joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b124
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x1003b06d
add ebx, 0
push ecx
call 0x1003b082
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x72ca7130
sub ebx, dword [0x72cc696f]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x72cc695f
call fcn.10036b4c
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.1003605a
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1003b1e0
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1003b1e0
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x1003b197
mov eax, 1
lock xchg dword [0x72cc696b], eax
push 0x3dd1fc71
call 0x1003b124
push esi
add esp, 8
cmp eax, 0
jne 0x1003b10d
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1003b133
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x1003b148
cmp ecx, edx
cmp eax, 0
je 0x1003b16d
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x1003b157
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.1003b186
dec eax
loope 0x1003b189
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x72cc696b], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x1003b1bd
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1003b1d2
jmp 0x1003b1dd
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x1003b0cb
Function at 0x10042245
Capabilities:
Access peb ldr_data

Disassembly:
add esp, 8
and dword [esp], ebx
push ecx
push edx
push edi
push esi
or edi, 0xffffffff
not edi
add edi, dword [ebp + 8]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov ecx, dword [eax + 0xc]
push ecx
xor edx, edx
mov ecx, dword [ecx]
cmp ecx, dword [esp]
je 0x1004251b
push ebp
push 0xffffffffffffffff
sub esp, 0x32
mov dword [esp + 0x2e], 0x72cb35e3
add esp, 0x2e
sub esp, 4
mov dword [esp], 0x72caa5a9
push 0xffffffffffffffff
call fcn.10039445
xchg edx, eax
and eax, 0
add eax, 0x75d46dc4
push ecx
and ecx, 0xcfb6d7ec
mov ecx, esp
mov dword [ecx - 0x54], esi
pop ecx
ja 0x100422af
and eax, eax
xchg edx, eax
mov edx, dword [ecx + edx - 0x75d46dac]
call fcn.100422c7
mov byte [0xee69f033], al
invalid
mov eax, ecx
pop esi
mov edi, dword [esp]
add esp, 4
pop edx
xor ecx, ecx
add ecx, 0xffffffff
and ecx, dword [esp]
xor ecx, 0
add esp, 4
pop ebx
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
jno 0x1004250f
xor eax, 0
ret 4
xor ecx, ecx
jmp 0x100424e3
Function at 0x10051d15
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10051d37
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10051d37
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10051d37
ret
cmp word [ebx + 4], 0x14c
jne 0x10051d37
test word [ebx + 0x16], 2
je 0x10051d37
test word [ebx + 0x16], 0x100
je 0x10051d37
cmp word [ebx + 0x18], 0x10b
jne 0x10051d37
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10051d37
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10051dc3
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10051d57
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10038ca2
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10051d37
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8

Function at 0x10051dc3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
lea esp, [esp - 0x10]
mov dword [esp + 0xc], edx
lea esp, [esp + 0xc]
sub esp, 4
mov dword [esp], 0x8b92e34e
mov dword [esp], edi
push esi
mov eax, dword [ebp + 8]
and ax, 0xf001
dec eax
cmp word [eax], 0x5a4d
jne 0x10051d37
mov ebx, dword [eax + 0x3c]
cmp ebx, 0xf08
ja 0x10051d37
add ebx, eax
cmp dword [ebx], 0x4550
jne 0x10051d37
ret
cmp word [ebx + 4], 0x14c
jne 0x10051d37
test word [ebx + 0x16], 2
je 0x10051d37
test word [ebx + 0x16], 0x100
je 0x10051d37
cmp word [ebx + 0x18], 0x10b
jne 0x10051d37
mov edx, dword [ebx + 0x78]
cmp edx, 0
je 0x10051d37
lea edx, [eax + edx]
mov edx, dword [edx + 0xc]
push 0xe1641d81
call 0x10051dc3
adc al, 0xbd
mov dl, 3
cmp byte [ecx + 0x75ac5ffe], 0xa
jnp 0x10051d57
int1
salc
push edi
inc esp
add esp, 8
lea edx, [edx + eax]
mov ebx, eax
push edx
call fcn.10038ca2
xchg ebx, eax
cmp ebx, dword [ebp + 0xc]
jne 0x10051d37
sub esp, 0x3e
mov esi, dword [esp + 0x3e]
add esp, 0x42
pop edi
mov edx, dword [esp]
add esp, 4
pop ecx
pop ebx
leave
ret 8
Function at 0x10051e7a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10051ed3
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10051e7a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10051e89
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10457b2c
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10051eda
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10038d50
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10051f79
add edi, 4
add eax, 2
dec ecx
jne 0x10051ebf
call 0x10051f26
loope 0x10051f1c
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10051f76
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10051f87
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10051f3a
cmp eax, ecx
ja 0x10051f3a
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10051fc4
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10051fba
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1003922f
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x10051e89
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10051ed3
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x10051e7a
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x10051e89
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x10457b2c
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10051eda
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.10038d50
cmp eax, dword [ebp + 0xc]
pop eax
je 0x10051f79
add edi, 4
add eax, 2
dec ecx
jne 0x10051ebf
call 0x10051f26
loope 0x10051f1c
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x10051f76
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x10051f87
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10051f3a
cmp eax, ecx
ja 0x10051f3a
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x10051fc4
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x10051fba
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1003922f
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x43a1f3
Capabilities:
Encode data using xor

Disassembly:
dec edi
inc esi
insd dword es:[edi], dx
salc
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
imul esi, dword [esi - 0x42], 0xac40d297
fiadd dword [esi + 0x16]
pop ebx
xor esp, dword [ebx - 4]
dec edi
adc byte [ebx - 0x4566e52f], 0x6f
retf
mov esp, 0x3949f665
pop edx
jae 0x43a129
aaa
inc esi
adc al, byte [esi + ebp + 0x5e]
jbe 0x43a17f
pop ebx
invalid
in al, dx
mov bh, 0xc3
js fcn.0043a1f3
loopne 0x43a185
rcr byte [ebx + 0x1b42f317], 5
aas
mov dh, 0x71
xor edi, ebx
inc edx
sbb eax, dword [0x3371b63f]
sti
outsd dx, dword [esi]
pop ebx
nop
mov gs, word [ebp + 0x5b]
loopne 0x43a200
push edi
ja 0x43a228
and edx, dword [edi + eax*8]
adc bl, bl
mov edi, 0x48245db9
outsd dx, dword [esi]
aam 0xf0
xor dword [ecx + edi*4], esi
or eax, 0x7a46b887
mov es, edi
xchg dword [ebx + 0x6346c608], ebx
sahf
loop 0x43a1a9
sub esp, dword [edx - 0x68]
push ebp
int1
jne 0x43a224
sbb eax, 0xbb483449
xchg esp, eax
xor esp, esi
fld xword [esi + 6]
imul dword [ebx - 0x1e]
inc ebx
inc ebp
fild word [ecx - 0x524d2192]
mov cl, 0xf6
sub dword [esi - 0x22], 0xf6b1adb2
jbe fcn.0043a1f3
inc ebx
mov byte [0x292d5e20], al
mov byte [ebx - 0x30], 0x41
push edx
ja 0x43a24a
test dword [ebx], edx
push ebp
pushal
inc esi
push esp
inc ebx
stc
lodsb al, byte [esi]
out 7, al
fisub dword [ebx + 0xc]
mov al, byte [0xd3e3a4e4]
or al, 0x8a
add eax, 0xd3e3a4e4
movsb byte es:[edi], byte [esi]
jecxz 0x43a1fe
jo 0x43a1b3
mov ebx, 0xe876db8a
push esp
push edi
sbb ch, byte [esi - 8]
ja 0x43a2ab
movsb byte es:[edi], byte [esi]
mov ecx, 0x17ae299d
sal dword [eax - 0x2d], cl
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x6001166c]
pushfd
leave
invalid
jae 0x43a21f
das
inc ebx
inc esp
xchg esi, eax
mov ecx, 0xfc432ea5
cld
enter 0xffffffffffffd338, 0x3a
jmp 0x43a266
adc byte [0xa5b38b6c], bl
insd dword es:[edi], dx
rol dword [edx + 0x33], 1
dec ecx
dec esi
xor esi, dword [ebp + 0x451f6e76]
inc ebp
fnstsw word [esi]
dec ecx
sub edx, edi
mov al, 0
inc ebp
sub dl, ah
sub ebx, eax
cdq
inc esi
xchg ebx, eax
mov dl, 0xb6
pop ebx
and dword [ebx + 0x5e], eax
and ebp, dword [ecx + 0x45]
pushal
stc
mov eax, 0x477b63ac
lodsb al, byte [esi]
arpl word [ebx + 0x47], di
mov edi, dword [edx - 0x47]
adc al, 0x70
out 0xd9, eax
jb 0x43a272
int1
std
sub eax, 0xc684ff37
and dword [ebx - 0x56], ebx
pop ebx
aas
mov ecx, 0x68f57bd6
test eax, 0xd1c6f48c
cmp dword [ebx], 0x2a
mov word [eax - 8], gs
dec ecx
adc al, 0x43
jle 0x43a29a
sti
shr ebx, 1
iretd

Function at 0x4645c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x581a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x5897a8]
mov edx, dword [0x5897ac]
push 0
push 0
push eax
mov eax, dword [edx + 0x24]
mov ecx, 0x5897ac
call eax
mov dword [0x5897c4], eax
test eax, eax
jne 0x464626
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov byte [edx + 0x55f229c2], bh
loop 0x464651
mov dl, 0x59
mov byte [0xa09cb264], al
dec ecx
push edx
mov ecx, 0xa070b11c
invalid
out dx, al
leave
pop ebx
invalid
Function at 0x467bf9
Capabilities:
Encode data using xor

Disassembly:
pop esp
mov byte [0xbfc268ed], al
add ebp, dword [esi]
add dword [edi - 0x79], esi
dec esp
xchg ecx, eax
mov word [edx + 0x16], fs
sub bl, byte [edx]
sub byte [ebp - 0x20], bh
cwde
inc esp
and dword [esp + edi*2 - 0x72], esi
xor dword [eax + 0x7a], esp
aam 0x35
ljmp 0xc7d6
push ds
aam 0x49
and al, 0xec
sar dword [ecx + 0x67f79d25], 1
les edi, [eax - 0x40]
les edi, [bx + si - 0x40]
outsb dx, byte [esi]
push 0x446bc486
je 0x467c62
sub eax, 0xed778836
loope 0x467b7f
arpl word [eax + ebp*4], cx
jl 0x467c26
invalid
sub al, 0x46
inc esi
cmp al, 0x99
js 0x467be2
ret
outsd dx, dword [esi]
mov cl, 0x2a
add eax, 0xb168e029
pop es
movsd dword es:[edi], dword [esi]
leave
adc al, 0x1c
sbb esp, dword [ebx - 0x35]
sbb al, 0xf5
xchg esi, eax
cmp dl, cl
scasd eax, dword es:[edi]
stosb byte es:[edi], al
js 0x467c45
xchg esp, eax
mov ecx, dword [edi]
mov al, 0x4a
xchg edi, eax
lahf
lodsb al, byte [esi]
into
mov word [edi], ds
div dword [eax - 0x24]
jae 0x467c4c
js 0x467c06
dec esp
cmp ecx, esp
inc esp
daa
xor byte [ecx + 2], dl
pop ebp
loopne 0x467c85
idiv dword [esi - 0x3c0e8cfa]
xlatb
inc esp
sbb dl, cl
pop esi
sbb bh, bh
xor byte [eax - 0x76], 0x44
jo 0x467bd8
inc esp
xchg ebp, eax
cmc
movsb byte es:[edi], byte [esi]
pop esp
jmp 0x467cb9
int1
xor al, 0x6c
insb byte es:[edi], dx
jns 0x467ce1
fdiv dword [ebp - 0x80]
in al, dx
enter 0xfffffffffffff4e3, 0x6c
sub ah, 0xc8
jecxz 0x467c60
insb byte es:[edi], dx
sbb al, 0xd9
add eax, 0x145c5474
mov eax, dword [0x7a94c226]
cdq
aaa
cmc
mov ah, pe_nt_image_headers32
cmp byte [esi + ecx*2 - 0x70], ah
pop ebp
je 0x467cc1
ret 0x7a94
inc edi
cld
dec esp
faddp st(0)
popfd
test dword [0x4079a0d9], ebx
invalid
das
sbb bl, ah
sub byte [ecx], 0x84
jp 0x467c67
salc
int1
pop eax
xchg ebp, eax
sbb al, 0xa0
cmp al, 0xac
stosd dword es:[edi], eax
sub cl, byte [esi + ebp*8]
sbb al, 0x57
mov cl, bl
inc eax
fcomp dword [ebp - 0x3e]
pop esp
out dx, eax
inc eax
inc esi
lodsb al, byte [esi]
mov cl, 0x5b
add dword [ebp - 0x4f], ebp
adc bh, bl
dec ecx
and bh, dh
and bl, byte [ecx - 0x63df2427]
rcr byte [esi + edx], 1
or ecx, dword [ebp - 0x7a]
leave
fisttp word [ecx + 0x22]
invalid
and byte [eax + edx*8 + 0x4d0b161c], bl
xchg cl, cl
xchg edi, eax
add bh, bh
test ebx, ebx
add dword [ecx - 0x54], 0xbbc99304
push ecx
jp 0x467d03
mov dl, 0x31
aas
add al, dl
shl ebx, 1
pop ss
pop ebx
jae 0x467d55
test al, 0x1f
out 0x73, eax
sub ah, byte [edx]
push ecx
inc ecx
loope 0x467c75
int3
pushal
mov dh, 0x20
add dh, bh
or dword [ebx - 5], eax
fisub word [ebx + 0x12b25909]
mov dl, 0x12
push edi
cmp eax, 0x89c0abc1
jl 0x467cf7
jae 0x467c92
push edi
sub byte [esi - 0x5d], bl
stosb byte es:[edi], al
or al, byte [eax]
out dx, eax
jle 0x467cb3
dec ecx
pop edi
jae 0x467d90
mov ch, 0x2a
mov dword [eax], esp
sbb eax, 0xef28a8d0
and byte [esi + 0x44], ch
jae 0x467d65
sub byte [ebp - 0x76d325a6], 0xcb
cmp edi, dword [edx]
adc al, dl
shr dword [ecx - 0x11cc327], 0x2d
cmp esp, dword [edi]
int3
mov ah, 0xc3
xor eax, 0x107f754a
test byte [edi + 0x4bf520f7], dh
pop ebx
in eax, dx
jnp 0x467dca
invalid
invalid
invalid
invalid
invalid
invalid
invalid
Function at 0x47129b
Capabilities:
Encode data using xor

Disassembly:
aad 0x59
stosd dword es:[edi], eax
test byte [esi - 0x4ffe6e02], bh
jo 0x4712d2
mov al, 0x70
sub al, 0xc1
cmpsd dword [esi], dword es:[edi]
cmp dword [eax - 0x5d], ebx
wait
scasd eax, dword es:[edi]
shl dword [edi - 0x645ca7c7], 0xaf
dec ecx
shl byte [edi], 0xac
xor bh, ch
mov edx, dword [edx + 0x22caeebe]
sbb dword [edi + 0x71b3738b], edx
fistp qword [edi + 0x2c4b0175]
shr byte [ebx], 0xb3
mov ebp, 0x96af64cb
imul cl
mov dword [ebx + 0x184491fc], edi
jb 0x4712a3
cld
xchg ecx, eax
inc esp
sbb byte [edx - 0x35], dh
xor ah, byte [ecx]
invalid

Function at 0x47b5c9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x581a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0x98000000], eax
push esi
mov byte [esi], al
add cl, dh
rcl dword [esi + esi*4], 0x64
mov word [ebx - 3], fs
salc
call 0x58779e29
out 0x58, al
jno 0x47b5df
cmpsb byte [esi], byte es:[edi]
add al, byte [esi]
or byte [esi - 0x6dbfca87], ah
pushfd
inc eax
mov cl, cl
pushfd
mov edi, 0x1a287669
enter 0x1761, 0xffffffffffffffae
clc
bound ecx, qword [ebx + 0x5d]
add esi, 0x6fce21c0
imul esp, dword [esi - 0x698039c3], 0x57
sbb al, byte [edi + 0x5d]
pop ebp
adc al, 0xb7
push 0x771b18fa
js 0x47b675
jmp 0xa3696077
jl 0x47b631
and eax, 0x2e27a0da
movsd dword es:[edi], dword [esi]
sub eax, 0xb6db249d
pop ss
out 8, al
cmpsb byte [esi], byte es:[edi]
push ebp
invalid

Function at 0x48b124
Capabilities:
Encode data using xor

Disassembly:
jmp 0x48b113
or eax, ebx
sub ebx, dword [edx + 0x6e1eb60f]
adc al, 0x81
sub byte [edi], bh
or dword [esi + esi*4 + 0x319a6846], 0x76afe146
jg 0x48b12b
inc esi
push 0xe146319a
scasd eax, dword es:[edi]
jbe 0x48b19b
push cs
test byte [0x1fde056a], bh
cmp al, 0x30
xor byte [ecx + 0x37], dh
xor byte [ecx + 0x37], dh
pop ebp
mov al, 0x68
scasd eax, dword es:[edi]
xor byte [edx], cl
fst qword [ebp - 0x2e]
jae 0x48b104
xlatb
sal byte [edx + 0x7dbbf88c], 1
in al, 0x9c
pop ebp
pop ebx
and ebx, dword [ebx - 0x38237028]
jo 0x48b0f7
mov dl, 0x5e
pop esi
jp 0x48b144
int1
sysret
push 0x97af2070
jae 0x48b187
popfd
das
inc eax
or dword [0x39ee7981], ecx
dec esp
movdqa xmm5, xmmword [eax - 0x62d47edf]
div dword [edi]
mov byte [0x7f8c3c4f], al
sal dword ds:[ebx + 0x46934f3c], 0x9c
mov al, 0x78
push esi
push esp
pop ebx
jae 0x48b195
or dword [edx], 0x860a01c7
adc al, 0xdc
neg dword [edx - 0x19f506ca]
and al, 0x55
fdivr st(7), st(0)
lcall 0x5524, 0xe60af936
out 0x24, al
push ebp
mov word [ebp + 0x2b], ss
add dword [esi - 0x3676f503], 0xf689c089
mov esi, esi
mov edx, edx
mov eax, eax
mov ebx, ebx
mov edx, edx
mov ebx, ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4ad499
Capabilities:
Encode data using xor

Disassembly:
stosb byte es:[edi], al
and esi, esi
inc edx
dec eax
or ch, byte [ebp + edx + 0x32]
bound edi, qword [eax]
fimul dword [eax + 0x1f2135dd]
jno 0x4ad494
cmp dl, bl
mov ch, bl
xor eax, 0xed711f21
std
sub eax, 0xdab31100
mov ebp, 0x3f031a56
mov bl, 0xa9
xchg esp, eax
sub al, 0xc1
js 0x4ad49e
outsb dx, byte [esi]
mov al, 0x5e
pop es
adc ebp, esp
sar byte [esi + esi*2 + 0x56], 1
imul ebx, dword [ebx + 0xc1967d3], 0xfffffffc
cmp edi, dword [edi]
fld dword [edi - 0x34]
dec esp
das
in al, dx
shr byte [ebx], 0xd1
sub edi, ecx
popal
mov dword [ebx], esi
jns 0x4ad4f5
push edi
push ss
mov bl, 0xcc
popfd
fidivr dword [esi + 0x17ebe9f0]
dec ebx
mov dword [0xc7fd2259], eax
dec ecx
in eax, 0x2a
fstp dword [edx]
pop edx
xchg byte [ebp + 4], bl
clc
sbb bl, byte [edx - 0x7a]
pop ebp
add al, 0xf8
test eax, 0x29511278
int 0x1a
jecxz 0x4ad543
adc al, 0x1a
out 0xf1, al
sbb eax, 0x4b8c700d
pop esp
xor eax, 0xb40d8c21
and edx, dword [ebx]
pop es
sub dword [0xff831c64], ebx
shl dword [esi], cl
test al, 0x3f
daa
out dx, al
movsb byte es:[edi], byte [esi]
and al, byte [ecx - 0x1fb1a2df]
add bh, byte [ecx + 0x56]
dec esi
loopne 0x4ad52c
jns 0x4ad582
mul byte [edx]
jo 0x4ad5a2
adc byte [ecx + 0x38], al
out dx, eax
sbb byte [ebx], al
sbb byte [ebx + 0x428cb4a3], cl
or byte [esi + 0x3e], dh
and cl, byte [eax]
out dx, al
mov edi, 0x59a23df9
call 0xe0c8f7f8
stc
cmp eax, 0xace859a2
and bh, byte [esi - 0x20]
cmp ebp, dword [eax + 6]
adc al, 0x57
sbb byte [edi], bh
adc dword [ebx], 0xffffffeb
insd dword es:[edi], dx
pop eax
aad 0xe8
push edx
push 0xc4b993db
lea esi, [ecx + 0x323c11d3]
mov al, byte [0x3a663121]
inc ebx
pop esp
enter 0xe1c, 0xffffffffffffffd8
add al, dl
pop ebx
salc
push es
add eax, 0x9bb03bf6
test cl, ah
inc esi
arpl ax, dx
mov byte [edi], bh
mov edx, 0xee8f2ede
invalid
js 0x4ad527
pop eax
inc ebx
lahf
and cl, byte [eax]
int1
cmpsb byte [esi], byte es:[edi]
add ch, bl
xchg esp, eax
adc dh, dl
ret 0x29c

Function at 0x4ada56
Capabilities:
Encode data using xor

Disassembly:
sbb esp, esp
adc eax, 0xe8fce3d
adc byte [eax - 0x4b29d310], ch
sti
mov bl, 0x2c
invalid
Function at 0x4b9374
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bf5d8
push 0x4b9248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4c6d80], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4c6d7c], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4c6d78], ecx
shr eax, 0x10
mov dword [0x4c6d74], eax
insd dword es:[edi], dx
dec esp
add byte [edx + 1], ch
call fcn.004ba437
pop ecx
test eax, eax
jne 0x4b938b
push 0x1c
call fcn.004b944d
pop ecx
call fcn.004ba1f4
test eax, eax
jne 0x4b939c
push 0x10
call fcn.004b944d
pop ecx
xor esi, esi
mov dword [ebp - 4], esi
call fcn.004ba038
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4c7434], eax
call fcn.004b9f06
mov dword [0x4c6d64], eax
call fcn.004b9cb9
call fcn.004b9c00
call fcn.004b9910
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004b9ba8
mov dword [ebp - 0x64], eax
test byte [ebp - 0x30], 1
je 0x4b93eb
movzx eax, word [ebp - 0x2c]
jmp 0x4b93ee
push 0xa
pop eax
push eax
push dword [ebp - 0x64]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.004b993d
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x68], ecx
push eax
push ecx
call fcn.004b9a30
pop ecx
pop ecx
ret
Function at 0x4ba2fe
Capabilities:
Check os version
Query environment variable

Disassembly:
push 0x53ffffff
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4ba332
cmp dword [ebp - 0x88], 2
jne 0x4ba332
cmp dword [ebp - 0x94], 5
jb 0x4ba332
push 1
pop eax
jmp 0x4ba434
lea eax, [ebp - 0x122c]
push 0x1090
push eax
push str.__MSVCRT_HEAP_SELECT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4ba421
xor ebx, ebx
lea ecx, [ebp - 0x122c]
cmp byte [ebp - 0x122c], bl
je 0x4ba374
mov al, byte [ecx]
cmp al, 0x61
jl 0x4ba36f
cmp al, 0x7a
jg 0x4ba36f
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4ba361
lea eax, [ebp - 0x122c]
push 0x16
push eax
push str.__GLOBAL_HEAP_SELECTED
call fcn.004bc2a0
add esp, 0xc
test eax, eax
jne 0x4ba396
lea eax, [ebp - 0x122c]
jmp 0x4ba3df
lea eax, [ebp - 0x19c]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [ebp - 0x19c], bl
lea ecx, [ebp - 0x19c]
je 0x4ba3ca
mov al, byte [ecx]
cmp al, 0x61
jl 0x4ba3c5
cmp al, 0x7a
jg 0x4ba3c5
sub al, 0x20
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4ba3b7
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x122c]
push eax
call fcn.004bc220
pop ecx
pop ecx
cmp eax, ebx
je 0x4ba421
push 0x2c
push eax
call fcn.004bc160
pop ecx
cmp eax, ebx
pop ecx
je 0x4ba421
inc eax
mov ecx, eax
cmp byte [eax], bl
je 0x4ba406
cmp byte [ecx], 0x3b
jne 0x4ba401
mov byte [ecx], bl
jmp 0x4ba402
inc ecx
cmp byte [ecx], bl
jne 0x4ba3f8
push 0xa
push ebx
push eax
call fcn.004bbf32
add esp, 0xc
cmp eax, 2
je 0x4ba434
cmp eax, 3
je 0x4ba434
cmp eax, 1
je 0x4ba434
lea eax, [ebp - 4]
push eax
call fcn.004ba2c2
cmp byte [ebp - 4], 6
pop ecx
sbb eax, eax
add eax, 3
pop ebx
leave
ret