joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003b483
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x10061f80
call fcn.10060598
sub esp, 0x50
push ebx
push esi
mov dword [ebp - 0x24], 0x3e76
mov ebx, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x24], 0x3e82
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ecx
jle 0x1003b514
push esi
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], 0x572d
mov eax, edi
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b4e0
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.10004a46
add edi, ebx
dec dword [ebp - 0x1c]
jne 0x1003b4c9
mov edi, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x6459
jl 0x1003b4bf
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x3446
jl 0x1003b4bd
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x24], 0x3adc
jge 0x1003b528
push str.sose_iqfk_irpvs_uzywg_ojidnzonp_wfdjwxdu_fep_rye_lexvad_pukfi_gds
call fcn.10049ba3
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x1003b53e
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
inc dword [eax]
jmp 0x1003b64c
mov dword [ebp - 0x1c], 0x35f
cmp dword [ebp - 0x1c], 0x6ea
jle 0x1003b5b7
mov edi, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov dword [ebp - 0x24], esi
mov ecx, eax
mov dword [ebp - 0x28], edi
mov ebx, esi
sar edi, cl
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x5c]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b57c
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x5c]
call fcn.10004a46
inc ebx
cmp ebx, 0x56c
jl 0x1003b561
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x735d
jl 0x1003b558
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x10c
jl 0x1003b553
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x4dd8
cmp dword [ebp - 0x24], 0x5187
jle 0x1003b5fd
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007c0d8
xor eax, edi
cdq
push edx
push eax
call fcn.100042cb
inc ebx
cmp ebx, 0x4f3e
jl 0x1003b5cb
inc edi
cmp edi, 0x1bbd
jl 0x1003b5c9
push esi
push esi
push 1
push esi
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], esi
cmp dword [ebx], 3
jge 0x1003b619
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebx]
mov eax, dword [edx]
mov dword [eax + ecx*4], 1
inc dword [ebx]
cmp dword [ebx], 3
jl 0x1003b607
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x4b67
jge 0x1003b638
mov edx, str.fqqvstdv_scqka_dcrmbzr
mov ecx, 0x1007c0d8
call fcn.10006d07
cmp dword [ebp - 0x1c], 0x2b5
jge 0x1003b64c
push str.jadsigvgf_cnyigpy_uxqwxatw_fdzxk_mfeaglnxa_wwwjnut_mfqxjarjr_vdamhqr_nhruvfv_cnzngpl
call fcn.10049ba3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b677
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x40
cmp byte [ebp + 0x20], 0
push ebx
push edi
mov edi, edx
mov ebx, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
je 0x1003b737
mov dword [esp + 0xc], 0x630c
cmp dword [esp + 0xc], 0x666c
jle 0x1003b6fc
xor ebx, ebx
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
and eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b6c8
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004a46
inc edi
cmp edi, 0x5ab7
jl 0x1003b6ae
inc ebx
cmp ebx, 0x5fcc
jl 0x1003b6ac
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, dword [esp + 0x10]
mov dword [edi], 0
cmp dword [edi], 2
jge 0x1003b719
mov edx, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, dword [edx]
or dword [eax + ecx*4], 0xffffffff
inc dword [edi]
cmp dword [edi], 2
jl 0x1003b70a
cmp dword [esp + 0xc], 0x6104
jge 0x1003b7ca
push str.bwjnpravq_dginthq_zluvppkbj_jxtbe_mady_ztvpf_vas
call fcn.10049ba3
pop ecx
jmp 0x1003b7ca
mov dword [esp + 0xc], 0x7acc
cmp dword [esp + 0xc], 0x7ad9
jle 0x1003b790
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
cdq
lea ecx, [esp + 0x30]
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b766
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.10004a46
inc ebx
cmp ebx, 0x622c
jl 0x1003b74d
inc edi
cmp edi, 0x1ce9
jl 0x1003b74b
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0x7ab2
jge 0x1003b7a5
push str.hldrik_dzngcx_irxacrhxa_hyxkthqr_ggyfmvfaj_dbgr_ifi_ynkcdhcq_wvsq_rgovcez_pue_cjhrkp_qmoyopct_hcz
call fcn.10049ba3
pop ecx
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebx]
push dword [eax]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
push dword [eax]
mov eax, dword [ebp + 0x14]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp + 0x24]
push dword [eax]
call fcn.100371f9
add esp, 0x10
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b805
Capabilities:
Delete file

Disassembly:
mov eax, 0x10061f8a
call fcn.10060598
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x18], edi
je 0x1003b870
cmp byte [ebp + 0x20], 0
je 0x1003b84e
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1003b966
push 0x26c7
push 0x31b
push ecx
push 0
push ecx
mov cl, 1
jmp 0x1003b954
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
jmp 0x1003b866
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 4
jl 0x1003b859
jmp 0x1003b966
mov dword [ebp - 0x14], 0x601
cmp dword [ebp - 0x14], 0x7f8
jle 0x1003b8c1
xor esi, esi
mov dword [ebp + 0xc], esi
xor ebx, ebx
mov eax, esi
mov esi, 0x22f8
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x1007c0d8
cdq
push edx
push eax
call fcn.100042cb
inc edi
dec esi
jne 0x1003b893
mov esi, dword [ebp + 0xc]
inc ebx
cmp ebx, 0x6d71
jl 0x1003b887
inc esi
mov dword [ebp + 0xc], esi
cmp esi, 0x7a3d
jl 0x1003b885
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x590
jge 0x1003b8fc
mov edx, str.knlzzk_byvdohfn_vezfqzv_tkjc
mov ecx, 0x1007c0d8
call fcn.10006d07
jmp 0x1003b8fc
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1003b95e
mov eax, dword [edi]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [ebp + 0x24]
mov dword [eax], 0
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx]
sub ecx, 9
mov eax, dword [eax]
cmp ecx, dword [eax + 8]
jle 0x1003b944
push 0x6b09
push ecx
push dword [ebp + 0x28]
mov cl, 1
push 0x7c3b
push edi
call fcn.100396e9
jmp 0x1003b959
push 0x436d
push 0x2975
push ecx
push 0
push ecx
xor cl, cl
call fcn.10039add
add esp, 0x14
jmp 0x1003b966
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bd49
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061fa8
call fcn.10060598
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x4e0f
mov edi, edx
cmp dword [ebp - 0x14], 0x5088
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
jle 0x1003bdb2
push 0x551
call dword [sym.imp.GDI32.dll_EndDoc]
xor esi, esi
mov ebx, esi
mov edi, esi
mov eax, edi
mov ecx, 0x1007c0d8
xor eax, ebx
cdq
push edx
push eax
call fcn.100042cb
inc edi
cmp edi, 0x209e
jl 0x1003bd82
inc ebx
cmp ebx, 0x2e9c
jl 0x1003bd80
push esi
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov edi, dword [ebp - 0x18]
jmp 0x1003bdb4
xor esi, esi
cmp byte [ebp + 0x14], 0
je 0x1003bdd5
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
cmp dword [ecx], esi
je 0x1003bdcf
mov eax, dword [ebp + 0xc]
cmp dword [eax], esi
je 0x1003bdcf
xor eax, eax
inc eax
jmp 0x1003bdd1
mov eax, esi
mov dword [ecx], eax
jmp 0x1003bdee
mov dword [edi], 3
jmp 0x1003bdea
sub esp, 0x14
call fcn.10038787
add esp, 0x14
dec dword [edi]
cmp dword [edi], esi
jge 0x1003bddd
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x4c72
jge 0x1003be09
mov edx, str.cxvu_sayig_ubjaipfd_juvvhp_gpyjm_mijbu_jrujiatcy_whh_gfv_feu_oojuny_fnnghp_bsjr_nlu
mov ecx, 0x1007c0d8
call fcn.10006d07
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f6ad
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x10062154
call fcn.10060598
sub esp, 0x5c
and dword [ebp - 0x1c], 0
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
call fcn.1003c558
push ecx
push eax
lea ecx, [ebp - 0x2c]
call fcn.1003f939
and dword [ebp - 4], 0
add esi, 0xfffffb26
mov edx, dword [ebp - 0x2c]
mov ecx, edx
mov eax, dword [edx + 4]
cmp byte [eax + 0xd], 0
jne 0x1003f711
cmp dword [eax + 0x10], esi
jge 0x1003f6f6
mov eax, dword [eax + 8]
jmp 0x1003f6fa
mov ecx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1003f6ec
cmp ecx, edx
je 0x1003f711
cmp esi, dword [ecx + 0x10]
jl 0x1003f711
mov dword [ebp - 0x20], ecx
lea esi, [ebp - 0x20]
jmp 0x1003f717
mov dword [ebp - 0x24], edx
lea esi, [ebp - 0x24]
mov esi, dword [esi]
lea ecx, [ebp - 0x38]
push 2
pop ebx
push ebx
call fcn.1000457d
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x14], edx
jmp 0x1003f73f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1003f72f
mov dword [ebp - 0x14], edx
jmp 0x1003f764
mov dword [ebp - 0x18], 0x83846275
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0x8bc5
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x1003f749
lea ecx, [ebp - 0x38]
call fcn.10004600
mov eax, dword [0x1007e7a8]
test al, 1
jne 0x1003f7a7
and dword [0x1007e7bc], 0
or eax, 1
mov dword [0x1007e7a8], eax
xor eax, eax
push 0x1006256f
mov dword [0x1007e7c0], 7
mov word [0x1007e7ac], ax
call fcn.10049b79
pop ecx
xor eax, eax
mov dword [ebp - 0x14], 0x3342eb9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x1003f7c1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x1003f7eb
cmp dword [ebp - 0x14], eax
jne 0x1003f7f1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x1003f7e8
push eax
push 0x25ec
push eax
push 0x1eb6
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
je 0x1003f7c6
cmp esi, dword [ebp - 0x2c]
je 0x1003f80e
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [ebp - 0x68]
call fcn.10037176
pop ecx
xor ebx, ebx
mov byte [ebp - 4], 1
inc ebx
jmp 0x1003f81e
push 0x1007e7ac
lea ecx, [ebp - 0x50]
call fcn.100043e0
mov dword [ebp - 4], ebx
push eax
mov ecx, edi
mov dword [ebp - 0x1c], ebx
call fcn.100043e0
or ebx, 4
test bl, 2
je 0x1003f840
push 0
push 1
lea ecx, [ebp - 0x50]
and ebx, 0xfffffffd
call fcn.10004bb8
test bl, 1
je 0x1003f851
push 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10004bb8
lea ecx, [ebp - 0x2c]
call fcn.1001c808
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004066c
Capabilities:
Get file attributes

Disassembly:
push ecx
test cl, cl
je 0x1004067b
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
ret
mov eax, dword [edx]
dec dword [eax + 8]
pop ecx
ret
Function at 0x10040c1f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
push ebx
push esi
mov esi, ecx
je 0x10040c68
cmp byte [ebp + 0x10], 0
je 0x10040c4c
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x10040c96
push ecx
push ecx
mov edx, 0x2357
mov cl, 1
call fcn.1004066c
pop ecx
pop ecx
jmp 0x10040c96
mov edx, dword [ebp + 0x24]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [edx]
sete bl
sub ebx, eax
mov eax, dword [ebp + 0x20]
add dword [eax], ebx
jmp 0x10040c96
cmp byte [ebp + 0xc], 0
je 0x10040c7c
cmp byte [edx], 0
je 0x10040c96
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x10040c91
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x10040c87
pop esi
pop ebx
pop ebp
ret
Function at 0x42c920
Capabilities:
Encode data using xor

Disassembly:
pop esp
cmp eax, 0xa927e55c
cmp al, 0xf7
cmp eax, 0x62a97c40
mov dl, 0xb5
xor esp, dword [ecx - 0x25]
fcmovnb st(0), st(5)
mov cl, dl
cmp byte [esi - 0x2d], bh
inc eax
or bl, bl
enter 0xffffffffffff9309, 0x47
insb byte es:[edi], dx
xor eax, 0xe64ff5af
call 0xd39fd4ef
loop 0x42c8c9
sti
inc ebp
mov ecx, 0xd5b2a0c3
jno 0x42c8f1
and eax, 0xc95e5743
pop edi
push edx
jl 0x42c959
xchg ebp, eax
xchg ebp, eax
and eax, 0x17be4d66
aad 0xbe
cmpsd dword [esi], dword es:[edi]
dec ebp
mov esi, 0xa7bed517
cdq
push ebx
out 0x95, eax
xchg edx, eax
dec esp
les ecx, [ecx + edx*8]
sbb al, 0xe3
pushfd
sbb eax, 0xfc3e717e
xor edi, dword [ecx]
xchg edx, eax
out dx, eax
dec eax
inc edx
sbb eax, 0x5144157a
push ecx
push ds
dec eax
invalid
jno 0x42c8b0
jle 0x42c8c9
dec esp
sub esi, ecx
sar byte [eax], 0x35
xor ch, dl
jl 0x42c927
push 0xe0187856
xchg ebx, eax
mov dword [0x3f4503a8], eax
push esp
dec edx
sar byte [ecx], 1
fcmove st(0), st(0)
fdivr qword [edi + 0x5bd7a8a0]
and dword [esi - 0x4e68b37c], esp
daa
jp 0x42c8f5
add ah, bl
sub al, 0x55
sbb ah, al
xor dword [ebp + 0x28], esi
fcomp dword [eax + ecx*8]
aaa
js 0x42c916
enter 0x7837, 0xffffffffffffffb9
xchg esi, eax
call 0x19d3b938
xor dword [edx], esi
jp 0x42c9a7
jno 0x42c90f
or al, 0xa1
jg 0x42c9e4
mov esi, 0x239693b
push edi
je 0x42c93a
add ebx, dword [esi]
add cl, byte [ebx - 0xa6736cf]
mov bl, 0x54
push esi
xlatb
sal byte [ebp + 0x65], 0xc2
cmp al, byte [ebp - 0x49375bf3]
pop ebx
cmp dword [edi + 0x132c9e7], edx
mov byte [eax], dl
push ds
dec ebx
add al, 0xfd
insb byte es:[edi], dx
iretd
pop ebx
test byte [edi], al
dec ebx
xchg esp, eax
or al, ah
sbb eax, 0x65b539b8
sahf
ror dword [eax - 0x1288cd37], cl
cmc
hlt
invalid
movsd dword es:[edi], dword [esi]
jle 0x42ca50
pop eax
mov cl, 0x44
inc esp
dec esp
add cl, bl
dec edx
mov bl, 0x8b
mov bh, 0x68
cmpsd dword [esi], dword es:[edi]
movsb byte es:[edi], byte [esi]
fidiv dword [edi - 0x204ce576]
push 0xb7daa4a7
mov bl, byte [edx]
mov bl, 0xdf
loope 0x42c9d7
mov edi, 0x752adb69
xlatb
or edi, dword [ebx]
jmp edi
pop esi
pop es
cmc
mov word [ecx + edi*4 - 0xc], ss
add al, 0xd5
js 0x42ca21
rol dword ds:[ebx + 0x1945869c], cl
ret
xchg esi, eax
div dword [esi + 0x33b7b21e]
mov dh, 8
rcr ah, 0x1d
jne 0x42c9ce
cmpsb byte [esi], byte es:[edi]
cmp al, 0x46
push dword [esi]
and eax, 0x195d8bef
xchg ebp, eax
xor ch, ah
xlatb
mov eax, dword [0xdd65fe79]
sbb ecx, dword [ecx + eax*4]
pop ebx
jae 0x42c9dc
mov ecx, 0x324b95e
mov ebp, 0x293b79fc
cmp ebp, dword [ecx]
insd dword es:[edi], dx
mov al, byte [edi]
das
dec edx
pop ss
pop ecx
sbb dword [edx - 0x6371e219], ebp
sbb eax, 0x57
lodsb al, byte [esi]
leave
jecxz 0x42c9fd
stc
add dh, bh
invalid
Function at 0x44c6ae
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004556bd
mov dword [esp + 0x28], 0
test esi, esi
jne 0x44c6f4
xor eax, eax
jmp 0x44c6f7
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.00455cf2
lea eax, [edi + 0x7c]
test eax, eax
je 0x44c712
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.00456057
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x44c750
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.00456057
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004553d7
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.00455d73
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x455eaa
Capabilities:
Encode data using xor

Disassembly:
cmp eax, 0xff896a90
mov ss, edx
sahf
into
popfd
mov cs, word [ebp - 0x15039879]
iretd
idiv byte [eax + esi + 0x26]
jle 0x455e23
scasd eax, dword es:[edi]
add dword [eax + 0x636d1f23], eax
outsd dx, dword [esi]
in al, dx
xor eax, 0x9a657eb
out dx, al
salc
add cl, cl
push es
mov bh, 0x84
cmp eax, 0xafdf36ba
push 0xffffffffffffffb0
add ch, ah
in eax, 0xec
in eax, 0xec
loopne 0x455e86
inc ebp
or al, 0x74
and byte [ecx], al
insb byte es:[edi], dx
inc eax
push esp
xor eax, 0x865b056a
push 0x56b273a9
xchg esp, eax
mov cs, word [eax]
dec ebp
mov bl, byte [ebp - 0x6b255adb]
or al, byte [edi + 0xbc77090]
dec esp
push ebp
dec esi
sbb dword [ebx + 0x6877cc79], ebp
pop edi
sub ah, byte [edi + edi*2 - 0x47]
push esi
test dword [ecx + edi*4 - 0x3b], edi
aam 0xba
and eax, 0x95a90084
lodsb al, byte [esi]
shl edi, 1
inc ecx
mov esp, 0x33368a63
sub eax, 0x4a2230
sub byte [ebp - 0x43], dl
invalid
invalid
Function at 0x457f38
Capabilities:
Encode data using xor

Disassembly:
std
push ebp
test eax, 0xed85d8a0
mov edi, dword [esp + edi + 0x7e]
pushal
out dx, eax
sub dl, bl
imul edi, dword [eax + 0x5163fcc1], 0x55
stosd dword es:[edi], eax
test dword [0x9e5574d9], ecx
and eax, 0x69df55a8
ret
scasd eax, dword es:[edi]
dec ebp
lds esp, [ebx + 0x59]
fisttp word fs:[esi - 0x2103e719]
movsb byte es:[edi], byte [esi]
mov esi, 0x6e7df0b0
and eax, 0x7a8fac07
daa
aad 0x1a
adc eax, 0x90d88a2e
or dword [edi + ebx*8 + 0x6f8ead88], edi
fld qword [edx - 0x742b2d46]
xchg ebx, eax
sub byte [esi - 0x31], 0x5c
sub al, 0x85
cmp al, 0x5b
jl 0x457f99
aas
insd dword es:[edi], dx
inc ecx
sub esi, ebp
jns 0x457f05
jp 0x457fc6
jno 0x457fe6
fnsave dword [esp + ecx*2]
xor al, 0x76
retf
pop esp
cmp ch, ah
rol byte [edi - 0x1551f2a], 1
mov cl, 0xbc
je 0x457fbf
mov edx, 0x7bf3dc5a
iretd
lodsd eax, dword [esi]
jbe 0x457fe2
lodsd eax, dword [esi]
pushfd
push ss
pop ebx
cmp byte [ebx], dl
sub al, 0x85
jno 0x457fee
xchg esp, eax
clc
mov dword [0xd0ad449d], eax
jne 0x457fc5
invalid
push esp
xchg dword [ebx + ecx*4], esi
sub eax, 0xcdb2acd5
sbb al, 0x18
stosb byte es:[edi], al
iretd
movsb byte es:[edi], byte [esi]
ret 0xbc5c
mov cl, 0x1d
sbb bh, cl
cmp dword [eax + 0xc3b9c95], 0x695b1e81
inc eax
xor eax, 0x54a81b2b
cmp ecx, dword [ecx + eax*4]
push ds
pop ebx
imul eax, dword [eax + 0x35], 0x54a81b2b
sbb dword [ebp + 0x63d34885], edi
pop esp
sub edx, esi
loope 0x458073
clc
xlatb
bnd jl 0x457fb2
je 0x457fb1
frstor dword [ebp + 0x40a27488]
pushfd
inc ecx
mov ecx, 0x48266cc8
inc ebp
retf 0x819b
movsd dword es:[edi], dword [esi]
mov edi, 0x186d02e7
sub dword [ebx + 0x3c46c7cd], edi
insd dword es:[edi], dx
sbb byte [ecx], ch
mov ebx, 0x3c46c7cd
lodsb al, byte [esi]
movsb byte es:[edi], byte [esi]
les eax, [esp + 0x1255c474]
lcall 0xc2ec, 0xd3c2472f
push edx
mov esp, ebx
xor al, 0xe0
pop esi
jnp 0x4580ef
adc dword [eax], edi
ja 0x458077
cmc
sbb al, byte [0xc78c97be]
lodsd eax, dword [esi]
sub eax, 0xa54c0502
test al, 0xa4
inc ebx
movsd dword es:[edi], dword [esi]
outsb dx, byte [esi]
sbb ah, al
cmp ah, dl
inc edi
push esi
xor al, 0xee
jp 0x4580ae
or al, 0x60
pop ds
pop edi
test word [edx + 0x6a30f1f5], 0xacc9
hlt
out 0xb1, eax
adc byte [edx - 0x5f], dl
in eax, 0xc4
sub cl, byte fs:[eax]
in al, dx
xchg esp, eax
int3

Function at 0x458f3e
Capabilities:
Check for software breakpoints

Disassembly:
add eax, 0x889b7995
test byte [edx - 0x32], 0x9a
xchg dword [ebx - 0x7d393127], esi
mov dh, dh
dec edx
into
lcall 0x82c6, 0xced9b387
dec ecx
jno 0x458f42
mov ebx, dword [ecx + 0x56]
mov al, 0xb4
sub eax, 0xea9549ba
stc
jno 0x458f77
or eax, 0xc2eb7f5d
xchg ecx, eax
pushfd
scasd eax, dword es:[edi]
pop ds
push eax
shr dword [edx - 0x22e8d9c2], cl
mov cl, 0x6c
cwde
nop
mov esi, 0xf429e9c2
invalid
Function at 0x458f66
Capabilities:
Check for software breakpoints

Disassembly:
add al, 0x50
and byte [edx], cl
inc eax
je 0x458fe1
stc
insb byte es:[edi], dx
pop cx
pop es
push 0x10
invalid
arpl word [esp - 0x54862c83], cx
sbb al, 0x1d
in al, 0xa0
and edx, dword [ebp - 0x5e23ca75]
sbb byte [ebx - 0x2db3c6e4], dh
adc esi, dword [esi + 0x472c2edf]
dec esp
rcl byte [ebx], cl
mov dh, 0xdf
sub al, 0x47
cmp bh, dh
inc edi
push esp
push eax
invalid
push edx
fistp qword [esi]
insb byte es:[edi], dx
loope 0x458fad
outsb dx, byte [esi]
aas
mov bh, 0xdc
clc
mov ebp, 0x4ca57024
adc dword [eax - 0x33], 0x728c65f6
cmp byte [esi], 0x3e
jo 0x458fda
das
mov byte [ecx - 0x34839db1], ch
pushfd
fild dword [edi]
imul dword [ebp + 0x27]
arpl word [eax], si
cld
mov word [ebp - 5], es
pop esi
test eax, 0x67ad3502
or al, 0x79
jl 0x458f98
ret
Function at 0x4a91a7
Capabilities:
Encode data using xor

Disassembly:
jle 0x4a9138
fdiv qword [esi + 0x3e]
aas
pop ebp
push 0xffffffffffffffe8
sub ch, byte [ebp - 0xa3c808c]
sbb eax, 0x237dd440
mov al, 0x73
and al, 0x98
mov al, byte [0xe6c140ec]
cmp byte [0x8acdc73a], 0x67
bound esi, qword [ebx - 0x60]
int3
sbb eax, 0x20cb992e
popfd
or dword [esi - 0x4343ede9], ecx
pushal
pop edx
xchg edi, eax
cwde
add dl, cl
pushfd
hlt
insb byte es:[edi], dx
sub edx, esi
loope 0x4a919c
xor dword ss:[ecx + 0x65af574a], edi
loopne 0x4a9136
lahf
enter 0x741a, 0xffffffffffffffcd
test al, 0x48
clc
cmp eax, 0x7ce24af9
loop 0x4a9225
loop 0x4a9225
jbe 0x4a918e
test dword [esi - 0x63270f17], esi
push cs
in eax, dx
xchg esp, eax
sub eax, 0x200215eb
add al, 0xf5
mov ch, 0x37
mov ebp, 0x88d8e61c
aas
in eax, 0x70
loop 0x4a9178
push ds
mov eax, dword [ebp - 0xe]
invalid
in al, 0x73
cmp byte [ebx - 0x22], al
cmp al, 0x7b
xor esp, dword [edx]
inc edx
mov al, dh
in al, 0x61
outsb dx, byte [esi]
retf 0xeff3

Function at 0x4a9770
Capabilities:
Encode data using xor

Disassembly:
and byte [edx - 0x66], 0xc1
loopne 0x4a97a7
retf 0x8c28
dec edx
movsd dword es:[edi], dword [esi]
adc dword ss:[esi], 0x8ad6718e
mov ebp, 0xc97cdd64