joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40902190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp + 8], eax
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x409021c1
lea eax, [ebp + 8]
push 4
push eax
push 4
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop esi
pop ebp
ret 4

Function at 0x409021c9
Capabilities:
Set registry value

Disassembly:
mov eax, 0x40905b84
call sub.MSVCRT.dll__EH_prolog
push ecx
push esi
push edi
mov esi, ecx
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.4090568a
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov byte [ebp - 4], 1
mov edi, dword [eax - 8]
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x40902223
push ebx
mov ebx, dword [esi + 4]
push edi
inc edi
push edi
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push dword [ebp + 0xc]
push 0
push ebx
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
pop ebx
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
mov esi, dword [esi + 0xc]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 8

Function at 0x4090225a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x40905b98
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x408
push esi
mov esi, ecx
mov dword [ebp - 0x14], 0x400
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x40902281
push 6
pop eax
jmp 0x409022d9
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi + 0xc], eax
jne 0x409022d6
call sub.MFC42.DLL_AfxGetEmptyString
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x414]
push eax
call fcn.409056b4
mov ecx, dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.40905690
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40902350
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
cmp eax, 0xffffffff
jne 0x40902360
push 6
pop eax
jmp 0x4090237a
lea ecx, [esp + 0xc]
push ecx
push dword [esp + 0xc]
push 0
push 0
push dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi + 0xc], eax
pop esi
ret 8
Function at 0x4090237e
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, ecx
call sym.LEXINST.dll_protected:_long_int___thiscall_CRegistry::createKey_void_
test eax, eax
mov dword [esi + 0xc], eax
jne 0x409023a7
push dword [esp + 0xc]
push dword [esp + 0xc]
push 3
push eax
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
pop esi
ret 8

Function at 0x40902483
Capabilities:
Query or enumerate registry key

Disassembly:
push esi
push edi
mov esi, ecx
mov edi, 0x400
mov ecx, dword [esp + 0xc]
push edi
call sub.MFC42.DLL_CString::GetBuffer
mov ecx, dword [esi + 4]
cmp ecx, 0xffffffff
jne 0x409024a3
push 6
pop eax
jmp 0x409024c6
push edi
push eax
movzx eax, word [esi + 0xc]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 0xc]
inc word [esi + 0xc]
push 0xffffffffffffffff
mov dword [esi + 8], eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esi + 8]
pop edi
pop esi
ret 4

Function at 0x4090253f
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x40905c0c
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x30
push esi
mov esi, ecx
lea ecx, [ebp - 0x3c]
call sym.LEXINST.dll_public:_void___thiscall_CMVKeySecurity::constructor_void_
and dword [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call sym.LEXINST.dll_public:_void____thiscall_CMVKeySecurity::GetSD_void_
push eax
push 4
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
mov dword [esi + 8], eax
je 0x409025ab
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_2
push dword [esi + 8]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push 0x40901208
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov esi, dword [esi + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call sym.LEXINST.dll_public:_void___thiscall_CMVKeySecurity::destructor_void_
mov ecx, dword [ebp - 0xc]
mov eax, esi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x4090523a
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x210]
push 0x40901928
push eax
mov ebx, 0x409011e8
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_remove]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090191c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901910
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901900
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x409018f0
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x409018e0
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40905340
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x210]
push 0x40901940
push eax
mov ebx, 0x409011e8
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_remove]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901934
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901928
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090191c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901910
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x40901900
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x409018f0
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x409018e0
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4090548c
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x210]
push 0x40901988
push eax
mov ebx, 0x409011e8
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
mov edi, dword [sym.imp.MSVCRT.dll_remove]
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x409011f8
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090197c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090196c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090195c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
lea eax, [ebp - 0x210]
push 0x4090194c
push eax
lea eax, [ebp - 0x108]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40905592
Capabilities:
Get common file path
Move file

Disassembly:
mov eax, 0x40906328
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x230
push ebx
push 0x80000002
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x4090140c
call sub.MFC42.DLL_CString::CString_1
push ecx
xor ebx, ebx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x409013f8
mov dword [ebp - 4], ebx
call sub.MFC42.DLL_CString::CString_1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sym.LEXINST.dll_public:_void___thiscall_CRegistry::constructor_class_CString__class_CString__struct_HKEY____
lea eax, [ebp - 0xd]
lea ecx, [ebp - 0x2c]
push eax
mov dword [ebp - 4], 1
call sym.LEXINST.dll_public:_long_int___thiscall_CRegistry::get_unsigned_char__
test eax, eax
je 0x409055f3
mov byte [ebp - 0xd], bl
test byte [ebp - 0xd], 1
je 0x40905601
push ebx
push ebx
push ebx
call fcn.4090449a
test byte [ebp - 0xd], 2
je 0x4090560f
push ebx
push ebx
push ebx
call fcn.40904432
lea ecx, [ebp - 0x2c]
call sym.LEXINST.dll_public:_long_int___thiscall_CRegistry::DeleteEntry_void_
push ebx
push ebx
push ebx
call fcn.409043cf
test byte [ebp - 0xd], 3
je 0x40905668
lea eax, [ebp - 0x134]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x134]
push 0x40901994
push eax
lea eax, [ebp - 0x23c]
push 0x409011e8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 4
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call sym.LEXINST.dll_public:_void___thiscall_CRegistry::destructor_void_
mov ecx, dword [ebp - 0xc]
push 1
pop eax
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40eec3
Capabilities:
Encode data using xor

Disassembly:
mov ch, 0xfc
xchg byte [esp + edi*2 - 0x42], bl
cdq
mov dh, 0x5d
pop ecx
mov dword [ecx - 0x1a], ebx
sub eax, 0x54a0b046
mov al, 0xa0
push esp
push edx
xor esp, dword [edi + 0x5a]
pop ecx
sbb eax, 0xffb479cf
jne 0x40eed2
push edx
sub al, 0xb5
insd dword es:[edi], dx
cmp byte [ecx - 0x6f], cl
out dx, eax
movsb byte es:[edi], byte [esi]
adc byte [ebx - 0x16], cl
invalid

Function at 0x41823b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ab0b
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418303
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ab0b
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5247e6
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4183a9
cmp edi, dword [esi + 0x7c]
jge 0x4183a9
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042cc4d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042cc4d
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ab0b
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ab0b
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4182fb
jmp 0x4182cb
call fcn.00430e74
int3
Function at 0x445038
Capabilities:
Encode data using xor

Disassembly:
jle 0x44504b
mov ebx, 0x4f3cd0e7
push edi
push edi
push edi
in eax, 0xa9
sub byte [ebp - 0x49529e75], bl
jnp 0x445030
xchg ecx, eax
or ch, byte [edx]
test dh, dh
xor byte [edi - 0x6eea5cb7], 0x42
adc al, 0x3b
push ecx
clc
mov dword [0x14429115], eax
cmp edx, dword [ecx - 8]
dec eax
jl 0x4450cb
test eax, 0x38bb4821
adc dl, al
cmp al, 0xfa
rol byte [ebp - 0x120021fe], 1
int1
aaa
cmp byte [esi + ecx*8], bl
mov bl, 0xa9
inc edx
jecxz 0x445030
cmp byte [eax], dl
ret 0x3c66
sar dword [ebx + 0x75], cl
call 0x1a70bf6e
call 0xfe87f04f
sbb bh, byte [eax + ecx*4]
stc
jne 0x4450ab
invalid
and ecx, dword [eax - 0x78]
inc esp
mov bh, dh
invalid
sub eax, 0x576c5470
jbe 0x44505a
and eax, 0xe0a6c104
enter 0xffffffffffff8bf6, 0x71
insb byte es:[edi], dx
mov eax, dword [0x58d4fb72]
cmp al, byte [ebx - 0xb]
mov cl, dh
fbld tbyte [ebx]
fisttp word [eax]
or ebx, dword [edi + 7]
pop edi
pop es
out 0x57, eax
shr al, 0xe2
loopne 0x4450f7
dec eax
mov ebp, 0x133de747
mov dword [0xc882908], eax
mov esi, 0xce267413
xchg ebp, eax
jns 0x4450a2
push esi
movsb byte es:[edi], byte [esi]
cmp al, 0x1b
mov al, byte [0x4e1480b2]
ret
xchg al, cl
bound esp, qword [eax - 0x24d50a21]
mov al, byte [0xdb2af5df]
aaa
pop es
in al, dx
fsubr dword [edi + 0x6fbc1cd8]
das
inc esp
mov al, byte [0x3be16d9d]
dec edi
jo 0x4450f4
in eax, 0x62
leave
lds eax, [esp + eax + 0x4b5ba78c]
movsb byte es:[edi], byte [esi]
lcall 0xa30d, 0x3a44ecb1
cmp cl, byte [0x3107daa3]
cdq
cdq
popal
insd dword es:[edi], dx
fiadd dword [edi]
xor dword [ecx + 0x6d61993e], ebx
jge 0x445122
add bl, byte [esi + esi*4 - 0x678f095f]
dec esp
push ds
bound esp, qword [ebx]
and al, 8
jns 0x44518b
push es
shr byte [eax + 0x2b], 1
imul edi, dword [ebp + 0xb], 0xe6f762c6
out dx, al
and byte [edi], ah
mov dl, 0xc8
push ecx
ja 0x44511f
retf 0x45ae
invalid

Function at 0x445f0b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
Function at 0x445f52
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5587db
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445fd3
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5587db
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5524b6
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x446079
cmp edi, dword [esi + 0x7c]
jge 0x446079
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a91d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a91d
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5587db
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5587db
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445fcb
jmp 0x445f9b
call fcn.0045eb44
int3
Function at 0x45127b
Capabilities:
Encode data using xor

Disassembly:
sub edx, dword [ebx - 0x4adcb755]
xchg edx, eax
adc ebp, dword [esi - 0x15]
leave
xlatb
leave
dec ebp
sub dword [eax + 0x41499044], esp
jbe 0x4512cf
aad 0xf9
cmp byte [ebx + 0x50c2e9fe], dl
and eax, 0x643b9f3c
push cs
inc ebx
push ebx
stosd dword es:[edi], eax
adc byte [ebx + 0x27e4222], ah
xchg esi, eax
xor byte [ecx - 0x6d2eda38], 0x2d
jp 0x451243
xchg ebx, eax
jl 0x451238
and ch, byte [edi + 0x6b9d7902]
jo 0x45122c
jle 0x451258
popfd
sti
adc eax, 0x74369629
rol byte [ecx + 0x11], 0x13
cli
inc ebx
cwde
loop 0x4512f5
rcr ah, cl
xchg edx, eax
sti
and dh, byte [ebx - 0x5e]
imul ebx, ebp, 0x33
movsd dword es:[edi], dword [esi]
xchg ebp, eax
adc eax, 0x227fa5da
jg 0x4512d5
dec eax
and ebx, ebx
cmpsd dword [esi], dword es:[edi]
ljmp 0x6ca0
fdivr st(5), st(0)
mov edx, 0xfe83fe2e
push ds
wait
arpl word [ecx - 0x157264ea], cx
and byte [ebx], cl
or eax, 0xe5c9214d
pop edx
sbb bl, byte [eax]
cmp byte [edi + 0x52b7cbca], al
add al, byte [ecx]
xor al, cl
jp 0x4512cf
invalid
jnp 0x4512f8
add al, byte [edi]
pop es
xor dword [ebx], 0xbaf822de
stc
lodsd eax, dword [esi]
aaa
and dword [ecx], ecx
cmp ebx, dword [eax - 0xd]
insb byte es:[edi], dx
xor ebx, esi
and bh, al
mov edx, 0x2137adf9
or dword [ebx], edi
pop eax
rep insb byte es:[edi], dx
inc edi
ficomp word [edx + 0x3a]
in al, 0x29
and byte [0x9fe31b62], ch
jecxz 0x4512b1
and dh, byte [edi]
pop es
adc edx, dword [ecx - 0x12]
sub eax, 0x98c67a35
adc ch, byte [eax]
pop ds
inc ecx
pop ebx
fisubr word [ebx + 0x42]
sbb ecx, dword [ebx - 0x16514d7b]
salc
push esi
mov ss, word [0x4323ead5]
insd dword es:[edi], dx
sbb dword [ebp - 0x2d6735ca], ecx
jle 0x451310
sbb dword [eax], ecx
mov edi, edi
adc al, 0xcd
push ds
aad 0x26
out 0xa9, eax
inc ebx
push esi
cmp edx, dword [edi - 0x23]
invalid

Function at 0x453e61
Capabilities:
Encode data using xor

Disassembly:
add dword [ebx + 2], ecx
das
pop es
jmp 0x27439985
mov ecx, 0x815cdcea
xor bl, byte [edx + 0x63eda9e]
scasd eax, dword es:[edi]
xor al, 0x31
scasb al, byte es:[edi]
inc esi
pop ecx
jge 0x453e0b
outsb dx, byte [esi]
jns 0x453e4e
sbb edi, edi
or al, 0x1a
ljmp 0x2874
cmp eax, 0x1b265072
loop 0x453dcf
aaa
jns 0x453e6b
movsd dword es:[edi], dword [esi]
retf
leave
pop esi
mov dh, 0x69
adc dword [ebx], 0xfffffff8
sbb esp, dword [ecx]
leave
lodsd eax, dword [esi]
xchg byte [ebx + 0x26], bh
test byte [edi + 0x53], bh
cmc
fidivr dword [edi - 0x26]
jg 0x453e3d
jg 0x453e3d
pop esi
rcl dword [edi]
iretd
jns 0x453e00
dec ebp
sbb esi, dword [0x993c6014]
test edx, ecx
pushfd
jnp 0x453eca
mov cl, 0xa9
push ds
lodsd eax, dword [esi]
mov ebp, 0xc4848d03
cdq
cmpsd dword [esi], dword es:[edi]
pop ebx
lodsd eax, dword [esi]
dec edi
invalid
cmp dword [esi], eax
invalid
cmpsd dword [esi], dword es:[edi]
mov eax, dword [0xa253f260]
test al, 0xb1
test al, 0xf1
cmp eax, esp
jnp 0x453ead
int3
Function at 0x473553
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.00585e23
adc dword [eax], eax

Function at 0x4735d4
Capabilities:
Packed with generic packer

Disassembly:
adc dword [eax], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x47361b
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add byte [ebx], 0xd2
pop ebp
adc byte [esi - 0x75], dl
or byte [ebx + 0x138a0845], cl

Function at 0x4b318d
Capabilities:
Encode data using xor

Disassembly:
lahf
inc esp
pop edx
lodsb al, byte [esi]
mov bl, 0x38
mov eax, 0xd611176f
xor eax, 0xaeb7ea71
jl 0x4b318f
mov ah, 0xfd
and dword [edx + 0x69f8ba62], eax
mov ch, byte [ebp + 0x4e]
test dword [edi + 0x787f08b8], edi
ffree st(4)
xchg ebx, eax
in eax, dx
inc edx
xchg dword [eax + ebx - 0x69], ebx
out dx, al
lodsb al, byte [esi]
mov dh, 0xb1
jo 0x4b31d0
adc al, dh
inc eax
fmul qword [ebp + 0x87432e7]
mov byte [0x4e439f7b], al
sbb al, 0xe5
xor edi, dword [ecx + 0x13]
test byte [0x929e6777], dl

Function at 0x4b8890
Capabilities:
Encode data using xor

Disassembly:
push ds
shl byte [edx], 1
xor dword [edi + 8], edx
and ebp, eax
invalid
jecxz 0x4b88a9
in eax, 0xf0
jb 0x4b8887
hlt
in eax, 0xeb
push ds
push cs
out dx, al
cmp dword [eax + ebx*2 - 0x60f89d6a], ebp
bound eax, qword [edi]
lahf
bound eax, qword [edi]
lahf
inc eax
mov byte [0x9417c650], al
loopne 0x4b8820
lahf
push esp
inc edi
insd dword es:[edi], dx
inc ecx
push ebp
jnp 0x4b886c
rol esi, 1
into
or al, 0x20
into