joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441220
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x479593
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046c5b4
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], 0x5dc6e8
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], 0x5da570
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [0x47b090]
push eax
mov ecx, edi
call fcn.00471c50
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004731af
test eax, eax
je 0x44133c
mov ecx, dword [esp + 0x3c]
call fcn.00471c7d
mov ecx, dword [esi + 0x1c]
mov ebp, dword [0x47b3b8]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x441300
push edi
mov ecx, esi
call fcn.0046f2db
mov ecx, esi
call fcn.004414a0
cmp dword [esp + 0x38], 1
jne 0x441335
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0046f416
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28

Function at 0x443d50
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x443d83
push esi
call fcn.00446e40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x443d7c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x443e09
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x443df2
mov eax, dword [esi + 8]
test eax, eax
je 0x443da7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x443dee
cmp eax, 2
je 0x443df2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x443d9a
cmp eax, 3
je 0x443dcd
cmp eax, 1
jne 0x443d9a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x443d9a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x443d9a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00443e30
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x443e18
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00443e30
add esp, 4
pop esi
ret
Function at 0x452d30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x479ce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004528e0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00452960
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00452960
lea ecx, [esi + 0xc]
call fcn.0046af8e
lea ecx, [esi + 0x10]
call fcn.0046af8e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00455190
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00455190
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00455190
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0046b003
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0046b003
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x403d2a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x905790
push 0x403f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
nop
nop
nop
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0x407df0], 0xffffffff
or dword [0x407df4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x407dd4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x407dd0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x407dec], eax
call fcn.00403f73
cmp dword [0x407ce0], ebx
jne 0x403dad
push 0x403f70
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00403f5e
push 0x407018
push 0x407014
call sub.MSVCRT.dll__initterm
mov eax, dword [0x407dcc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x407dc8]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
nop
adc eax, sym.imp.MSVCRT.dll___getmainargs
push 0x407010
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x403e40
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e14
cmp al, 0x22
jne 0x403e06
cmp byte [esi], 0x22
jne 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e27
cmp al, 0x20
jbe 0x403e19
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403e4b
movzx eax, word [ebp - 0x2c]
jmp 0x403e4e
cmp byte [esi], 0x20
jbe 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
jmp 0x403e40
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
nop
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x296e5d98
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x7c3e5327
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x403e2a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403e2a
lcall 0x5de5, 0x8b10c483
jmp loc.00826910
Function at 0x447def
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 0xc
mov ecx, dword [0x358557c]
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x10], esi
test ecx, ecx
jle 0x447fc3
mov edx, dword [esp + 0x28]
mov eax, dword [esi*4 + 0x3585ad0]
cmp dword [eax], edx
je 0x447e29
inc esi
mov dword [esp + 0x10], esi
cmp esi, ecx
jl 0x447e10
jmp 0x447fc3
cmp dword [esp + 0x38], 0x20
jne 0x447f97
mov eax, dword [eax + 8]
mov ebp, dword [esp + 0x44]
test eax, eax
je 0x447e6d
cmp ebp, 0x20
je 0x447e49
cmp ebp, 0xffffffff
jne 0x447e6d
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call eax
jmp 0x447fc1
mov eax, dword [esp + 0x2c]
inc eax
imul ebx, eax, 3
and ebx, 0xfffffffc
mov eax, ebx
mov dword [esp + 0x14], ebx
imul eax, dword [esp + 0x30]
push eax
push 0
push dword [0x358411c]
call dword [0x3581a5c]
mov dword [esp + 0x18], eax
test eax, eax
je 0x447fc3
mov edi, dword [esp + 0x30]
test edi, edi
jle 0x447f62
mov edx, dword [esp + 0x24]
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ecx
mov ebp, edx
test eax, eax
jle 0x447f42
mov ebx, ecx
mov esi, eax
mov ecx, 0xff
movzx eax, byte [ebp + 2]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 2], al
movzx eax, byte [ebp + 1]
sub eax, ecx
movzx ecx, byte [ebp + 3]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx + 1], al
movzx eax, byte [ebp]
lea ebp, [ebp + 4]
sub eax, ecx
movzx ecx, byte [ebp - 1]
imul eax, ecx
mov ecx, 0xff
add eax, 0xfe01
cdq
idiv ecx
mov byte [ebx], al
lea ebx, [ebx + 3]
dec esi
jne 0x447ed3
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
add edx, dword [esp + 0x34]
add ecx, ebx
dec dword [esp + 0x24]
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ecx
jne 0x447ec0
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x44]
mov eax, dword [esi*4 + 0x3585ad0]
mov esi, dword [esp + 0x18]
push ebp
push dword [esp + 0x44]
push dword [esp + 0x44]
push ebx
push edi
push dword [esp + 0x40]
push esi
push dword [esp + 0x3c]
call dword [eax + 4]
push esi
push 0
push dword [0x358411c]
mov edi, eax
call dword [0x3581a60]
jmp 0x447fc3
cmp dword [esp + 0x38], 0x18
jne 0x447fc3
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x44]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
call dword [eax + 4]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 0x28
Function at 0x417810
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417836
mov eax, dword [0x4b9a90]
test eax, eax
je 0x41782c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4b9070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
Function at 0x421726
Capabilities:
Encode data using xor

Disassembly:
add al, 0x40
jl 0x42175f
or byte [ecx + 0x24], al
pop es
pop eax
in eax, 0x29
test al, 0x6a
sbb dword [ebx - 0x47], edi
or cl, byte [ebx + 0x56]
jns 0x421753
mov al, 0xba
jno 0x421750
push ecx
out dx, al
mov cl, 0xa6
and eax, 0x5e057a82
jl 0x421787
push cs
wait
out 0x72, eax
call 0x5a5c4493
push eax
jno 0x4217c4
int 0x7d
outsb dx, byte [esi]
inc edi
outsd dx, dword [esi]
adc al, 0xcd
imul ebp, dword [ecx], 0x20
pop ecx
imul ecx, dword [eax + 0x2a], 0x7e

Function at 0x42e793
Capabilities:
Check for vm using instruction vpcext

Disassembly:
adc ah, bh
sbb esp, dword [edi + eax*8]
xchg ebp, eax
inc edi
retf 0xb44
xor esp, dword [ecx - 0x4aee91d1]
loope 0x42e7b2
js 0x42e767
push es
fsub st(7)
push edx
cmc
insd dword es:[edi], dx
aaa
mov eax, dword [0x711a6a3f]
scasd eax, dword es:[edi]
inc ebx
xor eax, 0xb3270374
clc
clc
Function at 0x438b6d
Capabilities:
Encode data using xor

Disassembly:
outsb dx, byte [esi]
mov ebp, 0xb8e15202
arpl sp, si
sti
bound eax, qword [ecx + 0x4389d5d2]
cmovne ebp, dword [ebx + 0x7d]
imul esi, edx, 0xc7fb313e
movsd dword es:[edi], dword [esi]
inc edi
scasd eax, dword es:[edi]
mov bl, 0xab
out 0xb4, al
daa
sub dword [edi - 0x5a], ebp
mov bl, 0x5e
push es
aaa
scasd eax, dword es:[edi]
mov cl, cl
mov eax, dword [0x153b8935]
loop 0x438b47

Function at 0x43b4c8
Capabilities:
Encode data using xor

Disassembly:
pop ds
dec ebx
inc esp
adc cl, byte [ebx - 0x404c2d86]
mov bl, 0xbf
xor al, 0xd4
add ecx, dword [eax]
jae 0x43b4cf
pushal
or dword [edx - 0x5f4ac10], 0x39
add ch, byte [ebp - 0x1c]
jp 0x43b50a
pop ebp
sbb eax, 0x74be010b
dec ebx
sub al, 0xe2
mov dl, 0x57
sub byte [eax], ah
aaa
pop edx
aam 0x5d
adc al, 0xfb
mov edx, esp
sar esi, cl
inc eax
dec eax
iretd
mov ah, 0x33
pushal
sub eax, 0x9395c551
fdivr dword [ecx + 0x225f5c5]
dec ebx
mov ah, 0x34
in eax, dx
invalid
Function at 0x447881
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00447a74
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004525c9
xor ebx, ebx
cmp eax, ebx
jne 0x447a2f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00447a74
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.0044f2a8
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004a0b9d
add esp, 0x10
test eax, eax
jne 0x44794a
push esi
call fcn.00444f33
mov esi, eax
cmp esi, ebx
pop ecx
je 0x44794a
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x447935
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x44794a
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x447943
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00453adc
cmp byte [esp + 0x13], bl
je 0x44797a
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00447ab1
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4479ea
push 0x14
call fcn.0049fe0a
cmp eax, ebx
pop ecx
je 0x4479a4
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4479a6
xor edi, edi
cmp edi, ebx
je 0x4479ea
push esi
push edi
call fcn.00446fd7
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0044709f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004471c8
add esp, 0x18
call fcn.00447a74
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00451c96
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x447a01
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x447a13
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x447a56
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x447a56
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0044709f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004471c8
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465c6f
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x7a065b3a
jbe 0x465cd0
dec ebp
cwde
das
push cs
jg 0x465d40
lahf
lcall 0x31e, 0xaf69b0d1
stosd dword es:[edi], eax
sahf
jno 0x465ce5
shr byte [esi + 0x993f6f9], 0xb1
invalid
not byte [ebx + 0x3f8fb109]
invalid
Function at 0x48bb71
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048bd64
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004968b9
xor ebx, ebx
cmp eax, ebx
jne 0x48bd1f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048bd64
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00493598
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e4e8d
add esp, 0x10
test eax, eax
jne 0x48bc3a
push esi
call fcn.00489223
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48bc3a
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48bc25
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48bc3a
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48bc33
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00497dcc
cmp byte [esp + 0x13], bl
je 0x48bc6a
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048bda1
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48bcda
push 0x14
call 0x4e40fa
cmp eax, ebx
pop ecx
je 0x48bc94
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48bc96
xor edi, edi
cmp edi, ebx
je 0x48bcda
push esi
push edi
call fcn.0048b2c7
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048b38f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b4b8
add esp, 0x18
call fcn.0048bd64
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00495f86
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48bcf1
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48bd03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48bd46
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48bd46
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048b38f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048b4b8
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4942a1
Capabilities:
Encode data using xor

Disassembly:
shl dword [ebx + 0x595abfad], cl
add dword [edi + 0x423b0805], esi
Function at 0x4aa05c
Capabilities:
Encode data using xor

Disassembly:
sub edx, dword [ebx + 0x28]
ror byte [ebp + 0x35bc500], 1
lea eax, [eax]
lds ebx, [ebx + 3]
std
stosd dword es:[edi], eax
mov eax, dword [0xda66326d]
aad 0xf7
pop edi
lds ecx, [0xc4e63c06]
neg byte [ecx]
and eax, 0x90ba6db6
fst dword [eax]
salc
xor dword [ebp + 0x13], edx
or dword [eax], ebx
sal dword [ebx], 1
adc dword [edx - 0x547f2f79], 0xffffffc0
mov ebx, 0x783ad331
cmpsd dword [esi], dword es:[edi]
sbb dh, byte [esi + 0x3b4315d2]
ja 0x4aa060
popfd
invalid

Function at 0x4aa268
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x84
adc ah, dl
lodsd eax, dword [esi]
mov al, 0xef
lodsb al, byte [esi]
mov al, bl
cmpsb byte [esi], byte es:[edi]
xor bl, al
and edx, dword [eax]
imul esi, dword [esi + 0x619851a1], 0xffffffcd
clc
add al, 0x42
dec ebx
and eax, 0xea8335ee
or byte [edx - 0x28], dh
jb 0x4aa272
stosd dword es:[edi], eax
das
pop eax
cwde
jbe 0x4aa2f8
pop ecx
invalid
xchg edx, eax
jl 0x4aa335
sub al, byte [ecx + 0xb4be825]
cwde
rol byte [ecx - 0x5fdd3f90], 0x31
xor dword [eax + 0x64], ebp
cld
cmpsd dword [esi], dword es:[edi]
loop 0x4aa388
imul edi, dword [esi - 0x56], 0x48baa238
scasb al, byte es:[edi]
push cs
push edi
fstp dword [eax + 2]
loope 0x4aa30e
scasb al, byte es:[edi]
mov dl, 0xa5
std
in eax, dx
add byte [ecx - 0x10], dh
mov ecx, 0x94406208
xor al, 0xcc
lodsb al, byte [si]
imul byte [eax + 0x6a]
mov ebx, 0x3e238eb0
add dh, byte [eax - 0x5ebe5deb]
salc
ret 0x482f
cmc
add byte [edx], ch
add esi, ecx
aad 0xbb
push ds
pop edx
Function at 0x4170ce
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x10], al
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov edx, dword [ebp + 8]
mov dword [esp], edx
mov ecx, eax
call fcn.00426f44
sub esp, 0xc
mov eax, dword [ebp - 0xc]
movzx edx, byte [ebp - 0x10]
mov byte [eax + 0xc], dl
mov dword [esp], str.ECSIMPORT
call sub.msvcrt.dll_getenv
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
add eax, 0x14
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov dword [esp + 4], 0
mov dword [esp], edx
mov ecx, eax
call fcn.00411072
sub esp, 8
mov eax, dword [ebp - 0xc]
add eax, 0x1c
mov dword [esp], 1
mov ecx, eax
call fcn.00414d78
sub esp, 4
mov eax, dword [ebp - 0xc]
add eax, 0x20
mov ecx, eax
call fcn.004faa9c
mov eax, dword [ebp - 0xc]
add eax, 0x2c
mov ecx, eax
call fcn.004fb2d8
nop
leave
ret 0x10

Function at 0x43e580
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.0044d350
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.0044d350
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]