joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403b10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f608
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x45115c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x403c3d
cmp byte [edi + 0x4a], bl
je 0x403c3d
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffff
mov ecx, edi
call edx
movzx eax, ax
mov ecx, 0xffff
cmp cx, ax
je 0x403c31
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x403b8f
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x403ba7
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_wchar_t__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x403bce
dec eax
je 0x403bd1
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x403c2c
jmp 0x403c38
mov byte [edi + 0x4a], bl
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x403be1
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x403c0b
cmp edx, 0x10
jae 0x403bf0
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x403c29
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x4a], bl
je 0x403c35
cmp esi, ebx
jne 0x403b9b
push ebx
mov ebx, 8
lea esi, [ebp - 0x2c]
call fcn.004038c0
xor ebx, ebx
jmp 0x403b95
lea ecx, [ebp - 0x2c]
call fcn.00402d40
xor al, al
jmp 0x403c3f
lea ecx, [ebp - 0x2c]
call fcn.00402d40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
Function at 0x4046f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44052d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x45115c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x24], esi
call dword [sym.imp.mfc100.dll_Ordinal_9474]
mov eax, dword [esi + 0x20]
push 0
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4344]
mov edi, eax
test edi, edi
je 0x404793
lea ecx, [ebp - 0x14]
call dword [0x442930]
push 0x65
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call dword [sym.imp.mfc100.dll_Ordinal_7581]
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 0xc], 0
je 0x404783
mov edx, dword [edi + 4]
mov ebx, dword [sym.imp.USER32.dll_AppendMenuA]
push 0
push 0
push 0x800
push edx
call ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [edi + 4]
push eax
push 0x10
push 0
push ecx
call ebx
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call dword [0x44293c]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov ebx, eax
call edi
mov edx, dword [reloc.mfc100.dll_Ordinal_13305]
push 2
push 0x258
push 0x2ee
push eax
push ebx
push edx
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_12865]
mov eax, dword [esi + 0x174]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
mov eax, dword [esi + 0x20]
push 1
push pe_nt_image_headers32
push eax
call edi
mov eax, dword [esi + 0x174]
mov ecx, dword [esi + 0x20]
push eax
push 0
push pe_nt_image_headers32
push ecx
call edi
lea ecx, [ebp - 0x18]
call dword [0x442930]
lea ebx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00405400
lea ecx, [ebp - 0x1c]
call dword [0x442930]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x18]
push edx
push 0x444768
lea eax, [ebp - 0x1c]
push str._s__Version:__s
push eax
call dword [sym.imp.mfc100.dll_Ordinal_4283]
mov ecx, dword [ebp - 0x18]
add esp, 0x10
push str.._security
push ecx
push str.ToolVersion
push str.Server
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp - 0x1c]
push edx
mov ecx, esi
call dword [sym.imp.mfc100.dll_Ordinal_12868]
push 0x104
call dword [sym.imp.mfc100.dll_Ordinal_265]
add esp, 4
push str.._security
push 0x104
mov edi, eax
push edi
push 0x4445b0
push str.Login_URL
push str.Server
mov dword [edi], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
add dword [edi - 0x73], edx
dec ebp
invalid
Function at 0x405400
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x45115c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.0043e300
push str.0.0.0.0
push ebx
call dword [sym.imp.mfc100.dll_Ordinal_4283]
add esp, 0x14
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov esi, eax
test esi, esi
jne 0x40547b
push eax
push eax
push str.GetFileVersionInfoSize_fail
call dword [sym.imp.mfc100.dll_Ordinal_1982]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.mfc100.dll_Ordinal_265]
add esp, 4
mov edi, eax
push edi
push esi
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
jne 0x4054a6
push eax
push eax
push str.GetFileVersionInfo_fail
jmp 0x4054cb
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x444ab8
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x4054eb
push eax
push eax
push str.GetFileVersionValue_fail
call dword [sym.imp.mfc100.dll_Ordinal_1982]
push edi
call dword [0x4427d0]
add esp, 4
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10c]
mov eax, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x14]
movzx edx, cx
push edx
shr ecx, 0x10
push ecx
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
push str._d._d._d._d
push ebx
call dword [sym.imp.mfc100.dll_Ordinal_4283]
push edi
call dword [0x4427d0]
mov ecx, dword [ebp - 4]
add esp, 0x1c
pop edi
xor ecx, ebp
pop esi
call fcn.0043dda2
mov esp, ebp
pop ebp
ret

Function at 0x4067e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x70
mov eax, dword [0x45115c]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
xor ebx, ebx
mov eax, ecx
push esi
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406825
sub eax, esi
push ecx
lea ebx, [esp + 0xc]
call fcn.00405e30
lea eax, [esp + 0x68]
push eax
mov ecx, ebx
call fcn.00405ee0
mov eax, edi
add esp, 8
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406850
sub eax, edx
push eax
push 0
push edi
call fcn.0043e300
mov ebx, dword [0x4422dc]
add esp, 0xc
xor esi, esi
lea ecx, [ecx]
movzx ecx, byte [esp + esi + 0x64]
push ecx
push edi
push str._s_02X
push edi
call ebx
inc esi
add esp, 0x10
cmp esi, 0x10
jl 0x406870
mov ecx, dword [esp + 0x74]
pop esi
pop ebx
xor ecx, esp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
Function at 0x40a470
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push edi
mov edi, eax
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x40a48f
pop edi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp - 0x1c]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40a4ad
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x3c]
movzx edx, word [eax + esi + 0x14]
add eax, esi
lea ecx, [edx + eax + 0x18]
movzx eax, word [eax + 6]
push ebx
sub edi, esi
xor ebx, ebx
mov dword [ebp - 4], eax
test eax, eax
je 0x40a4f1
lea eax, [ecx + 0x10]
mov edi, edi
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ecx, dword [eax - 4]
cmp edx, esi
ja 0x40a4de
mov edx, esi
cmp edi, ecx
jb 0x40a4e8
add edx, ecx
cmp edi, edx
jbe 0x40a4fa
inc ebx
add eax, 0x28
cmp ebx, dword [ebp - 4]
jb 0x40a4d0
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
inc ebx
mov dword [eax], ebx
sub edi, ecx
mov ecx, dword [ebp + 0x10]
pop ebx
pop esi
mov dword [ecx], edi
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40a520
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x45115c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str._nCall_stack:_n
mov esi, ecx
call fcn.0040a6b0
push str.Address___Frame_____Logical_addr__Module_n
call fcn.0040a6b0
mov eax, dword [esi + 0xb8]
mov ebx, dword [esi + 0xb4]
add esp, 8
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ebx
jmp 0x40a576
mov ebx, dword [ebp - 0x10c]
push 0x103
xor esi, esi
lea ecx, [ebp - 0x107]
push esi
push ecx
mov byte [ebp - 0x108], 0
call fcn.0043e300
mov edi, dword [ebp - 0x110]
add esp, 0xc
push 0x1c
lea edx, [ebp - 0x138]
push edx
push edi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x118], esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a63b
mov esi, dword [ebp - 0x134]
push 0x104
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a63b
mov eax, dword [esi + 0x3c]
movzx ecx, word [eax + esi + 0x14]
add eax, esi
lea edx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
mov ecx, edi
sub ecx, esi
xor edi, edi
mov dword [ebp - 0x11c], eax
test eax, eax
je 0x40a63b
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40a60e
mov edx, esi
cmp ecx, ebx
jb 0x40a618
add edx, ebx
cmp ecx, edx
jbe 0x40a626
inc edi
add eax, 0x28
cmp edi, dword [ebp - 0x11c]
jb 0x40a600
jmp 0x40a635
inc edi
sub ecx, ebx
mov dword [ebp - 0x114], edi
mov dword [ebp - 0x118], ecx
mov ebx, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x114]
lea edx, [ebp - 0x108]
push edx
mov edx, dword [ebp - 0x110]
push eax
push ecx
push ebx
push edx
push str._08X___08X___04X:_08X__s_n
call fcn.0040a6b0
mov eax, dword [ebx + 4]
mov dword [ebp - 0x110], eax
mov eax, ebx
mov ebx, dword [ebx]
add esp, 0x18
mov dword [ebp - 0x10c], ebx
test bl, 3
jne 0x40a692
cmp ebx, eax
jbe 0x40a692
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
je 0x40a570
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
Function at 0x41fd00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43f608
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x45115c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
cmp dword [edi + 0x44], ebx
je 0x41fe22
cmp byte [edi + 0x49], bl
je 0x41fe22
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x41fe16
mov ecx, 0xf
xor eax, eax
mov byte [ebp - 0x2c], bl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 8
cmp ecx, 0x10
jae 0x41fd74
lea eax, [ebp - 0x2c]
mov byte [eax + 8], bl
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
mov ecx, eax
cmp edx, 0x10
jae 0x41fd8c
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, ebx
je 0x41fdb3
dec eax
je 0x41fdb6
sub eax, 2
lea ecx, [ebp - 0x2c]
jne 0x41fe11
jmp 0x41fe1d
mov byte [edi + 0x49], bl
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, eax
cmp edx, 0x10
jae 0x41fdc6
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, ecx
je 0x41fdf0
cmp edx, 0x10
jae 0x41fdd5
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x41fe0e
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp byte [edi + 0x49], bl
je 0x41fe1a
cmp esi, ebx
jne 0x41fd80
push ebx
mov ebx, 8
lea esi, [ebp - 0x2c]
call fcn.004038c0
xor ebx, ebx
jmp 0x41fd7a
lea ecx, [ebp - 0x2c]
call fcn.00402d40
xor al, al
jmp 0x41fe24
lea ecx, [ebp - 0x2c]
call fcn.00402d40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043dda2
mov esp, ebp
pop ebp
ret
Function at 0x43dda2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45115c]
jne 0x43ddac
repz ret
jmp fcn.0043e306

Function at 0x46e6d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x46e7dc
test eax, eax
je 0x46e7dc
push esi
push edi
mov ecx, 0x10
mov esi, 0x488fe8
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x46e7c3
lea edi, [eax + 4]
jmp 0x46e727
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x46e73c
mov dword [ebp - 4], 2
jmp 0x46e75d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x46e753
mov dword [ebp - 4], 1
jmp 0x46e75d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x46e7d3
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x46e796
mov byte [ecx], 0x3d
jmp 0x46e7a2
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x46e7ad
mov byte [ecx], 0x3d
jmp 0x46e7b3
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x46e724
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472670
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
jne 0x47268f
mov ebx, dword [ebp + 8]
push eax
call fcn.00471b80
test al, al
je 0x4726c9
mov ebx, dword [ebp + 0xc]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x472697
sub eax, edx
mov esi, eax
push esi
mov dword [ebp + 0xc], esi
call fcn.00479a84
lea ecx, [ebp + 0xc]
push ecx
mov edi, eax
push edi
push esi
push ebx
call fcn.0046e7f0
add esp, 0x14
test al, al
jne 0x4726d4
push edi
call fcn.0047a174
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, dword [ebp + 0xc]
xor ebx, ebx
push edx
push edi
lea esi, [ebp - 0x7c]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x67452301
mov dword [ebp - 0x28], 0xefcdab89
mov dword [ebp - 0x24], 0x98badcfe
mov dword [ebp - 0x20], 0x10325476
mov dword [ebp - 0x1c], 0xc3d2e1f0
mov byte [ebp - 0x7c], bl
call fcn.0046e900
mov dword [ebp + 0xc], 0x40
cmp byte [ebp - 0x7c], bl
jne 0x472727
call fcn.0046ee80
mov byte [ebp - 0x7c], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x2c]
bswap ecx
mov dword [ebp + eax*4 - 0x18], ecx
inc eax
cmp eax, 5
jb 0x472730
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp - 0x18]
push 0x14
push ecx
call fcn.0046e6d0
mov edx, dword [ebp + 0xc]
push edi
mov byte [ebp + edx - 0xbc], bl
call fcn.0047a174
mov bl, byte [ebp + 0x10]
add esp, 0x14
mov eax, 0x48934c
test bl, bl
jne 0x47277a
mov eax, 0x489364
mov edi, dword [ebp + 8]
push 0
push eax
call fcn.00472090
push 1
lea eax, [ebp - 0xbc]
push eax
call fcn.00472090
test bl, bl
je 0x47279c
call fcn.00472170
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x995cae
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xed2d08
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf08678
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf0c1b2
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf121a2
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf1c2b0
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf34cc0
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0xf70eac
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xf9ac79
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret

Function at 0xfee667
Capabilities:
Execute syscall

Disassembly:
dec esp
mov edx, ecx
syscall
ret
Function at 0x100443a3
Capabilities:
Encode data using xor

Disassembly:
call 0x1004431c
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1004434c
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x10044368
xor edx, 0
jmp 0x10044373
xor edx, edx
jmp 0x1004438a
jmp 0x10044396
xor eax, eax
push 0x8427d7c0
call 0x100443a3
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x100443df
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x100443b8
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x100443f6
add eax, 0
jno 0x100443fb
add esi, 0
ret 0x10

Function at 0x10045164
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x10045186
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x10045328
cmp edi, dword [ebp + 0x10]
jb 0x10045328
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.10044c50
inc edi
jmp 0x1004520f
jmp 0x1004521c
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c50
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.10044c50
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x10045270
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x10045254
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1004529e
add dword [eax], 0x39
jle 0x1004527a
sub al, 0xf5
mov ch, al
call fcn.100452b3
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10
Function at 0x10046f8b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ecx
push edx
push 0
sub esi, esi
shr esi, 9
and dword [esp - 0x69], ebx
jbe 0x10046fa1
add edi, 0
shr esi, 0x17
or esi, dword [esp]
add esp, 4
add esi, dword [ebp + 8]
xor eax, eax
xor edx, edx
cld
and dword [esp - 0x46], edx
xor ecx, ecx
rol edx, 7
and dword [esp - 0x4b], edx
xor dl, al
mov al, byte [esi]
inc esi
or al, al
jne 0x10046fb2
mov eax, edx
pop edx
pop ecx
pop esi
mov esp, ebp
mov ebp, dword [esp]
add esp, 4
push 0x54
call fcn.10046ff3
std
inc ebx
sar cl, 0x3e
lahf
in al, dx
mov ch, 0x4a
mov ebx, 0x971631d8
test byte [ebp - 0x5e], ch
xor eax, dword [ebx + 0x2b5108c4]
add esp, 8
push ecx
sub ecx, eax
mov ecx, esp
cmp dword [ecx - 0x51], edx

Function at 0x1004935f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0xffffffffffffffff
push esi
mov esi, esp
xor dword [esp - 0x43], esi
xor dword [esp - 0x45], esi
and dword [esi + 4], eax
pop esi
push 0
ja 0x100492a8
add ebx, 0
push ecx
call 0x100492bd
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
add esp, 8
xor dword [esp], ebx
sub esp, 0x6b
mov dword [esp + 0x67], edx
add esp, 0x67
push ecx
push 0
xor dword [esp - 0x56], edx
xor edi, 0
add dword [esp], edi
push esi
mov ebx, 0x737b7340
sub ebx, dword [0x737d6b7f]
mov dword [ebp - 8], ebx
xchg esi, eax
push 0x737d6b6f
call fcn.10044d87
xchg esi, eax
add esi, ebx
mov edx, dword [ebp + 8]
sub edx, ebx
call fcn.10044295
mov edi, eax
mov eax, dword [esi + 8]
xor dword [esp - 0x69], edx
xor ebx, 0
xor eax, edi
cmp edx, eax
jb 0x1004941b
mov eax, dword [esi + 0xc]
xor eax, edi
cmp edx, eax
ja 0x1004941b
mov ecx, dword [esi + 0x10]
sub dword [esp - 0x34], ebx
xor ecx, edi
mov edx, dword [esi + 0x14]
xor edx, edi
shl edx, 2
add edx, 0x18
mov eax, dword [esi]
xor eax, edi
cmp eax, 1
je 0x100493d2
mov eax, 1
lock xchg dword [0x737d6b7b], eax
push 0x3dd1fc71
call 0x1004935f
push esi
add esp, 8
cmp eax, 0
jne 0x10049348
push edx
mov eax, edi
xor byte [esi + edx], al
inc edx
dec ecx
jne 0x1004936e
pop edx
mov eax, dword [esi + 0x14]
xor eax, edi
js 0x10049383
cmp ecx, edx
cmp eax, 0
je 0x100493a8
mov dword [ebp - 4], eax
lea ecx, [esi + 0x18]
mov eax, dword [esi + ecx]
xor eax, edi
add eax, edx
add dword [esi + eax], ebx
add ecx, 4
dec dword [ebp - 4]
jne 0x10049392
mov eax, 1
mov dword [esp - 0x1a], eax
push 0x8ae1b7eb
call fcn.100493c1
dec eax
loope 0x100493c4
invalid
xor eax, edi
mov dword [esi], eax
mov dword [0x737d6b7b], 0
add edx, esi
mov dword [ebp + 4], edx
xchg dword [esp], esi
push ecx
lea ecx, [edi - 0x72d1f741]
mov ecx, esp
mov dword [ecx - 0x15], ebx
pop ecx
push esi
xor esi, esi
mov esi, esp
and dword [esi - 0x1d], ecx
pop esi
mov dword [esp], esi
jb 0x100493f8
xor edx, 0
add esp, 4
pop edi
pop ecx
pop edx
pop ebx
pop eax
leave
jmp 0x1004940d
jmp 0x10049418
ret 4
mov eax, dword [esi + 4]
xor eax, edi
add esi, eax
jmp 0x10049306