joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4459d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov eax, 0xfffffffe
cmp word [esi + eax + 2], 0
lea eax, [eax + 2]
jne 0x4459e0
mov ebx, eax
sar ebx, 1
cmp ebx, 0xfffffffb
jge 0x4459fb
mov eax, 0xffffffff
jmp 0x4459fe
add eax, 0xa
push eax
call fcn.0040c730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
mov word [eax + 8], 0
mov dword [esp + 8], eax
mov ecx, eax
add ecx, 8
movzx edx, word [esi]
test dx, dx
je 0x445a41
add esi, 2
nop
nop
mov word [ecx], dx
add ecx, 2
movzx edx, word [esi]
add esi, 2
test dx, dx
jne 0x445a30
mov word [ecx], 0
lea ecx, [ebx*2 + 8]
mov word [esp + 0xc], cx
lea ecx, [ebx*2 + 0xa]
mov word [esp + 0xe], cx
mov eax, dword [esp + 8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0x40
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov ecx, 0x2d2e5e76
mov eax, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x2d2e5e76]
mov esi, ecx
and esi, ebx
add esi, esi
sub esi, ebx
add esi, eax
and esi, ecx
mov edi, esi
and edi, 0x2d2e5e7d
mov edx, esi
and edx, 2
mov ebp, esi
or ebp, 0xfffffffd
inc ebp
imul ebp, edi
or esi, 2
imul esi, edx
add ebp, ebx
sub ebp, esi
add ebp, ecx
mov ebx, ebp
and ebx, 0x31
add ebx, ebx
xor ebp, 0x4e
sub ebx, ebp
mov byte [esp + ecx - 0x2d2e5e76], bl
inc ecx
dec eax
cmp ecx, 0x2d2e5e7d
jne 0x445ac0
mov esi, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x445b73
xor edx, edx
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edx*8], 0x266686e9
je 0x445b40
inc edx
cmp ecx, edx
jne 0x445b30
jmp 0x445b73
mov ecx, dword [ebx + edx*8 + 4]
cmp ecx, esi
je 0x445b73
mov eax, esp
lea edx, [esp + 0x14]
push dword [esp + 0x50]
push dword [esp + 0x50]
push eax
push edx
push dword [esp + 0x58]
push dword [esp + 0x58]
push 6
push dword [0x453174]
push ecx
call fcn.004421f0
add esp, 0x24
mov esi, eax
push dword [esp + 8]
call fcn.0040c740
add esp, 4
mov eax, esi
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445b90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x58
mov ebx, dword [ebp + 8]
mov eax, 0xfffffffe
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ebx + eax + 2], 0
lea eax, [eax + 2]
jne 0x445bb0
mov esi, eax
sar esi, 1
cmp esi, 0xfffffffb
jge 0x445bcb
mov eax, 0xffffffff
jmp 0x445bce
add eax, 0xa
push eax
call fcn.0040c730
add esp, 4
mov dword [eax], 0x3f005c
mov dword [eax + 4], 0x5c003f
lea ecx, [esi + 4]
mov word [eax + 8], 0
mov dword [esp + 4], eax
mov edx, eax
add edx, 8
movzx edi, word [ebx]
test di, di
je 0x445c21
add ebx, 2
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov word [edx], di
add edx, 2
movzx edi, word [ebx]
add ebx, 2
test di, di
jne 0x445c10
mov word [edx], 0
mov edi, 3
sub edi, esi
and edi, 2
mov edx, ecx
and edx, 0xfffd
imul edx, edi
and esi, 2
or ecx, 2
imul ecx, esi
lea esi, [ecx + edx]
mov word [esp + 8], si
add ecx, edx
add ecx, 2
mov word [esp + 0xa], cx
mov eax, dword [esp + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 0x40
lea ecx, [esp + 8]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0x34353a3b
mov word [esp + 0x2c], 0
mov byte [esp + 0x2e], 0
mov ecx, 0x2d2e5e76
mov eax, 0xd2d1a189
nop
nop
nop
nop
movzx ebx, byte [esp + ecx - 0x2d2e5e4e]
mov esi, ecx
and esi, ebx
add esi, esi
sub esi, ebx
add esi, eax
and esi, ecx
mov edx, esi
and edx, 0x2d2e5e7d
mov edi, esi
or edi, 0xfffffffd
inc edi
imul edi, edx
mov edx, esi
and edx, 2
or esi, 2
imul esi, edx
add edi, ebx
sub edi, esi
add edi, ecx
mov ebx, edi
and ebx, 0x31
add ebx, ebx
xor edi, 0x4e
sub ebx, edi
mov byte [esp + ecx - 0x2d2e5e4e], bl
inc ecx
dec eax
cmp ecx, 0x2d2e5e7d
jne 0x445cb0
mov esi, dword [esp + 0x28]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x445d55
xor edx, edx
mov edi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
cmp dword [edi + edx*8], 0x87573896
je 0x445d30
inc edx
cmp ecx, edx
jne 0x445d20
jmp 0x445d55
mov ecx, dword [edi + edx*8 + 4]
cmp ecx, esi
je 0x445d55
lea eax, [esp + 0x28]
lea edx, [esp + 0x10]
push eax
push edx
push 2
push dword [0x453174]
push ecx
call fcn.004421f0
add esp, 0x14
mov esi, eax
push dword [esp + 4]
call fcn.0040c740
add esp, 4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x445d6e
mov eax, dword [esp + 0x48]
mov dword [ecx], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x28
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov edx, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x2d2e5e76]
mov ebx, eax
and ebx, ecx
add ebx, ebx
sub ebx, ecx
add ebx, edx
and ebx, eax
mov edi, ebx
and edi, 0x2d2e5e7d
mov esi, ebx
or esi, 0xfffffffd
inc esi
imul esi, edi
mov edi, ebx
and edi, 2
or ebx, 2
imul ebx, edi
add esi, ecx
sub esi, ebx
add esi, eax
mov ecx, esi
and ecx, 0x31
add ecx, ecx
xor esi, 0x4e
sub ecx, esi
mov byte [esp + eax - 0x2d2e5e76], cl
inc eax
dec edx
cmp eax, 0x2d2e5e7d
jne 0x445db0
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x445e58
xor edx, edx
mov esi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xa70a987f
je 0x445e30
inc edx
cmp ecx, edx
jne 0x445e20
jmp 0x445e58
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x445e58
mov eax, esp
lea edx, [esp + 0x1c]
push 5
push 0x18
push eax
push edx
push dword [ebp + 8]
push 5
push dword [0x453174]
push ecx
call fcn.004421f0
add esp, 0x20
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x445e65
mov ecx, dword [esp + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x445e74
cmp byte [esp + 0x15], 0
setne byte [ecx]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x445e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov ebx, 0xd2d1a189
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2d2e5e76]
mov ebp, eax
and ebp, edi
add ebp, ebp
sub ebp, edi
add ebp, ebx
and ebp, eax
mov ecx, ebp
and ecx, 0x2d2e5e7d
mov edx, ebp
and edx, 2
mov esi, ebp
or esi, 0xfffffffd
inc esi
imul esi, ecx
or ebp, 2
imul ebp, edx
add esi, edi
sub esi, ebp
add esi, eax
mov ecx, esi
and ecx, 0x31
add ecx, ecx
xor esi, 0x4e
sub ecx, esi
mov byte [esp + eax - 0x2d2e5e76], cl
inc eax
dec ebx
cmp eax, 0x2d2e5e7d
jne 0x445eb0
mov eax, dword [esp]
mov esi, dword [0x45316c]
test esi, esi
je 0x445f64
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xd41f89d1
je 0x445f30
inc edi
cmp esi, edi
jne 0x445f20
jmp 0x445f64
mov ebx, dword [ebx + edi*8 + 4]
cmp ebx, eax
je 0x445f64
lea eax, [esp + 8]
push 0
push 0
push dword [esp + 0x34]
push dword [esp + 0x34]
push eax
push 0
push 0
push 0
push dword [esp + 0x44]
push 9
push dword [0x453174]
push ebx
call fcn.004421f0
add esp, 0x30
cmp eax, 0x103
jne 0x446039
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov ecx, 0xd2d1a189
nop
nop
nop
nop
movzx edi, byte [esp + eax - 0x2d2e5e76]
mov edx, eax
and edx, edi
add edx, edx
sub edx, edi
add edx, ecx
and edx, eax
mov ebx, edx
and ebx, 0x2d2e5e7d
mov ebp, edx
and ebp, 2
mov esi, edx
or esi, 0xfffffffd
inc esi
imul esi, ebx
or edx, 2
imul edx, ebp
add esi, edi
sub esi, edx
add esi, eax
mov edx, esi
and edx, 0x31
add edx, edx
xor esi, 0x4e
sub edx, esi
mov byte [esp + eax - 0x2d2e5e76], dl
inc eax
dec ecx
cmp eax, 0x2d2e5e7d
jne 0x445f90
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x446031
xor edx, edx
mov esi, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0x53f09cfa
je 0x446010
inc edx
cmp ecx, edx
jne 0x446000
jmp 0x446031
mov ecx, dword [esi + edx*8 + 4]
cmp ecx, eax
je 0x446031
push 0
push 0
push dword [esp + 0x2c]
push 3
push dword [0x453174]
push ecx
call fcn.004421f0
add esp, 0x18
test eax, eax
js 0x446039
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x30]
test edx, edx
je 0x446050
xor ecx, ecx
cmp eax, 0xc0000011
je 0x44604e
mov ecx, dword [esp + 0xc]
mov dword [edx], ecx
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x3c]
xor edi, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp word [ecx + edi], 0
lea edi, [edi + 2]
jne 0x446250
add edi, 0xfffffffe
and edi, 0xfffe
mov word [esp + 8], di
add edi, 2
mov word [esp + 0xa], di
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], 0x18
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 0x40
lea eax, [esp + 8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp], 0x34353a3b
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x2d2e5e76
mov edi, 0xd2d1a189
nop
nop
nop
movzx ebp, byte [esp + eax - 0x2d2e5e76]
mov ebx, eax
and ebx, ebp
add ebx, ebx
sub ebx, ebp
add ebx, edi
and ebx, eax
mov edx, ebx
and edx, 0x2d2e5e7d
mov esi, ebx
and esi, 2
mov ecx, ebx
or ecx, 0xfffffffd
inc ecx
imul ecx, edx
or ebx, 2
imul ebx, esi
add ecx, ebp
sub ecx, ebx
add ecx, eax
mov ebx, ecx
and ebx, 0x31
add ebx, ebx
xor ecx, 0x4e
sub ebx, ecx
mov byte [esp + eax - 0x2d2e5e76], bl
inc eax
dec edi
cmp eax, 0x2d2e5e7d
jne 0x4462c0
mov eax, dword [esp]
mov ecx, dword [0x45316c]
test ecx, ecx
je 0x44636a
xor edi, edi
mov ebx, dword [0x453170]
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x9ecf05eb
je 0x446340
inc edi
cmp ecx, edi
jne 0x446330
jmp 0x44636a
mov ecx, dword [ebx + edi*8 + 4]
cmp ecx, eax
je 0x44636a
lea eax, [esp + 0x10]
push dword [esp + 0x48]
push eax
push dword [esp + 0x4c]
push dword [esp + 0x4c]
push 4
push dword [0x453174]
push ecx
call fcn.004421f0
add esp, 0x1c
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100472b6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0x3205a5f
adc ecx, ecx
pushal
push eax
mov byte [esp + 8], bl
lea esp, [esp + 0x2c]
jmp 0x1004e888

Function at 0x10048f66
Capabilities:
Resolve function by parsing pe exports

Disassembly:
rcl al, 2
add edi, 1
setge al
shl al, 6
rol al, 3
xor al, 0x28
mov al, byte [edi]
cmc
clc
pushfd
pushal
test al, al
push 0xf09d58fa
call fcn.1004e13f
sub ebp, dword [edx + 0x41]
and al, 0xf
invalid
adc cl, ch
push 0xffffffffffffff8c
add byte [eax], al
call fcn.1004d8ed
sbb dword [ebp - 0x6735b880], ecx
int1
xchg byte [edx], cl
scasb al, byte es:[edi]
test byte [ebx + 0x4a], ah
sbb eax, ebx
xchg ebx, eax
outsb dx, byte [esi]
pop ecx
adc bh, bh
fcom dword [ebx - 0xefa692]
mov esi, 0xc63b88a1
sub eax, 0xd0d747e0
ja 0x10048588
inc eax
movsd dword es:[edi], dword [esi]
xor byte [esi - 0x4fecc79a], bl
adc eax, 0x89b766ac
sbb al, 0xa6
movsb byte es:[edi], byte [esi]
popfd
and dl, cl
mov edi, esp
js 0x1004858c
pop ebx
jne 0x100485b9
jp 0x1004857f
xchg ecx, eax
clc
push ebp
mov bh, 0x5e
salc
ljmp 0x2eb0
jge 0x10048533
mov cs, eax
aaa
or eax, 0xfee0dd46
xchg ebx, eax
xchg dword [ebx - 0x8d43375], ebx
and esi, dword [esi + 0x3912b5e0]
or eax, 0xa34133b
add dword [esi], esi
xchg edi, eax
mov esp, 0xc247e2c8
cmp eax, 0x3e875459
dec edi
out 0xa, al
sar dword [ebp - 0x1b], 0xcc
mov bh, 0x32
lodsd eax, dword [esi]
push esp
jecxz 0x1004854c
xor ch, byte [ebp + 0x298ee354]
fcom dword [edi - 6]
sub eax, ebx
push edi
cli
lodsd eax, dword [esi]
and al, 0xc3
push esi
xor esp, dword [edi]
retf
lea esp, [esp + 0x40]
call fcn.1004914e
pushfd
cmp eax, 0x7d00
push 0xd12836d6
pushal
lea esp, [esp + 0x28]
jae 0x1004e888
stc
stc
call fcn.1004e600
pushal
lea esp, [esp + 0x20]
je 0x1004dad0
pushfd
pushal
mov byte [esp + 8], ch
pushfd
adc ecx, ecx
mov byte [esp], 0x5d
push 0x59252482
pushfd
lea esp, [esp + 0x30]
jmp 0x1004e888
push 0xb856df3e
lea esp, [esp + 0x24]
je 0x10048c36
pushfd
stc
cmp al, 0x23
bt esi, 4
cmp ebx, 3
pushal
pushfd
jmp 0x1004c563
sub al, 0x30
bt bp, 0xc
cmc
pushfd
cmp cl, 0x5d
cmp al, 9
pushal
pushfd
lea esp, [esp + 0x28]
ja 0x10048539
push ebp
push 0x843595b2
pushfd
imul edx, edx, 0xa
cmc
clc
cmp bl, al
add edx, eax
push ebx
pushfd
push dword [esp]
lea esp, [esp + 0x18]
jmp 0x10047319
lea esp, [esp + 0x28]
je 0x1005fae3
push esi
lea esp, [esp + 4]
jmp 0x1005fafe
not bx
pop ebx
xchg esi, ebp
movsx di, bl
movsx bp, bl
movsx si, cl
pop edi
call fcn.1004a97d
lea esp, [esp + 4]
je 0x1005129e
jmp 0x1004aab1
push 0xe965014c
inc bl
push dword [esp]
jmp 0x1005f662
sub di, cx
pushfd
sbb di, 0xb905
and di, bx
mov edi, edx
sub esp, 0xfffffffc
ror ch, cl
dec cx
mov ecx, edi
call fcn.10047631
jmp 0x10049086
inc ecx
lea esp, [esp + 8]
inc bl
setbe bl
call fcn.1004e108
lea esp, [esp + 0x54]
je 0x10048f46
clc
clc
pushal
clc
cmp ebx, 2
mov byte [esp], 0xa4
jmp 0x1005eb4c
adc bl, 0xe7
mov bx, word [esi]
pushfd
and ebx, 0xfff
pushal
bt cx, 3
stc
add dword [edi + ebx], edx
lea esp, [esp + 0x24]
Function at 0x1004b9bd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x20]
call fcn.10048a25
call fcn.100771c7
pushfd
pushfd
inc ecx
lea esp, [esp + 0xc]
jmp 0x1004cf80
pushfd
lea esp, [esp + 4]
call fcn.10048a25
pushal
adc ecx, ecx
jmp 0x1004902e

Function at 0x1004bfe2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
dec al
pushfd
cmc
shr eax, 1
lea esp, [esp + 0x40]
jno 0x10048f8c
je 0x1004dad0
jmp 0x1004ba2b
call fcn.100472b6
pushal
lea esp, [esp + 0x28]
jae 0x1004e54e
call fcn.1004c280
invalid
push dword [esp]
rol al, 2
pushfd
cmp bh, ah
mov byte [esp + 8], dl
neg al
pushfd
dec al
pushal
not al
jmp 0x1004b96e
pushfd
push dword [esp]
not al
push eax
lodsb al, byte [esi]
jmp 0x1004e0ee

Function at 0x1004c280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x20]
jae 0x1004c295
pushfd
jmp 0x1004c7d8
pushal
lea esp, [esp + 0x20]
call fcn.10048a25
push edx
push 0x57d813e
push 0xaa426104
jmp 0x1004d78f
mov byte [esp], 0x9d
mov al, byte [esp]
mov bl, 2
pushfd
dec al
inc ecx
not al
mov al, 0x10
lea esp, [esp + 8]
jmp 0x1004b7c7
mov byte [esp], 0xda
lea esp, [esp + 4]
jne 0x1004e120
push 0xce9663c9
stosb byte es:[edi], al
mov byte [esp], 0xa
lea esp, [esp + 4]
jmp 0x1004b1b5
adc al, al
pushal
lea esp, [esp + 0x2c]
jp 0x100771e6
push 0xf9289b6f
pushfd
lea esp, [esp + 8]
jae 0x1004c295
pushfd
pushal
push 0x66f4dfb
push ecx
lea esp, [esp + 0x2c]
jne 0x1004e120
pushfd
pushal
stosb byte es:[edi], al
push dword [esp]
lea esp, [esp + 0x28]
jmp 0x1004b1b5
pushal
cmc
xchg dword [esp + 0x1c], esi
cmc
rcr si, cl
lea esi, [esi*2 - 0x46fcffb9]
movsx si, al
mov esi, edi
pushfd
sub esi, eax
call fcn.1005f7fa
jmp 0x10048e9c

Function at 0x1004cd14
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [esp]
call fcn.10048f2e
push esp
push 0x726f2065
imul ebp, dword fs:[esi + 0x61], 0x7525206c
and byte [ebx + 0x6f], ah
jne 0x1004cd9c
and byte fs:[esi + 0x6f], ch
je 0x1004cd56
bound esp, qword [ebp + 0x20]
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [ecx + 0x74], sp
and byte fs:[ecx + 0x6e], ch
and byte [eax + ebp*2 + 0x65], dh
and byte [ecx + edi*2 + 0x6e], ah
popal
insd dword es:[edi], dx
imul esp, dword [ebx + 0x20], 0x6b6e696c
and byte [ecx + ebp*2 + 0x62], ch
jb 0x1004cdbb
imul esp, dword [edx + 0x72], 0x20797261
jb 0x1004cdd5
jns 0x1004cd7d
and byte [0x48530073], ah
and eax, 0x48530073
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [eax - 0x64], ah
push dword [ebx]
cmp al, 0x1b
div byte [ecx - 0x42]
hlt
lahf
retf
and ebp, dword [ecx - 0x2b]
pushal
inc eax
movsd dword es:[edi], dword [esi]
sal dword [eax + 0x35], 1
pop eax
mov esp, dword [esi + 0x1b]
mov edi, 0x2d67139
test dword [eax], esp
jno 0x1004cd5b
mov eax, dword [0x907ab233]
nop
cmc
test eax, 0x2dba8ed
sub eax, 0x8dc13ed6
mov ecx, 0x1471767
invalid
Function at 0x1004d355
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
mov byte [esp + 4], bl
cmp eax, edx
pushfd
mov dword [esp], 0xd77
mov word [esp], sp
mov word [esp], bp
lea esp, [esp + 0x28]
jb 0x1004c2c3
jne 0x10075e09
test ebp, ebx
cmp eax, dword [ebp - 0x10]
push 0x1bdce5c5
lea esp, [esp + 4]
jae 0x1004c2c3
and bx, dx
xadd bh, ch
rcl di, 4
clc
mov ebx, eax
push 0x6d5e436a
sar di, 3
mov edi, eax
shld cx, sp, 3
mov ecx, 0x104
stc
jmp 0x1005f3d4
xor al, al
push dword [esp]
repne scasb al, byte es:[edi]
pushal
push dword [esp + 4]
lea esp, [esp + 0x2c]
jne 0x1004c2b7
btc si, 9
mov ecx, edi
lea esi, [esi + 0x1bbbb3c4]
mov si, ax
add si, cx
or si, cx
sub ecx, ebx
neg esi
mov esi, esp
stc
pushfd
clc
test sp, si
cmp eax, dword [ebp - 0x10]
pushal
pushfd
lea esp, [esp + 0x28]
jae 0x1004c2c3
xchg ecx, ebx
rcl ch, cl
bswap bx
mov ebx, eax
shrd ecx, ebx, 0x1c
mov edi, eax
shr ecx, cl
mov ecx, 0x104
cmp sp, 0x5f72
push edx
sub al, al
mov byte [esp], 0x8e
cmc
pushal
bt bp, 6
repne scasb al, byte es:[edi]
pushal
mov byte [esp], ah
lea esp, [esp + 0x44]
jne 0x1004c2b7
pushal
bts ecx, ebx
adc esi, edx
sub ch, bh
mov ecx, edi
rol si, cl
add si, dx
sub ecx, ebx
sbb si, 0x9a9d
bts si, 0xc
lea esi, [esp + 0x20]
cmp al, 0xc9
stc
sub edi, 4
clc
push dword [edi]
pop dword [esp + 0x1c]
bt bp, 2
pushfd
clc
cmp edi, ebx
call fcn.1004b40b

Function at 0x1004d783
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr eax, 0x10
add esp, 4
push ebp
call fcn.1004cd76

Function at 0x10051104
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, 0x33bcf0e6
lcall 0xf84d, 0xbea21879
clc
ja 0x100510d3
xchg ebp, eax
sub al, 0xc7
push edx
fnstenv [eax + 0x33]
sub byte [esi - 0x1d], dl
xchg edx, eax
test dword [ebx - 0x3617fe3f], 0x2cffff78
add ecx, 1
call 0x100489be
sub al, 0xe6
stc
lea esp, [esp + 0x28]
je 0x10048f46
pushal
cmp ch, al
bt bp, di
clc
cmp ebx, 2
push ebp
mov byte [esp + 4], 0xd2
pushfd
call fcn.1004c705
pop esi
sbb eax, 0x572e5bd0
push edi
adc esp, dword [ebp - 0x4c3712f6]
cmpsb byte [esi], byte es:[edi]
jno 0x1005116e
loop 0x100510de
js 0x1005117a
lds ebp, cs:[ebx + edx*8 + 0x52]
lcall 0x1344, 0xdf8b480d
stosb byte es:[edi], al
pushal
mov dword [0xb8ecd708], eax
aaa
sahf
insd dword es:[edi], dx
cmp al, 0x66
fpatan
enter 0xffffffffffffa292, 0xffffffffffffffc3
fld st(6)
or ch, byte [edi - 0x58]
dec edi
outsd dx, dword [esi]
test al, 0x4f
inc edi
inc esi
jns 0x100511b8
and al, 0x3d
jbe 0x1005115c
dec edi
inc edx
pop ebx
nop
aam 0xdd
popfd
std
bound esp, qword [edx + 0x34484d49]
popfd
dec esi
jg 0x1005112b
jge 0x1005115d
loop 0x10051197
sbb ebx, dword [esi + 0x48]
pop esi
dec eax
and bl, byte [ebx]
xor byte fs:[ebx - 0x79dc78ce], bh
mov ecx, 0x4d2ed962
in eax, dx
test eax, 0xef64bd02
mov dh, byte [0x4dba37b0]
dec ebp
add byte [edi + 0x337ce13e], cl
sub byte [eax - 0x7b], bl
invalid

Function at 0x1005f88d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], 0x5357
jmp 0x1005f671
Function at 0x100012f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, ecx
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], ecx
cmp dword [eax], ecx
jle 0x10001424
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
nop
mov esi, dword [edx]
add esi, ecx
mov al, byte [esi]
mov byte [ebp - 0x14], al
mov eax, dword [edx + 4]
mov al, byte [ecx + eax]
mov byte [ebp - 0x10], al
mov eax, dword [edx + 8]
mov al, byte [ecx + eax]
mov byte [ebp - 8], al
mov eax, dword [edx + 0xc]
mov al, byte [ecx + eax]
mov byte [ebp - 4], al
push dword [ebp - 4]
push 9
call fcn.100014c0
push dword [ebp - 8]
mov bl, al
push 0xd
call fcn.100014c0
push dword [ebp - 0x10]
xor bl, al
push 0xb
call fcn.100014c0
mov edi, dword [ebp - 0x14]
xor bl, al
push edi
push 0xe
call fcn.100014c0
push dword [ebp - 4]
xor bl, al
push 0xd
mov byte [esi], bl
call fcn.100014c0
push dword [ebp - 8]
mov bl, al
push 0xb
call fcn.100014c0
mov esi, dword [ebp - 0x10]
xor bl, al
push esi
push 0xe
call fcn.100014c0
push edi
push 9
xor bl, al
call fcn.100014c0
mov ecx, dword [ebp - 0xc]
xor bl, al
mov eax, dword [ebp + 8]
push dword [ebp - 4]
push 0xb
mov eax, dword [eax + 4]
mov byte [ecx + eax], bl
call fcn.100014c0
push dword [ebp - 8]
mov bl, al
push 0xe
call fcn.100014c0
push esi
push 9
xor bl, al
call fcn.100014c0
push edi
push 0xd
xor bl, al
call fcn.100014c0
mov ecx, dword [ebp - 0xc]
xor bl, al
mov eax, dword [ebp + 8]
push dword [ebp - 4]
push 0xe
mov eax, dword [eax + 8]
mov byte [ecx + eax], bl
call fcn.100014c0
push dword [ebp - 8]
mov bl, al
push 9
call fcn.100014c0
xor bl, al
push esi
push 0xd
call fcn.100014c0
push edi
push 0xb
xor bl, al
call fcn.100014c0
mov edx, dword [ebp + 8]
xor bl, al
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov byte [ecx + eax], bl
inc ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
cmp ecx, dword [eax]
jl 0x10001310
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10002130
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 1
jmp fcn.10001900

Function at 0x10002140
Capabilities:
Link many functions at runtime

Disassembly:
mov ecx, 2
jmp fcn.10001900
Function at 0x100061cc
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1000620b
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1000620b
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1000620b
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1000620b
cmp dword [ecx + 0x74], 0xe
jbe 0x1000620b
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x10009199
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10009236
push ebx
push esi
call fcn.10009162
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100090f6
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100091e3
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009235
push edi
push eax
call fcn.10007b1d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10009203
call fcn.10007ae3
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10009234
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100090f6
add esp, 0x20
test eax, eax
jne 0x10009222
push edi
call fcn.10007ae3
jmp 0x1000922a
push ebx
call fcn.10007ae3
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100094a3
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100119c8
push 0x100119c0
push str.FlsAlloc
push 0x1f
call fcn.100093bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100094d7
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
jmp 0x100094dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10009521
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100119d8
push 0x100119d0
push str.FlsGetValue
push 0x21
call fcn.100093bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10009558
push dword [ebp + 8]
mov ecx, esi
call dword [0x10010118]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10009560
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100119e0
push 0x100119d8
push str.FlsSetValue
push 0x22
call fcn.100093bf
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1000959a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x10010118]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]