joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49bec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4a00a1
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
mov eax, dword [0x4d54a0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
lea esi, [esp + 0x14]
call fcn.0049ae80
lea esi, [esp + 0x24]
mov dword [esp + 0x78], 0
call fcn.0049ae80
mov ecx, edi
mov byte [esp + 0x78], 1
call fcn.00401c00
mov esi, dword [esp + 0x1c]
test esi, esi
jge 0x49bf38
push 0
push 0x4b
push 0x4bc810
push 0x4bc840
push 0x4bc844
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [edi]
mov ebx, dword [esp + 0x14]
mov edx, dword [eax + 8]
push esi
push ebx
mov ecx, edi
call edx
xor ecx, ecx
mov dword [esp + 0x18], eax
mov esi, eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x5c], ecx
call fcn.0049a210
test eax, eax
sete al
test al, al
jne 0x49bf95
push 0x4b84f0
push 0x4b84f0
push 0x4b84f0
push 0x4d7eb4
call fcn.0041d860
add esp, 0x10
mov byte [esp + 0x78], 2
lea ebx, [ebx]
mov eax, dword [edi]
mov edx, dword [eax + 0x2c]
mov ecx, edi
call edx
add dword [ebp + 8], esi
mov byte [esp + 0x84], al
mov esi, dword [esp + 0x84]
lea ebx, [ebx]
push esi
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0049ada0
add dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x80]
mov edx, dword [ecx]
mov edx, dword [edx + 0xc]
push eax
mov eax, dword [esp + 0x28]
push eax
call edx
cmp dword [esp + 0x44], 0
je 0x49bfc0
mov esi, dword [esp + 0x1c]
test esi, esi
jge 0x49c017
push 0
push 0x4b
push 0x4bc810
push 0x4bc840
push 0x4bc844
push 0
call fcn.0041d410
add esp, 0x18
mov eax, dword [edi]
mov edx, dword [eax + 8]
push esi
push ebx
mov ecx, edi
call edx
cmp byte [esp + 0x84], 0
mov dword [esp + 0x18], eax
mov esi, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ebx
je 0x49bfa0
mov eax, dword [esp + 0x6c]
lea esi, [esp + 0x34]
mov dword [ebp + 0x14], eax
mov byte [esp + 0x78], 1
call fcn.00499720
lea ecx, [esp + 0x24]
mov byte [esp + 0x78], 0
call fcn.0049b0a0
lea ecx, [esp + 0x14]
mov dword [esp + 0x78], 0xffffffff
call fcn.0049b0a0
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 8
Function at 0x4eae78
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x443ac2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004ec4d8
add esp, 4
lea ecx, [esp + 0x14]
xor esi, esi
push ecx
lea eax, [esp + 0x1c]
mov edx, 0x44df48
mov dword [esp + 0x48], esi
call fcn.004e1558
add esp, 4
mov byte [esp + 0x44], 1
mov ebx, 2
push 0x45ad54
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], esi
call dword [fcn.00449024]
mov dword [esp + 0x34], 0x45ad54
mov byte [esp + 0x44], bl
mov edx, dword [esp + 0x14]
push 1
add edx, 0xc
push edx
push SysReAllocStringLen
lea eax, [esp + 0x34]
push eax
call fcn.004ffbe8
mov ebp, dword [fcn.00449028]
cmp dword [esp + 0x28], esi
je 0x4eaff7
push 0x44dfb8
lea ecx, [esp + 0x20]
push ecx
lea esi, [ebx + 0xe]
call fcn.004e1718
lea edx, [esp + 0x24]
push edx
mov byte [esp + 0x48], 3
call fcn.004df628
add esp, 4
lea ecx, [esp + 0x1c]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x50], 4
call fcn.004e76b8
add esp, 0xc
mov byte [esp + 0x44], 6
mov edi, dword [esp + 0x24]
push edi
call ebp
test eax, eax
jg 0x4eaf6c
mov ebx, dword [edi + 8]
mov esi, 0x45af88
call fcn.004f4e28
mov byte [esp + 0x44], 7
mov edi, dword [esp + 0x1c]
push edi
call ebp
test eax, eax
jg 0x4eaf89
mov ebx, dword [edi + 8]
mov esi, 0x45af88
call fcn.004f4e28
mov esi, dword [esp + 0x20]
add esi, 0xc
jne 0x4eafb0
push esi
push 0x176
push 0x44f420
push 0x44b954
push 0x44b954
push esi
call fcn.004e4bb8
add esp, 0x18
mov eax, esi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4eafb8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, esi
call fcn.00500108
mov byte [esp + 0x44], 2
mov eax, dword [esp + 0x20]
push eax
mov edi, eax
call ebp
test eax, eax
jg 0x4eaff7
mov ebx, dword [edi + 8]
mov esi, 0x45af88
call fcn.004f4e28
mov esi, dword [esp + 0x4c]
cmp dword [esi + 4], 0
je 0x4eb021
push 0
push 0x1d7
push 0x44de80
push 0x44b954
push 0x44b954
push 0
call fcn.004e4bb8
add esp, 0x18
mov eax, dword [esp + 0x18]
add eax, 0xc
push eax
push 0
call dword [0x449000]
lea edx, [esp + 0x28]
push edx
mov dword [esi + 4], eax
mov byte [esp + 0x48], 1
call fcn.004ffb58
mov byte [esp + 0x44], 0
mov esi, dword [esp + 0x14]
push esi
call ebp
test eax, eax
jg 0x4eb062
mov ebx, dword [esi + 8]
mov edi, esi
mov esi, 0x45af88
call fcn.004f4e28
mov dword [esp + 0x44], 0xffffffff
mov edi, dword [esp + 0x18]
push edi
call ebp
test eax, eax
jg 0x4eb082
mov ebx, dword [edi + 8]
mov esi, 0x45af88
call fcn.004f4e28
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x38
ret 4
Function at 0x4f4608
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4446d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp byte [ebp + 0x10], 0
push esi
push edi
mov edi, ecx
mov ebx, edx
jne 0x4f4636
push ebp
call fcn.004f4568
mov ecx, dword [ebp]
test ecx, ecx
je 0x4f46a9
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4f4662
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
push edi
push ebx
call edx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp eax, 1
jne 0x4f46a0
mov eax, dword [ebp + 0xc]
push eax
push edi
push ebx
lea eax, [esp + 0x30]
push eax
call fcn.004e1888
mov dword [esp + 0x1c], 0
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 4]
push eax
lea ecx, [edi + 0xc]
push ecx
mov ecx, ebp
call fcn.004f47c8
mov dword [esp + 0x1c], 0xffffffff
push edi
jmp 0x4f4796
push 0
push 0x75
jmp 0x4f472f
mov esi, dword [ebp + 4]
test esi, esi
je 0x4f475d
mov eax, dword [ebp + 8]
test eax, eax
jne 0x4f46d5
call fcn.004e3558
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
cmp eax, 1
jne 0x4f472b
mov eax, dword [ebp + 0xc]
push eax
push edi
push ebx
lea edx, [esp + 0x30]
push edx
call fcn.004e1888
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 4]
push ecx
add eax, 0xc
push eax
mov ecx, ebp
call fcn.004f47c8
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004e3798
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
push 0
push 0x7d
push 0x44ecd8
push 0x44b954
push 0x44b954
push 0
call fcn.004e4bb8
add esp, 0x18
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
mov eax, dword [ebp + 0xc]
push eax
mov edx, ebx
lea edi, [esp + 0x14]
call fcn.004e1968
mov dword [esp + 0x1c], 2
mov ecx, dword [eax]
add ecx, 0xc
push ecx
push 0x44ed30
call fcn.004f77d8
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
add esp, 8
mov edi, eax
push eax
call dword [fcn.00449028]
test eax, eax
jg 0x4f47ad
mov ebx, dword [edi + 8]
mov esi, 0x45af88
call fcn.004f4e28
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x10
ret 4
Function at 0x4f5438
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x441c79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov edi, dword [esp + 0x20]
xor ebx, ebx
mov dword [esp + 0x18], ebx
push 0x45ad44
mov dword [esp + 0x10], ebx
call dword [fcn.00449024]
mov dword [edi], 0x45ad44
push 0xa
mov dword [esp + 0x1c], ebx
push 0x29
lea esi, [ebx + 0x28]
mov dword [esp + 0x14], 1
call fcn.004f5318
push eax
mov eax, dword [esp + 0x30]
push eax
call fcn.0050c5f5
mov ecx, dword [edi]
lea eax, [ecx + 0xc]
add esp, 0x10
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x4f549e
sub eax, esi
mov dword [ecx + 4], eax
mov ecx, dword [edi]
mov byte [ecx + eax + 0xc], bl
mov ecx, dword [esp + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x503168
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x44324d
push eax
mov dword fs:[0], esp
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], 0x44f754
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], 0x1f
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], 0x80
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
push eax
push ecx
push edx
mov eax, esi
call fcn.00503278
mov ecx, dword [esp + 4]
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 0xc

Function at 0x506f08
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x444428
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
xor ebx, ebx
push esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
push 0x30
lea eax, [esp + 0x34]
push ebx
push eax
mov byte [esp + 0x78], 2
call fcn.005100b8
mov edx, dword [esp + 0x84]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00507078
mov edx, dword [esp + 0x8c]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00507118
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x34]
push edx
mov edx, dword [esp + 0x94]
lea ecx, [esp + 0x20]
call fcn.005071b8
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x90]
lea eax, [esp + 0x14]
push eax
push ecx
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x30]
call fcn.00507298
mov eax, dword [esp + 0x94]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.005073e8
mov eax, dword [esp + 0x9c]
add esp, 0x28
lea edx, [esp + 0x30]
push edx
push eax
call fcn.00506e68
mov esi, eax
mov byte [esp + 0x6c], 1
mov eax, dword [esp + 0x28]
cmp eax, ebx
je 0x507020
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov byte [esp + 0x6c], bl
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x50703a
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x70], 0xffffffff
call fcn.004df128
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x507062
mov ecx, dword [eax - 8]
mov edx, dword [ecx]
add eax, 0xfffffff8
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esp + 0x64]
mov eax, esi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x68
ret 0x1c
Function at 0x10463570
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x10463b90
lea edx, [ecx*4]
shl ebx, 2
jle 0x10463a2c
jg 0x10463a2c
ljmp 0xf0ce:0x7380e171
lea esp, [esp + 1]
jmp 0x104639d2
call fcn.10463a04
lea edx, reloc.WINMM.dll_timeGetTime
sub esp, 5
jnp 0x104639e8
lea esp, [esp + 1]
jmp 0x104639ec
push dword [esp + 0x30]
ret 0x34
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
ja 0x1046358e
mov dh, 0xf
adc cl, 0x57
jne 0x10463b7a
je 0x10463caa
mov ss, word [ecx]
and eax, 0x8710d713
xchg dword [esp + 0x24], edx
sub esp, 0x17
lea esp, [esp + 8]
pop word [esp + 3]
lea esp, [esp + 1]
jmp 0x10463b73
ror edx, 2
jmp 0x10463c00
ror edx, 2
neg dx
dec dl
jmp 0x10463c05
pushfd
lea ebx, [esi + 0x40]
inc eax
shr edx, cl
jnp 0x10463bc0
jp 0x10463bc9
mov dl, byte [esp]
sub ebx, ecx
jbe 0x10463c68
not dx
lea edx, reloc.WINMM.dll_timeGetTime
jmp 0x10463cc7
neg dx
dec dl
mov dl, 0x7d
call 0x10463c0e
cmp edx, dword [edx]
mov edx, 0xf0c240cc
sub esp, 4
btr edx, eax
mov edx, dword [esp + 2]
lea edx, [esi + ebp]
jmp 0x10463c5e
pushal
mov dword [esp + 0x18], esi
popal
setg dh
mov dx, 0xe3ea
jmp 0x10463be0
xchg dword [esp + 4], edx
stc
call fcn.10463c22
not dx
jmp 0x10463c8b
lea edx, reloc.WINMM.dll_timeGetTime
mov dl, cl
ror dh, cl
jmp 0x10463cb1
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
lea edx, [ebp - 0x80]
jmp 0x10463ccd
mov dl, cl
ror dh, cl
jmp 0x10463cb1
and dl, 0xfc
call 0x10463cd6
lodsb al, byte [esi]
sub esp, 0x1c
jmp 0x10463d4e
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
lea esp, [esp + 1]
sub edx, ebx
lea esp, [esp + 0xc]
jmp 0x10463d30
sub esp, 0xd
jg 0x10463cff
lea esp, [esp + 1]
call fcn.10463d86
sub eax, 0x648dd32b
and al, 0xc
jmp 0x10463db6
pushal
mov esp, edx
pushfd
jmp 0x10463dbc
je 0x10463cdf
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
pushal
jmp 0x10463d31
lea esi, [edx + ebx - 0x40]
cmc
jle 0x10463fa2
jg 0x10463fa2
salc
push ecx
shl dword [eax - reloc.WINMM.dll_timeGetTime], 0x40
daa
shl byte [edx - 0x2d], cl
dec edx
mov ebx, ecx
lea edx, [edi + ebp]
mov dx, word [esp]
jmp 0x10463ae1
jmp 0x10463e41
mov edi, edx
pushal
mov dx, word [esp]
cmc
jo 0x10463de9
mov dword [esp + 0x18], ebx
jmp 0x10463e45
mov dword [esp + 0x18], ebx
call fcn.10463e29
pop edi
pop esi
popfd
jmp fcn.10463e53
push edi
push ecx
mov esi, ecx
jmp 0x10463dff
push esi
jmp 0x10463e71
Function at 0x10463c0e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x10463b90
lea edx, [ecx*4]
shl ebx, 2
jle 0x10463a2c
jg 0x10463a2c
ljmp 0xf0ce:0x7380e171
lea esp, [esp + 1]
jmp 0x104639d2
call fcn.10463a04
lea edx, reloc.WINMM.dll_timeGetTime
sub esp, 5
jnp 0x104639e8
lea esp, [esp + 1]
jmp 0x104639ec
push dword [esp + 0x30]
ret 0x34
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
ja 0x1046358e
mov dh, 0xf
adc cl, 0x57
jne 0x10463b7a
je 0x10463caa
mov ss, word [ecx]
and eax, 0x8710d713
xchg dword [esp + 0x24], edx
sub esp, 0x17
lea esp, [esp + 8]
pop word [esp + 3]
lea esp, [esp + 1]
jmp 0x10463b73
ror edx, 2
jmp 0x10463c00
ror edx, 2
neg dx
dec dl
jmp 0x10463c05
pushfd
lea ebx, [esi + 0x40]
inc eax
shr edx, cl
jnp 0x10463bc0
jp 0x10463bc9
mov dl, byte [esp]
sub ebx, ecx
jbe 0x10463c68
not dx
lea edx, reloc.WINMM.dll_timeGetTime
jmp 0x10463cc7
neg dx
dec dl
mov dl, 0x7d
call 0x10463c0e
cmp edx, dword [edx]
mov edx, 0xf0c240cc
sub esp, 4
btr edx, eax
mov edx, dword [esp + 2]
lea edx, [esi + ebp]
jmp 0x10463c5e
pushal
mov dword [esp + 0x18], esi
popal
setg dh
mov dx, 0xe3ea
jmp 0x10463be0
xchg dword [esp + 4], edx
stc
call fcn.10463c22
not dx
jmp 0x10463c8b
lea edx, reloc.WINMM.dll_timeGetTime
mov dl, cl
ror dh, cl
jmp 0x10463cb1
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
lea edx, [ebp - 0x80]
jmp 0x10463ccd
mov dl, cl
ror dh, cl
jmp 0x10463cb1
and dl, 0xfc
call 0x10463cd6
lodsb al, byte [esi]
sub esp, 0x1c
jmp 0x10463d4e
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
lea esp, [esp + 1]
sub edx, ebx
lea esp, [esp + 0xc]
jmp 0x10463d30
sub esp, 0xd
jg 0x10463cff
lea esp, [esp + 1]
call fcn.10463d86
sub eax, 0x648dd32b
and al, 0xc
jmp 0x10463db6
pushal
mov esp, edx
pushfd
jmp 0x10463dbc
je 0x10463cdf
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
pushal
jmp 0x10463d31
lea esi, [edx + ebx - 0x40]
cmc
jle 0x10463fa2
jg 0x10463fa2
salc
push ecx
shl dword [eax - reloc.WINMM.dll_timeGetTime], 0x40
daa
shl byte [edx - 0x2d], cl
dec edx
mov ebx, ecx
lea edx, [edi + ebp]
mov dx, word [esp]
jmp 0x10463ae1
jmp 0x10463e41
mov edi, edx
pushal
mov dx, word [esp]
cmc
jo 0x10463de9
mov dword [esp + 0x18], ebx
jmp 0x10463e45
mov dword [esp + 0x18], ebx
call fcn.10463e29
pop edi
pop esi
popfd
jmp fcn.10463e53
push edi
push ecx
mov esi, ecx
jmp 0x10463dff
push esi
jmp 0x10463e71
Function at 0x10463cd6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 4]
jmp 0x10463b90
lea edx, [ecx*4]
shl ebx, 2
jle 0x10463a2c
jg 0x10463a2c
ljmp 0xf0ce:0x7380e171
lea esp, [esp + 1]
jmp 0x104639d2
call fcn.10463a04
lea edx, reloc.WINMM.dll_timeGetTime
sub esp, 5
jnp 0x104639e8
lea esp, [esp + 1]
jmp 0x104639ec
push dword [esp + 0x30]
ret 0x34
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
ja 0x1046358e
mov dh, 0xf
adc cl, 0x57
jne 0x10463b7a
je 0x10463caa
mov ss, word [ecx]
and eax, 0x8710d713
xchg dword [esp + 0x24], edx
sub esp, 0x17
lea esp, [esp + 8]
pop word [esp + 3]
lea esp, [esp + 1]
jmp 0x10463b73
ror edx, 2
jmp 0x10463c00
ror edx, 2
neg dx
dec dl
jmp 0x10463c05
pushfd
lea ebx, [esi + 0x40]
inc eax
shr edx, cl
jnp 0x10463bc0
jp 0x10463bc9
mov dl, byte [esp]
sub ebx, ecx
jbe 0x10463c68
not dx
lea edx, reloc.WINMM.dll_timeGetTime
jmp 0x10463cc7
neg dx
dec dl
mov dl, 0x7d
call 0x10463c0e
cmp edx, dword [edx]
mov edx, 0xf0c240cc
sub esp, 4
btr edx, eax
mov edx, dword [esp + 2]
lea edx, [esi + ebp]
jmp 0x10463c5e
pushal
mov dword [esp + 0x18], esi
popal
setg dh
mov dx, 0xe3ea
jmp 0x10463be0
xchg dword [esp + 4], edx
stc
call fcn.10463c22
not dx
jmp 0x10463c8b
lea edx, reloc.WINMM.dll_timeGetTime
mov dl, cl
ror dh, cl
jmp 0x10463cb1
mov bh, byte [esp]
mov bl, al
jmp 0x10463c39
lea edx, [ebp - 0x80]
jmp 0x10463ccd
mov dl, cl
ror dh, cl
jmp 0x10463cb1
and dl, 0xfc
call 0x10463cd6
lodsb al, byte [esi]
sub esp, 0x1c
jmp 0x10463d4e
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
lea esp, [esp + 1]
sub edx, ebx
lea esp, [esp + 0xc]
jmp 0x10463d30
sub esp, 0xd
jg 0x10463cff
lea esp, [esp + 1]
call fcn.10463d86
sub eax, 0x648dd32b
and al, 0xc
jmp 0x10463db6
pushal
mov esp, edx
pushfd
jmp 0x10463dbc
je 0x10463cdf
pop word [esp + 8]
lea esp, [esp + 2]
jmp 0x10463d15
pushal
jmp 0x10463d31
lea esi, [edx + ebx - 0x40]
cmc
jle 0x10463fa2
jg 0x10463fa2
salc
push ecx
shl dword [eax - reloc.WINMM.dll_timeGetTime], 0x40
daa
shl byte [edx - 0x2d], cl
dec edx
mov ebx, ecx
lea edx, [edi + ebp]
mov dx, word [esp]
jmp 0x10463ae1
jmp 0x10463e41
mov edi, edx
pushal
mov dx, word [esp]
cmc
jo 0x10463de9
mov dword [esp + 0x18], ebx
jmp 0x10463e45
mov dword [esp + 0x18], ebx
call fcn.10463e29
pop edi
pop esi
popfd
jmp fcn.10463e53
push edi
push ecx
mov esi, ecx
jmp 0x10463dff
push esi
jmp 0x10463e71

Function at 0x1049f4b3
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x587940f4
mov ebx, 0xf08b0d92
call fcn.1049f45f
wait
push ds
mov ebx, gs
in al, 0xe7
jae 0x1049e36c
xchg byte [ebp - 0x3d], dh
mul cl
and byte [ebx - 0x66], ah
movzx eax, byte [eax]
jmp 0x1049e39a
cmc
movzx ecx, byte [ecx]
sub eax, ecx
jmp 0x1049f505
push dword [esp]
pop word [esp]
lea esp, [esp + 2]
jmp 0x1049f4e6
lea esp, [esp + 4]
dec dword [ebp - 4]
jmp 0x1049f51b
leave
ret
mov edx, dword [ebp - 4]
jne 0x1049e37b
je 0x1049e391
Function at 0x10526e65
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [esp + 0xb], cx
popal
pop cx
mov word [esp + 5], dx
jmp 0x10526e6a
pushal
rdtsc
jmp 0x10526e4f
mov byte [esp + 4], cl
xchg cl, ch
mov dword [esp + 4], esi
push word [esp + 1]
jmp 0x10526ef4
xchg word [esp], bx
pop word [esp + 1]
cmp dh, cl
mov cx, 0xb2e3
btr ax, di
jmp 0x10526e91
lea ebp, reloc.WINMM.dll_timeGetTime
mov dword [esp + 3], edx
push ax
cmc
adc bl, 0xb4
mov ch, byte [esp + 9]
jmp 0x10526ea7
mov dword [esp], edi
mov word [esp + 1], bx
setge cl
mov ah, cl
mov esi, dword [esp]
pop edi
jmp 0x10526ec0

Function at 0x1052728b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
sub esp, 0xa
mov dword [esp + 0xa], ebp
mov ecx, edx
mov dl, 0x95
not ecx
jmp 0x105272a9
mov ah, 0x99
mov ch, ah
dec ah
std
lea esp, [esp + 6]
jmp 0x10527293
mov bp, 0xc03c
rdtsc
jmp 0x10527264
lea edx, [eax + 0x9d]
stc
mov bx, bp
lea edx, [ecx + edx]
bsf ecx, eax
jmp 0x105272d4
push dword [esp + 0x16]
xchg word [esp + 0xb], cx
pop bp
pop dword [esp + 2]
lea esp, [esp + 6]
jmp 0x10527275

Function at 0x10527631
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop di
jmp 0x10527639
mov ch, 0x96
bswap esi
mov bl, 0x16
mov al, dl
xchg word [esp + 0xc], cx
jmp 0x105277d6
Function at 0x105277fb
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10527812
lea ecx, [eax + esi]
std
pop ax
sub esp, 0xd
call 0x105277fb
scasb al, byte es:[edi]
add esp, 0x11
push edx
jmp 0x1052782c
mov ebx, 0x972dad0
bswap edx
adc bp, bp
xchg byte [esp + 3], dh
mov dx, word [esp + 1]
mov word [esp + 2], bp
jmp 0x105277ec
lea edx, reloc.WINMM.dll_timeGetTime
mov cl, 0xe
lea esi, [ecx + ebx]
setg al
not si
sub esp, 0
jmp 0x105278e4
lea esp, [esp + 8]
pop bp
mov cl, ah
lea ebx, reloc.WINMM.dll_timeGetTime
mov ah, byte [esp + 1]
rdtsc
jmp 0x105278c2
mov bl, 0x58
xchg byte [esp], ah
mov si, word [esp + 8]
mov word [esp + 5], di
mov ecx, dword [esp + 8]
dec dh
jmp 0x1052786c
clc
dec bx
push di
push word [esp]
xchg dl, bl
cmc
jmp 0x10527a0a
neg al
mov edi, esi
not eax
add esp, 1
add dx, bp
mov si, 0xaf20
jmp 0x105278ac
pop word [esp]
push word [esp + 3]
push dword [esp + 6]
xchg si, di
push word [esp + 9]
sets al
jmp 0x10527895
bts bp, cx
rdtsc
pop dword [esp]
lea esi, [ecx*4]
jmp 0x1052795e
mov byte [esp + 9], ah
lea esi, reloc.WINMM.dll_timeGetTime
mov ax, bx
setb cl
mov dword [esp + 3], ebx
xchg dword [esp + 5], ecx
jmp 0x105278fe
add esp, 1
cpuid
rdtsc
setae ch
pop di
mov dx, cx
jmp 0x10527914
push word [esp + 3]
xchg byte [esp + 5], bl
mov cl, byte [esp + 5]
setns bl
jmp 0x10527974
xchg ebp, esi
pop cx
mov ecx, 0xc6ed4fba
bts edi, edx
mov dl, byte [esp + 2]
bsr cx, bp
jmp 0x10527948
lea eax, [esi + ebp]
mov eax, esp
push eax
bswap ecx
xchg si, cx
push word [esp + 5]
call fcn.105279a4
push esp
insb byte es:[edi], dx
jae 0x105279ce
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
mov byte [esp + 4], bl
inc si
cmc
mov eax, edx
mov dword [esp + 2], ebx
mov byte [esp], bl
jmp 0x10527937
bswap ecx
mov dword [esp + 1], esi
mov ebx, dword [esp + 4]
and al, 4
xchg word [esp + 2], cx
xchg dword [esp + 6], ecx
xchg dl, ah
jmp 0x10527992
lea esi, reloc.WINMM.dll_timeGetTime
sub esp, 0xc
bts dx, ax
setae cl
neg si
pop dword [esp + 3]
jmp 0x105279c6

Function at 0x10527a23
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10527a6a
mov ax, 0x3b20
xchg dword [esp], eax
add esp, 1
add ebp, 0x1e9823e1
jmp 0x10527a54
mov ch, byte [esp + 3]
bsr edx, ebp
mov si, dx
rcl ecx, cl
pop edx
lea eax, [esi + edi]
jmp 0x10527a7c
clc
push word [esp + 7]
lea edi, [ebp + ebp]
dec ebx
mov ebx, dword [esp + 8]
popal
jmp 0x10527a25
lea eax, [eax*4]
rdtsc
neg bp
lea edi, [ecx - 0x6b]
bsr edx, esi
jmp 0x10527ad2
mov bl, ch
pop cx
bsf edx, ecx
bswap edx
xchg dl, cl
mov ah, 0x7b
jmp 0x10527aa2
lea edi, [edx + ebp]
setge bh
bts eax, esi
xchg byte [esp], cl
setl dh
bswap esi
jmp 0x10527ab8

Function at 0x10528fc2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 0xc]
mov dword [esp + 0xc], edi
mov dword [esp + 0x13], eax
pop word [esp + 0x1c]
lea esp, [esp + 3]
jmp 0x10528bca
Function at 0x10539453
Capabilities:
Access peb ldr_data
Execute anti-debugging instructions

Disassembly:
call fcn.10539006
mov eax, dword [eax]
jmp 0x105393a5
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x1053923b
mov eax, dword [eax + 8]
push eax
jmp 0x10539001
pop word [esp + 1]
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0x10539251