joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001be50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a8
mov eax, dword [0x10059008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push edi
push 0x103
lea eax, [ebx + 0x374]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.1002ef30
lea edi, [ebp - 0x108]
mov byte [ebp - 5], 0
add esp, 0xc
lea ecx, [edi + 1]
nop
mov al, byte [edi]
inc edi
test al, al
jne 0x1001be90
sub edi, ecx
mov eax, 0x105
sub eax, edi
je 0x1001bed0
push esi
mov esi, 8
cmp eax, esi
cmovb esi, eax
lea eax, [ebp - 0x108]
push esi
add eax, edi
push 0x10054ab4
push eax
call fcn.10048ae0
add esp, 0xc
lea eax, [esi + edi]
mov byte [ebp + eax - 0x108], 0
pop esi
lea ecx, [ebp - 0x108]
call fcn.10004df0
test al, al
jne 0x1001bef0
push 0x10
push str.Fatal_Error
push str.ERROR:_Unable_to_run_the_application_outside_the_directory_of_the_game.
jmp 0x1001bfa9
push 0x94
lea eax, [ebp - 0x3a4]
push 0
push eax
call fcn.1002af10
add esp, 0xc
mov dword [ebp - 0x3a4], 0x94
lea eax, [ebp - 0x3a4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x394], 2
jne 0x1001bf9d
mov eax, dword [ebp - 0x3a0]
cmp eax, 5
jb 0x1001bf9d
jne 0x1001bf3c
cmp dword [ebp - 0x39c], 0
je 0x1001bf9d
mov eax, dword [ebx + 0x244]
test eax, eax
je 0x1001bfb1
mov eax, dword [eax]
test eax, eax
je 0x1001bfb1
lea ecx, [ebp - 0x3a8]
mov dword [ebp - 0x3a8], 0
push ecx
push eax
push 6
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExA]
test eax, eax
je 0x1001bfb1
mov eax, dword [ebp - 0x3a8]
test eax, eax
je 0x1001bfb1
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1001bfb1
pop edi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100288b6
mov esp, ebp
pop ebp
ret
push 0x10
push str.Fatal_Error
push str.ERROR:_Unfortunately__this_game_doesnt_support_Win95___98___ME___2000___NT_4.0_environment.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.100288b6
mov esp, ebp
pop ebp
ret

Function at 0x1001cb90
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x419
cmp ax, cx
je 0x1001cbb3
mov dword [edi + 0x24c], 0
jmp 0x1001cbbd
mov dword [edi + 0x24c], 1
lea eax, [ebp - 4]
mov ecx, 0x1008c830
push eax
mov eax, dword [0x1008c830]
push str._language
call dword [eax + 0xc]
test eax, eax
je 0x1001cc2b
mov eax, dword [ebp - 4]
test eax, eax
je 0x1001cc2b
cmp byte [eax], 0
je 0x1001cc2b
push esi
mov esi, 0x1008c7f8
nop dword [eax]
push eax
push dword [esi]
call fcn.1002f409
add esp, 8
test eax, eax
je 0x1001cc21
push dword [ebp - 4]
push dword [esi + 4]
call fcn.1002f409
add esp, 8
test eax, eax
je 0x1001cc21
add esi, 0xc
cmp esi, str._______R
je 0x1001cc2a
mov eax, dword [ebp - 4]
jmp 0x1001cbf0
mov eax, dword [esi + 8]
mov dword [edi + 0x24c], eax
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1001e1e0
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push str._n_nbzip2_libbzip2:_internal_error_number__d._n_n
push 2
call fcn.1002f291
add esp, 4
push eax
call fcn.100016b0
add esp, 0xc
push 3
call fcn.10033d6b
int3

Function at 0x1001e490
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov bl, byte [ecx + 0x34]
push esi
mov esi, dword [ecx + 0x38]
test esi, esi
jle 0x1001e4c3
mov edx, dword [ecx + 0x260]
push edi
movzx edi, bl
mov eax, edx
shl edx, 8
shr eax, 0x18
xor eax, edi
xor edx, dword [eax*4 + 0x10051918]
sub esi, 1
jne 0x1001e4a6
mov dword [ecx + 0x260], edx
pop edi
mov eax, dword [ecx + 0x34]
mov byte [ecx + eax + 0x58], 1
mov edx, dword [ecx + 0x38]
mov eax, edx
sub eax, 1
je 0x1001e51a
sub eax, 1
je 0x1001e550
sub eax, 1
je 0x1001e529
mov byte [edx + ecx + 0x54], 1
mov edx, dword [ecx + 0x24]
mov eax, dword [ecx + 0x44]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov bl, byte [ecx + 0x38]
sub bl, 4
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
mov eax, dword [ecx + 0x44]
mov edx, dword [ecx + 0x24]
pop esi
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
mov edx, dword [ecx + 0x44]
mov eax, dword [ecx + 0x24]
mov byte [edx + eax], bl
inc dword [ecx + 0x44]
pop ebx
ret
Function at 0x1001fa40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
mov ebx, ecx
test esi, esi
jne 0x1001fa5d
test ebx, ebx
je 0x1001fba1
pop esi
mov dword [ebx], edx
pop ebx
pop ebp
ret 0x14
cmp byte [esi + 0x1390], 0
jne 0x1001fa80
test ebx, ebx
je 0x1001fa70
mov dword [ebx], 0xffffffff
mov dword [esi + 0x13c4], 0xffffffff
pop esi
pop ebx
pop ebp
ret 0x14
push dword [esi]
call fcn.1002eefa
add esp, 4
test eax, eax
je 0x1001faa8
test ebx, ebx
je 0x1001fa98
mov dword [ebx], 0xfffffffa
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x14
cmp dword [ebp + 8], 0
push edi
jne 0x1001fb78
cmp dword [esi + 0x13c4], 0
jne 0x1001fb27
lea eax, [esi + 4]
mov dword [esi + 0x13a8], 0x1388
lea ecx, [esi + 0x1394]
mov dword [esi + 0x13a4], eax
call fcn.1001e8d0
mov dword [ebp + 8], eax
cmp eax, 3
je 0x1001fae7
cmp eax, 4
jne 0x1001fb65
mov ecx, dword [esi + 0x13a8]
cmp ecx, 0x1388
jae 0x1001fb22
push dword [esi]
mov edi, 0x1388
lea eax, [esi + 4]
sub edi, ecx
push edi
push 1
push eax
call fcn.100350bc
add esp, 0x10
cmp edi, eax
jne 0x1001fb4a
push dword [esi]
call fcn.1002eefa
add esp, 4
test eax, eax
jne 0x1001fb4a
mov eax, dword [ebp + 8]
cmp eax, 4
jne 0x1001fabc
push dword [esi]
call fcn.1002eefa
add esp, 4
test eax, eax
jne 0x1001fb78
push dword [esi]
call fcn.10038a8d
push dword [esi]
call fcn.1002eefa
add esp, 8
test eax, eax
je 0x1001fb78
test ebx, ebx
je 0x1001fb54
mov dword [ebx], 0xfffffffa
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
pop esi
pop ebx
pop ebp
ret 0x14
test ebx, ebx
je 0x1001fb6b
mov dword [ebx], eax
pop edi
mov dword [esi + 0x13c4], eax
pop esi
pop ebx
pop ebp
ret 0x14
test ebx, ebx
je 0x1001fb82
mov dword [ebx], 0
lea ecx, [esi + 0x1394]
mov dword [esi + 0x13c4], 0
call fcn.1001e980
push esi
call fcn.1002f05f
add esp, 4
pop edi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1001fd60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x1001fd73
mov dword [edi], 0
test esi, esi
je 0x1001ff29
mov eax, dword [ebp + 8]
mov dword [esi + 0x13c4], 0
test eax, eax
je 0x1001ff29
cmp byte [esi + 0x1390], 0
je 0x1001fdb5
test edi, edi
je 0x1001fda3
mov dword [edi], 0xffffffff
pop edi
mov dword [esi + 0x13c4], 0xffffffff
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
push dword [esi]
mov dword [esi + 0x13a8], 0x40000
mov dword [esi + 0x13a4], eax
call fcn.1002eefa
add esp, 4
test eax, eax
jne 0x1001fe93
nop dword [eax + eax]
cmp dword [esi + 0x1398], 0
jne 0x1001fe37
mov ebx, dword [esi]
push ebx
call fcn.1002f0c1
add esp, 4
cmp eax, 0xffffffff
je 0x1001fe37
push ebx
push eax
call fcn.10038727
push dword [esi]
lea eax, [esi + 4]
push 0x1388
push 1
push eax
call fcn.10034dc8
push dword [esi]
mov ebx, eax
call fcn.1002eefa
add esp, 0x1c
test eax, eax
jne 0x1001fe93
lea eax, [esi + 4]
mov dword [esi + 0x138c], ebx
mov dword [esi + 0x1398], ebx
mov dword [esi + 0x1394], eax
lea ecx, [esi + 0x1394]
call fcn.1001f740
test eax, eax
jne 0x1001feed
mov ebx, dword [esi]
push ebx
call fcn.1002f0c1
add esp, 4
cmp eax, 0xffffffff
je 0x1001fe66
push ebx
push eax
call fcn.10038727
add esp, 8
jmp 0x1001fe78
cmp dword [esi + 0x1398], 0
jne 0x1001fe78
cmp dword [esi + 0x13a8], 0
ja 0x1001feb0
cmp dword [esi + 0x13a8], 0
je 0x1001fecd
push dword [esi]
call fcn.1002eefa
add esp, 4
test eax, eax
je 0x1001fde0
test edi, edi
je 0x1001fe9d
mov dword [edi], 0xfffffffa
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffffa
xor eax, eax
pop esi
pop ebp
ret 8
test edi, edi
je 0x1001feba
mov dword [edi], 0xfffffff9
pop ebx
pop edi
mov dword [esi + 0x13c4], 0xfffffff9
xor eax, eax
pop esi
pop ebp
ret 8
test edi, edi
je 0x1001fed7
mov dword [edi], 0
pop ebx
pop edi
mov dword [esi + 0x13c4], 0
mov eax, 0x40000
pop esi
pop ebp
ret 8
cmp eax, 4
jne 0x1001ff14
test edi, edi
je 0x1001fef8
mov dword [edi], eax
pop ebx
mov eax, 0x40000
mov dword [esi + 0x13c4], 4
sub eax, dword [esi + 0x13a8]
pop edi
pop esi
pop ebp
ret 8
test edi, edi
je 0x1001ff1a
mov dword [edi], eax
pop ebx
mov dword [esi + 0x13c4], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
test edi, edi
je 0x1001ff33
mov dword [edi], 0xfffffffe
test esi, esi
je 0x1001ff41
mov dword [esi + 0x13c4], 0xfffffffe
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x1003c3b5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1003c22b
Function at 0x1004afd0
Capabilities:
Accept command line arguments

Disassembly:
add al, 0x10
aad 0x93
add al, 0x10
fist dword [ebx - 0x6c1eeffc]
add al, 0x10
out 0x93, eax
add al, 0x10
in eax, dx
xchg ebx, eax
add al, 0x10
xchg ebx, eax
adc bl, dh
xchg ebx, eax
add al, 0x10
stc
xchg ebx, eax
add al, 0x10
int3
mov eax, dword [esp + 8]
push esi
cmp eax, 3
ja case.default.0x1004afde
jmp dword [eax*4 + 0x1004b71c]
adc byte [eax + 0xc5b683d], al
adc byte [eax], al
cmp byte [0x100c5b68], 0
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
je 0x1004b2f8
int 0xad
sub esi, dword [esi]
pop eax
cmpsb byte [esi], byte es:[edi]
mul dword [edx + 0x64]
jae 0x1004b05b
bound esp, qword [ebx + esi*2 + 0x57]
jnp 0x1004afc3
imul edi, dword [0x30b5c656], 0xaddce4e1
ja 0x1004b000
mov ebx, gs
sbb ebp, ebp
salc
inc esi
xchg ebp, eax
dec ebp
sar byte [esp + esi*4 + 0x68], 1
and dword [eax - 0x3b], esp
jne 0x1004afae
add byte [esi + esi*2 + 0x6e], cl
js 0x1004afe4
xchg esi, eax
pop ebp
pop esi
or ecx, dword [eax]
cmp al, 0x7e
inc edi
jno 0x1004afcc
retf
jg 0x1004b0ad
xor eax, 0x54c7d1ed
sbb eax, 0x636a9ced
mov esi, 0xed6a4dda
int3
inc edx
insb byte es:[edi], dx
jbe 0x1004b0fc
in eax, dx
fisttp qword [ebx + 0x4c]
mov ch, 0x5f
test byte [ebp + 0x6bcb8fa3], bh
mov ebp, 0xcb1878fa
stosd dword es:[edi], eax
jns 0x1004b0d3
cmp al, 0xf4
cmp eax, 0x6ea87a85
shr byte [ecx - 0x17], 1
adc al, 0x65
cmp al, 0x69
in al, dx
invalid
cmp byte [esi - 0x339bdc5a], 0xfb
daa
xchg ebp, eax
add ch, byte [ebx + 0x20]
imul esp, ebp, 0x5f5fdeb2
mov eax, dword [eax - 0x6a4658f4]
invalid
push eax
mov eax, dword [0x442afaa1]
fsubr dword [ecx - 0x1f8d85fe]
pop eax
push edi
arpl word [ebx - 0x5be0ce09], cx
dec ebx
insd dword es:[edi], dx
xor dword [0x3a4ff54a], edi
mov eax, 0xf42fdf7
and al, 0xcd
inc eax
push cs
mov al, byte [0x4bb10ddb]
dec ebx
mov ecx, 0x22a87e6e
scasd eax, dword es:[edi]
jp 0x1004b216
jb 0x1004b216
loope 0x1004b274
jno 0x1004b2cc
jle 0x1004b23f
invalid
sbb bl, byte [ebp + 0x57883d31]
or dl, byte [ebx - 0x6563415]
hlt
xchg ecx, eax
cmp ebx, dword [edx + 6]
scasd eax, dword es:[edi]
imul dword [ebx + 0xd0fa6a7]
push esi
inc ebp
adc eax, dword [esi + edx]
int3
jmp 0x1004b24d
jmp 0x894694e8
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp byte [0x100c5b68], 0
mov edi, eax
je 0x1004b54e
jo 0x1004b2c8
mov al, byte [0x67f3636e]
movaps xmm6, xmmword [ebp - 0x42]
or al, 0x94
ljmp 0x5fd2
lea edx, [esp + 0x10]
mov ecx, edi
call fcn.10058e40
push dword [esp + 0x14]
xor edx, edx
xor ecx, ecx
push 1
push dword [esp + 0x14]
push dword [esp + 0x1c]
push 0
push 0
push 0
call fcn.1005c850
add esp, 0x1c
pop edi
pop esi
ret 0xc
cmp byte [0x100c5b68], 0
je case.default.0x1004afde
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
pushal
inc ebp
pop ebx
cmpsd dword [esi], dword es:[edi]
nop
push ss
out 0x2f, eax
test eax, 0xd34108be
in eax, dx
aam 0x21
or byte [ebp - 0x4c], bl
outsd dx, dword [esi]
or al, 0x7f
push ebp
xor dword [0x86794f52], 0xc2c601a4
iretd
mov eax, 1
pop esi
ret 0xc
Function at 0x1004b730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
cmp byte [0x100c5b68], 0
push esi
je 0x1004bc2d
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
mov ecx, 0x8fb54b04
add byte [edi - 0x10], dh
mov bh, 0xa4
mov eax, dword [0xaa000d3e]
sbb ecx, esp
int3
mov dword [esp + 0x20], 0x6edd3366
mov dword [esp + 0x24], 0x6ee3334e
mov dword [esp + 0x28], 0x6ed63347
mov dword [esp + 0x2c], 0x6ec2334b
mov dword [esp + 0x30], 0x6ed43356
mov dword [esp + 0x34], 0x6ee23350
mov dword [esp + 0x38], 0x6ec33347
mov dword [esp + 0x3c], 0x6ed43354
mov dword [esp + 0x40], 0x6eb13350
mov eax, dword [esp + 0x20]
mov byte [esp + 0x44], 0
cmp byte [esp + 0x44], 0
jne 0x1004bca3
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 0x20]
xor eax, 0x6eb13322
mov dword [esp + ecx*4 + 0x20], eax
inc ecx
cmp ecx, 9
jb 0x1004bc90
mov dword [esp + 8], 0x75a0c1b3
mov dword [esp + 0xc], 0x54a5ca92
mov dword [esp + 0x10], 0x74bec883
mov dword [esp + 0x14], 0x42badf92
mov dword [esp + 0x18], 0x27ccad85
mov eax, dword [esp + 8]
mov byte [esp + 0x1c], 0
cmp byte [esp + 0x1c], 0
jne 0x1004bcf3
xor ecx, ecx
nop dword [eax]
mov eax, dword [esp + ecx*4 + 8]
xor eax, 0x27ccadf7
mov dword [esp + ecx*4 + 8], eax
inc ecx
cmp ecx, 5
jb 0x1004bce0
push 0
push 0
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x30]
mov edx, 2
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x20]
push dword [ebp + 8]
call fcn.1005c850
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1004bd20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [0x100c5b68], 0
push esi
je 0x1004bf1d
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
adc dword [eax], esp
mov al, byte [0x545a4c5a]
fcomp qword [eax - 0x261c6c6a]
dec eax
cmp dword [edx], ebx
hlt
mov dword [esp + 0x10], 0x38e4d769
mov dword [esp + 0x14], 0x38e2d77a
mov dword [esp + 0x18], 0x38d2d702
mov eax, dword [esp + 0x10]
mov byte [esp + 0x1c], 0
cmp byte [esp + 0x1c], 0
jne 0x1004bf63
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 0x10]
xor eax, 0x38d2d702
mov dword [esp + ecx*4 + 0x10], eax
inc ecx
cmp ecx, 3
jb 0x1004bf50
mov dword [esp + 4], 0x3ebcb45
mov dword [esp + 8], 0x3393fd2e
mov eax, dword [esp + 4]
mov byte [esp + 0xc], 0
cmp byte [esp + 0xc], 0
jne 0x1004bfa3
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 4]
xor eax, 0x3393fd2e
mov dword [esp + ecx*4 + 4], eax
inc ecx
cmp ecx, 2
jb 0x1004bf90
push 0
push 0
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x20]
mov edx, 2
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push dword [ebp + 8]
call fcn.1005c850
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004bfd0
Capabilities:
Encode data using xor

Disassembly:
and al, 0xc
add byte [ebp + 0x20], dh
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
cmp byte [0x100c5b68], 0
push esi
je 0x1004c10d
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
xlatb
test ebp, 0x5995e463
jno 0x1004bf7e
xor eax, 0xfa372044
scasd eax, dword es:[edi]
aam 0x33
lodsb al, byte [esi]
invalid
mov dword [esp + 0x1c], 0x1ee81ee6
mov dword [esp + 0x20], 0x1eae1ee3
mov dword [esp + 0x24], 0x1eb71ee8
mov dword [esp + 0x28], 0x1eb61ebd
mov dword [esp + 0x2c], 0x1eb01efe
mov dword [esp + 0x30], 0x1eb71ebe
mov dword [esp + 0x34], 0x1eaf1ee2
mov dword [esp + 0x38], 0x1ead1eee
mov dword [esp + 0x3c], 0x1eef1ee9
mov dword [esp + 0x40], 0x1edf1efa
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x44], 0
cmp byte [esp + 0x44], 0
jne 0x1004c183
xor ecx, ecx
nop
mov eax, dword [esp + ecx*4 + 0x1c]
xor eax, 0x1edf1e8a
mov dword [esp + ecx*4 + 0x1c], eax
inc ecx
cmp ecx, 0xa
jb 0x1004c170
mov dword [esp + 4], 0x6b48f323
mov dword [esp + 8], 0x7316ac2d
mov dword [esp + 0xc], 0x7215ab3b
mov dword [esp + 0x10], 0x6845b427
mov dword [esp + 0x14], 0x1a51f42c
mov eax, dword [esp + 4]
mov byte [esp + 0x18], 0
cmp byte [esp + 0x18], 0
jne 0x1004c1d3
xor ecx, ecx
nop dword [eax]
mov eax, dword [esp + ecx*4 + 4]
xor eax, 0x1a21c44f
mov dword [esp + ecx*4 + 4], eax
inc ecx
cmp ecx, 5
jb 0x1004c1c0
push 0
push 0
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x2c]
mov edx, 2
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push dword [ebp + 8]
call fcn.1005c850
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x1004c200
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
cmp byte [0x100c5b68], 0
je 0x1004c578
push esi
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
aaa
sbb ecx, dword [ebp + 0x58c00a60]
out dx, al
push ebp
jl 0x1004c25b
pop eax
pop edi
mov ah, 0x90
mov dword [esi], esp
jmp 0x1004c237
mov esp, 0x1e133a58
adc byte [esi], bl
and eax, 0x6354e6
ror dword [ecx + 0x2f722665], cl
mov ah, 0x33
pop esp
invalid
mov cl, 0x77
fsincos
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
pop ebx
add eax, 0x5fb9a3ec
int3
mov dword [esp + 0xc], 0x442245ff
mov dword [esp + 0x10], 0x446645f4
mov dword [esp + 0x14], 0x442545f9
mov dword [esp + 0x18], 0x445345e2
mov eax, dword [esp + 0xc]
mov byte [esp + 0x1c], 0
cmp byte [esp + 0x1c], 0
jne 0x1004c5c3
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 0xc]
xor eax, 0x44534591
mov dword [esp + ecx*4 + 0xc], eax
inc ecx
cmp ecx, 4
jb 0x1004c5b0
mov dword [esp], 0x7f288769
mov dword [esp + 4], 0x4a3e806f
mov eax, dword [esp]
mov byte [esp + 8], 0
cmp byte [esp + 8], 0
jne 0x1004c5f4
xor ecx, ecx
mov eax, dword [esp + ecx*4]
xor eax, 0x4a4df607
mov dword [esp + ecx*4], eax
inc ecx
cmp ecx, 2
jb 0x1004c5e3
push 0
push 0
push 0
push dword [esp + 0x3c]
lea eax, [esp + 0x1c]
mov edx, 2
push eax
push dword [esp + 0x3c]
lea ecx, [esp + 0x18]
push dword [esp + 0x3c]
call fcn.1005c850
add esp, 0x3c
ret 0x10
Function at 0x1004c620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
mov dword [esp + 0x24], 0x673f9959
mov dword [esp + 0x28], 0x67299953
mov dword [esp + 0x2c], 0x6727994f
mov dword [esp + 0x30], 0x676b994c
mov dword [esp + 0x34], 0x673b9951
mov dword [esp + 0x38], 0x6733991d
mov dword [esp + 0x3c], 0x6730995f
mov dword [esp + 0x40], 0x676d994a
mov dword [esp + 0x44], 0x673e994c
mov dword [esp + 0x48], 0x6735994f
mov dword [esp + 0x4c], 0x672e994e
mov dword [esp + 0x50], 0x67689951
mov dword [esp + 0x54], 0x676e9959
mov dword [esp + 0x58], 0x675d9929
mov eax, dword [esp + 0x24]
mov byte [esp + 0x5c], 0
cmp byte [esp + 0x5c], 0
jne 0x1004c6c3
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [esp + ecx*4 + 0x24]
xor eax, 0x675d9929
mov dword [esp + ecx*4 + 0x24], eax
inc ecx
cmp ecx, 0xe
jb 0x1004c6b0
mov dword [esp + 4], 0x428650e8
mov dword [esp + 8], 0x9948fe
mov dword [esp + 0xc], 0x58c854e0
mov dword [esp + 0x10], 0x69f5fee
mov dword [esp + 0x14], 0x5e9a51fd
mov dword [esp + 0x18], 0x38441ff
mov dword [esp + 0x1c], 0x36fc01e8
mov eax, dword [esp + 4]
mov byte [esp + 0x20], 0
cmp byte [esp + 0x20], 0
jne 0x1004c723
xor ecx, ecx
nop dword [eax]
mov eax, dword [esp + ecx*4 + 4]
xor eax, 0x36fc3298
mov dword [esp + ecx*4 + 4], eax
inc ecx
cmp ecx, 7
jb 0x1004c710
push 0
push 0
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x34]
mov edx, 2
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push dword [ebp + 8]
call fcn.1005c850
add esp, 0x1c
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1004c750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x64
cmp byte [0x100c5b68], 0
push esi
je 0x1004c8ed
mov esi, dword [sym.imp.KERNEL32.dll_Beep]
cmp dword [esi + 0x17], edx
int 0xd9
cmp ah, byte [edi + 0x279ffd55]
nop
mov eax, edi
xchg bl, bl
mov bh, 0xcd
jns 0x1004c7f2
adc dl, 0xfc
xchg ebx, eax
push ebp
inc ebp
xchg dword [ebp - 0x80], edi
sub ebp, dword [edi]
invalid
pop esi
jo 0x1004c819
mov ah, byte [edi - 0x45]
xlatb
outsd dx, dword [esi]
jo 0x1004c785
nop
or dl, byte [0xb04e1b87]
sbb ecx, dword [esi - 0x50]
sti
sar edi, 0xd7
mov ah, 0xde
pushfd
int1
cdq
lodsb al, byte [esi]
popal
or byte [edx + 0x3b], cl
pushfd
or al, 0xf7
xchg dword [esi - 0xe4434ac], ebx
push 0x2a
jp 0x1004c7ab
clc
mov al, 0xf0
int1
pushfd
xchg edx, eax
das
ficomp dword [edx - 0xa]
cmp al, 0xf8
pushfd
pop es
push 0x67
jg 0x1004c813
aaa
adc byte [ebx + 0x25], cl
cmp al, 0x26
push cs
mov esp, 0x198fa2cc
or dl, dh
invalid
mov word [edx], fs
outsd dx, dword [esi]
int3
mov cl, 0xe2
push eax
mov dh, 0x6f
sub ebp, dword [ecx]
ja 0x1004c79d
xchg esi, eax
invalid
ret
jns 0x1004c7ed
mov dword [0x72d9a6d8], eax
popfd
or byte [esi + 0x5d], al
pop ebp
rcl byte [ebp - 0x78f05c9a], cl
push cs
ror dword [ebx + 0x7b], 1
sar byte [ebx - 0x75], 0xe2
jle 0x1004c848
fcom dword [ebp + 0xf]
retf
adc dl, ch
invalid
mov dword [esp + 0x28], 0x1c7a79e3
mov dword [esp + 0x2c], 0x1c2679f5
mov dword [esp + 0x30], 0x1c6c79e9
mov dword [esp + 0x34], 0x1c7b79fa
mov dword [esp + 0x38], 0x1c6e79fe
mov dword [esp + 0x3c], 0x1c6e79a8
mov dword [esp + 0x40], 0x1c2f79a9
mov dword [esp + 0x44], 0x1c6579f6
mov dword [esp + 0x48], 0x1c6679ff
mov dword [esp + 0x4c], 0x1c2179ed
mov dword [esp + 0x50], 0x1c7479fa
mov dword [esp + 0x54], 0x1c6e79fb
mov dword [esp + 0x58], 0x1c7b79af
mov dword [esp + 0x5c], 0x1c2479f7
mov dword [esp + 0x60], 0x1c1679f5
mov eax, dword [esp + 0x28]
mov byte [esp + 0x64], 0
cmp byte [esp + 0x64], 0
jne 0x1004c993
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 0x28]
xor eax, 0x1c167999
mov dword [esp + ecx*4 + 0x28], eax
inc ecx
cmp ecx, 0xf
jb 0x1004c980
mov dword [esp + 4], 0x19e3ec5
mov dword [esp + 8], 0x5c9128cf
mov dword [esp + 0xc], 0x49c32ad8
mov dword [esp + 0x10], 0x429d6b8f
mov dword [esp + 0x14], 0x68622d9
mov dword [esp + 0x18], 0x499030dc
mov dword [esp + 0x1c], 0x39c3f89
mov dword [esp + 0x20], 0x31f252d3
mov eax, dword [esp + 4]
mov byte [esp + 0x24], 0
cmp byte [esp + 0x24], 0
jne 0x1004ca03
xor ecx, ecx
nop word [eax + eax]
mov eax, dword [esp + ecx*4 + 4]
xor eax, 0x31f252bf
mov dword [esp + ecx*4 + 4], eax
inc ecx
cmp ecx, 8
jb 0x1004c9f0
push 0
push 0
push 0
push dword [ebp + 0x14]
lea eax, [esp + 0x38]
mov edx, 2
push eax
push dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
push dword [ebp + 8]
call fcn.1005c850
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret 0x10