joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e0494
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.00513984
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x4e05b7
push ecx
lea ecx, [esi + 0x18]
call fcn.004ffcb4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x4e05ce
push ecx
lea ecx, [esi + 0x24]
call fcn.004ffbc4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x50ae34
Capabilities:
Check for software breakpoints

Disassembly:
xor dword [eax], esi
and ebx, dword [edx + 0x3288283c]
mov bl, 0xd5
mov dword [0xd12480fa], eax
imul esi, esi, 0x40b6466
sbb bl, dl
lodsb al, byte [esi]
mov byte [0x19b44df7], al
aas
mov eax, dword [0xa3144006]
in eax, dx
mov ch, byte [ebp - 0x55]
xchg edx, eax
test byte [edi - 0x21], dh
push edx
test eax, edx
push cs
mov edx, 0x85815114
jle 0x50ae7e
pop edi
xor edi, dword [ecx]
inc edi
push 0x76da8c2c
push ecx
sahf
adc dword [ecx], esp
pop eax
inc edi
dec ebp
rol byte [edx - 0x2d955387], 1
push 0xffffffffffffffd2
mov dword [edi], ebp
or al, 0x7d
pop ebx
adc al, 0x1d
or ah, byte [esi - 0x13464e7e]
jo 0x50aef0
inc ecx
pop ss
cmp byte [ecx], bl
cmp byte [edx - 0x36], 0x4f
stc
pop esp
ret 0xd4ab
out 0x9a, eax
add eax, 0x564f2d84
sbb ebx, ebx
inc ecx
invalid
Function at 0x529744
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47262f
mov eax, dword fs:[0]
push eax
sub esp, 0x138
mov eax, dword [0x4a2008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x13c], edx
mov eax, ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x134], eax
mov esi, dword [ebp + 8]
mov edi, esi
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], 0
cmp dword [esi + 0x14], 0x10
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x138], ecx
jb 0x5297ab
mov edi, dword [esi]
cmp dword [edx + 0x14], 0x10
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], edx
jb 0x5297c8
mov ecx, dword [edx]
mov dword [ebp - 0x130], ecx
cmp dword [edx + 0x10], 0
jbe 0x529831
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572714
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, edi
cmp edi, ecx
je 0x529804
nop dword [eax]
movzx eax, byte [edi]
inc edi
mov byte [ebp + eax - 0x128], 1
cmp edi, ecx
jne 0x5297f4
mov edx, dword [ebp - 0x130]
mov edi, edx
mov ecx, dword [ebp - 0x134]
add ecx, edx
cmp edx, ecx
jae 0x52982b
movzx eax, byte [edi]
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x529885
inc edi
cmp edi, ecx
jb 0x529818
mov eax, dword [ebp - 0x12c]
xorps xmm0, xmm0
mov ecx, eax
push 0
movups xmmword [eax], xmm0
push 0x491667
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
call fcn.0055d0b4
mov dword [ebp - 4], 0
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00570f90
mov esp, ebp
pop ebp
ret
sub edi, edx
cmp edi, 0xffffffff
je 0x52982b
cmp dword [esi + 0x14], 0x10
jb 0x529894
mov esi, dword [esi]
mov ecx, dword [ebp - 0x13c]
mov dword [ebp - 0x130], ecx
cmp dword [ecx + 0x14], 0x10
jb 0x5298ae
mov eax, dword [ecx]
mov dword [ebp - 0x130], eax
push 0x100
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.00572714
mov ecx, dword [ebp - 0x138]
add esp, 0xc
add ecx, esi
cmp esi, ecx
je 0x5298e4
nop dword [eax]
movzx eax, byte [esi]
inc esi
mov byte [ebp + eax - 0x128], 1
cmp esi, ecx
jne 0x5298d4
mov eax, dword [ebp - 0x134]
or ecx, 0xffffffff
mov edx, dword [ebp - 0x130]
dec eax
cmp eax, ecx
cmovb ecx, eax
movzx eax, byte [ecx + edx]
add ecx, edx
mov al, byte [ebp + eax - 0x128]
test al, al
je 0x529922
cmp ecx, edx
je 0x529999
movzx eax, byte [ecx - 1]
dec ecx
mov al, byte [ebp + eax - 0x128]
test al, al
jne 0x52990a
sub ecx, edx
sub ecx, edi
lea eax, [ebp - 0x28]
inc ecx
push ecx
mov ecx, dword [ebp - 0x13c]
push edi
push eax
call fcn.00548684
mov dword [ebp - 4], 1
xorps xmm0, xmm0
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x140], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x14], 0
mov byte [ebp - 0x28], 0
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.0055d1e4
mov eax, esi
jmp 0x52986a
or ecx, 0xffffffff
jmp 0x529924
Function at 0x529bc4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.0055d0b4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x529ce7
push ecx
lea ecx, [esi + 0x18]
call fcn.005493e4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x529cfe
push ecx
lea ecx, [esi + 0x24]
call fcn.005492f4
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x545f04
Capabilities:
Encode data using xor

Disassembly:
sbb byte [esi - 0x5d], 0xa3
stosd dword es:[edi], eax
les esi, [edi - 0x26410804]
xchg esp, eax
push esi
sub esp, eax
xor byte [ebx + 0x14], bl
std
pop ebx
adc al, 0xf2
std
lodsb al, byte [esi]
popfd
mov bl, byte [ebx]
stc
jp 0x545e2a
and ch, byte [ecx + 0x6bda62e7]
cmp eax, 0xe2b462f9
add bh, cl
or dh, cl
pop edi
cli
cmpsd dword [esi], dword es:[edi]
xchg ecx, eax
sub edi, ebx
je 0x545ed4
retf 0x5c9d
push edi
js 0x545ec9
aaa
push edx
inc ebp
not ebx
loop 0x545e3a
inc ebx
sub byte [esp + ebx], al
xor ebx, edi
lock or dword [edi + 0x5898f0eb], ebp
mov dword [ebx + 0x50abe24a], ebp
popal
push ss
js 0x545eee
jbe 0x545e5d
mov byte [edi + 0x570a2bc2], dh
sub eax, 0xc78c6ecf
or dword [eax - 0x5e], 0xdfe99bf8
pop ecx
arpl word [0x9f8e1d38], bp
xor al, 0xec
test eax, 0x673478b7
mov bh, 0x78
xor al, 0x67
ror bh, cl
push 0x18107696
sbb byte [ecx - 0x64679689], ch
cmp dword [eax], 0x4922a50b
cmpsb byte [esi], byte es:[edi]
add cl, byte [ecx - 0xa]
mov eax, 0x8ba64ef0
idiv byte [eax - 0x7459b110]
and dword ss:[esi], eax
xlatb
sbb dword [eax], 0xffffff80
call 0x28a42e57
clc
aam 0x18
inc esp
fist dword [ebx + 0x26]
out 0x46, al
dec edx
jecxz 0x545e94
out 0xe9, eax
ja 0x545f29
in al, dx
sub dword [esi + 0x79], edx
and dword [0x49c8e045], ebp
ja 0x545f2c
cld
and byte [ecx - 0x752b8278], ch
sbb byte [0x984ec45], 0xd3
fiadd word [ebp + esi*8 + 0x6a31127]
mov eax, 0x87c7c2bf
mov ebp, 0x2e1ca9b1
or dword [edi + 0x49], edi
rcr esi, cl
test ch, dh
cmc
daa
adc dword [ebx - 0x3d4047fa], esp
mov dword [edi + 0x1ca9b1bd], 0x497f092e
pop edi
call 0x77ab97d0
lodsd eax, dword [esi]
or dword [esi + 0x70], ebx
jns 0x545f61
push ebp
or dword [ebp + ebx*8 + 0x5880dbe0], edx
sal al, 0x56
inc esi
sti
sub al, 0x3b
aas
pop edx
add dword [ecx - 0x2e], ebp
sub esi, dword [ebp - 0x47]
pushal
mul byte [edi + 0x46]
push esi
in eax, 0x12
daa
invalid
Function at 0x55cc04
Capabilities:
Encode data using xor

Disassembly:
stosd dword es:[edi], eax
add al, 0xea
add dh, dl
fadd st(6)
out dx, al
xchg edi, eax
dec eax
salc
lahf
jo 0x55cc8a
push esp
inc ebp
dec ebx
jp 0x55cc2b
mov bh, 0xc2
xchg esp, eax
push eax
dec edi
rol dword [ebp - 0x3d], 0x93
popfd
xchg dword [edx - 0x24], esp
mov byte [edi - 0x5d3f6b5f], bh
scasd eax, dword es:[edi]
sbb cl, byte [ebp + 0x42]
invalid
or ecx, dword [eax]
sti
inc edi
invalid
in eax, 0xff
and dl, cl
cmp dword [ecx + 0x4ad51377], eax
push edi
and edx, dword [edi]
push 0xffffffffffffffa7
out 0x98, eax
pop ebx
inc ebp
jl 0x55ccdf
shl byte [ecx + ebp*2 - 0x5205f09d], cl
sti
insb byte es:[edi], dx
push esi
push 0xafe4bd84
in eax, dx
push cs
jno 0x55cc43
jb 0x55cd07
jb 0x55cd07
stosb byte es:[edi], al
js 0x55cd20
or byte [ebp + 0x56], ch
sbb byte [0x46fc3638], dh
fild word [edx - 0x1c058909]
inc ecx
xchg ecx, eax
pop eax
cmpsd dword [esi], dword es:[edi]
invalid
imul eax, dword [edi - 8], 0x7b
cmp byte [edi], dh
clc
inc ebp
sbb cl, cl
or dword [ecx - 0x19d21398], edx
pop ecx
adc dword [ecx + 0x73c4d77], ecx
mov esp, 0x5847d00d
jbe 0x55ccb3
inc ecx
adc eax, 0xd53e9840
stosd dword es:[edi], eax
stc
push edi
clc
mov es, word [esi - 0x1f14ecfe]
mov edx, 0x4dbe98ce
outsb dx, byte [esi]
dec ebp
fldcw word [edx + 0xb26e4fc]
push ss
mov edx, 0xb8174d96
xchg al, cl
out dx, eax
pop ss
mov eax, 0x74efc886
invalid
je 0x55cd25
cld
daa
sub byte [0xd2ba49bc], 0x41
ret

Function at 0x5731d4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.005a66c4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x5732f7
push ecx
lea ecx, [esi + 0x18]
call fcn.005929f4
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x57330e
push ecx
lea ecx, [esi + 0x24]
call fcn.00592904
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x5a6374
Capabilities:
Encode data using xor

Disassembly:
test dword [esi - 0x56], ecx
ja 0x5a631e
pop eax
pop ds
test al, 0x4a
loop 0x5a626b
mov dword [ebx], esi
fprem1
adc eax, 0x17cf8c10
mov edi, 0x53dc91ec
dec eax
daa
mov al, 0x40
popfd
fst st(1)
fsubrp st(5)
pop edi
adc esp, edi
add al, 0x4b
stosd dword es:[edi], eax
pop edi
mov byte [0xbcc8d7de], al
xor al, byte [ecx]
jnp 0x5a6306
std
inc ebp
insb byte es:[edi], dx
fld qword [ecx + edi*4 - 0x4001fdc9]
jmp 0x5a62de
cmp dh, byte [esi + 0x7f]
aaa
pop es
and edi, edx
mov al, byte [0xd1f561ce]
mov bl, 0xbb
invalid
dec ebp
enter 0x382a, 0x60
jp 0x5a6330
or al, 0xc4
jo 0x5a638d
test eax, 0x33de7065
aad 0x3e
cmc
scasd eax, dword es:[edi]
pop ecx
push es
mov bl, 0xc5
test eax, 0xb4a7c5ae
ja 0x5a634e
invalid
in al, dx
mov byte ss:[0x257b2f94], ah
xchg esp, eax
invalid

Function at 0x6060f4
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x472754
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4a2008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xorps xmm0, xmm0
push 1
movups xmmword [esi], xmm0
push 0x48f868
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
call fcn.006395e4
mov dword [ebp - 4], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov byte [ebp - 4], 1
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov byte [ebp - 4], 2
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov byte [ebp - 4], 3
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [ebp - 4], 4
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov byte [ebp - 4], 5
mov ecx, dword [0x4a2a48]
mov eax, dword [0x4a2a4c]
add ecx, 1
mov dword [esi + 0x58], 0
mov dword [esi + 0x5c], 0
adc eax, 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [0x4a2a4c], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x68], ecx
mov eax, dword [esi + 0x20]
sub eax, dword [esi + 0x18]
sar eax, 3
mov dword [0x4a2a48], ecx
cmp eax, 0x64
jae 0x606217
push ecx
lea ecx, [esi + 0x18]
call fcn.00625914
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x24]
sar eax, 3
cmp eax, 0x14
jae 0x60622e
push ecx
lea ecx, [esi + 0x24]
call fcn.00625824
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x638d24
Capabilities:
Encode data using xor

Disassembly:
xchg ebx, eax
arpl word [esi + 0x67], sp
mov cl, 6
mov esp, 0xd5bac562
movsb byte es:[edi], byte [esi]
adc eax, 0xa77cb6fb
invalid
xlatb
cld
les esi, [edx - 0x55]
jge 0x638c2d
stosb byte es:[edi], al
insb byte es:[edi], dx
mov bh, 0x27
dec edi
adc byte [ebx + 0x32], al
test byte [ebx + 4], 0xab
jp 0x638cb0
ret 0xdbf4
or byte [eax + ecx*4 + 0x57aa5222], ch
xchg al, dh
pop ss
jae 0x638d02
pop edx
cmp al, 0x22
mov cl, 0xae
jb 0x638cb5
dec edi
das
insd dword es:[edi], dx
int3
dec edi
push esi
xchg ecx, eax
sahf
ljmp 0xfd03
ja 0x638c84
out 0x44, al
aas
mov bp, 0x3279
xchg edi, eax
aad 0x99
div ecx
xor dl, byte [edi - 0xe08662b]
salc
push 0xffffffffffffffb7
cld
jo 0x638cec
adc edx, dword [esi]
push ss
jbe 0x638c79
lcall 0x82d1, 0x93b39ea0
loop 0x638c9b
and dl, 0x47
adc dl, byte [ebx - 8]
mov dh, 0xef
inc edi
jecxz 0x638d39
aam 0xc2
inc edx
hlt
lodsd eax, dword [esi]
cmpsd dword [esi], dword es:[edi]
adc byte [ebx], ah
xchg esp, eax
stc
xlatb
jb 0x638d3f
jbe 0x638d8c
fdiv qword [esi + eax*2]
mov bl, 0xc1
inc edi
and esi, dword [eax]
ret
jecxz 0x638cd8
mov cl, 0xc6
in eax, dx
push esp
popfd
div ah
loop 0x638cc5
loopne 0x638ccd
lds ebx, [esi - 0x2f5de820]
adc dl, byte [edx + 0x5a]
adc edx, dword [ebp - 0x45597a10]
pop eax
cmp bh, byte [eax]
test dword [esi + 0x383a58ba], esp
cmpsb byte [esi], byte es:[edi]
mov edx, 0x24383a58
xor dl, 0xe2
inc esp
and al, 0x82
loop 0x638d8e
cmpsb byte [esi], byte es:[edi]
pop esi
xchg esi, eax
push es
stosd dword es:[edi], eax
cwde
aad 0x42
les ecx, [edx + 0x72]
loopne 0x638cec
jne 0x638d40
inc ecx
mov cl, 0x67
ret 0xb261
cmpsd dword [esi], dword es:[edi]
loop 0x638dbe
pop ds
lahf
ret
xchg dword [esi], edx
adc dword [edx], eax
in al, 0xc0
jb 0x638d64
adc al, dl
in eax, dx
pushfd
dec esi
mov dword [0x42eb900f], eax
xchg dword [esi], ecx
shl dword [esi], cl
mov ebp, 0xc81fd572
inc eax
add byte [edi], bl
stosd dword es:[edi], eax
and bh, cl
xor edx, dword [ebx + 0x46c344d2]
dec edx
invalid
mov esi, 0x16c70648
mov esi, 0xe7430a22
aaa
pop ds
pop esi
invalid
Function at 0x401120
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor ecx, ecx
xor edi, edi
mov esi, 0x200c
nop
mov eax, 0x76b981db
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x401130
inc ecx
mov eax, ecx
and eax, 0x80000001
jns 0x401152
dec eax
or eax, 0xfffffffe
inc eax
jne 0x401156
add ecx, ecx
cmp ecx, 0x20e7
jl 0x401143
mov edx, dword [ebp + 8]
test edx, edx
je 0x4011e9
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4011e9
cmp edx, eax
jae 0x4011e9
mov ebx, eax
mov ecx, esi
sub ebx, edx
je 0x40118e
lea esp, [esp]
mov al, byte [ecx + edx + 1]
add al, 0x62
xor byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x401180
mov ecx, 0x24b8
mov edx, 0x22
mov eax, 0x73
lea ecx, [ecx]
cmp eax, 0x22
cmovg eax, edx
dec ecx
jne 0x4011a0
mov ecx, 0x2f25
mov edx, 0x30
mov eax, 0x76
cmp eax, 0x30
cmovl eax, edx
dec ecx
jne 0x4011b8
inc esi
mov eax, 0x38e38e39
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, esi
lea eax, [eax + eax*8]
sub ecx, eax
jne 0x4011dc
inc esi
cmp esi, 0x5d64
jl 0x4011c1
pop edi
pop esi
pop ebx
pop ebp
ret
mov ebx, 0x27fd
mov edi, edi
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x4011f0
mov ebx, 0x4e54
inc edi
mov eax, 0x66666667
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, edi
lea eax, [eax + eax*4]
sub ecx, eax
jne 0x401223
inc edi
cmp edi, 0x4b41
jl 0x401208
jmp 0x401230
mov eax, 0x81848da9
imul ebx
add edx, ebx
sar edx, 7
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401230
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403350
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x4033ad
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403360
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x4031b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x24]
push 0x18
push 0
push eax
mov eax, dword [0x4c17f0]
call fcn.00401ce0
mov ecx, dword [edi]
mov dword [ebx + 0xc0], ecx
mov edx, dword [edi + 8]
mov ecx, dword [esp + 0x24]
mov dword [ebx + 0x44], edx
mov eax, dword [edi + 8]
mov edi, dword [esp + 0x70]
mov dword [ebx + 0x4c], eax
mov eax, dword [esp + 0x60]
mov dword [ebx + 0x48], edi
mov dword [ebx + 0x38], ecx
test eax, eax
je 0x403253
mov byte [eax], 1
jmp 0x403262
mov eax, 0x73
mov word [esp + 0x90], ax
lea eax, [esp + 0x92]
test ecx, 0x400
je 0x4031d3
mov edx, 0x46
jmp 0x4031e0
test ecx, 0x800
je 0x4031e6
mov edx, 0x66
mov word [eax], dx
add eax, 2
test ecx, 0x1000
je 0x4031f8
mov ecx, 0x43
mov word [eax], cx
jmp 0x403208
test ecx, 0x2000
je 0x40320b
mov edx, 0x63
mov word [eax], dx
add eax, 2
xor ecx, ecx
mov dword [esp + 0x44], 0x49
mov word [eax], cx
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0xc]
mov dword [ebx + 0x34], ecx
cmp ecx, 8
je 0x403101
cmp ecx, 5
je 0x403101
mov ecx, dword [0x4c17f0]
push 1
push 0
push 0xffffffffffffffff
lea edx, [esp + 0x9c]
push edx
call fcn.0046e960
jmp 0x403114
cmp byte [esp + 0x1e], 0
je 0x403262
mov eax, dword [esp + 0x14]
or byte [eax + 5], 4
mov ecx, dword [esp + 0x4c]
call fcn.00401eb0
mov edx, dword [esp + 0x78]
mov esi, dword [edx*4 + 0x4c1600]
xor ebx, ebx
mov dword [esp + 0xc], esi
cmp esi, ebx
je 0x4033d9
cmp edi, dword [esi + 0xc]
jae 0x403298
mov ecx, dword [esi + 0x14]
lea eax, [edi + edi*4]
lea edx, [ecx + eax*4]
mov dword [esp + 0x14], edx
jmp 0x40329c
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x44]
add eax, 0xfffffffb
cmp eax, 4
ja 0x4032f7
jmp dword [eax*4 + 0x402a64]
cmp dword [esp + 0x14], ebx
je 0x4033d9
mov eax, dword [esp + 0x14]
and byte [eax + 5], 0xfb
jmp 0x4033d9
Function at 0x4038b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x49840b
push eax
mov dword fs:[0], esp
sub esp, 0x180
cmp dword [0x4bd3e4], 0
push ebx
push esi
push edi
je 0x403c4c
cmp dword [0x4c0ffc], 0
jne 0x403c4c
mov ecx, dword [0x4c17e0]
mov ebx, dword [0x4c178c]
xor eax, eax
mov dword [esp + 0x24], ecx
test ecx, ecx
jle 0x403916
lea edx, [ebx + 4]
mov esi, dword [ebp + 0xc]
cmp dword [edx], esi
je 0x403916
inc eax
add edx, 0xc
cmp eax, ecx
jl 0x403907
cmp eax, ecx
je 0x403c4c
mov ecx, dword [0x4bd3f0]
lea eax, [eax + eax*2]
mov esi, dword [ebx + eax*4]
lea ebx, [ebx + eax*4]
mov eax, dword [0x4c0fe0]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], esi
cmp eax, ecx
jl 0x40395a
add ecx, 2
cmp eax, ecx
jge 0x403c4c
mov ecx, dword [esi + 8]
mov al, byte [ecx]
cmp al, 0xd8
je 0x40395a
cmp al, 0xd3
jne 0x403c4c
mov dx, word [ebx + 8]
cmp dx, word [ebx + 0xa]
jge 0x403c4c
mov eax, dword [0x4bd41c]
cmp dword [eax + 0x2c], 0
jg 0x403c4c
mov ecx, dword [0x4c17f0]
push 0
mov edi, 1
push edi
call fcn.00401e40
push 0x7f
push eax
lea ecx, [esp + 0x90]
push ecx
call fcn.00489924
xor edx, edx
mov word [esp + 0x192], dx
mov eax, dword [esi + 8]
movzx ecx, byte [eax]
add esp, 0xc
push ecx
push edx
push edx
mov al, 1
call fcn.00403c70
mov eax, dword [ebp + 8]
add esp, 0xc
call fcn.004706f0
mov esi, dword [0x4bd41c]
mov dword [esi + 0xc0], eax
test eax, eax
je 0x403a3e
mov edi, eax
call fcn.00401ef0
mov edi, eax
test edi, edi
je 0x403a39
mov edx, dword [edi + 8]
mov ecx, dword [ebp + 8]
mov ebx, dword [0x499608]
mov dword [esi + 0x44], edx
mov eax, dword [edi + 8]
push ecx
mov dword [esi + 0x4c], eax
call ebx
lea esi, [eax - 3]
cmp esi, dword [edi + 0xc]
jb 0x403a13
mov edx, dword [ebp + 8]
push edx
call dword [0x499604]
test eax, eax
je 0x403a13
push eax
call ebx
lea esi, [eax - 3]
mov edi, dword [edi + 0xc]
mov eax, esi
cmp esi, edi
jb 0x403a21
mov eax, 0x2af8
mov esi, dword [0x4bd41c]
mov ebx, dword [esp + 0x10]
cmp eax, edi
mov edi, 1
jae 0x403a3e
mov dword [esi + 0x48], eax
jmp 0x403a3e
mov edi, 1
mov eax, dword [ebp + 0x18]
xor ecx, ecx
cmp eax, ecx
je 0x403a59
mov edx, dword [eax + 0x14]
mov dword [esi + 0x3c], edx
mov edx, dword [eax + 0x18]
mov dword [esi + 0x40], edx
mov eax, dword [eax + 0x10]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x10]
lea edx, [esp + 0x48]
mov dword [esp + 0x38], edx
mov dword [esp + 0x48], eax
mov eax, dword [ebp + 0x14]
lea edx, [esp + 0x58]
mov dword [esp + 0x3c], edx
cdq
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
mov dword [esp + 0x40], eax
mov dword [esp + 0x68], edx
mov edx, dword [ebp + 8]
lea eax, [esp + 0x78]
and al, 0x78
mov ecx, dword [esp + 0x18c]
pop edi
pop esi
xor al, al
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret