joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f3fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00541cce
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f4c6
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00541cce
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0053b9a9
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f56c
cmp edi, dword [esi + 0x7c]
jge 0x42f56c
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443e10
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443e10
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541cce
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00541cce
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f4be
jmp 0x42f48e
call fcn.00448037
int3
Function at 0x43c23e
Capabilities:
Encode data using xor

Disassembly:
js 0x43c1a5
mov edi, 0x4c079ff0
pop ds
bound esi, qword [ebx + 0x3a]
jmp 0x43c1dd
sbb edi, dword [edx - 0x40c944f5]
pop esi
lodsb al, byte [esi]
pop ss
invalid
invalid
dec edi
mov dl, 0x3a
ret 0x8817
test ebp, edi
call 0xdd1d6a71
xor eax, 0x6b290e28
push ebp
push ebp
in al, dx
sub edi, dword [esi - 0x782f82ac]
mov ah, byte [edi - 0x1bec645d]
xor esi, dword [ebp - 0x62]
push esi
loopne 0x43c196
pop ebx
sal byte [ebp + 0x78], 1
ja 0x43c19e
mov eax, 0x47b28918
scasb al, byte es:[edi]
add al, 0xb0
xchg dword [eax], ebx
push ss
pop edx
or dh, bl
ja 0x43c1c9
loop 0x43c1b6
out dx, al
xchg ebp, eax
sub eax, 0xad9b58a1
sub al, 0x6b
mov cl, 0x4d
aam 0x3f
mov word [edi - 0x20], gs
pop es
mov byte [0x7c6cfbbd], al
add byte [edi - 0x48], ch
sahf
dec esp
sub ah, byte [edi - 0x49]
nop
pop ds
or eax, 0xa5af082
salc
salc
salc
popfd
dec ebp
mov edx, 0xc8d2e078
call 0x11e1e87
xchg byte [esi*2 - 0x7cb991e0], cl
js 0x43c28e
sbb dh, byte [esi + 0x37f39914]
xlatb
je 0x43c1f2
and dword [ecx - 0x42], ecx
xor eax, 0xc14a0b0
rol dword [0x4f317cab], cl
sbb byte [ebx + 0x6a08ec50], dh
dec esi
cli
jp 0x43c261
test byte [esi - 0x7a], al
invalid
mov ecx, edi
out 0x8a, al
pop eax
int3
Function at 0x4458c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
subps xmm0, xmm1
mulps xmm0, xmm3
add edx, 4
add ebp, 4
cvtps2pi mm3, xmm0
movss xmm0, dword [ebp]
movss xmm1, dword [edx]
unpcklps xmm0, xmm1
movmskps ecx, xmm2
movaps xmm2, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
cvttps2pi mm0, xmm0
movlhps xmm2, xmm7
movlhps xmm6, xmm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
add esi, eax
add edi, 3
movq mm1, mm0
pcmpeqd mm0, mm6
cmpltps xmm2, xmm6
paddd mm0, mm1
cvtpi2ps xmm1, mm0
cmp ecx, 0
jne 0x44593e
movq mm2, qword [esp]
movq mm4, mm3
psubd mm2, mm3
movq mm3, mm2
punpckldq mm2, mm4
punpckhdq mm3, mm4
packssdw mm2, mm2
packssdw mm3, mm3
mov ecx, dword [esp + 0x20]
movzx eax, byte [esi + 3]
shl eax, 0x10
movzx ebx, byte [esi]
or eax, ebx
movd mm5, eax
movzx eax, byte [ecx + esi + 3]
shl eax, 0x10
movzx ebx, byte [ecx + esi]
or eax, ebx
movd mm1, eax
punpckldq mm5, mm1
movzx eax, byte [esi + 4]
shl eax, 0x10
movzx ebx, byte [esi + 1]
or eax, ebx
movd mm4, eax
movzx eax, byte [ecx + esi + 4]
shl eax, 0x10
adc byte [edi], cl
mov dh, 0x5c
xor dword [ecx], eax
or eax, ebx
movd mm1, eax
punpckldq mm4, mm1
sar eax, 0x14
mov byte [edi - 3], al
pmaddwd mm4, mm2
psrad mm4, 8
packssdw mm4, mm4
pmaddwd mm4, mm3
movd eax, mm4
add eax, 0x21
sar eax, 0x14
mov byte [edi - 2], al
pmaddwd mm7, mm2
psrad mm7, 8
packssdw mm7, mm7
pmaddwd mm7, mm3
movd eax, mm7
add eax, 0x21
sar eax, 0x14
mov byte [edi - 1], al
sub dword [esp + 0x30], 1
jne 0x44580b
movmskps ecx, xmm2
cmp ecx, 0
jne 0x445a4a
subps xmm0, xmm1
mulps xmm0, xmm3
cvtps2pi mm3, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
add esi, eax
movq mm2, qword [esp]
movq mm4, mm3
psubd mm2, mm3
movq mm3, mm2
punpckldq mm2, mm4
punpckhdq mm3, mm4
packssdw mm2, mm2
packssdw mm3, mm3
mov ecx, dword [esp + 0x20]
movzx eax, byte [esi + 3]
shl eax, 0x10
movzx ebx, byte [esi]
or eax, ebx
movd mm5, eax
movzx eax, byte [ecx + esi + 3]
shl eax, 0x10
movzx ebx, byte [ecx + esi]
or eax, ebx
movd mm1, eax
punpckldq mm5, mm1
movzx eax, byte [esi + 4]
shl eax, 0x10
movzx ebx, byte [esi + 1]
or eax, ebx
movd mm4, eax
movzx eax, byte [ecx + esi + 4]
shl eax, 0x10
movzx ebx, byte [ecx + esi + 1]
or eax, ebx
movd mm1, eax
punpckldq mm4, mm1
movzx eax, byte [esi + 5]
shl eax, 0x10
movzx ebx, byte [esi + 2]
or eax, ebx
movd mm7, eax
movzx eax, byte [ecx + esi + 5]
shl eax, 0x10
movzx ebx, byte [ecx + esi + 2]
or eax, ebx
movd mm1, eax
punpckldq mm7, mm1
pmaddwd mm5, mm2
psrad mm5, 8
packssdw mm5, mm5
pmaddwd mm5, mm3
movd eax, mm5
add eax, 0x21
sar eax, 0x14
mov byte [edi], al
pmaddwd mm4, mm2
psrad mm4, 8
packssdw mm4, mm4
pmaddwd mm4, mm3
movd eax, mm4
add eax, 0x21
sar eax, 0x14
mov byte [edi + 1], al
pmaddwd mm7, mm2
psrad mm7, 8
packssdw mm7, mm7
pmaddwd mm7, mm3
movd eax, mm7
add eax, 0x21
sar eax, 0x14
mov byte [edi + 2], al
emms
add esp, 8
pop ebp
pop ebx
pop edi
pop esi
ret
Function at 0x445e3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445e67
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]

Function at 0x445e7b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0055870e
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445f06
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
fmul qword [esi + 0x88]
call fcn.0055870e
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005523e9
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445fac
cmp edi, dword [esi + 0x7c]
jge 0x445fac
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a850
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a850
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
call fcn.0055870e
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0055870e
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445efe
jmp 0x445ece
call fcn.0045ea77
int3
Function at 0x455d82
Capabilities:
Encode data using xor

Disassembly:
xor dword [edx + 0x28], ebx
mov ch, 0x92
adc dword [ebx - 0x36], eax
push 0x22
aas
cmp al, 0xe8
and esi, edx
xor byte [edi], cl
leave
out dx, al
dec edi
aam 0x3e
dec esi
inc eax
mov ah, 0x53
adc eax, 0x81cf1b95
inc esp
test al, 2
out dx, eax
pop fs
push ds
xchg edx, eax
aam 0xc1
add dh, byte [ecx + 0x52f45afb]
mov eax, dword [0x5b3cdb73]
and eax, 0x7094ae7
jo 0x455d08
adc byte [ebx - 0x3a9b0ace], 0xcf
pop ebp
jmp dword [eax + 0x56853589]
jbe 0x455d2d
xor esi, dword [0xeed956e9]
push 0x32
aam 0xa1
jl 0x455e09
aas
mov al, dh
mov eax, 0x2fbfa930
xchg eax, esi
or dword [edx + 0x10], edx
pop ss
salc
mov edx, 0x71f32001
out 2, eax
fnsave dword [edi]
sbb ecx, esp
xchg ecx, eax
out 0xf4, eax
push ebx
lodsb al, byte [esi]
cmp al, byte [edx + 0x5c6659d8]
pop edx
xor al, 0x3e
lcall 0x335f, 0xd833f062
bswap edx
push 0x12296fc3
mov ebx, 0x14d50452
push edx
mov ah, 0xab
imul eax, dword [edx - 0x20], 0xfffffff6
inc edx
jle 0x455daf
scasd eax, dword es:[edi]
xchg edx, eax
adc eax, dword [ebx - 0x11]
or dword [edi - 0x4cdf6d83], ecx
pop ecx
mov edx, 0x8546e3fc
xor al, byte [ebp - 0x200cee3a]
invalid
stosb byte es:[edi], al
pop eax
cmp dword [esi + 1], ecx
xor byte [esi], dh
in al, dx
rol byte [ebx - 0x761712c4], 0xf8
outsd dx, dword [esi]
retf 0x73a9

Function at 0x45a7c5
Capabilities:
Encode data using xor

Disassembly:
xchg ebp, eax
add dl, byte [edx - 0x4b]
loope 0x45a785
pop ss
neg edi
push esi
or al, 0x43
test dword [esp + eax*4 - 0x7d712f83], ebx
invalid
inc esi
retf 0x6e03
arpl word [edx + 0x22], si
iretd
cli
sbb dword [eax], 0x4c5e53fe
mov al, 0x58
daa
add al, byte [eax - 0x476cdec5]
arpl sp, bx
je 0x45a7cd
mov eax, 0x2274dc63
hlt
sahf
int 0x50
out dx, eax
mov ah, ah
pushal
mov dh, 0x9d
sti
mov edx, 0x5fbf7954
scasb al, byte es:[edi]
dec ebx
stc
xor al, 0x1e
and eax, 0x31709e76
sahf
jo 0x45a7f9
sahf
jo 0x45a7f9
xor dword [eax + 0x4a355736], ebp
test al, 0x36
push edi
xor eax, 0x9189714a
jno 0x45a758
xchg ecx, eax
xchg edi, eax
inc edx
mov esi, 0xe990aa63
jecxz 0x45a7c7
outsd dx, dword [esi]
or byte [edi], bh
jle 0x45a7a6
outsb dx, byte [esi]
pop es
jns 0x45a7af
jnp 0x45a777
fsubp st(2)
push esi
jbe 0x45a811
jnp 0x45a86b
push eax
jne 0x45a7b5
jle 0x45a856
frstor dword [edx + 0x6f]
mov esp, 0xbd3c7929
mov eax, dword [0x2d8af550]
invalid
loop 0x45a797
dec edx
sub byte [eax - 0x29bc00b8], bl
push 0x64b07dbb
int1
dec ebp
mov dword [esi + ebp*2 - 0x6a], 0xd5dc68c0
ror byte [ebx], 1
test dword [ebx], edx
aas
xlatb
jmp 0x45a843
ret

Function at 0x45c89e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38

Function at 0x45c8a7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
Function at 0x45c8bb
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]

Function at 0x45c8e9
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
pop esp
and al, 0x14
mov dword [esp + 0x1c], ebx
call fcn.0056f16e
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c966
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0056f16e
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00568e49
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45ca0c
cmp edi, dword [esi + 0x7c]
jge 0x45ca0c
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004712b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
and al, 0x24
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004712b0
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056f16e
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0056f16e
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c95e
jmp 0x45c92e
call fcn.004754d7
int3
Function at 0x47369e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585f6e
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x473766
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.00585f6e
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057fc49
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x47380c
cmp edi, dword [esi + 0x7c]
jge 0x47380c
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004880b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004880b0
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f6e
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.00585f6e
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x47375e
jmp 0x47372e
call fcn.0048c2d7
int3
Function at 0x489ba6
Capabilities:
Encode data using xor

Disassembly:
push ds
mov dword [ebx - 0x3f07a7d8], eax
invalid
dec esp
retf
pushal
je 0x489b8b
in al, dx
outsb dx, byte [esi]
ljmp 0xc3ce
test al, 0x7b
or esi, 0xffffffc3
inc esi
inc ax
jo 0x489b1c
loop 0x489b13
fdiv dword [edi + 0x6c]
ja 0x489ba9
xchg edi, eax
jp 0x489b28
out dx, al
mov al, 0x7a
aam 0x84
lahf
ja 0x489bb9
into
loopne 0x489b30
test al, 0
add al, 0x31
int3
xor al, 0x7a
jl 0x489bd7
mov ch, 0x56
xchg di, ax
pushfd
salc
sub dword [eax], esi
mov byte [0x35d56f53], al
xor byte [edx + 0x35d56f53], ah
push ebx
pop ebx
test eax, 0x25dc8e85
loope 0x489b97
scasd eax, dword es:[edi]
sti
js 0x489b39
invalid
mov cl, byte [ebx + 2]
jle 0x489bd3
lcall 0xf2f9, 0x5dbb740d
iretd
sbb dh, byte [eax]
sbb ah, cl
clc
push ss
pop esp
daa
test dword [esi - 0x49bd7dce], edx
ljmp 0x455d
and ch, dh
mov bl, 0xb9
in eax, 0xd8
cmc
pop eax
sbb byte [ecx + ebx*8 + 0x7ac77d53], dh
push esp
enter 0xffffffffffff8d6c, 0xffffffffffffffc7
sbb ebx, ebx
cdq
invalid
Function at 0x48a93e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call int.0059d20e
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48aa06
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call int.0059d20e
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.00596ee9
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48aaac
cmp edi, dword [esi + 0x7c]
jge 0x48aaac
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049f350
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049f350
fld qword [esi + 0x88]
fmul qword [0x560e70]
call int.0059d20e
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call int.0059d20e
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a9fe
jmp 0x48a9ce
call fcn.004a3577
int3
Function at 0x4a12f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
subps xmm0, xmm1
mulps xmm0, xmm3
add edx, 4
add ebp, 4
cvtps2pi mm3, xmm0
movss xmm0, dword [ebp]
movss xmm1, dword [edx]
unpcklps xmm0, xmm1
movmskps ecx, xmm2
movaps xmm2, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
cvttps2pi mm0, xmm0
movlhps xmm2, xmm7
movlhps xmm6, xmm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
and al, 0x1c
add esi, eax
add edi, 3
movq mm1, mm0
pcmpeqd mm0, mm6
cmpltps xmm2, xmm6
paddd mm0, mm1
cvtpi2ps xmm1, mm0
cmp ecx, 0
jne 0x4a136e
movq mm2, qword [esp]
movq mm4, mm3
fmul qword [edi]
cli
ror dword [edi], cl
jg 0x4a1279
fmul qword [edi]
cli
ror dword [edi], cl
jg 0x4a1279
punpckldq mm2, mm4
punpckhdq mm3, mm4
packssdw mm2, mm2
ror byte [edi], cl
imul ebx, ebx, 0xffffff8b
dec esp
and al, 0x20
movzx eax, byte [esi + 3]
shl eax, 0x10
movzx ebx, byte [esi]
or eax, ebx
movd mm5, eax
movzx eax, byte [ecx + esi + 3]
shl eax, 0x10
movzx ebx, byte [ecx + esi]
or eax, ebx
movd mm1, eax
punpckldq mm5, mm1
movzx eax, byte [esi + 4]
shl eax, 0x10
movzx ebx, byte [esi + 1]
or eax, ebx
movd mm4, eax
movzx eax, byte [ecx + esi + 4]
shl eax, 0x10
movzx ebx, byte [ecx + esi + 1]
pop esp
xor dword [ecx], eax
or eax, ebx
movd mm1, eax
punpckldq mm4, mm1
movzx eax, byte [esi + 5]
shl eax, 0x10
movzx ebx, byte [esi + 2]
or eax, ebx
movd mm7, eax
movzx eax, byte [ecx + esi + 5]
shl eax, 0x10
movzx ebx, byte [ecx + esi + 2]
or eax, ebx
movd mm1, eax
punpckldq mm7, mm1
pmaddwd mm5, mm2
psrad mm5, 8
packssdw mm5, mm5
pmaddwd mm5, mm3
movd eax, mm5
add eax, 0x21
sar eax, 0x14
mov byte [edi - 3], al
pmaddwd mm4, mm2
psrad mm4, 8
packssdw mm4, mm4
pmaddwd mm4, mm3
movd eax, mm4
add eax, 0x21
sar eax, 0x14
mov byte [edi - 2], al
pmaddwd mm7, mm2
psrad mm7, 8
packssdw mm7, mm7
pmaddwd mm7, mm3
movd eax, mm7
add eax, 0x21
sar eax, 0x14
mov byte [edi - 1], al
sub dword [esp + 0x30], 1
jne 0x4a123b
movmskps ecx, xmm2
cmp ecx, 0
jne 0x4a147a
subps xmm0, xmm1
mulps xmm0, xmm3
cvtps2pi mm3, xmm0
movd esi, mm0
psrlq mm0, 0x20
movd eax, mm0
lea esi, [esi + esi*2]
imul eax, dword [esp + 0x20]
add esi, dword [esp + 0x1c]
add esi, eax
movq mm2, qword [esp]
outsd dx, dword [esi]
adc al, 0x24
Function at 0x4a181e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [fcn.00536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.005b40ee
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4a18e6
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.005b40ee
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005addc9
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4a198c
cmp edi, dword [esi + 0x7c]
jge 0x4a198c
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004b6230
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004b6230
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b40ee
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.005b40ee
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4a18de
jmp 0x4a18ae
call fcn.004ba457
int3