joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002599f
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10036080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10019ef6
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10019ef6
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10025a16
cmp word [ecx], dx
je 0x10025a16
mov eax, dword [0x1002f6d4]
push edi
dec eax
push eax
push 0x1002f5c0
call fcn.1002593e
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10025a89
cmp word [eax], dx
je 0x10025a89
mov eax, dword [edi]
test eax, eax
je 0x10025a3a
cmp word [eax], dx
je 0x10025a3a
lea eax, [ebp - 0x10]
push eax
call fcn.10025321
jmp 0x10025a43
lea eax, [ebp - 0x10]
push eax
call fcn.100253bc
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10025ab3
mov eax, dword [0x1002f5bc]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1002f2b0
call fcn.1002593e
add esp, 0xc
test al, al
je 0x10025ab3
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10025a7e
cmp word [eax], di
je 0x10025a7e
lea eax, [ebp - 0x10]
push eax
call fcn.10025321
pop ecx
jmp 0x10025ab5
lea eax, [ebp - 0x10]
push eax
call fcn.100253bc
jmp 0x10025a7b
mov eax, dword [edi]
test eax, eax
je 0x10025aa0
cmp word [eax], dx
je 0x10025aa0
lea eax, [ebp - 0x10]
push eax
call fcn.100252d6
pop ecx
jmp 0x10025ab3
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10025b7e
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.100257c3
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10025b7e
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10025b7e
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10025b7e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10025b0b
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1001ca5f
test ebx, ebx
je 0x10025b79
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1001ca5f
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025b7e
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10025b7e
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10028162
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10025b80
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a607
leave
ret
Function at 0x10028431
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100283ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100285a0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100285a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10028555
jg 0x1002848d
test eax, eax
je 0x1002854b
push 1
push 0x1000
call fcn.10018a92
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100284b0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10028542
push 0x8000
push ebx
call fcn.100282de
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100284d9
jg 0x100284d4
cmp ecx, 0x1000
jb 0x100284d9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001e36a
add esp, 0x10
cmp eax, 0xffffffff
je 0x1002851e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100284d4
jl 0x10028505
test ecx, ecx
jne 0x100284c6
push dword [ebp - 0xc]
push ebx
call fcn.100282de
push esi
call fcn.10018aef
add esp, 0xc
xor ebx, ebx
jmp 0x100285ae
cmp byte [edi + 0x24], 0
je 0x10028535
cmp dword [edi + 0x20], 5
jne 0x10028535
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10028540
mov ebx, dword [edi + 0x18]
jmp 0x10028542
xor ebx, ebx
push esi
call fcn.10018aef
pop ecx
jmp 0x100285ae
test ecx, ecx
jg 0x10028517
jl 0x10028555
test eax, eax
jae 0x10028517
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001fde5
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10028575
cmp byte [edi + 0x1c], 0
je 0x10028517
jmp 0x100285a6
push ebx
call fcn.10025f59
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10028517
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100285ae
cmp byte [edi + 0x1c], 0
je 0x100285ab
mov ebx, dword [edi + 0x18]
jmp 0x100285ae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001fde5
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029c60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10029c8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10029c8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401407
Capabilities:
Terminate process

Disassembly:
push ebx
mov eax, 0xfa07
mov ebx, 0x12345678
mov ecx, 0x12345678
mov edx, 0x12345678
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [section..data], eax
jmp loc.0047b432
Function at 0x420b0a
Capabilities:
Encode data using xor

Disassembly:
std
and edi, eax
int1
mov bl, byte [edx]
cld
jecxz 0x420b14
arpl word [ecx - 0x14], ax
retf
jmp 0x420b83
mov edx, 0x4c61b4fc
dec ebx
leave
popfd
jnp 0x420b06
adc al, 0xe0
mov ah, 0x69
mov eax, 0x34b5dc00
loopne 0x420ac3
rcr cl, 0x73
movsb byte es:[edi], byte [esi]
test byte [edx - 0x24], ch
mul dword [eax + 0x24]
xchg eax, eax
sal dword [edx + esi*2], 1
in al, dx
aad 0x54
arpl cx, di
movsd dword es:[edi], dword [esi]
dec edx
xor al, 0xa2
sal dword [ebx - 0x49], cl
inc esi
cmpsb byte [esi], byte es:[edi]
adc al, 0x4f
in al, 0xb7
les esi, [ecx - 0x5b]
jae 0x420b33
and byte [edx + esi*8], al
dec ecx
pop edi
sal ebp, 0xbc
rol byte [ecx + 0x6e], 1
lcall 0xab96, 0x6575d373
invalid
mov ebx, 0xa38eddbc
push esp
rcr byte [esp + esi*2 + 0x51], cl
jp 0x420bc4
sbb edi, dword [ecx + 0x54f07839]
mov ebp, esi
xchg edi, eax
mov edx, 0x5af7ba5d
push dword [edx]
push ebx
ljmp 0xe1b5
std
or al, 0x2c
add dword [ecx + 0x2f], ecx
hlt

Function at 0x42eed2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add eax, 0xf10e0c1
mov dh, 0x5c
xor dword [edx], eax
Function at 0x42f3ad
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00541c7d
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f475
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00541c7d
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0053b958
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f51b
cmp edi, dword [esi + 0x7c]
jge 0x42f51b
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443dbf
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443dbf
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541c7d
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541c7d
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f46d
jmp 0x42f43d
call fcn.00447fe6
int3
Function at 0x43f2f1
Capabilities:
Encode data using xor

Disassembly:
inc ecx
rcr esp, 1
add dword [0xa0299f1], ebp
sbb al, 0x7e
scasb al, byte es:[edi]
aam 0x11
adc dword [esi], 0xf3b69d53
mov dh, 0xf3
outsd dx, dword ss:[esi]
mov dword [0xff5230bc], eax
test al, 0xf7
fdiv dword [ecx - 0x711af7ed]
jge 0x43f2b4
push eax
sub dword [eax + ebx*4 - 0x6aa96af], ecx
dec ebp
or byte ss:[esi], ah
rcr byte [ecx], 0x50
push ds
mov byte [ebp - 0x51], al
pop eax
adc dword [ecx - 0x4a], eax
jle 0x43f279
inc ecx
mov dh, 0x7e
sar dword [eax - 0x798d7dc], 0xa0
call 0x245152c1
dec esp
mov eax, 0xf8672824
mov al, byte [0xd5ffee8]
and al, 0x4c
pop edi
or eax, 0x74074c24
lds esp, [esi - 0x710e0a42]
add ebx, edi
pop es
je 0x43f28c
cmpsb byte [esi], byte es:[edi]
mov esi, 0x18ef1f5
sti
cmc
movsd dword es:[edi], dword [esi]
mov edx, 0x4713f0d
mov al, 0x56
add al, 0xb0
push esi
cmc
movsb byte es:[edi], byte [esi]
adc eax, 0x93d2b6c6
in eax, 0xfb
or byte [0xee4c99a4], bl
pop ebx
and eax, 0xd5ee3771
out dx, eax
xor dword [ebx], ecx
jg 0x43f2c8
in eax, dx
loopne 0x43f2d4
cmp ecx, dword [ebx]
lds esp, [eax - 0x199e0a4a]
mov byte [0x99c75a45], al
adc byte [esi + 0x52], bl
mov byte [0x30a3d062], al
cdq
cwde
cmp al, 0x85
call [0x4eaee359]
pop ecx
jecxz 0x43f2c0
dec esi
jae 0x43f30f
out 0xfa, eax
fld xword [esi]
loopne 0x43f32b
xlatb
into
and ebp, ebp
jo 0x43f342
sbb dword [edx - 0x31], eax
inc edx
out dx, eax
clc
xlatb
fcomp qword [edi]
int1
nop
mov es, esp
jbe 0x43f2bd
sub ch, byte [ebx - 0x311c0702]
xchg ch, cl
cli
ret 0x8b90
push ss
mov esi, 0xa79622ea
dec esp
sub bl, ch
int3

Function at 0x445ded
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445e16
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
Function at 0x445e2a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005586bd
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445eb5
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
fmul qword [esi + 0x88]
call fcn.005586bd
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00552398
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445f5b
cmp edi, dword [esi + 0x7c]
jge 0x445f5b
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a7ff
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a7ff
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
call fcn.005586bd
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005586bd
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445ead
jmp 0x445e7d
call fcn.0045ea26
int3

Function at 0x456b35
Capabilities:
Check for software breakpoints

Disassembly:
shl byte [ebx - 4], 1
fisub dword [edi - 0x4d]
pop ds
inc edi
or dword [eax + 0x1a], ecx
jo 0x456b43
out dx, eax
invalid

Function at 0x45c84d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38

Function at 0x45c856
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]

Function at 0x45c86a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
Function at 0x45c898
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call fcn.0056f11d
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c915
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0056f11d
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00568df8
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45c9bb
cmp edi, dword [esi + 0x7c]
jge 0x45c9bb
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0047125f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and al, 0x24
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0047125f
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056f11d
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056f11d
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c90d
jmp 0x45c8dd
call fcn.00475486
int3

Function at 0x467d2d
Capabilities:
Encode data using xor

Disassembly:
sub ch, byte [edi]
xor eax, 0xd21df23f
xchg ebx, eax
mov bh, 0x81
fistp word [edi + 0x587a9ae5]
in eax, 0xcf
mov cl, 0x2f
add ecx, dword [ecx]
pushal
out dx, eax
jge 0x467d2f
scasd eax, dword es:[edi]
or al, 0x3a
mov bh, 0xa8
or dword [0xc94132c1], 0xbbe5efc2
sub byte [edi - 0x123d2476], 0xe1
xchg dword [edi], edx
dec ebx
and eax, 0xf4bf885e
into
neg byte [esi - 0x75dc2d5a]
scasd eax, dword es:[edi]
out dx, eax
jecxz 0x467dd6
in al, 0xfd
cmp byte [ecx], bh
xor al, 0xca
sub byte [ecx - 0x252b2d18], ah
adc eax, 0x356e3532
rcl ebp, cl
add ecx, edi
in al, dx
iretd
sbb dh, byte [ebp + 0x660fd135]
pop ecx
popfd
pop ebp
inc eax
aam 0xae
sti
in al, 0x2e
in al, 0xef
ret
adc ch, dh
jo 0x467da0
invalid
Function at 0x4731ae
Capabilities:
Encrypt data using rc4 prga

Disassembly:
subps xmm0, xmm1
mulps xmm0, xmm3
add edx, 4
add ebp, 4
cvtps2pi mm3, xmm0
movss xmm0, dword [ebp]
movss xmm1, dword [edx]
unpcklps xmm0, xmm1
movmskps ecx, xmm2
movaps xmm2, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
cvttps2pi mm0, xmm0
movlhps xmm2, xmm7
movlhps xmm6, xmm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
add esi, eax
add edi, 3
movq mm1, mm0
pcmpeqd mm0, mm6
cmpltps xmm2, xmm6
paddd mm0, mm1
cvtpi2ps xmm1, mm0
cmp ecx, 0
jne fcn.004731ae
movq mm2, qword [esp]
sub dword [esp + 0x30], 1
jne 0x47307b
movmskps ecx, xmm2
cmp ecx, 0
jne 0x4732ba
subps xmm0, xmm1
mulps xmm0, xmm3
cvtps2pi mm3, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
add esi, eax
movq mm2, qword [esp]
movq mm4, mm3
psubd mm2, mm3
movq mm3, mm2
punpckldq mm2, mm4
punpckhdq mm3, mm4
packssdw mm2, mm2
packssdw mm3, mm3
mov ecx, dword [esp + 0x20]
and byte [edi], cl
mov dh, 0x46
add eax, ecx
loopne 0x47321a
movzx ebx, byte [esi]
or eax, ebx
movd mm5, eax
movzx eax, byte [ecx + esi + 3]
shl eax, 0x10
movzx ebx, byte [ecx + esi]
or eax, ebx
movd mm1, eax
punpckldq mm5, mm1
movzx eax, byte [esi + 4]
shl eax, 0x10
movzx ebx, byte [esi + 1]
or eax, ebx
movd mm4, eax
movzx eax, byte [ecx + esi + 4]
shl eax, 0x10
movzx ebx, byte [ecx + esi + 1]
Function at 0x47364d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585f1d
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473715
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00585f1d
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057fbf8
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4737bb
cmp edi, dword [esi + 0x7c]
jge 0x4737bb
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048805f
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048805f
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f1d
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f1d
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x47370d
jmp 0x4736dd
call fcn.0048c286
int3
Function at 0x48a8ed
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059d1bd
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a9b5
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059d1bd
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596e98
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48aa5b
cmp edi, dword [esi + 0x7c]
jge 0x48aa5b
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0049f2ff
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0049f2ff
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d1bd
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d1bd
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a9ad
jmp 0x48a97d
call fcn.004a3526
int3