joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c7559
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esi*4]
pop dword [esp + 1]
rdtsc
add esp, 0xb
jmp 0x101c7540
mov ch, 7
rdtsc
neg dx
bswap ecx
shr eax, 2
inc ax
jmp 0x101c751a
rdtsc
xchg word [esp + 0x11], cx
neg cx
lea edx, [esi + esi]
lea eax, reloc.KERNEL32.dll_GetCurrentProcess
jmp 0x101c7593
std
xchg ah, ch
lea edx, [eax + ebx]
jmp 0x101c7530
xchg word [esp + 1], ax
push dword [esp + 2]
push word [esp + 6]
push dword [esp + 6]
call fcn.101c7577
bswap edx
add ecx, esp
lea esp, [esp + 0x1a]
mov ax, word [esp + 5]
std
call fcn.101c75e3
lodsb al, byte [esi]
mov edi, 0x47eeb886
jg 0x101c759d
pop word [esp + 1]
lea edx, reloc.KERNEL32.dll_GetCurrentProcess
jmp 0x101c75a6
Function at 0x101cf069
Capabilities:
Parse pe header

Disassembly:
mov dword [esp], ecx
push cx
lea esp, [esp + 2]
push edx
push ebp
push word [esp + 1]
jmp 0x101cf081
jmp 0x101cf053
lea esp, [esp]
push dword [esp + 1]
lea esp, [esp + 6]
push word [esp]
jmp 0x101cf108
push si
lea esp, [esp + 1]
mov dword [esp], ebx
lea esp, [esp + 3]
mov dword [esp], ebx
push eax
jmp 0x101cf06b
mov dword [esp], esp
call fcn.101cf0c4

Function at 0x101cf0ae
Capabilities:
Parse pe header

Disassembly:
call fcn.101c6c3d
jmp 0x101cf0ef
mov dword [esp + 4], esi
pushal
mov byte [esp + 2], al
pushfd
lea esp, [esp + 0x1b]
jmp 0x101cf126
push word [esp + 1]
push dword [esp + 4]
mov word [esp + 2], ax
lea esp, [esp + 2]
jmp 0x101cf0d9
mov eax, dword [eax + 0xc]
jmp 0x101cf13a
lea esp, [esp + 1]
mov dword [esp + 8], edi
lea esp, [esp + 8]
mov eax, dword fs:[0x30]
jmp 0x101cf110
mov eax, dword [eax + 0x1c]
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0x101cf148
push eax
jmp 0x101c6c38

Function at 0x101cf0c4
Capabilities:
Parse pe header

Disassembly:
pop word [esp]
mov word [esp], ax
mov byte [esp], dh
lea esp, [esp + 2]
push ebp
call fcn.101cf0ae
Function at 0x407f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x6000]
push edi
or ebp, 0xffffffff
jmp 0x407fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x407fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x407f98
mov eax, 1
add ebx, ebx
jne 0x407fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x407fb0
jne 0x407fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407fb0
xor ecx, ecx
sub eax, 3
jb 0x407fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x408052
mov ebp, eax
add ebx, ebx
jne 0x407feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x407ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40801c
inc ecx
add ebx, ebx
jne 0x408008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x407ffd
jne 0x408019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x407ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40803c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40802d
jmp 0x407f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40803c
add edi, ecx
jmp 0x407f9e
pop esi
mov edi, esi
mov ecx, 0x8f
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40805a
cmp byte [edi], 0
jne 0x40805a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40805f
lea edi, [esi + 0x5000]
mov eax, dword [edi]
or eax, eax
je 0x4080d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8d64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8ddc]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40808c
mov ecx, edi
jns 0x4080bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8de4]
or eax, eax
je 0x4080d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4080a9
call dword [esi + 0x8de0]
mov ebp, dword [esi + 0x8de8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40810b
sub esp, 0xffffff80
jmp 0x402130

Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x4033a6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x100000
push dword [ebp + 8]
push eax
push dword [ebp + 0x10]
call fcn.004030c4
add esp, 0x10
test eax, eax
je 0x4033e6
push 0x10
push 0x49e8b4
push str.Installer_Corrupted._nPlease_re_download_this_file_nfrom_www.winamp.com
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 4]
leave
ret

Function at 0x4033eb
Capabilities:
Delete file
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push dword [eax]
lea eax, [ebp - 0x108]
push dword [ebp + 8]
push 0x49ea08
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80000080
push 2
push 0
mov ebx, 0x40000000
push 1
lea eax, [ebp - 0x108]
push ebx
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x4034c9
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x60c]
push str.Couldnt_open_the_file:_n_t__s__nfor_writing._If_Winamp_is_currently_running__nbe_sure_to_close_it._n_nHit__abort__to_cancel_installation___retry__to__ntry_writing_this_file_again__or__ignore__to_skip_this_file.
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x60c]
push 0x32
push str.Error_Installing_Winamp
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub eax, 3
je 0x4034ab
dec eax
jne 0x40353b
lea eax, [ebp - 0x108]
push eax
call esi
push 0
push 0x80000080
push 2
push 0
push 1
lea eax, [ebp - 0x108]
push ebx
push eax
jmp 0x403443
push 0x30
push str.Winamp_Installer
push str.Installation_aborted_n_n_Installation_failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x100000
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, dword [ebp + 0xc]
mov edi, eax
push dword [esi + 4]
lea ebx, [esi + 0xc]
push ebx
call fcn.00403ba4
cmp eax, dword [esi + 8]
pop ecx
pop ecx
je 0x40350a
push 0x10
push 0x49e8b4
push str.Failed_CRC_check_on_file._nPlease_re_download_this_installer_nfrom_www.winamp.com_n_n_Installation_failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edi
push dword [esi + 4]
push ebx
call fcn.004033a6
add esp, 0xc
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
push 0
push ecx
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40367b
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x104]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x104]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
lea eax, [ebp - 0x104]
pop esi
lea edx, [ebp + ecx - 0x104]
cmp edx, eax
jb 0x4036dd
cmp byte [edx], 0x5c
je 0x4036dd
dec edx
lea eax, [ebp - 0x104]
jmp 0x4036cb
cmp byte [ebp - 0x103], 0x3a
lea eax, [ebp - 0x104]
jne 0x4036f4
lea eax, [ebp - 0x100]
jmp 0x403738
cmp byte [ebp - 0x104], 0x5c
jne 0x403738
cmp byte [ebp - 0x103], 0x5c
jne 0x403738
mov cl, byte [ebp - 0x102]
lea eax, [ebp - 0x102]
test cl, cl
je 0x403721
cmp cl, 0x5c
je 0x403721
mov cl, byte [eax + 1]
inc eax
jmp 0x403712
cmp byte [eax], 0
je 0x403727
inc eax
mov cl, byte [eax]
test cl, cl
je 0x403732
cmp cl, 0x5c
jne 0x403726
cmp byte [eax], 0
je 0x403738
inc eax
cmp edx, eax
jb 0x40374c
and byte [edx], 0
lea eax, [ebp - 0x104]
push eax
call fcn.0040367b
pop ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret

Function at 0x403ba4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [esp + 8]
push esi
mov ecx, eax
dec eax
test ecx, ecx
mov esi, 0xdeadbeef
je 0x403bdf
mov edx, dword [esp + 8]
push ebx
push edi
lea edi, [eax + 1]
mov ecx, 0xff
mov al, byte [edx]
mov ebx, esi
and eax, ecx
and ebx, ecx
xor eax, ebx
shr esi, 8
mov eax, dword [eax*4 + 0x49ecd0]
xor esi, eax
inc edx
dec edi
jne 0x403bc3
pop edi
pop ebx
mov eax, esi
pop esi
ret
Function at 0x535060
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0xde1000
lea edi, [esi - 0xe0000]
push edi
jmp 0x53507a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x535081
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x535070
mov eax, 1
add ebx, ebx
jne 0x535093
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5350a4
jne 0x5350c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5350c3
dec eax
add ebx, ebx
jne 0x5350b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x535088
add ebx, ebx
jne 0x5350bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x535115
xor ecx, ecx
sub eax, 3
jb 0x5350db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53514a
sar eax, 1
mov ebp, eax
jmp 0x5350e6
add ebx, ebx
jne 0x5350e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5350b4
inc ecx
add ebx, ebx
jne 0x5350f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5350b4
add ebx, ebx
jne 0x535101
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5350f6
jne 0x535112
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5350f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x535134
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x535126
jmp 0x535076
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x535134
add edi, ecx
jmp 0x535076
pop esi
mov edi, esi
mov ecx, 0x3eef
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x535152
cmp byte [edi], 0x11
jne 0x535152
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x535157
lea edi, [esi + 0x12e000]
mov eax, dword [edi]
or eax, eax
je 0x5351cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19277c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1928f8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x535184
mov ecx, edi
jns 0x5351b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1928fc]
or eax, eax
je 0x5351c9
mov dword [ebx], eax
add ebx, 4
jmp 0x5351a1
call dword [esi + 0x19290c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x535200
cmp al, 0xef
ja 0x5351f3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5351d5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5351e2
mov ebp, dword [esi + 0x192900]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x535234
sub esp, 0xffffff80
jmp 0x426bf7
Function at 0x431003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x40915c
nop
mov ecx, 0x3bbc62c1
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x7ef94c76
nop
nop
nop
test eax, eax
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x417a10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baa90]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
and al, 0xc
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff

Function at 0x417a3a
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x50
test eax, eax
push esi
je 0x417a36
mov eax, dword [0x4baa90]
test eax, eax
je 0x417a2c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x50
ret
push ebx
push edi
lea eax, [esp + 0xc]
and al, 0xc
push 0x50
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x4ba070
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0xd]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
Function at 0x42218d
Capabilities:
Encode data using xor

Disassembly:
adc bh, al
or eax, 0x9d290ee4
in al, dx
mov bl, 0x43
adc byte [eax - 0x50ecd27d], bl
sub eax, 0x6e65de3d
Function at 0x452323
Capabilities:
Encode data using xor

Disassembly:
lahf
xchg esi, eax
sub eax, 0xa7e3a6c8
sbb ch, dl
cdq
das
cmp esp, eax
div dword [edi + 0x4c]
jne 0x45235f
stosb byte es:[edi], al
mov esp, 0x309c5935
adc esi, 0xffffffab
mov edx, 0xddd9ddf3
inc ecx
sbb byte [edi - 0x471d49c8], ah
cmp byte [esi - 0x68f1471e], dh
sub byte [ecx + 0x77231304], ch
xor ch, ah
inc edi
loop 0x452336
adc bh, bh
ljmp 0x7685
jbe 0x45236c
in al, dx
in al, 0xff
popal
aad 0xc1
inc dword [ecx]
xchg edx, eax
js 0x4523d9
or eax, 0xb4a90274
not byte [ecx + 0x62ea6478]
cmc
mov eax, 0x762a4414
sub dword [edi - 0x52], esp
xor dword [edi - 0x1c], ebp
mov edi, 0x90ab0618
sbb al, 0xa0
out dx, al
popfd
fistp word [eax + 0x6538c6e9]
invalid
rcr cl, 0x9d
inc esi
sbb dword [ecx], 0xafe70079
or al, 0xdf
retf

Function at 0x454375
Capabilities:
Encode data using xor

Disassembly:
add dword [bx + di], 0x17cf4cf1
pop esp
jmp 0xbf9baa3d
or edx, esp
or al, 0xe
sahf
mov ah, 0xc0
das
mov eax, 0x644fe56e
imul ebx, dword [edi + 0x698cd7b8], 0xeaf4d9a4
or dword [edx - 0x4d], esi
inc eax
pop ss
fstp qword [eax + 0x31244574]
jl 0x45432d
pushfd
add bh, ah
sub byte [esp + ebp*4 - 0x4a101493], bl
lodsb al, byte [esi]
insd dword es:[edi], dx
jmp 0x454368
mov ch, 0x78
invalid
aam 0xf9
jno 0x4543e0
out dx, al
sub dword [ebx], 0x7f
xor al, 0x1f
or byte [ebx], 0x8f
add al, 0x63
push ds
xor dword [ebp + 0x41f4dc69], ebp
add dl, dl
int 0x35
mov byte [eax + 0x282afcbd], dl
add al, 0xdf
sub byte [edi + ebx*8], al
and al, 0x3f
xor al, 0x46
stosb byte es:[edi], al
jb 0x4543cf
mov cl, 0xb6
mov eax, dword [0xaaea9d7b]
invalid
Function at 0x472114
Capabilities:
Encode data using xor

Disassembly:
mov bh, 0x3c
and eax, 0xb4c22238
jo 0x47216a
jo 0x4720f1
pop ss
xlatb
cld
lahf
adc al, 0
stosd dword es:[edi], eax
mov eax, 0x357b52db
dec edx
fidivr dword [eax]
test eax, 0x61eec9a2
inc esp
xor eax, 0xa938da4a
mov byte [0x4461eec9], al
imul ebx, dword [ecx], 0x1ba32e70
sub ebp, dword [edi - 6]
and dword [ebp - 5], ecx
pushfd
sub ebp, edi
and eax, 0x8e2e1230
je 0x47212a
ror dword [edx], cl
imul esp, dword [0x770fdc4a], 0xffffffb2
or dword [ecx - 0x50], esp
cwde
popal
mov al, 0x98
rcl dword [ebx - 0x2f]
fadd qword [esi + 0x16]
sub byte [edi - 0x37], cl
out dx, eax
and dword [esi - 0x53abc2c7], ebp
dec edx
add ecx, dword [edx + 8]
jmp 0x4721a9
or bl, ch
cmp al, 0xea
and byte [ecx], dh
into
mov dh, 0x93
lds edx, [esi]
fcom qword [edx - 0x53]
or edx, eax
je 0x47217f
sub al, 0xd0
loop 0x4721d4
stc
ret
aas
imul ebp, dword [eax], 0xffffffe7
jge 0x472154
cmp al, 0xd6
and ah, byte [ebx + edi*2]
in eax, dx
dec esp
int3
shl edx, cl
insb byte es:[edi], dx
mov eax, dword [0x8c1a0819]
xor dword [ecx + 0x62], eax
add edx, eax
shr ch, 1
Function at 0x48c831
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0048ca24
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00497579
xor ebx, ebx
cmp eax, ebx
jne 0x48c9df
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0048ca24
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00494258
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4e5b4d
add esp, 0x10
test eax, eax
jne 0x48c8fa
push esi
call int.00489ee3
mov esi, eax
cmp esi, ebx
pop ecx
je 0x48c8fa
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x48c8e5
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x48c8fa
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c8f3
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.00498a8c
cmp byte [esp + 0x13], bl
je 0x48c92a
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0048ca61
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x48c99a
push 0x14
call 0x4e4dba
cmp eax, ebx
pop ecx
je 0x48c954
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x48c956
xor edi, edi
cmp edi, ebx
je 0x48c99a
push esi
push edi
call fcn.0048bf87
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0048c04f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c178
add esp, 0x18
call fcn.0048ca24
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.00496c46
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x48c9b1
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x48c9c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x48ca06
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x48ca06
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0048c04f
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0048c178
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10001270
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
movzx edx, ax
sub ax, 0x400
cmp ax, 0xf
jbe 0x100012c0
mov dword [esp], edx
movzx ebx, bx
call sym._DosFileHandleToWin32Handle_4
mov ecx, dword [ebp + 0xc]
sub esp, 4
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll__lread]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 0xc
mov eax, dword [ebp + 0xc]
movzx ebx, bx
mov dword [esp], edx
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
call dword [sym.imp.lz32.dll_LZRead]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 0xc

Function at 0x10001350
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov esi, dword [ebp + 8]
movzx edx, word [ebp + 0xc]
lea eax, [esi - 0x400]
movzx edi, si
cmp ax, 0xf
jbe 0x100013d8
mov dword [esp], edi
mov dword [ebp - 0x10], edx
call sym._DosFileHandleToWin32Handle_4
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.lz32.dll_LZInit]
mov edx, dword [ebp - 0x10]
mov ebx, eax
lea eax, [eax - 0x400]
sub esp, 4
cmp eax, 0xf
jbe 0x10001415
test ebx, ebx
jle 0x10001400
test si, si
jle 0x10001450
mov dword [esp], edx
call sym._DosFileHandleToWin32Handle_4
sub esp, 4
mov ebx, eax
mov dword [esp], edi
call sym._DosFileHandleToWin32Handle_4
mov dword [ebp + 0xc], ebx
mov dword [ebp + 8], eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.lz32.dll_LZCopy]
mov dword [esp], edx
call sym._DosFileHandleToWin32Handle_4
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
jmp dword [sym.imp.lz32.dll_LZCopy]
test bx, bx
jle 0x10001450
movzx edi, bx
sub bx, 0x400
cmp bx, 0xf
ja 0x100013a6
mov ebx, edi
mov dword [esp], edx
call sym._DosFileHandleToWin32Handle_4
sub esp, 4
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.lz32.dll_LZCopy]
sub esp, 8
mov dword [ebp - 0x10], eax
mov dword [esp], ebx
call dword [sym.imp.lz32.dll_LZClose]
mov eax, dword [ebp - 0x10]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x100014f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x18
movzx esi, word [ebp + 0xc]
movzx ebx, word [ebp + 8]
test byte [0x100022c0], 8
jne 0x10001520
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
add esp, 0x18
pop ebx
pop esi
pop ebp
jmp dbg.LZCopy16@8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], str.__d__d__n
mov dword [esp + 8], global___func__
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x10001509