joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441080
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47e238
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.00476dcf
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.00440a20
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.00476cfd
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.004735bb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.004735bb
push 1
push 0
push 0
mov ecx, esi
call fcn.00473563
push 1
push 0
push 1
mov ecx, esi
call fcn.00473563
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00476e41
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x441200
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47e258
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.00476dcf
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.00440a20
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.00476cfd
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x4412c4
cmp dword [esp + 0x40], 1
jne 0x4412c2
cmp ecx, eax
jge 0x4412c4
mov eax, ecx
cmp eax, 0xc8
jge 0x4412d0
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00441080
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.00476e41
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x441a40
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x47e2c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004719d9
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00477077
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00478593
test eax, eax
je 0x441b5c
mov ecx, dword [esp + 0x3c]
call fcn.004770a4
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x441b20
push edi
mov ecx, esi
call fcn.00474706
mov ecx, esi
call fcn.00441cc0
cmp dword [esp + 0x38], 1
jne 0x441b55
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.00474841
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x444570
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4445a3
push esi
call fcn.00447680
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x44459c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x444629
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x444612
mov eax, dword [esi + 8]
test eax, eax
je 0x4445c7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x44460e
cmp eax, 2
je 0x444612
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x4445ba
cmp eax, 3
je 0x4445ed
cmp eax, 1
jne 0x4445ba
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x4445ba
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x4445ba
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.00444650
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x444638
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.00444650
add esp, 4
pop esi
ret
Function at 0x451280
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x4512c9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x451740
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47e770
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.004512f0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00451370
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00451370
lea ecx, [esi + 0xc]
call fcn.004703b5
lea ecx, [esi + 0x10]
call fcn.004703b5
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00452900
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00452900
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00452900
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0047042a
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0047042a
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x452af0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x452b56
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x452b56
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x452b37
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x4727ce
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x472806
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00470885
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0047085d
jmp 0x472812
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x473ec3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x473f05
call fcn.00479a38
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x473f05
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x473efc
xor eax, eax
jmp 0x473f0d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00473f13
pop edi
pop esi
pop ebx
ret 4

Function at 0x479f68
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x479f96
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x479fb4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00479ece
jmp 0x479fb4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x479fb4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00479ece
test edi, edi
mov eax, edi
jne 0x479f9e
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x5f13e6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jne 0x611622
pushal
lea esp, [esp + 0x20]
jg 0x61080e
not eax
movsx ax, bl
mov byte [edi - 1], 0
pushfd
mov dword [esp], ebx
cwde
movsx ax, cl
pushal
lea eax, [0x65c5c7]
jmp 0x610d62
push 0x9f6dff0a
mov dword [esp + 0x40], eax
push ecx
push edi
push dword [esp]
push dword [esp + 0x4c]
ret 0x50
push esi
lea eax, [edx - 0x4cdbf19c]
mov byte [edi - 1], 0
call fcn.0057e12a
invalid
pushal
mov dword [esp + 0x3c], 0x60e9ff
pushfd
mov byte [esp], 0xd
jmp 0x60f55e

Function at 0x5f1a1c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xfffffffc
jg 0x60c91c
pushfd
cmp byte [edi], 0x23
pushal
clc
cmp byte [edi], 0x23
push 0x9742a05c
mov byte [esp], 0xa3
pushfd
lea esp, [esp + 0x28]
jne 0x60ba02
call fcn.0060fad4
add byte [eax], al
push eax
popal
je 0x60c982
insb byte es:[edi], dx
je 0x60c943
add byte [eax], al
dec esp
outsd dx, dword [esi]
popal
dec esp
imul esp, dword [edx + 0x72], 0x57797261
add byte [eax], al
add byte [edi + 0x65], al
je 0x60c9ac
push 0x64616572
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
add byte gs:[eax], al
add byte [edx + 0x65], dl
push ecx
jne 0x60c9d1
jb 0x60c9e7
push esi
popal
insb byte es:[edi], dx
jne 0x60c9d8
inc ebp
js 0x60c9b7
add byte [eax], al
add byte [edi + 0x64], al
imul esi, dword [eax + 0x43], 0x74616572
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x6f724670
insd dword es:[edi], dx
push ebx
je 0x60ca02
popal
insd dword es:[edi], dx
add byte [eax - 0x64], ah
pushal
pushfd
call fcn.0060b8c4
add byte [eax], al
inc ebx
jb 0x60ca05
popal
je 0x60ca08
inc edx
imul esi, dword [ebp + ebp*2 + 0x61], 0x70
popal
jo 0x60c9aa
add byte [eax], al
inc ebx
outsd dx, dword [esi]
push edx
imul esi, dword gs:[bp + di + 0x74], 0x654d7265
jae 0x60ca2d
jae 0x60ca2d
popal
inc esi
imul ebp, dword [esp + esi*2 + 0x65], 0x72
dec edi
insb byte es:[edi], dx
push edx
jne 0x60ca3a
add byte [eax + eax*8 + 0x4247488], al
and al, 4
pushal
lea esp, [esp + 0x28]
and al, 0x28
je 0x6102b3
cmc
cmc
jmp 0x60fb61
push ebx
jne 0x60ca5d
jo 0x60ca51
outsb dx, byte [esi]
push esp
push 0x64616572
add byte [ebx - 0x54685e13], dl
retf 0x80f5
push 0x7d9d900a
int 0x95
popfd
jge 0x60c9d5
xchg ebp, eax
or dword [ecx + 0x4807731a], eax
jle 0x60ca14
xor byte [edx + 0x5e11c591], 0x7e
jp 0x60ca3c
lds edx, [ecx]
pop esi
jle 0x60ca93
and cl, byte [edx]
je 0x60c9a7
or dh, byte [edx + ecx*4 + 0x43]
inc ebx
invalid
push esi
push 0xfffcf890
call fcn.0065d74a
lds ecx, [ebx]
invalid
Function at 0x5f2031
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x48]
jae 0x57e41c
push 0xa930bb07
pushal
pushal
pushfd
lea esp, [esp + 0x48]
jmp 0x5e3792
stc
mov edi, dword [edx + 0x1c]
pushfd
add edi, eax
cmp dh, dh
pushal
mov edi, dword [edi + ecx*4]
pushal
cmc
test edi, edi
jmp 0x60d003
rol al, 5
call 0x60c82c
add byte [eax], al
inc esp
jae 0x5f200e
jb 0x5f200b
jns 0x5f1fe7
arpl word [edi + 0x6e], bp
add byte [eax], al
add byte [edi + 0x65], al
je 0x5f1ff5
jae 0x5f201e
popal
push esp
imul ebp, dword [ebp + 0x65], 0x44000000
insb byte es:[edi], dx
je 0x5f2020
inc ebx
jb 0x5f2027
je 0x5f2029
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [edi + 0x65], al
je 0x5f2014
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x5f204a
je 0x5f203c
jb 0x5f2027
popal
insd dword es:[edi], dx
inc ecx
add cl, ch
cli
test al, 1
add byte [eax], al
add byte [edi + 0x65], al
je 0x5f202f
imul ebp, dword [ebp + 0x53], 0x657a69
add byte [eax], al
push ebx
je 0x5f203a
je 0x5f203a
jne 0x5f206b
jae 0x5f206a
jb 0x5f1ffd
add byte [eax], al
inc ebx
outsd dx, dword [esi]
push esp
popal
jae 0x5f2070
dec ebp
insd dword es:[edi], dx
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
test al, bh
sub ecx, dword [edx + 0x10]
pushal
push edx
bt cx, bx
cmp ecx, dword [edx + 0x14]
jmp 0x5e3707
push ss
invalid
inc dword [eax]
add byte [edi + 0x65], al
je 0x5f206b
jbe 0x5f2093
imul esp, dword [ebx + 0x65], 0x73706143
arpl word [ebp + 0x43], sp
popal
jo 0x5f20a3
jae fcn.005f2031
add byte [esi + 0xf], ah
mov edx, 0xf6603e6
mov dword [0x4c89f8c1], eax
dec esp
and al, 0x14
ror dword [ebx + 0x4c6044d], 0x24
invalid
imul esi, dword [eax + 0x62], 0x6472616f
jo 0x5f20cf
outsd dx, dword [esi]
popal
jb 0x5f20d5
inc esi
inc esi
outsd dx, dword [esi]
jb 0x5f20e2
popal
je 0x5f20b9
add byte [eax], al
add byte [esi + 0x72], al
dec esp
imul esp, dword [edx + 0x72], 0x797261
cmp al, 0xb
and eax, 0x223c5ed6
int 0xab
mov cl, 0xc5
inc edx
aam 0x68
retf 0x7d96
rcr ebp, 0x22
pop esp
leave
and al, 0x91
jmp 0x5f2116
ret
dec edx
jle 0x5f213f
lcall 0xe6df, 0x957d2d3c
test dword [ecx - 0x16], esp
jnp 0x5f20a0
rcl dh, 1
salc
iretd
or byte [ebp + 0x44], al
cmp byte [ecx + eax*4 + 0x26], bh
bnd jno 0x5f20c1
mov dh, 0x8d
and al, 0x4c
and al, 0x4c
je 0x611303
rol esi, 0x14
mov esi, edx
test ecx, 0x4bd04fb
mov edx, eax
pushfd
bt esp, ebp
mov word [esp], bp
sub ebx, ebx
clc
mov word [esp], 0x9a2f
shr eax, 0x10
lea esp, [esp + 4]
add dword [eax], eax
bt eax, 2
stc
ror al, 6
jmp 0x60e9eb
call fcn.0060d18c
jmp 0x5f1f8c
neg al
bt dx, ax
bt ebp, eax
bt ecx, ebp
rol al, 5
jmp 0x611605
mov byte [esp + 4], 0x92
push edx
push ecx
dec al
pushfd
cmp bl, al
shr eax, 1
push 0x82bf81c0
jmp 0x60e811
Function at 0x60b412
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [esp]
lea esp, [esp + 8]
jae 0x60b36b
push 0xc9e03ef3
pushfd
lea esp, [esp + 8]
jge 0x610085
cmp ah, 5
call fcn.005f1f5d
push 0x5ffcf864
call fcn.0065ea0d
ja 0x5e32a2
xchg edx, eax
lea esp, [esp + 8]
jae 0x60f2c0
pushfd
bt edx, esp
push 0x9496d4ef
cmp eax, 0x7f
push dword [esp + 4]
pushal
add al, 0x60
pushfd
mov byte [esp], ah
lea esp, [esp + 0x30]
ja 0x60f2c3
mov bl, 0x6b
inc ecx
push eax
mov byte [esp], dh
call fcn.005f1773
add byte [eax], al
insb byte es:[edi], dx
jae 0x5e3337
jb 0x5e3328
insd dword es:[edi], dx
jo 0x5e3309
add byte [eax], al
add byte [ebp + 0x6e], al
jne 0x5e333c
push ebx
jns 0x5e3345
je 0x5e3339
insd dword es:[edi], dx
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
jae 0x5e331e
add byte [eax - 0x31], ch
stc
cld
mov bh, 0xe8
std
popfd
pop es
add byte [ebx + 0x79], dl
add dword [edi + 0x24648da3], ebx
inc esp
add byte [eax], al
inc ebp
outsb dx, byte [esi]
push eax
popal
imul ebp, dword [esi + 0x74], 0x8dc01000
adc al, al
lea esp, [esp + 4]
jge 0x611254
add al, byte [eax]
jae 0x60f77c
call fcn.0060c994
xchg esi, eax
add al, byte [eax]
add byte [eax], al
push edx
imul esi, dword gs:[bp + di + 0x74], 0x6c437265
popal
jae 0x5e33ad
jae 0x5e337c
inc ecx
add byte [eax], al
add byte [edi + 0x70], cl
outsb dx, byte gs:[esi]
add byte [eax], al
dec edi
jo 0x5e33a6
outsb dx, byte [esi]
inc esi
imul ebp, dword [ebp + 0x4d], 0x69707061
outsb dx, byte [esi]
inc ecx
add byte [esi + 0xf], ah
dec ebp
popal
jo 0x5e33ba
imul ebp, dword [esi + 0x67], 0xf660041
mov edx, 0xbde907e4
mov ah, 2
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x5e33a5
outsd dx, dword [esi]
arpl word [ebp + 0x73], si
add byte [ebx + 0x45], cl
push edx
dec esi
inc ebp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebp + 0xf242464], cl
lea esp, [esp + 0x24]
invalid
test byte [eax], bh
iretd
out dx, eax
mov ecx, 0x8d9c0002
and al, 0x10
inc ecx
jne 0x5e342f
je 0x5e3412
pop edx
jmp 0x2462fb3b
lea esp, [esp + 0x24]
jae 0x5e3254
jae 0x60b36b
push 0xbad887e1
test ah, ch
cmp ah, 5
push ebx
push 0xad9c8cb2
lea esp, [esp + 0xc]
jo 0x6109d9
jae 0x60f2c0
cmc
pushal
cmp eax, 0x7f
jmp 0x60d28d
pushal
push 0x3aac2c2a
mov word [esp + 8], 0x522e
lea esp, [esp + 0x44]
ja 0x60f2c3
dec bl
not bl
not bl
setl bl
inc ecx
inc bl
pushfd
push 0xb01cd3d2
inc ecx
clc
pushfd
pushal
xchg ebp, eax
test bh, cl
mov eax, ebp
clc
call fcn.0060e61a
call 0x57eff6
push 0x7fd0723
call fcn.0065d4b5
invalid
pushfd
call 0x60ec52
adc eax, 0x26564cca
mov cl, 1
mov bl, 0x55
mov eax, dword [edx - 0x46d3f1e3]
xchg ebp, eax
outsd dx, dword [esi]
or al, 0xee
test dword [ebp - 0x43d8195c], ecx
and eax, 0xcd567db9
jo 0x6109af
sub bl, byte [eax - 0x4bd579df]
mov dl, 0x44
fadd qword [eax - 0x2d]
sbb ch, ah
test eax, 0x624b9ca7
inc ebp
invalid

Function at 0x60d2c5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 4], 0x5e
pushfd
mov dword [esp + 0x2c], 0x60c609
call fcn.0060f7c2
jns 0x60c60c
xchg dword [0xf708b20], esp
in eax, dx
and al, 0x60
popfd
push ebx
push ss
invalid
jmp 0x610860
lea eax, [0x65c5c7]
push esp
jmp 0x60c57a
Function at 0x60f24e
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 0x24]
jb 0x57e107
cli
idiv bh
push eax
call fcn.0060f8fd
adc byte [ecx], ah
daa
mov ch, 0x41
xor esp, edx
fmul dword [esi - 0x67]
lock and esp, dword [eax + 0x2ae11d37]
and esp, dword [eax + 0x2ae11d37]
test eax, 0xd21bb1be
sbb dl, al
stc
pushfd
mov ch, 0x1f
jge 0x60e633
mov cl, 0x1b
rcr byte [eax], cl
ret 0x9cf9
wait
stc
push ds
das
jns 0x60e637
mov al, byte [0x587a70c3]
jno 0x60e6af
add al, 0x5d
mov byte [ebx], bh
in al, dx
mov esp, 0x47a9e722
jns 0x60e64f
jo 0x60e647
invalid
sub dword [esi - 0x2fc4bdb9], edx
or al, 0x6e
lodsb al, byte [esi]
add eax, 0x9497ca63
inc ecx
wait
invalid
jmp 0x60e62c
Function at 0x60f75d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call 0x611038
add byte [eax], al
dec edi
jae 0x60eabd
je 0x60eab0
imul esp, dword [ebp + 0x77], 0x74726f70
dec edi
jb 0x60eacb
inc ebp
js 0x60ea67
add byte [eax], al
push edx
inc ebx
insb byte es:[edi], dx
outsd dx, dword [esi]
jae 0x60ead6
dec ebx
jns 0x60ea75
add byte [eax], al
dec ebp
outsd dx, dword [esi]
jbe 0x60eae0
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [ebp + 0x78], al
je 0x60eafa
popal
arpl word [ecx + ecx*2 + 0x63], si
outsd dx, dword [esi]
outsb dx, byte [esi]
inc ecx
add byte [eax], al
add byte [edx + 0x65], dl
dec edi
jo 0x60eafe
outsb dx, byte [esi]
dec ebx
jns 0x60eae3
js 0x60eae1
add byte [eax], al
add byte [ebx + 0x48], dl
inc edi
je 0x60eaed
jae 0x60eb17
je 0x60eb1d
jo 0x60eaf6
outsd dx, dword [esi]
insb byte es:[edi], dx
jb 0x60eab6
add byte [eax], al
inc edi
je 0x60eb0c
popal
jb 0x60eb24
outsb dx, byte [esi]
je 0x60eac2
jae 0x60eafc
adc ebx, 0x9e538a27
ljmp 0x9b8e
mov ecx, 0x8e37c8a5
wait
mov bh, 0x81
stosb byte es:[edi], al
mov ebp, 0x386a1dc0
sub dh, byte [ebx + 0x7e6ab519]
ror ecx, cl
sbb eax, 0xb32a386a
sbb dword [ebp - 0x362c8196], esi
leave
sal bl, 1
pop edx
adc dword [edx + 0x5c], edx
movsd dword es:[edi], dword [esi]
sub al, 0xe
cmpsd dword [esi], dword es:[edi]
in al, dx
std
xlatb
adc al, dl
and ebx, esp
adc byte [0xabc712d6], ah
adc al, bh
stosd dword es:[edi], eax
iretd
push esi
lahf
or bl, byte [esi + 0x58]
pop eax
leave
inc esp
jle 0x60eb23
push ss
or dword [esi], eax
aaa
xor eax, 0x6c8d01e
xor al, 0x4a
leave
test edx, ecx
stc
invalid
retf 0xc7f9
sub dword [edi], ebx
cmp ah, byte [ecx + 0x5e]
cli
or al, 0xff
mov cl, 0xbb
stc
jbe 0x60eb10
in al, dx
aaa
invalid
cmp eax, dword [esp + 0xc]
pushfd
lea esp, [esp + 8]
jae 0x6102c0
pushal
pushfd
lea esp, [esp + 0x24]
jae 0x57e425
setns bh
mov ebx, eax
pushal
cmp sp, di
mov ch, 0x40
mov edi, eax
rcl cl, cl
clc
mov ecx, 0x104
stc
xor al, al
cmp bl, 0x1f
push dword [esp + 4]
call fcn.0060d1a7
add byte [eax], al
inc edi
je 0x60f797
jns 0x60f7b9
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x60f74c
add byte [eax], al
push ebx
arpl word [edx + 0x65], si
outsb dx, byte gs:[esi]
push esp
outsd dx, dword [esi]
inc ebx
insb byte es:[edi], dx
imul esp, dword [ebp + 0x6e], 0x34880074
mov byte [esp], dh
lea esp, [esp + 0x28]
jae 0x5f1e7d
inc bl
push edi
mov bl, 2
pushal
inc ecx
setae al
not al
mov al, 0x10
lea esp, [esp + 0x24]
push 0x7e924f1
push esi
lea esp, [esp + 8]
call fcn.0060f0b3
call fcn.005e3314
add byte [eax], al
push ebx
je 0x60f7ea
js 0x60f80d
js 0x60f80d
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x60f79f
add byte [eax], al
inc edi
je 0x60f7f8
arpl word [edx + 0x6f], si
insb byte es:[edi], dx
insb byte es:[edi], dx
push edx
popal
outsb dx, byte [esi]
add byte gs:[bx + si], al
add byte [ebx + 0x72], al
popal
je 0x60f81d
push edi
imul ebp, dword [esi + 0x64], 0x7845776f
inc ecx
invalid
Function at 0x610da2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
jmp 0x60f465
bt sp, 8
test edx, edx
push 0xd0418247
lea esp, [esp + 0xc]
je 0x57e41c
adc ecx, 0xc70187de
cmc
xor cl, 0x70
add edx, eax
cmc
rcr cx, 1
mov ecx, dword [esi + 0x7c]
jmp 0x61124a
bsf ax, si
push ebp
cmc
sub ah, 0x7b
setge al
push esi
adc al, dl
rcl ebp, cl
push edi
rcr bp, 0xc
sbb al, 0xaf
push ebx
sbb ah, cl
shrd ax, dx, 0xa
push edx
pushal
inc ax
mov dword [esp + 0x1c], edx
and ebp, 0xb72a4706
rol bp, cl
pushfd
mov dword [esp + 0x1c], edx
sbb bp, 0x8a64
lahf
setg al
clc
mov dword [esp + 0x18], edx
btc ax, sp
inc bp
cmc
lea ebp, [esp + 0x3c]
add eax, 0xad72ede8
shrd eax, edi, cl
lahf
mov eax, dword [ebp]
cmc
test eax, eax
pushal
mov word [esp], 0x5026
mov dword [esp], 0x731e59bb
lea esp, [esp + 0x38]
je 0x57e41c
and dl, bh
mov esi, dword [eax + 0x3c]
btr dx, 3
add esi, eax
add dx, 0xb00
dec dl
bts dx, 0xc
pushfd
mov edx, dword [esi + 0x78]
jmp 0x60d008