joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459730
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x486a78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x1c]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
push 0
lea ecx, [esp + 0x20]
call fcn.0047f9cf
mov eax, dword [esi + 0xd0]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.004590d0
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x48]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call fcn.0047f8fd
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call fcn.0047c1c6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call fcn.0047c1c6
push 1
push 0
push 0
mov ecx, esi
call fcn.0047c16e
push 1
push 0
push 1
mov ecx, esi
call fcn.0047c16e
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047fa41
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret

Function at 0x4598b0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x486a98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
push 0
lea ecx, [esp + 0x20]
call fcn.0047f9cf
push 0x3e8
lea eax, [esp + 0x20]
push 0x3e8
push eax
mov dword [esp + 0x44], 0
call fcn.004590d0
mov ecx, dword [esi + 0x48]
mov eax, dword [esi + 0x4c]
add ecx, 0x64
add esp, 0xc
mov dword [esp + 4], ecx
lea ecx, [esp + 4]
add eax, 0x96
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], eax
call fcn.0047f8fd
mov eax, dword [esi + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 8]
mov edx, dword [esp + 0xc]
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, edx
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
cdq
idiv dword [esp + 4]
cmp dword [esp + 0x44], 1
jne 0x459974
cmp dword [esp + 0x40], 1
jne 0x459972
cmp ecx, eax
jge 0x459974
mov eax, ecx
cmp eax, 0xc8
jge 0x459980
mov eax, 0xc8
mov ecx, esi
mov dword [esi + 0xd0], eax
call fcn.00459730
mov ecx, dword [esi + 0x1c]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047fa41
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret 8
Function at 0x45a100
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x486b03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0047a5e1
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.0047fc77
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.0048128d
test eax, eax
je 0x45a21c
mov ecx, dword [esp + 0x3c]
call fcn.0047fca4
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x45a1e0
push edi
mov ecx, esi
call fcn.0047d310
mov ecx, esi
call fcn.0045a380
cmp dword [esp + 0x38], 1
jne 0x45a215
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.0047d44b
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x45cc40
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x45cc73
push esi
call fcn.0045fd40
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x45cc6c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x45ccf9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x45cce2
mov eax, dword [esi + 8]
test eax, eax
je 0x45cc97
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x45ccde
cmp eax, 2
je 0x45cce2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x45cc8a
cmp eax, 3
je 0x45ccbd
cmp eax, 1
jne 0x45cc8a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x45cc8a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x45cc8a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0045cd20
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x45cd08
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0045cd20
add esp, 4
pop esi
ret

Function at 0x47b3d7
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47b40f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0047948b
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00479463
jmp 0x47b41b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47caca
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47cb0c
call fcn.00482679
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47cb0c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47cb03
xor eax, eax
jmp 0x47cb14
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047cb1a
pop edi
pop esi
pop ebx
ret 4

Function at 0x482ba9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x482bd7
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x482bf5
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00482b0f
jmp 0x482bf5
mov eax, dword [esi + 0x14]
test eax, eax
je 0x482bf5
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00482b0f
test edi, edi
mov eax, edi
jne 0x482bdf
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x7e35b4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [esp + 8]
pushfd
mov byte [esp], 0xff
pushal
lea esp, [esp + 0x30]
jne 0x83f043
call fcn.00833bbd
add byte [eax], al
inc ebx
jb 0x7e3637
popal
je 0x7e363a
dec ecx
arpl word [edi + 0x6e], bp
inc esi
jb 0x7e364b
insd dword es:[edi], dx
push edx
jae 0x7e3650
jne 0x7e3655
arpl word [ebp + 0x45], sp
js 0x7e35e8
add byte [eax], al
dec ecx
outsb dx, byte [esi]
imul esi, dword [ecx + ebp*2 + 0x61], 0x657a696c
inc ebx
jb 0x7e3660
je 0x7e3662
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [eax], al
add byte [ebx + 0x65], dl
je 0x7e365c
dec edi
push eax
xor al, byte [eax]
sal bl, cl
inc bh
mov ebx, eax
push 0x3e015307
cmp byte [edi], 0x23
mov word [esp], sp
mov byte [esp], 0x13
call fcn.007e8400
add byte [eax], al
inc edi
je 0x7e3682
je 0x7e36a0
arpl word [ebx + 0x4f], bp
bound ebp, qword [edx + 0x65]
arpl word [eax + eax - 0x18], si
shl dword [edx], 5
add byte [eax], al
add byte [edi + 0x6c], al
call 0x835900
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc esi
insb byte es:[edi], dx
popal
jae 0x7e364d
jae 0x7e364d
add byte [eax], al
dec eax
popal
jo 0x7e3698
jae 0x7e36cb
jae 0x7e36cb
jb 0x7e36c8
jns fcn.007e365b
and al, 4
test byte [esi - 0xaffffa6], dl
pop edx
add byte [eax], al
add byte [eax], al
add byte [eax], al
inc edi
je 0x7e36d7
jae 0x7e3700
popal
inc ecx
add byte [ebx - 0x779ffe05], al
inc esp
and al, 4
loopne 0x7e3662
add eax, 0x8352f500
sti
add ch, cl
dec dword [edx + 0x38]
add byte [eax + 0x14], ch
jmp 0x7e3696
pop eax
mov byte [edi], 0x47
inc edi
popfd
ret 0x9e79
xchg esi, eax
pop ss
xchg byte [eax - 0x80], ch
loopne 0x7e36d5
invalid
add dh, byte [edx]
adc dl, al
sal ch, 1
sub eax, dword [edx]
push ds
invalid
Function at 0x7e4f58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], cl
lea esp, [esp + 0xc]
je 0x7ea85e
pushfd
jmp 0x7ea1bd
call 0xb6885b
add byte [eax], al
inc edi
je 0x7ea21b
jns 0x7ea23d
inc ebx
outsd dx, dword [esi]
insb byte es:[edi], dx
outsd dx, dword [esi]
jb 0x7ea1d0
add byte [eax], al
inc edi
je 0x7ea223
outsb dx, byte gs:[esi]
jne 0x7ea1da
add byte [eax], al
inc ebx
jb 0x7ea244
popal
je 0x7ea247
push eax
outsd dx, dword [esi]
insb byte es:[edi], dx
jns 0x7ea24e
outsd dx, dword [esi]
outsb dx, byte [esi]
push edx
outsb dx, byte [si]
add cl, ch
inc edi
or byte [eax], al
add byte [eax], al
add byte [edx + 0x65], dl
insb byte es:[edi], dx
popal
jae 0x7ea260
push ebx
insd dword es:[edi], dx
popal
jo 0x7ea269
outsd dx, dword [esi]
jb 0x7ea269
add byte [eax + 0x18], ch
xchg edi, eax
rol dword [edi + 0x37ec42e8], 1
add byte [esi], dh
add byte [eax], al
push ebx
je 0x7ea268
arpl word gs:[ebp + eax*2 + 0x6d], si
jo 0x7ea291
jns 0x7ea21f
add byte [eax], al
push ebx
je 0x7ea26b
je 0x7ea26b
imul ebp, dword [ebp + 0x50], 0x746e696f
jb 0x7ea230
add byte [eax], al
add byte [ebp + 0x73], al
je 0x7ea2b7
outsd dx, dword [esi]
dec ebp
outsb dx, byte [esi]
outsd dx, dword fs:[esi]
ja 0x7ea2a8
outsd dx, dword [esi]
js 0x7ea2df
mov ebx, ebp
call fcn.007e904e
push 0x586c1118
push ecx
lea esp, [esp + 8]
je 0x7e90fb
adc bh, bl
lea ebx, [edx - 0x4a3ee65b]
neg bl
jmp 0x8376cb

Function at 0x7e85b1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x50]
ja 0x837a08
jmp 0x836389

Function at 0x7ea169
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov byte [esp], 0x68
jmp 0x837019

Function at 0x7ea317
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub ecx, ebx
bswap si
bt eax, ebp
test dh, cl
lea esi, [esp + 8]
pushal
Function at 0x7ea363
Capabilities:
Encrypt data using rc4 prga

Disassembly:
clc
sub al, al
cmc
repne scasb al, byte es:[edi]
jmp 0x7e4da6
push 0xf45f1435
cmp byte [esi - 1], 0
call fcn.00837b4e
add byte [eax], al
inc esp
jae 0x7ea2b8
jb 0x7ea2b5
jns 0x7ea295
outsb dx, byte gs:[esi]
jne 0x7ea24c
add byte [eax], al
push ebx
je 0x7ea2c3
je 0x7ea2b7
push 0x746c42
add byte [eax], al
push ebx
je 0x7ea2b6
imul ebp, dword [esi + 0x64], 0x6f43776f
outsb dx, byte [esi]
je 0x7ea2ce
js 0x7ea2df
dec eax
insb byte es:[edi], dx
jo 0x7ea2b9
add bh, al
inc esp
and al, 0x24
pop ebx
pop ecx
add dword [eax], 0x60
pushfd
pushfd
mov dword [esp + 0x48], eax
mov byte [esp], 0x7c
push dword [esp + 0x14]
mov byte [esp], 0x6a
push dword [esp + 0x4c]
ret 0x50
add byte [edi + ebp*2 + 0x63], cl
imul eax, dword [esi + 0x69], 0x6c
add byte gs:[eax], al
add byte [ebp + 0x70], dl
popal
je 0x7ea30c
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [edi + 0x65], al
je 0x7ea2f8
insb byte es:[edi], dx
inc ebx
inc ebx
je 0x7ea32b
jb 0x7ea326
insb byte es:[edi], dx
dec ecx
inc esp
add byte [eax + 0xc], ch
sbb edx, ecx
xchg eax, ebp
inc edx
add edi, dword [eax]
add byte [ebx], ch
add byte [edx + esi*2 + 0x61], al
ja 0x7ea314
inc ebp
add byte gs:[bx + si], al
add byte [edi + 0x65], al
je 0x7ea326
jae 0x7ea34f
popal
push esp
push esp
imul ebp, dword [ebp + 0x65], 0x182c6800
rol dword [edi + 0x37eb63e8], 1
add byte [ecx + 0x66], bl
shld edi, edi, 3
sub di, 0x91b9
xchg ecx, eax
lea edi, [eax - 0x30823c0f]
mov edi, eax
mov cx, dx
btc ecx, esi
bts cx, si
mov ecx, 0x104
add al, 1
add byte [eax], al
cmc
stc
jmp 0x7e9835
cmc
invalid
cmp ax, bp
cmp al, bh
sub edi, 4
mov byte [esp + 4], 0x4e
clc
push dword [edi]
pop dword [esp + 0x24]
pushfd
mov byte [esp], bl
clc
cmp edi, ebx
call fcn.007e5763
add byte [eax], al
dec ebp
outsd dx, dword [esi]
imul esp, dword fs:[esi + 0x79], 0x756e654d
inc ecx
outsb dx, byte gs:[esi]
jne 0x7ea394
add byte [eax], al
add byte [edx + 0x65], dl
jb 0x7ea3bc
ja 0x7ea3b4
imul ebp, dword [esi + 0x64], 0x8d00776f
and al, 8
je 0x83fdd7
push esp
pushal
cmp ebx, 3
pushfd
pushfd
pushfd
mov byte [esp], bl
lea esp, [esp + 0x30]
je 0xb686b3
pushal
pushal
mov word [esp], sp
lea esp, [esp + 0x40]
jmp 0x7e53a6
not edi
add byte [eax], al
inc ebp
outsb dx, byte [esi]
inc esp
imul esp, dword [ecx + 0x6c], 0x9c00676f
insb byte es:[edi], dx
outsd dx, dword [esi]
add byte [si - 0x143f], bl
or al, 0xe8
inc byte [esi]
add byte [eax], al
push 0x620aaa54
lea esp, [esp + 8]
jne 0x7e9a95
pushfd
cmp dl, 0xd6
push dword [esp]
lea esp, [esp + 8]
jnp 0x7ea230
cmp byte [esi - 1], 0
lea esp, [esp + 8]
je 0x837bf5
sbb bl, 0x1f
mov ebx, dword [esi]
cmp ecx, ebp
add ebx, eax
clc
push esi
sar esi, cl
push edi
bsr si, dx
xchg di, si
btc si, ax
shld esi, edi, 0x1e
mov esi, dword [ebp + 4]
dec edi
movsx edi, dl
btc di, bx
inc di
mov edi, ebx
push 0x5a8fab22
cmpsb byte [esi], byte es:[edi]
jmp 0x840439
Function at 0x7ea468
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp bx, 0x59f6
test edx, edx
js 0x8349d9
push esp
pushfd
push dword [esp + 4]
lea esp, [esp + 0xc]
je 0x837bf5
not ch
seta ch
add cx, sp
add edx, eax
sal cx, 0xf
rcl ch, 6
test bl, dh
mov ecx, dword [esi + 0x7c]
call fcn.007e491f
xor dword [eax], esi
cmp eax, 0x8fa2dc0c
pushal
mov dl, 0x9e
mov ch, 0x24
sbb ecx, dword [edx + 0x40ce6e9f]
ror byte [edx], 1
and dword [eax - 0x7c079880], ecx
xchg ebp, eax
rcr dword [ecx + 0x15d98dc7], 0xf
add eax, 0x703a4fc
xchg esp, eax
invalid
adc ah, al
stc
push ebp
cmp dh, cl
bsr bp, dx
shl bp, cl
push esi
cmp esp, 0x687f700f
push edi
mov al, 0x4d
aaa
aas
movzx bp, al
push ebx
cwde
rcr bp, 5
push edx
cmc
adc ah, 0xe5
mov bp, 0x599d
bt bx, bx
push edx
movsx bp, bl
stc
inc ah
neg al
lea ebp, [esp + 0x1c]
cmc
mov eax, dword [ebp]
cmc
stc
test eax, eax
jmp 0x7ea77d
je 0x837bf5
sal si, 0xe
bsr esi, eax
mov esi, 0xd019a88c
shl dh, 5
mov esi, dword [eax + 0x3c]
sar dx, cl
lea edx, [edx + 0x51f39d69]
cmc
rol dh, cl
add esi, eax
sal dl, 6
bswap dx
mov edx, dword [esi + 0x78]
jmp 0x7e34b4
pushal

Function at 0x7ea811
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea esp, [esp + 0x28]
jne 0x837bf5
bts ecx, 0xf
inc esi
mov ecx, edi
movzx si, bl
shrd esi, edx, 0xb
sub ecx, ebx
rcr si, 0xf
not si
pushfd
movsx si, cl
lea esi, [esp + 4]
cmc
sub edi, 4
bt ax, bp
clc
mov byte [esp], ah
push dword [edi]
pop dword [esp]
stc
pushal
stc
cmp esp, ebp
cmp edi, ebx
pushal
lea esp, [esp + 0x40]
jmp 0x8345e9
Function at 0x833d17
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
adc si, 0xc2f4
add edi, ebx
jmp 0x7e862b
pushfd
cmp ah, 0xfe
add esi, ebx
mov byte [esp], 0xf3
lea esp, [esp + 4]
jmp 0x7e95ef
bsf si, cx
mov esi, dword [edx]
bt sp, sp
cmp edi, esp
cmp dl, 4
push 0x84b281cd
test esi, esi
push ebx
lea esp, [esp + 0x28]
je 0x7e5222
jmp 0x7e811b
inc ecx
mov byte [esp + 4], ch
xchg ebp, eax
cmc
xchg bl, ah
sbb ah, 0xe3
bt bx, di
mov eax, ebp
push ecx
test ch, bh
xor bl, ch
sal bl, cl
mov bl, 1
test esp, eax
clc
cmc
bt esp, ecx
xchg dword [esp + 8], esi
cmc
mov word [esp], cx
inc esi
btr esi, 1
mov esi, edi
test ah, 0x47
call fcn.007e5456
add byte [eax], al
inc esp
jb 0x833bf4
ja 0x833bd9
imul esp, dword [edx + 0x44], 0x776172
add byte [eax], al
inc edi
insb byte es:[edi], dx
outsd dx, dword [esi]
bound esp, qword [ecx + 0x6c]
inc esp
insb byte es:[edi], dx
je 0x833c0f
inc ecx
je 0x833c1c
insd dword es:[edi], dx
add byte [eax], al
add byte [ebp + 0x6c], al
je 0x833c1c
inc esi
imul ebp, dword [ebp + 0x41], 0x7be99c00
pushfd
jmp 0x7ea73e
cmp byte [edi + edi*8 - 0x3dc3db8c], bl
inc eax
add byte [esi - 0x39], ah
mov word [esp], 0xac80
add edx, ebx
test al, 0x30
cmc
cmc
test bh, 0xa1
mov edx, dword [edx + 0x80]
stc
add byte [eax], al
add cl, bh
cmc
mov byte [esp], ch
call fcn.007e48d9
add byte [eax], al
inc edi
je 0x833c79
imul ebp, dword [esi + 0x64], 0x4344776f
add byte [eax], al
add byte [ebx + 0x6f], al
push esp
popal
jae 0x833c9d
dec ebp
insd dword es:[edi], dx
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
add byte [ebx + 0x65], dl
je 0x833cd3
outsb dx, byte [esi]
push 0x6c646e61
inc ebp
js 0x833cec
jo 0x833d00
imul ebp, dword [edi + 0x6e], 0x746c6946
jb 0x833c96
add byte [eax], al
dec esp
popal
jbe 0x833d02
inc ebx
jb 0x833d09
je 0x833d0b
arpl word [ecx + 0x6c], sp
push ebx
arpl word gs:[ecx + ebp*2 + 0x6f], si
outsb dx, byte [esi]
add byte [ecx], bl
out dx, eax
mov edi, dword [edx + 0x10]
jmp 0xb67ef0
add byte [edi + 0x65], al
je 0x833d25
outsd dx, dword [esi]
jne 0x833d48
dec eax
popal
outsb dx, byte [esi]
insb byte es:[edi], dx
inc ecx
add byte [edi*4 + 0x47d4099f], bl
mov dl, 0x39
pop es
cmp edx, esi
pop es
je 0x833d00
sahf
mov dh, 0xe8
dec edi
xchg edi, eax
dec ebp
sbb dword [ecx + 0xf8469ad], ecx
sub ebp, dword [eax]
xor al, dh
pop ecx
invalid
cmp eax, 0x1a3a7ba9
cmpsb byte [esi], byte es:[edi]
or eax, 0xe9fc717a
call 0x80f91b1f
mov bl, 0xee
xlatb
movsd dword es:[edi], dword [esi]
mov ecx, edi
stc
jp 0x833d7c
cld
jmp 0x76614af9
cmp eax, edx
pushal
push esp
jmp 0x8346fe
sti
sal byte [eax - 4], 1
jo 0x833d23
daa
push eax
bound ebp, qword [eax - 0x7930e70f]
mov ch, 0x10
nop
invalid
int 0x4a
sbb dword [ecx - 0x536a8672], 0x5612b322
lds ebx, [eax + 0x2f1184fa]
pop ecx
or al, 0x1e
pushfd
in al, 0x68
dec eax
invalid
and al, 0x20
lea esp, [esp + 0x30]
jb 0x837c06
pushfd
test sp, bx
push 0xf07c184b
cmp eax, dword [esp + 8]
clc
test edi, edi
pushfd
mov word [esp], ax
pushfd
pushfd
lea esp, [esp + 0xc]
je 0x7e90fb
pushal
shrd si, bx, 2
jmp 0x7e30db
Function at 0x835c1d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
add word [edi + ebx], ax
push dword [esp]
lea esp, [esp + 0x38]
jmp 0x7e53a6
Function at 0x8373ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add dword [edi + ebx], edx
sub esp, 0xfffffffc
and ebx, 0xfff
mov word [esp], cx
clc
test ch, 0xcb
jmp 0x7e53a0

Function at 0x83fc8d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
mov byte [esp + 4], 0x48
call fcn.007e85b1
add byte [eax], al
push ebx
je 0x7ea1ee
outsb dx, byte [esi]
jbe 0x7ea215
jb 0x7ea21d
outsb dx, byte [esi]
insd dword es:[edi], dx
outsb dx, byte gs:[esi]
je 0x7ea20a
popal
jb 0x7ea220
popal
bound ebp, qword [ebp + 0x41]
add al, ch
cdq
out 0x37, al
add byte [eax], al
add byte [edi + 0x65], al
je 0x7ea21b
call fcn.00b68e51
add byte ss:[eax], al
push edx
add byte [ebx + 0x65], dl
sub edi, 4
pushal
push dword [edi]
pop dword [esp + 0x24]
bt ebx, 0x1c
pushal
push 0xa0cc052e
test al, dl
cmp edi, ebx
jmp 0x7ea196
Function at 0xb683f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
sub al, al
cmc
repne scasb al, byte es:[edi]
jmp 0x7e4da6
push 0xf45f1435
cmp byte [esi - 1], 0
call fcn.00837b4e
add byte [eax], al
inc esp
jae 0x7ea2b8
jb 0x7ea2b5
jns 0x7ea295
outsb dx, byte gs:[esi]
jne 0x7ea24c
add byte [eax], al
push ebx
je 0x7ea2c3
je 0x7ea2b7
push 0x746c42
add byte [eax], al
push ebx
je 0x7ea2b6
imul ebp, dword [esi + 0x64], 0x6f43776f
outsb dx, byte [esi]
je 0x7ea2ce
js 0x7ea2df
dec eax
insb byte es:[edi], dx
jo 0x7ea2b9
add bh, al
inc esp
and al, 0x24
pop ebx
pop ecx
add dword [eax], 0x60
pushfd
pushfd
mov dword [esp + 0x48], eax
mov byte [esp], 0x7c
push dword [esp + 0x14]
mov byte [esp], 0x6a
push dword [esp + 0x4c]
ret 0x50
add byte [edi + ebp*2 + 0x63], cl
imul eax, dword [esi + 0x69], 0x6c
add byte gs:[eax], al
add byte [ebp + 0x70], dl
popal
je 0x7ea30c
push edi
imul ebp, dword [esi + 0x64], 0x776f
add byte [edi + 0x65], al
je 0x7ea2f8
insb byte es:[edi], dx
inc ebx
inc ebx
je 0x7ea32b
jb 0x7ea326
insb byte es:[edi], dx
dec ecx
inc esp
add byte [eax + 0xc], ch
sbb edx, ecx
xchg eax, ebp
inc edx
add edi, dword [eax]
add byte [ebx], ch
add byte [edx + esi*2 + 0x61], al
ja 0x7ea314
inc ebp
add byte gs:[bx + si], al
add byte [edi + 0x65], al
je 0x7ea326
jae 0x7ea34f
popal
push esp
push esp
imul ebp, dword [ebp + 0x65], 0x182c6800
rol dword [edi + 0x37eb63e8], 1
add byte [ecx + 0x66], bl
shld edi, edi, 3
sub di, 0x91b9
xchg ecx, eax
lea edi, [eax - 0x30823c0f]
mov edi, eax
mov cx, dx
btc ecx, esi
bts cx, si
mov ecx, 0x104
add al, 1
add byte [eax], al
cmc
stc
jmp 0x7e9835
cmc
invalid
cmp ax, bp
cmp al, bh
sub edi, 4
mov byte [esp + 4], 0x4e
clc
push dword [edi]
pop dword [esp + 0x24]
pushfd
mov byte [esp], bl
clc
cmp edi, ebx
call fcn.007e5763
add byte [eax], al
dec ebp
outsd dx, dword [esi]
imul esp, dword fs:[esi + 0x79], 0x756e654d
inc ecx
outsb dx, byte gs:[esi]
jne 0x7ea394
add byte [eax], al
add byte [edx + 0x65], dl
jb 0x7ea3bc
ja 0x7ea3b4
imul ebp, dword [esi + 0x64], 0x8d00776f
and al, 8
je 0x83fdd7
push esp
pushal
cmp ebx, 3
pushfd
pushfd
pushfd
mov byte [esp], bl
lea esp, [esp + 0x30]
je 0xb686b3
pushal
pushal
mov word [esp], sp
lea esp, [esp + 0x40]
jmp 0x7e53a6
not edi
add byte [eax], al
inc ebp
outsb dx, byte [esi]
inc esp
imul esp, dword [ecx + 0x6c], 0x9c00676f
insb byte es:[edi], dx
outsd dx, dword [esi]
add byte [si - 0x143f], bl
or al, 0xe8
inc byte [esi]
add byte [eax], al
push 0x620aaa54
lea esp, [esp + 8]
jne 0x7e9a95
pushfd
cmp dl, 0xd6
push dword [esp]
lea esp, [esp + 8]
jnp 0x7ea230
cmp byte [esi - 1], 0
lea esp, [esp + 8]
je 0x837bf5
sbb bl, 0x1f
mov ebx, dword [esi]
cmp ecx, ebp
add ebx, eax
clc
push esi
sar esi, cl
push edi
bsr si, dx
xchg di, si
btc si, ax
shld esi, edi, 0x1e
mov esi, dword [ebp + 4]
dec edi
movsx edi, dl
btc di, bx
inc di
mov edi, ebx
push 0x5a8fab22
cmpsb byte [esi], byte es:[edi]
jmp 0x840439
Function at 0xb6aa3f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [ebp + 4], eax
push ebx
push dword [esp + 4]
push 0xfd8515fa
pushfd
pop dword [esp + 0x34]
jmp 0xb6b22d
push dword [esp + 0x34]
pop dword [ebp]
mov byte [esp + 4], ch
pushfd
mov byte [esp + 4], cl
lea esp, [esp + 0x3c]
jmp 0xb68aac