joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1c29063e
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x271e5fce
nop
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41fb6c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42b520]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00416e52
and dword [ebp - 0x14], 0
cmp dword [0x46d558], 0
mov dword [ebp - 0x18], eax
jne 0x41fc1f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41fcc7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41fcc7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46d558], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46d55c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46d560], eax
call edi
push eax
call esi
mov dword [0x46d568], eax
test eax, eax
je 0x41fc1f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46d564], eax
mov eax, dword [0x46d564]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x41fc78
cmp dword [0x46d568], ecx
je 0x41fc78
push eax
call esi
push dword [0x46d568]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x41fc78
test ebx, ebx
je 0x41fc78
call edi
test eax, eax
je 0x41fc6f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41fc6f
test byte [ebp - 8], 1
jne 0x41fc78
or dword [ebp + 0x10], 0x200000
jmp 0x41fcab
mov eax, dword [0x46d55c]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41fcab
mov eax, dword [0x46d560]
cmp eax, dword [ebp - 0x18]
je 0x41fcab
push eax
call esi
test eax, eax
je 0x41fcab
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46d558]
call esi
test eax, eax
je 0x41fcc7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41fcc9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004113cb
leave
ret

Function at 0xb64932
Capabilities:
Encode data using xor

Disassembly:
movsx edi, cx
mov ah, dh
push 0xdcae5
push 0x806917
sub esi, edx
xor al, 0x84
mov dh, ah
sbb ch, bh
cmp ebx, 0xdc7d
jae 0xb64957
mov ecx, 0x48c4774a
lea edx, [0x67fdbaf8]
lea ebp, [0xb7cb6d08]
test edx, 0x668edd5f
cmp ebx, esi
sbb dl, 0x1a
imul ecx, ebx, 0x59d42c6e
movzx ebp, ch
cmp edi, edx
test edx, 0xfc05b05f
xor al, bh
imul ecx, ebx
imul esi, eax
call fcn.00b649f6
lea edx, [0x6d1219ac]
cmp al, 0xd5
lea esi, [0xee9f1754]
mov edx, eax
sub ebx, ebx
test ch, dl
test edi, esi
mov edx, ebp
sub ebx, 0xfff09426
imul ebp, edi, 0xbcc8179a
sub ebx, 0xf5c6b
dec esi
dec ecx
mov esi, 0xf35cc1db
mov ah, 0xdf
movzx edi, bh
mov ebp, 0x6b10dd00
cmp eax, 0xff9e962d
sub ebx, 1
cmp al, ah
mov esi, 0x7869289c
xor al, 0xf1
dec ecx
imul ebp, ecx
sbb eax, 0x9944f480
cmp esi, eax
cmp ebx, 0x269
invalid
invalid
invalid
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x13fa72ec
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x430024
nop
nop
nop
mov eax, str.p_fu
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xc3011c5
test eax, eax
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x6a882596
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..text
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x37d73141
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x6262312b
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x8616c3c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401335
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513c05
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4013fd
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513c05
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d8e0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4014a3
cmp edi, dword [esi + 0x7c]
jge 0x4014a3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415d47
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415d47
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c05
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c05
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4013f5
jmp 0x4013c5
call fcn.00419f6e
int3
Function at 0x4183a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ac75
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x41846d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ac75
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524950
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418513
cmp edi, dword [esi + 0x7c]
jge 0x418513
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cdb7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cdb7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac75
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac75
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418465
jmp 0x418435
call fcn.00430fde
int3

Function at 0x4207b2
Capabilities:
Encode data using xor

Disassembly:
xor al, 0xaa
sub byte [edi], cl
sbb dword [ebx], edx
mov ch, 0xfe
cmp eax, dword [ebx + edi]
xor eax, dword [esi + ecx*8 + 0x33]
jb 0x4207fa
fidivr word [edi - 0x41fd142f]
and eax, 0xb5064e68
adc dword [esi + ebx*2], ebp
pminsw mm2, mm3
movaps xmm1, xmmword [esi]
xchg ecx, eax
add eax, 0xd2afee14
aas
lahf
inc esi
push ecx
and ch, byte [ebx - 0x611b7342]
test byte [esi + 0x6e736fff], bh
xor cl, byte [edi + 0x74]
and ah, byte [ebp + edi*8 - 0xfbcfe13]
scasd eax, dword es:[edi]
out dx, eax
jecxz 0x4207c8
xchg edi, eax
pop esi
sub eax, dword [ecx]
aam 0xbe
dec ebp
adc byte [edi - 6], bl
rcr dword [edx - 0x5e1791dd], cl
mov cl, 0x20
push edx
jle 0x420799
fdivrp st(0)
dec esp
scasd eax, dword es:[edi]
sbb edi, edi
add dh, bl
in eax, 0x16
scasb al, byte es:[edi]
fmul qword [ebx - 0x3d]
inc ecx
push ebp
invalid
invalid
Function at 0x42f435
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00541d05
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f4fd
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00541d05
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0053b9e0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f5a3
cmp edi, dword [esi + 0x7c]
jge 0x42f5a3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443e47
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443e47
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541d05
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541d05
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f4f5
jmp 0x42f4c5
call fcn.0044806e
int3

Function at 0x446075
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x4460bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00558945
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x44613d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00558945
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00552620
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4461e3
cmp edi, dword [esi + 0x7c]
jge 0x4461e3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.0045aa87
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.0045aa87
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00558945
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00558945
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x446135
jmp 0x446105
call fcn.0045ecae
int3

Function at 0x452eb5
Capabilities:
Encode data using xor

Disassembly:
jne 0x452eaa
mov eax, 0x528b10ab
movsd dword es:[edi], dword [esi]
sub al, 0xa2
arpl cx, bp
neg dword [esi - 0x5fadf207]
mov esi, 0x628adcfa
ljmp 0x23b2
enter 0x2cde, 0x27
push edx
std
fstp dword [ecx - 0x5d7a253b]
mov byte [0xfd33335a], al
mov byte [0xfd33335a], al
rcr dword [eax], cl
jb 0x452ec8
adc byte [eax - 0x7f7659d7], 0x67
lcall 0x8358, 0xaae2a7da
xlatb
clc
and byte [edi - 0x66], 0xda
cmpsd dword [esi], dword es:[edi]
loop 0x452e74
pop eax
adc edi, 0xfffffff8
wait
fst qword [ebx - 0x47ccb149]
push 0x5ca2372b
sub esi, dword [esi]
push ebp
mov ebp, 0xf901b0a
push esi
sbb ch, 0x8a
xchg edi, eax
inc ecx
mov eax, 0x2381aeb0
inc edx
and dl, byte [edi - 0x5a]
sub bh, byte [edx]
or byte [ebp + 0x65], 0xe5
xor eax, 0xcf1e5d09
and ch, dl
enter 0xffffffffffffd9ef, 0x3f
cmp al, 0x2b
jo 0x452ef4
mov byte [0xb1ad4bb6], al
ja 0x452ee7
outsd dx, dword [esi]
inc esp
cld
dec esi
sbb ebp, ebx
adc ah, byte [eax]
add byte [esi - 0x5d2d15ee], ah
jg 0x452ec3
jno 0x452ee7
mov dword [ebx], esp
push edi
push 0xcd7f14f7
fnstsw word [edi - 0x5d8b25e5]
or eax, 0x8eed2f5b
cmp ch, byte [esi - 0x48]
push ebx
daa
xor byte [edx], ah
ljmp 0xb79b
Function at 0x45670b
Capabilities:
Encode data using xor

Disassembly:
aaa
mov dl, 0xaa
pop ss
scasb al, byte es:[edi]
or ch, al
or dword [ebx], 0x10
inc edx
pop edi
xchg ecx, eax
wait
in al, 0x23
push 0x3e52cbd9
jne 0x456754
mov cl, byte [edi - 0x5e244277]
mov dl, 0x45
sar byte [esp - 7], 1
movsb byte es:[edi], byte [esi]
outsd dx, dword [esi]
jb 0x456725
cli
xchg esi, eax
inc ah
retf 0x9220
or ebx, dword [edx + 0x42]
xor dword [esi + 0x4d48f2ba], esp
rcl ah, 0xd8
insd dword es:[edi], dx
cmp eax, 0xaabdf22f
pop eax
push ebp
insb byte es:[edi], dx
in al, dx
adc ch, bl
in al, 0x21
jno 0x4566ec
mov eax, 0xa8c82795
dec edx
retf
pop edx
cmpsd dword [esi], dword es:[edi]
mov dl, 0xa1
inc esi
leave
test byte [esi - 0x7c], dl
adc byte [eax + 0x38], 0xf8
stosb byte es:[edi], al
push edx
fdiv st(3)
lds ebp, [ecx + 0x309f280a]
call dword [edx - 0x1029b2fb]
or byte [eax], ah
pushfd
je 0x456713
mov edi, 0xa613ebd3
invalid

Function at 0x467e5b
Capabilities:
Encode data using xor

Disassembly:
or edi, dword [esi]
pushfd
mov edx, 0x27251153
xor al, 0x17
or al, 0x12
cmp eax, 0xb5cad4d
invalid
Function at 0x473cd5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005865a5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473d9d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005865a5
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00580280
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473e43
cmp edi, dword [esi + 0x7c]
jge 0x473e43
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004886e7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004886e7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005865a5
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005865a5
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473d95
jmp 0x473d65
call fcn.0048c90e
int3
Function at 0x47ef6f
Capabilities:
Encode data using xor

Disassembly:
inc ebp
pop ecx
stosd dword es:[edi], eax
int 0x5b
nop
stosb byte es:[edi], al
dec ecx
sub eax, 0xc5862fae
pop ebx
jp 0x47ef31
bound ebx, qword [ebx + 0xa]
cwde
cmpsd dword [esi], dword es:[edi]
salc
ficomp word [esi - 0x51]
jle 0x47ef46
push esi
push ss
pop esi
movsb byte es:[edi], byte [esi]
out dx, ax
aaa
sahf
stosb byte es:[edi], al
outsb dx, byte [esi]
aam 0x4a
aaa
jns 0x47ef9f
cmp ebp, ebx
fst st(1)
pop edx
jno 0x47ef91
out dx, al
mov ecx, 0x36167632
sahf
and al, bl
retf
mov edi, 0x5375fe9c
jne 0x47efc7
out 0xb0, eax
jle 0x47ef1e
stc
xor bh, byte [ebx + edi*2 + 0x5a]
jbe 0x47ef72
cmp dword [esi + 0x22], 0x7b
add dword [edi + 0x76], ebx
sbb eax, 0x6d874646
xchg ecx, eax
push esp
push esi
je 0x47efd7
push 0x31
clc
xor eax, edi
push ebp
in eax, dx
scasd eax, dword es:[edi]
test eax, 0x3d361fe6
jp 0x47efca
adc al, 0x90
push esi
sbb dh, byte [edi - 0x2c01a0a5]
pop ebx
pop edx
or byte [ebx - 0x7b], bh
mov ebp, 0xeb717595
mov dh, 0xbc
cmc
push edi
dec eax
mov esp, 0xaa4857f5
adc al, 0x2f
invalid
jle 0x47f01c
push ss
jae 0x47efb1
dec ebx
wait
pop ss
jge 0x47f021
jnp 0x47efb7
fisttp word [esi - 0x7c]
push edx
or ah, byte [ecx]
cmp dword [eax], 0x80144949
mov cl, 0xa0
push ds
xchg esi, eax
xlatb
cmp ebx, ebx
pop eax
dec esi
test byte [edx + 0xa], dl
and dword [ecx + 0x14494938], eax
xor byte [ecx - 0x2869e160], 0x3b
fcomi st(2)
pop eax
or al, 0x7b
sub eax, 0x7f58ed98
sbb bl, ah
stc
hlt
test eax, 0x334c7559
xor byte [esi + 0x64], 0xb7
push edi
neg dword [edi - 0x4d05e20d]
dec esi
xchg esi, eax
mov eax, fs
xor byte ss:[ecx + 0x16], 0xf
xor dword [edi + edi*4 - 0x6f0c28f4], ebp
std
xchg ecx, eax
lahf
popal
stosd dword es:[edi], eax
push edx
mov bl, 0xbf
mov edi, 0x1707619f
std
mov edi, 0xb5abafd8
cmc
pop ss
cli
or bl, 0x39
sbb esp, dword [ecx + esi*4 - 0xe]
xor dword [eax + 0x5e2d9fcc], esi
not dword [esi + esi*4 + 0x1b]
mov cl, 0x15
mov al, 0x12
loopne 0x47f0e4
mov eax, dword [0x1158aa3b]
bound eax, qword [edi + 0x19047069]
aad 0xb3
stosd dword es:[edi], eax
cmp ebp, dword [edx - 0x789deea8]
imul esi, dword [eax + 4], 0xabb3d519
in al, dx
cmp bh, 0x69
and dword [edx - 0x3b], ebx
push 0x15
xor al, 0xb1
push 3
retf
jg 0x47f06b
mov dword [0xf0c0f017], eax
mov bh, 0xb1
sal byte [eax + edi*4 + 0x2163f99c], 0x58
sub eax, 0xad536170
mov cl, 0
iretd