joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4455a4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
xor ebp, ebp
xor eax, eax
mov dword [esp], eax
mov eax, ebx
call fcn.0044522c
mov byte [ebx + 0x1da], al
mov edi, dword [ebx + 0x1ac]
jmp 0x44565a
mov eax, ebx
call fcn.0044522c
mov byte [esp + 4], al
cmp byte [esp + 4], 0x80
jb 0x44560c
xor eax, eax
mov al, byte [esp + 4]
mov esi, 0xff
sub esi, eax
inc esi
test esi, esi
jle 0x44563d
mov eax, ebx
call fcn.0044522c
mov byte [ebx + 0x1da], al
mov al, byte [ebx + 0x1da]
mov byte [edi], al
inc ebp
inc edi
dec esi
jne 0x4455f0
jmp 0x44563d
mov eax, ebx
call fcn.0044522c
mov byte [ebx + 0x1da], al
xor eax, eax
mov al, byte [esp + 4]
cdq
xor eax, edx
sub eax, edx
mov esi, eax
and esi, 0xff
test esi, esi
jle 0x44563d
mov al, byte [ebx + 0x1da]
mov byte [edi], al
inc ebp
inc edi
dec esi
jne 0x445630
movzx eax, word [ebx + 0x1e6]
cmp ebp, eax
jl 0x44565a
xor ebp, ebp
inc dword [esp]
mov eax, ebx
call fcn.0044522c
mov byte [ebx + 0x1da], al
movzx eax, word [ebx + 0x1e8]
cmp eax, dword [esp]
jg 0x4455cc
push ebx
push 0x4450dc
mov eax, ebx
call fcn.0040f4c4
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x448030
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x448110
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x110]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 0x110]
lea eax, [ebp - 3]
mov cl, 1
call fcn.00402a30
lea eax, [ebp - 0x118]
lea edx, [ebp - 3]
call fcn.00403730
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.004061d0
mov eax, dword [ebp - 0x114]
mov bl, byte [eax]
mov eax, ebx
add al, 0xbf
sub al, 0x1a
jae 0x4480ea
lea eax, [ebp - 0x114]
mov edx, ebx
call fcn.00403720
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 8]
mov ecx, 0x44812c
call fcn.004037d0
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 8]
call fcn.004068fc
mov ebx, eax
push ebx
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
setg byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448117
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00403630
lea eax, [ebp - 8]
call fcn.00403610
ret
Function at 0x448b94
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403938
xor eax, eax
push ebp
push 0x448c3e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
mov edx, dword [ebp - 4]
call fcn.004068fc
lea eax, [ebp - 0x109]
call fcn.0040680c
mov esi, eax
call sub.kernel32.dll_GetEnvironmentStringsA
mov ebx, eax
jmp 0x448c15
movzx edi, si
mov ecx, edi
lea edx, [ebp - 0x109]
mov eax, ebx
call fcn.00406960
test eax, eax
jne 0x448c0b
cmp byte [ebx + edi], 0x3d
jne 0x448c0b
mov edx, dword [ebp - 8]
mov eax, edi
add eax, ebx
inc eax
call fcn.004069ec
jmp 0x448c28
mov eax, ebx
call fcn.0040680c
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x448be0
push ebx
call sub.kernel32.dll_FreeEnvironmentStringsA
mov eax, dword [ebp - 8]
call fcn.00403610
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x448c45
lea eax, [ebp - 4]
call fcn.00403610
ret

Function at 0x44903c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
call fcn.004034d0
call fcn.00404ffc
call fcn.00408dc4
call fcn.00408f60
call fcn.0040fc6c
call fcn.00410a5c
call fcn.004129f0
call fcn.0041907c
call fcn.004262c4
call fcn.0042c3b0
call fcn.0043cc3c
call fcn.00449000
cmp byte [0x44a1c8], 5
jne 0x449091
call fcn.0043aa34
jmp 0x449112
cmp byte [0x44a1c8], 4
jne 0x4490aa
cmp dword [0x44a1cc], 0
je 0x449112
call fcn.0043ad24
jmp 0x449112
mov eax, dword [0x44d630]
call fcn.0042591c
mov edx, 0x449124
mov eax, dword [0x44d630]
call fcn.00425638
mov ecx, 0x44d688
mov edx, 0x43184c
mov eax, dword [0x44d630]
call fcn.0042592c
mov ecx, 0x44d6a8
mov edx, 0x442658
mov eax, dword [0x44d630]
call fcn.0042592c
mov eax, dword [0x44d630]
call fcn.004259bc
cmp byte [0x44a1c8], 0
jbe 0x449112
cmp dword [0x44a1d0], 0
je 0x449112
mov eax, dword [0x44a1d0]
push eax
call sub.user32.dll_SetForegroundWindow
call fcn.00404854
mov esp, ebp
pop ebp
ret
Function at 0x4e300c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, edx
not eax
test esi, esi
je 0x4e2d7a
lea esp, [esp]
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4e301a
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
pop ebp
jmp 0x4e2d4c
Function at 0x5906cc
Capabilities:
Encode data using xor

Disassembly:
push edx
imul eax, dword [ebx - 0x2e3f26d7], 0x92129333
lock sbb dword [ecx - 0xea5a73], edx
push edx
xchg ebx, eax
pop ebp
invalid
Function at 0x5d744c
Capabilities:
Encode data using xor

Disassembly:
push esi
and eax, 0x5f9ee4ad
jge 0x5d7499
inc esp
sbb dword [edx - 0x6f657c93], ebx
neg byte [esi]
sub esp, 0x2ce362a4
adc al, 8
les edi, [ebp + 0x618c3e94]
js 0x5d7479
cdq
lcall 0x6de1, 0x44349801
inc edx
lea ebx, [ebx]
loop 0x5d749b
and edi, edi
dec ebx
pop es
dec dword [ebx + 7]
dec ebx
cmp al, 0x85
invalid
mov ch, 0x55
out 0xf4, al
fcomp qword [ebp - 0x3b]
insd dword es:[edi], dx
mov ecx, 0xe49981e2
xchg edi, eax
pop edi
mov bh, 0x25
fbld tbyte [ebp - 0x55]
and eax, 0x34ab65df
dec esi
stosd dword es:[edi], eax
xor al, 0x4e
dec edi
salc
add eax, 0xa800b48a
mov ch, 0xd8
dec esi
dec ebp
jo 0x5d7489
pop ebx
sti
insd dword es:[edi], dx
invalid
Function at 0x43c57e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043c23e

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
nop
mov ecx, 0x747c42b9
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x2c76c8c
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x430000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x74712273
nop
nop
nop
nop
nop
test eax, eax
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x3ab46ad7
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x211f4ca1
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
cmp eax, 0
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x33805ff3
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp int.00401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
mov ecx, 0x35976322
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x197821ed
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401125
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5139f5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4011ed
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5139f5
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d6d0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401293
cmp edi, dword [esi + 0x7c]
jge 0x401293
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415b37
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415b37
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5139f5
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5139f5
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4011e5
jmp 0x4011b5
call fcn.00419d5e
int3
Function at 0x416e92
Capabilities:
Authenticate hmac

Disassembly:
pop es
ret 0x3c00
dec ebp
fild word [esp + eax*2 + 0x43]
xor edx, edi
mov esi, 0x6f425ec5
xor eax, 0xbb07794a
pop esi
aam 0x60
jbe 0x416eed
xchg edi, eax
xchg ebx, eax
test al, 0xe7
pop esp
imul ecx, dword [ecx], 0xd2401866
pop esi
mov bh, 0x2c
invalid
inc ecx
aam 0x7c
inc ebp
loope 0x416edf
or edx, dword [ebx + 0x49]
xlatb
xchg ebp, eax
push 0xffffffffffffff8c
jl 0x416e69
push eax
sub byte [ebx - 0x3df633c6], al
cmc
arpl word [edi], cx
jne 0x416f00
sti
lodsd eax, dword [esi]
je 0x416e62
jecxz 0x416f31
xchg ebp, eax
clc
adc al, 0x65
mov dh, 0x36
idiv byte [ecx + ebp]
or al, 3
jp 0x416f0e
add eax, 0x45c82acd
test eax, 0x8bd76a75
pop es
ret 0x747f
mov ecx, 0x1cb3687c
pop esi
shl word [ecx], 0x7a
invalid
call 0xf86e4d70
int1
clc
fld dword [ebx + edi*2 + 0x47071cb9]
out dx, eax
jne 0x416f04
pop es
pop edi
invalid
mov byte [0xc9dd3aff], al
leave
nop
cmp dword [ebp + 0x45], ebp
aas
and ebx, 0x72
cmp dword [eax - 0x233eeb0b], 0x4c2342dd
mov eax, 0xdcc114f5
fld qword [edx + 0x23]
dec esp
loop 0x416ed3
or byte [eax + 0x5508fdc7], bl
invalid
mov esp, 0x6648268b
imul esp, dword [0x2a23239a], 0xffffff9e
adc eax, ebp
sar dh, cl
sub dword [edx - 0x6d11487b], ebp
cmp edx, 0x823c4f23
popfd
sub byte [edi], 0xad
js 0x416f47
hlt
in eax, 0x63
and ch, byte [ebx - 0x7767e197]
loop 0x416ee5
adc esi, dword ss:[edi + 0x3d]
add byte [edi], ah
mov dword [0x48490176], eax
fcomp qword [esi + 0x78]
sub al, 0xe0
xor dword [ebx + 0x19e34fe7], eax
push esi
test al, 0x92
imul esp, dword [ebx + 0x35], 0x7c18de36
adc byte [ebx + 0x7b], al
mov dl, 0x83
mov edi, 0x6b6118bb
arpl word [edi - 0x7d], si
or dword [ebx - 0x5b], esi
xchg edi, eax
adc dword [ebx + 0xb1245f4], 0xdc689397
add byte [esi + 0x6031f25b], ah
lds edx, [edi - 0x3760b5bb]
and eax, 0xa8263b74
std
push eax
jl 0x416f52
pop edx
aam 0x32
or eax, 0x5f57fcf8
mov ah, 0xc1
daa
jg 0x417021
or eax, 0x95632250
push dword [ebx + ecx*8 - 0xd54587e]
sub esi, dword [eax - 0x367d583a]
ja 0x416f8e
push ebp
out dx, al
sbb eax, ebp
mov ebx, 0xb414a72c
or al, 0x4b
inc eax
or al, 0x9c
imul byte [ecx]
cmpsb byte [esi], byte es:[edi]
cmp edx, dword [ebx + 0x371106c6]
bound ebp, qword [edx + 0x3871a2c4]
push ecx
invalid
fisttp qword [eax + ebx*8 + 0x2d]
push eax
push ebp
dec ebp
jge 0x417088
and dword [edi], esp
cmp al, 0x13
dec ebp
adc dword [edx + ebx*2], ebx
retf
xchg ebx, eax
add ah, byte [ebp + 0x7caeb95e]
int3
Function at 0x417dac
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52a665
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x417e5d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52a665
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524340
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x417f03
cmp edi, dword [esi + 0x7c]
jge 0x417f03
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042c7a7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042c7a7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52a665
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52a665
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x417e55
jmp 0x417e25
call fcn.004309ce
int3