joyce8/EMBER2024-capa huggingface dataset:
Function at 0x453db0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x453dc7
add esp, 0xfffffff0
call fcn.00403574
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041c304
mov eax, dword [0x46d834]
cmp word [eax + 2], 0
jne 0x453def
mov eax, dword [0x46d834]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455488
mov eax, dword [0x46d950]
cmp word [eax + 2], 0
jne 0x453e09
mov eax, dword [0x46d950]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00455680
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412ac8]
call fcn.00403238
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412ac8]
call fcn.00403238
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41e4e0]
call fcn.00424128
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453f90
mov eax, dword [0x46d6d8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004244f8
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x455c30
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46d6d8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c94c
test eax, eax
je 0x453efe
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004089dc
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c974
test eax, eax
je 0x453f12
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404294
mov eax, dword [0x46d51c]
cmp byte [eax], 0
jne 0x453f46
mov eax, ebx
call fcn.004540b8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455e0c
mov eax, ebx
call fcn.004567d0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x453f86
call fcn.004035cc
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454338
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46ebb4]
cmp dword [eax + 0x30], 0
je 0x4543e2
cmp dword [ebx + 0x94], 0
jne 0x4543dc
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4542c8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4543dc
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4543a2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4543dc
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041522c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4543b1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454f44
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x454f79
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404114
jmp 0x454f86
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404078
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x455fe8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x456029
mov eax, esi
call fcn.0043c7a0
test al, al
je 0x456029
mov eax, dword [ebx + 0x84]
call fcn.0043c49c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x456029
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043c49c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x41d323
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41d362
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41d362
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41d362
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41d362
cmp dword [ecx + 0x74], 0xe
jbe 0x41d362
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42f490
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42f4bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42f4bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x65a058], 1
mov dword [0x65a054], 1
mov dword [0x65a050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x65a00c], eax
mov eax, dword [0x65a064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x65a078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x65a060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x655014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056
Function at 0x64cca0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x64cd00
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x65a06c]
test esi, esi
jle 0x64ce20
mov eax, dword [0x65a070]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp ebx, edx
jb 0x64cd34
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x64cdb7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x64cd20
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x64ce47
mov eax, dword [0x65a070]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x65a070]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x64ce27
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x64cdb0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x64cdc0
add dword [0x65a06c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 4
mov eax, 0x40
mov ecx, dword [esp + 0x20]
cmove eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x65a070]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x64cdb0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x64cd3e
mov eax, dword [0x65a070]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop
Function at 0x64d360
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x65a088
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x65a080]
sub esp, 4
test ebx, ebx
je 0x64d3b5
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x64d3ae
test esi, esi
je 0x64d3ae
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x64d390
mov dword [esp], 0x65a088
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x64d6f0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x64d715
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x64d720
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x64d715
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test si, si
je 0x64d768
xor ecx, ecx
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x64d75e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x64d76a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x64d750
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4048b0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00437da0
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4049d3
push ecx
lea ecx, [esi + 0x18]
call fcn.004240d0
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4049ea
push ecx
lea ecx, [esi + 0x24]
call fcn.00423fe0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x423410
Capabilities:
Encode data using xor

Disassembly:
jno 0x423488
invalid
fsubr qword [edi]
and eax, 0x25b75ac7
jbe 0x42349b
xor dword [esi], eax
pop esi
js 0x4234d2
je 0x4234cf
leave
jno 0x4234ab
por mm6, qword [ecx + esi*4 - 0xe4d040d]
stosd dword es:[edi], eax
mov al, dh
xchg ebp, eax
and al, 0xd4
push es
int3
fst qword [esi - 0x47de745c]
stc
aad 0x4d
mov esp, dword [ecx]
mov eax, 0x604dd5f9
dec ebp
pushal
ja 0x423464
push 0x17
pop ebp
mov dword [ebx], ebp
aaa
sub esi, dword [edi]
sbb dword [ebp + 0x57], esp
or al, 0x17
or al, 0x17
jb 0x4234cf
cmpsd dword fs:[esi], dword es:[edi]
aam 0x42
pop edi
push ecx
jns 0x42348d
out 0x89, al
mov dl, 0x9c
pushfd
push es
ja 0x423485
mov ch, 0x27
push ecx
and ebp, dword [0x3574be28]
mov eax, dword [0x47a1772d]
mov ch, 0x49
pop ebx
cmpsb byte [esi], byte es:[edi]
add esi, dword [ebp + edi*4 - 0xa6a9f28]
fsub dword [eax - 0x6b]
cmc
jl 0x4234c4
cli
jp 0x423451
or ebp, dword [edx + 0x242636ff]
and al, 0x34
inc edi
xor al, 0x47
adc al, 0x48
cmp edx, dword [ebp + 0x9461fb6]
inc esi
pop esi
inc edx
cmp dl, dl
pop ds
stosb byte es:[edi], al
or ebx, edi
xor eax, dword [edi - 0x197d2df9]
adc eax, 0x75f24530
or dh, byte [edx + 0x3bdee945]
ja 0x4234c9
xchg ebx, eax
stosd dword es:[edi], eax
adc dword [ebp - 0x3aface35], esp
sahf
inc ebp
std
sub bl, byte [ebx + 0x48ebc301]
jl 0x423495
les edi, [ebx]
mov eax, dword [0x8d2664a8]
sub eax, 0x16bf122b
sbb byte es:[ecx + 0x31], cl
mov byte [0x4c52d52c], al
cmpsb byte [esi], byte es:[edi]
sal dword [edx - 0x46db3dcb], 1
retf 0xd8d7
Function at 0x4378f0
Capabilities:
Encode data using xor

Disassembly:
sub dl, byte [edi + 0x14]
or dword [edx + eax + 0x348123f8], 0xe530c76f
add dword [ebp + 0x7417463], eax
add bh, al
and eax, dword [ecx + 0x30c76f34]
in eax, 1
test dword [ebx + 0x74], esp
inc ecx
pop es
xchg byte [edx - 0x71], ah
xor eax, 0x738648eb
aam 0x7a
fdivr dword [edi - 0x2aab9efc]
jbe 0x4378f5
push esi
cli
push ecx
add al, 0xde
jno 0x437975
invalid
mov dh, 0x1c
imul ebx, dword [ebp + 0x20187120], 0xef301c38
mov word [eax + 0x8a4f294], cs
mov eax, ebp
div byte [edi + eax*8 - 0x68598b7c]
xor dword [eax + 0x64ba036f], esp
pop ss
and dl, bl
test al, 0xb5
pushal
dec esp
xor dword [esp + ecx*4], 0xffffffb6
and eax, 0xfa8793e4
pop ss
and al, 0xeb
iretd
loop 0x43797b
not dword [edi + 0x23]
idiv dword [edi]
aas
dec di
pop ecx
outsb dx, byte [esi]
pop edi
dec edi
xchg ebx, eax
lodsd eax, dword [esi]
lea eax, [edx]
test eax, 0xd3e6e6f6
xchg eax, ecx
arpl word [ebp + 0x27ec804a], si
out 0xe6, al
rol dword [edi + 0x4ab563c8], cl
sub ah, 0x27
or al, 0x8f
push eax
ja 0x4379ef
jge 0x437934
pushal
push 0x48
jbe 0x4379aa
ret 0xa776
cmpsb byte [esi], byte es:[edi]
int1
enter 0xffffffffffffdfd3, 0xffffffffffffffb7
mov byte [eax + 0xb3bd24d], bh
jb 0x437a0f
salc
jne 0x437988
and byte [ebx - 0xea942b0], bh
imul eax, dword [edx + ebx*4 - 0x40], 0x15
into
test dword [ecx + 0x3e0e1ed], eax
jno 0x437a35
lcall 0xed81, 0x85ce15c0
loope 0x4379ac
add esi, dword [ecx + 0x66]
loope 0x4379f4
inc ebp
imul eax, esi, 0x9472e4c2
dec ecx
add dword [eax + 0x17251458], edi
lodsd eax, dword [si]
test dword [eax - 0x45475b65], esp
invalid
wait
movsb byte es:[edi], byte [esi]
mov eax, 0x74f5c6ba
xlatb
ret
scasd eax, dword es:[edi]
or edi, esi
cmpsd dword [esi], dword es:[edi]
mov gs, word [eax]
push eax
cmovb esp, esi
je 0x4379c3
sub byte [eax + 0xf], dl
inc edx
out 0x74, al
enter 0x2c03, 0x67
add ebp, dword [edi]
js 0x437a55
adc al, 0xa0
popfd
mov bh, 0x66
imul esi, ebp, 0xb15c6f3c
xchg ebp, eax
push edx
push 0x30
cmp ah, byte [esi + 0x6421298b]
ja 0x437a81
or eax, 0x2507346a
aam 0xfc
fidiv dword [ebp - 0x3b6d0eb4]
mov dh, 0xa6
and byte [esi], 0
lahf
test eax, 0x50e3d801
mov cl, 0xa6
arpl word [edi + 0x73], ax
insb byte es:[edi], dx
jae 0x437aa3
lds edx, [eax - 0x1f]
adc edi, dword [esi]
mov al, 0x75
jno 0x437a9f
xchg byte [ebx + ebp*2 + 0x66], dh
pushal
xor edx, dword [edi - 0x66]
call 0xe66a1262
push esp
invalid
invalid
Function at 0x44a210
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
push edi
xor ebp, ebp
push str.Kernel32
mov dword [esi], ebp
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
mov dword [esi + 0x14], ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebp
je 0x44a2b0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateToolhelp32Snapshot
push edi
call ebx
push str.Thread32First
push edi
mov dword [esi + 4], eax
call ebx
push str.Thread32Next
push edi
mov dword [esi + 8], eax
call ebx
push str.Module32FirstW
push edi
mov dword [esi + 0xc], eax
call ebx
push str.Module32NextW
push edi
mov dword [esi + 0x10], eax
call ebx
mov ecx, dword [esi + 4]
mov dword [esi + 0x14], eax
cmp ecx, ebp
pop ebx
je 0x44a2a7
cmp dword [esi + 8], ebp
je 0x44a2a7
cmp dword [esi + 0xc], ebp
je 0x44a2a7
cmp dword [esi + 0x10], ebp
je 0x44a2a7
cmp eax, ebp
je 0x44a2a7
push edi
mov dword [esi], 1
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret
push edi
mov dword [esi], ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebp
ret

Function at 0x46c580
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0xde
xchg edx, eax
iretd
das
insd dword es:[edi], dx
sbb dword [edx + 0x77], 0x659d9d77
inc ebp
jno 0x46c5cc
jg 0x46c5ae
scasd eax, dword es:[edi]
xchg edx, eax
out dx, al
fcomp dword [ebx]
stosb byte es:[edi], al
test byte [edi - 0x37], 0x15
dec edi
leave
adc eax, 0xc7ab23e7
dec edi
leave
adc eax, 0xc7ab23e7
pop ebp
mov ebx, 0x44765da0
aas
xchg esi, eax
loopne 0x46c606
add dl, bl
inc edx
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
pop edx
pushfd
adc eax, 0x5854e869
dec ebx
xlatb
push ss
rcr dword [esi], 0xb4
jb 0x46c56b
dec esi
xchg ecx, eax
xor dh, byte [ebp + 0x7c]
push esp
xchg ebp, eax
add al, 0x9f
invalid
cli
int1
dec ebp
inc ebx
push ebp
add eax, 0xf56e7567
invalid
jae 0x46c562
adc al, 0x88
and dword [ecx + 0x6fd058cd], edx
cmpsd dword [esi], dword es:[edi]
jb 0x46c5af
sbb eax, 0x8114a6de
xchg edi, eax
or esi, dword [ecx]
mov al, byte [0xc5e0a676]
mov ecx, 0xa4f6fcdc
loop 0x46c662
xchg dword [edi + ebx*8 - 0x51cc96], esp
inc ecx
dec esi
invalid
ffreep st(3)
mov edi, 0xb0b3aeb
wait
dec ecx
pop ebp
sub eax, 0x57e4c608
xor dword [0xc1b5eb2d], ebp
or esp, dword [ecx - 0x45]
bsr esp, dword [ebx - 0x4e]
aam 0xd2
mov ah, 0x51
stosb byte es:[edi], al
sahf
mov bh, 0xc0
int3
lodsd eax, dword [esi]
test dword [eax - 0x58bb3a19], edi
movsd dword es:[edi], dword [esi]
mov ch, 0xcd
invalid
Function at 0x480c90
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0xd688b2ff
push esi
xchg ecx, eax
push esi
aas
and ah, byte [ecx]
fnstsw word [esp + esi*4]
pop esi
sub dword [ecx + 0x3e], ebx
mov esi, 0x62182907
adc ch, byte [edi - 0x2b]
pop es
sub dword [eax], ebx
bound edx, qword [edx]
outsd dx, dword [esi]
aad 0xc5
inc ebp
and byte [edi + 0x40b7a5d1], 0x97
or eax, 0x65b24e8c
sal bh, 1
lds eax, [ebp - 0x7e]
cmpsd dword [esi], dword es:[edi]
shl dword [ebp + 0xd9740b7], 1
mov word [esi - 0x4e], cs
sal bh, 1
outsd dx, dword [esi]
bound eax, qword [edi]
push esp
loop 0x480ca3
push esp
xchg ebx, eax
and cl, byte [edx - 9]
jp 0x480c9c
jns 0x480c98
enter 0xffffffffffffe1a4, 0xffffffffffffffc2
movsb byte es:[edi], byte [esi]
loope 0x480c89
sub al, 0x85
mov byte [ecx - 0x51], dl
mov esp, dword [eax]
pop esp
xor dword [edx + 0x5d], esp
aad 0xf2
imul ebp, dword [ebp - 0x4b], 0x7ca06753
mov dl, 0xb6
leave
xor eax, 0xc4c020b7
fbld tbyte [edx - 0x1b]
je 0x480cc4
aam 0x6e
sbb bl, byte [ecx - 0x6dccf72b]
int1
into
add dword [edi], ebx
lodsb al, byte fs:[esi]
pop edx
dec eax
xor al, 0x3e
push edi
and al, 0x41
adc eax, 0xa76e6408
mov dword [0x996753c0], eax
cdq
cmpsd dword [esi], dword es:[edi]
dec esp
stosd dword es:[edi], eax
xchg esp, eax
pop edi
leave
xchg dword [esi], ecx
cmp al, 0x33
mov al, 0xb6
mov al, 0x17
cmp eax, 0x5a003cc4
test dword [esi], 0xcc806ebe
jecxz 0x480cbf
cmp ch, byte [ecx]
movsb byte es:[edi], byte [esi]
invalid