joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470670
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54c770
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x5a1574]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [0x5a7324]
xor edi, edi
cmp eax, edi
jne 0x47079f
push 0x9c
lea eax, [ebp - 0xb0]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.00516fd0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [ebp - 0xb0]
push ecx
mov dword [ebp - 0xb0], 0x9c
call esi
cmp eax, edi
jne 0x470709
lea edx, [ebp - 0xb0]
push edx
mov dword [ebp - 0xb0], 0x94
call esi
cmp eax, edi
jne 0x470709
mov dword [0x5a7324], edi
xor eax, eax
jmp 0x47079f
mov ecx, dword [ebp - 0xa0]
sub ecx, 1
movzx eax, word [ebp - 0xa4]
je 0x4707da
sub ecx, 1
jne 0x47079a
mov eax, dword [ebp - 0xac]
cmp eax, 4
jbe 0x4707bb
cmp eax, 7
jne 0x470744
mov dword [0x5a7324], 0x1000
jmp 0x47079a
cmp eax, 6
mov eax, dword [ebp - 0xa8]
jne 0x470775
cmp eax, edi
jne 0x47075f
mov dword [0x5a7324], 0x800
jmp 0x47079a
cmp eax, 1
je 0x470738
cmp eax, 2
jne 0x47079a
mov dword [0x5a7324], 0x2000
jmp 0x47079a
cmp eax, 1
jae 0x470786
mov dword [0x5a7324], 0x100
jmp 0x47079a
dec eax
neg eax
sbb eax, eax
and eax, 0x200
add eax, 0x200
mov dword [0x5a7324], eax
mov eax, dword [0x5a7324]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00516d58
mov esp, ebp
pop ebp
ret
jne 0x4707c9
mov dword [0x5a7324], 0x80
jmp 0x47079a
sub eax, 3
neg eax
sbb eax, eax
and eax, 0x3f80
add eax, 0x40
jmp 0x470795
cmp dword [ebp - 0xac], 4
jne 0x47079a
mov ecx, dword [ebp - 0xa8]
cmp ecx, edi
je 0x470831
cmp ecx, 0xa
je 0x470807
sub ecx, 0x5a
neg ecx
sbb ecx, ecx
and ecx, 0x1f
add ecx, 0x20
mov dword [0x5a7324], ecx
jmp 0x47079a
cmp eax, 0x7ce
je 0x470822
sub eax, 0x8ae
neg eax
sbb eax, eax
and eax, 0x2f
add eax, 0x10
jmp 0x470795
mov dword [0x5a7324], 8
jmp 0x47079a
sub eax, 0x3b6
je 0x470871
sub eax, 1
je 0x470862
sub eax, 0xa0
je 0x470853
mov dword [0x5a7324], 0x3f
jmp 0x47079a
mov dword [0x5a7324], 4
jmp 0x47079a
mov dword [0x5a7324], 2
jmp 0x47079a
mov dword [0x5a7324], 1
jmp 0x47079a
Function at 0x473c50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54f1c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.004011ff
mov dword [esp + 0x18], 0
test edi, edi
je 0x473c94
add edi, 0x28
jmp 0x473c96
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x473cae
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::runtime_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x473f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x110
mov eax, dword [0x5a1574]
xor eax, esp
mov dword [esp + 0x10c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x120]
lea eax, [esp + 0xc]
push edi
xor ebx, ebx
push eax
mov dword [esp + 0x24], ebx
call fcn.00423847
push eax
call fcn.00422f70
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
call fcn.005189eb
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.00423634
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004238ab
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00423428
push 0xc7
lea ecx, [esp + 0x7d]
push ebx
push ecx
mov byte [esp + 0x84], bl
call fcn.00516fd0
lea edx, [esp + 0x50]
push edi
push edx
call fcn.00423924
lea eax, [esp + 0x60]
push edi
push eax
call fcn.00423924
add esp, 0x40
lea ecx, [esp + 0x10]
push edi
push ecx
call fcn.00423924
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
add esp, 8
push ebx
push 0xf4240
push edi
push ebp
call fcn.00519c00
push ebx
push 0x3c
push edx
push eax
call fcn.00519b40
push eax
push ebx
push 0x3938700
push edi
push ebp
call fcn.00519c00
push ebx
push 0x3c
push edx
push eax
call fcn.00519b40
push eax
push ebx
push 0xd693a400
push edi
push ebp
call fcn.00519c00
movzx edx, word [esp + 0x28]
push eax
movzx eax, word [esp + 0x38]
movzx ecx, word [esp + 0x1e]
push edx
push eax
push ecx
push str._02i__02i__04i__02i:_02i:_02i
lea edx, [esp + 0x70]
push 0xc8
push edx
call fcn.0051814d
lea eax, [esp + 0x78]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
add esp, 0x24
mov byte [esi + 4], bl
lea edx, [eax + 1]
jmp 0x474090
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x474090
sub eax, edx
push eax
lea eax, [esp + 0x58]
push eax
mov ecx, esi
call fcn.004029c0
mov ecx, dword [esp + 0x11c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00516d58
add esp, 0x110
ret
Function at 0x475360
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x54d000
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
mov eax, dword [0x5a1574]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
sub esp, 8
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov dword [esp + 0x28], 0
call fcn.00475b50
mov ecx, dword [esp + 0x30]
add esp, 4
call fcn.00475280
lea ecx, [esp + 0xc]
push ecx
call fcn.00475c60
mov edx, dword [eax]
push ecx
mov ecx, esp
mov dword [ecx], edx
mov eax, dword [eax + 4]
mov byte [esp + 0x24], 1
mov dword [esp + 0x10], esp
mov dword [ecx + 4], eax
test eax, eax
je 0x4753d7
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov ecx, dword [esp + 0x2c]
call fcn.00475280
mov esi, dword [esp + 0x10]
mov byte [esp + 0x1c], 0
test esi, esi
je 0x475417
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x475417
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x475417
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
sub esp, 8
mov eax, esp
mov dword [esp + 0x10], esp
push eax
call fcn.00476610
mov ecx, dword [esp + 0x30]
add esp, 4
call fcn.00475280
sub esp, 8
mov ecx, esp
mov dword [esp + 0x10], esp
push ecx
call fcn.00476720
mov ecx, dword [esp + 0x30]
add esp, 4
call fcn.00475280
mov esi, dword [esp + 0x28]
mov dword [esp + 0x1c], 0xffffffff
test esi, esi
je 0x475487
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x475487
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, esi
call eax
lea ecx, [esi + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x475487
mov eax, dword [esi]
mov edx, dword [eax + 8]
mov ecx, esi
call edx
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x18
ret

Function at 0x47d6c0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x47d6ed
push esi
push edi
jmp 0x47d6d0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x562f50]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x47d6d0
pop edi
pop esi
ret
Function at 0x483240
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
xor edi, edi
mov eax, ebp
test ebp, ebp
jne 0x483257
xor ebx, ebx
jmp 0x48326f
cmp byte [ebp], 0
je 0x483266
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x483260
sub eax, ebp
and eax, 0x3fffffff
mov ebx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 4]
xor esi, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
test eax, eax
jle 0x48332e
jmp 0x483294
mov esi, dword [esp + 0x10]
cmp esi, 2
jge 0x48329c
xor esi, 1
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x4832bc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax + 8]
mov edx, esi
shl edx, 4
mov edx, dword [edx + eax]
call fcn.0047cd20
test eax, eax
jne 0x48331b
mov ecx, dword [esp + 0x1c]
mov edx, dword [ecx + 8]
shl esi, 4
mov ecx, dword [esi + edx + 0xc]
add ecx, 4
cmp dword [ecx + 0xc], 0
je 0x483305
xor eax, eax
mov edi, ebx
mov edx, ebp
test ebx, ebx
jle 0x4832ff
lea ecx, [ecx]
movzx esi, byte [edx]
movzx esi, byte [esi + 0x562f50]
lea ebp, [eax*8]
xor esi, ebp
dec edi
xor eax, esi
inc edx
test edi, edi
jg 0x4832e0
mov ebp, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x483307
xor edx, edx
push ebp
call fcn.0047d750
add esp, 4
test eax, eax
je 0x483338
mov edi, dword [eax + 8]
test edi, edi
jne 0x48332e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jl 0x483290
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
xor edi, edi
jmp 0x48331b

Function at 0x483340
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov eax, edi
test edi, edi
jne 0x483356
xor ebx, ebx
jmp 0x48336f
cmp byte [edi], 0
je 0x483366
jmp 0x483360
inc eax
cmp byte [eax], 0
jne 0x483360
sub eax, edi
and eax, 0x3fffffff
mov ebx, eax
mov edx, dword [ecx + 4]
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], edx
test edx, edx
jle 0x48342c
mov ecx, dword [ecx + 8]
push esi
mov dword [esp + 0x14], ecx
jmp 0x483394
mov eax, dword [esp + 0x10]
cmp eax, 2
jge 0x48339c
xor eax, 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
shl eax, 4
mov esi, dword [eax + edx + 0xc]
add eax, edx
test ecx, ecx
je 0x4833bc
mov edx, dword [eax]
call fcn.0047cd20
test eax, eax
jne 0x48340b
cmp dword [esi + 0x20], 0
lea ecx, [esi + 0x14]
je 0x4833f5
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x4833ef
nop
movzx edi, byte [edx]
movzx edi, byte [edi + 0x562f50]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x4833d0
mov edi, dword [esp + 0x20]
xor edx, edx
div dword [ecx]
jmp 0x4833f7
xor edx, edx
push edi
call fcn.0047d750
add esp, 4
test eax, eax
je 0x483428
mov ebp, dword [eax + 8]
test ebp, ebp
jne 0x48341e
mov eax, dword [esp + 0x10]
inc eax
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jl 0x483390
pop esi
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
xor ebp, ebp
jmp 0x48340b
pop edi
mov eax, ebp
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x4878e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
lea eax, [esi*8]
cmp eax, 0x400
jbe 0x4878fb
mov esi, 0x80
cmp esi, dword [edi]
jne 0x487906
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [0x5a77a4]
test eax, eax
je 0x487911
call eax
lea ecx, [esi*8]
push ebp
push ecx
call fcn.00486fa0
mov ebp, eax
mov eax, dword [0x5a77a8]
add esp, 4
mov dword [esp + 8], ebp
test eax, eax
je 0x487933
call eax
test ebp, ebp
jne 0x48793f
pop ebp
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [edi + 0xc]
push ebx
push edx
call fcn.0047c9b0
push ebp
mov dword [edi + 0xc], ebp
call dword [0x59f15c]
mov ebx, eax
shr ebx, 3
lea eax, [ebx*8]
push eax
push 0
push ebp
mov dword [esp + 0x2c], ebx
mov dword [edi], ebx
call fcn.00516fd0
mov ecx, dword [edi + 8]
add esp, 0x14
mov dword [edi + 8], 0
test ecx, ecx
je 0x487a1f
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x4879b3
nop
movzx ebx, byte [esi]
movzx ebx, byte [ebx + 0x562f50]
lea ebp, [eax*8]
xor ebx, ebp
dec edx
xor eax, ebx
inc esi
test edx, edx
jg 0x487990
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
xor edx, edx
div ebx
lea eax, [ebp + edx*8]
test eax, eax
je 0x4879fa
mov esi, dword [eax]
test esi, esi
je 0x4879d0
mov edx, dword [eax + 4]
jmp 0x4879d2
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x4879fa
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x4879f2
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x487a13
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x487a13
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x487a09
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x487983
pop ebx
pop ebp
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x48eaa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x318
mov eax, dword [0x5a1574]
xor eax, esp
mov dword [esp + 0x314], eax
mov eax, dword [0x5a77c4]
push ebx
push esi
test eax, eax
je 0x48eadc
push eax
push 0x566434
lea eax, [esp + 0x14]
push eax
push 0xe6
call fcn.0048e9d0
add esp, 0x10
jmp 0x48eb81
call fcn.0047d830
test eax, eax
je 0x48eb26
lea ecx, [esp + 0x114]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x114]
call fcn.0047d8f0
mov esi, eax
test esi, esi
jne 0x48eb63
pop esi
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x314]
xor ecx, esp
call fcn.00516d58
add esp, 0x318
ret
lea eax, [esp + 0x114]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x114]
push ecx
call fcn.0047d950
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x48eb0a
call fcn.0047d8f0
push ebx
mov esi, eax
call fcn.0051704a
add esp, 4
test esi, esi
je 0x48eb0a
push esi
push 0x566434
lea edx, [esp + 0x14]
push edx
push 0xe6
call fcn.0048e9d0
push esi
call fcn.0051704a
add esp, 0x14
cmp byte [esp + 0xc], 0
lea eax, [esp + 0xc]
je 0x48eb96
lea esp, [esp]
inc eax
cmp byte [eax], 0
jne 0x48eb90
lea ecx, [esp + 0xc]
sub eax, ecx
and eax, 0x3fffffff
jbe 0x48ebaf
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x48ebaf
sub eax, 1
jne 0x48eba4
lea edx, [esp + 0xc]
push edx
mov byte [esp + eax + 0x10], 0
mov eax, dword [esp + 0x328]
push 0x566428
add eax, 0xffffffe2
push edi
push eax
call fcn.0048e9d0
add esp, 0x10
mov eax, edi
test edi, edi
je 0x48ebed
cmp byte [edi], 0
je 0x48ebe6
lea ecx, [ecx]
inc eax
cmp byte [eax], 0
jne 0x48ebe0
sub eax, edi
and eax, 0x3fffffff
cmp dword [0x59f13c], 0
push ebp
mov esi, eax
mov ebx, 0x14
lea ebp, [edi + eax]
jne 0x48ec0b
mov dword [esp + 0xc], 0
jmp 0x48ec30
push 5
call dword [0x59f178]
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
je 0x48ec30
mov ecx, eax
push ecx
call dword [0x59f180]
add esp, 4
lea ebx, [ebx]
dec ebx
call fcn.004876e0
mov byte [ebp], al
inc ebp
test ebx, ebx
jne 0x48ec30
mov eax, dword [esp + 0xc]
pop ebp
test eax, eax
je 0x48ec51
push eax
call dword [0x59f188]
add esp, 4
mov ecx, 0x14
jmp 0x48ec60
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
inc esi
sub ecx, 1
mov dl, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x48ec60
mov byte [edi + esi], cl
mov ecx, dword [esp + 0x31c]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00516d58
add esp, 0x318
ret
Function at 0x48edc0
Capabilities:
Get disk size

Disassembly:
sub esp, 0x114
mov eax, dword [0x5a1574]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
lea ecx, [esp + 8]
push ecx
push 0x104
push eax
push edx
mov dword [esp + 0x14], 0x200
call fcn.0048eca0
add esp, 0x10
test eax, eax
jne 0x48eeef
push ebx
push esi
push edi
call fcn.0047d830
lea ebx, [esp + 0x14]
test eax, eax
je 0x48ee18
call fcn.0047d890
mov esi, eax
jmp 0x48ee38
call fcn.0047d890
mov edi, eax
test edi, edi
je 0x48eeb6
push edi
call fcn.0047d9c0
push edi
mov esi, eax
call fcn.0051704a
add esp, 8
test esi, esi
je 0x48eeb6
call fcn.0047d830
test eax, eax
mov eax, esi
je 0x48ee7d
cmp word [esi], 0
je 0x48ee66
lea ecx, [ecx]
cmp word [eax], 0x5c
je 0x48ee61
add eax, 2
cmp word [eax], 0
jne 0x48ee50
jmp 0x48ee66
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 0xc]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x48eea7
cmp byte [esi], 0
je 0x48ee92
cmp byte [eax], 0x5c
je 0x48ee8f
inc eax
cmp byte [eax], 0
jne 0x48ee82
jmp 0x48ee92
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x18]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.0051704a
add esp, 4
test edi, edi
jne 0x48eed3
pop edi
pop esi
mov eax, 0x200
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00516d58
add esp, 0x114
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00516d58
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.00516d58
add esp, 0x114
ret
Function at 0x490a70
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
jne 0x490a7d
xor eax, eax
pop ebx
ret
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, 0x44
call fcn.004873c0
mov edi, eax
test edi, edi
jne 0x490a97
pop edi
pop esi
pop ebx
ret
mov eax, dword [ebx]
push ebp
mov ebp, dword [esp + 0x1c]
push ebp
push eax
push esi
call fcn.0048ab80
mov dword [edi], eax
mov ecx, dword [ebx + 8]
push ebp
push ecx
push esi
call fcn.00490820
push 0
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
push ebp
push eax
push esi
call fcn.00497670
mov dword [edi + 0xc], eax
mov edx, dword [ebx + 0x10]
push ebp
push edx
push esi
call fcn.0048ab80
push 0
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
push ebp
push eax
push esi
call fcn.00497670
add esp, 0x44
mov dword [edi + 0x14], eax
mov eax, dword [ebx + 0x18]
push ebp
push eax
push esi
call fcn.0048ab80
mov dword [edi + 0x18], eax
mov cl, byte [ebx + 4]
mov byte [edi + 4], cl
mov edx, dword [ebx + 0x1c]
push ebp
push edx
push esi
call fcn.00490a70
push 0
mov dword [edi + 0x1c], eax
mov eax, dword [ebx + 0x28]
push ebp
push eax
push esi
call fcn.00497670
push 0
mov dword [edi + 0x28], eax
mov eax, dword [ebx + 0x2c]
push ebp
push eax
push esi
call fcn.00497670
mov dword [edi + 0x2c], eax
xor eax, eax
mov dword [edi + 0x30], eax
mov dword [edi + 0x34], eax
mov cx, word [ebx + 6]
add esp, 0x38
mov edx, 0xfff7
mov dword [edi + 0x24], eax
and cx, dx
or eax, 0xffffffff
pop ebp
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], eax
mov dword [edi + 0x40], eax
mov word [edi + 6], cx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x498f60
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esi]
xor ebp, ebp
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebp
jmp 0x498f80
mov al, byte [ebp + 0x563678]
mov byte [esp + 0x10], al
test edi, edi
je 0x499005
cmp byte [edi], 0
mov eax, edi
je 0x498f9b
inc eax
cmp byte [eax], 0
jne 0x498f95
mov ecx, dword [esp + 0x20]
sub eax, edi
and eax, 0x3fffffff
add ecx, 0x17c
cmp dword [ecx + 0xc], 0
mov ebx, eax
je 0x498fed
xor eax, eax
mov esi, ebx
mov edx, edi
test ebx, ebx
jle 0x498fe3
mov edi, edi
movzx edi, byte [edx]
movzx edi, byte [edi + 0x562f50]
lea ebp, [eax*8]
xor edi, ebp
dec esi
xor eax, edi
inc edx
test esi, esi
jg 0x498fc0
mov edi, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov esi, dword [esp + 0x24]
xor edx, edx
div dword [ecx]
jmp 0x498fef
xor edx, edx
push edi
call fcn.0047d750
add esp, 4
test eax, eax
je 0x499001
mov eax, dword [eax + 8]
jmp 0x49900c
xor eax, eax
jmp 0x49900c
mov ecx, dword [esp + 0x20]
mov eax, dword [ecx + 0x2c]
test eax, eax
je 0x49901c
movzx ecx, byte [esp + 0x10]
lea edx, [ecx + ecx*4]
lea eax, [eax + edx*4 - 0x14]
cmp dword [eax + 0xc], 0
jne 0x49903d
inc ebp
cmp ebp, 3
mov dword [esp + 0x14], ebp
jl 0x498f80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov ecx, dword [eax + 8]
mov dword [esi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [esi + 0xc], edx
mov eax, dword [eax + 0x10]
pop edi
mov dword [esi + 0x10], 0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x4aed20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x1b4
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov edx, dword [esi + 4]
push edi
mov edi, dword [eax + 0x18]
mov eax, dword [edx]
xor ebx, ebx
xor ecx, ecx
cmp eax, ebx
mov dword [esp + 0x38], edi
jle 0x4aed60
add edx, 4
lea esp, [esp]
cmp dword [edx], edi
je 0x4aee1c
inc ecx
add edx, 4
cmp ecx, eax
jl 0x4aed50
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov eax, dword [esi + 0x14]
mov edi, dword [esi + 0x1c]
lea ecx, [eax + eax*4]
lea eax, [edi + ecx*8]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], edi
cmp edi, eax
jae 0x4aef19
mov ebx, dword [ebp + 0x18]
jmp 0x4aed90
fldz
mov edx, 0x100
cmp word [edi + 0x10], dx
jne 0x4aef06
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
not eax
and eax, dword [edi + 0x20]
not ecx
and ecx, dword [edi + 0x24]
and eax, dword [ebp + 0x14]
and ecx, ebx
or eax, ecx
jne 0x4aef06
mov ecx, dword [edi + 0xc]
mov eax, dword [ecx + 0x160]
mov edx, dword [ecx + 0x164]
and eax, dword [esp + 0x10]
and edx, dword [esp + 0x14]
or eax, edx
je 0x4aef06
mov esi, dword [ecx + 0x1c]
fld st(0)
mov ecx, dword [ecx + 0x14]
fst qword [esp + 0x30]
lea eax, [ecx + ecx*4]
fxch st(1)
lea eax, [esi + eax*8]
fst qword [esp + 0x20]
mov dword [esp + 0x2c], eax
cmp esi, eax
jae 0x4aeebe
mov ecx, 0x200
cmp word [esi + 0x10], cx
jne 0x4aee35
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov edi, dword [esi + 0xc]
push ebx
push edx
push eax
jmp 0x4aee6f
mov eax, 1
xor edx, edx
call fcn.0051c640
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
jmp 0x4aed68
mov ecx, dword [esp + 0x38]
cmp dword [esi + 8], ecx
jne 0x4aeeb3
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax + 4]
push ebx
mov dword [esp + 0x64], edx
mov edx, dword [ebp + 8]
push ecx
mov dword [esp + 0x6c], eax
mov byte [esp + 0x78], 0x43
mov dword [esp + 0x84], esi
mov dword [esp + 0x7c], 1
push edx
lea edi, [esp + 0x6c]
mov eax, dword [ebp + 0x10]
fstp st(1)
lea ecx, [esp + 0x4c]
fstp st(0)
xor edx, edx
call fcn.004a76c0
fld qword [esp + 0x5c]
fadd qword [esp + 0x3c]
mov ecx, dword [ebp + 0x20]
mov edi, dword [esp + 0x28]
add esp, 0xc
fst qword [esp + 0x30]
fld qword [esp + 0x58]
fadd qword [esp + 0x20]
fst qword [esp + 0x20]
fld qword [ecx + 0x10]
fcomp st(2)
fnstsw ax
test ah, 0x41
jnp 0x4aeec1
mov eax, dword [esp + 0x2c]
add esi, 0x28
cmp esi, eax
jb 0x4aee03
mov ecx, dword [ebp + 0x20]
cmp dword [ebp + 0x1c], 0
je 0x4aeee5
fstp st(1)
sub esp, 8
fstp qword [esp]
call fcn.00484e80
fld qword [esp + 0x28]
add esp, 8
fmul st(1), st(0)
fxch st(1)
fadd qword [esp + 0x30]
fxch st(1)
fld qword [ecx + 0x10]
fcomp st(2)
fnstsw ax
test ah, 0x41
jne 0x4aef04
fxch st(1)
mov dword [ecx], 0x10000000
fstp qword [ecx + 0x10]
mov dword [ecx + 8], edi
fstp qword [ecx + 0x18]
jmp 0x4aef08
fstp st(1)
fstp st(0)
add edi, 0x28
mov dword [esp + 0x1c], edi
cmp edi, dword [esp + 0x3c]
jb 0x4aed90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret