joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4123f1
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448250]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00410f18
mov dword [ebp - 0x14], eax
cmp dword [0x2d4d9b8], esi
jne 0x4124e4
push 0x800
push esi
push 0x4052ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x412471
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4125c4
push esi
push esi
push 0x4052ac
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4125c4
push 0x4052c4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4125c4
push eax
call ebx
push 0x4052d0
push edi
mov dword [0x2d4d9b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4052e0
push edi
mov dword [0x2d4d9bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x4052f4
push edi
mov dword [0x2d4d9c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2d4d9c8], eax
test eax, eax
je 0x4124e1
push 0x405310
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x2d4d9c4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x412509
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4124fc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41251e
push 4
pop eax
jmp 0x4125c6
cmp dword [ebp - 0x14], esi
je 0x41251e
push dword [0x2d4d9b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x412503
mov eax, dword [0x2d4d9c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41257c
cmp dword [0x2d4d9c8], edi
je 0x41257c
push eax
call ebx
push dword [0x2d4d9c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41257c
test eax, eax
je 0x41257c
call ecx
test eax, eax
je 0x412571
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x412571
test byte [ebp - 8], 1
jne 0x41257c
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4125ac
mov eax, dword [0x2d4d9bc]
cmp eax, edi
je 0x4125a9
push eax
call ebx
test eax, eax
je 0x4125a9
call eax
mov esi, eax
test esi, esi
je 0x4125a9
mov eax, dword [0x2d4d9c0]
cmp eax, edi
je 0x4125a9
push eax
call ebx
test eax, eax
je 0x4125a9
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x2d4d9b8]
call ebx
test eax, eax
je 0x4125c4
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4125c6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b3ae
mov esp, ebp
pop ebp
ret
Function at 0x428520
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x42854f
test cl, 7
je 0x42854f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4f82d0]
dec esi
inc ecx
test esi, esi
ja 0x428532
cmp esi, 8
jb 0x4285e8
mov edi, esi
push ebx
shr edi, 3
push ebp
nop
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + 0x4f86d0]
mov dword [esp + 0x14], ecx
mov ebp, edx
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x4f82d0]
mov ecx, edx
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f8ad0]
mov ebp, eax
shr ebp, 0x18
xor ebx, dword [ebp*4 + 0x4f92d0]
mov ecx, eax
shr ecx, 0x10
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f96d0]
mov ecx, eax
shr ecx, 8
movzx ebp, cl
xor ebx, dword [ebp*4 + 0x4f9ad0]
mov ecx, dword [esp + 0x14]
movzx edx, dl
xor ebx, dword [edx*4 + 0x4f8ed0]
movzx eax, al
xor ebx, dword [eax*4 + 0x4f9ed0]
sub esi, 8
add ecx, 8
sub edi, 1
mov eax, ebx
jne 0x428560
pop ebp
pop ebx
test esi, esi
jbe 0x428608
lea esp, [esp]
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4f82d0]
dec esi
inc ecx
test esi, esi
ja 0x4285f0
pop edi
pop esi
ret 0xc

Function at 0x428a50
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x6ec]
push eax
call fcn.004283d0
mov edi, dword [esp + 0xc]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x428a70
sub eax, edx
push eax
push edi
push 0xffffffffffffffff
call fcn.00428520
mov word [esi + 0xc00], ax
shr eax, 0x10
xor ecx, ecx
xor edx, edx
mov word [esi + 0xc02], ax
mov word [esi + 0xc06], cx
mov word [esi + 0xc04], dx
mov al, byte [edi]
test al, al
je 0x428ae6
mov edx, edi
lea ecx, [ecx]
movzx ecx, al
mov di, word [esi + ecx*4 + 0x6ec]
lea ecx, [esi + ecx*4 + 0x6ec]
movzx ax, al
xor di, ax
xor word [esi + 0xc04], di
mov cx, word [ecx + 2]
add cx, ax
add word [esi + 0xc06], cx
mov al, byte [edx + 1]
inc edx
test al, al
jne 0x428ab0
pop edi
pop esi
ret 4
Function at 0x429100
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x1d8
mov eax, dword [0x4ec0b4]
xor eax, esp
mov dword [esp + 0x1d4], eax
mov eax, dword [esp + 0x1ec]
push ebx
mov ebx, dword [esp + 0x1e8]
push esi
mov esi, dword [esp + 0x1e8]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0xc], eax
cmp esi, 0x40
jbe 0x429179
lea ecx, [esp + 0xf0]
push ecx
call fcn.0047eb80
push esi
push edi
lea edx, [esp + 0xf8]
push edx
call fcn.0047f030
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0xf4]
push ecx
call fcn.0047f0e0
lea edi, [esp + 0x1a0]
mov esi, 0x20
xor eax, eax
test esi, esi
jbe 0x4291a5
push ebp
mov ebp, edi
lea edx, [esp + 0x164]
sub ebp, edx
jmp 0x429190
lea ecx, [esp + eax + 0x164]
mov dl, byte [ecx + ebp]
xor dl, 0x36
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x429190
pop ebp
cmp esi, 0x40
jae 0x4291c4
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x36
push eax
call fcn.004c2670
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call fcn.0047eb80
push 0x40
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.0047f030
mov edx, dword [esp + 0x1f4]
push edx
push ebx
lea eax, [esp + 0x18]
push eax
call fcn.0047f030
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0047f0e0
lea eax, [esp + 0x80]
push eax
call fcn.0047eb80
xor eax, eax
test esi, esi
jbe 0x429237
lea ecx, [esp + 0x160]
sub edi, ecx
lea ecx, [esp + eax + 0x160]
mov dl, byte [edi + ecx]
xor dl, 0x5c
inc eax
mov byte [ecx], dl
cmp eax, esi
jb 0x429223
cmp esi, 0x40
jae 0x429256
mov ecx, 0x40
sub ecx, esi
push ecx
lea eax, [esp + esi + 0x164]
push 0x5c
push eax
call fcn.004c2670
add esp, 0xc
push 0x40
lea edx, [esp + 0x164]
push edx
lea eax, [esp + 0x88]
push eax
call fcn.0047f030
push 0x20
lea ecx, [esp + 0x1c4]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.0047f030
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x84]
push ecx
call fcn.0047f0e0
mov ecx, dword [esp + 0x1e0]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004c1c22
add esp, 0x1d8
ret 0x14

Function at 0x4531a2
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
je 0x4531b6
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x4531b2
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
sete dl
mov eax, edx
pop ebp
ret

Function at 0x465a10
Capabilities:
Encode data using xor

Disassembly:
xor byte [edi], 2
add dword [ebx], ecx
xor dword [esi], ecx
xor byte [esi + eax], cl
or ch, byte [ebx]
push es
add dword [ecx + eax], eax
xor byte [edi], 2
add dword [0x9062330], edx
sub al, byte [esi + 0xdf78648]
add dword [ecx], ecx
add al, 0x31
push ss
add al, 0x14
adc edx, ecx
sbb dword [ebx + 0x2dca8a13], eax
sahf
mov al, 0x2b
dec eax
dec ebx
sar byte [esi - 0x1b], 0xfa
loope 0x465a1c
mov eax, 0x9060d30
sub al, byte [esi + 0xdf78648]
add dword [ecx], eax
add dword [0x1820400], eax
add byte [ebx], dh
Function at 0x47fbe0
Capabilities:
Encode data using xor

Disassembly:
cmp edi, dword [edx]
jne 0x47fbe5
inc edi
xor ecx, ecx
cmp eax, ebp
jl 0x47fb9a
cmp edi, dword [edx]
jg 0x47fd89
mov dword [esp + 0x10], 0x450d68
movzx esi, byte [esp + ebp*4 + 0x11]
mov al, byte [esp + 0x14]
xor al, byte [esi + 0x450e88]
mov byte [esp + 0x14], al
movzx esi, byte [esp + ebp*4 + 0x12]
movzx ebx, byte [esi + 0x450e88]
xor byte [esp + 0x15], bl
movzx esi, byte [esp + ebp*4 + 0x13]
adc ecx, dword [edi]
mov dh, 0x9e
mov byte [esi], cl
inc ebp
add byte [eax], dh
pop esp
and al, 0x16
movzx esi, byte [esp + ebp*4 + 0x10]
movzx ebx, byte [esi + 0x450e88]
mov esi, dword [esp + 0x10]
xor al, byte [esi]
xor byte [esp + 0x17], bl
inc esi
mov byte [esp + 0x14], al
mov dword [esp + 0x10], esi
cmp ebp, 8
je 0x47fc90
cmp ebp, 1
jle 0x47fd2b
lea eax, [esp + 0x15]
lea esi, [ebp - 1]
jmp 0x47fc68
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x47fc68
jmp 0x47fd2b
lea eax, [esp + 0x15]
mov esi, 3
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x47fc99
movzx eax, byte [esp + 0x20]
movzx eax, byte [eax + 0x450e88]
xor byte [esp + 0x24], al
movzx eax, byte [esp + 0x21]
movzx eax, byte [eax + 0x450e88]
xor byte [esp + 0x25], al
movzx eax, byte [esp + 0x22]
movzx eax, byte [eax + 0x450e88]
xor byte [esp + 0x26], al
movzx eax, byte [esp + 0x23]
movzx eax, byte [eax + 0x450e88]
xor byte [esp + 0x27], al
lea eax, [esp + 0x25]
mov esi, 3
lea ecx, [ecx]
movzx ebx, byte [eax - 1]
xor byte [eax + 3], bl
movzx ebx, byte [eax]
xor byte [eax + 4], bl
movzx ebx, byte [eax + 1]
xor byte [eax + 5], bl
movzx ebx, byte [eax + 2]
xor byte [eax + 6], bl
add eax, 4
sub esi, 1
jne 0x47fd08
xor eax, eax
test ebp, ebp
jle 0x47fd81
lea esp, [esp]
cmp edi, dword [edx]
jg 0x47fd89
cmp eax, ebp
jge 0x47fd75
cmp ecx, 4
jge 0x47fd78
movzx ebx, byte [esp + eax*4 + 0x14]
lea esi, [ecx + edi*4]
mov byte [edx + esi*4 + 0x14], bl
movzx ebx, byte [esp + eax*4 + 0x15]
lea esi, [ecx + edi*4]
lea esi, [edx + esi*4]
mov byte [esi + 0x15], bl
movzx ebx, byte [esp + eax*4 + 0x16]
mov dh, 0x5c
test byte [esi], dl
mov byte [esi + 0x16], bl
movzx ebx, byte [esp + eax*4 + 0x17]
inc eax
inc ecx
cmp eax, ebp
mov byte [esi + 0x17], bl
jl 0x47fd40
cmp ecx, 4
jne 0x47fd7d
inc edi
xor ecx, ecx
cmp eax, ebp
jl 0x47fd38
cmp edi, dword [edx]
jle 0x47fbf9

Function at 0x480120
Capabilities:
Encode data using xor

Disassembly:
push 0xc10044f5
ljmp 0x1c33
Function at 0x4810f5
Capabilities:
Encode data using xor

Disassembly:
sub edx, eax
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x1c]
mov edi, dword [edi + eax]
mov edi, dword [ecx + edi*4]
add edi, dword [ecx + ebp*4]
mov ecx, dword [esi]
mov ecx, dword [ecx + edi*4]
xor dword [eax], ecx
mov ecx, dword [esi + 4]
mov edi, dword [esp + 0x2c]
mov edi, dword [edi + eax]
mov edi, dword [ecx + edi*4]
add edi, dword [ecx + ebp*4]
mov ecx, dword [esi]
mov ecx, dword [ecx + edi*4]
or al, 0xb9
xor dword [edx + eax], ecx
mov edi, dword [esi + 0xc]
jle 0x481109
inc ebx
add eax, 4
cmp ebx, edi
jb 0x4810cb
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
inc eax
mov dword [esp + 0x18], eax
cmp eax, dword [esi + 0x14]
jb 0x48108b

Function at 0x483c28
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ebx + 0x1c]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
xor ecx, ecx
lea ecx, [ecx]

Function at 0x4b4369
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push es
add byte [eax + eax*8 + 0x1c685175], al
mov byte [ebp], cl
push edi
call 0x5145e6
test al, al
jne 0x4b43c0
push 0x4d8814
push edi
call 0x5145f5
test al, al
jne 0x4b43ba
mov eax, edi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4b4392
mov ecx, dword [0x4d8808]
mov dword [eax], ecx
mov edx, dword [0x4d880c]
mov dword [eax + 4], edx
mov cx, word [0x4d8810]
mov word [eax + 8], cx
push edi
call 0x5159cc
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6198], 0
je 0x4b43d2
push edi
call 0x4f12fe
xor eax, eax
mov word [esp + 0x2d7dc], ax
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
xor ecx, ecx
or edx, dword [eax + 0x6164]
mov word [esp + 0x2dc5c], cx
and al, 0x5c
fadd qword [edx]
invalid
je 0x4b4400
mov byte [ebx + 0x18f8], 1
jmp 0x4b4407
and dword [eax + 0x6148], 0xffffffe7
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6189]
mov edx, dword [eax + 0x615c]
push 1
push ecx
push edx
add eax, 0xc41c
push eax
lea ecx, [esp + 0x1b0c4]
add dh, al
inc esp
and al, 0x26
add al, ch
fdivr qword [edx + 7]
add byte [ebx], dh
dec dword [ecx - 0x138fdb44]
add al, byte [eax]
mov eax, dword [esp + 0x34]
push 0x800
push eax
lea ecx, [esp + 0x1e0e0]
push ecx
call 0x53342e
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x31bc]
mov dword [esp + 0x1f0d8], eax
call 0x536764
lea ecx, [esp + 0x31c4]
call 0x536770
lea ecx, [esp + 0x31cc]
call 0x53677c
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0xc8]
call fcn.004ba83c
Function at 0x4b4427
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push es
add byte [eax + eax*8 + 0x1c685175], al
mov byte [ebp], cl
push edi
call 0x5145e6
test al, al
jne 0x4b43c0
push 0x4d8814
push edi
call 0x5145f5
test al, al
jne 0x4b43ba
mov eax, edi
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, si
jne 0x4b4392
mov ecx, dword [0x4d8808]
mov dword [eax], ecx
mov edx, dword [0x4d880c]
mov dword [eax + 4], edx
mov cx, word [0x4d8810]
mov word [eax + 8], cx
push edi
call 0x5159cc
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6198], 0
je 0x4b43d2
push edi
call 0x4f12fe
xor eax, eax
mov word [esp + 0x2d7dc], ax
mov eax, dword [ebx + 0x38]
mov edx, dword [eax + 0x6160]
xor ecx, ecx
or edx, dword [eax + 0x6164]
mov word [esp + 0x2dc5c], cx
and al, 0x5c
fadd qword [edx]
invalid
je 0x4b4400
mov byte [ebx + 0x18f8], 1
jmp 0x4b4407
and dword [eax + 0x6148], 0xffffffe7
mov eax, dword [ebx + 0x38]
movzx ecx, byte [eax + 0x6189]
mov edx, dword [eax + 0x615c]
push 1
push ecx
push edx
add eax, 0xc41c
push eax
lea ecx, [esp + 0x1b0c4]
add dh, al
inc esp
and al, 0x26
add al, ch
fdivr qword [edx + 7]
add byte [ebx], dh
dec dword [ecx - 0x138fdb44]
add al, byte [eax]
mov eax, dword [esp + 0x34]
push 0x800
push eax
lea ecx, [esp + 0x1e0e0]
push ecx
call 0x53342e
mov eax, dword [ebx + 0x38]
lea ecx, [esp + 0x31bc]
mov dword [esp + 0x1f0d8], eax
call 0x536764
lea ecx, [esp + 0x31c4]
call 0x536770
lea ecx, [esp + 0x31cc]
call 0x53677c
mov edx, dword [ebx + 0x38]
push edx
lea ecx, [esp + 0xc8]
call fcn.004ba83c

Function at 0x4b449f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x2ec70], 1
mov eax, dword [ebx + 0x38]
cmp word [eax + 0x73b0], di
jae 0x4b44a1
add byte [ebp + 0x73b0b0], cl
invalid
je 0x4b4512
push 0x50
lea eax, [esp + 0x58]
push edi
push eax
call 0x575f23
add esp, 0xc
lea ecx, [esp + 0x44]
mov dword [esp + 0x54], esi
mov dword [esp + 0x80], 2
mov dword [esp + 0x9c], 0xffffffff
call 0x5367d9
lea edx, [esp + 0x21ac]
push edx
lea ecx, [esp + 0x1b0b8]
call 0x52c8a2
test eax, eax
jne 0x4b468d
or esi, 0xffffffff
Function at 0x4b453a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x130]
mov edx, dword [esp + 0x34]
and al, 0x34
push edi
push eax
lea ecx, [esp + 0x21b4]
push ecx
push edx
mov ecx, ebx
call fcn.004b4eca
test al, al
je 0x4b4671
push 0x50
lea eax, [esp + 0x58]
push 0
push eax
call 0x575fd0
mov eax, dword [esp + 0x31bc]
mov edx, dword [esp + 0x31b8]
lea ecx, [esp + 0x21b8]
mov dword [esp + 0x60], ecx
mov ecx, dword [esp + 0x31c0]
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x31c4]
or byte [esp + 0x22], ah
mov dword [esp + 0x70], ecx
add esp, 0xc
lea ecx, [esp + 0x31bc]
mov dword [esp + 0x5c], edx
mov byte [esp + 0xa0], al
mov byte [esp + 0xa1], ah
call 0x5367e4
lea ecx, [esp + 0x31cc]
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], edx
call 0x5367f8
mov ecx, dword [ebx + 0x38]
cmp byte [ecx + 0xf782454], cl
mov bh, 0x94
and al, 0xd4
loopne 0x4b45db
invalid
add byte [ecx - 0x728bdbbc], cl
test byte [esp + ebp*4], ah
and dword [eax], eax
add byte [eax - 0x77], dl
xchg esp, eax
and al, 0x80
add byte [eax], al
add bh, al
test byte [esp + eax*4], ah
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [ecx + 0xa024b4], cl
add byte [eax], al
mov dword [esp + 0x74], eax
lea eax, [esp + 0x21ac]
push eax
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 2
mov dword [esp + 0xa0], esi
call fcn.004d49d1
test al, al
je 0x4b4611
or dword [esp + 0x94], 1
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0xc48c], 0
jbe 0x4b4655
push 0x800
lea ecx, [esp + 0x1188]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
call fcn.004b50f1
mov eax, dword [esp + 0x31b8]
push 0
push 0
push eax
lea ecx, [esp + 0x1190]
push ecx
mov ecx, dword [ebx + 0x38]
call fcn.004d531d
test al, al
jne 0x4b4671
lea edx, [esp + 0x54]
push edx
lea ecx, [esp + 0xc8]
call fcn.004ba5b2
cmp byte [esp + 0x31b8], 0
jne 0x4b4671
inc edi
lea eax, [esp + 0x21ac]
push eax
lea ecx, [esp + 0x1b0b8]
invalid
jl 0x4b4606
pop es

Function at 0x4b4a2b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.004ba9cc
cmp dword [eax + 0x2c], edi
jne 0x4b4bd1
inc esi
cmp esi, dword [esp + 0x130]
jb 0x4b4a23
Function at 0x4b50ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x4b50fa
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], al
jne 0x4b5101
mov byte [esp + 0x28], 0
jmp 0x4b511a

Function at 0x4b50f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
je 0x4b50fa
mov edx, dword [ebx + 0x38]
cmp byte [edx + 0x6189], al
jne 0x4b5101
mov byte [esp + 0x28], 0
jmp 0x4b511a

Function at 0x4b510a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [ebx + 0x38]
cmp dword [eax + 0x6158], 1
je 0x4b5db7

Function at 0x4b5170
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc dword [eax], eax
add byte [ecx], al
add byte [eax], al
add byte [edx - 0x7bd7dbb4], cl
leave

Function at 0x4b5374
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [eax + edx*8], fs
add byte [eax], al
add bh, al
test byte [eax + ebx*4], ah
cmpsd dword [esi], dword es:[edi]
add byte [eax], al
add eax, 0xe8000000
pushfd
pop edi
add byte [eax], al
Function at 0x4b59f5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x155fc]
jmp 0x4b5a05

Function at 0x4b5bed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [eax + eax*2], ah
adc dword [eax], eax
add byte [ebx + 0x20005f8], cl
add byte [eax], al

Function at 0x4b5d61
Capabilities:
Resolve function by parsing pe exports

Disassembly:
and eax, 0x7e890000
or byte [ecx + 0x2feb047e], cl

Function at 0x4b5dbf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea ecx, [esp + 0x1184]
call 0x4f1307

Function at 0x4b5dcf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [esp + 0x130]
jb 0x4b4ff0
mov esi, dword [esp + 0xa8]

Function at 0x4b875a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc al, 0x89
je 0x4b8782
cmp al, 0x33
xor al, 0x95
dec eax
int1
dec esi
add byte [ebx - 0x1b8fcc2f], cl
shr edx, 8
movzx edx, dl
mov dword [esp + 0x24], esi
mov esi, dword [edx*4 + 0x4ef548]
mov edx, ebx
shr edx, 0x10
movzx edx, dl
mov dh, 0xd2
mov edx, dword [edx*4 + 0x4ef948]
shr edi, 0x18
xor esi, dword [edi*4 + 0x4efd48]
shr ebx, 8
mov dword [esp + 0x3c], esi
xor dword [esp + 0x3c], edx
movzx edx, byte [esp + 0x18]
mov esi, dword [esp + 0x3c]
xor esi, dword [edx*4 + 0x4ef148]
mov edx, dword [esp + 0x18]
xor esi, dword [eax - 0x18]
invalid
inc esp

Function at 0x4b881f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
dec eax
cmc
dec esi
add byte [edi], cl
mov dh, 0x4c
and al, 0x20
xor ebx, dword [ecx*4 + 0x4ef148]
mov ecx, edx
xor ebx, dword [eax - 0x10]
shr ecx, 0x10
invalid
invalid
Function at 0x4b8c96
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ebx, 8
movzx edi, bl
xor esi, dword [edi*4 + 0x4ef548]
mov ebx, dword [esp + 0x2c]
mov edi, ecx
shr edi, 0x18
xor esi, dword [edi*4 + 0x4efd48]
movzx edi, dl
xor esi, dword [edi*4 + 0x4ef148]
shr ebx, 8
xor esi, dword [eax + 0x34]
mov edi, edx
mov dword [esp + 0x14], esi
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef548]
shr edi, 0x18
xor esi, dword [edi*4 + 0x4efd48]
movzx edi, byte [esp + 0x28]
mov dword [esp + 0x3c], esi
mov ebx, ecx
shr ebx, 0x10
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef948]
xor dword [esp + 0x3c], esi
mov esi, dword [esp + 0x3c]
xor esi, dword [edi*4 + 0x4ef148]
xor esi, dword [eax + 0x38]
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x28]
shr esi, 0x18
shr edx, 0x10
mov esi, dword [esi*4 + 0x4efd48]
mov edi, dword [esp + 0x18]
movzx edx, dl
xor esi, dword [edx*4 + 0x4ef948]
movzx edx, byte [esp + 0x2c]
shr ecx, 8
movzx ecx, cl
xor esi, dword [ecx*4 + 0x4ef548]
mov ebx, dword [esp + 0x10]
xor esi, dword [edx*4 + 0x4ef148]
mov edx, edi
xor esi, dword [eax + 0x3c]
shr edx, 0x10
mov ecx, esi
movzx edx, dl
shr ecx, 0x18
mov ecx, dword [ecx*4 + 0x4efd48]
xor ecx, dword [edx*4 + 0x4ef948]
mov edx, dword [esp + 0x14]
shr edx, 8
movzx edx, dl
xor ecx, dword [edx*4 + 0x4ef548]
movzx edx, bl
xor ecx, dword [edx*4 + 0x4ef148]
mov edx, esi
xor ecx, dword [eax + 0x40]
mov dword [esp + 0x1c], esi
shr edx, 0x10
movzx edx, dl
mov edx, dword [edx*4 + 0x4ef948]
mov dword [esp + 0x34], ecx
mov ecx, edi
mov edi, dword [esp + 0x14]
shr ebx, 0x18
Function at 0x4b8da3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
shr ecx, 8
movzx esi, cl
xor edx, dword [esi*4 + 0x4ef548]
movzx esi, byte [esp + 0x14]
xor edx, dword [ebx*4 + 0x4efd48]
mov ebx, dword [esp + 0x1c]
xor edx, dword [esi*4 + 0x4ef148]
shr ebx, 8
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef548]
mov ebx, dword [esp + 0x10]
shr edi, 0x18
xor esi, dword [edi*4 + 0x4efd48]
movzx edi, byte [esp + 0x18]
mov dword [esp + 0x3c], esi
shr ebx, 0x10
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef948]
xor dword [esp + 0x3c], esi
mov esi, dword [esp + 0x3c]
xor esi, dword [edi*4 + 0x4ef148]
mov ebx, dword [esp + 0x14]
xor esi, dword [eax + 0x48]
xor edx, dword [eax + 0x44]
mov dword [esp + 0x28], esi
mov esi, dword [esp + 0x18]
shr esi, 0x18
mov esi, dword [esi*4 + 0x4efd48]
shr ebx, 0x10
movzx edi, bl
xor esi, dword [edi*4 + 0x4ef948]
mov ebx, dword [esp + 0x10]
movzx edi, byte [esp + 0x1c]
mov dword [esp + 0x3c], esi
shr ebx, 8
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef548]
xor dword [esp + 0x3c], esi
mov esi, dword [esp + 0x3c]
xor esi, dword [edi*4 + 0x4ef148]
mov ebx, dword [esp + 0x28]
xor esi, dword [eax + 0x4c]
mov dword [esp + 0x2c], esi
shr esi, 0x18
mov esi, dword [esi*4 + 0x4efd48]
shr ebx, 0x10
movzx edi, bl
xor esi, dword [edi*4 + 0x4ef948]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x3c], esi
mov ebx, edx
shr ebx, 8
movzx edi, bl
xor esi, dword [edi*4 + 0x4ef548]
mov ebx, dword [esp + 0x2c]
movzx edi, cl
xor esi, dword [edi*4 + 0x4ef148]
shr ebx, 0x10
xor esi, dword [eax + 0x50]
mov dword [esp + 0x10], esi
movzx esi, bl
mov esi, dword [esi*4 + 0x4ef948]
mov ebx, dword [esp + 0x28]
shr ebx, 8
movzx edi, bl
xor esi, dword [edi*4 + 0x4ef548]
mov ebx, dword [esp + 0x2c]
mov edi, ecx
invalid

Function at 0x4b8ecc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
out dx, eax
sbb byte [ebx], dh
xor al, 0xbd
dec eax
std
dec esi
add byte [edi], cl
mov dh, 0xfa

Function at 0x4b8fed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dh, 0xf3
mov esi, dword [esi*4 + 0x4ef548]
mov ebx, dword [esp + 0x10]