joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ff5a
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x30]
sub ecx, eax
push ecx
push dword [esi + 0x2c]
push dword [ebp + 8]
call fcn.0040fff0
cmp eax, 1
jne 0x40ffeb
push eax
lea eax, [esi + 0x30]
push eax
push 0x4004667f
push dword [esi + 0xc]
call sub.WSOCK32.dll_ioctlsocket
pop eax
cmp dword [esi + 0x30], 0
je 0x40ffda
push 0x42
push dword [esi + 0x30]
push dword [esi + 0x1c]
call sub.KERNEL32.DLL_GlobalReAlloc
mov dword [esi + 0x1c], eax
push eax
call sub.KERNEL32.DLL_GlobalLock
mov dword [esi + 0x20], eax
push 0
push dword [esi + 0x30]
push dword [esi + 0x20]
push dword [esi + 0xc]
call sub.WSOCK32.dll_recv
cmp eax, 0xffffffff
jne 0x40ffcb
mov eax, 0
jmp 0x40ffda
mov dword [esi + 0x30], eax
push eax
push dword [esi + 0x20]
push dword [ebp + 8]
call fcn.0040fff0
cmp eax, 1
jne 0x40ffeb
cmp byte [esi + 0x3f], 1
jne 0x40ffeb
push esi
call fcn.0040f7dd
pop esi
leave
ret 4

Function at 0x40fff0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x28], 0
je 0x410014
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jbe 0x410014
mov eax, dword [esi + 0x28]
sub eax, dword [esi + 0x34]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x34]
cmp eax, dword [esi + 0x28]
jne 0x410026
mov dword [esi + 0x6d], 1
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x65]
call sub.KERNEL32.DLL_WriteFile
push eax
cmp eax, 1
jne 0x410057
mov eax, dword [ebp - 4]
add dword [esi + 0x34], eax
add dword [esi + 0x48], eax
cmp dword [esi + 0x69], 0
je 0x410057
push dword [ebp + 8]
call fcn.0040f154
pop eax
pop esi
leave
ret 0xc
Function at 0x41626e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x41dcb4], 0
push esi
push edi
jne 0x4162d6
push 0x41af14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
mov esi, eax
test esi, esi
je 0x4162d6
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
push esi
mov edi, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov esi, eax
test esi, esi
je 0x4162d6
push esi
call dword [sym.imp.KERNEL32.DLL_LockResource]
test eax, eax
je 0x4162cf
push edi
push eax
push dword [ebp + 0xc]
call fcn.0041624a
add esp, 0xc
cmp eax, dword [0x418364]
jne 0x4162db
push esi
call dword [sym.imp.KERNEL32.DLL_FreeResource]
mov eax, dword [0x418364]
pop edi
pop esi
pop ebp
ret

Function at 0x4162df
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [0x41dcb4], 0
mov eax, dword [ebp + 8]
push esi
mov esi, dword [0x418364]
jne 0x41641c
test eax, eax
je 0x41630c
cmp byte [eax], 0
jne 0x41641c
push ebx
mov ebx, 0x105
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push ebx
push eax
push dword [0x41dcac]
call edi
test eax, eax
je 0x416350
lea eax, [ebp - 0x108]
push eax
call fcn.004160a7
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.0041642a
add esp, 0xc
mov esi, eax
cmp esi, dword [0x418364]
jne 0x416416
lea eax, [ebp - 0x108]
push ebx
push eax
push 0
call edi
test eax, eax
je 0x41638f
lea eax, [ebp - 0x108]
push eax
call fcn.004160a7
and byte [eax], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x108]
push eax
call fcn.0041642a
add esp, 0xc
mov esi, eax
cmp esi, dword [0x418364]
jne 0x416416
mov edi, dword [ebp + 0xc]
push edi
push 0x41af20
call fcn.0041642a
mov esi, eax
pop ecx
cmp esi, dword [0x418364]
pop ecx
jne 0x416416
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
test eax, eax
je 0x4163d4
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0041642a
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x418364]
jne 0x416416
lea eax, [ebp - 0x108]
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
test eax, eax
je 0x4163ff
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0041642a
pop ecx
mov esi, eax
pop ecx
cmp esi, dword [0x418364]
jne 0x416416
push edi
push str.PATH
call fcn.004165d3
pop ecx
mov esi, eax
pop ecx
pop edi
mov eax, esi
pop ebx
jmp 0x416427
push dword [ebp + 0xc]
push eax
call fcn.0041642a
pop ecx
pop ecx
pop esi
leave
ret
Function at 0x417337
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 4
lea eax, [ebp + 8]
push esi
push eax
call fcn.00415f66
mov eax, dword [ebp + 8]
push 4
lea edi, [eax + esi]
lea eax, [edi + 0x3c]
push eax
lea eax, [ebp - 4]
push eax
call fcn.00415f66
mov eax, dword [ebp - 4]
push 4
add eax, edi
push eax
lea eax, [ebp - 8]
push eax
call fcn.00415f66
add esp, 0x24
cmp dword [ebp - 8], 0x4550
je 0x417390
push str.PELD:_peGetProcAddress:_invalid_instance_handle_or_corrupt_memory_image
call fcn.00416bd7
jmp 0x417452
mov eax, dword [ebp - 4]
push 8
lea eax, [eax + edi + 0x78]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00415f66
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ebx, 0x10000
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ecx
jb 0x4173c2
push str.PELD:_peGetProcAddress:_export_section___64K
jmp 0x417386
push eax
call fcn.00415e04
mov esi, eax
pop ecx
test esi, esi
jne 0x4173d6
push str.PELD:_peGetProcAddress:_picosMalloc_error
jmp 0x417386
mov eax, dword [ebp + 8]
push dword [ebp - 0xc]
add eax, edi
push eax
push esi
call fcn.00415f66
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp ecx, ebx
jae 0x4173f5
sub cx, word [esi + 0x10]
jmp 0x417443
mov eax, esi
xor ebx, ebx
sub eax, dword [ebp + 8]
add dword [esi + 0x20], eax
cmp dword [esi + 0x18], ebx
jbe 0x41742c
xor eax, eax
jmp 0x41740b
mov ecx, dword [ebp + 0xc]
mov edx, dword [esi + 0x20]
mov eax, dword [edx + eax*4]
sub eax, dword [ebp + 8]
add eax, esi
push eax
push ecx
call fcn.00415c86
pop ecx
test eax, eax
pop ecx
je 0x41742c
inc ebx
movzx eax, bx
cmp eax, dword [esi + 0x18]
jb 0x417408
movzx eax, bx
cmp eax, dword [esi + 0x18]
jae 0x41744b
mov ecx, esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x24], ecx
mov ecx, dword [esi + 0x24]
mov cx, word [ecx + eax*2]
movzx eax, cx
cmp eax, dword [esi + 0x14]
jb 0x417456
push esi
call fcn.00415e4a
pop ecx
xor eax, eax
jmp 0x41746e
mov ecx, esi
push esi
sub ecx, dword [ebp + 8]
add dword [esi + 0x1c], ecx
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ecx + eax*4]
call fcn.00415e4a
pop ecx
lea eax, [ebx + edi]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513c71
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x401469
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513c71
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d94c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x40150f
cmp edi, dword [esi + 0x7c]
jge 0x40150f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415db3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415db3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c71
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c71
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x401461
jmp 0x401431
call fcn.00419fda
int3

Function at 0x42df6e
Capabilities:
Encode data using xor

Disassembly:
mov al, byte [esi - 0x6a]
mov word [edi + 0x6ea2ee1a], gs
dec eax
insd dword es:[edi], dx
movsd dword es:[edi], dword [esi]
sbb ch, dh
mov byte [0xa56d486e], al
test al, 0x47
xchg edi, eax
ficomp dword [ecx - 0x6d55588a]
adc eax, 0xff1dbdd6
or ch, byte [edx]
push ecx
or byte [ebx + ebp*4 + 0x73], al
pop ecx
mov ah, 0x25
call 0xca7c3587
and ebx, dword [esp + ebp*8 - 0x2a2adec3]
pop eax
xor ah, ah
dec edi
adc dword [edi + 0x28], 0xeb3a6879
and ebx, dword [ebp + 0x26]
enter 0x702d, 0x12
fisubr word [eax + 0x52]
pop es
aad 0x97
xor byte [esi + ebx*8 + 0x41], dl
or dword [ebx], edx
mov ss, word [eax - 0x23aa7fe8]
jo 0x42df73
fimul word [esi - 0x1e]
rcl eax, 0xf4
clc
dec edx
out 9, al
loopne 0x42dfc4
retf 0xa25d
Function at 0x445ad1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445afa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]

Function at 0x445b0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24

Function at 0x445b9f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445c3f
add byte [eax], al
cmp edi, dword [esi + 0x7c]
jge 0x445c3f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a4e3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a4e3
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call fcn.005583a1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005583a1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445b91
jmp 0x445b61
call fcn.0045e70a
int3
Function at 0x445bfb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445c3f
add byte [eax], al
cmp edi, dword [esi + 0x7c]
jge 0x445c3f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a4e3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a4e3
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call fcn.005583a1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005583a1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445b91
jmp 0x445b61
call fcn.0045e70a
int3

Function at 0x45c531
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45c69f
cmp edi, dword [esi + 0x7c]
jge 0x45c69f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00470f43
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and al, 0x24
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00470f43
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056ee01
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056ee01
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c5f1
jmp 0x45c5c1
call fcn.0047516a
int3

Function at 0x45c53a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]

Function at 0x45c54e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
Function at 0x45c57c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14

Function at 0x45c5a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call fcn.0056ee01
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c5f9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0056ee01
invalid

Function at 0x46589d
Capabilities:
Encode data using xor

Disassembly:
add al, 0xa3
das
fldcw word [ebx + 0x47]
mov dword [0x476bd92f], eax
and al, byte [ebx - 0xcc1fbc0]
lea ecx, [esi]
lea ecx, [esi]
invalid
pop ebp
xchg esp, eax
loopne 0x4657f2
je 0x465858
ror dword [ecx + 0x33], cl
pop ecx
cmp cl, 0x9d
sbb dword [esi + ebx*2], ecx
sub bh, bh
les eax, [0x31d3c96b]
jo 0x4657f7
aaa
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x76], edi
leave
cdq
dec ebx
mov bl, 0x1e
sub eax, 0x847e9640
dec ecx
je 0x465851
leave
mov al, byte [0xd1757902]
int1
sti
push ecx
inc dword [edi + 0x19214c4b]
lahf
sub byte [esi], 0xa1
jle 0x4657ed
cmp byte [edi - 0x7946f9e0], al
adc eax, 0x997d9883
jge 0x4657ec
jl 0x4658a6
dec ebx
jo 0x465805
mov edi, 0x81fdcdee
invalid
scasb al, byte es:[edi]
js 0x465843
int1
lodsb al, byte [esi]
invalid
call 0xad72367e
mov esp, 0x6d8cb83c
insd dword es:[edi], dx
cmp bh, dl
popfd
jge 0x465864
jns 0x46592b
invalid
int 0x39
scasd eax, dword es:[edi]
sbb eax, 0x393b2f49
mov eax, 0xe0d53c76
push edx
lodsb al, byte [esi]
dec edi
invalid

Function at 0x46c475
Capabilities:
Encode data using xor

Disassembly:
push ebx
sbb eax, 0x46bcd07a
pop edx
xchg ebp, eax
push ecx
or dword [edx + 0x43cc95d4], edi
xchg edx, eax
xor edi, dword [edx - 0x1d]
adc bh, dh
dec esi
loope 0x46c4c9
adc dword [ebp + 0x4f], edi
outsb dx, byte [esi]
sar edx, 1
faddp st(7)
daa
arpl word [edx + 0x69e9d65a], dx
les ecx, [eax + 0x504db923]
movd dword [ebx - 0x6f], mm3
inc ecx
xchg ecx, eax
invalid
invalid
Function at 0x470d78
Capabilities:
Encode data using xor

Disassembly:
lodsd eax, dword [esi]
aam 0xc8
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
inc ecx
imul esp, dword [esi], 0xffffffb7
mov ebx, 0xa1003e48
retf
adc eax, 0xd7c3ab4
inc esi
adc al, 0x69
xlatb
popal
ror byte [edx + 0x19], 1
dec esp
js 0x470cec
shr byte [ecx + 0x31], 1
leave
mov ss, word [0xae53b5aa]
push 0xf
cmp dword [eax], esp
sub al, 0xf9
dec edx
popfd
cdq
invalid
push esp
xchg esi, eax
call 0xb1f8d1b5
call 0x820a3381
cli
test al, 0x34
or byte [esi + 0x7e7e0c3d], dh
add byte [ebx + ebx*4 - 0x7b], bh
inc edx
in eax, 0x53
xor al, 8
mov dh, 0x3d
or al, 0x7e
jle 0x470d8e
jl 0x470d2b
test dword [edx - 0x1b], eax
push ebx
nop
pop esp
pop ebx
xor eax, 0x11fbbd5e
imul ebx, eax, 0xffffffe7
out 0x60, al
adc ebx, dword [edi]
dec edi
pop esp
loope 0x470d86
rol byte [ebx], 0xff
dec eax
nop
ror dword [edx + 0x68], cl
inc edi
fistp dword [ecx]
push eax
xchg edx, eax
dec esp
sahf
scasb al, byte es:[edi]
sbb dword [esp + edi - 0x6f0ae22f], esp
push 0x331d6c2d
dec ebx
and eax, 0x4285d390
in eax, 0x9a
lcall 0xa87a, 0x6bb313ef
int1

Function at 0x47303f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
punpckldq mm0, mm0
mov ebx, 0x46800000
movd xmm7, ebx
pshufd xmm7, xmm7, 0
movq qword [esp], mm0
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov edx, dword [esp + 0x2c]
movq mm6, qword [esp + 0x34]
movd mm7, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
dec esp
and al, 0x20
movss xmm0, dword [ebp]
movss xmm1, dword [edx]
unpcklps xmm0, xmm1
cvttps2pi mm0, xmm0
movq mm2, mm0
pcmpeqd mm0, mm6
paddd mm0, mm2
cvtpi2ps xmm1, mm0
movq mm1, mm0
psrlq mm0, 0x20
movq mm5, mm1
pmuludq mm0, mm7
paddd mm1, mm1
paddd mm0, mm5
paddd mm0, mm1
sub dword [esp + 0x30], 1
xor byte [ecx], al
je 0x473170

Function at 0x48a4f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059cdc1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
Function at 0x48a57c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 0x7c], edi
jg 0x48a5b9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059cdc1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596a9c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a65f
cmp edi, dword [esi + 0x7c]
jge 0x48a65f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049ef03
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049ef03
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059cdc1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059cdc1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a5b1
jmp 0x48a581
call fcn.004a312a
int3
Function at 0x4a13d1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b3ca1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a1499
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b3ca1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ad97c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a153f
cmp edi, dword [esi + 0x7c]
jge 0x4a153f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b5de3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b5de3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3ca1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3ca1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a1491
jmp 0x4a1461
call fcn.004ba00a
int3