joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49997a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x499993
mov eax, dword [ebp - 4]
jmp 0x499a6d
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x499a48
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
nop
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x693d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x693d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x693d38]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x693d38]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x693d38]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x693d38]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x693d38]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x693d38]
dec ebp
jne 0x4999b2
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x499a64
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x693d38]
dec ecx
jne 0x499a52
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x571580
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
push esi
test eax, eax
je 0x57159d
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x5715a2
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [ebp + 0x14]
test esi, esi
jle 0x571675
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
inc edi
cmp esi, 3
jl 0x571606
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + ebx]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + ebx]
mov byte [edx], al
jmp 0x571651
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x57161a
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x57163e
lea eax, [esi + 0x3c]
jmp 0x571648
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + ebx]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
mov ecx, dword [ebp - 4]
sub esi, 3
add ecx, 4
add edi, 3
inc edx
mov dword [ebp - 4], ecx
test esi, esi
jg 0x5715b5
pop edi
pop esi
mov byte [edx], 0
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov byte [eax], cl
mov eax, ecx
mov esp, ebp
pop ebp
ret
Function at 0x5c6110
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x1048
push 0x67f8e0
push esi
call fcn.005e11d0
mov ebx, dword [ebp + 0x10]
mov edi, 0x48
add esp, 0xc
mov dword [ebp + 8], 0
cmp dword [ebp + 0xc], edi
mov eax, ebx
cmovle edi, dword [ebp + 0xc]
add edi, ebx
nop dword [eax]
movzx edx, byte [eax]
inc eax
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
cmp eax, edi
cmovae eax, ebx
shl edx, 8
movzx ecx, byte [eax]
inc eax
or edx, ecx
mov ecx, dword [ebp + 8]
cmp eax, edi
cmovae eax, ebx
xor dword [esi + ecx*4], edx
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x12
jl 0x5c6150
mov dword [ebp - 8], 0
xor edi, edi
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push esi
push eax
call fcn.005c6b50
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 4], eax
add edi, 2
cmp edi, 0x12
jl 0x5c61a2
xor edi, edi
lea eax, [ebp - 8]
push esi
push eax
call fcn.005c6b50
mov eax, dword [ebp - 8]
add esp, 8
mov dword [esi + edi*4 + 0x48], eax
mov eax, dword [ebp - 4]
mov dword [esi + edi*4 + 0x4c], eax
add edi, 2
cmp edi, 0x400
jl 0x5c61c6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401313
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513be3
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4013db
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513be3
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d8be
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401481
cmp edi, dword [esi + 0x7c]
jge 0x401481
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415d25
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415d25
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513be3
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513be3
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4013d3
jmp 0x4013a3
call fcn.00419f4c
int3
Function at 0x418383
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ac53
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x41844b
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ac53
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x52492e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4184f1
cmp edi, dword [esi + 0x7c]
jge 0x4184f1
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cd95
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cd95
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac53
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ac53
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x418443
jmp 0x418413
call fcn.00430fbc
int3
Function at 0x443e65
Capabilities:
Encode data using xor

Disassembly:
test dword [ebx], esp
insb byte es:[edi], dx
pushfd
mov dh, byte [eax + ebp*8 + 0x69990f28]
ja 0x443e7c
cdq
xor cl, dl
push eax
fsubr st(3), st(0)
jle 0x443eee
add cl, cl
leave
adc eax, dword [edx - 0x62]
in al, 0x19
mov dword [ebx + edi*4 - 0x57], edx
fdiv dword [edi + 0x4b]
mov ebx, 0xb2cd7bba
lcall 0x18d0, 0xe91dff22
sub eax, 0x2ba23fb0
sbb ebx, ebx
sar byte [edx + 0x47], cl
wait
or ecx, dword cs:[esi + esi*2]
mov al, 0xe0
in eax, 0x9b
add dh, byte [edi + eax*4]
pop edx
fxch st(2)
inc ebp
sub ebp, edx
fild dword [ebx]
cwde
and ah, byte [ebx]
or esp, ebp
mov esp, 0x50fb0e1f
sub byte [ebx], al
in al, 0x15
push eax
ja 0x443ed5
jle 0x443f01
dec eax
add eax, 0x81b0265d
mov al, byte [0x111989f6]
pushfd
add byte [bp + di - 0x5c59], ah
in al, dx
invalid
cmpsd dword [esi], dword es:[edi]
mov dword [0x86d7deec], eax
std
sahf
cmp eax, 0x52315bb7
wait
xor al, 0xf7
mov ecx, 0xffab9e65
sub edi, ebx
mov ebx, 0xf4dbfccc
cld
fcomi st(4)
pop ebx
sbb al, 0x17
enter 0x6d4e, 0xa
pushfd
wait
mov dh, 0xd8
mov byte [ebx + 0x59f438d9], 0x99
pop ecx
cdq
xor dword [ecx], ebx
mov ebx, 0x1985bb67
xor dword [0x9af06b8e], ebp
shr dword [eax], 1
or eax, 0x2f7fc951
sti
or eax, 0x9b537696
popal
sbb esi, dword [eax + 0x7b]
movsd dword es:[edi], dword [esi]
pop edi
or al, 0x9e
lcall 0x9a21, 0xbbc7a165
inc edi
leave
wait
xlatb
adc ebp, eax
movsb byte es:[edi], byte [esi]
dec ebp
xor dh, byte [ecx - 0x60f17ee6]
xchg edi, eax
push ecx
mov dl, 0x87
mov cl, 0x5d
xchg esi, eax
or eax, esp
mov bl, 0xc9
xchg cl, dh
pop ss
loope 0x443f17
std
fmul qword [ecx + 0x5638a40d]
leave
cmp edi, dword [edi - 0x12]
test al, 0xd
mov ss, esp
jb 0x443ef9
push ebp
mov edx, dword [edx]
sub edi, esp
out 0x11, eax
outsb dx, byte [esi]
leave
insd dword es:[edi], dx
sbb eax, 0x8ccbc7a5
cmc
into
pushal
mov gs, word [eax + 0x3c]
arpl ax, cx
sti
ret 0x7c41

Function at 0x446053
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x44db41
Capabilities:
Authenticate hmac

Disassembly:
add ecx, dword [esi]
push 0xfffffffffffffff1
sbb ch, byte [ebx]
pop es
cli
pop edx
mov byte [0x91635e32], al
invalid
mov byte [0x6030a1d0], al
jle 0x44dabc
movsd dword es:[edi], dword [esi]
mov bl, 0xe7
or dword [edx], esp
mov dl, dh
retf
invalid
push es
stc
mov eax, dword [0x7f957e65]
pushal
inc edx
pop ecx
mov ebp, 0x41926410
cmp al, 0xc9
xchg edi, eax
push ss
add al, byte [edx - 0xd]
pop edx
mov esi, 0xd6cdcc32
fidivr word [esi]
int3
push cs
xchg edx, eax
nop
and dword [ebx - 0x3a55c7e], eax
add dword [edx + 0x3ffc5aa3], 0xffffff9d
add dword [edx + 0x3ffc5aa3], 0xffffff9d
jg 0x44daf4
jo 0x44dba3
rcr ebx, 1
or byte [ebx - 0x39a23d0a], 0x5c
or byte [ecx - 0x1c], 0x36
cmpsb byte [esi], byte es:[edi]
test dword [0x50b9841e], ecx
add ah, byte [0x22d1f4fa]
and esi, esp
inc eax
dec esi
lodsd eax, dword [esi]
scasd eax, dword es:[edi]
mov esi, 0x47f41b62
jp 0x44db0b
push ebp
dec byte [ebx + 0x21]
inc edx
jbe 0x44db03
wait
pop ecx
aad 0x75
xor dl, bh
add cl, byte [edi + 0x329dc006]
pop ss
lahf
outsd dx, dword [esi]
inc edi
pushal
dec ebp
fimul dword [esi + 0x4ad22fc5]
mov ebx, 0x107c9298
cld
rol bh, 0x8f
push ebp
and al, 0x46
iretd
out dx, al
jecxz 0x44db3d
hlt

Function at 0x45ccb3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
and al, 0x38

Function at 0x468023
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
neg esi
mov ebx, 0x262d35f5
xor eax, 0x784262d
mul dword [edi + 0x3c]
jmp 0x467fc8
cmpsd dword [esi], dword es:[edi]
fld qword [edi + 0x69]
push es
sub dword [ebx], ebp
or ch, 0xaa
cmp ecx, dword [ecx + 0x7e]
rol byte [edi - 0x54709445], 1
dec ebx
xor esi, dword [esi + esi*4 - 0x26]
out 0x15, eax
mov al, byte [0x1fb49c11]
add al, 0xa6
jg 0x467f8e
rol byte [edi], 0x46
movsd dword es:[edi], dword [esi]
pop es
inc esi
adc dword [edi - 0x5157ed9], esi
leave
xlatb
mov ecx, 0x7562f71f
inc esp
hlt
salc
sub dh, byte [edi]
mov bh, 0xa7
fild qword [eax - 0xf]
jbe 0x467fbb
xchg esi, eax
pop esp
push ebx
or eax, 0x36ccb5b2
in al, dx
insd dword es:[edi], dx
jnp 0x468074
pop edi
xchg ebp, eax
fucomp st(7)
add dl, byte [edi]
pop es
loopne 0x46808e
test byte [esi + 0x3c174bab], 0xc4
sahf
jge 0x468079
popal
cld
test byte [esp + ecx*4 + 0x52], ch
add eax, 0x6f66756d
fldenv [edi + 0x22660af0]
xor dword [eax], esi
pop ecx
dec ebx
pop edx
lds ebp, [ebp + 0x61]
sbb dword [ecx + ebx], ecx
inc ebx
cld
inc ecx
mov esi, 0x7dfbd15a
xchg esp, eax
int1
pop ss
loope 0x468082
xchg edx, eax
ljmp 0x85d1
sal ebx, 1
invalid
sub byte [esi - 0x365ac913], 0xff
or al, 0x50
xchg ebx, eax
add eax, 0x66ecafd7
add dword [eax + edi*8 - 0x32796b82], ecx
xlatb
scasd eax, dword es:[edi]
in al, dx
add word [eax + edi*8 - 0x32796b82], cx
bound eax, qword [ebx + 0x6d]
xor dh, byte [0xb735fbbd]
fistp dword [esi + 0x3b171b17]
add edx, dword [eax]
invalid
Function at 0x46a971
Capabilities:
Encode data using xor

Disassembly:
sub al, byte [eax]
cmp byte [ebx], bh
sbb eax, 0x623e8dd5
cmp edx, ebp
je 0x46a907
jg 0x46a90d
xchg ecx, eax
fsubr qword [ebp + esi*2 - 0x3e846349]
mov bh, 0x9c
jnp 0x46a941
sub edi, dword [ecx - 2]
inc edi
fld dword [esi]
leave
pop edi
scasd eax, dword es:[edi]
imul edi, dword [ecx + edi*4 + 0x625191ce], 1
pop ecx
invalid

Function at 0x46a9ab
Capabilities:
Encode data using xor

Disassembly:
rcl eax, 1
dec edi
test byte [esi + 0x3e840aeb], 0x9d
je 0x46a9d5
cmp bl, byte [ecx - 0x281007ff]
dec esi
mov dh, 0x45
inc edi
push ebx
sti
lea ebx, [ecx - 0x34dc422a]
sbb byte [esi], al
mov dword [0xa366e39f], eax
bound edi, qword [ebx - 0x55]
mov ebx, 0xaacb36ed
mov byte [esi - 0x6b3052cd], ch
pop ds
retf
inc ebx
xor al, byte [esi + 0x7f]
dec esp
std
cmp al, 0xa4
mov dword [ecx], edi
or bl, byte [edx]
or eax, 0x82b52c13
jp 0x46a9df
int3

Function at 0x473cb3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586583
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473d7b
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586583
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0058025e
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473e21
cmp edi, dword [esi + 0x7c]
jge 0x473e21
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.004886c5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.004886c5
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586583
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586583
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473d73
jmp 0x473d43
call fcn.0048c8ec
int3
Function at 0x481c09
Capabilities:
Encode data using xor

Disassembly:
lds ebx, [edi - 0x21a5412d]
stosd dword es:[edi], eax
cmpsb byte [esi], byte es:[edi]
dec esp
dec esi
add dword [ebx - 0x4fa0b797], 0x21
sar byte [ebp + ecx*4 - 0x42457048], cl
adc ecx, eax
and ch, byte [esi*8 + 0x7a4f0298]
xor byte [ebp + 0x3f9e323c], bh
or bh, ah
xor byte [ebx - 0x264e7aaf], dl
push esp
enter 0x6a5f, 0xe
cmp dword [eax + 0x6ec3f7ae], ecx
out dx, eax
std
push 0x55a10664
jo 0x481c11
rcl dword [ecx], 0xa8
mov word [edi - 0x3e], ds
mov ecx, 0xa6a15730
xor dword [ecx + 0x739d039a], ecx
mov esp, esp
out dx, al
mov dl, 0x7a
daa
invalid

Function at 0x48a45c
Capabilities:
Encode data using xor

Disassembly:
jle 0x48a458
das
int 0xef
adc eax, 0x7f720139
inc eax
add al, 0x8d
test dword [edi + 0x6e870ddf], ebx
cmp dword [eax + 0xfee6716], esi
mov al, 0x16
out dx, al
packssdw mm5, qword [eax]
invalid
retf
or eax, 0xb0396e87
push ss
out dx, al
packssdw mm5, qword [eax]
sbb eax, 0x27ef93cb
adc dh, dl
outsd dx, dword [esi]
ror dl, cl
adc al, 0x38
xor ch, byte [eax]
loope 0x48a45e
jno 0x48a494
push 0x3a3bee5f
stosb byte es:[edi], al
invalid
invalid
adc dword [esi + 0x72c847b], ebp
je 0x48a47c
push edx
push es
mov bh, 0x6a
ffreep st(7)
or eax, 0xe24f5bcc
invalid

Function at 0x48aae3
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
rol byte [ebp - 3], 0xd8
push edx
pushfd
pop ebp
pause
invalid
sub dword [ecx], esp
ja 0x48ab46
xchg ecx, eax
imul edx, ebp, 0x31123383
adc dword [edi], ebx
jl 0x48aae5
mov dword [0xcbad75c2], eax
sub eax, 0xad68eeb4
dec edx
arpl word [esi + eax*2 - 0x6a2d6472], bp
inc esi
invalid
wait
invalid
xchg ebp, eax
inc esi
mov ds, word [ebx - 0x6a286a2e]
wait
rcl byte [ebp + 0x616495d7], cl
xchg ebp, eax
xlatb
xchg ebp, eax
popal
pop edi
mov ebx, 0xe5f45e83
das
xor dword [eax + 0x7c], edx
salc
inc eax
mov cl, 0x7c
add dword [ecx - 0x85de904], edi
outsd dx, dword [si]
lea ebx, [edi - 0x41]
adc dword [ebx - 0x7f], ebp
jecxz 0x48aac7
push eax
imul ecx, esp, 0xfffffffc
adc ecx, esp
outsd dx, dword gs:[esi]
or byte [esi], bh
xchg ebx, eax
test eax, 0x9b52d267
xchg esp, eax
loopne 0x48aaaf
pop ecx
sbb eax, 0xf449100a
inc edx
and byte [edx], ch
pop ebp
pop es
int 0xf0
jmp 0x48ab9a
pop eax
pushfd
mov dword [0x183ce1b9], eax
inc esp
sub al, 8
mov ah, 0x88
jns 0x48ab46
insd dword es:[edi], dx
cdq
cli
jl 0x48aae7
insd dword es:[edi], dx
aad 0xbe
or byte [esi + 0x7b611a40], 0xd5
mov edx, 0xd6eff0f3
xor dh, 0x5b
rol byte [eax], 1
ret
sbb ah, byte [ecx + 0x7b]
aad 0xba
invalid
pop eax
sbb eax, 0x2e50f00b
pop edi
cmp al, 0xcf
cmp dword [ecx], esi
out dx, al
pushal
je 0x48ab4b
or byte [edi + esi + 0x60], dh
fcmovnu st(0), st(2)
shr dword [0x19d158ac], cl
fadd qword [ecx - 0x3328a87c]
ret 0xe6e2
into
mov ah, 0x2b
out 0x8f, al
jle 0x48ab2d
salc
sahf
ja 0x48ab64
dec eax
call 0x2b368909
xor edx, esi
or dword [ebx - 0xe62b536], eax
jecxz 0x48ac2e
mov ebp, 0x3068c8e7
cmp edi, dword [0xfaa0701c]
invalid
ror byte [ecx + 0x5de58bd2], 0xc3
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
sub esp, 0x5f8
push esi
push edi
jmp 0x5ef653
Function at 0x4a10f1
Capabilities:
Encode data using xor

Disassembly:
sub byte [eax], 0xf4
lodsd eax, dword [esi]
cdq
sbb eax, 0x94d01b99
xchg edx, eax
in al, 0xdd
jmp 0x50be336e
xchg ebp, eax
loopne 0x4a112b
xchg al, ah
sti
out dx, al
loop 0x4a105d
arpl word [eax + 0xe], ax
rcr byte [edi + eax*4], 1
popal
invalid
mov ebp, 0x24714587
mov dword [0xe317ca6e], eax
iretd
stosb byte es:[edi], al
mul ecx
les ebp, [ecx + 0x50]
jecxz 0x4a10bc
inc eax
int3
push ebx
mov dword [edi + 0x26], esp
jmp 0x7003d85a
xacquire xchg dword [ecx + 0x2f], eax
mov al, 0x90
in eax, 0xe0
salc
rcr ebx, 0xc6
and ebx, ebx
in eax, dx
out 0xcc, al
stc
dec ebp
jb 0x4a10d8
cmp dword [ecx], esi
arpl ax, bx
salc
sub dword [eax], edx
mov ah, 0x14
cmp eax, esi
jecxz 0x4a10ff
adc al, 0x88
or dword [ebx], ecx
sahf
loope 0x4a1123
invalid

Function at 0x4a2133
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b4a03
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a21fb
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b4a03
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ae6de
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js fcn.004a22a1
cmp edi, dword [esi + 0x7c]
jge fcn.004a22a1
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b6b45
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b6b45
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4a03
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4a03
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a21f3
jmp 0x4a21c3