499f46
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
jmp 0x499f26
Function at 0x4affd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, eax
test eax, eax
je 0x4b0006
push esi
push ebx
push esi
mov esi, edx
cmp dword [edx], 1
jne 0x4b0030
mov ebx, dword [eax]
cmp ebx, 1
je 0x4b0000
test byte [eax + 0x32], 0x40
jne 0x4b0000
cmp ebx, 5
je 0x4b0020
xor eax, eax
cmp ebx, 4
je 0x4b0010
pop edx
pop ebx
pop esi
ret
pop edx
xor eax, eax
pop ebx
pop esi
ret
xor eax, eax
ret
mov edx, ecx
mov eax, esi
pop ecx
pop ebx
pop esi
jmp fcn.004adf60
mov edx, eax
mov eax, esi
pop ebx
pop ebx
pop esi
jmp fcn.004b1350
mov eax, esi
mov ecx, str.this_function_needs_a_parser_context
mov edx, str.xmlSchemaTypeFixup
call fcn.0049e770
or eax, 0xffffffff
jmp 0x4afff9