joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401925
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5141f5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4019ed
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5141f5
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50ded0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401a93
cmp edi, dword [esi + 0x7c]
jge 0x401a93
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00416337
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00416337
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5141f5
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5141f5
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4019e5
jmp 0x4019b5
call fcn.0041a55e
int3

Function at 0x40b935
Capabilities:
Encode data using xor

Disassembly:
or al, 0x7d
sahf
aad 0x33
sar byte [edi], 0xde
fsubr st(5), st(0)
mov edi, 0x85e48d53
stosd dword es:[edi], eax
sub edi, dword [0xf1bcf4b6]
mov dword [0x1d23a055], eax
ror ebx, 1
adc al, 0xbd
aam 0x69
mov ebp, 0xdcccc26c
dec ebp
xor ah, byte fs:[edi]
xchg edx, eax
push ebp
popfd
jns 0x40b950
dec esi
adc al, 0xb5
sti
fdivr qword [ecx - 0x31]
mov ah, 0x9d
cmc
sbb al, ah
sub eax, 0x54844309
invalid
Function at 0x418815
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52b0e5
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4188dd
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52b0e5
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524dc0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x418983
cmp edi, dword [esi + 0x7c]
jge 0x418983
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042d227
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042d227
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52b0e5
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52b0e5
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4188d5
jmp 0x4188a5
call fcn.0043144e
int3
Function at 0x42f6a5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541f75
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f76d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541f75
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53bc50
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f813
cmp edi, dword [esi + 0x7c]
jge 0x42f813
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004440b7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004440b7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541f75
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541f75
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f765
jmp 0x42f735
call fcn.004482de
int3

Function at 0x437c92
Capabilities:
Encode data using xor

Disassembly:
out dx, al
xchg esp, eax
sar dword [bx + di], cl
cwde
out 0xbe, al
fistp word [ebp + 0x1e03ba9c]
mov dword [0xefface28], eax
sbb bl, byte [edi - 0x3cf51ef]
xor ah, bh
psubq mm4, qword [esi + 0x40]
or ah, byte [esi + 0x6d5729ba]
movsb byte es:[edi], byte [esi]
mov al, byte [0xd45b74ef]
jl 0x437caa
pop esp
mov eax, 0xa4b0c4e6
test byte [esi], bl
dec edx
xchg ebp, eax
wait
push ds
mov esi, 0xf7f0fbd1
mov byte [0x26a4fb81], al
rol bl, cl
stosd dword es:[edi], eax
xchg esp, eax
xor bl, byte [eax - 0x6112ed56]
lahf
push cs
mov dl, bh
mov bh, 0x22
sahf
pop ebx
adc ah, byte [esi + 0x2d348788]
lodsb al, byte [esi]
and ah, ch
loop 0x437cff
mov al, 0xfa
mov ebx, 0x78d28cf3
push edi
xchg byte [0x5e9ffb1e], bl
lahf
pop esi
cmp dword [edx + eax + 0xcdf2e94], esi
mov ch, 0xdf
stc
lcall 0x33a5, 0x6abe7fdc
mov dword [0x92783a88], eax
ret
Function at 0x454b84
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
movsd dword es:[edi], dword [esi]
imul esp, dword [edx], 0xa8dd475b
and al, byte [eax + 0x46]
out dx, al
push esp
mov eax, 0x4f33de6a
jg 0x454b08
mov cl, byte [edx - 0xa3216b6]
pop esi
insd dword es:[edi], dx
ja 0x454b00
cmp eax, 0x6506206f
lcall 0xe865, 0x874b64f3
dec ebx
xchg dword [ebp - 0x18], esp
xor ah, byte [ebx + 0x21]
test dword [eax + 0x61], edi
dec esi
or esp, dword [eax + 0x23]
pop ecx
pminub mm3, mm3
push esp
push ebp
pushal
xor al, 0x85
adc eax, 0x6045eb3
xacquire xchg dword [eax + edx*2 - 0x57efe67b], edi
loop 0x454b24
salc
cli
sbb edi, dword [ebp - 0x7e9fe51]
scasd eax, dword es:[edi]
add dword [esi], edx
clc
cmp al, 0x7a
call 0x7547ca0
inc ebx
push 0xf5940fc7
loopne 0x454bb5
or eax, 0x3eb36752
xchg esi, eax
outsb dx, byte [esi]
inc edx
sbb esp, dword [edx]
push 0x4f
mov dl, 0xaf
cli
out dx, eax
or cl, ah
inc ebx
adc byte [esp + ebx + 0x5f], bl
pushal
jecxz 0x454b0b
test al, 0x86
invalid
insd dword es:[edi], dx
jnp 0x454b4d
push edx
adc al, 0x28
and dword [ebx - 0x10ccef3e], esi
ror edi, 1
push ebx
xor al, 0x14
push ds
mov byte [0x6efc9e55], al
dec edx
arpl word [edx], di
das
out 0x16, al
push ecx
pop esi
mov eax, dword [0x314231ca]
cmp esp, esi
jnp fcn.00454b84
cld
xor dword [0xaafb5334], 0x152cb035
mov ch, 0x43
je 0x454b51
mov al, 0x2c
adc eax, 0x957443b5
jmp 0x88e2f6c2

Function at 0x45cb45
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38

Function at 0x45cb4e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]

Function at 0x45cb62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
Function at 0x45cb90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call 0x56f415
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45cc0d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56f415
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5690f0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45ccb3
cmp edi, dword [esi + 0x7c]
jge 0x45ccb3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call int.00471557
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and al, 0x24
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call int.00471557
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f415
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56f415
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45cc05
jmp 0x45cbd5
call fcn.0047577e
int3

Function at 0x471440
Capabilities:
Encode data using xor

Disassembly:
salc
mov ebx, 0x29411ea0
rcr byte [ecx + 0x2be01caf], 1
or cl, dl
inc ebp
and al, 0xe7
mov byte [0xed1061a6], al
not dword [ebx]
fadd qword [0x9cebd9ae]
jne 0x47142c
sub esp, dword [ecx + ebx*8]
rol ch, cl
movsb byte es:[edi], byte ds:[esi]
mov dword ss:[0xffe047f], eax
movups xmmword [eax + esi*4], xmm2
pushal
push ss
in al, 0xd8
mov byte [0xbdd10c7e], al
xchg esp, eax
cmc
pop ebp
and ecx, dword [edi + 0x4d]
dec edi
dec ebp
jnp 0x471467
jmp 0x4714ae
push ebx
push ss
jp 0x47147e
lodsd eax, dword [esi]
mov gs, word [esi]
jae 0x47150f
mov dh, 0x53
mov ecx, 0x16da3206
mov edx, 0x8b318316
dec ebp
xchg byte [ebx], bh
push eax
stosd dword es:[edi], eax
fidiv dword [edx]
push esi
jp 0x4714dd
invalid
cwde
call 0x38d1b0d5
cli
push edi
inc esp
jmp 0x2cc9b762
invalid
invalid
invalid
Function at 0x473945
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00586215
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473a0d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00586215
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057fef0
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x473ab3
cmp edi, dword [esi + 0x7c]
jge 0x473ab3
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00488357
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00488357
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586215
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00586215
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x473a05
jmp 0x4739d5
call fcn.0048c57e
int3

Function at 0x47e92b
Capabilities:
Encode data using xor

Disassembly:
in al, 0xcf
sal byte [esp + edx*4 + 0x78d1e9d5], 0x41
mov bh, 0x34
insb byte es:[edi], dx
movsb byte es:[edi], byte [esi]
sbb al, 0x2b
push ss
sub edx, dword [esi]
lahf
in eax, 0xbb
or dword [eax], edx
pop ecx
xor eax, 0x51edd004
loopne 0x47e938
popal
clc
in al, dx
jbe 0x47e928
cmpsb byte [esi], byte es:[edi]
movsb byte es:[edi], byte [esi]
cwde
cli
xchg ecx, eax
sti
push ebp
test byte [eax + edi + 5], ah
shl dword [eax], 1
invalid

Function at 0x4821f9
Capabilities:
Check for software breakpoints

Disassembly:
pop esi
push cs
or ch, byte [ecx - 0x124c99a2]
sub eax, 0x65dc9ff7
les eax, [eax + 0x54]
fdivr st(1), st(0)
neg byte [eax + ebx*8]
mov esi, 0x5dace645
fistp word [eax - 0x4b]
daa
cmpsd dword [esi], dword es:[edi]
invalid
Function at 0x48afb5
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059d885
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48b07d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059d885
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00597560
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48b123
cmp edi, dword [esi + 0x7c]
jge 0x48b123
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049f9c7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049f9c7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d885
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059d885
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48b075
jmp 0x48b045
call fcn.004a3bee
int3

Function at 0x496325
Capabilities:
Encode data using xor

Disassembly:
test byte [ebp - 0x4d], ch
daa
dec ecx
adc dword [edi + 0x6b1749de], esp
insb byte es:[edi], dx
cli
and al, byte [edi - 0x54]
sub dword [eax], ebp
mov dword [ebp + 0x4568490f], 0x5f388ae1
pop ds
lodsd eax, dword [esi]
dec esp
and al, 9
invalid
cmc
loopne 0x4962b6
xlatb
lea ecx, [edx + 0x5f535566]
or byte [eax], cl
stc
invalid
Function at 0x498c44
Capabilities:
Encode data using add xor sub operations

Disassembly:
adc eax, 0xe9ec7573
pop ebx
stc
in eax, dx
or cl, byte [eax]
add esi, esi
sbb edi, dword [ebp + 0x5d]
jno 0x498c40
push 0x46
popfd
push cs
lahf
inc edx
dec esp
fdivr dword [eax + edi*4 + 0x8588741]
jo 0x498c46
or byte [eax + 3], dh
salc
je 0x498c57
or byte [edi], ch
invalid
xchg edx, eax
xchg edi, eax
sbb al, 0x51
in al, 0x80
mov dword [0x150eab69], eax
bound esi, qword [ecx + 0x2be7f88]
mov ch, 0x2d
test byte [ebp + 0x26], 0x8e
dec ebp
pop ebx
xchg esp, eax
lea edi, [edx - 0x55806333]
mov edx, 0xaa7f9ccd
jg 0x498c22
or eax, 0xc91b6bf3
xor dword [ecx - 0x79], esi
jno 0x498c07
out 0xd6, al
sub ecx, dword [edi]
mov fs, word [0x2f96d1eb]
add esi, dword cs:[eax + 0x65]
out dx, al
lock adc byte ds:[esi], 9
xchg byte [esi + 0x751c1128], al
loopne 0x498c76
sbb dl, byte [esi - 0x72ef1dd0]
scasd eax, dword es:[edi]
xchg edx, eax
mov ebp, dword [ebx]
mov eax, dword [0xc852131f]
cmpsd dword [esi], dword es:[edi]
aam 0x1c
sbb al, 0xc8
movsd dword es:[edi], dword [esi]
invalid
mov gs, word [ecx + 0x22]
push edi
and dword [ecx + 0x562c4619], ebp
in eax, dx
add byte [edi + 0x23], ch
idiv byte [ecx]
adc ch, byte [ecx - 0x19]
test byte [ebx - 5], bl
xchg ebp, eax
out dx, al
aam 0xe4
push es
push ebx
add dl, byte [edi + 0x5c278b69]
in eax, dx
daa
cmp ah, dh
and ch, byte [edi - 0x2bd43862]
add ah, dl
invalid

Function at 0x498c7e
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
adc eax, 0xe9ec7573
pop ebx
stc
in eax, dx
or cl, byte [eax]
add esi, esi
sbb edi, dword [ebp + 0x5d]
jno 0x498c40
push 0x46
popfd
push cs
lahf
inc edx
dec esp
fdivr dword [eax + edi*4 + 0x8588741]
jo 0x498c46
or byte [eax + 3], dh
salc
je 0x498c57
or byte [edi], ch
invalid
xchg edx, eax
xchg edi, eax
sbb al, 0x51
in al, 0x80
mov dword [0x150eab69], eax
bound esi, qword [ecx + 0x2be7f88]
mov ch, 0x2d
test byte [ebp + 0x26], 0x8e
dec ebp
pop ebx
xchg esp, eax
lea edi, [edx - 0x55806333]
mov edx, 0xaa7f9ccd
jg 0x498c22
or eax, 0xc91b6bf3
xor dword [ecx - 0x79], esi
jno 0x498c07
out 0xd6, al
sub ecx, dword [edi]
mov fs, word [0x2f96d1eb]
add esi, dword cs:[eax + 0x65]
out dx, al
lock adc byte ds:[esi], 9
xchg byte [esi + 0x751c1128], al
loopne 0x498c76
sbb dl, byte [esi - 0x72ef1dd0]
scasd eax, dword es:[edi]
xchg edx, eax
mov ebp, dword [ebx]
mov eax, dword [0xc852131f]
cmpsd dword [esi], dword es:[edi]
aam 0x1c
sbb al, 0xc8
movsd dword es:[edi], dword [esi]
invalid
mov gs, word [ecx + 0x22]
push edi
and dword [ecx + 0x562c4619], ebp
in eax, dx
add byte [edi + 0x23], ch
idiv byte [ecx]
adc ch, byte [ecx - 0x19]
test byte [ebx - 5], bl
xchg ebp, eax
out dx, al
aam 0xe4
push es
push ebx
add dl, byte [edi + 0x5c278b69]
in eax, dx
daa
cmp ah, dh
and ch, byte [edi - 0x2bd43862]
add ah, dl
invalid
Function at 0x4a1e95
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b4765
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a1f5d
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b4765
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call int.005ae440
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a2003
cmp edi, dword [esi + 0x7c]
jge 0x4a2003
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b68a7
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b68a7
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4765
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b4765
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a1f55
jmp 0x4a1f25
call fcn.004baace
int3

Function at 0x4b6ace
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xf420d4c2
movsb byte es:[edi], byte [esi]
aaa
inc ebp
repne cmpsb byte [esi], byte es:[edi]
sal edx, cl
sbb ah, byte [esi + 0x71]
sub edi, dword [ebx - 0x70]
sbb eax, 0xffffffe9
in eax, 0x27
push 0xf4f84da9
xlatb
mov ecx, dword [eax - 0x3c]
sal byte [edx], cl
xor byte [ecx - 0x7b], cl
outsb dx, byte [esi]
inc esi
loop 0x4b6adc
jp 0x4b6abc
ljmp 0xa379:0x5daca0ae
Function at 0x41b3f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41b41d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41b41d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret