joyce8/EMBER2024-capa huggingface dataset:
Function at 0x501828fc
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax], al
add byte [eax], al
sbb byte [ecx + 0x10e05024], al
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xf8501210
sbb dl, byte gs:[eax + 0x1c]
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
les ebx, [eax]
adc dl, byte [eax + 0x34]
sbb dword [edx], edx
push eax
cmp al, 0x19
adc dl, byte [eax + 0x44]
sbb dword [edx], edx
push eax
adc al, 0x19
adc dl, byte [eax - 0x40]
sbb dl, byte [eax - 0x34]
sbb byte [edx], dl
push eax
fcomp qword [eax]
adc dl, byte [eax + 1]
add bh, bh
push dword [esi + 0x540a501a]
inc ebx
outsd dx, dword [esi]
outsd dx, dword [esi]
insb byte es:[edi], dx
inc edx
popal
outsb dx, byte [esi]
jae 0x501828c8

Function at 0x5018338c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
xchg esp, eax
xor ebx, dword [eax]
push eax
sbb al, 0
movsb byte es:[edi], byte [esi]
xor edx, dword [edx]
push eax
pushfd
xor edx, dword [edx]
push eax
adc al, 0x45
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ebx
popal
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
popal
jb 0x501833ea
jb 0x50183419
outsd dx, dword [esi]
jb 0x50183337
inc eax
add byte [eax + 0x7501833], dh
pop es
Function at 0x501833b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop eax
mov ds, word [eax + edx*2]
add byte [ecx], al
add bh, bh
add byte [ecx], al
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax - 0x80000000], al
inc ebx
add byte [ebx], cl
dec edi
outsb dx, byte [esi]
push ebx
je 0x50183369
jb 0x5018337e
inc esp
jb 0x5018336e
hlt
add byte [ebx + esi + 0x1c5018], dl
sbb byte [eax + 0x1c], dl
add byte [eax], al
add byte [edx + ecx*4 + 0x24], bh
push eax
add byte [eax], al
jl 0x501832e8
and al, 0x50
loopne 0x50183372
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
lodsb al, byte [esi]
xor edx, dword [edx]
push eax
sub byte [ecx], dl
adc dl, byte [eax + 0x40]
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x94501210
xor edx, dword [edx]
push eax
pop es
adc al, 0x45
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ebx
popal
insb byte es:[edi], dx
outsb dx, byte gs:[esi]
popal
jb 0x50183407
jb 0x50183436
outsd dx, dword [esi]
jb 0x50183353
xor ebx, dword [eax]
push eax
js 0x50183356
and al, 0x50
add byte [eax], al
or byte [ebx + 0x6f], al
insd dword es:[edi], dx
inc ebx
je 0x50183449
insb byte es:[edi], dx
jae 0x501833da
add byte [eax + sym.vcl120.bpl__Comctrls_TMonthCalColors_], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push esp
xor al, 0x18
push eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc eax
xor al, 0x18
push eax
and al, 0
add byte [eax], al
cmp byte [ecx + 0x10e05024], al
push eax
loopne 0x5018341a
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax + 0x28]
adc dword [edx], edx
push eax
inc eax
adc dword [edx], edx
push eax
dec eax
adc dl, byte [eax + 0x48]
adc dword [edx], edx
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0xc501210
sbb byte [edx], dl
push eax

Function at 0x50183434
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sbb al, 0x18
adc dl, byte [eax + 0x24]
sbb byte [edx], dl
push eax
pop esp
mov ebx, dword [edx]
push eax
andps xmm1, xmmword [ebp + 0x6f]
outsb dx, byte [esi]
je 0x501834af
inc ebx
popal
insb byte es:[edi], dx
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x501834c3
push esp
xor al, 0x18
push eax
Function at 0x50183454
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
andps xmm1, xmmword [ebp + 0x6f]
outsb dx, byte [esi]
je 0x501834c4
inc ebx
popal
insb byte es:[edi], dx
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x501834d8
xor al, 0x34
sbb byte [eax + 0x34], dl
and dword [eax + edx*2], 0x43080006
outsd dx, dword [esi]
insd dword es:[edi], dx
inc ebx
je 0x501834e8
insb byte es:[edi], dx
jae 0x5018347f
add byte [edi + edi], ah
adc dl, byte [eax + 8]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [0xff0000], al
add byte [ecx], cl
inc edx
popal
arpl word [ebx + 0x43], bp
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x501834c3
aas
adc dl, byte [eax + 0xc]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], cl
add byte [eax], al
inc dword [ecx]
add byte [ecx], cl
push esp
js 0x50183531
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x501834e7
aas
adc dl, byte [eax + 0x10]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [edx], al
add byte [eax], al
add byte [edx], al
add byte [eax], al
inc dword [edx]
add byte [esi], cl
add bh, bh
add al, byte [eax]
push cs
push esp
imul esi, dword [esp + ebp*2 + 0x65], 0x6b636142
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x50183510
aas
adc dl, byte [eax + 0x14]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [ebx], al
add byte [eax], al
add bh, bh
invalid
add dword [eax], eax
add byte [eax], al
add eax, dword [eax]
add byte [eax], al
invalid
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x50183539
aas
adc dl, byte [eax + 0x18]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [eax + eax], al
add byte [eax], al
invalid
outsb dx, byte [esi]
je 0x5018359c
inc edx
popal
arpl word [ebx + 0x43], bp
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x50183562
aas
adc dl, byte [eax + 0x1c]
add byte [eax], al
call dword [eax - 0x74]
sbb dl, byte [eax + 1]
add byte [eax], al
add byte [0x13000000], al
add byte [eax], al
inc dword [0x72541100]
popal
imul ebp, dword [ecx + ebp*2 + 0x6e], 0x78655467
je 0x501835a8
js 0x501835d8
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x501834f7
inc eax
add byte [eax + 0x35], dh
sbb byte [eax + 3], dl
add ecx, dword [0x6c614354]
jae 0x50183603
outsb dx, byte [esi]
popal
Function at 0x50189018
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov eax, ebx
mov si, 0xffb3
call sub.rtl120.bpl__System__CallDynaInst_qqrv
test al, al
jne 0x50189045
call sub.user32.dll_GetFocus
push eax
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
push eax
call sub.user32.dll_IsChild
test eax, eax
je 0x50189077
cmp word [edi + 4], 9
jne 0x50189077
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x50189077
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
setge dl
mov cl, 1
mov eax, ebx
call sym.vcl120.bpl__Comctrls_TPageControl_SelectNextPage_qqroo
mov dword [edi + 0xc], 1
jmp 0x50189080
mov edx, edi
mov eax, ebx
call sym.vcl120.bpl__Controls_TWinControl_CMDialogKey_qqrr15Messages_TWMKey
pop edi
pop esi
pop ebx
ret

Function at 0x5019347c
Capabilities:
Inspect section memory permissions

Disassembly:
push ebx
add esp, 0xffffff88
mov ebx, eax
movzx eax, byte [0x50193534]
mov byte [esp], al
mov eax, dword [ebx + 4]
call sym.vcl120.bpl__Controls_TWinControl_HandleAllocated_qqrv
test al, al
je 0x50193529
cmp byte [ebx + 8], 0
jne 0x50193529
lea edx, [esp + 4]
mov eax, ebx
call sym.vcl120.bpl__Comctrls_TTextAttributes_InitFormat_qqrr22Richedit__CHARFORMAT2W
lea eax, [esp + 4]
push eax
push 1
mov eax, dword [ebx + 4]
call sym.vcl120.bpl__Controls_TWinControl_GetHandle_qqrv
cmp byte [ebx + 8], 0
sete cl
and ecx, 0x7f
mov edx, 0x43a
call fcn.50123184
mov ebx, dword [esp + 8]
test bl, 1
je 0x501934e1
or byte [esp], 1
test ebx, 0x40000000
je 0x501934ed
or byte [esp], 2
test ebx, 0x20000000
je 0x501934f9
or byte [esp], 4
test bl, 2
je 0x50193502
or byte [esp], 8
test ebx, 0x80000000
je 0x5019350e
or byte [esp], 0x10
test bl, 8
je 0x50193517
or byte [esp], 0x20
test bl, 4
je 0x50193520
or byte [esp], 0x40
test bl, 0x10
je 0x50193529
or byte [esp], 0x80
movzx eax, byte [esp]
add esp, 0x78
pop ebx
ret

Function at 0x501a5594
Capabilities:
Set global application hook

Disassembly:
cmp dword [0x5024513c], 0
jne 0x501a55b7
call sub.kernel32.dll_GetCurrentThreadId
push eax
push 0
mov eax, 0x501a5508
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5024513c], eax
ret
Function at 0x501ad148
Capabilities:
Encode data using xor

Disassembly:
sbb edx, dword [eax + 0x68]
adc byte [edx], dl
push eax
add eax, 0x10000200
add dword [edx - 0x11001100], eax
invalid
pop es
or eax, 0x6d6f4354
insd dword es:[edi], dx
outsd dx, dword [esi]
outsb dx, byte [esi]
inc esp
imul esp, dword [ecx + 0x6c], 0xd0d0676f
sbb dl, byte [eax - 0x38]
and byte [eax + edx*2], 6
add byte [edi], al
inc esp
imul esp, dword [ecx + 0x6c], 0x473676f
add byte [esp + edi*2 + 0x24], al
push eax
xor byte [eax], al
add bh, bh
xor byte [eax], al
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax + 1], al
add al, byte [eax]
add eax, 0x336c7443
inc esp
js 0x501ad10e
and al, 0x50
xor al, 0
add bh, bh
xor al, 0
add bh, bh
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [eax]
or ecx, dword [eax + 0x65]
insb byte es:[edi], dx
jo 0x501ad1ee
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501ad214
js 0x501ad225
insb byte es:[edi], dx
and dword [eax + edx*2], 0xff000048
dec eax
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f070004], al
outsb dx, byte [esi]
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x501ad238
insb byte es:[edi], dx
and dword [eax + edx*2], 0xff000050
push eax
add byte [eax], al
inc dword [ecx]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax + 0x4f060005], al
dec edi
outsb dx, byte [esi]
push ebx
push 0xd1f8776f
sbb dl, byte [eax + 3]
add ecx, dword [ebx]
push esp
dec edi
jo 0x501ad263
outsb dx, byte [esi]
push dx
popal
dec edi
Function at 0x501b3ce4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff94
mov esi, eax
mov edi, esp
xor ebx, ebx
call sym.vcl120.bpl__Printers_Printer_qqrv
call sym.vcl120.bpl__Printers_TPrinter_GetPrinters_qqrv
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x501b3e80
mov eax, edi
xor ecx, ecx
mov edx, 0x54
call sub.rtl120.bpl__System__FillChar_qqrpvib
mov dword [edi], 0x54
mov eax, dword [0x50245004]
mov dword [edi + 0x3c], eax
call fcn.501b0fe4
mov dword [edi + 4], eax
movzx eax, byte [esi + 0xf0]
dec al
je 0x501b3d40
dec al
jne 0x501b3d44
add dword [edi + 0x10], 4
jmp 0x501b3d44
add dword [edi + 0x10], 8
test byte [esi + 0x68], 1
je 0x501b3d4e
add dword [edi + 0x10], 0
test byte [esi + 0x68], 2
je 0x501b3d58
add dword [edi + 0x10], 0x10
test byte [esi + 0x68], 4
je 0x501b3d65
add dword [edi + 0x10], 0x100
test byte [esi + 0x68], 8
je 0x501b3d72
add dword [edi + 0x10], 0x80000
test byte [esi + 0x68], 0x10
je 0x501b3d7f
add dword [edi + 0x10], 0x200
test byte [esi + 0x68], 0x20
je 0x501b3d89
add dword [edi + 0x10], 0x20
lea ecx, [esp + 0x54]
mov edx, dword [esi + 0x90]
mov eax, dword [esi + 0x8c]
call sub.rtl120.bpl__Classes_Point_qqrii
mov eax, dword [esp + 0x54]
mov dword [edi + 0x14], eax
mov eax, dword [esp + 0x58]
mov dword [edi + 0x18], eax
mov eax, dword [esi + 0x78]
push eax
lea eax, [esp + 0x60]
push eax
mov ecx, dword [esi + 0x74]
mov edx, dword [esi + 0x70]
mov eax, dword [esi + 0x6c]
call sub.rtl120.bpl__Classes_Rect_qqriiii
push esi
push edi
lea esi, [esp + 0x64]
add edi, 0x1c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov eax, dword [esi + 0x88]
push eax
lea eax, [esp + 0x60]
push eax
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x80]
mov eax, dword [esi + 0x7c]
call sub.rtl120.bpl__Classes_Rect_qqriiii
push esi
push edi
lea esi, [esp + 0x64]
add edi, 0x2c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword [edi + 0x44], fcn.501b10d0
or dword [edi + 0x10], 0x400
xor eax, eax
mov dword [edi + 0xc], eax
xor eax, eax
mov dword [edi + 8], eax
push edi
call sub.comdlg32.dll_PageSetupDlgW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x501b3e80
mov eax, dword [edi + 0x14]
mov dword [esi + 0x8c], eax
mov eax, dword [edi + 0x18]
mov dword [esi + 0x90], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x7c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x34]
mov dword [esi + 0x84], eax
mov eax, dword [edi + 0x38]
mov dword [esi + 0x88], eax
mov eax, dword [edi + 8]
test eax, eax
je 0x501b3e6e
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov dword [edi + 8], eax
mov eax, dword [edi + 0xc]
test eax, eax
je 0x501b3e80
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
mov dword [edi + 0xc], eax
mov eax, ebx
add esp, 0x6c
pop edi
pop esi
pop ebx
ret
Function at 0x501b73cc
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x501b7561
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x501b752f
xor edx, edx
push ebp
push 0x501b7528
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 8]
test eax, eax
je 0x501b743b
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x501b743b
lea eax, [ebp - 8]
mov edx, dword [ebp - 8]
call sub.rtl120.bpl__System__InternalUStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test eax, eax
je 0x501b7444
sub eax, 4
mov eax, dword [eax]
add eax, eax
add eax, 2
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x501b74fd
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
xor edx, edx
push ebp
push 0x501b74ec
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x501b74a6
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x501b74a6
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0xc]
call sub.rtl120.bpl__System__InternalUStrFromLStr_qqrr20System_UnicodeStringx27System__AnsiStringT_us_i0__
test eax, eax
je 0x501b74af
sub eax, 4
mov eax, dword [eax]
mov esi, eax
add esi, esi
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
lea ecx, [esi + 2]
mov edx, ebx
call sub.rtl120.bpl__System_Move_qqrpxvpvi
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 0x10]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501b74f3
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [sym.vcl120.bpl__Consts__SCannotOpenClipboard]
mov dl, 1
mov eax, dword [sym.imp.rtl120.bpl__Sysutils_Exception_]
call sub.rtl120.bpl__Sysutils_Exception__bctr_qqrp20System_TResStringRec
call sub.rtl120.bpl__System__RaiseExcept_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x501b7568
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x501b95b8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or edx, dword [ebp + eax*2 + 0x64]
imul esi, dword [esp + eax*2 + 0x65], 0x6574656c
push eax
xchg ebp, eax
sbb edx, dword [eax + 0x60]
nop
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9637
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
mov eax, eax
xor al, 0x96
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501b96], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi + edx*4 + 0xac501b], cl
add byte [eax], al
fdivr dword [ebp + 0x1e]
push eax
loopne 0x501b961a
adc dl, byte [eax - 0x18]
adc byte [edx], dl
push eax
xor byte [ecx], dl
adc dl, byte [eax - 0x74]
sbb eax, 0x11405012
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax

Function at 0x501b96a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
invalid
pop es
or eax, 0x6e695754
outsd dx, dword fs:[esi]
ja 0x501b96eb
arpl word [ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
xor al, 0x96
sbb edx, dword [eax - 0x74]
jle 0x501b96d4
push eax
adc eax, dword [eax]
or byte [ebx + 0x74], dl
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
sbb al, 0x97
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x501b97], cl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edi + edx*4 + 0x1b], dh
push eax
lodsb al, byte [esi]
mov byte [edi + 0x501b], dl
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
je 0x501b967d
sbb edx, dword [eax - 0x54]
add byte [eax], al
add ah, bl
xchg ebp, eax
sbb edx, dword [eax - 0x20]
adc byte [edx], dl
push eax
call 0x806ba909
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
Function at 0x501b9788
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
or al, 0x54
push edi
imul ebp, dword [esi + 0x64], 0x6c43776f
outsd dx, dword [esi]
jae 0x501b97fb
sbb al, 0x97
sbb edx, dword [eax - 0x64]
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b9808
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
nop
add al, 0x98
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax - 0x68], dh
sbb edx, dword [eax]
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + ebx*4 + 0x1b], bl
push eax
lodsb al, byte [esi]
add byte [eax], al
add ah, bl
xchg ebp, eax
sbb edx, dword [eax - 0x20]
adc byte [edx], dl
push eax
call 0x806ba9f1
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax

Function at 0x501b9870
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
push cs
push esp
push edi
imul ebp, dword [esi + 0x64], 0x6143776f
jae 0x501b98e0
popal
add al, 0x98
sbb edx, dword [eax - 0x64]
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b98f2
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
invalid
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
nop
push ds

Function at 0x501b98f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
push cs
push esp
push edi
imul ebp, dword [esi + 0x64], 0x6143776f
jae 0x501b98e0
popal
add al, 0x98
sbb edx, dword [eax - 0x64]
xchg esi, eax
sbb edx, dword [eax + 0x13]
add byte [eax], cl
push ebx
je 0x501b98f2
inc ecx
arpl word [esi + ebp*2 + 0x73], si
add byte [eax], al
lea eax, [eax]
invalid
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
nop
push ds

Function at 0x501b9964
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop es
adc eax, 0x6e695754
outsd dx, dword fs:[esi]
ja 0x501b99c2
imul ebp, dword [ebp + 0x48], 0x7a69726f
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x501b99db
insb byte es:[edi], dx
invalid
adc dl, byte [eax + 0x30]
adc dword [edx], edx
push eax
mov word [0x11405012], ds
adc dl, byte [eax - 0x24]
sbb al, 0x12
push eax
push eax
adc dword [edx], edx
push eax
cmp byte [ecx], dl
adc dl, byte [eax - 0x50]
adc byte [edx], dl
push eax
mov eax, 0x38501210
mov ebx, dword [esi]
push eax
push eax
mov al, 0x10
adc dl, byte [eax - 0x48]
adc byte [edx], dl
push eax
cmp byte [ebx - 0x746fafe2], cl
nop
mov ebx, dword [esi]