joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c43d
Capabilities:
Encode data using xor

Disassembly:
lds esi, [eax]
push 0x7b
sub byte [esi - 0x34], 0x79
mov edx, 0xa124067c
sub eax, 0x1d4af6a8
aas
xchg byte [eax + 0x55], ch
sub byte [edx - 0x98bebb4], bh
inc eax
inc esp
insd dword es:[edi], dx
adc dword [edi], ebx
imul bh
inc ebx
aad 0xfd
faddp st(2)
out 0x91, eax
stosd dword es:[edi], eax
or eax, 0x99a159ae
wait
invalid
xor dword [ebp - 0x39afed47], edx
pop ebp
jo 0x40c3e4
test al, 0x43
jmp 0x40c396
adc eax, 0x67c77c5
movsd dword es:[edi], dword [esi]
sbb dword [ebp + 7], 0xffffffb3
xchg dword [ecx - 1], ecx
movsd dword es:[edi], dword [esi]
jae 0x40c3e4
ret 0x3680
jl 0x40c45d
inc esi
adc dword [edi], ebx
sub cl, dl
cmp eax, 0x9014f427
les ecx, [ecx]
push ebp
jne 0x40c3ff
invalid
push cs
test dword [esi + 0x4641d443], 0x72b3c722
and esi, dword [esi]
sbb byte [eax + 0x29], 0x9d
xor edx, dword [esi]
xor dword [ecx - 0x30e17116], ecx
in al, dx
pushfd
pop edi
fisubr dword [0x41aeb5f6]
retf
Function at 0x431a3d
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.00431c30
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.0043c785
xor ebx, ebx
cmp eax, ebx
jne 0x431beb
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.00431c30
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00439464
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.0048ad59
add esp, 0x10
test eax, eax
jne 0x431b06
push esi
call fcn.0042f0ef
mov esi, eax
cmp esi, ebx
pop ecx
je 0x431b06
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x431af1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x431b06
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431aff
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.0043dc98
cmp byte [esp + 0x13], bl
je 0x431b36
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.00431c6d
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x431ba6
push 0x14
call fcn.00489fc6
cmp eax, ebx
pop ecx
je 0x431b60
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x431b62
xor edi, edi
cmp edi, ebx
je 0x431ba6
push esi
push edi
call fcn.00431193
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0043125b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00431384
add esp, 0x18
call fcn.00431c30
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.0043be52
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x431bbd
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x431bcf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x431c12
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x431c12
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0043125b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.00431384
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43c296
Capabilities:
Encode data using xor

Disassembly:
xor eax, ebx
fcomp qword es:[ebx + ecx*2 + 0x3a5d7a07]
pop ebp
cmp dl, dh
pop ebp
cmp dl, dh
add ebx, edi
sbb eax, 0x51f9f134
sbb al, al
wait
inc edi
stosb byte es:[edi], al
cmp cl, byte [ebx + 0x63de35da]
xchg eax, ecx
mov esi, es
ja 0x43c28e
inc ecx
and al, 0xc4
xlatb
inc edi
outsd dx, dword [esi]
mov dh, byte [edi + 0x4e6fdd9d]
xchg edx, eax
xchg ebx, eax
mov byte [0x7d07bb7f], al
jno 0x43c2be
daa
jle 0x43c313
cwde
cli
push 0xcfd2abc1
in al, dx
invalid
dec ebx
iretd
sti
in eax, dx
push edx
out dx, eax
jl 0x43c2f8
lodsb al, byte [esi]
adc edx, dword [ebx + 0x4d]
ror dword [ebx + ebp*2], 1
mov dh, 0x2d
push ebx
pop ds
stosb byte es:[edi], al
js 0x43c37e
ja 0x43c2cb
mul ah
adc al, byte [ebx + 0x1b]
in eax, dx
mov ch, 0x52
clc
invalid
and dword [esi - 0x4d8f0186], 0xc7db3f3d
dec esp
stosb byte es:[edi], al
push ecx
add esp, dword [ebx + 0x37df8960]
pushal
ret
Function at 0x45b1cc
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xc0e2e29f
xor eax, dword [esi - 0x59e37cb5]
stc
jl 0x45b222
insb byte es:[edi], dx
mov edi, 0x3d9a7b80
pop edx
in al, dx
add byte [edi + 0x76877e59], ch
retf
shl dword cs:[ecx], 0xd7
not dword [edi]
inc esi
aam 0x8d
aaa
cld
nop
inc edi
jmp 0x45b2a3
invalid
and al, byte [edx]
cld
out dx, eax
fmul dword [esi]
test byte [edi + 0x11feac1c], ch
push ds
fsubr qword [edx - 0x7b2c4fd3]
xlatb
xor eax, 0x664d7784
rol byte [edx - 0x1b], 1
invalid
popal
pop ds
or eax, 0x40268bf
jecxz 0x45b274
pushfd
jae 0x45b2c3
inc ebp
dec eax
cdq
pop ebp
adc eax, 0x1638bf18
and dword [ebp - 0x893f561], ebp
loopne 0x45b281
mov ch, 0x5b
lodsb al, byte [esi]
sti
out dx, eax
pop esp
mov eax, dword [0xa0a33dc2]
daa
or byte [ecx + ebp], 0xe6
sbb eax, dword [esi - 0x889dbb5]
scasb al, byte es:[edi]
cmc
xor cl, byte [esi - 0x19]
and eax, dword [ecx + 0x67]
xor bl, byte [eax]
push 0x947e7cca
add ch, 0x28
add byte [eax + ebx*8 + 0x65], dh
rcr dword [eax], cl
sub ch, bh
dec byte [edx]
xor ch, byte [edx + 0xc]
fistp qword [ecx]
pushfd
or byte [esi - 0x603dcb7c], al
test al, 0xa
mov bh, 0xc
in eax, dx
out dx, eax
mov ecx, esi
jecxz 0x45b336
pop ecx
sahf
not dword [ebx + 0x17636b44]
cmpsd dword [esi], dword es:[edi]
cmp dword [edi + 0x16], 0xffffffd3
sbb ebp, esp
invalid
dec dword [edi + ebx - 0xb]
dec ebp
pop ebx
fcomp qword [0x25580972]
lodsb al, byte [esi]
sbb eax, 0xe8da34a1
sub bh, byte [ecx - 0x6caa7558]
mov byte [0xdac3dbf3], al
mov bh, 0x7f
in eax, 0xb6
out dx, al
wait
dec ecx
xor ah, ah
sub dword [edi - 0x476dbd62], edi
push 0xaa329dee
mov edi, gs
lcall 0x9535, 0x442f5634
fsubr qword ds:[edi - 0x2a]
add cl, 0x60
jmp 0x45b3d4
sub eax, 0x2c005414
lea edi, [eax + 0x45fa664b]
add byte [ecx*4 - 0x599b448], ch
inc ebp
je 0x45b3d7
bound ebp, qword [esp + esi + 0x1ead5de3]
invalid
Function at 0x45eedd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.0045f0d0
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.00469c25
xor ebx, ebx
cmp eax, ebx
jne 0x45f08b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.0045f0d0
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.00466904
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call fcn.004b81f9
add esp, 0x10
test eax, eax
jne 0x45efa6
push esi
call fcn.0045c58f
mov esi, eax
cmp esi, ebx
pop ecx
je 0x45efa6
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x45ef91
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x45efa6
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45ef9f
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call int.0046b138
cmp byte [esp + 0x13], bl
je 0x45efd6
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.0045f10d
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x45f046
push 0x14
call fcn.004b7466
cmp eax, ebx
pop ecx
je 0x45f000
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x45f002
xor edi, edi
cmp edi, ebx
je 0x45f046
push esi
push edi
call fcn.0045e633
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.0045e6fb
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e824
add esp, 0x18
call fcn.0045f0d0
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004692f2
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x45f05d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x45f06f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x45f0b2
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x45f0b2
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.0045e6fb
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.0045e824
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466533
Capabilities:
Encode data using xor

Disassembly:
ror dword [edi], 1
xor al, 0x72
push eax
leave
je 0x46652d
daa
loopne 0x46656a
fidivr dword [esi - 0x24]
dec edi
sub byte [ecx + 0x3a648ac8], cl
cmp al, 0xd1
inc ebp
add esp, 0xacbaa503
movsd dword es:[edi], dword [esi]
aaa
adc eax, edi
cld
sbb eax, 0x14c91471
popfd
inc ebp
in eax, 0x11
das
pop esp
push 0xffffffffffffffbf
and ecx, dword [ebp + 0x31da0f13]
fdiv qword [esi - 0x3784799d]
js 0x4665db
mov ebx, 0x248ff292
push cs
nop
dec edx
ljmp 0xa592
invalid
xchg edx, eax
movsd dword es:[edi], dword [esi]
ljmp 0x636e:0xc96b

Function at 0x467c80
Capabilities:
Check for vm using instruction vpcext

Disassembly:
invalid
lodsb al, byte [esi]
imul esi, dword [0x4885458e], 0xffffff9c
add eax, 0x93c71f6b
push ecx
dec ebx
jp 0x467c19
mov cl, 0x1a
sahf
or byte [ebx + edi - 0x6956266f], 0xe7
or eax, 0xef68df3c
sbb bl, byte [esi - 0x6ec4737e]
fldcw word [ecx + 0x3c0de796]
fild qword [eax - 0x11]
xchg edx, eax
cmp cl, byte [ecx + 0x69]
out dx, eax
cmp al, ah
sub eax, 0xb52ed8b
mov ebp, 0x6415bb66
jp 0x467c92
mov dl, byte ss:[edi + 0x79]
sbb dword [ecx + 0x7f], ebp
push 0xb52e1ca3
invalid

Function at 0x472a92
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
rol byte [ebx - 0x327685f4], 1
mov dh, 0x99
adc eax, 0x136b3983
push ds
idiv ecx
nop
invalid
Function at 0x482121
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cld
stc
fld xword [ebp + 0x41]
adc bl, byte [esi - 0x5c7a77f7]
ror byte [ebp + 0x749e3ac4], cl
les edi, [edx]
sahf
je 0x482112
les edi, [edx]
sahf
je 0x482112
test al, 0xcb
lodsd eax, dword fs:[esi]
aam 0xcc
xchg ebx, eax
inc ecx
jno 0x482181
jnp 0x48212a
adc eax, 0x3628d9d
mov byte [0x904ec4d], al
in al, dx
add al, 9
fsub st(4), st(0)
arpl word [edx + 0x21e73848], ax
or dword [ebp + ebp*2 - 0x23], eax
jle 0x482193
mov ah, 0x78
fild dword [ebx - 0x78]
mov word [ecx - 0x3f], cs
dec esp
bound edi, qword [esi + 0xdabdc21]
xchg ebp, eax
mov eax, dword ds:[0x9714d5c0]
popfd
jno 0x482176
push esp
movsb byte es:[edi], byte [esi]
mov ebp, dword [0xd1fa24ea]
invalid
loopne 0x482113
invalid
test byte [0x78ce7121], 0xa8
je 0x4821f6
test al, 0x74
insb byte es:[edi], dx
lock and ebp, dword [0x6a82de3c]
mov ecx, edi
sbb edx, esi
xor bl, byte [ebx]
out dx, eax
int1
inc esp
inc ebx
dec eax
sub ch, byte [ebx]
and ch, byte [edi]
repe scasb al, byte es:[edi]
jecxz 0x482187
iretd
cmp ch, 0x59
mov cl, 0x14
insd dword es:[edi], dx
arpl word [eax], di
sub dh, cl
lahf
iretd
push 0xffffffffffffffd5
jne 0x4821fb
jne 0x482240
inc esp
retf
movsb byte es:[edi], byte [esi]
add eax, 0xdff4836e
mov ah, 0xac
int 0x65
sub bl, dl
push ebx
mov bh, 0xa4
ret

Function at 0x482139
Capabilities:
Check for vm using instruction vpcext

Disassembly:
cld
stc
fld xword [ebp + 0x41]
adc bl, byte [esi - 0x5c7a77f7]
ror byte [ebp + 0x749e3ac4], cl
les edi, [edx]
sahf
je 0x482112
les edi, [edx]
sahf
je 0x482112
test al, 0xcb
lodsd eax, dword fs:[esi]
aam 0xcc
xchg ebx, eax
inc ecx
jno 0x482181
jnp 0x48212a
adc eax, 0x3628d9d
mov byte [0x904ec4d], al
in al, dx
add al, 9
fsub st(4), st(0)
arpl word [edx + 0x21e73848], ax
or dword [ebp + ebp*2 - 0x23], eax
jle 0x482193
mov ah, 0x78
fild dword [ebx - 0x78]
mov word [ecx - 0x3f], cs
dec esp
bound edi, qword [esi + 0xdabdc21]
xchg ebp, eax
mov eax, dword ds:[0x9714d5c0]
popfd
jno 0x482176
push esp
movsb byte es:[edi], byte [esi]
mov ebp, dword [0xd1fa24ea]
invalid
loopne 0x482113
invalid
test byte [0x78ce7121], 0xa8
je 0x4821f6
test al, 0x74
insb byte es:[edi], dx
lock and ebp, dword [0x6a82de3c]
mov ecx, edi
sbb edx, esi
xor bl, byte [ebx]
out dx, eax
int1
inc esp
inc ebx
dec eax
sub ch, byte [ebx]
and ch, byte [edi]
repe scasb al, byte es:[edi]
jecxz 0x482187
iretd
cmp ch, 0x59
mov cl, 0x14
insd dword es:[edi], dx
arpl word [eax], di
sub dh, cl
lahf
iretd
push 0xffffffffffffffd5
jne 0x4821fb
jne 0x482240
inc esp
retf
movsb byte es:[edi], byte [esi]
add eax, 0xdff4836e
mov ah, 0xac
int 0x65
sub bl, dl
push ebx
mov bh, 0xa4
ret
Function at 0x4972b4
Capabilities:
Encode data using xor

Disassembly:
sub al, 0x38
je fcn.004972b4
insb byte es:[edi], dx
cwde
out 0x48, al
pop esp
jg 0x497286
mov byte [0x1169c618], bl
jb 0x4972c8
invalid
mov eax, dword [0xe1b2c2c6]
mov byte [eax], ah
xor al, 0x5e
dec edx
pushal
jne 0x4972ba
sbb dword [edi - 0x18], 0xffffffb7
sal byte [ebx + 0x1753a16a], 0x48
pop es
lahf
sub dword [edi - 0x6a089ead], esp
or al, 0xc8
mov dword [edi + 0x24], 0xca03a11a
invalid
Function at 0x4a3cfd
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4933c6
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4bf2d8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
call fcn.004a3ef0
mov esi, dword [ebp + 8]
mov ecx, eax
lea eax, [esp + 0x14]
push eax
add ecx, 8
lea edi, [esp + 0x1c]
lea eax, [esp + 0x20]
call fcn.004aea45
xor ebx, ebx
cmp eax, ebx
jne 0x4a3eab
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push dword [ebp + 0xc]
mov dword [esp + 0x3c], ebx
call fcn.004a3ef0
mov ecx, eax
lea eax, [esp + 0x18]
add ecx, 0x38
push eax
call fcn.004ab724
mov byte [esp + 0x40], 1
mov esi, dword [eax]
push ebx
push esi
xor edi, edi
call 0x4fd019
add esp, 0x10
test eax, eax
jne 0x4a3dc6
push esi
call fcn.004a13af
mov esi, eax
cmp esi, ebx
pop ecx
je 0x4a3dc6
mov eax, dword [esi + 8]
cmp eax, ebx
mov dword [esi + 8], ebx
je 0x4a3db1
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4a3dc6
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a3dbf
mov eax, dword [ecx]
push 1
call dword [eax]
xor edi, edi
mov dword [esp + 0x28], esi
inc edi
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x14]
cmp edi, ebx
sete byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.004aff58
cmp byte [esp + 0x13], bl
je 0x4a3df6
push dword [ebp + 0x14]
lea eax, [esp + 0x24]
push eax
push dword [ebp + 8]
call fcn.004a3f2d
add esp, 0xc
mov esi, dword [esp + 0x28]
cmp esi, ebx
je 0x4a3e66
push 0x14
call 0x4fc286
cmp eax, ebx
pop ecx
je 0x4a3e20
mov dword [eax + 4], ebx
mov dword [eax], 0x4a2934
mov dword [eax + 0x10], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov edi, eax
jmp 0x4a3e22
xor edi, edi
cmp edi, ebx
je 0x4a3e66
push esi
push edi
call fcn.004a3453
mov eax, dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
push eax
call fcn.004a351b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a3644
add esp, 0x18
call fcn.004a3ef0
mov ebx, eax
mov eax, dword [ebp + 8]
add ebx, 8
call fcn.004ae112
mov dword [eax], edi
xor ebx, ebx
or dword [esp + 0x38], 0xffffffff
mov ecx, dword [esp + 0x28]
cmp ecx, ebx
je 0x4a3e7d
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x4a3e8f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x20], ebx
je 0x4a3ed2
push dword [esp + 0x20]
call dword [fcn.00497258]
push dword [esp + 0x20]
call dword [fcn.00497250]
jmp 0x4a3ed2
mov edi, dword [eax + 4]
push dword [edi + 0xc]
mov ebx, dword [edi + 8]
mov esi, dword [ebp + 0x10]
call fcn.004a351b
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push eax
push ecx
push edi
push eax
push ecx
push esi
call fcn.004a3644
add esp, 0x18
xor ebx, ebx
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b6990
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
xchg ebp, eax
xor byte [esi + 0x492145f9], 0x2a
inc ebp
and dword [ecx + 0x2a], ecx
pop eax
sub al, 0xa7
xchg eax, ebx
xchg ecx, eax
dec eax
mov esi, 0x8b5ec897
in al, dx
loope 0x4b69f7
push 0xffffffffffffffe9
dec esp
std
xchg edi, eax
sub ah, byte [esi - 0xc66af74]
sar edi, 1
xor bh, bl
push 0xffffffffffffffb5
stc
pop ecx
xor ah, dl
int 2
adc esi, ebp
cmpsd dword [esi], dword es:[edi]
invalid
les edi, [ebp + 0x34bc44a3]
mov ebx, 0xaa63ce65
rcl edx, 1
mov al, 4
out dx, eax
cmp bl, byte [ecx - 0x4f44d03]
push edx
cmp eax, 0x52a521a8
sti
mov dh, 0x64
arpl di, bp
fnstenv [esi]
mov bl, 0x34
loope 0x4b6a7b
bound ecx, qword [ecx]
adc dword [edx + 0x521f2677], esi
jecxz 0x4b6a74
and byte [edx], bh
invalid
cmp dword [ebp + 0x219afc93], ebx
jecxz 0x4b6a84
cmc
mov ch, 0x86
adc esp, dword [edi]
outsd dx, dword [esi]
aam 0xdf
dec ecx
mov esp, 0x812ccaed
sub al, 0x81
xchg ah, ah
jns 0x4b6acb
invalid
xor eax, 0x78c8d4f9
sub esi, esp
bound ebx, qword [edi - 0x5f86b078]
or al, 0x94
fisttp qword [edi]
push ebx
bound esp, qword [edi]
rol dword [ebx + 0x28b3a66b], 1
mov esp, 0xc877f039
or ebx, dword [eax]
jl 0x4b6a48
sub byte [ecx + edi + 0xbc877f0], bh
sbb byte [ebx + eax*8 + 0x68], bh
cmc
test dword [ebx + 0x4cc1080], 0xef722247
ret
push 0x808bf7f5
adc ah, cl
add al, 0x47
and dh, byte [edx - 0x11]
imul esi, dword [ecx + ebp*2 + 0x24c0026a], 0xb53f7696
mov dword [0x231bbcd9], eax
clc
cmp al, 0x1f
comiss xmm1, dword ss:[ebx + 0x7a6645ab]
pop eax
jmp 0xcaaefd77
inc edi
push ss
jnp 0x4b6b30
rol esi, cl
add byte [ecx + 0x11499b7e], ch
mov byte [0x49748b83], al
jecxz 0x4b6aed
or bh, byte [edi]
in eax, 0x29
stosb byte es:[edi], al
pushal
or eax, 0x57b87a08
jno 0x4b6b0d
test byte [ecx], 0x6b
xor ch, byte [eax]
imul esi, dword [edx], 0x28
mov bl, 0xf9
aas
jp 0x4b6a91
out dx, al
add eax, 0xcfcbcef0
push esp
scasb al, byte es:[edi]
mov byte [ebx + 0x6e], ch
lds ecx, [ecx - 0x3153a8b]
loope 0x4b6b08
fnstcw word [0x1ea8e735]
push ds
add bl, ah
invalid
cmpsd dword [esi], dword es:[edi]
add al, 0x2e
pushal
out 0x64, eax
mov al, 0xbe
jmp 0x4b6af0

Function at 0x4b6dc2
Capabilities:
Encode data using xor

Disassembly:
cld
sub al, 7
shr dword [edx*4 - 0x47265307], cl
div byte [edx + 0x158035b2]
add eax, 0x182001ce
invalid
Function at 0x401de0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d358]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x25
push 0
mov esi, ecx
mov dword [ebp - 0x210], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x401e68
push 0x41a298
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401e68
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x20c]
mov word [esi], dx
lea edx, [eax + 2]
jmp 0x401e50
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401e50
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
jmp 0x401e81
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push eax
mov eax, 0x41a264
call fcn.00403f20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004084ab
mov esp, ebp
pop ebp
ret

Function at 0x401ea0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d358]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x25
push 0
mov esi, ecx
mov dword [ebp - 0x210], 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x401f28
push str.net.exe
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401f28
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x20c]
mov word [esi], dx
lea edx, [eax + 2]
jmp 0x401f10
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401f10
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
jmp 0x401f41
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push eax
mov eax, 0x41a264
call fcn.00403f20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004084ab
mov esp, ebp
pop ebp
ret

Function at 0x4025a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41d358]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x104
mov esi, ecx
mov dword [ebp - 0x210], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x402628
push str.BingDictMsi.msi
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x402628
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
lea eax, [ebp - 0x20c]
mov word [esi], dx
lea edx, [eax + 2]
jmp 0x402610
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402610
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
jmp 0x402641
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
push eax
mov eax, 0x41a264
call fcn.00403f20
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004084ab
mov esp, ebp
pop ebp
ret