joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e20ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x101e8958], 0
mov dword [0x101e895c], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [0x101e8968], 0
mov dword [0x101e8950], 0x1445
mov ecx, dword [ebp - 0x10]
cmp ecx, 0
mov edx, eax
mov esi, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], eax
je 0x100e2295
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x101e8950], 0x1a3e
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x101e8958], edx
mov dword [0x101e8954], 0x263
mov ecx, dword [ebp - 0x1c]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x101e895c], edx
mov dword [0x101e8954], 0x25c1
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x101e8960], cl
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov edx, dword [0x101e8954]
add edx, 0x1fb5
mov dword [0x101e8950], edx
mov cl, byte [0x101e8960]
mov edx, dword [0x101e895c]
mov byte [edi + edx], cl
mov edx, dword [0x101e8950]
add edx, 0x201f
mov dword [0x101e8950], edx
mov edx, dword [0x101e8958]
movzx edx, byte [edi + edx]
mov ebx, dword [0x101e895c]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x101e8968], ebx
mov dword [0x101e8950], 0xfad
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x101e896d], ch
mov byte [0x101e896e], cl
xor ch, cl
mov byte [0x101e896c], ch
mov dword [0x101e8950], 0x8f3
mov edx, dword [0x101e8954]
add edx, 0xffffec9d
mov dword [0x101e8954], edx
mov edx, dword [ebp - 0x18]
mov byte [edx + ebx], ch
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x100e2295
mov eax, dword [0x101e8958]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x101e895c]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], edx
jmp 0x100e2151
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4013b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x513c81
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x401479
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x513c81
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50d95c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x40151f
cmp edi, dword [esi + 0x7c]
jge 0x40151f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00415dc3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00415dc3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c81
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x513c81
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x401471
jmp 0x401441
call fcn.00419fea
int3
Function at 0x418211
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0052aae1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4182d9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0052aae1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005247bc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x41837f
cmp edi, dword [esi + 0x7c]
jge 0x41837f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cc23
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cc23
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0052aae1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0052aae1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4182d1
jmp 0x4182a1
call fcn.00430e4a
int3

Function at 0x425ecf
Capabilities:
Encode data using xor

Disassembly:
les edx, [edx - 0x5d96aaee]
pop ds
wait
scasb al, byte es:[edi]
xor al, 0xb5
Function at 0x42cc23
Capabilities:
Encode data using xor

Disassembly:
cdq
out 0x90, eax
invalid
push es
mov ebx, 0x53ae9d2a
adc dword [eax - 0x65], edx
push ebx
mov esi, 0x3816449b
or byte [ebp + 0x3ecc1d58], ah
lodsb al, byte [esi]
xor dword [esi - 0x54], esi
push edi
invalid
jge 0x42cbb4
cmp esi, eax
std
in al, dx
push 0x70
push ecx
test eax, 0x1547a6a6
adc eax, 0xa555c6b4
adc eax, 0xa555c6b4
adc eax, eax
pop edx
loopne 0x42cbf7
mov esp, 0x522f2035
mov esi, 0xba377b1c
pop ebp
les edx, [ecx + 0x482d3700]
std
mov bh, 0x84
pushal
mov word [ecx + 0x4b], gs
adc byte [ebx], 0x39
jbe 0x42cc16
sub ah, byte [esi + 0x2b]
pop ds
movsb byte es:[edi], byte [esi]
push ecx
aam 5
cli
mov ecx, 0xa885abc3
lds esi, [ebx + 0x43bec7]
jg 0x42ccc5
pop es
in al, dx
sti
jg 0x42ccd2
cdq
mov eax, dword [0x638ed6df]
xor al, 0xfe
out 0x31, eax
wait
wait
invalid

Function at 0x42f0a1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00541971
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f169
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00541971
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0053b64c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f20f
cmp edi, dword [esi + 0x7c]
jge 0x42f20f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443ab3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443ab3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541971
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541971
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f161
jmp 0x42f131
call fcn.00447cda
int3
Function at 0x4419be
Capabilities:
Encode data using xor

Disassembly:
mov dl, 0xb
mov dword [0x64ab755e], eax
xor dl, byte [edi - 0x3bf1c16f]
pop edi
xlatb
sbb ah, byte [esp + ecx*8 - 0x13]
mov dword [ebx - 0x40], ecx
std
inc esp
mov byte [ebp - 8], dh
mov cl, 0xb7
dec esp
pop ss
invalid
in eax, 0xc2
jp 0x44196f
inc edi
mov ch, 0x15
inc eax
sub eax, 0x6f09bcf7
inc ebp
dec edi
jge 0x441953
wait
add eax, 0x1da57d5d
pop esp
mov ah, 0x95
dec ecx
and cl, byte [ecx]
xchg edi, eax
loop 0x441a21
mov byte [0x6d316168], al
pop ebx
mov esp, 0x81832ed3
sub edx, esi
sbb al, 0xba
mov esi, 0x1e552b0f
loope 0x441a16
mov esi, 0x97db950a
adc dword [ebx - 0x3430a071], esp
pop ds
or al, 0x55
ret 0x5cb5
loop 0x4419cc
jg 0x4419af
mov cs, ecx
aam 0x7b
wait
fadd dword [edx + 0xb30bb29]
int3
sub dword [ebx - 0x6833f4d0], edi
movsb byte es:[edi], byte [esi]
inc eax
sbb dword [edx], edi
push ebp
sbb al, 0x58
das
mov cl, 0xd2
insb byte es:[edi], dx
pushfd
enter 0xfffffffffffff00b, 0xffffffffffffffb8
xor cl, byte [eax]
into
scasb al, byte es:[edi]
cmpsd dword [esi], dword es:[edi]
out dx, eax
cmpsd dword [esi], dword es:[edi]
salc
sub al, 0x44
lahf
xor al, 0x1e
jmp 0x984e1b62

Function at 0x445ae1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445b0a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]

Function at 0x445b1e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
Function at 0x445baf
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445c4f
add byte [eax], al
cmp edi, dword [esi + 0x7c]
jge 0x445c4f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a4f3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a4f3
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call fcn.005583b1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005583b1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445ba1
jmp 0x445b71
call fcn.0045e71a
int3

Function at 0x445c0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445c4f
add byte [eax], al
cmp edi, dword [esi + 0x7c]
jge 0x445c4f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a4f3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a4f3
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
or eax, 0x560e70
call fcn.005583b1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005583b1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445ba1
jmp 0x445b71
call fcn.0045e71a
int3

Function at 0x469381
Capabilities:
Encode data using xor

Disassembly:
pop edx
loopne 0x469387
retf 0xf597
fadd qword [ebp - 0x63]
shl byte [edi], cl
inc esp
mov es, word [ebp + 0xdf90d86]
lodsd eax, dword [esi]
or eax, dword [eax - 0x46436fc2]
popal
mov ebx, 0xbef7ecf5
shr byte [edx], 0xc6
xchg esi, eax
mov ecx, 0xecf5bb61
idiv dword [esi - 0x6939d540]
xor al, 0xc
pop ebx
jns 0x469375
jo 0x46934f
and ch, cl
sti
adc dword [eax + ecx*4], eax
invalid
Function at 0x473341
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585c11
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473409
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00585c11
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057f8ec
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4734af
cmp edi, dword [esi + 0x7c]
jge 0x4734af
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00487d53
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00487d53
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585c11
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585c11
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473401
jmp 0x4733d1
call fcn.0048bf7a
int3
Function at 0x4893df
Capabilities:
Encode data using xor

Disassembly:
loopne 0x48942a
sbb ecx, dword [ecx - 0x263f84d6]
sar byte [esi], 0x80
push edi
lcall 0xfd86, 0x985885eb
mov word [ecx], es
jbe 0x4893ff
nop
jmp 0x48946f
cdq
xchg edi, eax
pop edx
cmp ebp, eax
push es
fucomp st(6)
test dword [ecx - 0x32], ebp
mov cs, ebp
sub esp, 0x32c0769f
insb byte es:[edi], dx
or byte [eax + 0x64206c26], al
mov eax, dword [0x35a25045]
fbstp tbyte [edi + 0x38169ec0]
xchg dword [ecx + edx*2 + 0x6f5041e5], edx
push eax
outsd dx, dword [esi]
xor eax, dword [edx + edi - 0x439b7734]
jbe 0x48947b
div dh
ficom word [edi + 0x6c345681]
ror dword [esi], 0x1a
jmp 0x4894a0
jmp 0xf9c69018
mov eax, 0xd282280c
mov al, byte [0x63157dbf]
das
mov esp, 0xba8006fa
stc
dec ebp
rcl byte [ebx]
jnp 0x489464
wait
stc
invalid
lcall 0x2b7c, 0xd00b5aec
sbb dword [ecx + 0x66], 0x32617d79
dec eax
sub edi, dword [esi + 0x68]
test byte [ebx + 0x6d], dl
int 0x42
jne 0x489445
rcr byte [ebx + 0x2f], cl
add eax, 0xac7c7d7b
mov esp, 0x85b3568d
jns 0x4894d1
pop ebp
adc al, 0x33
outsd dx, dword [esi]
insb byte es:[edi], dx
fdivrp st(0)
fsubr st(1), st(0)
fsubr st(1), st(0)
adc dword [esi + 0x965ceee], edi
add esp, 0xffffffdb
outsd dx, dword [esi]
neg bl
lahf
in eax, dx
in al, dx
xor byte [ebx + ebp], dh
sti
fld xword [edi - 0xa]
fistp dword [edi + 0x3430eced]
sub edi, ebx
jle 0x4894db
inc byte [ebx]
invalid

Function at 0x48a501
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059cdd1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
Function at 0x48a58c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp dword [esi + 0x7c], edi
jg 0x48a5c9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059cdd1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596aac
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a66f
cmp edi, dword [esi + 0x7c]
jge 0x48a66f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049ef13
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049ef13
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059cdd1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059cdd1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a5c1
jmp 0x48a591
call fcn.004a313a
int3
Function at 0x4a13e1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b3cb1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a14a9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b3cb1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005ad98c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a154f
cmp edi, dword [esi + 0x7c]
jge 0x4a154f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.004b5df3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.004b5df3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3cb1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b3cb1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a14a1
jmp 0x4a1471
call fcn.004ba01a
int3