joyce8/EMBER2024-capa huggingface dataset:
Function at 0x759c58
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
xor eax, eax
push ebp
push 0x759d55
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
call fcn.00409c0c
xor eax, eax
mov dword [ebx + 8], eax
xor esi, esi
lea ecx, [ebx + 8]
imul edx, dword [ebx + 0x2c], 0x3e8
mov eax, dword [ebx + 0x3c]
call fcn.00759820
test al, al
je 0x759d37
mov dword [ebp - 0xc], 0x10
mov eax, edi
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.004077ac
lea eax, [ebp - 0xc]
push eax
push edi
push 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
add eax, edx
push eax
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_recvfrom
mov esi, eax
cmp esi, 0xffffffff
jne 0x759d37
call fcn.007596f4
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
xor edx, edx
mov eax, edi
call fcn.00429514
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0
lea edx, [ebp - 0x28]
mov ecx, 2
mov eax, 0x759d74
call fcn.00425870
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 4]
call fcn.00409fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x759d5c
lea eax, [ebp - 0x2c]
call fcn.00409c0c
lea eax, [ebp - 0x10]
call fcn.00409c0c
ret

Function at 0x759e0c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x759ec4
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x10
push esi
mov eax, dword [ebp + 8]
push eax
push 0
mov eax, dword [ebp + 0xc]
push eax
lea eax, [edx + ecx]
push eax
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_sendto
mov esi, eax
cmp esi, 0xffffffff
jne 0x759ea6
call fcn.007596f4
mov edi, eax
mov dword [ebx + 8], edi
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x20]
xor edx, edx
mov eax, edi
call fcn.00429514
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, dword [ebx + 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x1c]
mov ecx, 2
mov eax, 0x759ee4
call fcn.00425870
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.00409fec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x759ecb
lea eax, [ebp - 0x20]
call fcn.00409c0c
lea eax, [ebp - 4]
call fcn.00409c0c
ret
Function at 0x781664
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x7816fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov eax, dword [esi + 4]
mov edx, edi
call fcn.00781198
lea ecx, [ebp - 8]
mov eax, dword [esi + 8]
mov edx, edi
call fcn.00781198
push edi
mov eax, ebx
mov ecx, 1
mov edx, dword [0x4048f0]
call fcn.0040c2e0
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x7816bd
sub eax, 4
mov eax, dword [eax]
mov edx, eax
dec edx
test edx, edx
jl 0x7816dd
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
mov esi, dword [ebp - 8]
xor cl, byte [esi + eax]
mov esi, dword [ebx]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x7816c7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x781705
lea eax, [ebp - 8]
mov edx, dword [0x4048f0]
mov ecx, 2
call fcn.0040b50c
ret

Function at 0x78bad0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040dd70
xor eax, eax
push ebp
push 0x78bb25
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 4]
mov edx, dword [ebp - 4]
call fcn.0040dd14
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78bb2c
lea eax, [ebp - 4]
call fcn.0040dcfc
ret

Function at 0x79925c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x79931d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x409
mov word [0x8914c4], ax
and eax, 0xf0000
shr eax, 0x10
or ax, 0xd0
mov word [0x8914c6], ax
mov byte [0x8914c8], 0
lea eax, [ebp - 4]
mov edx, pe_nt_image_headers32
call fcn.0040abac
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.0040aa30
push eax
push 1
push 0x400
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x799302
mov edx, eax
dec edx
lea eax, [ebp - 4]
call fcn.0040abac
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x799334
call fcn.0040ac84
mov eax, dword [ebp - 8]
call fcn.00424704
mov word [0x8914c4], ax
and eax, 0xf0000
shr eax, 0x10
or ax, 0xd0
mov word [0x8914c6], ax
mov byte [0x8914c8], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x799324
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409c6c
ret
Function at 0x7a3714
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x7a381a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
movzx eax, word [eax - 2]
mov word [ebx], ax
lea eax, [ebp - 8]
mov edx, esi
call fcn.0040ab24
mov eax, dword [ebp - 8]
test eax, eax
je 0x7a3754
sub eax, 4
mov eax, dword [eax]
shr eax, 1
mov edx, eax
mov word [ebx + 2], dx
movzx eax, dx
mov esi, eax
add esi, esi
test esi, esi
jle 0x7a37f6
push esi
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4048f0]
call fcn.0040c2e0
add esp, 4
mov eax, dword [ebp - 8]
mov edx, esi
dec edx
test edx, edx
jl 0x7a37ae
inc edx
xor edi, edi
movzx ecx, byte [eax]
shl ecx, 4
movzx ebx, byte [eax]
shr ebx, 4
or cl, bl
xor cl, 0xa5
and cl, 0xff
push ecx
mov ecx, dword [ebp - 4]
pop ebx
mov byte [ecx + edi], bl
inc eax
inc edi
dec edx
jne 0x7a378d
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
add eax, esi
mov edx, dword [ebp - 0xc]
cmp eax, dword [edx + 0xc]
jle 0x7a37d1
mov edx, eax
mov eax, dword [ebp - 0xc]
call fcn.0078ef44
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx + 4]
add edx, eax
mov eax, dword [ebp - 4]
mov ecx, esi
call fcn.00406eec
mov eax, dword [ebp - 0xc]
add dword [eax + 8], esi
mov eax, dword [ebp + 8]
add word [eax - 2], si
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7a3821
lea eax, [ebp - 8]
call fcn.00409c54
lea eax, [ebp - 4]
mov edx, dword [0x4048f0]
call fcn.0040c404
ret

Function at 0x7c5b40
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 0x18], edx
xor edx, edx
push ebp
push 0x7c5ba6
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0x12]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
lea eax, [ebp - 0x18]
lea edx, [ebp - 0x12]
mov ecx, 7
call fcn.0040aad4
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 4]
call fcn.00407848
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x7c5b90
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7c5bad
lea eax, [ebp - 0x18]
call fcn.00409c0c
ret
Function at 0x7db294
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x7db2e8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0x64]
xor ecx, ecx
call fcn.007c2070
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7db302
mov eax, dword [ebp - 4]
inc dword [eax + 0x18]
mov eax, dword [ebp - 4]
call fcn.007db318
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x7dde74
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x7ddf6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
jl 0x7ddf4c
mov dword [ebp - 8], 0xf
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040abac
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040aa30
push eax
call sub.kernel32.dll_GetComputerNameW
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040abac
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x7ddf4c
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0042396c
mov eax, dword [ebp - 0x10]
mov edx, 0x7ddf8c
call fcn.0040adbc
jne 0x7ddf16
mov ecx, dword [ebp - 4]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
jmp 0x7ddf46
push dword [ebp - 4]
push 0x7ddfb0
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
push dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040ad0c
mov ecx, dword [ebp - 0x18]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec dword [ebp - 0xc]
jne 0x7ddee2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ddf76
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00409c6c
lea eax, [ebp - 4]
call fcn.00409c0c
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
nop
nop
nop
nop
nop
pop eax
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x408947
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
push edi
pop ebx
and ebx, ebx
call fcn.00408965
mov ebx, edi
xor dword [eax], edx
inc eax
and ebx, edi
cmp eax, esi
jne fcn.00408947
and ebx, ebx
add edi, edi
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
sub eax, 0x403a6b
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp fcn.00401219
Function at 0x417abe
Capabilities:
Encode data using xor

Disassembly:
dec eax
xchg byte [esi - 0x3b80ab8b], ch
sub ch, ah
sub byte [esi - 0x76], dl
cmp edx, dword [eax]
sub eax, 0xf627908

Function at 0x417d90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52a609
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x417e01
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52a609
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5242e4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x417ea7
cmp edi, dword [esi + 0x7c]
jge 0x417ea7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042c74b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042c74b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52a609
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52a609
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x417df9
jmp 0x417dc9
call fcn.00430972
int3

Function at 0x4259c8
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x9c
invalid
add eax, 0xedcae194
out 0xa7, al
inc edx
dec edi
nop
push ds
in eax, dx
pushfd
xor cl, dh
add dword [eax + 0x76], ecx
jbe 0x4259ad
aas
sub dword [ebx], eax
add byte [edx - 0x11], dl
xor ah, byte [edx - 0x228df3c5]
cmp al, 0xf0
dec eax
les edx, [edx - 0x4997c3b8]
push ds
fcmovbe st(0), st(2)
and dh, ah
and eax, 0xc4c74e64
dec esi
mov esp, 0x32405db5
dec edx
cmp byte [ecx], dl
movsb byte es:[edi], byte [esi]
mov ebx, 0x7a2444c8
Function at 0x43c6c1
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
lodsb al, byte [esi]
or byte [edx], ch
jl 0x43c6e5
neg byte [ebx - 1]
test al, 0xea
sub al, 0x43
cdq
wait
and al, 0x9c
sub eax, 0x858eb023
movsd dword es:[edi], dword [esi]
sbb esp, ecx
jge 0x43c743
mov al, 0x8e
test dword [ebp + 0x687de11b], esp
push 0x51
retf
mov ss, word [ecx + 0x31]
pop es
add esp, dword [ecx - 0x1b]
rcr ebx, 1
retf
mov fs, word [edx - 0x66]
shl dword [eax - 0x781f3759], cl
bound ebx, qword [edx - 0x37585f2d]
loopne 0x43c6d3
test eax, 0x800182b0
pop ss
pop ebx
mov dh, 0x49
push esi
xor cl, byte [edx + 0x1a0fca7e]
push ecx
movsb byte es:[edi], byte [esi]
mov eax, 0x9c29f271
in al, 0x2d
and bl, 0xa7
mov cl, 0xc4
xchg esp, eax
mov edx, 0x811ebfbf
add dword [edx + 0x108c5057], esi
adc al, byte [ebx - 0x44]
sal dword [ecx + 0x76], 0x9e
adc al, 0xa
xchg ebx, eax
adc dword ds:[ebp - 0x5e], ebx
cmp dl, dh
xlatb
and dl, bl
nop
cmp al, 0xcc
and eax, 0xcf381675
pop edi
push 0x97448484
push 0x80794cb3
inc ecx
or edi, dword [edx + 6]
imul eax, dword [ebp - 0x5d], 0xeeeb1bfa
wait
lodsd eax, dword [esi]
aas
cmp ebx, dword [ebp - 0x2a05b1e8]
popal
js 0x43c744
inc esi
adc ecx, dword [eax]
inc eax
mov dh, dh
pop esp
jne 0x43c828
mov byte [0xfab89929], al
and dword [edi + 0x6d852b58], ebp
jl 0xf979055d
retf
xchg edx, eax
pop ds
ljmp 0xac9e

Function at 0x44532a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x557ad9
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5517b4
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445377
cmp edi, dword [esi + 0x7c]
jge 0x445377
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00459c1b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00459c1b
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557ad9
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x557ad9
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4452c9
jmp 0x445299
call fcn.0045de42
int3

Function at 0x452e98
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
sahf
mov dl, 0x31
or dh, bh
salc
add dh, dh
arpl word [ebp - 0x2c6eb624], cx
stc
mul byte [ebx - 0x73]
fmul qword [ecx - 0x6f]
sar ecx, cl
mov al, byte [0x858d968e]
mov edi, 0x6adce7c7
inc ebx
jecxz 0x452ea0
invalid
Function at 0x45bbbe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56e339
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x568014
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45bbd7
cmp edi, dword [esi + 0x7c]
jge 0x45bbd7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0047047b
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0047047b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56e339
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56e339
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45bb29
jmp 0x45baf9
call fcn.004746a2
int3

Function at 0x4726a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [eax], al
add byte [ebp + 0x9b], cl
add byte [ebx - 0x74c7dba4], cl
dec esp
and al, 0x2c
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x584f39
mov dword [esp + 0x28], eax
Function at 0x4726f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x472731
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x584f39
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x57ec14
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4727d7
cmp edi, dword [esi + 0x7c]
jge 0x4727d7
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0048707b
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0048707b
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f39
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x584f39
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x472729
jmp 0x4726f9
call fcn.0048b2a2
int3

Function at 0x488fca
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x8c
xor al, 0x55
mov ebx, 0x5b117ddc
iretd
jns 0x488fd0
pop ebp
pminub mm6, qword [edi]
js 0x488fb2
jle 0x488fea
retf
cmp cl, byte [esi - 0x61]
sbb ebx, dword [ebp - 0x3f4a3302]
pop edx
sbb byte [esi + 0x676f2def], 0xee
add edx, dword [edx - 0x74]
pop ecx
xor bh, byte [edi + 0x6b40afc1]
xor al, 0xaa
test dword [esi + 0x22d00710], esp
in al, dx
add byte [ebp + 0x44], dh
and ebx, ebp
mov dword [eax], edi
and dword [edx + 0x11], edi
push ebp
invalid
dec ebp
invalid
invalid
clc

Function at 0x492da3
Capabilities:
Encode data using xor

Disassembly:
enter 0x4e6f, 0xffffffffffffff9e
jae 0x492dc4
or eax, 0xaf0b3a3d
imul dword [ebx + 0xd9d29a9]
push cs
xchg edx, eax
xchg byte [edi + 0x548cfeda], dh
bound edx, qword [ecx + 0x1f]
lock sbb dword [edx], eax
sbb edi, ebp
xchg edx, eax
inc esp
xchg byte [edi - 0x15], dh
mov al, 0x6c
or dword [esi], esp
xchg edx, eax
pmulhuw mm3, qword [edi]
je 0x492dd3
pop ecx
sal byte [edx + 0x177080f5], 1
xor ebp, dword [ecx + ebx*2 - 0xa5e6844]
mov ch, byte [ebx - 0x7080a6ca]
adc ebp, ebx
jl 0x492e29
ja 0x492e58
add dword [edi], edi
ficom word [esi - 0x66]
cwde
cmp eax, 0xd91ffd13
sbb byte [esp + ebx - 0x4a], 0xbf
retf
or dword [esi], ebx
cmpsd dword [esi], dword es:[edi]
fadd qword [esp + ebp*4 - 0x3c]
mov ecx, 0x1f60abf0
sbb eax, 0xd4de9fe0
div dword [esi]
xchg esp, eax
and eax, 0xfead10bf
or eax, 0x4f53dd2d
pop es
dec ebx
sbb eax, 0x49943dc7
push 0x75
imul eax, dword [ecx - 0x71], 0x26
or eax, 0x71b69a4
sbb eax, dword [edi]
div dword [ecx]
invalid

Function at 0x496929
Capabilities:
Encode data using xor

Disassembly:
cmp byte [esi], ah
inc ebx
out dx, eax
inc ebx
mov al, 0
je 0x496959
invalid
ret