joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
shl eax, 2
push eax
call fcn.004fa109
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0xc], 0
jne 0x403fd6
mov eax, dword [ebp - 4]
mov dword [eax], 0
push 0
push 0
push 0x55d330
call fcn.0051c1dd
push 0
call fcn.004f987d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8

Function at 0x404010
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
shl ecx, 2
push ecx
call fcn.004fa109
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x404077
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
push 0
push 0
push 0x55d348
call fcn.0051c1dd
push 0
call fcn.004f987d
mov edx, dword [ebp - 4]
mov eax, dword [edx]
shl eax, 2
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004fa250
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4

Function at 0x4041f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x40420f
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call fcn.004f9aad
add esp, 4
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], 0
mov edx, dword [ebp - 4]
mov dword [edx], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [eax], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
shl ecx, 2
push ecx
call fcn.004fa109
add esp, 4
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
jne 0x40428c
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
push 0
push 0
push 0x55d360
call fcn.0051c1dd
push 0
call fcn.004f987d
mov edx, dword [ebp - 4]
mov eax, dword [edx]
shl eax, 2
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
push ecx
call fcn.004fa250
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 4
Function at 0x428d70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0x104
call fcn.004fa109
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x428db2
push 0
push 0
push 0x55ede4
call fcn.0051c1dd
push 0
call fcn.004f987d
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ecx + 0x100], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x428e66
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x104
call fcn.004fa109
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x428e9a
push 0
push 0
push 0x55edf8
call fcn.0051c1dd
push 0
call fcn.004f987d
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.004fa590
add esp, 8
mov edx, dword [ebp - 4]
mov dword [edx + 0x100], 0
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x100], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 8]
add eax, 1
mov ecx, dword [ebp - 8]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret 4
Function at 0x428f72
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
cmp eax, dword [edx + 4]
jne 0x428f95
xor eax, eax
jmp 0x429094
mov ecx, dword [ebp - 0x14]
call fcn.00429100
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
sub ecx, 1
cmp dword [ebp + 8], ecx
jle 0x428fb8
cmp dword [ebp + 8], 0
jge 0x428fb8
xor eax, eax
jmp 0x429094
cmp dword [ebp + 8], 0
jne 0x428fcf
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.00428ee4
jmp 0x429094
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x100]
mov dword [ebp - 4], edx
mov dword [ebp - 8], 0
cmp dword [ebp - 4], 0
je 0x429092
mov eax, dword [ebp + 8]
sub eax, 1
cmp dword [ebp - 8], eax
jne 0x429078
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x100]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x429020
push 0
push 0
push 0x55ee0c
call fcn.0051c1dd
push 0
call fcn.004f987d
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004fa590
add esp, 8
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x100]
mov dword [edx + 0x100], ecx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, dword [edx + 4]
jne 0x429056
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 0x10]
push eax
call fcn.004f9aad
add esp, 4
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
sub edx, 1
mov eax, dword [ebp - 0x14]
mov dword [eax + 8], edx
mov eax, 1
jmp 0x429094
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x100]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x428fe4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x45fdcb
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp + 0x18]
push edx
call fcn.004fa910
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jl 0x45fe00
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x45fe08
xor ax, ax
jmp 0x45ff3b
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 8]
add eax, 7
sar eax, 3
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
sar edx, 3
add ecx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call dword [fcn.0053c3bc]
mov dword [ebp - 0xc], eax
mov dx, word [ebp + 8]
mov word [ebp - 0x20], dx
mov ax, word [ebp + 0x10]
mov word [ebp - 0x18], ax
mov cx, word [ebp + 0xc]
mov word [ebp - 0x14], cx
mov dx, word [ebp + 0x14]
mov word [ebp - 8], dx
pushaw
xor ecx, ecx
mov cx, word [ebp - 0x20]
and cx, 7
mov byte [ebp - 0x34], 0xff
shr byte [ebp - 0x34], cl
mov dx, word [ebp - 0x18]
and dx, 7
inc dx
mov cl, 8
sub cl, dl
mov byte [ebp - 0x1c], 0xff
shl byte [ebp - 0x1c], cl
mov ax, word [ebp - 0x20]
shr ax, 3
mov word [ebp - 0x30], ax
mov ax, word [ebp - 0x18]
shr ax, 3
mov word [ebp - 4], ax
cmp ax, word [ebp - 0x30]
jne 0x45fea9
mov al, byte [ebp - 0x1c]
and byte [ebp - 0x34], al
mov byte [ebp - 0x1c], 0
mov edi, dword [ebp - 0x24]
add edi, dword [ebp - 0xc]
mov ax, word [ebp - 8]
sub ax, word [ebp - 0x14]
inc ax
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x28], 0
lea ebx, [0x56058c]
xor dx, dx
xor ah, ah
mov al, byte [edi]
and al, byte [ebp - 0x34]
xlatb
add dx, ax
inc edi
mov cx, word [ebp - 4]
sub cx, word [ebp - 0x30]
jecxz 0x45fef0
dec cx
jecxz 0x45fef0
mov al, byte [edi]
xlatb
add dx, ax
inc edi
loop 0x45fee7
cmp byte [ebp - 0x1c], 0
je 0x45feff
mov al, byte [edi]
and al, byte [ebp - 0x1c]
xlatb
add dx, ax
mov edi, dword [ebp + 0x18]
add edi, dword [ebp - 0x28]
add edi, dword [ebp - 0x28]
inc dword [ebp - 0x28]
mov word [edi], dx
xor eax, eax
mov ax, word [ebp - 0x2c]
cmp dword [ebp - 0x28], eax
jge 0x45ff29
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
add edi, esi
mov dword [ebp - 0x24], edi
add edi, dword [ebp - 0xc]
jmp 0x45feca
popaw
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 4]
push ecx
call dword [fcn.0053c3b0]
xor ax, ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x45ff44
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp + 8]
lea ecx, [eax + eax + 2]
push ecx
push 0
mov edx, dword [ebp + 0x18]
push edx
call fcn.004fa910
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp + 8]
jl 0x45ff79
mov ecx, dword [ebp + 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x45ff81
xor ax, ax
jmp 0x460091
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 8]
add eax, 7
sar eax, 3
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
imul ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 8]
sar edx, 3
add ecx, edx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 4]
push ecx
call dword [fcn.0053c3bc]
mov dword [ebp - 0xc], eax
mov dx, word [ebp + 8]
mov word [ebp - 0x20], dx
mov ax, word [ebp + 0x10]
mov word [ebp - 0x1c], ax
mov cx, word [ebp + 0xc]
mov word [ebp - 0x18], cx
mov dx, word [ebp + 0x14]
mov word [ebp - 8], dx
mov eax, dword [ebp + 0x14]
sub eax, dword [ebp + 0xc]
add eax, 1
mov word [ebp - 0x28], ax
pushaw
xor ecx, ecx
mov cx, word [ebp - 0x20]
and cx, 7
mov byte [ebp - 0x30], cl
mov dx, word [ebp - 0x1c]
and dx, 7
inc dx
mov byte [ebp - 0x14], dl
mov ax, word [ebp - 0x20]
shr ax, 3
mov word [ebp - 0x2c], ax
mov ax, word [ebp - 0x1c]
shr ax, 3
mov word [ebp - 4], ax
mov edi, dword [ebp - 0x24]
add edi, dword [ebp - 0xc]
xor cx, cx
mov esi, dword [ebp + 0x18]
mov al, byte [edi]
mov cl, byte [ebp - 0x30]
shl al, cl
mov dl, 8
sub dl, cl
xchg cl, dl
shl al, 1
adc word [esi], 0
inc esi
inc esi
loop 0x46002c
inc edi
mov dx, word [ebp - 4]
sub dx, word [ebp - 0x2c]
je 0x460069
dec dx
je 0x460058
mov al, byte [edi]
mov cl, 8
shl al, 1
adc word [esi], 0
inc esi
inc esi
loop 0x460049
inc edi
dec dx
jne 0x460045
mov cl, byte [ebp - 0x14]
jecxz 0x460069
mov al, byte [edi]
shl al, 1
adc word [esi], 0
inc esi
inc esi
loop 0x46005f
dec word [ebp - 0x28]
je 0x46007f
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x10]
add edi, esi
mov dword [ebp - 0x24], edi
add edi, dword [ebp - 0xc]
jmp 0x460019
popaw
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [fcn.0053c3b0]
xor ax, ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x460716
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0x10], 1
je 0x460747
mov ecx, dword [ebp - 0x30]
call fcn.00468b98
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x30]
call fcn.00463689
mov eax, 1
jmp 0x4608e4
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 8]
add edx, 7
sar edx, 3
mov word [ebp - 0x24], dx
mov eax, dword [ebp - 0x30]
mov cx, word [eax + 0xc]
mov word [ebp - 0x1c], cx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
add eax, 7
sar eax, 3
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp - 0x30]
mov dx, word [ecx + 8]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x30]
mov cx, word [eax + 8]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x24]
and edx, 0xffff
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
sub ecx, 1
mov edx, dword [ebp - 0x24]
and edx, 0xffff
imul ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0xc]
add ecx, 7
sar ecx, 3
mov edx, dword [ebp - 0x30]
imul ecx, dword [edx + 8]
push ecx
push 2
call dword [fcn.0053c3b8]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4607dd
call fcn.00428561
xor eax, eax
jmp 0x4608e4
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [fcn.0053c3bc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [fcn.0053c3bc]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 8], 0
je 0x460806
cmp dword [ebp - 0x28], 0
jne 0x46083a
cmp dword [ebp - 8], 0
je 0x460819
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 4]
push ecx
call dword [fcn.0053c3b0]
cmp dword [ebp - 0x28], 0
je 0x460829
mov edx, dword [ebp - 0xc]
push edx
call dword [fcn.0053c3b0]
mov eax, dword [ebp - 0xc]
push eax
call dword [fcn.0053c3b4]
xor eax, eax
jmp 0x4608e4
pushaw
xor ecx, ecx
xor edx, edx
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 8]
add esi, dword [ebp - 0x10]
mov cx, 8
cmp word [ebp - 0x18], cx
ja 0x460857
mov cx, word [ebp - 0x18]
sub word [ebp - 0x18], cx
push esi
mov bx, word [ebp - 0x1c]
mov dx, 8
cmp bx, dx
ja 0x46086c
mov dx, bx
sub bx, dx
xor al, al
mov ah, byte [esi]
rcr ah, cl
rcl al, 1
sub esi, dword [ebp - 4]
dec dx
jne 0x460871
stosb byte es:[edi], al
cmp bx, 0
jne 0x460860
dec cl
pop esi
jne 0x46085b
inc esi
cmp word [ebp - 0x18], 0
jne 0x460849
popaw
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call dword [fcn.0053c3b0]
mov eax, dword [ebp - 0xc]
push eax
call dword [fcn.0053c3b0]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ecx + 4]
push edx
call dword [fcn.0053c3b4]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], ecx
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
mov dword [ecx + 8], eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x473a8a
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x537d49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push esi
mov dword [ebp - 0x64], ecx
lea ecx, [ebp - 0x54]
call fcn.00409000
lea ecx, [ebp - 0x2c]
call fcn.00409000
lea ecx, [ebp - 0x44]
call fcn.00409000
lea eax, [ebp - 0x54]
push eax
push 1
mov ecx, dword [ebp - 0x64]
add ecx, 0x1a8
call fcn.0051c48e
mov ecx, dword [ebp - 0x54]
add ecx, 1
mov dword [ebp - 0x54], ecx
mov edx, dword [ebp - 0x50]
add edx, 1
mov dword [ebp - 0x50], edx
mov eax, dword [ebp - 0x4c]
sub eax, 1
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
lea edx, [ebp - 0x2c]
push edx
push 0
mov ecx, dword [ebp - 0x64]
add ecx, 0x1a8
call fcn.0051c48e
mov ecx, dword [ebp - 0x64]
add ecx, 0x1a8
call fcn.004171e0
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x54]
call fcn.00403280
cdq
sub eax, edx
mov esi, eax
sar esi, 1
lea ecx, [ebp - 0x2c]
call fcn.00403280
lea ecx, [esi + eax - 0xa]
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x54]
call fcn.00403280
imul eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
add ecx, 1
cdq
idiv ecx
mov edx, dword [ebp - 0x54]
add edx, eax
mov dword [ebp - 0x4c], edx
mov eax, dword [ebp - 0x4c]
add eax, 1
mov dword [ebp - 0x44], eax
push 0x800000
lea ecx, [ebp - 0x18]
call fcn.00518927
mov dword [ebp - 4], 0
push 0x808080
lea ecx, [ebp - 0x5c]
call fcn.00518927
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x54]
push edx
mov ecx, dword [ebp - 0x60]
call fcn.00409990
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x44]
push ecx
mov ecx, dword [ebp - 0x60]
call fcn.00409990
mov eax, dword [ebp + 0x10]
imul eax, eax, 0x64
mov ecx, dword [ebp + 0xc]
sub ecx, dword [ebp + 8]
add ecx, 1
cdq
idiv ecx
push eax
push 0x560c90
lea edx, [ebp - 0x1c]
push edx
call fcn.004fa9f4
add esp, 0xc
mov byte [ebp - 0x19], 0x25
push 1
mov ecx, dword [ebp - 0x60]
call fcn.00517f31
mov dword [ebp - 0x10], eax
push 0xffffff
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x60]
call dword [edx + 0x30]
mov dword [ebp - 0x34], eax
push 4
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0x30]
push edx
mov eax, dword [ebp - 0x60]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x60]
call dword [edx + 0x5c]
mov eax, dword [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x60]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x60]
call dword [edx + 0x30]
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x60]
call fcn.00517f31
mov ecx, dword [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x64]
add ecx, 0x1a8
call fcn.00417200
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x5c]
call fcn.00409760
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00409760
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b88a8
Capabilities:
Packed with generic packer

Disassembly:
push esi
mov ax, ax
shr edi, 0x40
mov bp, bp
ja 0x4bd479
jbe 0x4af11d
cpuid
nop
ret
xchg ebp, ecx
xchg ecx, ebp
mov esi, dword [ebp + 8]
push ecx
pop ecx
mov bl, byte [esi + 0xba]
cmp bl, 1
ja 0x4bd479
xchg al, ch
xchg ch, al
jbe 0x4af13e
cwde
rcr byte [esi], cl
mov al, byte [esi + 0xbb]
push edi
jno 0x4c2a02
mov bl, bl
jo 0x4af153
inc esp
aas
pushal
jo 0x4c2a02
fstp dword [ebp + 0x52]
invalid
rcr dword [ebx + 0x1f105850], 1
jmp dword [esi]
lea esp, [esp + 4]
jne 0x4bcf9c
je 0x4b88b8
cpuid
nop
ret
je 0x4bcf9c
invalid
xchg si, ax
shl ch, 0x20
shl ax, 0x20
xchg si, ax
push ebx
js 0x4af107
jns 0x4bcfb4
cmp ebx, 0x4d890f20
and edi, edi
inc edi
leave
mov ebx, dword [esi + 8]
mov al, byte [ebp + eax]
shl ch, 0x20
lea esi, [esi + 0xc]
xor byte [ebp + ebx], al
jb 0x4b4db4
jns 0x4af107
invalid
shl bx, 0x20
mov edx, edx
xchg di, ax
xchg di, ax
call fcn.004a7998
fsqrt
mov eax, dword [esi + 4]
mov ebx, ebx
mov ebx, dword [esi + 8]
mov ebx, dword [ebp + ebx]
lea esi, [esi + 0xc]
sbb dword [ebx], eax
jmp dword [esi]
shl esi, 0x20

Function at 0x4bb7e2
Capabilities:
Encode data using xor

Disassembly:
and esi, 0x9fffffff
jb 0x4a949d
mov eax, esi
pop esi
ret
or esi, 0xc0000000
jb 0x4a94a6
mov eax, esi
push eax
pop eax
pop esi
mov di, di
ret
xchg edi, eax
push 0x4655870f
add dword [eax], eax
jbe 0x4a94a0
add eax, dword [edx]
mov al, 0xf
xchg byte [edx + 0x46], cl
add dword [eax], eax
jbe 0x4bdaf0
fpatan
dec edi
lcall 0xee85, 0x820ff688
invalid
push ss
dec edx
shl ebx, 0x20
jne 0x4b1de5
je 0x4abc40
invalid
ja 0x4b923b
jbe 0x4b803e
mov eax, dword [0xf9a0420]
xchg bh, dh
adc dword [eax], eax
add byte [edx + 0x24648dd5], al
lea esp, [esp + 4]
ja 0x4ac28d
mov al, al
shr al, 0x40
jbe 0x4b923b
je 0x4c005a
mov dword [0x5718f4], 1
call fcn.004a0af7
test eax, eax
jb 0x4abc1e
je 0x4c005a
jne 0x4bb2bf
nop
cpuid
ret 0xf089
mov eax, esi
mov dword [0x5718f0], 1
and eax, 0x1fffffff
jb 0x4abc30
lea edx, [edx]
pop esi
jmp fcn.004abbdc
push esi
call dword [fcn.0053c3a8]
mov esi, eax
mov eax, dword [0x5718f4]
ja 0x4c0862
jbe 0x4bb7fc
cpuid
add bl, 0xf
xchg byte [eax + 0x50], ah
add byte [eax], al
jbe 0x4c0862
invalid
xchg bp, cx
xchg cx, bp
mov bx, bx
shr bl, 0x40
js 0x4b8032
jns 0x4bdb08
invalid
jns 0x4b8032
test esi, 0x80000000
jb 0x4abc46
mov ebx, ebx
mov eax, esi
je 0x4a0ac3
push dword [ebp + 4]
jne 0x4c0076
cpuid
and eax, ebx
add ch, 0x4c
sub ch, 0x4c
and eax, 0xff
jb 0x4b1e00
cmp eax, 3
ja 0x4a0ab5
xchg bh, ch
xchg ch, bh
jbe 0x4c009c
cmp byte [edx - 0x3e994eac], ch
out dx, eax
inc eax
shr di, 0x40
jne 0x4c00cb
je 0x4c00ac
cpuid
jmp 0x4c006f
mov eax, esi
and eax, 0xff00
jb 0x4a9493
cmp eax, 0xb00
ja 0x4a0ab5
jbe 0x4c00c9
adc eax, 0xf688b590
mov dh, dh
sub edi, 0
jae 0x4c00d2
inc edi
outsb dx, byte [esi]
jae 0x4a0aa1
xor eax, 0xe26ffec
iretd
test eax, eax
jb 0x4b5a1b
je 0x4bb29c
jne 0x4c0876
invalid
mov edx, edx
mov eax, dword [0x5718f0]
test eax, eax
jb 0x4b5a24
ja 0x4bb271
jbe 0x4c0891
cpuid
nop
ret
jbe 0x4bb271
xor al, 0xe9
push edx
invalid
Function at 0x4bc37f
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
mov eax, dword [esi + 4]
shl ah, 0x20
call fcn.004b0482
fimul dword [ecx - 0x75]
pop ebp
inc eax
xchg dx, ax
xchg dx, ax
mov edx, dword [esi + 8]
mov si, si
mov ecx, dword [esi + 4]
lea esi, [esi + 0xc]
shl dword [ebx + edx], cl
mov si, si
jmp dword [esi]
lea esi, [esi + 4]
shr cx, 0x40
stc
jmp dword [esi]
mov edx, dword [esi + 8]
ja 0x49e698
jbe 0x4a8d72
cpuid
nop
ret
jbe 0x49e698
fst dword [esi]
mov word [esi + 0xbc], dx
xchg cx, ax
mov bl, bl
js 0x4b486b
xchg si, ax
xchg si, ax
jns 0x4bc38f
nop
cpuid
ret
jns 0x4b486b
fsub dword [eax - 0x77]
cmp al, 0xff
xchg edx, eax
js 0x49f093
jns 0x4bc3aa
cpuid
ret
jns 0x49f093
ficomp dword [ebp - 0x75]
pop ebp
inc eax
jne 0x4a8d63
shl bx, 0x20
je 0x4bc3c3
dec edi
je 0x4a8d63
invalid

Function at 0x4c3e1a
Capabilities:
Encode data using xor

Disassembly:
call fcn.004a43d6
shl edi, 0x20
mov al, byte [ebp + 0xb]
xchg dx, ax
lea ebp, [ebp]
mov cx, cx
xchg dx, ax
push esi
xchg bh, dh
shl ax, 0x20
xchg dh, bh
shr bp, 0x40
mov byte [esi + 0xba], bl
jne 0x4b8009
je 0x4acd2d
std
cpuid
ret
je 0x4b8009
xor eax, 0x44e8b96
ja 0x4a20a5
jbe 0x4b4d03
call 0xfeb615c
xchg byte [ebx + edx*8 - 0x297d0002], bl
xchg esi, ebp
jbe 0x4a20a5
adc dh, 0x87
out dx, al
xchg ebp, esi
mov byte [esi + 0xba], cl
mov byte [esi + 0xbb], 0
mov word [esi + 0xbc], dx
jno 0x4accf8
jo 0x4b4d2e
cmp cl, byte [esi]
int1
jo 0x4accf8
sub byte [esi - 0x74d3ba75], 0x5d
inc eax
shl ebx, 0x20
push 0x4b691e
ret
ja 0x49e204
jbe 0x4b8014
rol byte [edi], 1
fmul dword [edi]
xchg dl, ch
popal
invalid
jbe 0x49e204
xor al, 0x66
jmp dword [esi]
pop dword [esp - 4]
mov byte [esi + 0xba], cl
jno 0x4b4cf7
jo 0x4c3e2e
xor eax, 0xc3800fc8
push cs
invalid
jo 0x4b4cf7
and eax, 0x24448f69
cld

Function at 0x4c4420
Capabilities:
Encode data using xor

Disassembly:
mov ax, word [esp + 8]
push ebx
and ax, 0x8000
push esi
mov dx, word [esp + 0x10]
mov ecx, dword [esp + 0xc]
cmp ax, 1
sbb eax, eax
add dx, dx
inc eax
or ax, dx
mov word [esp + 0x10], ax
xor byte [esp + 0x11], al
mov ax, word [esp + 0x10]
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
and ax, 1
mov dx, word [esp + 0x10]
cmp ax, 1
mov eax, 0
adc eax, 0xffffffff
mov esi, 0x55
and ax, 0x8000
shr dx, 1
or ax, dx
mov word [esp + 0x10], ax
mov eax, 0x58
mov dl, byte [esp + 0x10]
mov bl, byte [esp + 0x10]
and dl, 0x80
add bl, bl
shr dl, 7
add ecx, 2
or dl, bl
mov byte [esp + 0x10], dl
mov dl, byte [esp + 0x11]
and dl, 1
mov bl, byte [esp + 0x11]
shl dl, 7
shr bl, 1
or dl, bl
mov byte [esp + 0x11], dl
mov bl, byte [esp + 0x10]
xor byte [esp + 0x11], bl
mov dx, word [esp + 0x10]
not dx
mov word [esp + 0x10], dx
xor word [ecx - 2], dx
add word [esp + 0x10], si
dec eax
jne 0x4c44a3
pop esi
pop ebx
ret