joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c3c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edi, dword [0x416720]
test edi, edi
je 0x40c3f0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x68], 0x41414141
mov eax, dword [str._LIBGCCW32_EH_2_SJLJ_GTHR_CYGWIN]
lea esi, [ebp - 0x68]
mov dword [ebp - 0x64], 0x41414141
mov dword [ebp - 0x60], 0x41414141
mov dword [ebp - 0x48], eax
mov eax, dword [0x410b84]
mov dword [ebp - 0x5c], 0x41414141
mov dword [ebp - 0x58], 0x41414141
mov dword [ebp - 0x44], eax
mov eax, dword [0x410b88]
mov dword [ebp - 0x54], 0x41414141
mov dword [ebp - 0x50], 0x41414141
mov dword [ebp - 0x40], eax
mov eax, dword [0x410b8c]
mov dword [ebp - 0x4c], 0x41414141
mov dword [ebp - 0x3c], eax
mov eax, dword [0x410b90]
mov dword [ebp - 0x38], eax
mov eax, dword [0x410b94]
mov dword [ebp - 0x34], eax
mov eax, dword [0x410b98]
mov dword [ebp - 0x30], eax
mov eax, dword [0x410b9c]
mov dword [ebp - 0x2c], eax
movzx eax, byte [0x410ba0]
mov byte [ebp - 0x28], al
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
movzx eax, ax
sub esp, 4
test eax, eax
mov dword [ebp - 0x6c], eax
jne 0x40c540
mov dword [esp], 0x30
call sub.cygwin1.dll_malloc
test eax, eax
mov ebx, eax
je 0x40c56a
cld
mov edi, eax
mov eax, dword [ebp - 0x6c]
mov ecx, 0xc
rep stosd dword es:[edi], eax
mov dword [ebx], 0x30
mov eax, dword [0x40d520]
mov dword [ebx + 0x24], 0xffffffff
mov dword [ebx + 4], sub.cygwin1.dll_abort
mov dword [ebx + 0x14], eax
mov eax, dword [0x4166f0]
mov dword [ebx + 8], 0x40c260
mov edx, dword [0x40d528]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x20], eax
mov eax, dword [0x40d524]
mov dword [ebx + 0x2c], edx
mov dword [ebx + 0x28], eax
mov eax, ebx
call fcn.0040c310
test ax, ax
je 0x40c51d
mov dword [esp], 0
mov esi, 0x40c570
xor ecx, ecx
mov dword [esp + 8], esi
mov dword [esp + 4], ecx
call sub.cygwin1.dll_pthread_atfork
jmp 0x40c547
mov dword [esp], ebx
call sub.cygwin1.dll_free
mov dword [esp], esi
call sub.KERNEL32.dll_FindAtomA
sub esp, 4
movzx eax, ax
lea esi, [esi]
lea edi, [edi]
call fcn.0040c270
mov ebx, eax
mov dword [0x416720], ebx
lea eax, [ebx + 4]
mov dword [0x416710], eax
lea eax, [ebx + 8]
mov dword [0x416730], eax
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
call sub.cygwin1.dll_abort
nop
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x416720]
call fcn.0040c310
test ax, ax
je 0x40c587
leave
ret
mov dword [esp], str._usr_build_package_orig_test.respin_gcc_3.4.4_3_gcc_config_i386_w32_shared_ptr.c
mov eax, str.__w32_sharedptr_set____w32_sharedptr____0
mov dword [esp + 8], eax
mov eax, 0xf6
mov dword [esp + 4], eax
call sub.cygwin1.dll___assert
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x6fd819c1
nop
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1a3f248b
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401479
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513d49
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x401541
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513d49
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50da24
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4015e7
cmp edi, dword [esi + 0x7c]
jge 0x4015e7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415e8b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415e8b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513d49
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513d49
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x401539
jmp 0x401509
call fcn.0041a0b2
int3
Function at 0x4184d9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ada9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4185a1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ada9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524a84
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418647
cmp edi, dword [esi + 0x7c]
jge 0x418647
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042ceeb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042ceeb
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ada9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ada9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418599
jmp 0x418569
call fcn.00431112
int3

Function at 0x42ee8e
Capabilities:
Encode data using xor

Disassembly:
inc eax
mov dh, byte [esp]
xor al, 0xe4
inc edi
cmpsb byte [esi], byte es:[edi]
rcl dword [edx + 0x1bd9cba8], 0xc2
loop 0x42ee90
je 0x42eefc
stc
not byte [esp + ebp + 0x1e6e8754]
adc eax, 0xe51fe8c7
push 0x5ef9fcba
clc
lodsd eax, dword [esi]
outsb dx, byte [esi]
add eax, ecx
jle 0xe56ab785
dec eax
invalid
Function at 0x42f569
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541e39
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f631
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541e39
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53bb14
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f6d7
cmp edi, dword [esi + 0x7c]
jge 0x42f6d7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443f7b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443f7b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541e39
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541e39
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f629
jmp 0x42f5f9
call fcn.004481a2
int3

Function at 0x43de1d
Capabilities:
Encode data using xor

Disassembly:
add ch, byte [edi + 0x55c6da95]
adc dword [ebp + 0x18da6cd9], 0x8116c1c
mov byte [esi], bl
mov eax, dword [esi]
push cs
sbb ecx, dword [esi + 0x5220e07e]
or esp, dword [esi + 0x16]
xor al, 0x83
invalid
Function at 0x441e86
Capabilities:
Encode data using xor

Disassembly:
dec esp
shl dword [ecx], 1
xor eax, 0x99895a44
fist dword [edi - 2]
jbe 0x441e57
ret 0x9be0
and bh, byte [eax - 8]
mov cl, 0x6d
xchg edx, eax
jnp 0x441e54
and ecx, dword [0x995d0fe2]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esi]
cmp eax, 0x5adaff61
xlatb
into
sub al, 0x5c
dec edi
sub eax, 0x15f14ee5
rep insb byte es:[edi], dx
or ebx, esi
adc eax, 0xde0b6cf3
and eax, 0xb1a369ef
or ch, byte [edi + 0x6b]
mov dl, 0x7b
in al, dx
or al, 0xd5
pop ebp
pop edx
adc al, 0xe0
add dword [edi + 0x15bb465c], edx
and dl, bl
adc dh, cl
lcall 0xd30b, 0xf561270
xor dword [ebp + 0x65], ecx
cmp cl, byte [eax - 0x50d5bae2]
cmp cl, byte gs:[eax - 0x50d5bae2]
jp 0x441eea
xchg ecx, eax
out dx, eax
test al, 0xa3
outsb dx, byte [esi]
push ds
push eax
mov byte [edi + 0x452e3a3d], dl
cmp edx, dword [ebx + 0x4e18adf8]
dec esi
dec esi
jne 0x441f2b
cmp bl, byte [ebx - 0x24]
adc ecx, ebp
lodsb al, byte [esi]
mov byte [0x55daf37], al
mov esi, 0x3c5d6cf8
aaa
aas
cmp dword es:[ecx + 0x54], ecx
jle 0x441f05
invalid
mov esp, 0x6aad35c5
jbe 0x441ea6
inc esp
invalid
jmp 0x441f92
sbb al, byte [eax]
ja 0x441ecf
sahf
invalid
invalid
in al, dx
dec ecx
loopne 0x441f3f
aaa
rcl ebx, 0x14
sub byte [ecx - 0x27b74d86], ah
mov cl, 0x6f
push 0x3a
in eax, 0x8c
push edx
fld qword [ebp + 0x6d]
in al, dx
jg 0x441f5d
aam 0x13
invalid

Function at 0x445607
Capabilities:
Encode data using xor

Disassembly:
lcall 0xae84, 0xbe9598c9
mov word [eax + edi + 0x19d19f3], es
adc byte [esi + ecx*2], 0xa8
mov dl, dl
add eax, 0x2d6eae6a
push ebp
fstp st(1)
stosb byte es:[edi], al
outsd dx, dword [esi]
fucompi st(3)
sub eax, 0x886fbb26
outsb dx, byte [esi]
xchg ch, al
sbb eax, 0xdaee923
outsb dx, byte [esi]
call 0xfc2a9bbd
and ebp, ecx
scasb al, byte es:[edi]
or eax, 0x4583e86e
out 0xfb, al
add dword [ebp - 0x1a], 0xfffffffb
mov cl, 0xbb
in al, dx
fadd qword [edi - 0x4f9cdb51]
sbb al, 0xf2
in eax, 0x7b
lea esp, [edx]
mov byte ss:[0x5423e45a], al
mov word [eax - 0x6addc8ba], gs
pop ecx
pop edi
cli
push ebp
out 0xf6, al
imul ecx, dword [ebp + 0x42e0aaeb], 0xffffffac
insd dword es:[edi], dx
outsb dx, byte [esi]
jg 0x445630
sbb dl, bl
sbb byte [esi], 0x5f
mov eax, 0xa149ee10
cmp eax, dword [edx]
or byte ss:[eax - 0x756fb44e], 0x53
inc ebx
fidivr dword [edi]
jp 0x4456a9
xor dword [ebx], edx
mov dh, 0x3a
push edi
sal byte [ebx], 0xe
xor ecx, dword [esi]
push ebp
pop ss
xchg ecx, eax
jne 0x445688
pop eax
xor eax, 0xf18898c6
invalid
jle 0x4456a9
or al, ch
or al, 0x1d
inc edx
jge 0x445636
popal
test eax, 0xc406c3d4
adc ecx, esi
dec esi
or eax, 0x5ecdfe74
wait
jb 0x4456dc
add eax, 0x7435a393
push cs
in eax, 0xd5
dec ebx
mov ebp, 0xff4bf84c
mov eax, 0x751cd551
xchg edi, eax
and al, 0x8e
pop esi
or cl, ah
scasd eax, dword es:[edi]
sub edx, dword [ecx + 0x70]
pop esp
and byte [ecx], ah
mov ah, 0x69
scasb al, byte es:[edi]
pop es
invalid
Function at 0x4461a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]

Function at 0x4461f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558a79
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x446271
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558a79
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x552754
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x446317
cmp edi, dword [esi + 0x7c]
jge 0x446317
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045abbb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045abbb
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558a79
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558a79
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446269
jmp 0x446239
call fcn.0045ede2
int3
Function at 0x44e06f
Capabilities:
Encode data using xor

Disassembly:
push ds
arpl word [0x74985544], dx
salc
xor ah, dh
retf
mov edx, 0x57d5ebc7
cld
loope 0x44e0ad
add dword [0xf7345042], ebp
test dword [ebp + 0x58], eax
cmp esp, esi
inc edx
xchg esp, eax
push ebp
in eax, dx
jecxz 0x44e03c
movsb byte es:[edi], byte [esi]
xchg esp, eax
aam 0xf6
xor esi, dword [esp]
mov byte [eax], dl
dec ecx
int1
or bl, bh
pushal
lcall 0x7d3f, 0xb5eb2647
lcall 0x429a, 0xae28455d
sti
inc eax
test eax, 0xe684f87f
imul eax, dword [ebp - 0x368b6503], 0x35
push esi
mov dl, 0x5f
in eax, 0xfd
lcall 0x5fb2, 0x5635c974
mov ebx, 0x109c913
xor al, 0x46
out 0xc8, al
inc esp
push edx
fadd st(5), st(0)
jne 0x44e0ab
lcall 0xa482, 0x39ce6a1
and al, 0x96
and dword [ebp + 0x1264c9da], esi
add al, 0xec
outsb dx, byte [esi]
xchg ebp, eax
xor edx, edx
adc al, 0xb4
push cs
mov al, 0xb4
add edx, 0xfffffff0
cmp dl, byte [esi + 0x3e]
out 0x3e, al
pop edx
adc al, 0x26
daa
dec edx
xor dword [edx + 0x64c8bdbf], ecx
salc
or al, 0xf5
jne 0x44e0e5
add eax, 0x255d42d9
cmpsb byte [esi], byte es:[edi]
stc
xchg edi, eax
xchg ecx, eax
xlatb
sti
adc al, 0xb1
and al, 0x40
xor eax, 0x980d3a45
das
pop edi
loope 0x44e0e0
jge 0x44e189
leave
jb 0x44e18c
cli
popfd
xchg esp, eax
or dword [eax - 0x65], 0x3d6ac060
add edi, dword [esi + 0x6d405478]
shr byte [edx + 0x3d], 3
mov esi, 0x6d405478
movsd dword es:[edi], dword [esi]
pop edi
mov bh, 0x1a
jnp 0x44e156
sub edi, dword [edx + 0x67]
jp 0x44e194
jle 0x44e0dd
shl byte [esi + 0x596dc1d6], cl
movsd dword es:[edi], dword [esi]
adc eax, 0xc76a196
jbe 0x44e148
mov bl, 0x37
xchg esi, eax
ljmp 0x36a4
xlatb
les eax, [eax + eax*4]
and al, 0xbf
jg 0x44e12a
adc dword [edx + 0x41], 0x78
adc al, 0x69
insd dword es:[edi], dx
xchg ebp, eax
iretd
imul ebp, dword [ebp - 0x6b], 0xbf4b21cf
out 0xa2, al
inc eax
dec eax
push ds
or al, 0x8c
mov dh, byte [eax + 0x64]
in al, 0x7b
lds eax, [esi - 0x6a]
and eax, 0x35ba522c
xchg edx, eax
cdq
jbe 0x44e13a
xchg byte [ebx], dl
mov bh, 0x2f
xor dword [ecx - 0x50], esp
stosb byte es:[edi], al
mov bl, 0x74
lds edx, [ebx + 0x45]
add ecx, dword [ebx + 0x1ae127b5]
test edx, eax
ja 0x44e11c
ja 0x44e11c
xchg ebp, eax
xchg edi, eax
cmp esp, ebx
jbe 0x44e19b
clc
xchg esi, eax
dec esp
add dword [ecx + 0x5006d595], 0xb52530a5
imul edi, dword [ebx], 0xffffffd3
aad 6
push eax
movsd dword es:[edi], dword [esi]
xor byte [0xd33b6bb5], ah
out 0x9d, al
dec edx
mov dh, 0xdf
mov al, 0x2f
cdq
mov al, 0x11
cdq
jge 0x44e217
cmp dl, bh
out 0x75, eax
div dword [ebp - 0xe]
cmpsb byte [esi], byte es:[edi]
sbb dword [esi + edx*4 + 0x15], 0x4e9c62f2
dec esi
test byte [0xe37e654b], dh
outsd dx, dword [esi]
and al, 0xa4
das
das
retf 0xe61d
add dword [eax - 0xce7fed], esp
test eax, 0x770d30f1
shl dword [esi + esi + 0x65], 0xee
xchg edx, eax
add esp, ebp
lcall 0xb5e8, 0x88d1e5f7
fpatan
sbb esp, edi
and eax, dword [esi - 0x52a11edf]
push ds
sub dl, byte [ebx]
aaa
cmp byte [ebx - 0x30b3cb3], bl
xor al, 0xa5
jae 0x44e1c9
ret
Function at 0x45ce09
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38