joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40555b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [0x422588], 0x44
push eax
xor eax, eax
push 0x422588
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405596
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405620
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004058cf
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405654
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x424008], eax
jmp 0x4057e8
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405672
test eax, eax
je 0x405793
test byte [ebp + 0xc], 2
je 0x405793
mov esi, 0x421588
push edi
push esi
call fcn.00405cfb
test ebx, ebx
je 0x40568f
push str..
push esi
call sub.KERNEL32.dll_lstrcatA
jmp 0x405695
push edi
call fcn.00405835
cmp byte [edi], 0
jne 0x4056a3
cmp byte [0x421588], 0x5c
jne 0x4056ae
push 0x409010
push edi
call sub.KERNEL32.dll_lstrcatA
push edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x405789
lea eax, [ebp - 0x11c]
push 0x3f
push eax
lea esi, [ebp - 0x11c]
call fcn.00405819
cmp byte [eax], 0
je 0x4056f4
cmp byte [ebp - 0x18], 0
je 0x4056f4
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x40570a
mov al, byte [esi + 1]
test al, al
je 0x405768
cmp al, 0x2e
jne 0x40570a
cmp byte [esi + 2], 0
je 0x405768
push esi
push ebx
call fcn.00405cfb
test byte [ebp - 0x148], 0x10
je 0x40572f
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405768
push dword [ebp + 0xc]
push edi
call fcn.00405620
jmp 0x405768
push edi
call fcn.004059b3
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405760
test byte [ebp + 0xc], 4
je 0x405758
push edi
push 0xfffffffffffffff1
call fcn.00404fe7
push 0
push edi
call fcn.00405a49
jmp 0x405768
inc dword [0x424008]
jmp 0x405768
push edi
push 0xfffffffffffffff2
call fcn.00404fe7
lea eax, [ebp - 0x148]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4056d2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 4], 0
je 0x405793
and byte [ebx - 1], 0
xor esi, esi
pop ebx
cmp dword [ebp - 4], esi
je 0x4057e8
cmp dword [ebp - 8], esi
jne 0x4057a8
inc dword [0x424008]
jmp 0x4057e8
push edi
call fcn.00405ff6
test eax, eax
je 0x4057e8
push edi
call fcn.004057ee
push edi
call fcn.004059b3
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x4057e0
test byte [ebp + 0xc], 4
je 0x4057a0
push edi
push 0xfffffffffffffff1
call fcn.00404fe7
push esi
push edi
call fcn.00405a49
jmp 0x4057e8
push edi
push 0xffffffffffffffe5
call fcn.00404fe7
pop edi
pop esi
leave
ret 8
Function at 0x405be2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405c53
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405c42
cmp dword [ebp + 0x14], 1
je 0x405c44
cmp dword [ebp + 0x14], 2
je 0x405c44
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14

Function at 0x405d1d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x405d3b
mov ecx, dword [0x42375c]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x423fb8]
mov edx, dword [ebp + 8]
add ecx, eax
mov eax, 0x422f20
push ebx
sub edx, eax
push esi
push edi
cmp edx, 0x800
mov edi, eax
jae 0x405f3a
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
jmp 0x405f3a
mov esi, edi
sub esi, eax
cmp esi, 0x400
jge 0x405f44
inc ecx
cmp dl, 0xfc
mov dword [ebp + 0xc], ecx
jbe 0x405f2d
movsx eax, byte [ecx + 1]
movsx ecx, byte [ecx]
mov esi, eax
mov ebx, ecx
and esi, 0x7f
and ebx, 0x7f
shl esi, 7
or esi, ebx
mov ebx, ecx
add dword [ebp + 0xc], 2
or bh, 0x80
mov dword [ebp - 0x18], ebx
mov ebx, ecx
mov ecx, eax
mov dword [ebp - 0x14], ebx
or ch, 0x80
cmp dl, 0xfe
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
jne 0x405ed7
push 2
pop esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x405de7
cmp ax, 0x5a04
je 0x405de7
cmp dword [ebp - 0xc], 0x23
je 0x405de7
cmp dword [ebp - 0xc], 0x2e
je 0x405de7
and dword [ebp - 4], 0
jmp 0x405dee
mov dword [ebp - 4], 1
cmp dword [0x424004], 0
je 0x405dfa
push 4
pop esi
test bl, bl
jns 0x405e35
invalid

Function at 0x40601d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x406041
xor eax, eax
test eax, eax
je 0x406053
cmp byte [ebp + eax - 0x121], 0x5c
je 0x406053
xor ecx, ecx
jmp 0x406056
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1014
push ebp
mov ebp, esp
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
or eax, 0xffffffff
mov dword [0x415c84], 9
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
mov dword [ebp - 8], eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
test esi, esi
jle 0x40aee4
mov ecx, 0x1000
xor eax, eax
lea edx, [ebp - 0x1010]
push edi
mov edi, edx
rep stosb byte es:[edi], al
pop edi
mov eax, edx
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
mov eax, esi
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
mov edi, eax
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
mov eax, esi
sub eax, edi
test eax, eax
mov esi, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x6d4f09d1
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x68f4533b
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x10027350
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x10027514
pushal
mov esi, 0x10026015
lea edi, [esi - 0x25015]
push edi
jmp 0x1002737a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x10027381
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x10027370
mov eax, 1
add ebx, ebx
jne 0x10027393
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x10027388
jne 0x100273a4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x10027388
xor ecx, ecx
sub eax, 3
jb 0x100273b8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1002742a
mov ebp, eax
add ebx, ebx
jne 0x100273c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x100273d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x100273f4
inc ecx
add ebx, ebx
jne 0x100273e0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x100273d5
jne 0x100273f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x100273d5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x10027414
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x10027405
jmp 0x10027376
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x10027414
add edi, ecx
jmp 0x10027376
pop esi
mov edi, esi
mov ecx, 0x95
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x10027432
cmp byte [edi], 2
jne 0x10027432
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x10027437
lea edi, [esi + 0x25000]
mov eax, dword [edi]
or eax, eax
je 0x100274a6
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x27000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2703c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x10027464
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x27040]
or eax, eax
je 0x100274a0
mov dword [ebx], eax
add ebx, 4
jmp 0x10027481
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x100274d7
cmp al, 0xef
ja 0x100274ca
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x100274ac
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x100274b9
mov ebp, dword [esi + 0x27044]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1002750b
sub esp, 0xffffff80
jmp 0x100034b0
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x60e939e2
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x42e060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x71583c9d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x414348
Capabilities:
Encode data using xor

Disassembly:
mov word [ebp + 0x1c96a198], gs
lds esp, [edx + 0xc]
xor al, 0x77
xor eax, 0x57537734
fdivr qword [edx - 0x4c]
test al, 0xc9
and byte [edi + 0x13], bl
pop ebp
invalid

Function at 0x418b2b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52b3fb
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418bf3

Function at 0x418c76
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52b3fb
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5250d6
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418c99
cmp edi, dword [esi + 0x7c]
jge 0x418c99
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042d53d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042d53d
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52b3fb
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call 0x52b3fb
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418beb
jmp 0x418bbb
call fcn.00431764
int3

Function at 0x420397
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x6db07146
dec esi
lodsd eax, dword [esi]
mov byte [0xcb5f94a], al
sti
ja 0x4203ed
inc ecx
dec ecx
mov eax, ebx
dec eax
mov eax, 0x57e9fc88
xor al, 0x17
stc
retf
push ecx
mov eax, 0xb511b5be
inc dword [edi + 0x4a9601b7]
adc dword [ebp + 0x1b787ff], esi
xchg esi, eax
dec edx
paddsw mm4, qword [ebx + 3]
imul ecx, dword [edi], 0x86798e7d
cmp al, 0x96
add dl, byte [ecx + 0x74faf568]
mov byte [edi + 0x1b], ch
aam 0xe2
xor edi, edx
ja 0x4203f2
sbb dl, byte [ecx]
test eax, 0x29bd09b8
test dword [ebx], 0xf5e75a86
stosb byte es:[edi], al
invalid
Function at 0x42d4b2
Capabilities:
Encode data using xor

Disassembly:
sbb dword [ecx + edi*8], ecx
mov ebx, 0x9dbffdb6
popfd
mov ss, word ds:[ecx]
xchg dword [edi + 0x2a38555e], edx
dec edi
push 0xdc85accf
rcr byte [ecx - 0x75], cl
dec edi
mov bh, 0xff
mov esp, 0x6de4e728
fld st(1)
salc
cmp al, 0xc0
push edi
jne fcn.0042d4b2
mov ch, 0xb8
loop 0x42d490
aas
fild word [edx + 0x16]
lodsd eax, dword [esi]
imul bh
int3
pop ecx
xor byte [ebp + ebp - 0x4f], ah
dec ebx
or byte [edx - 0x2bc20230], bl
push ecx
mov ah, 0
sub ebp, dword [ebp + esi*8 - 0x6249bda1]
or dword [ebx + 0x54], eax
xchg esi, eax
sbb eax, 0x9dfde0e2
jnp 0x42d41f
push cs
sbb cl, dh
rcr bh, cl
cmp byte [edx + eax*2], ah
pop ebp
add dl, byte [edx + ebp*8 + 2]
sal byte [0x5b1bf07c], cl
and al, 0xbe
ljmp 0x8163
sbb dl, dl
pop edx
mov eax, 0x4cf1493e
dec esp
lodsb al, byte [esi]
jno 0x42d461
and eax, 0xe9f38c29
xor esi, esp
mov bh, 0xc9
dec edi
salc
clc
aad 0x26
xor ecx, dword [esp + ebx*2 + 0x36]
mov ch, 0x95
push ds
dec edx
jge 0x42d4b9
int3

Function at 0x42f033
Capabilities:
Encode data using xor

Disassembly:
test byte [edi - 0x65], 0x59
inc ecx
jae 0x42f08c
mov byte [ecx*2 - 0x5cc33bae], dl
push edx
les edi, [ebx]
pop eax
out 0xd8, al
mov esi, 0x1c6b8226
cwde
sbb byte [eax], ch
sub ch, bl
push eax
jecxz 0x42f05e
fmulp st(0)
xor eax, 0x393ad269
mov bl, 0x40
mov ebp, 0x5e2324c6
loop 0x42f029
wait
mov ch, 0x60
retf 0xbb11
Function at 0x42fbbb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0054248b
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42fc83
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0054248b
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53c166
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42fd29
cmp edi, dword [esi + 0x7c]
jge 0x42fd29
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.004445cd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.004445cd
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0054248b
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0054248b
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42fc7b
jmp 0x42fc4b
call fcn.004487f4
int3

Function at 0x4375c1
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
xlatb
push ebx
mov eax, 0x9a3969f1
cli
invalid
loop 0x437571
Function at 0x4424d8
Capabilities:
Encode data using xor

Disassembly:
push eax
add eax, 0x64dbdafd
pop eax
out 0xfd, al
or eax, 0xaf922254
push cs
stc
mov esp, 0x5e0bfc49
xchg edx, eax
fisttp word [esi]
or edx, edx
inc edx
sbb eax, dword [ecx + 0x420a4c67]
out dx, al
les esi, [esi - 0x3d0932e9]
xchg esp, eax
inc ebx
test ah, bh
sbb eax, 0xeeee6b0d
outsb dx, byte [esi]
sbb dword [esp + edi*2], edi
out dx, eax
sub dword [ebp + ecx*8 - 0xcd5a963], eax
xor esi, ecx
pop edi
in eax, dx
push 0xffffffffffffffe4
popal
imul byte [ebp + 0x66ed7acb]
adc dword [ebp + 0x62362caf], edi
pop eax
leave
xlatb
pop ebx
popal
lodsd eax, dword [esi]
fiadd dword [ecx + 0x356a78b9]
xchg ebp, eax
jb 0x4424a7
pushfd
or bh, byte [ebx - 0x69d7b5b1]
and edx, dword [ebp - 0x6e2f31c8]
mov cl, 0x91
out dx, al
push esi
xchg dword [ebp + 0x56], esp
cmp dword [ebp - 0x68], esi
sal byte [esi - 0x1d], cl
cli
adc ch, ch
mov al, 0x36
cmpsb byte [esi], byte es:[edi]
cmp byte [eax - 0x45a1827a], 0xc2
or byte [ebx - 3], bh
jge 0x442521
rcl dword [edi - 0x4b9e5000]
invalid

Function at 0x4467fb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]

Function at 0x4687cb
Capabilities:
Encode data using xor

Disassembly:
and byte [0x233f0ffc], ch
stc
sub dh, bh
std
in al, dx
sub al, dh
lcall 0x15e8, 0x28788920
outsb dx, byte [esi]
out dx, eax
fdivr st(1)
or al, 0x2a
and byte [esi], dh
call 0x2076bc01
and byte [ebx], dh
push dword [edx]
clc
and byte [ebx], dh
push dword [edx]
clc
fadd qword [eax - 0x52]
aad 0xd1
jne 0x4687ab
cmc
retf 0xd775

Function at 0x4731c8
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x4c062cc2
mov byte [edi - 0x552d582d], ah
inc edi
pushfd
mov ch, 0x4e
pop ss
invalid
Function at 0x47445b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586d2b
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x474523
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586d2b
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00580a06
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4745c9
cmp edi, dword [esi + 0x7c]
jge 0x4745c9
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488e6d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488e6d
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586d2b
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586d2b
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x47451b
jmp 0x4744eb
call fcn.0048d094
int3