joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100032d0
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
test byte [0x100050a0], 8
jne 0x10003360
mov dword [edi], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], 8
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x1000342f
mov dword [eax], sym._dpvserver_QueryInterface_12
mov dword [eax + 4], 1
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], eax
call sym._dpvserver_QueryInterface_12
mov esi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
call dword [eax + 8]
sub esp, 4
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x10003428
mov eax, esi
shr eax, 0x10
je 0x10003410
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call sym._wine_dbg_sprintf_2
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], str.__p___s___p__n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.DPVOICE_CreateDirectPlayVoiceServer
mov dword [esp + 4], 0x100050a0
mov dword [esp], 3
call sym._wine_dbg_log.constprop.1_1
jmp 0x100032e8
mov dword [esp + 4], esi
mov dword [esp], str._guid_0x_04hx_
call sym._wine_dbg_sprintf_2
jmp 0x100033d5
mov eax, str._null_
jmp 0x100033d5
mov esi, 0x8007000e
jmp 0x1000334d

Function at 0x10003490
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x100034e8
cmp byte [esi + ebx - 1], 0xa
je 0x100034bc
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10012084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x10003f30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100120a0]
test eax, eax
je 0x10003fe8
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10003f70
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10003f5c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x1000401d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x100120a0], eax
sub esp, 8
test eax, eax
jne 0x10003f4d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10003f5e
Function at 0x10004030
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_FindResourceW]
sub esp, 0xc
mov dword [esp + 4], eax
mov dword [ebp - 0x10], eax
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
sub esp, 8
mov ebx, eax
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
sub esp, 8
test ebx, ebx
je 0x100041b1
mov eax, dword [esi]
test eax, eax
je 0x100041a0
mov edx, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x1c], edx
call edx
lea ecx, [eax + 1]
sub esp, 0x18
lea eax, [ecx + ecx]
mov dword [ebp - 0x18], ecx
mov ecx, eax
mov dword [ebp - 0x14], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
test eax, eax
mov edi, eax
je 0x100041b5
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
xor edx, edx
sub esp, 0x18
mov word [edi + eax - 2], dx
mov eax, dword [esi]
test ecx, ecx
mov edx, dword [eax]
mov dword [esp + 4], edi
mov dword [esp], eax
jne 0x10004198
call dword [edx + 0x28]
sub esp, 8
mov dword [esi + 8], eax
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
mov eax, dword [esi + 8]
sub esp, 0xc
not eax
shr eax, 0x1f
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
call dword [edx + 0x24]
sub esp, 8
jmp 0x10004159
mov edx, esi
mov eax, edi
call sym._create_registrar
test eax, eax
jne 0x10004096
xor eax, eax
jmp 0x10004188
mov dword [esi + 8], 0x8007000e
xor eax, eax
jmp 0x10004188
Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x7ab5267e
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x52415067
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401303
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513bd3
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4013cb
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513bd3
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d8ae
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401471
cmp edi, dword [esi + 0x7c]
jge 0x401471
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415d15
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415d15
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513bd3
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513bd3
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4013c3
jmp 0x401393
call fcn.00419f3c
int3

Function at 0x40efcc
Capabilities:
Encode data using xor

Disassembly:
xor ah, al
sbb byte [esi - 0x40], dl
sub dword [ebx + 0x37c490af], 0x68fb142f
jb 0x40efbc
jecxz 0x40ef63
invalid
Function at 0x41780b
Capabilities:
Encode data using xor

Disassembly:
jmp 0xc39f6a6d
adc eax, 0xaddc1833
sbb byte [edx], cl
je 0x41774c
imul esp, dword [ebp + 0x12], 0x1405f55e
mov ebx, 0x3a1cb25e
adc bl, byte [esi - 0xb]
add eax, 0xb25ebb14
sbb al, 0x3a
push ebx
sbb dword [0x53b6b562], ecx
ljmp 0xaef5
lodsd eax, dword [esi]
mov cs, word ds:[ebp + esi*4 + 0x5f]
jge 0x417792
frstor dword [ebp - 0xa]
insb byte es:[edi], dx
les esi, [eax + 0x3f85db75]
jnp 0x41783b
jb 0x417787
ljmp 0x1e04:0x4a7a1e74
psubusb mm0, mm4
sbb ch, byte [ebx]
insb byte es:[edi], dx
cmc
sub esp, esp
mul esi
and dh, bh
dec edi
sahf
inc esi
sbb byte [ebx], bl
add ebp, dword [esi]
sti
mov dl, 0xa1
jg 0x4177d5
arpl si, di
cmc
imul esp, dword [edi + 0x31], 0x18b05650
in al, dx
pop edi
lea esi, [0xc93c626b]
in eax, 0x98
or dword [esi - 0x45ce2040], ecx
inc esp
out 0xae, al
mov bl, 0x31
xchg edi, eax
rcl al, 1
mov al, byte [0x63eab7a6]
mov byte [0xef3af4e3], al
rcr bh, 0x31
mov edx, 0xb3aee644
xor dword [edi - 0x595f2f30], edx
mov bh, 0xea
arpl word [edx - 0x10c50b1d], sp
add byte [0x33ba6c9f], bh
pop esp
test eax, 0x6259497a
movsb byte es:[edi], byte [esi]
fdiv qword [ecx]
sti
in eax, 0xb4
stosd dword es:[edi], eax
xchg ecx, eax
xchg edi, eax
popal
push ecx
fld xword [eax - 0x59a494f6]
add eax, 0x1397c326
outsb dx, byte [esi]
sub bl, bl
pushal
or eax, 0xc39b0fa8
dec ebx
push edi
mov eax, 0x37d5fd46
wait
ret
aad 0x37
inc ebp
mov bh, bl
mov edi, 0x87d778f1
cld
aas
cwde
mov eax, 0xb093f40
xor al, 0x88
cmpsb byte [esi], byte es:[edi]
push ebx
cmc
in eax, 0x4a
push ds
je 0x417828
pop ecx
cmp eax, ecx
push 0xd2c8191
arpl word [ebp - 0xd], di
inc edi
pop ss
jnp 0x417881
push eax
cmc
jle 0x4178f4
inc edx
pushfd
mov cl, bh
sahf
mov edx, 0x357253a2
or al, 0x59
stosb byte es:[edi], al
in eax, 0xba
mov eax, dword [0x667d8bae]
cmp byte [ecx + 0x12], al
cdq
inc eax
mov byte [eax], dl
pop ds
xchg esp, eax
pop ss
jo 0x4178de
test dword [ecx - 0x55], edi
call dword [ebx]
nop
shl byte [ebp + 0x78], 1
or dh, byte [edx - 0x69]
jno 0x41794a
cmp dword [eax + edi*2 - 0x57259bb8], edx
wait
xor al, 0x1e
wait
jns 0x41787a
xchg esp, eax
rcl dword [edx + 0x7e], cl
wait
jmp 0xf005afd2
out dx, eax
leave
ja 0x4178a9
cdq
cmp byte [ebx - 0x6a], 0x5b
adc ch, byte [eax]
hlt
sbb dword [edi - 0x1a56647e], esi
sbb dword [eax + 0x6934d96d], eax
add byte [esi - 0x75b1fa37], ch
sub byte [edi], dh
jno 0x4179a3
sbb al, 0x7c
or eax, 0x383795fa
sar byte [ecx], 0xa9
fstp xword [edi + 0x31]
mov ah, 0xe4
mov ebx, 0x754e9db9
call 0x6bc61359
in eax, dx
add byte [esi + 0x33f143ae], bh
mov edx, 0x88287517
inc eax
push edx
push 0xb
inc edi
xor ecx, dword [eax - 0x174e1127]
les esp, [eax - 0x1c]
inc edi
test edi, 0x46b7f11e
adc byte [esp + ebx*2 + 0xb], bh
in eax, 0x2a
xor eax, 0x60be5c96
xchg ebp, eax
imul esi, edi, 0xffffffbd
cmp al, 0x8e
mul cl
pop esp
mov esi, 0xf76b9560
mov ebp, 0xe1f68e3c
cmp esp, esi
push dx
adc al, 0xf5
aas
or dword [esi + ecx*4 + 0x7b], edx
cmc
stosb byte es:[edi], al
pop edx
shr dword [ebx + ecx*4 - 0x249f654], cl
stc
cmp dword [edx - 0x4c0eb8eb], ebp
mov cl, 0xc7
ljmp 0xcdfe
Function at 0x417cb8
Capabilities:
Encode data using xor

Disassembly:
cld
jmp 0x590f36
and ch, bh
sub eax, 0x127be0c7
cmp eax, 0xdd995e7c
dec ecx
cli
test dl, dl
pop ebp
and eax, 0xcef60d75
mov word [ebx], ds
pop es
add dword [ebp - 0x25], esp
lodsb al, byte [esi]
movsd dword es:[edi], dword [esi]
nop
mov ch, 0x31
mov ebp, 0xc4dcd31d
imul esi, dword [ecx], 0xffffffd8
fld xword gs:[ebp - 0x42ce4a70]
sbb eax, 0x6bc4dcd3
xor eax, ebx
or dword [ecx - 0x16], 0x441bfa9
adc dword [ebp - 0x51b6554a], esi
je 0x417cd2
cmc
js 0x417c9b
pop ebx
pop esp
lahf
lodsb al, byte [esi]
or byte [ecx - 0xc5b3626], bl
mov ecx, 0xe39c7a32
add edx, dword [ecx - 0x4eb357cb]
mov eax, dword [0x44be29ee]
in eax, 0xd4
in eax, dx
inc eax
cmp dword [ebx + 0x29], esi
daa
out dx, al
push edx
invalid

Function at 0x42f403
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541cd3
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f4cb
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541cd3
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53b9ae
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f571
cmp edi, dword [esi + 0x7c]
jge 0x42f571
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.00443e15
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.00443e15
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541cd3
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541cd3
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f4c3
jmp 0x42f493
call fcn.0044803c
int3
Function at 0x43a159
Capabilities:
Encode data using xor

Disassembly:
jae 0x43a15d
push esi
push ecx
xor byte [ecx], bl
sbb dword [ebx], esi
adc al, byte [esi + ebx*2]
sbb dword [ebx], esi
adc al, byte [esi + ebx*2]
pop esi
popfd
insd dword es:[edi], dx
cld
xor eax, 0x53fdb1b8
and dword [ecx - 7], ebp
insb byte es:[di], dx
lodsb al, byte [esi]
jge 0x43a1c2
push esp
or ebp, ebp
outsb dx, byte fs:[esi]
aaa
mov edi, dword [eax + 0x55]
pop edi
out dx, eax
sahf
popfd
xor dword [edx], 0xd8417bec
pop cx
sub ah, cl
jnp 0x43a16d
aad 0x54
sub al, 0xd5
cld
sub al, 0xdc
int3
and al, 0xb1
sahf
or edi, 0x397cd80b
add eax, 0x680d4bd1
sub ch, cl
jbe 0x43a154
and dword [edx], ebp
inc ebx
insd dword es:[edi], dx
aam 0x76
adc al, 0x1d
rcr dword [eax - 0x40], 0x5e
mov ecx, dword [edx]
adc byte [ecx + 0x6a], bh
adc al, 0xcb
stosb byte es:[edi], al
push 0xc8e2b970
ja 0x43a223
and eax, 0xce6f0c55
dec ebp
xor eax, 0x2dbc6d84
test eax, 0x3889f05b
in al, 0xa7
ljmp 0x98ab
add byte [ecx + edi*4 + 0x2cc96f56], cl
scasb al, byte es:[edi]
mov esp, 0xab3764ad
mov al, byte fs:[0x6eab420e]
int3

Function at 0x446043
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x44608a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558913
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x44610b
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558913
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5525ee
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4461b1
cmp edi, dword [esi + 0x7c]
jge 0x4461b1
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045aa55
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045aa55
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558913
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558913
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446103
jmp 0x4460d3
call fcn.0045ec7c
int3

Function at 0x45bbeb
Capabilities:
Encode data using xor

Disassembly:
std
inc edx
or al, 0x84
loopne 0x45bc42
mov byte [0x159e06b2], al
inc eax
cwde
add edx, esp
test al, 0xa
scasd eax, dword es:[edi]
fmul qword [eax - 0x75d8f607]
sar byte [ecx + 6], 0x96
orps xmm0, xmmword [eax]
ljmp 0x6b0a
cmp byte [edx - 0x53c627c2], dl
popal
add eax, 0xab33e0c4
jnp 0x45bc53
test eax, 0x5c85ba50
rol ebx, 1
test dword [ecx + edx*8 - 0x3d], ebx
salc
or byte [esi - 0x60f2ef06], dl
insb byte es:[edi], dx
mov al, 0xac
invalid

Function at 0x45cca3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38
Function at 0x473ca3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586573
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473d6b
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586573
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0058024e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473e11
cmp edi, dword [esi + 0x7c]
jge 0x473e11
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004886b5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004886b5
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586573
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586573
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473d63
jmp 0x473d33
call fcn.0048c8dc
int3

Function at 0x47f183
Capabilities:
Encode data using xor

Disassembly:
sub eax, dword [esi - 0x64a169db]
mov ebx, 0x49e528d3
push esi
wait
cmp ebp, 0x61
mov al, 3
sbb dh, byte [ebx + 0x643b261a]
cmp esi, dword [esi]
dec ebx
fldenv [ebp + 0x3a67d3ed]
inc ebp
and ebp, edi
call 0xae484db6
sal dword [ebx + 0x2e], 0xb8
push ss
jle 0x47f1d3
clc
add al, 0x74
cli
out 0xb0, eax
bnd jge 0x47f1ef
mov eax, 0x5c2aed41
mov ch, 0xe9
adc al, 0x9e
add byte [esi], ch
popfd
sahf
cld
push ebp
push esi
scasb al, byte es:[edi]
idiv byte [esi - 0x13cfd53f]
in al, dx
jbe 0x47f214
adc eax, 0x9cca7d5f
ficomp dword [ebp + 0x5a]
invalid
pop eax
wait
invalid
dec edi
out dx, al
mov esp, 0x728f8b3e
mov esi, 0x335b3cb4
cld
sub eax, 0x33db8eaa
xor esi, dword [edi + ecx*4]
in al, 0xf1
lahf
sbb edi, edi
fsubrp st(5)
popfd
push 0xae99bfb7
mov ecx, 0xe18cd9a0
mov edx, 0x86996b67
scasb al, byte es:[edi]
ljmp 0x82a0