joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43e970
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47ab13
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046e912
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00473faa
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.004754c6
test eax, eax
je 0x43ea8c
mov ecx, dword [esp + 0x3c]
call fcn.00473fd7
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43ea50
push edi
mov ecx, esi
call fcn.0047163c
mov ecx, esi
call fcn.0043ebf0
cmp dword [esp + 0x38], 1
jne 0x43ea85
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00471777
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x4414b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4414e3
push esi
call fcn.0044f7f0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4414dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x441569
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x441552
mov eax, dword [esi + 8]
test eax, eax
je 0x441507
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44154e
cmp eax, 2
je 0x441552
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4414fa
cmp eax, 3
je 0x44152d
cmp eax, 1
jne 0x4414fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4414fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4414fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00441590
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x441578
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00441590
add esp, 4
pop esi
ret

Function at 0x441e00
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
je 0x441e21
mov ecx, dword [eax + 0x40]
test ecx, ecx
je 0x441e21
mov eax, dword [eax + 0x44]
test eax, eax
je 0x441e21
mov edx, dword [esp + 8]
push edx
push eax
call ecx
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x46f707
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x46f73f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0046d7be
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0046d796
jmp 0x46f74b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x470df9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x470e3b
call fcn.004768b6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x470e3b
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x470e32
xor eax, eax
jmp 0x470e43
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00470e49
pop edi
pop esi
pop ebx
ret 4
Function at 0x476de6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x476e14
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x476e32
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00476d4c
jmp 0x476e32
mov eax, dword [esi + 0x14]
test eax, eax
je 0x476e32
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00476d4c
test edi, edi
mov eax, edi
jne 0x476e1c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401030
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret
Function at 0x4555a8
Capabilities:
Encrypt data using aes

Disassembly:
mov ebx, dword [ebx*4 + 0x431254]
cmc
jmp 0x4555f8
pushal
lea esp, [esp + 0x23]
add esp, 0
lea esp, [esp + 1]
jmp 0x455590
and ebx, ecx
sub esp, 0x1e
push edx
add esp, 1
lea esp, [esp + 1]
jmp 0x455666
and edx, ecx
pushal
jmp 0x455693
sub esp, 0x14
pop word [esp + 1]
jmp 0x455638
lea esp, [esp + 0x20]
xor edi, dword [ebx*4 + 0x431a54]
movzx ebx, byte [esi + 5]
sub esp, 2
jmp 0x45564f
lea esi, [esi + 0x431254]
mov edx, dword [esi]
pop esi
call fcn.0045569f
xor dword [edx + edx*2 + 0x97bc435], edi
test al, 0xcb
bound ebx, qword [ebp - 0x720d74aa]
xor al, 0xb5
add byte [eax], al
add byte [eax], al
push esi
mov esi, edx
lea esi, [esi*4]
jmp 0x45567a

Function at 0x455754
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov ecx, edi
lea ecx, [ecx*4]
lea ecx, [ecx + 0x431254]
mov edi, dword [ecx]
jmp 0x45576e
shr edi, 0x18
clc
push ecx
jmp 0x455701
lea esp, [esp + 4]
popal
jmp 0x455720
clc
jmp 0x45573a
and edi, ecx
sub esp, 0x16
mov word [esp + 8], di
clc
lea esp, [esp + 2]
jmp 0x4557f3
pop ecx
pushal
mov word [esp + 0x16], di
pop dword [esp + 0x12]
jmp 0x455757
xor edi, dword [ebx*4 + 0x431e54]
sub esp, 0xc
mov ebx, 0x6f4dee74
lea esp, [esp + 0xc]
movzx ebx, byte [esi + 6]
jmp 0x455796
mov edi, dword [edi*4 + 0x431654]
and ebx, ecx
lea esp, [esp + 0x50]
jmp 0x4557b6

Function at 0x45586b
Capabilities:
Encrypt data using aes

Disassembly:
add byte [eax], al
add byte [edi + 0x10e18610], cl
rcl dword [ebx]
lea ebx, [0x9c549764]
out dx, eax
and edx, ecx
sub esp, 0x14
push word [esp + 0x11]
add esp, 0x13
call fcn.00455878
cmc
in al, 0x17
jle 0x4557e2
lea esp, [esp + 1]
and al, 1
lea esp, [esp + 3]
jmp 0x45583e
mov edx, dword [edx*4 + 0x431254]
cmc
sub esp, 8
jmp 0x455854

Function at 0x455878
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 3]
jmp 0x455976
push word [esp + 0x11]
push word [esp + 0x17]
call fcn.004558b1
lea esp, [esp + 0xc]
xor edi, dword [edx*4 + 0x432254]
mov edx, dword [esi + 8]
pushal
jmp 0x455902

Function at 0x4558e8
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push esp
push dword [esp + 4]
pop di
lea esp, [esp + 2]
jmp 0x455938
pushal
mov byte [esp + 7], ch
pushal
mov edi, dword [edi*4 + 0x431254]
jmp 0x455959
and ebx, ecx
lea esp, [esp + 0x74]
xor edi, dword [ebx*4 + 0x431e54]
bswap ebx
jmp 0x455943
mov edi, edx
push esp
mov dword [esp], eax
shr edi, 0x18
jmp 0x455911
rcr ebx, 3
jmp 0x45598a
and edi, ecx
mov edi, dword [edi*4 + 0x431654]
jmp 0x455920
movzx ebx, byte [esi + 0xa]
jmp 0x455ede
Function at 0x455a1e
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x45557b
mov edx, dword [edi]
pop edi
jmp fcn.004554cd
setb dh
shr edx, 5
push edi
mov edi, esi
jmp 0x4554e7
shl di, cl
push esp
lea esp, [esp + 4]
add esi, 0x10
bts edi, ebx
jmp 0x4554fe
movzx ebx, byte [esi + 0x11]
mov di, cx
mov ebx, dword [ebx*4 + 0x431254]
bswap edx
lea edx, [edx + edi]
jmp 0x455560
push eax
jmp 0x455ae0
mov dword [esp + 0x15], esi
lea esp, [esp + 1]
jmp 0x455ab5
mov edi, edx
shr edi, 0x18
sub esp, 4
add esp, 3
pushal
jmp 0x455a4a
mov ebx, dword [eax]
pop eax
push esp
rol di, cl
xchg word [esp + 1], di
jmp 0x455a67
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x431e54]
sub esp, 0x1e
jmp 0x455ac7
mov edi, dword [edi*4 + 0x431254]
and edi, ecx
mov edi, dword [edi*4 + 0x431654]
jmp 0x455a96
mov bl, 0xc8
mov ebx, dword [esp + 0x15]
not bx
lea esp, [esp + 2]
jmp 0x455b33
pushal
mov dword [esp + 0x1c], ebx
popal
lea eax, [eax*4]
lea eax, [eax + 0x431254]
jmp 0x455a88
lea esp, [esp + 0x1c]
movzx ebx, byte [esi + 0xe]
push edx
mov ebx, dword [ebx*4 + 0x431254]
call fcn.00455b1c
jmp 0x455bb7
add byte [eax], al
adc byte [esi - 0x77], ah
cmp al, 0x24
push ecx
jmp 0x455bdf
pushal
mov edx, ecx
mov dword [esp + 0x18], esi
push esp
call fcn.00455bc1
push word [esp + 1]
lea esp, [esp + 0xc]
popal
jmp 0x455c10
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
call 0x455c1c
popal
lea esp, [esp + 8]
jmp 0x455c84
jne 0x4270bd
je 0x426fb1
loopne 0x455d08
in al, 0x83
jle 0x455c55
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
scasb al, byte es:[edi]
push cs
cdq
clc
invalid
push cs
jae 0x455cf4
jns 0x455d25
jmp 0x455d37
dec edi
mov edx, 0x6d721b7b
pop esp
scasd eax, dword es:[edi]
sbb dword [edx - 0x2a], edx
Function at 0x455bba
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x45557b
mov edx, dword [edi]
pop edi
jmp fcn.004554cd
setb dh
shr edx, 5
push edi
mov edi, esi
jmp 0x4554e7
shl di, cl
push esp
lea esp, [esp + 4]
add esi, 0x10
bts edi, ebx
jmp 0x4554fe
movzx ebx, byte [esi + 0x11]
mov di, cx
mov ebx, dword [ebx*4 + 0x431254]
bswap edx
lea edx, [edx + edi]
jmp 0x455560
push eax
jmp 0x455ae0
mov dword [esp + 0x15], esi
lea esp, [esp + 1]
jmp 0x455ab5
mov edi, edx
shr edi, 0x18
sub esp, 4
add esp, 3
pushal
jmp 0x455a4a
mov ebx, dword [eax]
pop eax
push esp
rol di, cl
xchg word [esp + 1], di
jmp 0x455a67
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x431e54]
sub esp, 0x1e
jmp 0x455ac7
mov edi, dword [edi*4 + 0x431254]
and edi, ecx
mov edi, dword [edi*4 + 0x431654]
jmp 0x455a96
mov bl, 0xc8
mov ebx, dword [esp + 0x15]
not bx
lea esp, [esp + 2]
jmp 0x455b33
pushal
mov dword [esp + 0x1c], ebx
popal
lea eax, [eax*4]
lea eax, [eax + 0x431254]
jmp 0x455a88
lea esp, [esp + 0x1c]
movzx ebx, byte [esi + 0xe]
push edx
mov ebx, dword [ebx*4 + 0x431254]
call fcn.00455b1c
jmp 0x455bb7
add byte [eax], al
adc byte [esi - 0x77], ah
cmp al, 0x24
push ecx
jmp 0x455bdf
pushal
mov edx, ecx
mov dword [esp + 0x18], esi
push esp
call fcn.00455bc1
push word [esp + 1]
lea esp, [esp + 0xc]
popal
jmp 0x455c10
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
call 0x455c1c
popal
lea esp, [esp + 8]
jmp 0x455c84
jne 0x4270bd
je 0x426fb1
loopne 0x455d08
in al, 0x83
jle 0x455c55
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
scasb al, byte es:[edi]
push cs
cdq
clc
invalid
push cs
jae 0x455cf4
jns 0x455d25
jmp 0x455d37
dec edi
mov edx, 0x6d721b7b
pop esp
scasd eax, dword es:[edi]
sbb dword [edx - 0x2a], edx
Function at 0x455c1c
Capabilities:
Encrypt data using aes

Disassembly:
jmp 0x45557b
mov edx, dword [edi]
pop edi
jmp fcn.004554cd
setb dh
shr edx, 5
push edi
mov edi, esi
jmp 0x4554e7
shl di, cl
push esp
lea esp, [esp + 4]
add esi, 0x10
bts edi, ebx
jmp 0x4554fe
movzx ebx, byte [esi + 0x11]
mov di, cx
mov ebx, dword [ebx*4 + 0x431254]
bswap edx
lea edx, [edx + edi]
jmp 0x455560
push eax
jmp 0x455ae0
mov dword [esp + 0x15], esi
lea esp, [esp + 1]
jmp 0x455ab5
mov edi, edx
shr edi, 0x18
sub esp, 4
add esp, 3
pushal
jmp 0x455a4a
mov ebx, dword [eax]
pop eax
push esp
rol di, cl
xchg word [esp + 1], di
jmp 0x455a67
and ebx, ecx
lea esp, [esp + 0x4c]
xor edi, dword [ebx*4 + 0x431e54]
sub esp, 0x1e
jmp 0x455ac7
mov edi, dword [edi*4 + 0x431254]
and edi, ecx
mov edi, dword [edi*4 + 0x431654]
jmp 0x455a96
mov bl, 0xc8
mov ebx, dword [esp + 0x15]
not bx
lea esp, [esp + 2]
jmp 0x455b33
pushal
mov dword [esp + 0x1c], ebx
popal
lea eax, [eax*4]
lea eax, [eax + 0x431254]
jmp 0x455a88
lea esp, [esp + 0x1c]
movzx ebx, byte [esi + 0xe]
push edx
mov ebx, dword [ebx*4 + 0x431254]
call fcn.00455b1c
jmp 0x455bb7
add byte [eax], al
adc byte [esi - 0x77], ah
cmp al, 0x24
push ecx
jmp 0x455bdf
pushal
mov edx, ecx
mov dword [esp + 0x18], esi
push esp
call fcn.00455bc1
push word [esp + 1]
lea esp, [esp + 0xc]
popal
jmp 0x455c10
lea ecx, [ecx + 0xc]
mov dword [ecx], edi
pop ecx
call 0x455c1c
popal
lea esp, [esp + 8]
jmp 0x455c84
jne 0x4270bd
je 0x426fb1
loopne 0x455d08
in al, 0x83
jle 0x455c55
imul edi, ebx, 0xffffff9e
insd dword es:[edi], dx
scasb al, byte es:[edi]
push cs
cdq
clc
invalid
push cs
jae 0x455cf4
jns 0x455d25
jmp 0x455d37
dec edi
mov edx, 0x6d721b7b
pop esp
scasd eax, dword es:[edi]
sbb dword [edx - 0x2a], edx

Function at 0x4568a7
Capabilities:
Encrypt data using aes

Disassembly:
cmp al, 0x2b
call int.00456b7a
ljmp 0xd63b
call fcn.00456941
jmp fcn.00455e76
lea esp, [esp + 4]
jmp 0x45692e
lea esp, [esp + 2]
lea esp, [esp + 1]
jmp 0x45696c
jne 0x455e00
pushal
pop word [esp + 0x15]
lea esp, [esp + 0xb]
jmp 0x4568ff
cmp dl, 0x3d
pushal
push word [esp + 0xd]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
jmp 0x456917
lea esp, [esp + 0x10]
mov dword [edi], 1
jmp 0x455ddc

Function at 0x456adf
Capabilities:
Encrypt data using aes

Disassembly:
jne 0x455e8c
pushal
pop word [esp + 7]
lea esp, [esp + 2]
jmp 0x456aaf
mov word [esp], dx
mov dword [esp], ebp
mov byte [esp + 2], dh
lea esp, [esp + 4]
cmp al, 0x2f
jmp 0x4569f4
lea esp, [esp + 0x1c]
push 0x3f
jmp fcn.00455dac
jmp 0x456a18
Function at 0x456b7a
Capabilities:
Encrypt data using aes

Disassembly:
pop dword [esp]
call fcn.00456adf
add eax, 0xa455329c
sbb esi, dword [ebp - 0x17]
jns 0x455dea
jmp 0x455e2d
enter 0xfffffffffffff363, 0xffffffffffffff96
mov eax, dword gs:[0x4cde5d26]
sub esp, esi
push esi
lodsd eax, dword [esi]
xor esp, dword [ebx - 0x497eca3a]
mov eax, dword [0xb3ce8]
add bl, ch
outsd dx, dword [esi]
call [edx - 0x7ffc3d97]
push ss
jno 0x455d90
xor byte [ebp - 0x6e99e074], bh
jecxz 0x455e7a
invalid
salc
and ebx, dword [edx - 0x4b]
movsb byte es:[edi], byte [esi]
xlatb
jae 0x455e3d
xchg ebx, eax
add esp, dword [esi - 0x6b]
and edx, dword [esi + 0x3a83c001]
or dword ds:[eax - 0x17629d35], ebp
or byte [eax + eax], 0
bound ebx, qword [ebp + 0xc82e8]
add byte [ecx + ebx*4], cl
or al, 0x99
or dword [eax - 0x65], ebp
pop esp
outsb dx, byte [esi]
cli
push 0x5b4afa0f
mov dl, 0xad
mov esp, 0xfc6ee88f
wait
jbe 0x455e1b
cli
adc dword [ebx], 0x76
test dword [edi], esi
invalid
mov ah, byte [0x24b63254]
inc ebx
mov esi, 0x3bab200d
pop esi
lodsd eax, dword [esi]
sbb cl, byte [esi - 0x27]
cmp byte [edx - 0x18], dl
cdq
or eax, dword [eax]
add ch, dl
hlt
push esp
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 4]
push 0x3e
jmp fcn.00455dac
lea esp, [esp + 4]
jne 0x455dc3
je 0x456b26
lea esp, [esp + 4]
push esi
call fcn.00456bb1
iretd

Function at 0x52c1e8
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
push word [esp + 3]
call 0x52c1e8
sbb byte [edx + 0x70926700], dl
lcall 0xab8, 0x11e28717
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
mov dword [esp], eax
push dword [esp]
lea esp, [esp + 7]
lea esp, [esp]
call fcn.0052c193
pop word [esp + 3]
push dword [esp + 6]
invalid
je 0x52c1f9
push es
mov dword [esp + 0x18], ebx
call 0x52c1ea
jns 0x52c1cb
mov byte [ebx - 0x53], bh
fdivr dword [ebx]
adc ch, bl
jecxz 0x52c1d3
add byte ds:[eax], al
add byte [esi - 1], ah
je 0x52c217
add al, 0x8d
and al, 3
mov dword [esp + 0x18], esp
and al, 0x18
call 0x52c20c
lea ebx, [edi + ebp*2]
jbe 0x52c267
mov al, byte [0xeb240489]
scasd eax, dword es:[edi]
call fcn.0052c23a
mov dword [esp], esi
mov byte [esp + 1], dh
mov word [esp], dx
add dword [esi - 0x77], esp
adc al, 0x24
mov byte [esp + 1], dh
pop word [esp]
push esp
jmp 0x52c248
push esp
push esp
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
pushal
mov byte [esp + 0x14], ch
jmp 0x52c28e
pushfd
invalid
push dword [esp + 0xe]
mov word [esp + 0x1e], sp
call fcn.0052c26b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x52b04d
Function at 0x52c1ea
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
push word [esp + 3]
call 0x52c1e8
sbb byte [edx + 0x70926700], dl
lcall 0xab8, 0x11e28717
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
mov dword [esp], eax
push dword [esp]
lea esp, [esp + 7]
lea esp, [esp]
call fcn.0052c193
pop word [esp + 3]
push dword [esp + 6]
invalid
je 0x52c1f9
push es
mov dword [esp + 0x18], ebx
call 0x52c1ea
jns 0x52c1cb
mov byte [ebx - 0x53], bh
fdivr dword [ebx]
adc ch, bl
jecxz 0x52c1d3
add byte ds:[eax], al
add byte [esi - 1], ah
je 0x52c217
add al, 0x8d
and al, 3
mov dword [esp + 0x18], esp
and al, 0x18
call 0x52c20c
lea ebx, [edi + ebp*2]
jbe 0x52c267
mov al, byte [0xeb240489]
scasd eax, dword es:[edi]
call fcn.0052c23a
mov dword [esp], esi
mov byte [esp + 1], dh
mov word [esp], dx
add dword [esi - 0x77], esp
adc al, 0x24
mov byte [esp + 1], dh
pop word [esp]
push esp
jmp 0x52c248
push esp
push esp
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
pushal
mov byte [esp + 0x14], ch
jmp 0x52c28e
pushfd
invalid
push dword [esp + 0xe]
mov word [esp + 0x1e], sp
call fcn.0052c26b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x52b04d

Function at 0x52c207
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
push word [esp + 3]
call 0x52c1e8
sbb byte [edx + 0x70926700], dl
lcall 0xab8, 0x11e28717
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
mov dword [esp], eax
push dword [esp]
lea esp, [esp + 7]
lea esp, [esp]
call fcn.0052c193
pop word [esp + 3]
push dword [esp + 6]
invalid
je 0x52c1f9
push es
mov dword [esp + 0x18], ebx
call 0x52c1ea
jns 0x52c1cb
mov byte [ebx - 0x53], bh
fdivr dword [ebx]
adc ch, bl
jecxz 0x52c1d3
add byte ds:[eax], al
add byte [esi - 1], ah
je 0x52c217
add al, 0x8d
and al, 3
mov dword [esp + 0x18], esp
and al, 0x18
call 0x52c20c
lea ebx, [edi + ebp*2]
jbe 0x52c267
mov al, byte [0xeb240489]
scasd eax, dword es:[edi]
call fcn.0052c23a
mov dword [esp], esi
mov byte [esp + 1], dh
mov word [esp], dx
add dword [esi - 0x77], esp
adc al, 0x24
mov byte [esp + 1], dh
pop word [esp]
push esp
jmp 0x52c248
push esp
push esp
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
pushal
mov byte [esp + 0x14], ch
jmp 0x52c28e
pushfd
invalid
push dword [esp + 0xe]
mov word [esp + 0x1e], sp
call fcn.0052c26b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x52b04d
Function at 0x52c20c
Capabilities:
Parse pe header

Disassembly:
push dword [esp]
push word [esp + 3]
call 0x52c1e8
sbb byte [edx + 0x70926700], dl
lcall 0xab8, 0x11e28717
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
mov dword [esp], eax
push dword [esp]
lea esp, [esp + 7]
lea esp, [esp]
call fcn.0052c193
pop word [esp + 3]
push dword [esp + 6]
invalid
je 0x52c1f9
push es
mov dword [esp + 0x18], ebx
call 0x52c1ea
jns 0x52c1cb
mov byte [ebx - 0x53], bh
fdivr dword [ebx]
adc ch, bl
jecxz 0x52c1d3
add byte ds:[eax], al
add byte [esi - 1], ah
je 0x52c217
add al, 0x8d
and al, 3
mov dword [esp + 0x18], esp
and al, 0x18
call 0x52c20c
lea ebx, [edi + ebp*2]
jbe 0x52c267
mov al, byte [0xeb240489]
scasd eax, dword es:[edi]
call fcn.0052c23a
mov dword [esp], esi
mov byte [esp + 1], dh
mov word [esp], dx
add dword [esi - 0x77], esp
adc al, 0x24
mov byte [esp + 1], dh
pop word [esp]
push esp
jmp 0x52c248
push esp
push esp
lea esp, [esp + 2]
mov dword [esp + 0x20], ebp
pushal
mov byte [esp + 0x14], ch
jmp 0x52c28e
pushfd
invalid
push dword [esp + 0xe]
mov word [esp + 0x1e], sp
call fcn.0052c26b
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0x52b04d

Function at 0x52c23a
Capabilities:
Parse pe header

Disassembly:
lea esp, [esp + 3]
push word [esp]
lea esp, [esp + 3]
jmp 0x52c211

Function at 0x52c262
Capabilities:
Parse pe header

Disassembly:
mov dword [esp + 0x10], eax
call 0x52c207
Function at 0x52c26b
Capabilities:
Parse pe header

Disassembly:
call fcn.00525a18
push 0xf8096ef8
pop edi
inc esi
aad 0x45
sub al, 0xdf
sub al, 0xd0
inc esi
aam 0xb3
dec esi
sti
ja 0x525ab0
test eax, 0x8b58fb81
lcall 0x8385, 0xf5c7437
idiv edi
invalid
in al, dx
bound eax, qword [0xf97820f4]
js 0x525aab
imul ecx, dword [eax], 0xbb581ffb
sub esp, 0xe
mov byte [esp + 5], dh
call fcn.00528edc
add esp, 3
pop word [esp + 3]
lea esp, [esp + 2]
mov dword [esp + 3], ebx
jmp 0x528ec5
pushal
push dword [esp + 0x16]
pop dword [esp + 2]
sub esp, 8
lea esp, [esp + 0x28]
stc
jmp 0x528e90
xchg bl, bh
sub esp, 0x18
clc
mov ebx, 0xc176189a
xchg dword [esp + 7], ebx
jmp 0x528f4d
inc dword [eax + 0x41f01c]
pushfd
stc
stc
cld
jmp 0x528eb2
push esp
sub ebp, eax
pop word [esp]
xchg word [esp], bp
xchg byte [esp], bl
pop bp
jmp 0x528f33
push dword [esp + 0x14]
lea esp, [esp + 2]
mov dword [esp + 6], ebp
mov bl, bh
mov bp, sp
mov bl, bh
jmp 0x528eff
cmc
push esp
bsf bp, si
pop ebx
cmc
mov dword [esp + 1], edi
jmp 0x528f7b
push word [esp + 0x11]
clc
xchg bl, bh
mov bx, word [esp + 0x12]
inc bx
xchg bl, bh
jmp 0x528f1e
push esp
cmpsd dword [esi], dword es:[edi]
or al, 0x76
out dx, al
jl 0x528f8c
test byte [ecx + 0x64], 3
xchg ebx, eax
test byte [0x66f14684], 0xf7
xlatb
add eax, 0x66f14684
not edi
not di
xchg edi, ebp
bswap edi
call fcn.00528f60
in al, dx
jb 0x528f6a
xchg dword [edx - 0xb], esi
cmc
ja 0x528f77
xor byte [ecx - 0x55], 0xea
add eax, 0x59cea7b4
push eax
jmp 0x52901d
call 0x529022
jmp 0x52a230
je 0x528ef3
jne 0x52a25f
and ch, byte [ebp + 0x56b7443d]
sub al, 0xbe
sub al, 0x4b
invalid
pop eax
sub eax, 0x529022
cmp dword [eax + 0x41f01c], 0
jmp 0x52a217
lea esp, [esp + 8]
popal
jmp 0x525a39
movzx ebx, word [eax + 0x3c]
jmp 0x52c2d0
mov dword [esp + 0x44], esi
push edx
push word [esp + 3]
push word [esp + 5]
jmp 0x52c2fe
cmp word [eax], 0x5a4d
jmp 0x52c308
add ebx, eax
jmp 0x52c326
mov word [esp + 2], dx
call fcn.0052c2e7
je 0x52b0b7
sub eax, 0x10000
jmp 0x52c2ab
cmp word [ebx], 0x4550
je 0x528f99
jne 0x52c30e
sahf
or bl, byte [eax + 0x3cbc0aff]
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x56c05a1e
xor eax, eax
jle 0x52c343
sar byte [esi - 3], 0xcc
pop edi
cmpsb byte [esi], byte es:[edi]
invalid
push eax
int3

Function at 0x52c2e7
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x52c29c
push edx
mov dword [esp + 0x50], edi
lea esp, [esp + 0x50]
jmp 0x52c2c2