joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100784e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x100785f
xor eax, eax
jmp 0x10078d2
movzx eax, word [ebp + 0xc]
push ebx
push esi
push dword [ebp + 0x18]
shr eax, 4
xor ebx, ebx
inc eax
push eax
push 6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x10078c3
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10078d0
and dword [ebp + 0xc], 0xf
movzx ebx, word [eax]
lea esi, [eax + 2]
je 0x10078a6
mov eax, dword [ebp + 0xc]
lea esi, [esi + ebx*2]
movzx ebx, word [esi]
inc esi
inc esi
dec eax
jne 0x100789b
cmp dword [ebp + 0x14], 0
jne 0x10078b0
mov dword [edi], esi
jmp 0x10078ce
dec dword [ebp + 0x14]
cmp ebx, dword [ebp + 0x14]
jle 0x10078bb
mov ebx, dword [ebp + 0x14]
mov ecx, ebx
rep movsw word es:[edi], word [esi]
mov edi, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
je 0x10078ce
and word [edi + ebx*2], 0
mov eax, ebx
pop esi
pop ebx
pop edi
pop ebp
ret 0x14

Function at 0x1007977
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
push 0
push 0
push dword [ebp + 8]
call esi
mov edi, eax
test edi, edi
je 0x10079cd
inc edi
mov eax, 0x104
cmp edi, eax
ja 0x100799f
mov edi, eax
push ebx
push 2
push edi
call dword [sym.imp.msvcrt.dll_calloc]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x10079b5
xor eax, eax
jmp 0x10079cc
push edi
push ebx
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10079ca
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
jmp 0x10079b1
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1007b1d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100900c]
jne 0x1007b2e
test ecx, 0xffff0000
jne 0x1007b2e
ret
jmp fcn.01007b38
Function at 0x1007c1d
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1002010
call fcn.01007e00
cmp word [0x1000000], 0x5a4d
jne 0x1007c5c
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x1007c5c
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x1007c75
cmp ecx, 0x20b
je 0x1007c62
and dword [ebp - 0x1c], 0
jmp 0x1007c8c
cmp dword [eax + 0x1000084], 0xe
jbe 0x1007c5c
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x1007c86
cmp dword [eax + 0x1000074], 0xe
jbe 0x1007c5c
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100a6b4], 0xffffffff
or dword [0x100a6b8], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x100a690]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100a68c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x100a6bc], eax
call fcn.01007e8c
cmp dword [0x1009010], 0
jne 0x1007ce9
push fcn.01007e8c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01007e75
push 0x1001290
push 0x100128c
call sub.msvcrt.dll__initterm
mov eax, dword [0x100a688]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x100a684]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x1001288
push 0x1001280
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01003fc7
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], 0
jne 0x1007d61
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1007d96
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01007e3b
ret

Function at 0x1007f24
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x100205c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1007f7c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x1002098
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1007f6f
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1007f7e
xor eax, eax
pop esi
leave
ret 4
Function at 0x15e7962
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add edi, 1
rol al, cl
jmp 0x15ec371

Function at 0x15e88c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
stc
bt di, 6
sub al, 0x18
clc
mov word [esp + 8], 0xbfd1
pushfd
not al
pushfd
call fcn.015e774d

Function at 0x15ec64c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.015eec71
push 0xc394b6ad
add edi, 1
inc al
test cl, al
dec al
mov al, byte [edi]
call fcn.015e7e3b
sub al, al
shld ax, si, cl
bsr ax, ax
mov eax, dword [ebp - 8]
call fcn.015ecc58
lea esp, [esp + 0x18]
jp 0x15ec632
pushal
pushfd
xchg dword [esp + 0x20], eax
lahf
pushal
jmp 0x15ed817
mov dword [esp + 0x3c], 0xb
lea esp, [esp + 0x3c]
js 0x15ede47
movsx ax, dl
pushfd
lea eax, [0x18cb282]
push 0x637aaf91
call fcn.018de99c

Function at 0x15ec691
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushfd
mov word [esp], dx
call fcn.015eca3a
mov eax, dword [edx + 8]
pushfd
pushfd
pushal
lea esp, [esp + 0x28]
jmp fcn.0295cb9d
mov edi, dword [edi + ecx*4]
bt di, 9
stc
mov word [esp + 4], 0x9bd3
jmp 0x295ae41
pushfd
lea esp, [esp + 0x1c]
call fcn.015ee564
jmp 0x295625a
pushal
lea esp, [esp + 0x20]
je 0x15ed772
stc
push 0x438e7e1b
clc
add eax, edi
call fcn.015e7144
lea edi, [ebp - 0x3f0031cd]
mov edi, dword [ebp + 8]
pushfd
jmp 0x15ece1d
push eax
lea esp, [esp + 4]
jnp 0x18cb864
je 0x15ed772
call fcn.015eb29e
rcr byte [ecx - 0x69], 1
stosd dword es:[edi], eax
jb 0x18ddeb7
adc eax, ebp
jmp 0x941c0286
mov ch, 0xee
dec ecx
lodsb al, byte [esi]
or dword [ebx - 0x3d17b62f], eax
outsb dx, byte [esi]
aas
in eax, dx
xor cl, byte [eax - 0x4c]
lcall 0x258e, 0x4ee64af5
or byte [ebx], bl
inc ebp
in eax, 0x38
retf
pushal
push esi
mov byte [esp], 0xfa
lea esp, [esp + 0x24]
jne 0x295af8e
jmp 0x15e8c2b
test edi, edi
pushfd
lea esp, [esp + 0xc]
jp 0x18dde6e
pushal
lea esp, [esp + 0x20]
je 0x15ed772
cmc
pushfd
stc
clc
add eax, edi
mov dword [esp], 0x3f8523b1
pushal
cmp eax, edx
pushfd
lea esp, [esp + 0x28]
jb fcn.015ed77c
stc
stc
pushfd
test bl, bh
cmp eax, dword [ebp - 0x10]
lea esp, [esp + 4]
jl 0x15e796c
pushal
mov word [esp + 4], 0x7f52
lea esp, [esp + 0x20]
jae fcn.015ed77c
sal bh, cl
mov ebx, eax
and cl, 0x15
inc di
inc cl
or edi, 0x7538a3c1
mov edi, eax
bsr cx, bx
setl ch
shr cl, cl
mov ecx, 0x104
push 0x9128a12a
cmc
test dx, 0x4efd
xor al, al
add esp, 4

Function at 0x15ec72b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov di, 0x6b47
movzx di, al
mov edi, dword [ebp + 8]
push edi
lea esp, [esp + 0x10]
call fcn.015ee564
jmp 0x18de623
pushal
lea esp, [esp + 0x20]
jne 0x295af8e
lahf
mov eax, dword [edx + 8]
push esi
lea esp, [esp + 4]
jmp fcn.0295cb9d

Function at 0x15ec806
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x2c]
je 0x295cb92
jmp 0x295e47d
mov di, bp
lea edx, [ebx + 4]
movzx si, bl
movzx esi, word [edx + 0x1a]
movsx di, dl
call fcn.015efcf4
shl byte [ebx - 0x41], 0xd3
insb byte es:[edi], dx
and eax, 0x9c412a10
adc edx, dword [ecx + 0x53cf55dd]
retf 0x8a1e
Function at 0x15ec8fd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp], ebx
lahf
movzx ax, al
push 0xbd7c8d41
mov ah, byte [esp]
lea eax, [0x29516cb]
jmp 0x295b161
mov dword [esp], 0x294ead1
pushal
pushal
pushfd
call fcn.015eec52

Function at 0x15ecc3e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x40]
jne 0x2952bd5
call fcn.015ece18
jne 0x15eccc2
jb 0x15ecc85
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, dl
shl eax, 1
invalid
mov dword [esp], 0xc6605418
add al, 0x24
push cs
jmp 0x295d590
add dword ss:[eax - 0x17], esp
adc dword [ebp + 0x36], ecx
add edi, edi
invalid
je 0x15eccb4
or al, 0xc7
inc esp
and al, 0x44
pop esi
mov word [edi - 0x5f], ds
leave
loop 0x15eccfa
add dword [eax - 0x61], esp
mov dword [esp + 4], 0
pushal
mov ah, al
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
call fcn.015eeaa4
inc esp
in al, dx
pop ds
xor eax, dword [esp + ebx*2 + 0x1bbb7011]
sbb cl, byte [eax + 5]
push esi
fcomp dword [ecx - 0x77]
out dx, eax
mov dl, 0x2e
movsd dword es:[edi], dword [esi]
adc byte [edx - 0x24aaff65], bl
popal
invalid
mov word [esp], 0x3319
mov dword [ebp - 4], eax
pushal
xchg dword [esp + 0x20], eax
pop eax
pushfd
lea eax, [ebp*4 - 0x9acff3f]
mov dword [esp + 0x1c], 0
lea esp, [esp + 0x1c]
jl 0x18dda3b
movsx ax, cl
not ah
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
pushfd
mov dword [esp], 0x295061d
push 0xe71dcf1d
mov byte [esp], 0xeb
push dword [eax]
pop dword [esp]
pushal
push edx
mov byte [esp], dh
pushal
push dword [esp + 0x44]
ret 0x48
bswap ax
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
pushal
jmp 0x29553d4
jmp fcn.018cb1a5
lea esp, [esp + 0x24]
je 0x295cb92
push 0x7791f052
jmp 0x15eeff5

Function at 0x15ecc58
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x40]
jne 0x2952bd5
call fcn.015ece18
jne 0x15eccc2
jb 0x15ecc85
xor ch, byte [esi]
insb byte es:[edi], dx
insb byte es:[edi], dx
add cl, dl
shl eax, 1
invalid
mov dword [esp], 0xc6605418
add al, 0x24
push cs
jmp 0x295d590
add dword ss:[eax - 0x17], esp
adc dword [ebp + 0x36], ecx
add edi, edi
invalid
je 0x15eccb4
or al, 0xc7
inc esp
and al, 0x44
pop esi
mov word [edi - 0x5f], ds
leave
loop 0x15eccfa
add dword [eax - 0x61], esp
mov dword [esp + 4], 0
pushal
mov ah, al
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
call fcn.015eeaa4
inc esp
in al, dx
pop ds
xor eax, dword [esp + ebx*2 + 0x1bbb7011]
sbb cl, byte [eax + 5]
push esi
fcomp dword [ecx - 0x77]
out dx, eax
mov dl, 0x2e
movsd dword es:[edi], dword [esi]
adc byte [edx - 0x24aaff65], bl
popal
invalid
mov word [esp], 0x3319
mov dword [ebp - 4], eax
pushal
xchg dword [esp + 0x20], eax
pop eax
pushfd
lea eax, [ebp*4 - 0x9acff3f]
mov dword [esp + 0x1c], 0
lea esp, [esp + 0x1c]
jl 0x18dda3b
movsx ax, cl
not ah
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
pushfd
mov dword [esp], 0x295061d
push 0xe71dcf1d
mov byte [esp], 0xeb
push dword [eax]
pop dword [esp]
pushal
push edx
mov byte [esp], dh
pushal
push dword [esp + 0x44]
ret 0x48
bswap ax
lea eax, sym.imp.KERNEL32.dll_LocalAlloc
pushal
jmp 0x29553d4
jmp fcn.018cb1a5
lea esp, [esp + 0x24]
je 0x295cb92
push 0x7791f052
jmp 0x15eeff5
Function at 0x15ee26c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x295e211
lea esp, [esp + 8]
je 0x295cb92
jmp 0x295ad21
Function at 0x15ee520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
lea esp, [esp + 0x2c]
je 0x295cb92
movzx dx, cl
jmp 0x2955ace

Function at 0x15ee5cc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pop esi
add dword [eax], edx
pop esi
add dword [eax], ebx
pushal
pop esi
add eax, eax
in eax, 0x5e
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [edx + 0x295fe], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebp + 0xf0c2464], cl
test byte [ebp - 0x5597feca], bh
ljmp 0xfc45
movsx ax, bl
call fcn.015eeb70
mov cl, 0x60
loopne 0x15ee65d
pop esp
adc dword [edi], esi
dec esi
mov ah, bh
mov dh, 0x79
aaa
pop ebx
fld qword [esi - 0x6b]
sbb dword [edi - 0x49], eax
jb 0x15ee5a9
or cl, byte [esi + ecx*2]
retf 0xd46c
movsb byte es:[edi], byte [esi]
adc byte [ebx], al
fisttp dword [edi + 0x3a]
daa
mov edi, 0xc10ca771
idiv dword [esp + 0x14bfb0f3]
inc esi
hlt

Function at 0x15efcf4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esi, [esi + edx + 0x1c]
not di
pushal
mov edi, dword [ebp + 8]
mov dword [esp + 4], 0x4ccff4ed
push eax
mov byte [esp + 4], 0x82
lea esp, [esp + 0x28]
call fcn.015ee564
push ebp
pushfd
lea esp, [esp + 8]
jne 0x295af8e
lahf
mov eax, dword [edx + 8]
pushal
push 0x45e1ac13
pushal
push dword [esp]
lea esp, [esp + 0x48]
jmp fcn.0295cb9d

Function at 0x18cb3c7
Capabilities:
Encode data using xor

Disassembly:
push esi
seto al
mov dword [esp + 0x48], 0xb
pushfd
lea eax, [0xcd857ea1]
call fcn.02956e04
add byte [eax], al
dec esp
outsd dx, dword [esi]
arpl word [ecx + 0x6c], sp
inc ecx
insb byte es:[edi], dx
insb byte es:[edi], dx
outsd dx, dword [esi]
arpl word [eax], ax
push ebx
dec eax
inc ebp
dec esp
dec esp
xor esi, dword [edx]
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx - 0x14], bl
xchg ecx, eax
adc dword [esi + 0x784e112e], ebx
cmp al, 0x7a
cmp dword [ecx - 0x4d940fcf], ebp
jb 0x18cb3e0
pop ebp
lcall 0xc55d, 0x95c1911f
sbb eax, 0x54517cc
dec edi
ljmp 0xb214

Function at 0x18cbc24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp ah, dh
cmp edi, ebx
call fcn.0295d44c
cmp ax, 0x8e3c
cmp al, 0xa1
or ecx, ecx
jmp 0x15e713f

Function at 0x18dd9f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x294f997
not bl
pushfd
mov bl, 2
jmp 0x2953b41
inc ecx
setns al
jmp 0x295f1b4
seta al
jmp 0x18dd78d
mov al, 0x10
lea esp, [esp + 8]

Function at 0x18de97d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 8]
call fcn.015ee564
call fcn.0295a38c
push ebp
jmp 0x2956e2a
lea esi, [esi + edx + 0x1c]
lea esp, [esp + 0x2c]
jg 0x2959902
mov di, bp
pushfd
movsx di, al
mov edi, dword [ebp + 8]
pushfd
jmp 0x15ede39
Function at 0x29500e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov di, ax
mov ebx, dword [esp + 8]
push ebx
movsx edi, bl

Function at 0x29500f4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [esp + 0x10]
call fcn.02952071
pushal
push ecx
lea esp, [esp + 0x2c]
je 0x295cb92
call fcn.0295f45f
jo 0x29500eb
cld
or byte [edi + 0x26], 0x10
xlatb
int 0x65
lahf
add al, 0x55
fdiv qword [esp + ebp*8 + 0x4a]
out 0x20, eax
xchg esi, ebp
inc esi
mov eax, 0x2ebf2777
xchg ebx, eax
or dword [ebp - 0x10], edx
push 0xffffffffffffffc8
push ds
fldcw word [ebx - 0x49]
wait
fcom dword [esi + 0x53]
invalid

Function at 0x2950734
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0xc]
jne 0x295af8e
mov al, bl
lahf
mov eax, dword [edx + 8]
pushal
pushfd
lea esp, [esp + 0x24]
jmp fcn.0295cb9d

Function at 0x29516dd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esp, [esp + 0x44]
jne 0x295af8e
call fcn.0295b2cd
jmp 0x18cb196

Function at 0x2951d83
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x24], 0x295dcb1
pushal
call fcn.02951b06
lahf
push ebx
push eax
pushfd
pushal
push 0x728ff43d
mov dword [esp + 0x28], 0xb
movsx ax, al
lea eax, [0x18cb282]
jmp 0x18dde60
lea eax, [ebp - 8]
pushfd
mov dword [esp + 4], eax
lahf
movsx ax, bl
push dword [ebp - 4]
pop dword [esp]
movzx ax, cl
bswap ax
jmp 0x294e66b
lea esp, [esp + 0x30]
je 0x18deb6e
call fcn.018dda2e
cmc
push eax
or eax, eax
pushfd
push esi
mov byte [esp], dh
pushal
lea esp, [esp + 0x2c]
je 0x295cb92
pushfd
movzx bx, dl
movzx bx, cl
movsx bx, dl
mov ebx, eax
jmp 0x29505c8

Function at 0x2952385
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
lea esp, [esp + 0x2c]
call fcn.029594cb
pushfd
lea esp, [esp + 4]
jae 0x15ecca3
cmp di, ax
xor eax, eax
jmp 0x2953480
xor ecx, ecx
pushfd
pushfd
jmp 0x2950715
pushal
lea esp, [esp + 0x20]
call fcn.029594cb
jmp 0x295348f
push 0xaa9a6aa3
lea esp, [esp + 4]
jae 0x15ecb07
call fcn.018dd9f7

Function at 0x29547dc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
pushal
adc al, al
pushfd
lea esp, [esp + 0x48]
jae 0x295f1ba
pushfd
call fcn.0295fe92
jmp 0x294f523

Function at 0x2955127
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov byte [esp], 0xac
pushfd
lea esp, [esp + 8]
jne 0x295af8e
lahf
not ax
mov eax, dword [edx + 8]
pushfd
lea esp, [esp + 4]
jmp fcn.0295cb9d

Function at 0x2956186
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [0x18cb282]
jmp 0x294f517
mov dword [esp + 4], 0x15ec64c
push esi
push edx
mov byte [esp], ah
push dword [eax]
pop dword [esp + 8]
push dword [esp + 4]
push 0x7ddc278b
push dword [esp + 0x10]
ret 0x14
push dword [esp]
jmp 0x18df262
inc eax
mov eax, dword [ebp - 8]
stc
shl eax, 1
jl 0x2956e24
pushfd
mov byte [esp], 0xea
lea esp, [esp + 4]
je 0x295cb92
call fcn.029517d9
call fcn.02959555
jmp 0x29517a9
pushfd
call fcn.029500f4
mov byte [esp], bh
jmp 0x15e7977
Function at 0x295639c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
clc
cmp byte [edi - 1], 0
push 0xc2414cb1
jmp 0x15ecb0f
pushfd
push edx
lea esp, [esp + 0xc]
jb 0x2952731
test dl, 0x34
pushfd
jmp 0x29508c3
jmp 0x2952ad7

Function at 0x2959565
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea esi, [esi + edx + 0x1c]
push 0x5017ad2e
bswap di
mov edi, dword [ebp + 8]
push dword [esp + 8]
push dword [esp]
push 0xc4227ba2
lea esp, [esp + 0x30]
call fcn.015ee564
jmp 0x15eee5b
jmp 0x18caf8c
jne 0x295af8e
pushal
mov eax, dword [edx + 8]
mov word [esp], 0x6df8
pushfd
pushfd
lea esp, [esp + 0x28]
jmp fcn.0295cb9d
pushfd
push esi
lea esp, [esp + 0xc]
je 0x295cb92
movsx dx, al
pushal
xchg si, dx
mov di, cx
lea edx, [ebx + 4]
movsx si, al
not esi
movzx esi, word [edx + 0x1a]
mov word [esp], 0x1de7
not di
movsx edi, al
jmp 0x15e8037

Function at 0x295a38c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [edx + 8]
pushal
mov dword [esp + 4], ebp
lea esp, [esp + 0x20]
jmp fcn.0295cb9d
pushfd
lea esp, [esp + 8]
jne 0x295af8e
movsx ax, al
jmp 0x18de8b1

Function at 0x295ad2f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
seta al
mov eax, dword [edx + 8]
pushfd
pushfd
lea esp, [esp + 0x30]
jmp fcn.0295cb9d

Function at 0x295b2cd
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushal
not al
lahf
mov eax, dword [edx + 8]
mov word [esp], 0x57b5
pushfd
lea esp, [esp + 0x28]
jmp fcn.0295cb9d

Function at 0x295c4b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [ebp - 4]
pop dword [esp + 0x48]
movsx eax, cl
pushfd
mov dword [esp + 0x48], ebx
bswap ax
mov dword [esp + 0x44], 0xb
call fcn.02954372
movzx eax, bl
jmp 0x294f412
mov dword [esp + 0x48], eax
jmp 0x295a1e7

Function at 0x295cbcc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 0x3c], 0x2ce33f10
test al, al
push dword [esp]
call fcn.015ec949
clc
or eax, eax
push 0xc3d88a8d
pushfd
pushal
lea esp, [esp + 0x28]
jne 0x295cb92
stc
mov ecx, dword [ebx]
push 0x68433c2f
pushal
or ecx, ecx
mov byte [esp + 4], ch
call fcn.015ee520
in eax, dx
pushal
mov dword [esp + 8], 0x9911a6c0
pushal
mov dword [esp + 0x3c], 0xe826fd81
push edx
jmp 0x295239b

Function at 0x295ccba
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
push dword [esp]
mov dword [ebp - 4], eax
push ebp
xchg dword [esp + 8], eax
setle ah
pop eax
pushfd
call fcn.0295de53
pushal
jmp 0x15f0375
lea esp, [esp + 0x3c]
jne 0x15ed772
clc
clc
rcr ch, 7
mov ecx, edi
bsf si, ax
sub ecx, ebx
btr si, 2
rcr esi, 0x1d
btc si, 2
mov esi, esp
call fcn.015e7e92
lea esp, [esp + 4]
jge 0x15ecce9
pushfd
mov dword [ebp - 4], eax
jmp 0x15f07f4

Function at 0x295ce41
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
inc al
bt bx, si
xor al, 0xa4
call fcn.015e88c0
jmp 0x294f9a0
Function at 0x295db68
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push dword [esp]
lea esp, [esp + 0x2c]
jne 0x295cb92
not cx
sar ecx, 3
mov ecx, dword [ebx]
push 0x3aa98244
mov byte [esp], al
or ecx, ecx
mov byte [esp], 0xc5
push dword [esp]
lea esp, [esp + 8]
je 0x295cb92
movsx di, bl
push edi
pop edx
lea edx, [ebx + 4]
pushal
jmp 0x294f432

Function at 0x295e01a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg ebp, eax
sbb bp, 0x682e
clc
lea ebp, [esp + 4]
sbb eax, edi
not ah
test bl, dl
sub esp, 0x14
pushal
mov dword [esp + 0x1c], esi
shrd ax, bx, cl
aam 0x7d
lea eax, [ebx + 0x64328dd]
mov dword [esp + 0x18], edi
test bl, al
mov dword [esp + 0x14], ebx
aad 0x31
pushal
bswap ax
mov dword [esp + 0x30], edx
movsx ax, cl
mov eax, dword [ebp + 8]
stc
cmp bl, dh
test eax, eax
call fcn.015ecfb6

Function at 0x295e064
Capabilities:
Resolve function by parsing pe exports

Disassembly:
adc esi, 0x1c545e9c
rcr esi, 0x1c
sar di, cl
mov dword [ebp - 4], ecx
add esp, 0x40
lea esp, [esp + 8]
jbe 0x15ed772
pushal
pushal
dec di
and edi, 0xdf9e59a1
sub ecx, 1
jmp 0x295b114

Function at 0x295fe92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xb97b7006
stosb byte es:[edi], al
pushal
push 0xc49ba2ca
mov word [esp], 0x586f
push esp
lea esp, [esp + 0x30]
jmp 0x29523bc
lea esp, [esp + 8]
jne 0x15ef4d2
pushfd
jmp 0x2952fb2

Function at 0x2960357
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov word [esp], cx
pushfd
pushal
lea esp, [esp + 0x2c]
je 0x295cb92
pushfd
lea ebx, [esp - 0x6c8d8b21]
mov ebx, eax
call fcn.0294f5e4
str word [esp]
pushfd
mov dword [esp], 0xd75e9131
push 0x9efff634
pushfd
mov dword [esp + 4], 0x1d2c080f
pushfd
pushfd
pushfd
lea esp, [esp + 0x10]
jmp 0x2962745
call fcn.02962279
mov dword [esp + 0x14], ebx
pushfd
mov dword [esp + 0x14], ecx
call fcn.0296278f

Function at 0x2960740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [esp + 8], ebp
pushfd
mov word [esp], cx
jmp 0x2961546

Function at 0x2961894
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
pop dword [esp + 0x44]
jmp 0x2963011
rol si, cl
mov dword [esp + 0x40], eax
stc
mov dword [esp + 0x3c], ebx
ror esi, cl
rol si, 1
mov dword [esp + 0x38], ecx
ror si, cl
mov dword [esp + 0x34], edi
clc
mov dword [esp + 0x30], edx
pop esi
pop esi
push dword [0x296240f]
pop dword [esp + 0x24]
movsx esi, al
mov dword [esp + 0x20], 0
movzx si, bl
push dword [esp]
ror si, 4
clc
mov esi, dword [esp + 0x54]
cmc
cmc
mov word [esp + 8], cx
cmc
ror esi, 0x1c
pushal
test bl, 0x48
xor esi, 0xc7a8861f
jmp 0x2962e09