joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48e6e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov esi, ecx
push edi
mov edi, eax
test esi, esi
je 0x48e822
test ebp, ebp
je 0x48e822
cmp dword [esp + 0x14], 0
je 0x48e822
lea ecx, [edi + 2]
test ecx, ecx
jl 0x48e822
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x40000000
jge 0x48e822
cmp edi, 2
mov ecx, ebp
jle 0x48e7af
lea edx, [edi - 3]
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
add edi, eax
push ebx
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + 0x525af0]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
movzx eax, byte [eax + ebx + 0x525af0]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
inc ecx
and eax, 0xf
shr ebx, 6
movzx eax, byte [ebx + eax*4 + 0x525af0]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + 0x525af0]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
sub edx, 1
jne 0x48e750
pop ebx
test edi, edi
je 0x48e80f
movzx edx, byte [esi]
shr edx, 2
mov al, byte [edx + 0x525af0]
mov byte [ecx], al
inc ecx
cmp edi, 1
jle 0x48e7f5
movzx edx, byte [esi]
movzx eax, byte [esi + 1]
and edx, 3
shl edx, 4
shr eax, 4
movzx edx, byte [edx + eax + 0x525af0]
mov byte [ecx], dl
movzx eax, byte [esi + 1]
inc ecx
and eax, 0xf
movzx edx, byte [eax*4 + 0x525af0]
mov byte [ecx], dl
jmp 0x48e80a
movzx eax, byte [esi]
and eax, 3
shl eax, 4
mov dl, byte [eax + 0x525af0]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [esp + 0x14]
mov eax, ecx
sub eax, ebp
pop edi
pop esi
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebp
ret

Function at 0x48ec30
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
jne 0x48ec37
xor eax, eax
ret
or eax, 0xffffffff
push esi
cmp edx, 8
jb 0x48ed14
mov esi, edx
shr esi, 3
push edi
lea ebx, [ebx]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x5256f0]
inc ecx
sub edx, 8
sub esi, 1
jne 0x48ec50
pop edi
test edx, edx
je 0x48ed3b
jmp 0x48ed20
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x5256f0]
inc ecx
sub edx, 1
jne 0x48ed20
not eax
pop esi
ret
Function at 0x48f010
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x508670
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x1c]
call fcn.004424c0
mov dword [esp + 0x14], 0x513660
mov esi, dword [ebp + 8]
push 0x5466e8
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0
call fcn.00442510
test al, al
je 0x48f199
push 0x64
push 0
lea ecx, [esp + 0x24]
call fcn.004424c0
mov dword [esp + 0x1c], 0x513658
push 0x546918
push esi
lea ecx, [esp + 0x24]
mov byte [esp + 0x38], 1
call fcn.00442510
test al, al
je 0x48f18b
push 0
push esi
lea ecx, [edi + 0x154]
call fcn.00488f30
test al, al
je 0x48f18b
push 0
push esi
lea ecx, [edi + 0x44c]
call fcn.00488f30
test al, al
je 0x48f18b
mov ebx, dword [ebp + 0xc]
push 0x521274
mov ecx, ebx
call fcn.004394f0
cmp byte [edi + 0x151], 0
jne 0x48f0fd
push 0x513698
mov ecx, esi
call fcn.004386d0
mov ecx, eax
jmp 0x48f186
mov eax, dword [ebp + 0x10]
push 0
push eax
lea ecx, [esp + 0x18]
push ecx
lea ecx, [edi + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004920e0
test al, al
je 0x48f167
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x48f167
call fcn.004917f0
push eax
mov ecx, ebx
call fcn.004394f0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.004424e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.004424e0
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x513684
mov ecx, esi
call fcn.004386d0
mov ecx, eax
call fcn.00439040
mov ecx, ebx
mov esi, eax
call fcn.00439a20
push eax
mov ecx, esi
call fcn.00439040
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.004424e0
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.004424e0
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x490a60
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x508df8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x30]
mov al, byte [esp + 0x2c]
mov edi, dword [esp + 0x28]
push 0x5138f8
mov dword [esi + 4], ecx
push edi
mov ecx, 0x5466e8
mov byte [esi], al
call fcn.0044a440
test al, al
jne 0x490ad0
push 0x5138d4
push edi
call fcn.00438780
add esp, 8
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push 0x5138a8
push edi
mov ecx, 0x546918
call fcn.00442620
test al, al
je 0x490aad
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004424c0
mov dword [esp + 0x10], 0x513658
push 0x546918
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.00442510
test al, al
jne 0x490b4c
push 0x5138d4
push edi
call fcn.00438780
add esp, 8
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp byte [esi + 0xa78], 0
jne 0x490bd0
call fcn.0043e090
mov ecx, eax
call fcn.0043c420
test al, al
jne 0x490b9e
push edi
call fcn.0043e090
mov ecx, eax
call fcn.0043c450
test al, al
jne 0x490b9e
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ecx, esi
call fcn.0048f710
push 1
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call fcn.00490620
test al, al
je 0x490b76
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, esi
call fcn.00490040
test al, al
je 0x490b76
mov byte [esi + 0xa78], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x490c00
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x508df8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov cl, byte [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
push 0x5138f8
mov byte [esi + 8], cl
push edi
mov ecx, 0x5466e8
mov dword [esi + 0xc], eax
call fcn.0044a440
test al, al
jne 0x490c71
push 0x5138d4
push edi
call fcn.00438780
add esp, 8
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push 0x5138a8
push edi
mov ecx, 0x546918
call fcn.00442620
test al, al
je 0x490c4e
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004424c0
mov dword [esp + 0x10], 0x513658
push 0x546918
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0
call fcn.00442510
test al, al
jne 0x490ced
push 0x5138d4
push edi
call fcn.00438780
add esp, 8
lea ecx, [esp + 0x10]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
mov al, bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp byte [esi + 0xa78], 0
jne 0x490d71
call fcn.0043e090
mov ecx, eax
call fcn.0043c420
test al, al
jne 0x490d3f
push edi
call fcn.0043e090
mov ecx, eax
call fcn.0043c450
test al, al
jne 0x490d3f
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
xor al, al
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ecx, esi
call fcn.0048f710
push 1
lea edx, [esp + 0x14]
push edx
push edi
mov ecx, esi
call fcn.00490620
test al, al
je 0x490d17
lea eax, [esp + 0x10]
push eax
push edi
mov ecx, esi
call fcn.00490040
test al, al
je 0x490d17
mov byte [esi + 0xa78], 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
call fcn.004424e0
mov al, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x490f00
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x508ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.004424c0
mov dword [esp + 0x18], 0x513660
mov esi, dword [esp + 0x30]
push 0x5466e8
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00442510
test al, al
je 0x490f97
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004424c0
mov dword [esp + 0x10], 0x513658
push 0x546918
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00442510
test al, al
jne 0x490fbf
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.004424e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.004424e0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x154]
call fcn.00488f30
test al, al
je 0x490f89
push 0
push esi
lea ecx, [edi + 0x44c]
call fcn.00488f30
test al, al
je 0x490f89
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.00490930
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.004424e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.004424e0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10

Function at 0x491040
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x508ab0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x5415a0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
push 0x64
push 0
lea ecx, [esp + 0x20]
call fcn.004424c0
mov dword [esp + 0x18], 0x513660
mov esi, dword [esp + 0x30]
push 0x5466e8
push esi
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
call fcn.00442510
test al, al
je 0x4910d7
push 0x64
push 0
lea ecx, [esp + 0x18]
call fcn.004424c0
mov dword [esp + 0x10], 0x513658
push 0x546918
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x30], 1
call fcn.00442510
test al, al
jne 0x4910ff
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.004424e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.004424e0
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
push 0
push esi
lea ecx, [edi + 0x154]
call fcn.00488f30
test al, al
je 0x4910c9
push 0
push esi
lea ecx, [edi + 0x44c]
call fcn.00488f30
test al, al
je 0x4910c9
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
push esi
mov ecx, edi
call fcn.00490da0
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x28], 0
call fcn.004424e0
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 0xffffffff
call fcn.004424e0
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x4a0310
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
jne 0x4a0321
xor eax, eax
jmp 0x4a050b
mov eax, 1
test eax, eax
je 0x4a036d
mov dword [ebp - 4], 1
movzx ecx, byte [ebp - 4]
test ecx, ecx
je 0x4a0354
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a0510
add esp, 0xc
jmp 0x4a050b
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.004a0910
add esp, 0xc
jmp 0x4a050b
mov edx, dword [ebp + 8]
xor edx, 0xffffffff
mov dword [ebp + 8], edx
cmp dword [ebp + 0x10], 8
jb 0x4a04cc
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x515420]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x515420]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x515420]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x515420]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x515420]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0xc]
movzx eax, byte [edx]
xor eax, dword [ebp + 8]
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
xor ecx, dword [eax*4 + 0x515420]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
add edx, 1
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x515420]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
xor edx, dword [ebp + 8]
and edx, 0xff
mov eax, dword [ebp + 8]
shr eax, 8
xor eax, dword [edx*4 + 0x515420]
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 8
mov dword [ebp + 0x10], edx
jmp 0x4a0376
cmp dword [ebp + 0x10], 0
je 0x4a0505
mov eax, dword [ebp + 0xc]
movzx ecx, byte [eax]
xor ecx, dword [ebp + 8]
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
xor edx, dword [ecx*4 + 0x515420]
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 1
mov dword [ebp + 0x10], ecx
jne 0x4a04d2
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov esp, ebp
pop ebp
ret
Function at 0x4af140
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esi + 0x16c]
test ecx, ecx
je 0x4af15b
mov edx, dword [esi + 0xfc]
push edx
push edi
push ebx
push eax
push esi
call ecx
add esp, 0x14
ret
test eax, eax
jl 0x4af18f
cmp eax, 2
jg 0x4af18f
mov ecx, dword [esi + 0xf8]
push ecx
push 1
lea edx, [eax + eax*2 + 0x518530]
push 2
push edx
call fcn.004d3f7d
mov eax, dword [esi + 0xf8]
push eax
push 1
push edi
push ebx
call fcn.004d3f7d
add esp, 0x20
xor eax, eax
ret
Function at 0x4c2ff0
Capabilities:
Parse pe header

Disassembly:
mov al, byte [esp + 4]
movsx ecx, al
add ecx, 0xffffff9f
cmp ecx, 0x19
ja case.default.0x4c2fff
jmp dword [ecx*4 + 0x4c3054]
mov al, 0x41
ret
mov al, 0x42
ret
mov al, 0x43
ret
mov al, 0x44
ret
mov al, 0x45
ret
mov al, 0x46
ret
mov al, 0x47
ret
mov al, 0x48
ret
mov al, 0x49
ret
mov al, 0x4a
ret
mov al, 0x4b
ret
mov al, 0x4c
ret
mov al, 0x4d
ret
mov al, 0x4e
ret
mov al, 0x4f
ret
mov al, 0x50
ret
mov al, 0x51
ret
mov al, 0x52
ret
mov al, 0x53
ret
mov al, 0x54
ret
mov al, 0x55
ret
mov al, 0x56
ret
mov al, 0x57
ret
mov al, 0x58
ret
mov al, 0x59
ret
mov al, 0x5a
ret

Function at 0x4c5220
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.004d1381
add esp, 0x18
test eax, eax
je 0x4c5243
cmp eax, 0xffffffff
jne 0x4c5245
xor eax, eax
ret

Function at 0x4c5dc0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4e629d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x8e4e621f
sub ebx, 0x11
mov edx, dword [ebp + 0x3327c364]
inc dword [ebp - 0x347c8c]
call 0x75569bf6
sub edi, dword [eax + 0x18]
cmp ebx, esi
jne 0x4e62ec
add al, al
add cl, dl
pop ss
cmp eax, 0x16
mov ch, 0x44
inc eax
add eax, dword [eax]
mov edi, dword [ebp - 0x67c01b8]
mov ecx, dword [ebp - 0x347cb4]
push es
or byte [esi + 4], 0x40
jmp 0x4e634a
cmp ebx, esi
jne 0x4e631e
outsd dx, dword [esi]
jg 0x8baf6869
jb 0x4e62fa
popal
mov eax, dword [ebp + 0x18]
add dword [eax], ecx
jmp fcn.004e635e
inc ebp
sbb byte [ecx], al
or bl, ch
popal
dec ebp
or al, 0x63
je 0x4f2310
jne fcn.004e636c
pop edx
push es
sub eax, dword [esi - 0x15]
in eax, dx
pop es
mov cl, 0xe4
invalid
push edi
push dword [ebp + 0x10]
clc
outsb dx, byte [esi]
jne 0x576891
add byte [ebx - 0x3ca60196], al
push 0xffffffffffffff8b
mov ebp, 0xffcb8374
je 0x66a46573
jmp 0x66a465cf
js 0x4e6364
invalid

Function at 0x4e68fc
Capabilities:
Encode data using xor

Disassembly:
pop ebp
inc esi
mov byte [ebp - 0x19], 0x20
jmp 0x4e696a
inc esi
cmp al, 0x2d
jne 0x4e6953
test dl, dl
je 0x4e6953
mov cl, byte [esi]
cmp cl, 0x5d
je 0x4e6953
inc esi
cmp dl, cl
jae 0x4e6925
mov al, cl
jmp 0x4e6929
mov al, dl
mov dl, cl
cmp dl, al
ja 0x4e694f
sub al, dl
inc al
movzx edi, dl
movzx edx, al
mov eax, dword [ebp - 0xc]
xor eax, dword [ebp - 0x10]
xor esi, dword [ebx - 0x3e1c2dff]
call 0x592f64b
fmul qword [eax]
sbb byte [edi + 0x4a], al
jne 0x4e6937
xor dl, dl
jmp 0x4e696a
movzx ecx, al
mov dl, al
ret
mov al, byte [esi]
cmp al, 0x5d
jne 0x4e690c
add dword [eax], eax
add byte [esi + ebx + 0x2f7418e8], al
mov ch, 0x48
inc byte [ebx + 0x44008bf9]
invalid
Function at 0x4e8200
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 5
sar dword [ebx], cl
invalid
clc
add eax, 0x75c73bd3
push cs
push dword [ebp - 0x20]
call fcn.004cc8cb
in al, dx
push 0x7d
loopne 0x4e81ff
or edx, dword [edi + 0x7d]
fdiv st(7), st(0)
je 0x4e8220
add dword [ebp - 0x30], ecx
mov dword [ecx], eax

Function at 0x4e8e9c
Capabilities:
Write file on windows

Disassembly:
xor eax, 0x9c457118
push esp
mov ecx, ebx
and ecx, 7
sar ebx, 3
test ecx, ecx
je 0x4b7347
imul ecx, ecx, 0xc
add ecx, dword [ebp - 0x64]
mov eax, ecx
mov dword [ebp - 0x44], ecx
mov ecx, 0xc6fe8bd3
push es
xor byte [eax], cl
jb 0x4e8ed8
mov esi, eax
lea edi, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3c]
movsd dword es:[edi], dword [esi]
dec dword [ebp - 0x3a]
mov dword [ebp - 0x44], eax
movzx edx, word [eax + 0xa]
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp + 0x18], ecx
add al, byte [eax]
add byte [ebx - 0xd7415b3], cl
xor esi, ecx
push 0x64
push edx
push eax
call 0xb8c41899
mov esi, 0x83ffffb5
and ecx, esi
and edx, esi
lea esi, [edx + ecx]
movzx edi, si
mov esi, 0x83ffffb5
les edx, [eax]
into
jae 0x1fcb61c3
jg 0x4e8f1e
salc
jae 0x895517c3
push es
mov dword [ebp + 0xa], edx
push edx
push eax
push ebp
or dl, byte [edx + 0x50]
call 0x104cfea2
xchg dword [ebp + 0x55890688], edx
invalid
Function at 0x402180
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
movzx eax, si
push edi
mov edi, edx
test eax, eax
je 0x4021a6
sub esi, eax
add esi, 0x10000
cmp esi, edi
jae 0x402240
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop dword [eax]
nop dword [eax + eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x4021d4
mov esi, 0x80010000
jmp 0x40223c
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x402240
cmp dword [ebp - 0x10], 0x10000
mov ecx, dword [ebp - 0x14]
jne 0x402227
cmp ecx, 0x10000
jb 0x402227
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x402242
add esi, 0x10000
jmp 0x40223c
mov esi, dword [ebp - 0x20]
add esi, ecx
movzx ecx, si
test ecx, ecx
je 0x40223c
mov eax, 0x10000
sub eax, ecx
add esi, eax
cmp esi, edi
jb 0x4021c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fc87
mov esp, ebp
pop ebp
ret

Function at 0x402260
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x443040]
xor eax, ebp
mov dword [ebp - 4], eax
add edx, 0xffff0000
push ebx
push esi
movzx eax, dx
mov esi, edx
sub esi, eax
test eax, eax
push edi
mov edi, ecx
cmove esi, edx
cmp esi, edi
jbe 0x40231e
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop word [eax + eax]
lea eax, [esi - 0x50000000]
cmp eax, 0x30000000
ja 0x4022b4
mov esi, 0x4fff0000
jmp 0x40231a
push 0x1c
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
xorps xmm0, xmm0
push eax
push esi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40231e
cmp dword [ebp - 0x10], 0x10000
jne 0x402305
cmp dword [ebp - 0x14], 0x10000
jb 0x402305
push 0x40
push 0x3000
push 0x10000
push esi
call ebx
test eax, eax
jne 0x402320
sub esi, 0x10000
jmp 0x40231a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xffff0000
mov esi, ecx
movzx eax, si
sub esi, eax
test eax, eax
cmove esi, ecx
cmp esi, edi
ja 0x4022a0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040fc87
mov esp, ebp
pop ebp
ret