joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fbc5
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4332c2
call fcn.0040efc0
sub esp, 0x11c
mov eax, dword [0x4432d4]
push ebx
push esi
push edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x42fcbe
push 0x104
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, eax
test esi, esi
jne 0x42fc92
and dword [ebp - 4], eax
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x120]
call fcn.0040508b
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0042fbc5
mov ecx, dword [ebp - 0x120]
mov esi, eax
test esi, esi
setne bl
add ecx, 0xfffffff0
mov byte [ebp - 4], 0
call fcn.00403bec
test bl, bl
jne 0x42fc92
or dword [ebp - 4], 0xffffffff
jmp 0x42fc03
cmp esi, 0x103
je 0x42fca2
cmp esi, 0x3f2
jne 0x42fcb2
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
mov eax, esi
call fcn.0040da9f
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4302f1
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x430326
cmp edi, dword [esi + 0xc]
jge 0x430326
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x430326
cmp edi, dword [eax + 8]
jge 0x430326
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x430328
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x43042c
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x430460
jmp fcn.0041ad74
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret
Function at 0x4304d1
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x4305ca
cmp eax, dword [edi + 0xc]
jge 0x4305ca
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x430522
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x4305b3
cmp dword [ebp + 0xc], ebx
je 0x4305b3
jmp 0x43054c
push 0x10
call fcn.004301bd
cmp eax, ebx
je 0x430538
mov ecx, eax
call fcn.00430423
mov esi, eax
jmp 0x43053a
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x430563
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x430573
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x430585
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0041ad74
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.0040f020
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x4305c5
cmp ecx, dword [esi + 8]
jge 0x4305c5
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x4305cb
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x430689
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4306b7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4306d5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004305f3
jmp 0x4306d5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4306d5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004305f3
test edi, edi
mov eax, edi
jne 0x4306bf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x445f44]
test ecx, ecx
je 0x430788
jmp 0x430688
ret 8
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x29727412
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x3543023e
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x438ab0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x438add
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x438add
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x358375c0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x52d63229
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401e85
Capabilities:
Access the windows event log

Disassembly:
push 0x24
mov eax, 0x410552
call fcn.0040bec4
mov esi, edx
mov edi, ecx
push 0x4164ec
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
and dword [ebp - 0x1c], 0
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
and dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
push str.Description:_A_.NET_application_failed._n
call fcn.004033f3
push 0x4164e8
push esi
push str.Application:
lea ecx, [ebp - 0x2c]
call fcn.004033f3
mov ecx, eax
call fcn.004033f3
mov ecx, eax
call fcn.004033f3
mov esi, 0x4164e8
lea ecx, [ebp - 0x2c]
push esi
push edi
push str.Path:
call fcn.004033f3
mov ecx, eax
call fcn.004033f3
mov ecx, eax
call fcn.004033f3
push str.Message:
lea ecx, [ebp - 0x2c]
call fcn.004033f3
cmp dword [0x41b4d0], 8
mov ecx, 0x41b4bc
push esi
cmovae ecx, dword [0x41b4bc]
push dword [0x41b4cc]
push ecx
mov ecx, eax
call fcn.00403807
mov ecx, eax
call fcn.004033f3
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
xor ecx, ecx
push ecx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
push ecx
push 1
push ecx
push 0x3ff
push ecx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x401fa8
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x401f9f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x401f9f
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040b923
pop ecx
pop ecx
call fcn.0040be7f
ret
Function at 0x4048c8
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x4108d7
call fcn.0040be90
mov eax, 0x41bf04
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
lea eax, [ebp + 0xc]
push eax
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 8]
push ebx
push ebx
call fcn.004045b8
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
mov esi, eax
lea ecx, [ebp - 0x1c]
or eax, 0xffffffff
test esi, esi
cmovs esi, eax
add esp, 0x18
inc esi
push esi
call fcn.00404a11
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
mov edx, esi
push eax
push dword [ebp + 8]
call fcn.004045f1
mov eax, dword fs:[0x2c]
mov edi, dword [eax]
mov esi, dword [edi + 4]
test esi, esi
jne 0x40494e
mov ecx, dword [ebp - 0x1c]
call fcn.00401e2d
jmp 0x40495c
push dword [ebp - 0x1c]
mov ecx, esi
call dword [0x4121f0]
call esi
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [0x41bf20], 0
je 0x404993
push 2
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
pop ecx
cmp dword [0x41bf1c], eax
jne 0x404987
cmp dword [edi + 4], ebx
je 0x404993
mov edx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
call fcn.004045be
lea ecx, [ebp - 0x1c]
call fcn.004049ef
push 0x41bf04
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.0040be6a
ret
Function at 0x408afe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
mov eax, esi
mov dword [esi + 0x10], edx
cmp dword [esi + 0x14], 8
jb 0x408b17
mov eax, dword [esi]
push edx
push edx
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x408b60
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x408b5c
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.004048c8
add esp, 0xc
xor al, al
jmp 0x408bc0
push ebx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040bbe8
pop ecx
push dword [ebp - 4]
mov ebx, eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x408bae
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
push ecx
push edi
push str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.004048c8
add esp, 0xc
xor al, al
jmp 0x408bbf
push ebx
mov ecx, esi
call fcn.00403791
push ebx
call fcn.0040bbe3
pop ecx
mov al, 1
pop ebx
pop edi
pop esi
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x4017e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5140b9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4018b1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5140b9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50dd94
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401957
cmp edi, dword [esi + 0x7c]
jge 0x401957
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004161fb
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004161fb
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5140b9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5140b9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4018a9
jmp 0x401879
call fcn.0041a422
int3

Function at 0x4283bd
Capabilities:
Encode data using xor

Disassembly:
ret
fbld tbyte gs:[esp + esi*4]
sal esp, 1
out 0xd9, eax
add eax, 0x14276f78
xchg sp, ax
pushfd
sub al, 0xa6
insd dword es:[edi], dx
push esp
xor al, 0xdb
sar dl, 1
pop edi
stc
cmp byte [eax], 0x9e
and ch, ch
pop es
scasb al, byte es:[edi]
pop eax
mov ah, 0x64
stosb byte es:[di], al
loop 0x4283cd
mov ebx, 0xec1cb16c
push cs
insb byte es:[edi], dx
mov byte [ebp - 0x5c], dl
add dword [edx], eax
adc al, 0xc2
pop edi
test byte [ebx + 0xaf7fb9d], al
xchg edx, eax
add ah, dh
sub eax, 0x477cfdcc
js 0x4283a3
in al, 0x6b
xchg byte [edi + 0x4d533067], ah
retf 0x9186

Function at 0x43b849
Capabilities:
Encode data using xor

Disassembly:
adc ch, byte [ecx - 0x3c264f00]
aaa
or ch, bl
das
or al, 0x77
les edx, [ebx - 0x17]
xchg edx, eax
xchg ebx, eax
push eax
test ax, 0x4661
dec ebx
out 0xd2, al
invalid
Function at 0x445949
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x558219
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445a11

Function at 0x445a6a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x558219
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x551ef4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445ab7
cmp edi, dword [esi + 0x7c]
jge 0x445ab7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a35b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a35b
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558219
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x558219
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445a09
jmp 0x4459d9
call fcn.0045e582
int3
Function at 0x45c1a9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x56ea79
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c271

Function at 0x45c2fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56ea79
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x568754
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45c317
cmp edi, dword [esi + 0x7c]
jge 0x45c317
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00470bbb
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00470bbb
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56ea79
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56ea79
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c269
jmp 0x45c239
call fcn.00474de2
int3

Function at 0x468fe9
Capabilities:
Encode data using xor

Disassembly:
test dword [ebx], esi
add eax, 0x3a36334f
xor byte [ebx - 0x1b], dh
pop ss
cmp dword [edi], 0x15
mov ah, 0x9f
inc edx
jl 0x468ff0
jb 0x469006
push ebx
xchg ebx, eax
daa
ret 0xbcd4
and al, byte [ecx + 0x5c4a7050]
mov word [edi - 0x7c], ss
test al, 0x15
adc eax, 0xd92145d
cmc
xchg edi, eax
mov eax, dword [0xce9dac3]
mov cl, 0xda
jl 0x469044
pop ds
bound ebp, qword [0x39562d56]
mov es, word [edx + 0x1cb282ba]
push eax
add eax, 0x17a8b77a
push ebp
inc eax
out 0xb5, eax
or byte [edx + 0x19f7c797], 0xfd
out 0x2a, eax
jo 0x469055
and eax, 0x3d
loopne 0x469083
ret 0x2394
mov gs, word [ebp - 0x3c]
aaa
invalid
insb byte es:[edi], dx
adc byte [edx], dh
or byte [ebp - 0x6ad5a28b], ch
invalid
Function at 0x47c796
Capabilities:
Check for software breakpoints

Disassembly:
and ch, byte [eax - 0x28a21714]
call 0x552bb06d
pop es
enter 0x4cc, 0xffffffffffffffa8
invalid

Function at 0x48a119
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059c9e9
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a1e1
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059c9e9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005966c4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a287
cmp edi, dword [esi + 0x7c]
jge 0x48a287
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049eb2b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049eb2b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059c9e9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059c9e9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a1d9
jmp 0x48a1a9
call fcn.004a2d52
int3

Function at 0x496f59
Capabilities:
Encode data using xor

Disassembly:
wait
adc dword [ebx + ecx*4 - 0x2d], ecx
int3
cmp dl, cl
inc ebx
jns 0x496f28
mov dword [0x36a90b70], eax
xor bh, byte [ebx + 0x6cb051a5]
test eax, 0xa5bb3236
push ecx
mov al, 0x6c
pushal
insd dword es:[edi], dx
mov cl, 0x56
inc ecx
xor al, 0x89
or ebp, esp
cmp cl, byte [esi - 0x3e94e5c1]
out dx, al
inc ecx
insd dword es:[edi], dx
adc byte [ebp + 0x6c51ef75], bh
cmp esi, 0x79df2438
and byte [bp + si], dl
clc
push ecx
test al, 0x65
cmpsd dword [esi], dword es:[edi]
and al, 0x7c
mov dh, 0x83
mov byte [0x123b331e], 0xb4
call 0xc020b9db
mov edx, 0xe597cef2
sub esp, 0x290eec08
pop edx
pop esi
jecxz 0x496f61
sti
mov dh, 0x3c
xchg esp, eax
invalid