joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002ea4
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ebx, dword [esi + 0x3c]
push 0x40
add ebx, esi
push 0x3000
lea eax, [ebx + 0x18]
mov dword [ebp - 0x1c], ecx
push dword [eax + 0x38]
mov dword [ebp - 0x18], eax
push 0
call dword [0x5b605c]
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10002fad
push 0x40
mov edx, esi
mov ecx, edi
call fcn.10003ba0
mov esi, dword [edi + 0x3c]
movzx eax, word [ebx + 0x14]
add esi, edi
push eax
mov edx, ebx
mov ecx, esi
call fcn.10003ba0
movzx ecx, word [ebx + 0x14]
lea eax, [esi + 0x18]
movzx esi, word [esi + 0x14]
lea edx, [ebx + 0x18]
movzx ebx, word [ebx + 6]
add ecx, edx
add esi, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ebx
test ebx, ebx
je 0x10002f5c
mov edi, ecx
sub edi, esi
push 0x28
lea edx, [edi + esi]
mov ecx, esi
call fcn.10003ba0
add esi, 0x28
dec ebx
jne 0x10002f22
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
test ebx, ebx
je 0x10002f5c
lea esi, [ecx + 0x14]
mov edx, dword [esi]
mov ecx, dword [esi - 8]
push dword [esi - 4]
add edx, dword [ebp + 8]
add ecx, edi
call fcn.10003ba0
lea esi, [esi + 0x28]
dec ebx
jne 0x10002f44
mov ebx, dword [ebp - 0x14]
push ebx
mov edx, edi
mov ecx, edi
call fcn.10004350
push dword [ebp - 0x18]
mov ecx, dword [0x5b7004]
mov edx, edi
call fcn.10004430
mov edx, dword [ebx + 0x60]
test edx, edx
je 0x10002faa
cmp dword [ebx + 0x64], 0
je 0x10002faa
xor eax, eax
lea ecx, [edx + edi]
inc eax
sub eax, dword [ecx + 0x10]
cmp eax, dword [ecx + 0x14]
jae 0x10002fa2
push eax
push ecx
push dword [ebx + 0x64]
mov ecx, edi
call fcn.100043f0
jmp 0x10002fa4
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 4], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10004250
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, edx
push edi
push 0
push dword [0x5b7000]
mov dword [ebp - 8], edi
mov esi, ecx
call dword [0x5b607c]
mov ebx, edi
shr ebx, 2
mov dword [ebp - 4], eax
test ebx, ebx
je 0x10004294
mov edi, esi
mov ecx, eax
sub edi, eax
mov edx, ebx
mov eax, dword [edi + ecx]
mov dword [ecx], eax
lea ecx, [ecx + 4]
dec edx
jne 0x10004283
mov edi, dword [ebp - 8]
mov eax, dword [ebp - 4]
shl ebx, 2
cmp ebx, edi
jae 0x100042af
mov edx, edi
sub esi, eax
lea ecx, [ebx + eax]
sub edx, ebx
mov al, byte [ecx + esi]
mov byte [ecx], al
lea ecx, [ecx + 1]
dec edx
jne 0x100042a4
mov eax, dword [ebp - 4]
lea esi, [edi - 8]
lea ecx, [eax - 8]
add ecx, edi
mov ebx, esi
mov edx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ecx]
shr ebx, 2
and esi, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ecx
test ebx, ebx
je 0x100042f1
lea ecx, [ebx + edx]
mov edx, dword [eax]
movzx ecx, cl
ror edx, cl
mov ecx, dword [ebp - 8]
add eax, 4
xor edx, ecx
sub edx, ebx
mov dword [eax - 4], edx
mov edx, dword [ebp - 0xc]
dec ebx
jne 0x100042d4
test esi, esi
je 0x100042fd
xor byte [eax], cl
lea eax, [eax + 1]
dec esi
jne 0x100042f5
mov edi, dword [ebp - 0x10]
mov edi, dword [edi - 4]
push edi
push 0
push dword [0x5b7000]
call dword [0x5b607c]
mov ebx, dword [ebp - 4]
mov esi, eax
mov edx, esi
mov ecx, ebx
call fcn.10001d1b
push ebx
push 0
push dword [0x5b7000]
call dword [0x5b6080]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [eax], edi
pop edi
mov dword [ecx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x414167
Capabilities:
Encode data using xor

Disassembly:
xchg esp, eax
mov ebp, 0xc1673825
test eax, 0x1ca161b
mov ss, ebx
in eax, 0x35
invalid

Function at 0x4184da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52adaa
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4185a2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52adaa
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524a85
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418648
cmp edi, dword [esi + 0x7c]
jge 0x418648
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042ceec
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042ceec
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52adaa
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52adaa
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x41859a
jmp 0x41856a
call fcn.00431113
int3
Function at 0x41f92a
Capabilities:
Execute syscall

Disassembly:
sbb byte [0x8022f624], dh
popfd
pop ecx
push esp
adc al, 0x65
dec ebp
bound ebx, qword [edi - 0x777efbee]
js 0x41f964
lahf
adc al, byte [ecx + eax*4]
mov byte [eax + 0x4e], bh
scasd eax, dword es:[edi]
mov ebp, 0xac64c3b5
fsubr st(2), st(0)
dec edi
jb 0x41f95d
mov word [esp + edi*8], ss
daa
test eax, 0xab42ee16
out dx, al
inc edx
stosd dword es:[edi], eax
mov dh, 0x8a
mov ah, 0xc9
add eax, 0xc01968ff
enter 0x7dbf, 0x30
dec ebp
pop ebp
pop ds
push cs
jle 0x41f97c
or bh, 0x8e
jo 0x41f90f
and byte [eax - 0x24f4bc8], al
xor byte [ebp - 0x52b25291], ch
mov al, 0x93
and byte [edi + ecx*2 - 0x6f], ah
and dword [ecx - 0x52], eax
xlatb
invalid
fyl2xp1
sub al, 0x4b
insb byte es:[edi], dx
xor esi, dword [esi]
push cs
pop esi
arpl bp, bp
push 0x54
push ecx
add al, 0xdd
popal
jno 0x41f972
mov bh, 0x93
xchg ebx, eax
jge 0x41f999
jge 0x41f927
push esi
sbb dword [edi + eax*4], ebp
mov esi, 0x81e16c7c
jl 0x41f9ea
loope 0x41f901
mov byte [0xaeeced7], al
dec esp
cmp ah, ah
invalid
xor dh, cl
adc esi, dword [ebx]
fdiv st(3)
das
push edx
cmp byte [esi], bl
int 0x2e
rcr byte [ebp - 1], 0x51
ret 0xf21d
push ecx
sub ch, 0xf9
mov cl, 0xe9
xchg esp, eax
dec ecx
adc byte [eax + ebp*4], ah
xor byte [edi], 0x7d
and al, ah
push ebp
fistp qword [edi - 0x53e02f64]
mov word [eax + 0x4e9df21], ds
adc edi, dword [eax + 0x57]
adc dword [ebp + 0x445437d9], 0x15e45d78
invalid

Function at 0x426169
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
mov edi, cs
lea edi, [eax + eax*8 - 0x26410ea1]
int3
dec ecx
mov eax, 0xfabe3daf
sub byte [ebp + 0x74], ch
xchg ecx, eax
cmp eax, 0x6d28fabe
je 0x42604b
xor al, 0x8e
pop es
xchg edi, eax
jbe 0x4260b0
cmp edx, dword [ebp + 0x47025191]
pop eax
push edi
jmp 0x4260e9
int3
enter 0x5f1, 0xffffffffffffff9b
mov eax, 0xf61893dc
jnp 0x426127
idiv byte [ebx + 0xc]
scasd eax, dword es:[edi]
in eax, dx
jbe 0x426189
in eax, 0xa5
jl 0x4260b3
iretd
out 0x98, eax
inc ebx
xchg edi, eax
xor byte [edx + 0x17c8bc3], al
stosb byte es:[edi], al
inc edi
mov dl, 0x13
jmp [edx + 0x1f]
mov al, 0x57
push edi
mov bl, 0x12
push ebx
jns 0x426110
int 0x46
push ss
push 0xffffffffffffffa1
aas
and esi, ebp
js 0x426118
aaa
daa
xor eax, 0x9315b823
jbe 0x426185
dec esi
adc eax, 0xe57b0207
add bh, byte [ebx - 0x1b]
outsb dx, byte [esi]
pop esi
invalid

Function at 0x426f79
Capabilities:
Authenticate hmac

Disassembly:
cmp byte [esi + 0x97031e2], dh
cmp byte [ebx], bl
and eax, 0x94668428
mov esi, 0x429b747
salc
mov dword [edi + esi*8 - 0x6fa9effe], ecx
push 0xffffffffffffffc3
wait
add byte [ecx], cl
adc byte [ebx], dh
cmpsb byte [esi], byte es:[edi]
adc edi, esi
push esp
lahf
inc ebx
invalid
Function at 0x42932a
Capabilities:
Encode data using xor

Disassembly:
add cl, bh
sbb ecx, ecx
lahf
mov dl, 0x63
mov bl, 0x17
fcomp qword [edi + 5]
jmp 0x4292b3
out 0xe0, eax
ja 0x429311
jbe 0x4292c5
pop eax
cld
enter 0xffffffffffffcdc0, 0x21
jmp 0x429280
leave
test byte [ecx], 0x92
mov dl, 0xdc
mov dl, 0xb6
fisttp qword es:[ecx - 0x67]
sbb byte [ecx + 0x52850e3], ch
cwde
xchg dword [eax + 0x79], edx
add eax, 0x79508798
push cs
imul sp, bx, 0x3b97
call 0xbc99a42d
fiadd word [ebx - 0x22366467]
xor eax, 0x19a17bff
insd dword es:[edi], dx
mov byte [ecx - 0x22], bl
popfd
jbe 0x4292d6
insd dword es:[edi], dx
and al, ch
fucompi st(1)
lahf
dec edi
in al, dx
sbb al, 0xcd
xlatb
mov eax, dword [0xc9c433ec]
fidiv dword [ebx]
in eax, dx
stosd dword es:[edi], eax
cmp dh, byte [edx - 0x64]
scasd eax, dword es:[edi]
mov al, byte [0xee36716c]
xor dword [ebp - 0x7b], 0xffffff9d
fcomp qword [esi + 0x16]
cmpsd dword [esi], dword es:[edi]
fst dword [ebp - 0x1960293d]
xchg byte [edi - 0x5e], cl
pop esp
scasd eax, dword es:[edi]
loop 0x4292b5
mov bh, byte [ecx + 0x319b1b5e]
or dword [0x98138eac], esi
xchg ecx, eax
stc
test eax, 0x5c41a12b
stosd dword es:[edi], eax
sti
fsub qword [edx - 0x51]
test eax, 0xaf890208
fidiv word [eax + 0x2d592737]
aas
shl byte [esi - 0x3f], 1
pop ecx
mov dl, 0x3a
inc ebx
mov dword [ebx - 0x44], esi
xchg ebx, eax
cmp edi, dword [edi]
add ch, byte [edi + 0x35]
outsd dx, dword [esi]
dec esp
mov ah, 0x18
xor dword [edi + 0xd], esi
invalid
Function at 0x42f16a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541a3a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f232
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541a3a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53b715
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f2d8
cmp edi, dword [esi + 0x7c]
jge 0x42f2d8
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443b7c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443b7c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541a3a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541a3a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f22a
jmp 0x42f1fa
call fcn.00447da3
int3
Function at 0x4459aa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x55827a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445a72

Function at 0x445acb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x55827a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x551f55
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445b18
cmp edi, dword [esi + 0x7c]
jge 0x445b18
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a3bc
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a3bc
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x55827a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x55827a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445a6a
jmp 0x445a3a
call fcn.0045e5e3
int3

Function at 0x472e0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
inc esp
and al, 0x34
Function at 0x472e48
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc esp
and al, 0x34
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005856da
mov dword [esp + 0x28], eax

Function at 0x472e91
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x472ed2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005856da
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057f3b5
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x472f78
cmp edi, dword [esi + 0x7c]
jge 0x472f78
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048781c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048781c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005856da
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005856da
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x472eca
jmp 0x472e9a
call fcn.0048ba43
int3

Function at 0x47a938
Capabilities:
Encode data using xor

Disassembly:
or dword [edi + 0x57], esi
pop esp
std
or dword ds:[esi + ecx*4], ebp
pop ebp
out dx, eax
sal dword [ebx], 0x34
push sp
lds eax, [esi - 0x47]
xchg dword [eax - 0x1a], esi
popal
cmpsb byte [esi], byte es:[edi]
dec ebp
inc esi
test al, 0x17
xchg esp, eax
test byte [ebx - 0x30201354], dh
xor bh, byte [edx + edi*2 - 0x14]
jo 0x47a948
sub dword [edi], ecx
stosb byte es:[edi], al
invalid

Function at 0x48976b
Capabilities:
Encode data using xor

Disassembly:
and eax, 0xf2f1a3c2
retf 0xc66f
add esp, ebx
jl 0x4897a2
mov byte gs:[0x75a8602a], al
leave
sub ah, byte [eax - 0x58]
jne 0x48973f
iretd
mov byte [edi + edi*2 - 0x267ced67], bh
jne 0x489771
push esi
mov dl, byte [edx - 0x61]
stc
fld qword [edx]
xlatb
push edx
mov ah, 0x6e
xor byte [ebp + esi - 0x5d], bh
xchg ebp, eax
push eax
mov esp, 0x147d7fc8
jge 0x4897d5
cmpsb byte [esi], byte es:[edi]
invalid
Function at 0x48a17a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059ca4a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a242
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059ca4a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596725
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a2e8
cmp edi, dword [esi + 0x7c]
jge 0x48a2e8
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049eb8c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049eb8c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca4a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059ca4a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a23a
jmp 0x48a20a
call fcn.004a2db3
int3

Function at 0x49418a
Capabilities:
Encode data using xor

Disassembly:
invalid
and eax, 0x85c47e25
invalid
xchg esp, eax
push 0xd20c9e63
lds edi, [ebx]
and al, 0xe
jge 0x494105
jnp 0x494115
hlt
je 0x494129
sahf
jecxz 0x494189
invalid
Function at 0x49565a
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x607239a1
hlt
inc esi
pop esp
cmpsb byte [esi], byte es:[edi]
jne 0x495582
adc bh, al
add byte [edx], dl
mov byte [0x6e4c2163], al
invalid
jns 0x495691
push eax
sbb ebp, dword [eax + ebp*4 - 0x78]
or ch, byte [ecx]
lodsd eax, dword [esi]
sub al, 0xa7
dec edi
cmc
dec esp
mov cl, 0x7b
mov ecx, 0x5d6d6c2f
pop esp
lodsb al, byte [esi]
jge 0x4955d1
inc eax
lodsb al, byte [esi]
loopne 0x49566a
popfd
lodsb al, byte [esi]
jge 0x4955d4
jp 0x4956cd
fsub qword [eax + 0x31]
lodsd eax, dword [esi]
jge 0x4956b6
inc eax
scasb al, byte es:[edi]
ror byte [esi + 0x513cdd7c], 0xc7
test eax, 0xad490d35
or eax, 0xfb7cad49
jl 0x495665
inc ecx
insb byte es:[edi], dx
mov ebp, 0x60ba4cf4
push ecx
push eax
or dword [ebp + 0x7d3d2cc5], edi
dec esp
mov edx, 0x9505160
mov ebp, 0x7d3d2cc5
push ecx
out 0x6a, al
stc
inc ecx
pop esp
lodsb al, byte [esi]
jge 0x4956df
clc
insb byte es:[edi], dx
jge 0x49562f
sbb eax, 0x6afd29d1
or eax, 0x31204c04
xchg esp, eax
test byte [eax + 0x4d], al
jge 0x4956e2
pushal
push ebp
jge 0x495706
xchg dword [esi - 0x43], ebp
jno 0x495646
lodsb al, byte [esi]
mov esp, 0x6069455c
sub eax, 0x510c85d2
pop ebp
and byte [esp + ecx*2 + 0x4cccad96], bl
pop ebp
jge 0x495668
inc edi
or al, 0x3d
push es
cmc
push es
mov ebp, 0xad7ebf88
push ebx
lodsb al, byte [esi]
shr byte [edx + edx], cl
pop ebp
jl 0x495705
mov cl, 0xdd
or bl, ch
ja 0x49571f
push ecx
pop ebp
jge 0x49566e
or eax, 0xf8000d4d
insb byte es:[edi], dx
cmp al, 0x60
bound edx, qword [esi - 0x72a280f3]
in eax, 0x7f
pop eax
mov ebp, 0xf4c3d49
sal dword [ecx + 0x424b4a88], 1
mov dl, byte [edx - 0x453cdddf]
outsb dx, byte [esi]
mov bh, 0x5d
cld
cmp al, 0x4d
or dword [edi - 0x4ba7beab], 0xffffff93
jg 0x4956ab
pop edi
pop dword [eax - 0x62]
sahf
or eax, 0x972960ee
invalid
inc edx
fist dword [ebx + 0x6b]
xchg ebx, eax
lodsd eax, dword [esi]
pop edx
invalid

Function at 0x49ca97
Capabilities:
Encode data using xor

Disassembly:
pop esi
sub dword [edi - 0x31866355], ecx
mov esi, 0xded876ac
sbb ah, byte [esi]
arpl word [edx - 0x3d], dx
outsb dx, byte [esi]
mov esp, 0x3e6fe007
or eax, 0x9b15918b
and dword [edx + 0x53], ebp
push edx
ret
adc eax, 0x536a219b
call [ecx - 0x5f51b2c5]
xchg esp, eax
sahf
pop eax
jl 0x49caa6
jb 0x49cab1
inc edx
insb byte es:[edi], dx
mov eax, dword [0x557b6388]
arpl word gs:[edi + 0x60], dx
call 0xd88622b0
jle 0x49cab1
inc eax
stc
arpl word [edi], bx
push es
outsd dx, dword [esi]
aam 0x7c
aas
jl 0x49cb1d
mov al, byte [0x6f10589d]
xor edi, edx
cli
aam 0xde
inc edx
or eax, 0xfb4dbbeb
mov dh, 7
loopne 0x49cadc
sub eax, 0x7d9c584
mov dl, 0xf0
outsd dx, dword [esi]
scasd eax, dword es:[edi]
wait
push ds
in eax, 0x5d
movsb byte es:[edi], byte [esi]
sbb esp, dword [ecx - 0x344572c4]
cmp byte [ebx + ebp*4 + 0x55], bl
pop es
outsd dx, dword [esi]
or eax, 0xe9c244fb
xor cl, bl
aas
ficom word [edi - 0x4a]
jb 0x49cb2e
sahf
stc
inc ebx
inc eax
sar dword [esi], cl
push ds
in al, dx
or al, 0x43
inc ecx
invalid
sub eax, 0x9d8ee5f
ror byte [esi], 0x30
int 0x13
leave
sar byte [edx], cl
add dword [esi + 0x4f], eax
in eax, 0x4a
mov edx, 0x6e3d11d6
sbb byte [edx], ah
sbb eax, 0x7f434877
popfd
sub al, 0x40
int3