joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100380a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10038101
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100380a8
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100380b7
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043dd5a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10038108
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001ef7e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100381a7
add edi, 4
add eax, 2
dec ecx
jne 0x100380ed
call 0x10038154
loope 0x1003814a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100381a4
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100381b5
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10038168
cmp eax, ecx
ja 0x10038168
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100381f2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100381e8
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001f45d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x100380b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0
push ecx
xor ecx, ecx
jne 0x10038101
mov ecx, esp
xor dword [ecx - 0x55], edi
pop ecx
call 0x100380a8
dec esp
adc eax, 0x91b81b2a
div bh
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
call 0x100380b7
cld
test edx, ebx
or ebp, eax
add dword [esi - 0x7cc26b19], esp
les ecx, [eax]
or dword [esp], ebp
mov ebp, esp
sub esp, 0x100
push ebx
push edx
push ecx
push edi
push esi
mov ebx, dword [ebp + 8]
mov edx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
lea ebx, [ebx + edx]
mov eax, dword [ebx + 0x24]
add eax, edx
xor edi, edi
jne 0x1043dd5a
or edi, dword [ebx + 0x20]
add edi, edx
mov ecx, dword [ebx + 0x18]
mov esi, dword [edi]
add esi, edx
push 0
push ecx
mov ecx, esp
push 0x55d34c8a
call 0x10038108
sti
sbb byte [ecx + 0x56], dh
xlatb
les ebp, [ebp + 0x8c483e2]
xchg dword [ecx + 4], eax
xor eax, edx
shl eax, 3
xor ecx, 0
shl eax, 0x1d
add eax, dword [ecx + 4]
pop ecx
push esi
call fcn.1001ef7e
cmp eax, dword [ebp + 0xc]
pop eax
je 0x100381a7
add edi, 4
add eax, 2
dec ecx
jne 0x100380ed
call 0x10038154
loope 0x1003814a
invalid
sbb esi, ebx
mov edi, 0xdbead58c
js 0x100381a4
mov dh, 0xe8
or byte [eax], al
add byte [eax], al
mov bh, 0x24
lea eax, [edx + 0x53]
nop
mov dword [esi + 0x2308c483], ecx
sal byte [ecx], 0xc0
fsub st(7)
int 0xf
mov bh, 0
movzx eax, word [eax]
jmp 0x100381b5
shl eax, 2
add eax, dword [ebx + 0x1c]
add eax, edx
mov eax, dword [eax]
add eax, edx
mov ebx, edx
add ebx, dword [edx + 0x3c]
mov ecx, dword [ebx + 0x7c]
mov ebx, dword [ebx + 0x78]
add ebx, edx
add ecx, ebx
cmp eax, ebx
jb 0x10038168
cmp eax, ecx
ja 0x10038168
mov esi, eax
lea edi, [ebp - 0x100]
mov al, byte [esi]
mov byte [edi], al
inc edi
inc esi
js 0x100381f2
or ecx, ecx
xor dword [esp - 0x6b], eax
cmp al, 0x2e
jne 0x100381e8
lea edi, [ebp - 0x100]
push 0x100
push edi
push esi
call fcn.1001f45d
lea esp, [esp - 0x60]
mov dword [esp + 0x5c], edi
lea esp, [esp + 0x5c]
Function at 0x40f269
Capabilities:
Encode data using xor

Disassembly:
les edx, [ebp + 0x56]
push esi
inc edx
les edx, [ebp + edi*4 - 0x7c]
mov cl, 0x26
sbb byte [esi + ecx*8 - 0x69ad508d], dl
aad 0xb0
cmp byte [ebp - 0x55], bh
mov al, byte [0xb4ed5415]
test eax, 0xded9a63b
jge 0x40f26b
and esp, dword [0xc26694a5]
or eax, 0xe6f1292a
xchg ecx, eax
invalid

Function at 0x411b79
Capabilities:
Encode data using xor

Disassembly:
pop dword ds:[ebp + 0x3c]
invalid
cmp al, 0xd9
salc
cmp al, 0xe1
loope 0x411b0c
aas
inc ebx
cmc
cmc
cli
push esi
cmp cl, byte [esp + edx*8 - 0x4598ae8e]
add eax, 0x645c7449
xor dh, byte [edi]
mov esp, ss
jb 0x411b72
mov edx, 0x5c744905
xor dh, byte fs:[edi]
stc
test edi, ebp
mov esi, 0xfd612348
sti
insd dword es:[edi], dx
wait
jo 0x411b1d
faddp st(3)
mov bl, 0x21
cmp dword [eax + edi], 0x66aeace
and dword [ecx - 0x1531c7c4], eax
push 6
xchg byte [ebx + 0x75b27d5c], bl
mov esi, 0xb604fc58
mov ah, 0x24
sub bl, byte [edx - 0x7fcc89c5]
test al, 0
mov eax, dword gs:[0x37b547f4]
sti
sahf
or byte [0xab9c6521], ch
in eax, 0x3e
mov ecx, 0xc06f3ef1
retf
xchg ecx, eax
xchg esp, eax
jae 0x411be3
ret
mov gs, word [ecx + 0x2c780296]
xchg ebp, eax
xor esp, ebp
cmpsb byte [esi], byte es:[edi]
jae 0x411b0f
xchg ebx, eax
out 0xc5, eax
sbb eax, dword [ebp + 0x7bdbdee9]
rol dword [ecx - 0x32], 0x98
lcall 0xd9f4, 0xc78aef58
cmp al, 0x89
adc dword [esi], ebp
push eax
and esi, esp
pop esi
pop esi
loope 0x411b3b
outsb dx, byte [esi]
pop ss
mov ah, 0x60
dec ecx
aas
mov edx, ebx
mov byte ds:[ebx], al
rcl byte [ecx + 0x41], 0x66
push es
movsd dword es:[edi], dword [esi]
sti
sub eax, dword [ebp + esi - 0x2fdc9b9a]
pop ds
mov dword [eax + ecx*8], ebp
jo 0x411beb
xor eax, 0x71c5052e
sub cl, byte [edx + edx*2]
cmp ebp, edx
stc
or ecx, edx
enter 0x2f05, 0xfffffffffffffffe
mov ebp, dword cs:[esi + 0x3d]
hlt
rcr al, 0xfe
das
mov dword gs:[0xc60606ed], edx
push edx
into
adc al, 0xf3
adc dl, byte [ebp - 0x20db379d]
sbb eax, 0x87da207
pop eax
or cl, byte [edi]
bound eax, qword [edx + 0xb]
jecxz 0x411c80
push es
push es
invalid
invalid

Function at 0x415fc3
Capabilities:
Encode data using xor

Disassembly:
xor esp, edi
or al, 0x11
daa
wait
pop ebx
sbb ch, 0x14
invalid
xchg byte [ebx], ch
xor bl, byte [ebx - 0x474dbd5a]
into
mov edi, 0x5bcaa7de
push ebp
je 0x415f3a
or byte [edi + eax - 0x7a], 0x53
jb 0x415f57
pop ds
imul ebx, dword [esi + 2], 0xffffff87
rol edx, 0x4d
invalid
cmpsd dword [esi], dword es:[edi]
pop edx
loop 0x416006
dec esp
pop ss
or eax, 0x75e32dd2
int1
out 0xff, eax
mov eax, 0x43ab7305
jge 0x41602a
jo 0x415fd4
cld
jge 0x415f94
aad 0x54
cmpsb byte [esi], byte es:[edi]
lodsd eax, dword [esi]
cmp cl, byte [ebp + 0x4c]
jno 0x415fb9
fstp dword [esi - 0x71a446fd]
jne 0x415fb6
lodsb al, byte [esi]
adc dword [0x5f9c9866], ebx
jmp 0x416044
mov bh, byte [ecx]
inc edx
outsb dx, byte [esi]
pop ebp
push edx
aaa
invalid
invalid
xlatb
sbb ch, byte [esi]
pop edi
jl 0x41606a
lea esi, [edi + 0x2b]
and edi, dword [ebx]
adc ch, byte [eax + ebx*2 - 0x52f8c6ee]
xor al, 0xee
aaa
invalid
xor ch, ch
into
sub ch, byte [0xa68eb286]
ljmp 0x4a3e
Function at 0x417a10
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push 1
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov eax, dword [0x4c0030]
mov edx, dword [0x4c003c]
mov dword [esp + 4], 0
lea ecx, [eax*8]
add byte [eax], al
mov eax, dword [0x4c0034]
or ecx, eax
xor edx, eax
mov dword [esp], ecx
and edx, 0x7fffffff
fild qword [esp]
cmp edx, 0x3065aed2
fstp qword [0x4c0058]
jne 0x417a64
mov dword [0x4c0038], 0
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [0x4c3abc], eax
mov eax, dword [esp + 0x14]
push eax
invalid
invalid
invalid

Function at 0x417a33
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 8
push 1
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov eax, dword [0x4c0030]
mov edx, dword [0x4c003c]
mov dword [esp + 4], 0
lea ecx, [eax*8]
add byte [eax], al
mov eax, dword [0x4c0034]
or ecx, eax
xor edx, eax
mov dword [esp], ecx
and edx, 0x7fffffff
fild qword [esp]
cmp edx, 0x3065aed2
fstp qword [0x4c0058]
jne 0x417a64
mov dword [0x4c0038], 0
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [0x4c3abc], eax
mov eax, dword [esp + 0x14]
push eax
invalid
invalid
invalid
Function at 0x418421
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52acf1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4184e9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52acf1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x5249cc
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x41858f
cmp edi, dword [esi + 0x7c]
jge 0x41858f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042ce33
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042ce33
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52acf1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52acf1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4184e1
jmp 0x4184b1
call fcn.0043105a
int3
Function at 0x42380b
Capabilities:
Encode data using xor

Disassembly:
cmp esp, dword [ecx - 0x7108dfd4]
call [edx - 0x21e505de]
push 0x81361f3e
std
mov byte [edi + edi*2], al
iretd
jo 0x42383c
dec edx
push edx
mov ch, 0x3e
push eax
sbb al, 0x15
ret 0x2f6e
jns 0x423883
loope 0x4237ca
sub edi, ebp
xor edi, ecx
add eax, 0x10fd425b
push ebp
inc ecx
clc
cdq
xor byte [ebx - 0x66], 0xd0
insb byte es:[edi], dx
xchg edi, eax
mov dl, 0x13
fiadd word [ecx]
pop esi
push ebx
add esi, edi
adc ebx, dword [esi]
xor esi, dword [edx - 0x4dcca12d]
fst dword [edx - 0x211e630b]
aas
je 0x423840
pop edx
mov bh, 0x79
arpl word ds:[esi - 0x5fc0a8e1], di
add esi, ebx
push ebx
mov dword [0xbb30f218], eax
rcl dword [ebx - 0x20ec44a5], cl
mov ah, 0xae
mov ebx, 0xaeb4df13
push ebx
jle 0x4238be
mov dl, 0xce
xchg edx, eax
cmc
xor esi, dword [edx + 0x5e]
and ch, byte [ebx - 0x678d602c]
arpl word [ebp - 0xd], sp
dec ebx
push cs
xchg edx, eax
outsd dx, dword [esi]
out dx, al
out dx, eax
invalid
repe scasb al, byte es:[edi]
pop ss
lahf
das
jns 0x42389d
pop eax
mov edi, 0x23f703d2
ficomp word [eax - 0xe]
scasb al, byte es:[edi]
add dword [eax - 0x1d], ecx
cmp dword [ebx], edi
lahf
js 0x423880
ficomp dword [esi - 0x6d]
mov byte [0xbf4b630f], al
fdivr qword [esi + 0x7e12e2ae]
cwde
xlatb
mov esp, dword [esi]
test byte [edi - 0x180d11f1], bh
rcl dword [esi + 0x5f4eab62], cl
invalid

Function at 0x426377
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
dec esi
sub al, 0xa3
cmova ebp, dword [ebx]
call 0xc545af4f
js 0x4263ac
stosd dword es:[edi], eax
dec eax
invalid
push ss
fnstcw word [esi + 0x42985844]
xor al, 0xc3
inc eax
sub al, 0xa8
and byte [ebx - 0x63e43f24], dh
xchg esi, eax
in eax, dx
add ah, bl
xchg edi, eax
push ss
cmp ch, cl
insd dword es:[edi], dx
inc edi
sub esp, esi
dec edx
cmpsb byte [esi], byte es:[edi]
pop ss
imul ebx, dword [ecx], 0xfffffff5
xor al, byte [edx - 0xc]
insb byte es:[edi], dx
push eax
in al, 0x74
movsb byte es:[edi], byte [esi]
adc ch, al
lea eax, [edi + ecx*4 - 0xe]
pop ebp
cmp eax, 0xda99bb03
xor byte [ecx], bl
loope 0x4263c0
insd dword es:[edi], dx
invalid

Function at 0x42ad3e
Capabilities:
Encode data using xor

Disassembly:
les esi, [ecx - 0x6022053e]
loopne 0x42ada9
push 0x4529f9b6
xor dword [ebx], 0x140cbe37
invalid
mov byte [0x3a1845b7], al
mov al, byte [0xcacdcbe7]
lodsb al, byte [esi]
mov ebp, 0x6bc3edfc
daa
lodsd eax, dword [esi]
push esi
enter 0x261d, 0x45
insd dword es:[edi], dx
rcr eax, 0x6a
sahf
sahf
ret
Function at 0x42f2b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x541b81
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f379
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x541b81
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53b85c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f41f
cmp edi, dword [esi + 0x7c]
jge 0x42f41f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443cc3
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443cc3
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541b81
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x541b81
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f371
jmp 0x42f341
call fcn.00447eea
int3
Function at 0x439441
Capabilities:
Encode data using xor

Disassembly:
add dword [eax], esp
push eax
and ch, byte [edi - 0x17]
inc esi
mov cl, 0xc3
xor dh, ah
in eax, 0x70
sbb eax, edi
ror dl, 0x9e
pushal
add byte [eax - 0xfcc384a], al
add bh, 0x4b
xchg edi, eax
inc ebx
mov bh, 0x7d
mov fs, word [eax]
sub byte [eax], dh
push eax
inc ecx
out 0x18, al
sbb byte [ecx + 0x26], 0x90
mov byte [0x9fa35afd], al
xor byte [esi + 0x6e4e242d], al
call 0xa6371977
xchg byte [edx - 0x6d1e3c81], bh
push 0xfedd3f05
and eax, 0xb9ae8d
cmp bh, byte [edx + 0x6c]
sti
out 0xd1, al
mov word [eax + 0x1d], cs
dec edx
inc esp
mov bh, byte [ecx + 0x5f]
loop 0x439446
outsd dx, dword [esi]
jmp 0x31074592
sar esi, cl
sahf
int1
pop ds
add dword [ebx + 0x76], ecx
pop ebx
sub ah, 0xbd
adc al, 0x84
mov cl, 0xf1
int1
push edx
insd dword es:[edi], dx
cmp dword [ebp + 0x12944403], esp
test al, 6
and ebp, eax
sub al, 0x3d
mov eax, dword [0xa28ca241]
movsd dword es:[edi], dword [esi]
clc
push ss
xor al, 0xd9
pop ebp
push ds
leave
lahf
mov esp, 0x8a53331a
xlatb
pop esi
out 4, ax
shl ch, cl
xor eax, 0xa8b6520d
pop esp
push esp
imul esp, dword [ebp - 0x4493ba17], 0x265b491d
sbb al, 0x57
mov esi, 0x4045443
inc edx
invalid

Function at 0x43a791
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x109a3056
lcall 0x163c, 0x26b496bf
push ecx
xchg esp, eax
sub eax, 0x2f47a58c
mov edx, 0xb56f47d2
invalid

Function at 0x445cf1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi

Function at 0x445d1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
Function at 0x445d2e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
inc esp
and al, 0x24
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5585c1
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445db9
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
rol byte [ebx], cl
ror byte [ecx - 0x24f7dbac], cl
inc esp
and al, 8
fmul qword [esi + 0x88]
call 0x5585c1
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x55229c
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445e5f
cmp edi, dword [esi + 0x7c]
jge 0x445e5f
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a703
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a703
fld qword [esi + 0x88]
fmul qword [0x560e70]
or eax, 0x560e70
call 0x5585c1
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5585c1
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x445db1
jmp 0x445d81
call fcn.0045e92a
int3
Function at 0x44dc1d
Capabilities:
Encode data using xor

Disassembly:
jl 0x44dc20
or al, 0xc4
and byte [ecx - 0x6a5aa03c], cl
les esp, [eax]
mov esp, eax
pop edi
movsd dword es:[edi], dword [esi]
xchg ebp, eax
dec eax
dec ebx
aaa
rcl edx, 0x94
xchg esp, eax
jae 0x44dc2c
push esi
cmp bh, byte [esi]
loopne 0x44dc9d
out dx, al
inc esi
nop
and al, 0x27
sub esi, dword [ebx]
movsd dword es:[edi], dword [esi]
rcl dword [eax + 0x5498c074]
loope 0x44dcaa
aam 0x41
aad 0x84
mov ah, 0x9d
mov ebp, 0x8317b9a1
sub eax, 0xaf2f51fe
das
scasd eax, dword es:[edi]
mov edi, 0x613899c0
sbb byte [ecx - 0x73], bh
xor byte [edx], dh
mov eax, 0x8d9cdf3e
mov al, byte [0xe98d1ec5]
pushfd
lea esp, [eax - 0x1672e13b]
pop edi
xor ah, byte [ecx]
pop es
bound esi, qword [esi + 0x42]
adc ecx, dword [eax + esi]
imul esi, ebx, 0xdf01d742
add edi, ebx
pop ss
xor al, byte [ecx]
in eax, 0xdc
pop esi
sub al, 0xba
cmpsb byte [esi], byte es:[edi]
pop ds
sti
or ecx, ebx
ficomp dword [eax]
ja 0x44dc52
sub dword [ebp - 0x74ea27cd], ecx
aaa
cmc
push 0x16b93de6
dec ecx
sub eax, 0x2ca0f75d
scasd eax, dword es:[edi]
sub al, 0xaf
lahf
retf 0xc382
mov esp, dword [ebx + 0x14110795]
aas
inc edx
pop es
inc edx
push ebp
push ebx
and dword [ebx - 0x52da4f71], eax
popal
outsd dx, dword [esi]
jns 0x44dc61
outsb dx, byte [esi]
mov dh, 0x96
jno 0x44dd1a
push ebp
pop es
loopne 0x44dd28
loopne 0x44dd28
nop
mov cl, 0x65
dec ebx
not dword [esi + 0x7053d140]
rcl dword [ebx + 0x70]
loop 0x44dc76
jp 0x44dc9b
adc al, 0xf6
cwde
push esp
popal
or al, 0x70
pop ebx
push esp
jnp 0x44dcd0
cld
add eax, dword [edx + 0x73fb7191]
mov esp, 0x31ae8171
cmpsd dword [esi], dword es:[edi]
adc ebp, dword [edi]
das
mov cl, 0x93
scasd eax, dword es:[edi]
push edi
mov esp, edx
xor eax, 0xc18805eb
mov edi, 0x78f6f221
fnstcw word [edi]
lodsb al, byte [esi]
in al, dx
scasb al, byte es:[edi]
rcl dword [ecx], 0x33
test bl, al
adc eax, 0x2b7d193
adc ch, byte [ecx + 0x6a]
jb 0x44dd52
in eax, dx
jmp 0xabb59f1c
jo 0x44dcc7
mov ecx, 0xfb810959
jbe 0x44dcc4
insd dword es:[edi], dx
shl dword [edi], 1
rol dword [edi - 0x1a], 0xb2
out 0xb2, al
sub ebx, dword [bx - 6]
jg 0x44dcf1
push ecx
sbb byte [edi], 0x61
xor dword [edi], esp
or byte [esp], dh
xor dl, dl
sbb eax, 0xa4690993
pop es
stc
invalid
invalid
add al, al

Function at 0x44ddb7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test al, 0x83
aam 0xf6
invalid
push ecx
mov esp, 0x14018005
or eax, 0xbefbf478
push ds
rcr dword [ebx + 0x3bb11508], 1
mov eax, dword [0x811b918b]
jecxz 0x44dde2
jg 0x44ddd4
in eax, 1
xlatb
add edi, edx
dec ebp
bound edx, qword [ecx - 0x49]
dec ebp
cmpsd dword [esi], dword es:[edi]
sbb eax, 0xda8d42b7
inc ebx
inc ebp
ja 0x44dd6d
xor dword [ebx + esi - 0x6bd1ff7f], ebp
xchg ebx, eax
push ds
xchg ecx, eax
adc byte [eax - 0x5b], dh
mov dword [0xa0d7c9e9], eax
cmp dh, al
shl byte [edi], 1
jecxz 0x44de02
cmpsd dword [esi], dword es:[edi]
inc esi
iretd
pop esp
add ch, byte [edi]
das
dec edi
xchg edx, eax
mov bl, 0xe3
sbb al, ah
dec esi
xchg edi, eax
push cs
add byte [bx - 0x7d], bh
pushfd
mov bh, 0x51
mov cl, 0x57
adc al, 0xb7
test dword [eax], ebx
cmpsd dword [esi], dword es:[edi]
inc edi
mov al, 0x98
je 0x44de04
invalid