joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42fb71
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, 0x43757a
call fcn.004339e0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x43c770
mov dword [esi + 4], 0x43c758
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 1
call fcn.004028e9
mov ecx, dword [ebp - 0xc]
mov byte [esi + 0x24], 1
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov byte [esi + 0x4c], bl
mov byte [esi + 0x4d], bl
mov dword [esi], 0x43c73c
mov dword [esi + 4], 0x43c724
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x433770
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x433799
xor eax, eax
ret 4
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4337a8
mov eax, 1
ret 4

Function at 0x433db6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ce40
push 0x433db0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x446748], 0xffffffff
or dword [0x44674c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x444730]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x44472c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x446744], eax
call fcn.00433ef9
cmp dword [0x444420], 0
jne 0x433e39
push 0x433ef6
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00433ee4
push 0x444034
push 0x444030
call sub.msvcrt.dll__initterm
mov eax, dword [0x444728]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x444724]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
push 0x44402c
push section..data
call sub.msvcrt.dll__initterm
call dword [sym.imp.msvcrt.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.004312ef
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x63a379
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x63a379
lcall 0x5de5, 0x8b10c483
jmp loc.022edfd0
Function at 0x4017da
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5140aa
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x4018a2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5140aa
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x50dd85
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x401948
cmp edi, dword [esi + 0x7c]
jge 0x401948
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004161ec
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004161ec
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5140aa
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5140aa
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x40189a
jmp 0x40186a
call fcn.0041a413
int3

Function at 0x416021
Capabilities:
Encode data using xor

Disassembly:
inc edx
fdivr dword [edi + 0x467d034]
shl byte [edi + 4], 1
das
mul byte [esi - 0x54094c8e]
cmp al, 0x86
pop ss
push edi
and byte [ebx + 0x7501bb5d], ah
adc dword [ebx + 0x9d613d3], edi
xor dword [edi + 0x5adcfa31], ebx
jge 0x415fdb
imul ebp, ebp, 0xe54165ad
sub dword [ebp - 0x39dd96b9], ecx
test al, 0x8c
xchg ebp, eax
sbb dword [ecx - 0x41e6a302], edi
add eax, 0x872a43bd
mov dword [ebp - 0x2b66dae4], ecx
jb 0x415fdf
aas
add dword [edx], esi
ret 0xd14a
Function at 0x41846a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x52ad3a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x418532
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x52ad3a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x524a15
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x4185d8
cmp edi, dword [esi + 0x7c]
jge 0x4185d8
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0042ce7c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0042ce7c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ad3a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x52ad3a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x41852a
jmp 0x4184fa
call fcn.004310a3
int3

Function at 0x4240da
Capabilities:
Encode data using xor

Disassembly:
inc esi
push es
adc al, 0x26
jbe 0x424130
sal al, cl
ret
insb byte es:[edi], dx
sahf
inc esi
cmp dword [eax - 0x4e], edi
invalid
Function at 0x426f09
Capabilities:
Encode data using xor

Disassembly:
pop ebx
jp 0x426f2d
in eax, 0x5c
pop esp
mov ah, 0xe9
nop
lahf
pop ecx
xor bl, bh
push 0xfffffffffffffff3
les edx, [ecx + 0x37]
xor dword [ecx + 0x43], edx
fucomp st(4)
cmp al, byte [eax - 0x10f6618c]
add byte [ecx], al
insb byte es:[edi], dx
xor eax, 0x3b62e544
cmpsd dword [esi], dword es:[edi]
jns 0x426ee1
inc esp
in eax, 0x62
cmp esp, dword [edi + 0x77abe279]
fldcw word [edx - 0x1013585e]
je 0x426f2d
stosd dword es:[edi], eax
ja 0x426edb
stosb byte es:[edi], al
mov byte [0x74efeca7], al
and al, 0x3f
aas
aas
sbb eax, 0x97815aac
nop
jnp 0x426f4f
adc dword [edi - 0x56c28470], 0x56a716a3
test eax, 0x56a716a3
add ebp, esi
outsb dx, byte [esi]
enter 0xffffffffffffb7ff, 5
mov cl, 0x7b
cmp byte [ebx - 0x6fd15c96], dh
std
sal byte [edi - 0x62], 0x25
or dl, byte [ecx - 0x45]
pop ds
push 0x2c
jo 0x426ef8
mov ebx, 0x702c6a1f
lds ebx, [ebp + eax*4 + 0x6cb9fa75]
jne 0x426f48
pushfd
test dword [ebp - 6], esi
mov ecx, 0xfb0d756c
sti
or eax, ebp
sub dword [edi], esi
jecxz 0x426ed7
fmul qword [edx - 0x53]
sbb eax, 0x2f7acc5a
jp 0x426f79
je 0x426f68
dec ebx
adc dword [ebp - 0x1a5bf31], esp
dec esi
jae 0x426f0d
iretd
inc eax
pop edx
dec byte [esi + 0x73]
mov bh, 0x7d
clc
jge 0x426f50
arpl sp, sp
fsubr qword [ebx + 0x19a2879c]
cmp al, 0x6d
pop ebp
sti
popfd
or al, 0xd
jp 0x426fb2
inc esi
jp 0x426fa7
sbb eax, 0xbc70ec1d
leave
inc eax
pop edi
pushal
out 0x7c, eax
or byte [edx], ah
fdiv st(0), st(0)
and bl, ah
clc
pop ebx
push 0x63
and dh, byte [ecx + 0x3f]
inc edx
sahf
or al, 0x8e
aam 0x5d
fnsave dword [ebx]
outsb dx, byte [esi]
int3
int 0xac
pop es
dec esp
mov es, word [eax + 0x5d]
invalid
pop edx
call 0x2dbe951
leave
mov dword [0xe6e38eaa], eax
pushfd
rcl dword [ebx + 0x4e]
mov ecx, 0x414db726
mov al, 0x61
enter 0xffffffffffffcab2, 0xb
stosd dword es:[edi], eax
stc
mov esi, 0xe3819ac8
pop ecx
fild word [0x4e434244]
into
sbb ch, byte [ebx + 0x63]
int3

Function at 0x42cd65
Capabilities:
Encode data using xor

Disassembly:
aam 0xd1
lcall 0x4d58, 0xb037f1f5
mov ah, bl
xchg dword [edi - 0x5faecdbd], esp
sbb eax, 0x9cb42610
fisttp word [ebx - 0x4d86f074]
les ebp, [edx + ebx*8]
dec edx
sbb dword [ebp + 0x49], ecx
mov dword [0x897ac788], eax
adc bh, dh
out dx, eax
cmp byte [edx - 0x2e], dh
jb 0x42cd39
jb 0x42cd39
sbb eax, 0x21dc8169
cmp eax, 0x484af9b5
pop edx
push cs
aam 0xa6
and al, 0x79
inc esp
invalid
Function at 0x42f0fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x5419ca
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x42f1c2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x5419ca
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x53b6a5
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x42f268
cmp edi, dword [esi + 0x7c]
jge 0x42f268
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00443b0c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00443b0c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5419ca
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x5419ca
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x42f1ba
jmp 0x42f18a
call fcn.00447d33
int3

Function at 0x43d9ae
Capabilities:
Encode data using xor

Disassembly:
fbld tbyte [edi]
add dword [eax], ebp
jecxz 0x43d9fd
cmp eax, 0x1ebca9ae
inc edx
arpl word [eax], di
sub al, 0x14
sbb dword [eax + 0x5e2bb751], edx
adc al, 0x19
nop
push ecx
mov bh, 0x2b
pop esi
je 0x43d9bd
pop es
adc esi, dword [ebp + 0x2f]
lahf
scasd eax, dword es:[edi]
sub byte [edx - 0xafc275a], 0xf6
mov word [ebp + 0x503b5d94], ds
adc dh, byte [edi + 0x45f93595]
int 0xff
push esp
retf 0x1e96
push ds
inc esp
test dword [ebx + ebp*8 + 0x67], esp
pop edx
test byte [esi + 0x49], dl
cmp byte [eax + ebx*2 + 0x3d], dh
pop ss
daa
inc ebp
imul eax, esp, 0x14
insb byte es:[edi], dx
xor al, 0x60
bound esi, qword [ecx - 0x781982ea]
adc edx, dword [ebx - 0x68]
fsub qword [edx + edx*2 - 0x3759ed3c]
leave
aas
outsb dx, byte [esi]
invalid
Function at 0x44593a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x55820a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x445a02

Function at 0x445a5b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x55820a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x551ee5
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x445aa8
cmp edi, dword [esi + 0x7c]
jge 0x445aa8
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0045a34c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0045a34c
add dword [eax], eax
add dword [eax], eax
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x55820a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x55820a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x4459fa
jmp 0x4459ca
call fcn.0045e573
int3
Function at 0x45c19a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call 0x56ea6a
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x45c262

Function at 0x45c2ef
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call 0x56ea6a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call 0x568745
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x45c308
cmp edi, dword [esi + 0x7c]
jge 0x45c308
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.00470bac
mov eax, dword [esp + 0x20]
inc esp
and al, 0x20
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00470bac
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56ea6a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call 0x56ea6a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x45c25a
jmp 0x45c22a
call fcn.00474dd3
int3

Function at 0x472d9a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
inc esp
and al, 0x34
Function at 0x472e21
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x472e62
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0058566a
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.0057f345
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x472f08
cmp edi, dword [esi + 0x7c]
jge 0x472f08
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.004877ac
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.004877ac
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0058566a
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0058566a
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x472e5a
jmp 0x472e2a
call fcn.0048b9d3
int3

Function at 0x4896fb
Capabilities:
Encode data using xor

Disassembly:
or al, 0x14
sbb dl, bl
xchg ecx, eax
popal
push 0xfffffffffffffff9
imul eax, edx, 0x2e52d7e2
out dx, eax
in al, 0x19
aaa
je 0x4896a5
invalid
dec esp
bnd jmp 0x651a452b
invalid
dec edi
dec esi
ja 0x4896a9
mov ecx, 0x62459b38
push esp
xor al, 0x56
inc esp
or ecx, esi
in eax, 0xc4
test eax, 0xd5f59d63
mov edx, 0xf6d22726
add al, 0x68
inc ebp
pop esi
and al, byte [ebx + eax*4 - 0x1ff8ae14]
and al, 0x4c
add eax, 0xa3b7e3b0
movsd dword es:[edi], dword [esi]
jno 0x4896ef
xchg esi, eax
wait
jle 0x489749
jb 0x4896c6
les ebp, [eax - 0x3422b235]
mov dword [edi + edx - 0x6f567f88], esp
punpcklbw mm3, dword [edx - 0x15f33c92]
sbb al, 0xd1
xchg esp, eax
jge 0x48978c
invalid
popfd
invalid
xchg ebp, eax
invalid
xchg ebp, eax
Function at 0x48a10a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov eax, dword [0x581a60]
xor eax, esp
mov dword [esp + 0x34], eax
mov ecx, dword [esi + 0x20]
push ebx
push edi
lea eax, [esp + 0x2c]
xor edi, edi
push eax
push ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
call dword [0x536724]
fld qword [esi + 0x88]
mov eax, dword [esp + 0x34]
fmul qword [0x560e70]
mov ebx, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
lea ebx, [eax - 0x50]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
call fcn.0059c9da
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
cmp dword [esi + 0x7c], edi
jg 0x48a1d2
mov eax, dword [esi + 0x7c]
lea edx, [eax + eax*4]
add edx, edx
add edx, edx
mov dword [esp + 8], edx
fild dword [esp + 8]
fmul qword [esi + 0x88]
call fcn.0059c9da
mov ecx, dword [esp + 0x3c]
pop edi
pop ebx
xor ecx, esp
call fcn.005966b5
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
test edi, edi
js 0x48a278
cmp edi, dword [esi + 0x7c]
jge 0x48a278
mov edx, dword [esi + 0x78]
mov ecx, dword [edx + edi*4]
mov edx, dword [esp + 0x10]
push 1
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
sub ebx, eax
push ebx
push edx
mov dword [esp + 0x18], ecx
push eax
add ecx, 0x138
call fcn.0049eb1c
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
sub ecx, eax
push ecx
mov ecx, dword [esp + 0x24]
sub edx, ecx
push edx
push eax
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0049eb1c
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059c9da
mov ebx, dword [0x536728]
push eax
push 0
lea eax, [esp + 0x14]
push eax
call ebx
fld qword [esi + 0x88]
fmul qword [0x560e70]
call fcn.0059c9da
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
call ebx
inc edi
cmp edi, dword [esi + 0x7c]
jl 0x48a1ca
jmp 0x48a19a
call fcn.004a2d43
int3