joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415858
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0x4158b4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], edx
mov dword [eax + 0x24], ecx
xor edx, edx
mov dword [eax + 0x68], edx
mov dword [eax + 0x6c], 0x20
mov eax, 1
pop ebp
ret

Function at 0x4181f8
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret

Function at 0x4182a4
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], edx
mov dword [eax + 0xd4], 0x40
mov eax, 1
pop ebp
ret
Function at 0x429ff8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
dec ebx
mov edi, dword [ebp + 8]
lea eax, [ebx - 0x29]
cmp esi, eax
jle 0x42a02e
push 0x2d
push 0x495ccc
push 0x6e
push 0x79
push 4
call fcn.004345b4
add esp, 0x14
xor eax, eax
jmp 0x42a170
cmp ebx, 0x29
jge 0x42a04f
push 0x33
push 0x495ce4
push 0x78
push 0x79
push 4
call fcn.004345b4
add esp, 0x14
xor eax, eax
jmp 0x42a170
push 0x37
push 0x495cfc
lea edx, [ebx - 0x14]
push edx
call fcn.0041024c
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42a087
push 0x3a
push 0x495d14
push 0x41
push 0x79
push 4
call fcn.004345b4
add esp, 0x14
xor eax, eax
jmp 0x42a170
mov byte [edi], 0
lea edx, [edi + 1]
mov dword [ebp - 8], edx
add edi, 0x15
mov dword [ebp - 4], edi
push 0
call fcn.00436464
push eax
push 0
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 0x1c]
push edx
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00436314
add esp, 0x18
mov edi, ebx
sub edi, esi
mov eax, edi
add eax, 0xffffffd7
push eax
push 0
mov edx, dword [ebp - 4]
add edx, 0x14
push edx
call fcn.00405334
add esp, 0xc
mov ecx, dword [ebp - 4]
mov byte [ecx + edi - 0x15], 1
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp - 4]
add edx, ebx
sub edx, esi
add edx, 0xffffffec
push edx
call fcn.004052c4
add esp, 0xc
push 0x14
mov ecx, dword [ebp - 8]
push ecx
call fcn.004333dc
add esp, 8
test eax, eax
jg 0x42a105
xor eax, eax
jmp 0x42a170
push 0x14
lea ecx, [ebx - 0x14]
mov edx, dword [ebp - 8]
push edx
push ecx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042a410
mov edx, dword [ebp - 4]
add esp, 0x10
mov esi, edx
mov edx, dword [ebp - 0xc]
xor eax, eax
jmp 0x42a12e
mov cl, byte [edx]
inc eax
xor byte [esi], cl
inc esi
inc edx
lea ecx, [ebx - 0x14]
cmp eax, ecx
jl 0x42a127
add ebx, 0xffffffec
lea edx, [ebp - 0x20]
push ebx
mov eax, dword [ebp - 4]
push eax
push 0x14
push edx
call fcn.0042a410
mov edx, dword [ebp - 8]
add esp, 0x10
mov ecx, edx
lea edx, [ebp - 0x20]
xor eax, eax
mov bl, byte [edx]
xor byte [ecx], bl
inc eax
inc ecx
inc edx
cmp eax, 0x14
jl 0x42a155
mov eax, dword [ebp - 0xc]
push eax
call fcn.0041040c
pop ecx
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a178
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x42a2ee
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x42a1af
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
lea ebx, [eax - 0x14]
push 0x7a
push 0x495d2c
push ebx
call fcn.0041024c
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x42a1f1
push 0x7d
push 0x495d44
push 0x41
push 0x7a
push 4
call fcn.004345b4
add esp, 0x14
or eax, 0xffffffff
jmp 0x42a314
push ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.0042a410
add esp, 0x10
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0x24]
cmp eax, 0x14
jge 0x42a224
mov ecx, eax
mov edi, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
inc eax
mov cl, byte [edi + ecx]
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x42a210
push 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call fcn.0042a410
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x10], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0x42a254
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp ebx, eax
jg 0x42a244
push 0
call fcn.00436464
push eax
lea eax, [ebp - 0x38]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.00436314
add esp, 0x18
lea eax, [ebp - 0x38]
push 0x14
push eax
push esi
call fcn.0040558c
add esp, 0xc
test eax, eax
jne 0x42a2ee
cmp dword [ebp - 0xc], 0
jne 0x42a2ee
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x42a2a2
cmp byte [edx], 0
jne 0x42a2a2
inc eax
inc edx
cmp ebx, eax
jg 0x42a297
cmp byte [esi + eax], 1
jne 0x42a2ee
mov ecx, eax
inc eax
cmp ebx, ecx
jle 0x42a2ee
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x42a2d3
push 0x9b
push 0x495d5c
push 0x6d
push 0x7a
push 4
call fcn.004345b4
add esp, 0x14
or ebx, 0xffffffff
jmp 0x42a2e3
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004052c4
add esp, 0xc
push esi
call fcn.0041040c
pop ecx
mov eax, ebx
jmp 0x42a314
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.004345b4
add esp, 0x14
test esi, esi
je 0x42a311
push esi
call fcn.0041040c
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42a4b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42a4cb
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42a4ec
cmp cl, 0x6b
je 0x42a4ec
push 0x72
push 0x495da4
push 0x89
push 0x80
push 4
call fcn.004345b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42a55d
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42a533
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42a533
cmp dl, 0xbb
je 0x42a52e
push 0x81
push 0x495dbc
push 0x8a
push 0x80
push 4
call fcn.004345b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42a4fd
sub esi, ecx
test ecx, ecx
jne 0x42a560
push 0x8a
push 0x495dd4
push 0x8a
push 0x80
push 4
call fcn.004345b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42a58a
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004345b4
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004052c4
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x437098
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4370b1
cmp dword [esi + 8], 0
jne 0x4370b8
xor eax, eax
jmp 0x4371ab
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x4370d3
mov dword [ebp - 4], 1
jmp 0x437130
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x4370f1
cmp eax, 0x7f
jle 0x4370f1
mov ebx, 1
xor ecx, ecx
jmp 0x43712d
cmp dword [ebp - 8], 0
je 0x43712d
cmp eax, 0x80
jle 0x437107
mov ebx, 1
mov cl, 0xff
jmp 0x43712d
cmp eax, 0x80
jne 0x43712d
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x437129
cmp byte [edx], 0
je 0x437127
mov ebx, 1
mov cl, 0xff
jmp 0x43712d
inc eax
inc edx
cmp eax, dword [esi]
jl 0x437119
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x43713b
mov eax, dword [ebp - 4]
jmp 0x4371ab
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x437147
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x437151
mov byte [edx], 0
jmp 0x4371a0
cmp dword [ebp - 8], 0
jne 0x437169
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.004052c4
add esp, 0xc
jmp 0x4371a0
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x43717e
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x437178
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x4371a0
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x437192
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4371b4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x4371ca
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4371e8
push 2
call fcn.0043b4e4
pop ecx
mov esi, eax
test eax, eax
jne 0x4371df
xor eax, eax
jmp 0x437332
mov dword [esi + 4], 2
jmp 0x4371ed
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4a6358
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.0041024c
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x437224
mov eax, 0x41
jmp 0x4372fe
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x437239
mov dword [esi + 4], 2
jmp 0x4372ce
test byte [ebx], 0x80
je 0x4372a7
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x437254
cmp dword [ebp + 0x10], 1
je 0x437254
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x437266
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x43726f
test eax, eax
jne 0x437260
test eax, eax
jne 0x437288
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x4372ce
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x4372ce
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x437297
jmp 0x4372ce
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x4372bd
cmp dword [ebp + 0x10], 1
je 0x4372bd
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.004052c4
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x4372dc
push eax
call fcn.0041040c
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x4372f2
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x437332
push 0x103
push 0x4a636e
push eax
push 0xc2
push 0xd
call fcn.004345b4
add esp, 0x14
test esi, esi
je 0x437330
cmp dword [ebp + 8], 0
je 0x437329
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x437330
push esi
call fcn.0043b534
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4d8978
Capabilities:
Encode data using xor

Disassembly:
call 0x4c0fb9
jmp 0x26ede77a
mov word [esp], ax
pushfd
mov ecx, dword [ecx + 0xc9d98]
push dword [esp]
pushal
call fcn.004ba337
pushal
xchg dword [esp + 0x24], ecx
pushal
lea esp, [esp + 0x44]
jge 0x4c08c8
seta cl
mov ecx, 0x405c08
pushfd
jmp 0x4c20f7
jmp 0x4d2d77
Function at 0x4ddcb6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor di, 0x833
movsx esi, cl
mov edi, dword [ebx + ecx*4]
shr si, cl
add edi, eax
call fcn.004ddf81
rcl ax, cl
mov eax, dword [ebp - 8]
cmp dh, 0x8e
bt dx, 6
shl eax, 1
pushal
push 0x18155202
lea esp, [esp + 0x24]
jge 0x4df83b
je 0x4e06a8
pushal
mov dword [ebp - 4], eax
mov dword [esp], edi
xchg dword [esp + 0x1c], eax
pop eax
movzx ax, al
lea eax, [esi*2 + 0x39410160]
lea eax, [0x3c9df9d]
mov dword [esp + 0x14], 0
lea esp, [esp + 0x14]
jbe 0x4de160
lea eax, [sym.imp.KERNEL32.DLL_LocalAlloc]
call fcn.004e436c
cmp ecx, dword [ebp - 8]
pushal
lea esp, [esp + 0x20]
jbe 0x4e59df
bsr di, bx
add di, 0x65e6
bt si, di
pushfd
sub ecx, 1
clc
pop edi
xadd edi, esi
rcr edi, 0x1e
mov dword [ebp - 4], ecx
adc di, 0xe537
mov ecx, dword [ebp - 8]
pushal
add ecx, dword [ebp - 4]
sal si, cl
pushfd
shr ecx, 1
sbb di, 0xa652
jmp 0x4ddca1
shld eax, ebp, 0x1a
pushfd
mov dword [esp + 4], ebx
aam 0xe5
clc
mov dword [esp], edx
bswap ax
mov eax, dword [ebp + 8]
stc
pushal
test eax, eax
jmp 0x4e5b64
pushal
lea esp, [esp + 0x20]
je 0x4e06a8
call fcn.004e5618
mov byte [edi - 6], bl
xchg ecx, eax
sub byte [esi + 0x20], bl
sbb byte [edi + eax*8 + 0x52], al
int 0x48
mov edx, 0x191c49c6
arpl word [esi], si
push ds
sbb bl, byte [ecx]
cmp eax, 0xf72ff9a1
jp 0x4df858
pop ss
iretd
lea esp, [esp + 0x28]
je 0x4e5db6
jbe 0x4e7484
sbb edi, 0xef14fa84
sar di, cl
add di, cx
bsf di, di
mov edi, dword [edx + 0x24]
cmp ebx, 0xdb3d1d93
bswap bx
add edi, eax
xadd bl, cl
inc ch
mov ebx, dword [edx + 0x20]
rcl cl, 6
btc cx, 1
add ebx, eax
jmp 0x4e71b0
pushal
lea esp, [esp + 0x28]
jbe 0x4e7484
mov di, ax
movzx cx, al
rcl edi, cl
mov edi, dword [edx + 0x24]
movzx cx, bl
add edi, eax
xor ch, ah
shrd ecx, esi, 3
lea ecx, [edx + 0x3fcc539c]
seto bh
mov ebx, dword [edx + 0x20]
ror cx, 6
mov cx, 0xd6b9
add ebx, eax
cmc
sal ch, 2
movzx ecx, al
mov dword [ebp - 8], 0
dec cl
or cl, dl
btc ecx, 5
mov ecx, dword [edx + 0x18]
jmp 0x4decd6
jmp 0x4e7118
push 0xe5411f20
push ebx
jmp 0x4dfb22
pushal
push 0xbd8bc04d
lea esp, [esp + 0x44]
je 0x4e59df
shrd dx, ax, 7
not dx
bsf si, di
rcl si, 6
mov esi, dword [eax + 0x3c]
rcr dl, cl
inc dx
push 0x5d06ef59
add esi, eax
rol dl, 7
xor dx, sp
rol dl, 4
mov edx, dword [esi + 0x78]
mov byte [esp], 0xaf
clc
test edx, edx
pushfd
push eax
jmp 0x4e75f1
stc
bt dx, 0xf
mov dword [ebp - 8], 0
sar ecx, 0x1d
rcr cl, 3
call fcn.004e28ef
mov esp, ebp
movzx ebp, bl
not ebp
pop ebp
push ebx
pushal
push 0xdca29e9f
push dword [esp + 0x28]
ret 0x30
test cl, 0x2d
test bh, 0x21
sub ecx, dword [edx + 0x10]
test al, bh
call fcn.004e3d78
push 0xc40871d5
mov dword [esp + 0x1c], 0xf3923988
pushfd
pushal
lea esp, [esp + 0x40]
jmp fcn.004e9545
lea esp, [esp + 0xc]
je 0x4e59df
rol cl, 4
add edx, eax
cmc
test dl, 0x7f
mov ecx, dword [esi + 0x7c]
cmc
add ecx, edx
test dl, 0xf5
bt ax, 5
mov dword [ebp - 0x10], ecx
bsr cx, dx
bt cx, si
sal cl, cl
cmc
mov ecx, dword [ebp + 0xc]
pushfd
test bh, cl
pushfd
cmp ecx, 0xffff
pushal
jmp 0x4df9c5
Function at 0x4df66a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x28]
je 0x4e06a8
jmp 0x4dff32
movsx ebx, bl
mov ebx, eax
not ah
pushfd
call fcn.004e561e
mov ah, 0xd5
mov cl, 0x98
sub byte [esi - 0xf], bl
invalid
Function at 0x4df747
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor di, 0x833
movsx esi, cl
mov edi, dword [ebx + ecx*4]
shr si, cl
add edi, eax
call fcn.004ddf81
rcl ax, cl
mov eax, dword [ebp - 8]
cmp dh, 0x8e
bt dx, 6
shl eax, 1
pushal
push 0x18155202
lea esp, [esp + 0x24]
jge 0x4df83b
je 0x4e06a8
pushal
mov dword [ebp - 4], eax
mov dword [esp], edi
xchg dword [esp + 0x1c], eax
pop eax
movzx ax, al
lea eax, [esi*2 + 0x39410160]
lea eax, [0x3c9df9d]
mov dword [esp + 0x14], 0
lea esp, [esp + 0x14]
jbe 0x4de160
lea eax, [sym.imp.KERNEL32.DLL_LocalAlloc]
call fcn.004e436c
cmp ecx, dword [ebp - 8]
pushal
lea esp, [esp + 0x20]
jbe 0x4e59df
bsr di, bx
add di, 0x65e6
bt si, di
pushfd
sub ecx, 1
clc
pop edi
xadd edi, esi
rcr edi, 0x1e
mov dword [ebp - 4], ecx
adc di, 0xe537
mov ecx, dword [ebp - 8]
pushal
add ecx, dword [ebp - 4]
sal si, cl
pushfd
shr ecx, 1
sbb di, 0xa652
jmp 0x4ddca1
shld eax, ebp, 0x1a
pushfd
mov dword [esp + 4], ebx
aam 0xe5
clc
mov dword [esp], edx
bswap ax
mov eax, dword [ebp + 8]
stc
pushal
test eax, eax
jmp 0x4e5b64
pushal
lea esp, [esp + 0x20]
je 0x4e06a8
call fcn.004e5618
mov byte [edi - 6], bl
xchg ecx, eax
sub byte [esi + 0x20], bl
sbb byte [edi + eax*8 + 0x52], al
int 0x48
mov edx, 0x191c49c6
arpl word [esi], si
push ds
sbb bl, byte [ecx]
cmp eax, 0xf72ff9a1
jp 0x4df858
pop ss
iretd
lea esp, [esp + 0x28]
je 0x4e5db6
jbe 0x4e7484
sbb edi, 0xef14fa84
sar di, cl
add di, cx
bsf di, di
mov edi, dword [edx + 0x24]
cmp ebx, 0xdb3d1d93
bswap bx
add edi, eax
xadd bl, cl
inc ch
mov ebx, dword [edx + 0x20]
rcl cl, 6
btc cx, 1
add ebx, eax
jmp 0x4e71b0
pushal
lea esp, [esp + 0x28]
jbe 0x4e7484
mov di, ax
movzx cx, al
rcl edi, cl
mov edi, dword [edx + 0x24]
movzx cx, bl
add edi, eax
xor ch, ah
shrd ecx, esi, 3
lea ecx, [edx + 0x3fcc539c]
seto bh
mov ebx, dword [edx + 0x20]
ror cx, 6
mov cx, 0xd6b9
add ebx, eax
cmc
sal ch, 2
movzx ecx, al
mov dword [ebp - 8], 0
dec cl
or cl, dl
btc ecx, 5
mov ecx, dword [edx + 0x18]
jmp 0x4decd6
jmp 0x4e7118
push 0xe5411f20
push ebx
jmp 0x4dfb22
pushal
push 0xbd8bc04d
lea esp, [esp + 0x44]
je 0x4e59df
shrd dx, ax, 7
not dx
bsf si, di
rcl si, 6
mov esi, dword [eax + 0x3c]
rcr dl, cl
inc dx
push 0x5d06ef59
add esi, eax
rol dl, 7
xor dx, sp
rol dl, 4
mov edx, dword [esi + 0x78]
mov byte [esp], 0xaf
clc
test edx, edx
pushfd
push eax
jmp 0x4e75f1
stc
bt dx, 0xf
mov dword [ebp - 8], 0
sar ecx, 0x1d
rcr cl, 3
call fcn.004e28ef
mov esp, ebp
movzx ebp, bl
not ebp
pop ebp
push ebx
pushal
push 0xdca29e9f
push dword [esp + 0x28]
ret 0x30
test cl, 0x2d
test bh, 0x21
sub ecx, dword [edx + 0x10]
test al, bh
call fcn.004e3d78
push 0xc40871d5
mov dword [esp + 0x1c], 0xf3923988
pushfd
pushal
lea esp, [esp + 0x40]
jmp fcn.004e9545
lea esp, [esp + 0xc]
je 0x4e59df
rol cl, 4
add edx, eax
cmc
test dl, 0x7f
mov ecx, dword [esi + 0x7c]
cmc
add ecx, edx
test dl, 0xf5
bt ax, 5
mov dword [ebp - 0x10], ecx
bsr cx, dx
bt cx, si
sal cl, cl
cmc
mov ecx, dword [ebp + 0xc]
pushfd
test bh, cl
pushfd
cmp ecx, 0xffff
pushal
jmp 0x4df9c5
Function at 0x4dfd85
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp + 0x10], bl
push dword [eax]
pop dword [esp + 0x1c]
mov byte [esp + 8], bh
mov byte [esp], 0xf9
mov byte [esp], 0xfa
push dword [esp + 0x1c]
ret 0x20
call fcn.004ded1c
iretd
lea esp, [esp + 8]
je 0x4e06a8
push 0x10f91108
jmp 0x4e5d5b
push dword [esp]
mov dword [ebp - 4], eax
push dword [esp]
pushal
mov dword [esp + 0x28], eax
lahf
mov dword [esp + 0x24], 0
movzx ax, dl
lea eax, [esp - 0x2deaf5e8]
not ah
lea eax, [sym.imp.KERNEL32.DLL_LocalAlloc]
lea esp, [esp + 0x24]
jnp 0x4de1e2
push edx
pushal
mov byte [esp], ch
mov dword [esp + 0x20], 0x4e62f1
jmp 0x4ddc84

Function at 0x4e024f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
call fcn.004de299
clc
or eax, eax
pushfd
lea esp, [esp + 4]
je 0x4e06a8
not bh
mov ebx, eax
call fcn.004e59d1
push ss
push ds
push 0xb25e2881
dec ebx
xchg al, ch
pop ebp
push es
outsb dx, byte [esi]
fnstsw word [esi - 0x54b74172]
xchg esp, eax
adc al, 0xc5
stc
and dword [ebp - 0x41901e48], esp
or esp, edx
push 0xffffffffffffff83
outsd dx, dword [esi]
push edx
fld qword [edi]
jecxz 0x4de88b
sbb ebp, 0xffffffc8
mov ebx, dword [edx - 0x28]
cdq
xor ebx, dword [esi + esi + 0x4718afe0]
xor eax, 0x4b97bb81
inc ecx
mov bl, 0x17
popfd
scasd eax, dword es:[edi]
salc
int3
aad 0xb6
xchg edx, eax
cmp dword [edx + 0x21dfad4], ebx
mov cs, word [edx - 0x1db1ee4b]
jbe 0x4de824
mov ch, 0x32
or eax, 0x45e9744c
into
xor esp, dword [esi - 1]
sub al, 0x30
stc
cmc
cmp al, 9
jmp 0x4de7f1

Function at 0x4e26f2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmc
pushal
pushal
push 0xeccac94d
repne scasb al, byte es:[edi]
pushfd
call fcn.004de985
call fcn.004e2d37
sbb al, byte [eax + 0x5e287eb9]
popal
mov edx, 0x37bd90e4
xor ah, byte [eax + ebp]
sti
jle 0x4de52d
add al, 0x1e
push ds
inc edi
mov byte [0xaa16c295], al
out 0xe5, eax
je 0x2ab67ce8
das
mov esi, ebx
pop ebx
cmp al, 0x57
mov al, 0xd5
inc eax
fnstenv [edx + eax*8 - 0x3c]
dec ecx
cdq
test eax, 0xdbbb3870
hlt
mov dword [esp + 4], esi
push 0x25777b5f
cmp eax, dword [ebp - 0x10]
jmp 0x4e5b1e
lea esp, [esp + 0xc]
jae 0x4e59f1
neg bh
btr bx, bp
bswap bx
push edi
mov ebx, eax
and cl, ah
shr ch, cl
sal di, cl
shld di, ax, cl
mov edi, eax
bswap ecx
pushfd
sar cx, 5
adc cl, dh
mov ecx, 0x104
cmp al, 0x41
cmc
sub al, al
add esp, 8
jp 0x4de505
repne scasb al, byte es:[edi]
call fcn.004e19b8

Function at 0x4e2930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x40]
je 0x4e59df
push 0xd5a91434
jmp 0x4decaf

Function at 0x4e3360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or eax, eax
mov byte [esp], cl
lea esp, [esp + 4]
jne 0x4e06a8
lea ecx, [ecx + 0x449b13d6]
bts cx, ax
shrd cx, bx, cl
btc cx, bx
mov ecx, dword [ebx]
bt esp, eax
or ecx, ecx
jmp 0x4e2900

Function at 0x4e3431
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0xa1
lea esp, [esp + 0xc]
ja 0x4e6d36
bt dx, ax
stc
call fcn.004dd935
cmp al, 9
jmp 0x4e0926