joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44cdf1
Capabilities:
Check for software breakpoints

Disassembly:
sub esp, ebx
add byte [edx], 0x30
mov word [esi], gs
mov ebp, 0x8082dc17
stosd dword es:[edi], eax
or byte [ecx + 0x2f], dl
and cl, cl
insd dword es:[edi], dx
cmp bh, bl
leave
sub ebp, dword [ebx - 0x493f0691]
test eax, 0xd93c5e1f
pop esi
cmp al, 0xd9
jnp 0x439b14
or edx, dword [edi + 0x89f913a]
fbstp tbyte [ecx + ebx*8 + 0x614f025d]
invalid
les ebp, [eax + edx*2]
test byte [eax - 0x7e], bl
xor al, 0xef
cmp al, 0xcc
wait
xchg esp, eax
sbb al, 0x3b
das
imul eax, dword [esi], 0x2a
jno 0x439af6
invalid
hlt
je 0x44cddc
cmp edi, 0x20
jne 0x44cde2
pop ecx
je 0x44cf28
leave
mov ebp, esp
jne 0x44ce53
pushal
inc esi
jns 0x44ce3b
je 0x44cdd4
call 0x44ce31
push ecx
dec edx
pop edi
imul ecx, dword [edx + 0x4f], 0x615b444b
pushal
dec esp
push ecx
push ebx
pop ecx
dec edx
dec edi
pop di
dec esp
arpl word [eax + 0x52], bx
inc edi
inc eax
insd dword es:[edi], dx
imul ecx, dword [ecx + 0x5c], 0x6d
dec edi
pop edi
pop ebp
pop edx
inc ecx
push 0x5a
js 0x44ce9b
imul ecx, dword [ebx + 0x58], 0x6f676250
push eax
push esp
dec edi
bound edx, qword [edi + 0x42]
dec eax
dec eax
push 0x812434ff
inc esp
and al, 0
bound edx, qword [ecx + 0x44810002]
and al, 4
mov byte [eax], al
add byte [eax], al
ret
add byte [ecx - 0x77fbdbbc], al
add byte [eax], al
add bl, al
imul ecx, dword [ebp + 0x42], 0x46695a55
pop ebp
push eax
push ecx
dec ecx
inc esp
push ebp
push ebp
bound ecx, qword [ecx + 0x5a]
insb byte es:[edi], dx
pushal
pop edx
imul edi, dword [ebx + 0x48], 0x6f
pop esi
inc esi
push 0x795e4f79
arpl word [ebp + 0x69], cx
pop edx
pop edx
dec eax
push 0x7b
pushal
inc esi
outsb dx, byte [esi]
dec edx
bound ecx, qword [esi + 0x49]
inc ebp
dec ebx
inc ebx
js 0x44cee7
dec esi
inc esp
insd dword es:[edi], dx
inc ecx
bound esp, qword [edx - 0x7f]
sti
fld dword [edx]
ljmp 0x4554
and al, 0x5c
mov bh, 0x9e
cmp al, 0x2c
je 0x439b30
mov eax, ecx
cmp esi, 0x3238679
jne 0x44cece
jmp 0x44cec1
mov dword [edi + ecx*4 + 8], eax
lea ecx, [esi - 0x20]
ret
outsb dx, byte [esi]
push esp
outsd dx, dword [esi]
push 0x78
mov dword [esi + 4], edi
cmp dword [esp - 0x20], 0xfedde67d
jne 0x44ceec
mov dword [esi + 8], edi
cmp eax, 0xe58232f7
je 0x44cec9
mov dword [esi + 0xc], edi
cmp ecx, 0x908d2175
je 0x44934f
shl ecx, 0x10
cmp edi, 0x587a6997
cmove ecx, ebp
or eax, ecx
cmp eax, 0x12eecb09
jne 0x44cf2a
inc ecx
pop edx
insd dword es:[edi], dx
insb byte es:[edi], dx
Function at 0x44f690
Capabilities:
Packed with generic packer

Disassembly:
sti
add bl, bl
std
std
or eax, 0x21fcdec0
sahf
ret 0x24f7
pop ebp
push ebx
push eax
inc edx
jnp 0x44f6ea
js 0x44f6f4
push esi
cmp dword [esp + 0x38], 0xa4d0d22f
je 0x43d21f
call 0x44f700
jnp 0x44f712
pop esi
inc eax
push esi
imul esp, dword [ebx + 0x78], 0x5e
push 0x66
pop esp
inc edx
inc edx
pop edi
dec esp
pop ebp
arpl word [ebx + 0x47], bx
inc edi
js 0x44f72d
dec edi
push edi
inc ebp
pop ecx
push ebp
dec esp
pop eax
push ebp
dec edx
push eax
pop edi
pop eax
push esp
push esp
push eax
inc esi
bound edx, qword [eax + 0x51]
pushal
js 0x44f740
push esi
dec eax
dec ecx
inc ebp
inc ebp
push eax
push ebp
inc esp
push ecx
push eax
jnp 0x44f72d
pop edi
push ebp
jnp 0x44f738
pop edx
dec ebx
jns 0x44f732
dec di
pop ebx
popal
jnp 0x44f772
dec ebx
push ecx
inc ebx
pop esp
pop edi
dec ecx
dec eax
dec esp
push dword [esp]
add dword [esp], 0x2ab41
add dword [esp + 4], 0x8d
ret
add bl, al
pushal
pop ebx
jnp 0x44f770
imul dx, word [ebx + edx*2 + 0x59], 0x4360
pop esp
dec esp
jnp 0x44f774
imul ebx, dword [esi + 0x57], 0x6d555c4e
inc edx
dec edi
jnp 0x44f78e
dec esp
dec ebp
dec ebx
push edx
pop ebp
push edx
push ebx
pop edx
dec edx
cmp edx, 0xf5b82e77
cmove esi, ebp
pop ecx
pushf
call 0x44f792
imul eax, dword [edi + 0x63], 0x43
dec eax
inc esp
outsd dx, dword [esi]
outsb dx, byte [esi]
push esi
push eax
inc edi
jns 0x44f7be
push 0x687b4f59
pop esi
push esp
dec bx
pop esi
dec eax
inc eax
dec ecx
outsb dx, byte [esi]
pop eax
jnp 0x44f7b6
outsd dx, dword [esi]
imul ebx, dword [edi + 0x43], 0x79
jnp 0x44f7cd
pop edi
pop edi
pop ebx
push 0x5c525442
pop ebp
pop ebp
inc edi
dec esp
inc edi
inc ecx
inc ebp
bound ecx, qword [esi + 0x54]
imul ecx, dword [edx + 0x40], 0x48
dec edx
pop esp
pop edi
imul eax, dword [esi + 0x6d], 0x6c
insb byte es:[edi], dx
arpl word [eax + 0x6f], cx
mov esi, dword [esp]
lea esp, [esp + 4]
call 0x44f79e
mov dword [esp], edx
lea edx, [esp + 6]
push ebp
push edi
mov ebp, esi
add ebp, 0xfffbaced
push word [esp + 0xc]
or al, 0
add byte [eax], al
popf
mov eax, dword ds:[ebp]
mov edi, dword [esp]
lea esp, [esp + 4]
inc ebp
add byte [ebx + 0x648d243c], cl
and al, 4
pop ebp
pop edx
lea esp, [esp + 2]
cmp dword [esp + 0x24], 0xff5d5123
jne 0x44f828
cmp word [eax + 0x18], cx
je 0x44f8aa
dec edx
movdqa xmmword [edi], xmm0
mov eax, dword [esi]
cmp esi, dword [ecx + 8]
push 0x50
pop ecx
inc edx
test eax, eax
pop esp
lea eax, [eax + edi*4 + 0xc4]
push esi
test edi, edi
push ebp
dec ebp
je 0x44f813
cmp eax, edi
leave
push ebx
pop edx
push 0xc
mov edx, 3
ret
ret
mov dword [edi + 0x68], eax
cmp edi, 0x489984dd
jne 0x44f85d
pop ecx
ret
pushf
call 0x44f864
mov dword [esp], edi
call fcn.0044f89a
add byte [eax], al
add byte [ebx + 0x75ff55ec], cl
invalid
test byte [edx + ecx], ah
add byte [eax], al
add al, ch
add byte [eax], al
add byte [eax], al
Function at 0x453cfc
Capabilities:
Packed with generic packer

Disassembly:
add al, 0x8f
dec esp
cmp cl, dl
push es
xchg ebx, eax
pop es
or byte [edi], 0x4b
aam 0x68
pop ecx
mov dh, ch
or cl, byte [ebp - 0x6acbc8f0]
sub ah, byte [esp + esi*4 - 0x7e275ba0]
jmp 0x4672249e
jnp 0x453d62
inc esp
pop esi
imul ecx, dword [ebp + 0x60], 0x47
inc ebx
inc ecx
pop ebx
push esi
push ecx
pushal
pop edx
pop esp
pop edx
pop edi
popal
outsd dx, dword [esi]
pop ebx
pop esi
jns 0x453d7b
pop esp
dec esi
pop edi
pop edx
inc esp
push eax
popal
insd dword es:[edi], dx
pop eax
pop edx
pop ebx
dec esi
dec edx
arpl word [eax + 0x5a], bp
js 0x453d71
push edi
dec ebx
push ecx
outsd dx, dword [esi]
imul ebp, dword [esi + 0x63], 0x6e5d7b49
push esi
inc esp
push esp
pop ebx
js 0x453da6
dec eax
pop ecx
push edx
inc ebx
push eax
pop eax
dec ecx
pop edi
push ecx
arpl word [ecx + 0x64], bp
push ecx
imul ecx, dword [ecx + 0x45], 0xadfb8159
mov edi, 0x440f862f
clc
push dword [esi + 0xb0]
cmp ebp, 0xad5b8c77
je 0x42df8d
mov byte [0x26e8fffd], al
add byte [eax], al
add byte [ebx + 0x4b], cl
call 0x453d90
dec ebx
dec ebx
push edi
push eax
dec edi
dec esp
dec ecx
push edi
pop ebx
outsb dx, byte [esi]
popal
push edi
push ebx
inc edi
pop edi
dec eax
insd dword es:[edi], dx
insd dword es:[edi], dx
push eax
pop ebp
push 0x61486d55
push ebx
inc esp
push eax
inc esi
push edi
pop edi
pop eax
dec esi
imul ebx, dword gs:[esp + ebx*2 + 0x56], 0xffffffff
xor al, 0x24
add dword [esp], 0x26484
add dword [esp + 4], 0x79
ret
leave
add al, 2
add byte [eax], al
xor esi, esi
call fcn.004541b7
jne 0x453da7
lea edx, [eax + 0xffc]
je 0x453df0
mov esi, dword [ebp - 0x1c]
push dword [ebp + 0xc]
push ebx
test esi, esi
jl 0x453da9
xor esi, esi
test eax, eax
cmp esi, 0x40a540
call dword [sym.imp.KERNEL32.dll_TlsFree]
ja 0x453e11
insd dword es:[edi], dx
inc edx
push esi
invalid
Function at 0x457d79
Capabilities:
Packed with generic packer

Disassembly:
mov eax, dword [esp]
lea esp, [esp + 4]
call 0x457d85
mov dword [esp], ebx
add eax, 0x13ced5b7
mov ebx, dword [eax - 0x13d3aca2]
mov dword [esp + 8], ebx
pop ebx
mov eax, dword [esp]
lea esp, [esp + 4]
cmp esi, 0x4d15a55
jne 0x457dfc
push ecx
add byte [eax], al
invalid
call fcn.004572d8
mov byte [edi], al
cmp byte [esi], bl
jle 0x457dc2
mov edi, edi
inc esp
not ebx
ret
mov ebp, esp
mov al, byte [esi]
popal
dec esp
insd dword es:[edi], dx
push bx
jl 0x457d9f
mov ebp, esp
push edi
push eax
dec esp
push eax
cmp ecx, 2
insb byte es:[edi], dx
imul esp, dword [esi + 0x61], 0x4b
pop edi
ja 0x457df9
inc ecx
mov dword fs:[ecx + 8], esi
pop esi
push 0xe07d3959
jne 0x457df2
jmp 0x49f70f
push ebx
invalid
dec esi
adc byte [esi - 0x18], al
aaa
add byte [eax], al
add byte [ebx], dh
sar bh, 0x24
test eax, edi
outsb dx, byte [esi]
inc eax
add byte [ebx], al
stc
or eax, 0xffffffff
push 0x22
jmp 0x457e16
call fcn.00457e38
xor eax, eax
jmp dword [eax*4 + 0x406ef8]
inc eax
add byte [ebx + 0x3d1c8e44], cl
lea eax, [eax]
add al, al
inc sp
inc ebp
popal
pushal
mov edi, dword [ebp + 0xc]
push 1
mov ecx, dword [edi + 4]
test eax, eax
pop ecx
mov dword [ebp - 4], edi
ret
invalid
sbb byte [edi - 0x7f], bl
jl 0x49f738
loopne 0x49f793
cmpsb byte [esi], byte es:[edi]
push edi
mov word [edi], cs
test dword [esi], edx
add byte [eax], al
pop ebp
pop ebp
pop eax
arpl word [ecx + 0x47], bp
push ecx
pop ebp
dec edi
js 0x49f787
pop esi
outsd dx, dword [esi]
jnp 0x49f784
push esi
push ecx
push ecx
pop ebp
dec eax
push 0x486f6079
pushal
outsd dx, dword [esi]
dec eax
push eax
dec esi
pop eax
push edi
dec edi
imul ebx, dword [edi + edx*2 + 0x42], 0x405f6778
push esp
insb byte es:[edi], dx
push 0x4a
inc eax
pop esp
dec eax
dec ebx
insd dword es:[edi], dx
pop edi
inc ebx
push ecx
outsb dx, byte [esi]
inc ebx
inc edi
outsb dx, byte [esi]
inc eax
dec edx
jns 0x49f7ca
inc ecx
arpl word [ecx + 0x4a], di
arpl word [ecx + 0x4d], bp
dec ebx
pushal
push ecx
insd dword es:[edi], dx
push 0x5c
dec ebp
bound ebp, qword [edi + 0x5b]
pop ebp
popal
jns 0x49f7d4
insd dword es:[edi], dx
inc esi
inc edi
dec eax
pop esi
cmp ecx, 0xc0f6c127
je 0x46e94f
pop ebx
cmp dword [esp + 0x40], 0xf781b67f
je 0x4b6f55
jl 0x49f7aa
inc eax
jg 0x49f73f
xor edi, 0x77c4840f
add dword [eax], eax
ret
jl 0x49f7b9
js 0x49f750
invalid
push ebx
inc esp
aad 0x8d
dec esp
and al, 4
test dword [eax + eax], esp
add byte [eax], al

Function at 0x457df0
Capabilities:
Packed with generic packer

Disassembly:
inc esp
call fcn.00457d49
movdqa xmm1, xmmword [esi + 0x10]
inc esi
Function at 0x45929e
Capabilities:
Encode data using xor

Disassembly:
pop ebp
js 0x4592fe
imul ecx, dword [esi + 0x5c], 0x62
jnp 0x4592fb
pop ecx
pop ebx
insd dword es:[edi], dx
push edx
push edx
push esi
jnp 0x459301
push eax
inc eax
dec edi
push edx
outsb dx, byte [esi]
push eax
js 0x4592ff
js 0x45931e
pushal
test eax, esp
std
loopne 0x4592fa
invalid
invalid
call fcn.0045b6bc
cmp byte [ebp - 4], 0
leave
and eax, dword [eax]
add byte [eax - 0x36ff0383], al
jb 0x4592fb
mov edi, edi
call fcn.00457fe3
lea eax, [eax + ecx + 0x18]
mov edi, ecx
mov eax, ebx
push 0xa
cmp dword [ebp + 0x20], ebx
push 0x4071f8
mov eax, dword [edi]
mov eax, dword [ebp - 0x10]
and byte [eax - 8], ch
jno 0x459363
add byte [ebx - 0xfba74f9], cl
mov ebx, 0x8000
pushal
pop ax
push esi
outsb dx, byte [esi]
insd dword es:[edi], dx
insb byte es:[edi], dx
push esp
popal
push ecx
js 0x459392
dec edi
pop ecx
inc eax
push ebx
jmp 0x459342
mov ch, 0x40
add byte [eax + ecx - 1], dh
or bh, bh
and al, 0x95
xor byte [ecx + 0x40], 0
mov eax, dword [ebx + 8]
jne 0x459346
add esp, 0x18
push edx
insb byte es:[edi], dx
jbe 0x459344
mov esi, dword [ebp - 8]
clc
cmp dword [esp + 0x7c], 0xfa6bdf85
jne 0x459384
imul edi, edx, 0x75
sbb eax, 0x4c64fe3b
cmp edi, esi
dec esp
test eax, eax
call esi
xor eax, eax
cmp dword [ebp - 4], eax
mov dword [ebp - 4], eax
jb 0x459382
cmp dword [0x40b6d0], 3
ret
inc ecx
push esp
pop ecx
cmp dword [esp + 0x64], 0x1c5d03
cmove esi, edx
and dword [ebp - 4], 0
cmp eax, 0x1e86cc43
cld
add byte [0x1e86cc43], bh
jne 0x4593aa
push esi
push ecx
je 0x4593ae
mov dword [0x40a008], eax
mov ebx, eax
dec edx
dec ebx
pop esi
ret
push dword [esi + 0x68]
cmp edx, 0xe561a8ad
je 0x45935c
cli
lodsd eax, dword [esi]
test al, 0x61
in eax, 0x74
cmpsd dword [esi], dword es:[edi]
call 0x4593e0
imul ebp, dword [edx + 0x67], 0x55
push 0x5e
bound eax, qword [esi + 0x5d]
outsd dx, dword [esi]
inc bp
push edx
push edx
dec edx
push ebp
inc edx
dec ebx
imul eax, dword [ecx + 0x47], 0x5f5a426a
inc cx
dec esp
arpl word [edi + 0x59], bx
pop edi
imul esp, dword [ebx + 0x4d], 0x34ff7b64
and al, 0xe8
add byte [eax], al
add byte [eax], al
mov dword [esp], ebx
add dword [esp + 4], 0xfffaec8e
mov ebx, dword [esp + 4]
mov ebx, dword [ebx]
mov dword [esp + 4], ebx
add dword [esp + 8], 0x4d
pop ebx
ret
Function at 0x459407
Capabilities:
Packed with generic packer

Disassembly:
invalid
cmp dword [esp + 0x38], 0x98952a63
cmove eax, ebp
mov dword [ebp - 4], 0xfffffffe
cmp eax, 0x36956405
je 0x440fb9
call fcn.00459489
inc edi
dec esi
inc edx
pop edi
jns 0x459497
push ebp
inc ebx
insd dword es:[edi], dx
imul ebp, dword [ebx + 0x61], 0x5c4e446f
outsd dx, dword [esi]
imul ecx, dword gs:[esi + 0x4b], 0x794f6061
outsb dx, byte [esi]
dec ebx
push esp
jns 0x4594a2
dec ebp
dec ecx
bound eax, qword [esi + 0x65]
dec esp
dec edx
inc ecx
insd dword es:[edi], dx
inc ecx
pop esp
pop edi
push esp
outsb dx, byte gs:[esi]
outsb dx, byte [esi]
push esi
push edx
popal
arpl word [ecx + 0x43], di
dec esi
bound ebx, qword [ebx + 0x41]
popal
pushal
inc edx
bound eax, qword [ebp + eax*2 + 0x54]
push ebx
dec esp
dec ebp
dec ebp
inc ecx
inc ebx
inc ebx
js 0x4594d2
pop ebx
jns 0x4594e0
pop ebx
push ebp
push cx
push ebp
pop ebx
insd dword es:[edi], dx
invalid
Function at 0x45ad19
Capabilities:
Packed with generic packer

Disassembly:
and eax, dword [0x27c00b31]
sal dword [esi], cl
pop edi
sub al, 0xb2
invalid
popal
sub eax, 0xd11c1e00
jp 0x42281e
xor dword [eax + 0x2da3f544], ecx
nop
dec edi
cmp byte [ebx + 0x30], bl
daa
jbe 0x4228b1
iretd
mov esi, 0x793c1838
inc ebp
jns 0x4228fc
mov cl, 0xb4
jl 0x422929
ror dword [ecx], 0x42
cmp dword [0xdc24f1d8], eax
pop ss
retf 0x9a78
xor eax, 0x12b358f9
push edi
sbb bh, byte [esi + ebx*8]
mov al, 0xb9
salc
fidiv word [ebp + edi*4 - 0x28a30d27]
sub dword [0x5de1fb6d], edx
lodsd eax, dword [esi]
xchg esi, eax
jno 0x4228db
adc ax, word [esi]
cli
cmp dword [ebx], esi
iretd
sub al, 0x9b
stc
ud2
or ebp, dword [ebx]
loopne 0x4228f7
mov ch, 0
je 0x422885
mov al, byte [0xfed4db98]
jp 0x42291c
inc ebp
salc
xchg byte [ebx], dh
jae 0x422985
mov bl, 0x82
pop edi
mov bl, 0xfd
int 0x32
mov bl, 2
imul edi, edx, 0x3cc8b15f
sbb eax, 0x423590b6
xor eax, 0x587e3d42
mov al, byte [0xf3b74fc3]
xor eax, 0x587e3d42
pop eax
mov al, byte [0xf3b74fc3]
cmp ch, bh
jns str.5BX
jecxz 0x4228d0
mov byte [0x3fa60cf3], al
aas
imul esp, ebp, 0xffffff84
scasd eax, dword es:[edi]
stc
lds esi, [eax]
js 0x422957
mov bp, 0x10d5
jns 0x4229be
cmp ecx, ebp
popal
and al, 0x21
inc esi
pop esp
inc edi
lodsb al, byte [esi]
push ecx
sub eax, 0x82417cb3
or dword [eax], 0x6238e2e1
inc ecx
add byte [ecx + 0x38e2e108], 0x62
inc edx
pop dword [eax + 0x39326e56]
push esi
outsb dx, byte [esi]
xor bh, byte [ecx]
inc esp
xchg ebx, eax
sahf
mov edx, 0xfc30e1e5
fidiv dword [ebp + 0x63]
mov ch, 0x3b
out dx, al
insd dword es:[edi], dx
je 0x422969
std
dec ebp
cmpsb byte [esi], byte es:[edi]
iretd
salc
sbb dh, byte [ecx + 0x73]
mov ah, 0x12
invalid
or eax, 0xf070c326
sbb esp, dword [edx + edi*8 + 0x63]
jle 0x422931
dec ebx
out 0xb8, al
xchg edi, eax
outsd dx, dword [esi]
or eax, dword [esi]
test dword [edx + 0x47ed1135], 0x3b690da0
or eax, 0xd5613b69
and dh, ah
in eax, dx
retf
inc ecx
jp str.XdFv
sti
dec ebx
hlt
sub dh, byte [edi]
push ecx
jl 0x42297d
and ah, ah
jl 0x4229bd
mov es, word [esi - 0xd]
sar edi, cl
cli
fsubr st(6)
mov dword [0xcff29497], eax
aas
lodsd eax, dword [esi]
mov edi, 0xe733bcf7
or al, 0x2c
push ds
idiv dword [ebx + esi + 0x1e2c0ce7]
mov esp, es
clc
xor eax, 0x844cc1db
pop eax
inc esi
jbe 0x4229fa
loop str.7Q
mov bh, 0x6f
fidivr dword [edi]
mov dl, 0x71
jnp 0x4229bd
cmp dword [esi - 0x73], edx
xchg ebx, eax
popfd
sti
sub byte [eax - 0x76926d2f], 0xb6
insd dword es:[edi], dx
pop ecx
invalid
push esi
imul ecx, dword [edi + ecx*2 + 0x4f], 0x62654756
imul edx, dword [ebp + 0x78], 0x7b
inc esp
pop ebx
inc edx
jns 0x45ad88
push edx
inc eax
dec esi
pop esi
dec esi
imul dx, word [ebp + 0x61], 0x66
outsd dx, dword [esi]
dec ebp
outsd dx, dword [esi]
pushal
js 0x45ad98
push ebx
dec esi
pop esp
popal
push ebx
push eax
inc ebp
insd dword es:[edi], dx
jnp 0x45ad97
push eax
dec edx
dec cx
insb byte es:[edi], dx
insd dword es:[edi], dx
cmp ebx, 0x22001b03
je 0x449ef7
push eax
cmp dword [esp + 0x14], 0x52438ffb
je 0x4228b5
sub eax, 0x67000000
bound edi, qword [ebx - 0x7f]
add ch, bl
fld qword [eax]
add byte [ebp - 1], dl
ror byte [edi + 0x58], 1
Function at 0x45c5a2
Capabilities:
Packed with generic packer

Disassembly:
push 0x53
push edx
push edi
popal
dec esp
je 0x45c5d7
pop esi
test ebx, ebx
mov dword [ebp - 4], edi
mov esi, dword [ebp + 8]
cmp eax, 0x400
add esp, 0xc
mov dword [ebp - 4], 0
add al, 0
add byte [ebx + 0x45c70cc4], al
cld
add byte [eax], al
add byte [eax], al
mov dword [ebp - 4], edi
mov esi, ecx
sub esp, 0x10
call fcn.0045c0e2
mov esi, dword [ebp + 8]
call fcn.0045e45a
push ebp
push esi
add byte [ebp + 0x56], dl
call fcn.0045bd9b
push ebx
inc edx
push edx
jb 0x45c5b6
and edx, ecx
mov dword [ebp - 8], eax
mov eax, 0x408134
jne 0x45c605
cmp eax, ebx
push edi
pushal
push ebp
cmp ecx, 0x2508a8af
cmove esi, ecx
int1
push esi
cmp dword [esp + 0x7c], 0xc4870141
xchg esp, eax
cmove eax, ebp
call fcn.0045c688
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx - 0x20]
jmp 0x45c623
add dword [ebp + 0x10478dc0], eax
Function at 0x45db1c
Capabilities:
Packed with generic packer

Disassembly:
rcr byte [edi + 0x55], 0x4f
bound ebx, qword [esi - 0x75]
push esp
and al, 0x34
cmp dword [eax + 8], 0xffffffff
lea ecx, [esi - 0x20]
pop ecx
push dword [ebp + 0x24]
cmp esi, 0x40a9e0
pop edx
js 0x45db7b
pop esi
push edx
lea edx, [esp + 0xa]
call 0x45db2a
mov dword [esp], ecx
call 0x45db32
mov dword [esp], ebp
mov ecx, esi
add ecx, 0xfffad515
push word [esp + 0x10]
popf
mov dword [ecx], eax
mov ebp, dword [esp]
lea esp, [esp + 4]
pop ecx
lock xchg dword [esp], edx
lea esp, [esp + 4]
pop esi
lea esp, [esp + 2]
call fcn.0045dbde
lea ecx, [ecx + eax + 4]
lea eax, [eax*8 + 1]
call int.0045e2d7
push esi
test esi, esi
inc esi
mov edi, 0x80000000
or dword [eax], 0xffffffff
test eax, eax
add byte [ebx - 0x3f7a00f8], 0x74
or byte [edx + 0x36a0346], cl

Function at 0x45f599
Capabilities:
Encode data using xor

Disassembly:
dec ecx
dec esp
arpl word [ebp - 0x7d], bp
les ecx, [edi + edi*8]
and al, 0x8d
js 0x45f614
inc eax
add byte [ebx + 0x79], ch
sbb esi, esi
mov dword [esi + 0x64], 0x82
push eax
mov ecx, dword [ebp + 8]
jne 0x45f5be
push ss
pmaxub mm3, qword [esi]

Function at 0x45fa50
Capabilities:
Packed with generic packer

Disassembly:
std
cmpsd dword [esi], dword es:[edi]
sahf
std
dec esp
test byte [ebx - 0x69], 0x1e
pop ebx
jmp [edi]
dec ecx
cld
mov dword [ebp - 0x21c], ecx
cmp dword [esp + 0x58], 0x76729737
je 0x420384
mov dword [ebp - 0x328], 0xc0000417
cmp dword [esp - 0x18], 0xf2875fb3
jne 0x45faab
pop edi
push esp
pop eax
push esi
inc esp
inc eax
dec ebp
inc eax
pushal
dec esp
push ebp
js 0x45fad7
pushal
pop ecx
push 0x6a464368
arpl word [esi + 0x40], dx
push edx
pop esi
push edx
pop esp
dec esi
inc esi
push 0x50
imul eax, dword [esi + 0x4c], 0x406f5c63
dec eax
push si
pop edi
inc eax
pop edi
inc edi
push edx
imul ecx, dword [ebx - 0x39], 0xffffff85
fdiv st(4), st(0)
invalid
mov dword [ebp - 0x324], 1
cmp edi, 0x2c161ec9
cmove edi, edi
mov dword [ebp - 0x31c], eax
cmp dword [esp - 0x18], 0xfcc90eb3
jne 0x45fb21
inc ebx
imul ecx, dword [esi + 0x4d], 0x5479595d
pop ecx
jns 0x45fb2e
pushal
inc edx
push 0x57
push ebp
dec ebx
inc ebx
dec esi
call fcn.0045fb9d

Function at 0x46052a
Capabilities:
Packed with generic packer

Disassembly:
je 0x460548
mov dword [edi + 0x64], eax
dec esi
push 0x10
mov esi, dword [ebp - 0x1c]
inc edi
push 0x40b7f0
cmp eax, dword [0x40aabc]
test eax, eax
outsb dx, byte [esi]
pop edx
mov esi, 0x40b338
mov dword [ebp + 0x10], ecx
pop esp
inc esi
inc eax
add byte [ecx + 0x465c104d], cl
mov edi, edi
inc eax
inc edx
jns 0x4605a5
push esi
shr ebx, cl
xor eax, eax
mov eax, dword [ebp - 8]
mov dword [edi + ecx*4 + 0x1c], eax
push ebx
call 0x461a98
jmp 0x460584
dec esp
imul esp, dword [edi + 0x62], 0x61

Function at 0x4623ea
Capabilities:
Check for software breakpoints

Disassembly:
or byte [edx + 0x44], dl
mov edx, dword [ebp + 0xc]
jbe 0x4623f6
leave
je 0x462430
mov byte [edi + 2], al
call fcn.00462213
jnp 0x462459
inc edi
add ch, al
push ss
invalid
dec edi
push edi
mov byte [edi + 3], al
pop edi
jne 0x46240f
pop ebx
mov eax, dword [ebp + 0x10]
lea esi, [ecx + esi - 4]
jmp 0x46241b
inc dword [ecx]
add byte [ecx], al
add bl, al
Function at 0x464208
Capabilities:
Encode data using xor

Disassembly:
jnp 0x464251
inc esi
dec edi
inc ebx
imul ebp, dword [eax - 0x75], 0x68680c55
jne 0x464262
mov eax, dword [eax + 4]
push esi
jne 0x464272
dec edx
call fcn.00462f18
pop ebx
ret
hlt
dec eax
fbstp tbyte [ebp + 0x45]
push esp
pop ebx
pop edx
jnp 0x4642d5
dec eax
js 0x4642b1
inc eax
dec eax
pop esp
push ebx
dec eax
dec ebp
pushal
popal
insb byte es:[edi], dx
inc eax
jns 0x4642cd
jns 0x4642c9
imul ecx, dword [ebx + 0x55], 0x674a6944
dec ecx
pushal
pop ebp
pop ecx
mov ah, 0x75
or byte [ecx + 0x66], ch
inc ebx
pop edi
inc edi
mov dl, 0xf2
test byte [ebx - 0x7ea9f7a3], 0x7c
and al, 0x34
mov eax, dword [0xf7d27b8]
test byte [esi + 0x21], cl
cld
xor al, 0xa1
mov eax, 0x840f7d27
dec esi
and esp, edi
call dword [edi - 0x7f]
jl 0x464308
dec eax
in eax, 0x34
jne 0x4642f1
cmp byte [edi], dh
add byte [eax], 0
add byte [eax + ebx*8 + 0x57], dh

Function at 0x465afc
Capabilities:
Encode data using xor

Disassembly:
inc ebp
pop eax
jns 0x465b79
dec edi
inc ecx
jnp 0x465b69
dec ebp
dec edx
dec ebp
dec edx
dec esp
push esi
dec edx
pop ebx
imul ebx, dword [edi + 0x7b], 0x6e
bound ecx, qword [edx + 0x5c]
dec ebx
dec ecx
dec esp
pop ecx
push ecx
push esi
imul ecx, dword [ebx + 0x6e], 0x5f694f58
push ebp
invalid

Function at 0x4683d9
Capabilities:
Packed with generic packer

Disassembly:
mov ebx, dword [esp]
lea esp, [esp + 4]
lea esp, [esp - 4]
mov dword [esp], ebp
lea ebp, [esp + 6]
push ecx
lea esp, [esp - 4]
mov dword [esp], esi
mov ecx, ebx
add ecx, 0xfffa2502
push word [esp + 0xc]
popf
mov edi, dword [ecx]
lock xchg dword [esp], esi
lea esp, [esp + 4]
mov ecx, dword [esp]
lea esp, [esp + 4]
pop ebp
lea esp, [esp + 2]
cmp edx, 0xa3e777fb
je 0x460261
pushf
push edi
call fcn.004684a1
dec eax
jle 0x468491
mov ebx, dword [eax + 8]
cmp eax, 0xffffffff
inc edi
mov esi, dword [ebp + 8]
call fcn.00469597
push esi
jne 0x46845c
bound edx, qword [edx + 0x65]
dec edx
pop esp
mov ecx, dword [esp + 4]
std
pop ebx
dec esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor eax, eax
jb 0x46847d
mov ecx, esi
mov ecx, dword [ebp - 0x18]
jmp 0x468476
call fcn.00468233
call ecx
inc ecx
pop esi
pop ebp
imul edx, dword [eax + 0x50], 0x79896c4e
or byte [eax], ch
add dword [eax], eax
add byte [ebx + 0x4e66fcf8], cl
dec esi
insb byte es:[edi], dx
mov bl, byte [esi]
jmp 0x4b3c9e

Function at 0x46c45d
Capabilities:
Packed with generic packer

Disassembly:
push es
mov al, byte [esi + 3]
add eax, 8
ja 0x46c473
cmp eax, 2
jne 0x46c458
push esi
mov eax, dword [ebp + 0x10]
arpl word [ebx + eax*8 - 0x7b], bx
ror byte [edi], cl
test byte [edx], bl
add byte [eax], al
add byte [ecx - 0x36b3db84], al
cmp dword [esp + 0x4c], 0xc062bac9
jne 0x46c46e
mov byte [edx - 1], 0
call edi
jnp 0x46c4e7
les ecx, [edi]
test byte [ebp - 0x7c000382], ah
cld
add byte [eax + 0x2168003e], al
sbb al, byte [eax]
add byte [esi + 0x50], ah
lock xchg dword [esp], eax
Function at 0x46fba9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edx
push ecx
js 0x46fc05
push eax
push ebx
outsw dx, word [esi]
dec ebx
pop esi
dec eax
dec ebx
arpl word [esi + 0x46], bx
push esi
push eax
dec ecx
pop eax
pop ecx
imul dx, word [ebx + 0x5b], 0x5b
pop ebp
pop ecx
push ebx
inc ebp
inc ebx
bound edx, qword [edi + 0x51]
insb byte es:[edi], dx
dec ecx
push 0x4f615a40
inc ecx
imul ecx, dword [esi + 0x65], 0x63
invalid
invalid
pop edx

Function at 0x46fbd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edx
push ecx
js 0x46fc05
push eax
push ebx
outsw dx, word [esi]
dec ebx
pop esi
dec eax
dec ebx
arpl word [esi + 0x46], bx
push esi
push eax
dec ecx
pop eax
pop ecx
imul dx, word [ebx + 0x5b], 0x5b
pop ebp
pop ecx
push ebx
inc ebp
inc ebx
bound edx, qword [edi + 0x51]
insb byte es:[edi], dx
dec ecx
push 0x4f615a40
inc ecx
imul ecx, dword [esi + 0x65], 0x63
invalid
invalid
pop edx

Function at 0x47000b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop ecx
lea esp, [esp - 4]
mov dword [esp], edx
lea edx, [esp + 0xa]
call 0x47001f