joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f669
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541f39
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f731
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541f39
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53bc14
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f7d7
cmp edi, dword [esi + 0x7c]
jge 0x42f7d7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0044407b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0044407b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541f39
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541f39
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f729
jmp 0x42f6f9
call fcn.004482a2
int3

Function at 0x43b2d9
Capabilities:
Check for vm using instruction vpcext

Disassembly:
push ebp
or dh, byte [ebx + ecx*8 + 0xdb2cc94]
push ecx
invalid

Function at 0x43d361
Capabilities:
Encode data using xor

Disassembly:
invalid
mov esp, 0x81c80af8
lodsd eax, dword [esi]
jle 0x43d352
pushal
pop es
sar eax, cl
pop esi
fimul dword [ecx + 0xf]
mov ch, 0x6a
inc dword [edx + 0x75]
repe cmpsb byte fs:[esi], byte es:[edi]
mov bl, byte [esi]
xor cl, bh
push esp
test al, 0x31
dec eax
dec byte [edi]
invalid

Function at 0x4460a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
Function at 0x4460d2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]

Function at 0x4460e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558979
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x446171
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
fmul qword [esi + 0x88]
call 0x558979
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x552654
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x446217
cmp edi, dword [esi + 0x7c]
jge 0x446217
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045aabb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045aabb
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
call 0x558979
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558979
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446169
jmp 0x446139
call fcn.0045ece2
int3

Function at 0x45aafb
Capabilities:
Encode data using xor

Disassembly:
dec eax
pop edx
mov byte [ecx + eax*4 - 0x38], dh
and eax, 0xaf052a32
pop edx
jno 0x45ab2a
and esi, ecx
mov esi, 0x3d30ef95
imul esi, ebp, 0xffffff9a
jge 0x45aabe
loope fcn.0045aafb
inc ebx
insd dword es:[edi], dx
mov cl, 0x9c
cmp bh, bh
add ebp, edi
wait
sbb dword [edx], edx
sub dword [esi - 0x56a62cf5], edi
and ebx, eax
sbb byte [ecx + edx - 0x41f0f960], bh
loope 0x45aacd
arpl word [eax], bx
js 0x45aac2
mov bl, 0x5c
pop esp
mov es, word [eax - 0x5e]
fisttp qword [edx + 0xd]
movsd dword es:[edi], dword [esi]
leave
movsd dword es:[edi], dword [esi]
cmp dl, al
js 0x45ab45
and dh, byte [edx - 0x1f6c9c6c]
ror bh, 0xa7
sbb edx, esp
push edi
sub byte [eax - 0x7c439a5e], al
xchg dword [edi + eax*4 - 0xe], ecx
and byte [edx - 0x787c439b], 0x4c
xchg edx, esi
cdq
call 0x6b50f74a
or byte [ebx - 0x59], dl
int3

Function at 0x45cb09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
Function at 0x45cb12
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]

Function at 0x45cb26
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]

Function at 0x45cb54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call 0x56f3d9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45cbd1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56f3d9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5690b4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45cc77
cmp edi, dword [esi + 0x7c]
jge 0x45cc77
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0047151b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and al, 0x24
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0047151b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f3d9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f3d9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45cbc9
jmp 0x45cb99
call fcn.00475742
int3
Function at 0x46aa5f
Capabilities:
Encode data using xor

Disassembly:
sub edi, dword [edx - 0x52]
mov ebx, 0x82df1853
adc dword [eax - 0x4c0e7b42], 0xe3c0108d
push esi
xchg ecx, eax
cmp ah, byte [ebx - 0x43554756]
test al, 0x20
das
lahf
jb 0x46aa17
xor eax, 0x632110fa
inc esp
sti
stc
test al, 0x80
add byte [edx], dh
ret 0x6947
mov edi, 0x39afc416
mov bh, 0xce
jge 0x46a9eb
cmp eax, 0x868e7c67
or byte [ecx + 0x3066e7c7], bl
popal
sti
out 0x66, eax
xor byte [ecx - 5], ah
xlatb
rcl dword [edi + 4], cl
jnp 0x46aa70
inc ecx
leave
cmpsd dword [esi], dword es:[edi]
inc edx
pop es
mov ch, 0x52
mov al, 0xce
pushfd
xor byte [edx], 0x83
mov bh, 0xf2
or al, 0xd
sbb ah, 0x90
push esi
loope 0x46aaf1
shr eax, 0xb6
sub ch, byte [edx]
add esp, dword [ebp + esi*8 + 0x4e3d1b58]
out 0xbc, al
mov dl, 0x4f
pop eax
sbb edi, dword [0xb2bce64e]
dec edi
pop ebx
rol dword [ebp - 0x59723432], 0x47
inc esi
or esi, 0xa6c1ef4b
out dx, eax
push es
pop es
cmp ah, byte [ebx + 0x4c]
sub eax, esi
stosb byte es:[edi], al
xchg esi, eax
outsd dx, dword [esi]
pushf
xchg edx, eax
cmpsd dword [esi], dword es:[edi]
std
add cl, byte [eax + 1]
and ecx, dword [ebp - 0x66]
mov dl, 0xd0
mov bh, 0x30
cmp bl, byte [ecx - 0x12]
fsubp st(5)
mov ebp, 0x2f94ca6
stc
add dword [ebx], 0xf19d9599
movsd dword es:[edi], dword [esi]
jb 0x46aaef
sub cl, byte [edx + 0x3430d203]
scasd eax, dword es:[edi]
clc
out dx, eax
loopne 0x46aa9b
sub dword [0x4d583e45], ebp
pop eax
dec ebp
int3
Function at 0x473909
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005861d9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4739d1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005861d9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057feb4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473a77
cmp edi, dword [esi + 0x7c]
jge 0x473a77
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048831b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048831b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005861d9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005861d9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4739c9
jmp 0x473999
call fcn.0048c542
int3

Function at 0x47bf86
Capabilities:
Encode data using xor

Disassembly:
aas
push ebx
out dx, al
or al, 0x7e
inc esp
aam 0x77
arpl word [esp + ecx*2 - 0x2ae7f9e9], bx
dec esp
pop ss
push es
sbb ch, dl
dec esp
pop ss
push es
sbb ch, dl
outsb dx, byte [esi]
cmc
sub dword [ecx - 0x58], ebp
xor esi, ecx
rol dword [ecx], 1
and al, 0x6e
jne 0x47bf7c
ret

Function at 0x48384d
Capabilities:
Encode data using xor

Disassembly:
sbb cl, cl
lahf
sal bh, cl
iretd
sub dl, al
popal
jle 0x4837fa
adc al, 0x2e
mov edx, 0x9d7c4e33
pop ds
inc esp
pushfd
xor dword [edx - 0x7e35d960], esi
loope 0x48385a
mov edx, 0xe7f2ff6b
fsub dword [ecx + 0x2be0c79d]
add al, 0x52
aaa
add eax, 0xa741127c
invalid
Function at 0x48a473
Capabilities:
Encode data using xor

Disassembly:
dec eax
inc ebp
mov dl, 0x8a
or eax, 0x8399c5be
sahf
ficomp word [edi + 0x78]
invalid

Function at 0x48af79
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059d849
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b041
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059d849
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00597524
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b0e7
cmp edi, dword [esi + 0x7c]
jge 0x48b0e7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049f98b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049f98b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d849
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d849
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b039
jmp 0x48b009
call fcn.004a3bb2
int3
Function at 0x4a1e59
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b4729
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a1f21
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b4729
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ae404
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a1fc7
cmp edi, dword [esi + 0x7c]
jge 0x4a1fc7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b686b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b686b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4729
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4729
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a1f19
jmp 0x4a1ee9
call fcn.004baa92
int3
Function at 0x4ad213
Capabilities:
Encode data using xor

Disassembly:
popal
int1
pop esi
salc
xor esi, esp
dec edi
or al, ah
mov dl, 0xbb
push ebx
mov es, word [ebp + 0x38a27e69]
push 0x50
jp 0x4ad1d3
and eax, 0x91de248c
ljmp 0x6868
invalid
invalid
jmp 0x1669a68e
movsb byte es:[edi], byte [esi]
and byte [ebp - 0x1a5c9b5b], dl
push ebx
add eax, 0x88966747
aam 0x82
cmc
fsub st(6)
jne 0x4ad1a9
sar dl, cl
add eax, esp
pushal
push esp
movsd dword es:[edi], dword [esi]
in al, 0xa5
mov ah, ch
bound esp, qword [ecx]
test byte [ebp + 0x3f], bh
mov al, byte [0x95347924]
pop es
pushal
mov ch, 0x8d
mov ch, 0xaa
in eax, 0x11
add byte [esi], al
sbb al, 0x26
popal
add byte [ebx], cl
bound esi, qword [ecx]
xor edx, dword [esi + edx*2]
pushal
push ebx
sbb al, byte [eax + 0x653f4f]
pushal
mov al, byte [0x606c0610]
dec edi
aas
add byte gs:[eax - 0x60], ah
adc byte [esi], al
insb byte es:[edi], dx
pushal
in al, 0x6b
pop ds
push esi
add dword [ecx], eax
insb byte es:[edi], dx
idiv edx
movsd dword es:[edi], dword [esi]
pushal
xchg esp, eax
xlatb
mov edx, 0x5e33a8a5
add dword [eax + edx - 0x496ee18d], esp
mov ecx, dword [ebp + esi - 0x18]
push cs
enter 0x208d, 0xffffffffffffffef
push ds
xchg ecx, eax
mov dh, 0x8b
dec esp
xor eax, 0x8dc80ee8
and bh, ch
cmp byte [eax - 0x1f], bh
neg byte [ebx + 0x7c]
scasd eax, dword es:[edi]
xor al, 0xa1
cmp byte [ebp + 0x18], dh
mov dword [0x10962378], eax
jne 0x4ad276
xor al, 0x20
jne 0x4ad2ef
in al, dx
test edi, 0x8f7334b4
and al, 0x50
loope 0x4ad256
invalid

Function at 0x4b6827
Capabilities:
Encode data using xor

Disassembly:
int 0x5f
cmp bh, byte [ecx]
mov ebx, 0x76b65269
dec ebp
invalid
add dword [edx], edi
invalid
rol eax, cl
movsd dword es:[edi], dword [esi]
dec ebp
cmpsd dword [esi], dword es:[edi]
xor ebp, dword [ebp - 0x18d83206]
std
movsb byte es:[edi], byte [esi]
test byte [edx + 9], 0xb1
pushal
mov ch, 0x2a
fdivr qword [ebp + 0x32be196c]
xor ebp, dword [ecx - 0x47]
mov eax, dword [0x4276dc97]
pop ds
sahf
mov cl, byte [ecx]
mov dl, 0xb8
jnp 0x4b687d
sahf
jno 0x4b67e6
jne 0x4b6821
mov ebp, 0x3b5cae6f
dec ebp
sahf
mov dword [eax - 0x36], ecx
mov edi, dword [eax]
mov esi, dword [edx - 0x394ff265]

Function at 0x4b7bc6
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
insb byte es:[edi], dx
cmp byte [edi + 0x63], 0xea
sub eax, 0x347b785b
push dword [edi]
push edi
imul dword [edi]
push ebx
aad 0xfd
jb 0x4b7be3
cmp dword [ebx], eax
in al, dx
sti
push esp
mov ah, 0x18
cmp eax, 0xd6ddd82e
fcomp st(5)
salc
dec ebp
xchg esi, eax
invalid

Function at 0x4b8a97
Capabilities:
Terminate process

Disassembly:
or eax, 0x4c648c
push esi
lea esi, [ecx - 4]
cmp esi, eax
jb 0x4b8ab7
mov eax, dword [esi]
test eax, eax
je 0x4b8aac
call eax
sub esi, 4
cmp esi, dword [0x4c6490]
jae 0x4b8aa4
pop esi
push 0x4c1018
push 0x4c1014
call fcn.004b8b0a
pop ecx
pop ecx
push 0x4c1020
push 0x4c101c
call fcn.004b8b0a
pop ecx
pop ecx
test ebx, ebx
pop ebx
je 0x4b8ae6
invalid
Function at 0x4b95c1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c1420
cmp edx, dword [eax]
je 0x4b95e3
add eax, 8
inc ecx
cmp eax, 0x4c14b0
jl 0x4b95d4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c1420]
jne 0x4b9711
mov eax, dword [0x4c5dc4]
cmp eax, 1
je 0x4b96eb
test eax, eax
jne 0x4b9614
cmp dword [0x4c1348], 1
je 0x4b96eb
cmp edx, 0xfc
je 0x4b9711
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b964b
lea eax, [ebp - 0x1a4]
push 0x4be948
push eax
call fcn.004b9fa0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba430
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b968e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba430
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4be944
push edi
call fcn.004bc300
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4be928
push eax
call fcn.004b9fa0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004b9fb0
lea eax, [ebp - 0xa0]
push 0x4be924
push eax
call fcn.004b9fb0
push dword [esi + 0x4c1424]
lea eax, [ebp - 0xa0]
push eax
call fcn.004b9fb0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4be8fc
push eax
call fcn.004bc274
add esp, 0x2c
pop edi
jmp 0x4b9711
lea eax, [ebp + 8]
lea esi, [esi + 0x4c1424]
Function at 0x401411
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x20
mov byte [0x405005], 0
mov word [0x405022], 0
mov dword [0x405018], 0
mov dword [0x40501c], 0
mov word [0x405026], 0
mov byte [0x435275], 0
mov word [0x405028], 0
mov dword [section..bss], 0x402020
mov dword [0x405014], 0xffffffff
mov word [0x405024], 0xffff
mov dword [0x405010], 0x40501f
mov dword [0x40500c], 0x405018
mov byte [0x405004], 0xff
xor eax, eax
mov ecx, eax
shl ecx, 9
xor edx, edx
mov word [ecx + edx*2 + 0x405240], 1
inc edx
cmp edx, 0x100
jne 0x401493
mov word [eax + eax + 0x405040], 0x100
inc eax
cmp eax, 0x100
jne 0x40148c
xor eax, eax
mov byte [eax + 0x425240], 0xff
inc eax
cmp eax, 0x10000
jne 0x4014ba
mov eax, 4
shl dword [0x405018], 8
mov edx, dword [section..bss]
lea ecx, [edx + 1]
mov dword [section..bss], ecx
mov cl, byte [edx]
mov edx, dword [0x40500c]
mov byte [edx], cl
dec eax
jne 0x4014ce
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 2
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x40000000
mov eax, dword [esp + 0x28]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
sub esp, 0x1c
mov ebx, eax
mov al, 1
cmp ebx, 0xffffffff
je 0x40157f
call fcn.004011f6
test al, al
jne 0x401573
mov dword [esp + 0x10], 0
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x405020
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x40153a
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
xor eax, eax
add esp, 0x20
pop ebx
ret