joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10057241
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100572de
push ebx
push esi
call fcn.1005720a
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10054c48
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005728b
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100572dd
push edi
push eax
call fcn.100521d3
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100572ab
call fcn.100509b1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100572dc
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10054c48
add esp, 0x20
test eax, eax
jne 0x100572ca
push edi
call fcn.100509b1
jmp 0x100572d2
push ebx
call fcn.100509b1
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x100572e1
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x100572f2
pop esi
ret
push ebx
push edi
push esi
call fcn.1005720a
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.100521d3
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1005731a
push ebx
push esi
push edi
call fcn.1003a5b0
add esp, 0xc
push 0
call fcn.100509b1
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x100576ea
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1005732f

Function at 0x10059b48
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1004e8df
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10059bb7
cmp esi, dword [ebp - 4]
je 0x10059bb2
cmp dword [ebp + 0xc], 0
je 0x10059bb2
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x10059b8f
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1005969a
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x10059bb9
xor eax, eax
inc eax
jmp 0x10059bb9
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x10059c1e
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100760c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1004e8df
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1004e8df
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x10059c95
cmp word [ecx], dx
je 0x10059c95
mov eax, dword [0x1006dc04]
push edi
dec eax
push eax
push 0x1006daf0
call fcn.10059bbd
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x10059d08
cmp word [eax], dx
je 0x10059d08
mov eax, dword [edi]
test eax, eax
je 0x10059cb9
cmp word [eax], dx
je 0x10059cb9
lea eax, [ebp - 0x10]
push eax
call fcn.100595a0
jmp 0x10059cc2
lea eax, [ebp - 0x10]
push eax
call fcn.1005963b
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10059d32
mov eax, dword [0x1006daec]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1006d7e0
call fcn.10059bbd
add esp, 0xc
test al, al
je 0x10059d32
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10059cfd
cmp word [eax], di
je 0x10059cfd
lea eax, [ebp - 0x10]
push eax
call fcn.100595a0
pop ecx
jmp 0x10059d34
lea eax, [ebp - 0x10]
push eax
call fcn.1005963b
jmp 0x10059cfa
mov eax, dword [edi]
test eax, eax
je 0x10059d1f
cmp word [eax], dx
je 0x10059d1f
lea eax, [ebp - 0x10]
push eax
call fcn.10059555
pop ecx
jmp 0x10059d32
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10059dfd
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10059a42
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10059dfd
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10059dfd
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10059dfd
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10059d8a
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10051062
test ebx, ebx
je 0x10059df8
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10051062
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10059dfd
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10059dfd
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.1005d03a
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10059dff
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10038aec
leave
ret
Function at 0x1005bba6
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100760c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x1005bbe9
call fcn.10041d99
mov dword [eax], 0xf
call fcn.10041dac
mov dword [eax], 0xd
call fcn.1003e0bf
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10038aec
leave
ret
test eax, eax
jne 0x1005bbf0
inc eax
jmp 0x1005bbdd
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x1005bbdb
xor eax, eax
cmp ecx, 1
setne al
jmp 0x1005bbdd

Function at 0x1005ea40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005ea6d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005ea6d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4030ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x417008], 0x8088405
inc edx
mov dword [ebx + 0x417008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40d8d3
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.004049e8
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040692c
mov edi, eax
cmp edi, 0x104
jbe 0x40d8f6
mov eax, edi
add eax, eax
call fcn.00402e0c
mov esi, eax
jmp 0x40d8f8
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.0040692c
push edi
push esi
call fcn.004069c4
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40d931
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40d91b
mov eax, esp
cmp esi, eax
je 0x40d93e
mov eax, esi
call fcn.00402e28
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40d978
cmp bl, 0
je 0x40d974
cmp bl, 0x41
jl 0x40d96f
cmp bl, 0x5a
jg 0x40d96f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40d953
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40d8b8

Function at 0x40f854
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x41cd64
mov eax, esi
mov edx, 8
test al, 1
je 0x40f870
shr eax, 1
xor eax, 0xedb88320
jmp 0x40f872
shr eax, 1
dec edx
jne 0x40f863
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x40f85c
pop esi
ret

Function at 0x40f888
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x41cd60], 0
jne 0x40f8ab
call fcn.0040f854
push 1
push 0x41cd60
call fcn.004067d8
mov eax, edi
test esi, esi
je 0x40f8d6
mov edx, ebx
and edx, 0xff
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x41cd64]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x40f8b1
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x10069bc2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10069bd1
pop dword [ebp - 0x30]
mov eax, 0x23b99b8c
add eax, 0xec4d0045
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x3179c
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x8913c717
sub ecx, 0x89139608
xor edi, edi
add edi, eax
mov edx, 0x9b6c6a8a
sub edx, 0x8b643c8a
add edx, dword [ebp - 0x30]
mov esi, 0x6c6db881
sub esi, 0xcdaa292a
add dword [ebp - 0x24], esi
mov ebx, dword [edx]
sub dword [ebp - 0x2c], 0xfa348dfc
xor ebx, esi
xor dword [ebp - 4], 0x9798b402
mov dword [edi], ebx
add dword [ebp - 0x18], ecx
add edi, 0xf81e402b
add edi, 0x7e1bfd9
add edx, 4
loop 0x10069c2d
add eax, 0xb70f
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xa41e3677
add ecx, 0x6be1c989
add ecx, dword [ebp - 0x30]
call ebx
leave
ret

Function at 0x40169e
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x4042cb], ebp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x404772], eax
xor eax, eax
push eax
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x404706], eax
mov dword [0x4042c3], eax
mov dword [0x4046f2], 0x30
mov dword [0x4046f6], 2
jmp 0x4016df
xor eax, eax
mov dword [0x4046fa], 0x403290
mov dword [0x4046fe], eax
mov dword [0x404702], eax
mov eax, 0x4041c7
mov dword [0x404712], 0xe
mov dword [0x40471a], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40470e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x40470a], eax
mov dword [0x40471e], eax
push 0x4046f2
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4042c3]
push 0
push 0
push 0x1e0
push 0x1fe
push 0xfffff862
push 0xfffff8f8
push 0xcf0000
push 0x4046c8
push 0x4041c7
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x404766], eax
push 5
push eax
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x404766]
call dword [sym.imp.user32.dll_UpdateWindow]
xor edi, edi
lea ebx, [0x404722]
jmp 0x4017a6
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x401798
mov eax, dword [0x40472a]
jmp 0x4017c1
call 0x402a9e
ret
Function at 0x100024be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100024cd
pop dword [ebp - 0x10]
mov eax, 0x86e8731d
add eax, 0x8917b1b0
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x9d6563c1
sub dword [ebp - 0x20], 0x4f131e76
mov dword [ebp - 0x1c], 0x42066b6
sub dword [ebp - 0x1c], 0xd1ed1a71
mov dword [ebp - 0x18], 0xef99d052
sub dword [ebp - 0x18], 0xa34d8c24
mov dword [ebp - 0x14], 0x7d8747b
sub dword [ebp - 0x14], 0x7d8747b
lea eax, [ebp - 0x20]
push eax
mov eax, 0xfc5b84bd
sub eax, 0xec5b4475
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xdfc71a55
sub dword [ebp - 0x20], 0x6b54b0ff
mov dword [ebp - 0x1c], 0x31569f28
sub dword [ebp - 0x1c], 0xefea3db3
mov dword [ebp - 0x18], 0x17cfd041
add dword [ebp - 0x18], 0x4b9f9c2b
mov dword [ebp - 0x14], 0x6a4f4ef7
add dword [ebp - 0x14], 0x95b0b109
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x12314f93
sub eax, 0x2310f17
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3874b
push 0
call eax
mov ecx, 0x1ea48bc0
sub ecx, 0x1ea43c23
mov esi, eax
mov edx, 0xa3f76137
sub edx, 0x93f6cb37
add edx, dword [ebp - 0x10]
mov edi, 0x1345da4c
add edi, 0x54a9b551
sub dword [ebp - 8], ebx
mov ebx, dword [edx]
add dword [ebp - 4], esi
xor ebx, edi
xor dword [ebp - 0xc], ecx
mov dword [esi], ebx
xor dword [ebp - 4], ecx
add esi, 0xa7781109
sub esi, 0xa7781105
add edx, 0xa1aa3563
sub edx, 0xa1aa355f
loop 0x100025ef
add eax, 0x34a86d89
add eax, 0xcb58c3be
xor ebx, ebx
add ebx, eax
add eax, 0x9da7e341
sub eax, 0x9da7e33c
mov ecx, 0x10d0adec
add ecx, 0xff2f5214
invalid
invalid
invalid
invalid

Function at 0x100032c8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10007040]
jne 0x100032d2
repz ret
jmp fcn.100036ab
Function at 0x40c6bd
Capabilities:
Encode data using xor

Disassembly:
push ebx
ficomp word [eax - 0xf]
pop es
mov word [edx - 7], ss
test byte [ecx], 0x5c
popal
cmp cl, dl
mov dh, 0x27
nop
mov byte [0xf4b61893], al
mov dh, 0xf4
xor eax, 0x507b4199
sub esp, dword [edx]
cwde
jae 0x40c642
ret
or eax, esp
je 0x40c5ff
js 0x40c6c9
mov ah, 0xa6
movsd dword es:[edi], dword [esi]
wait
insb byte es:[edi], dx
xchg ecx, eax
xchg esp, eax
push ss
xchg ebx, eax
loopne 0x40c63e
lahf
push ecx
or dword [esi + ebp - 0x3d46ff99], esi
push ecx
jnp 0x40c614
push esi
mov al, 0xe5
mov al, 0x23
dec ecx
rol byte [esi], cl
xchg edi, eax
push esp
adc al, 0x6b
loopne 0x40c653
invalid
outsb dx, byte [esi]
sbb dh, cl
jp 0x40c666
xchg esp, eax
movsb byte es:[edi], byte [esi]
clc
aam 0x9d
or eax, 0x160a1f7f
pop ds
or dl, byte [esi]
mov ch, 0x94
jne 0x40c744
fistp word [edi + 0x7a7e387d]
xor byte [ebx + eax*8 + 0x24], al
inc ebp
cld
mov esp, 0xd454aaca
fdivrp st(1)
xchg esp, eax
pushal
jno 0x40c691
push ebp
rcr byte [ebx + 0x7b6a7537], cl
imul eax, esp, 0x895cbc86
cmp dl, ah
push eax
inc ebx
sbb edi, eax
or bh, byte [esi - 0x5fc8c6c6]
std
sub edi, edx
in eax, dx
mov ah, byte [ecx - 0x2f]
push edx
mov esi, dword [esp + 0x3a]
or esi, dword [eax + 0x3b]
dec ecx
bound edi, qword [ecx]
jns 0x40c770
aas
insd dword es:[edi], dx
mov ah, 0xc0
xor al, 0x1f
mov bh, 0xe4
popfd
sbb dword [ebx], ecx
inc esi
rcl ebx, 0xe7
mov ch, 0xe4
adc dword [edx + 0x64], 0x3c9f52b6
in eax, dx
sbb al, ah
mov bh, 2
mov al, 0x6e
and eax, 0x1c00150d
mov esi, 0x2e5e6bad
xor bh, byte [ebp + 0x4e9fa315]
aam 0xc7

Function at 0x421b9d
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
invalid
mov cl, 0x16
cmpsd dword [esi], dword es:[edi]
lcall 0x617f, 0xfa96b799
aas
and byte [edx + 0x46222651], ch
and eax, 0x7b2f477f
adc byte [edx], bl
pop ds
dec esi
or eax, 0xebc33ab5
in al, 0xaf
bound ebx, qword [ebp - 3]
cmp al, 0x31
wait
sahf
jle 0x421bf1
dec esp
and ebp, dword [edi + 0x5fd65f34]
xor al, 0x5f
salc
pop edi
jo 0x421b88
dec ebp
push eax
jnp 0x421bca
jl 0x421bfd
ljmp 0x7136:0x77691c9c
pop esi
repe cmpsb byte [esi], byte es:[edi]
add dword [0x3e0c87dd], ebp
aaa
pop eax
popal
push ecx
ljmp 0x88bb
Function at 0x44ea3d
Capabilities:
Encode data using xor

Disassembly:
rcl byte [edi + 0x25585362], 0x92
mov edi, 0x85b90266
in eax, dx
push ebp
pop esp
out 0x70, eax
mov dh, 0xd6
psubsb mm1, qword [edi + 0x330603ee]
push ss
xor edx, dword [esi]
cmp eax, 0x1fb8bfad
mov gs, word [ebx + 0x7fa6d3db]
jbe 0x44ea37
les edi, [edx - 0x30]
inc edx
mov al, 5
push eax
xor al, 0x41
push eax
test al, 0xe2
in eax, 0xf3
cmp eax, 0x74221ff1
adc dword [edi - 0x5d], esp
js 0x44ea63
jae 0x44e9d5
jae 0x44e9d5
arpl sp, dx
idiv byte [esi - 0x7d]
xchg ebx, ecx
push eax
jno 0x44e9bc
invalid
lodsd eax, dword [esi]
adc eax, 0x86a345cb
mov edi, 0xb3a68556
mov edi, 0xfa5c8463
daa
mov eax, dword [0xaa608277]
popal
mov dword [esi - 0x3a841476], 0xe6d4b606
insb byte es:[edi], dx
mov bl, 6
mov dword [0x8396d54c], eax
sal byte [ecx], 1
js 0x44e9fb
xchg edi, eax
sar dh, 0xe3
adc al, 0xec
xor esi, dword [ebp + esi*8 + 0xabb139f]
daa
mov dh, 0x45
out 0x42, eax
lds edx, [esi]
in al, 0xf5
xchg esp, eax
add dword [edi + eax*2 - 0x79], esp
loop 0x44ea64
test byte [edi + 0x57], ah
push esp
jg 0x44ea87
add edi, dword [esi - 0x42]
jle 0x44ea47
inc esi
ficom word [ebx - 0x4e29613a]
jno 0x44eb06
cmp al, 0xe1
add dl, byte [edx]
mov eax, 0xa25a6fdf
movsb byte es:[edi], byte [esi]
das
mov cl, 0x73
xchg ebx, eax
fsubp st(5)
pop ecx
push ebp
xchg byte [eax], dl
push eax
mov dh, 0x30
scasb al, byte es:[edi]
and eax, eax
salc
add esp, esi
in eax, dx
xor edi, esi
push ds
fisttp dword [edi]
lahf
sub al, 0xb2
and ebp, esp
xlatb
sbb eax, 0xddaa345b
scasd eax, dword es:[edi]
push es
sub dl, byte [edi + edx*4]
test ebp, ebp
inc ebx
test byte [edi + 0x7b], 0x34
xor al, 0x86
loope 0x44ea87
mov ah, 0x34
jecxz 0x44eae4
sahf
and byte [eax + 0x70], ch
or dh, byte [edi + 0x5c]
test byte [ebx - 0x395b7d51], dl
lcall 0x5242, 0x976466b1
and esi, edi
jae 0x44eac3
add esp, dword [esi + 0x2bd46636]
add eax, dword [esi + ebx + 0x798ce248]
aaa
inc edi
in al, 0x91
pop ebx
inc eax
pop edi
mov al, byte [0x1e82e366]
xchg edx, eax
inc ebx
invalid

Function at 0x44eacd
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x86
loope 0x44ea87
mov ah, 0x34
jecxz 0x44eae4
sahf
and byte [eax + 0x70], ch
or dh, byte [edi + 0x5c]
xchg di, ax
inc edx
push edx

Function at 0x46525d
Capabilities:
Encode data using xor

Disassembly:
or esi, dword [esi + 0x37]
ret 0xe8d
inc edi
xchg ch, ch
xor dword [esi + 0x6b3af6f0], ecx
idiv byte [edx]
invalid
invalid
idiv byte [edx]
imul eax, edi, 0xa
sar dl, 0x4a
push 0xffffffffffffffad
cmp esi, dword [esi + ebx]
sbb byte [esi], dl
sti
mov esi, 0x82755657
je 0x465257
pushal
and al, 0x28
jg 0x46521a
inc esi
invalid
Function at 0x46589d
Capabilities:
Encode data using xor

Disassembly:
sal eax, cl
and byte [ebx - 0xee97bba], dh
xchg byte [ebx - 0x30], ah
jne 0x465925
aad 0x76
xchg ebx, eax
ror dword ds:[ebx + 0x541d9642], cl
pop edx
invalid
jne 0x46593a
jne 0x46593a
xor dword [edx - 0xf1ed73c], 0x1f4901e5
cmp edi, ecx
and al, 0xa5
test bl, ch
in eax, 6
rcr byte [esi - 0x24], 0x72
xor bl, byte [eax + 0xf]
xor ecx, dword [esp + esi*2]
loop 0x46593f
jmp 0x465926
mov ch, 0x42
push eax
mov dword [0xaee49651], eax
popal
out 0x15, al
test dword [eax + edx*8 - 0x24821bd2], ecx
lcall 0xc014, 0x973680d4
pop es
mov dword [ebx], esp
test eax, 0x866b7586
mov ebx, eax
in al, 0x1d
xchg esp, eax
xor eax, 0xbe6d35c2
retf 0x20a4

Function at 0x47c4cd
Capabilities:
Encode data using xor

Disassembly:
and byte [esp + esi*2 + 0x3a], dh
cmp al, 0x83
jge 0x47c459
int1
xor dword [eax - 0x4e3ea7a3], eax
test dl, cl
xor dword [ecx - 0x1c], ecx
cwde
mov esi, 0x64be7d24
movsb byte es:[edi], byte [esi]
scasd eax, dword es:[edi]
jno 0x47c508
mov ebp, 0x29acc612
xor byte [edx - 0xd], ah
and esp, dword [ebp + edi + 0x50]
lodsd eax, dword [esi]
adc byte [0x44c72a30], 0x67
push esi
inc ebx
in al, 0x15
dec dword [0x2d8f9afa]
xchg ebx, eax
cld
aas
mov bh, 0x3a
movsb byte es:[edi], byte [esi]
call ebp
test byte [eax - 0x10fb5a1a], dl
inc ebp
dec esi
lodsb al, byte [esi]
mov ch, 0xbc
adc al, 0x66
xor eax, 0x4d203be7
sbb dword [eax - 0x3e], esp
je 0x47c4fd
pop ds
in eax, 0xd0
push ds
xchg ebp, eax
add eax, 0xe863575b
jmp 0x85a8752

Function at 0x47f75d
Capabilities:
Encode data using xor

Disassembly:
fisub dword [esi + ecx - 0x3406fe2e]
or al, 0x67
dec edx
sbb eax, 0x5069e8b2
sbb edx, dword [edx - 0xc]
xor dh, ah
jae 0x47f76e
hlt
movsb byte es:[edi], byte [esi]
in al, 0x52
cwde
add byte [edi + ecx*2 - 0x1c], 0xfe
cli
or al, 0x69
mov dword [edi + edi], 0xef7c065d
outsb dx, byte [esi]
push 0x6b
jno 0x47f7bc
cmp ah, byte [ebx]
int 0xe1
pop edi
fdiv st(7), st(0)
invalid
jg 0x47f811
popal
cmp ah, byte [esi + eax]
and ebp, dword [edx]
iretd

Function at 0x4808a3
Capabilities:
Encode data using xor

Disassembly:
cld
invalid
xor al, 0x19
and dword [eax], edi
out 8, eax
or byte [ebx + 0x3a], bh
or byte [ebx + 0x3a], bh
sal edx, 0xd4
sbb dword [eax], ebp
inc edi
dec eax
adc al, 0x34
call 0xeb0e9f06
pop ds
xchg esi, eax
out dx, al
lea ebx, [edi]
fnstenv [ecx + ecx*2 - 0x71]
inc edi
je 0x48089e
jae 0x48088e
out 0xee, al
add dword [edx + edi*4 + 0x7d10b13b], eax
cmp eax, 0x2cd9129d
fdiv qword gs:[ecx + 0xbaf3a60]
invalid
inc eax
dec ecx
or al, 0x6f
int 0xae
scasd eax, dword es:[edi]
fdivr qword [esi]
jecxz 0x4808f1
sbb eax, 0xc3b2fd03
scasd eax, dword es:[edi]
stosd dword es:[edi], eax
test al, bh
adc ebx, dword [edi - 0x60]
loop 0x48090a
aas
iretd
mov cl, 0xd4
mov edi, 0x670c4ba9
fdiv dword [edi + edi*8 - 0x4b]
into
pop esi
cmp byte [eax - 0xc389faa], al
and edi, 0x63
adc al, 0x66
rol byte [edi + 0x4af11dd5], cl
pop ss
or cl, ch
out 0xb, al
movsb byte es:[edi], byte [esi]
pop ds
in al, dx
sbb dl, byte [ecx]
mov bl, dl
push 0xffffffffffffffd6
push esi
cmp al, 0xc
invalid
Function at 0x49485d
Capabilities:
Encode data using xor

Disassembly:
fimul word [esi + 0x62]
add eax, 0x2a9c4316
add al, 0xc0
arpl sp, di
add dl, byte [ebp + 0x7e]
sal ebp, 0xea
push 0x2c
jbe 0x4948a2
adc byte [eax], ch
dec edi
insb byte es:[edi], dx
das
cmp al, byte [edx]
enter 0x87a, 0x53
out dx, al
aas
cwde
mov eax, 0x7c642268
in eax, dx
xchg edx, eax
test al, 0x6f
test eax, 0x384bee18
neg dword [edx]
cmpsb byte [esi], byte es:[edi]
idiv byte [esi + 0x5a17bd19]
xchg dword [0x6061fbcb], edi
jg 0x49489a
mov ebp, 0x3d875a17
retf
xor al, ah
bound ebx, qword [eax]
clc
sbb al, 0xd0
dec edx
fcomp qword [edx]
xchg ch, dh
mov ebp, 0xd325f000
add cl, byte [ebx]
jno 0x494895
cmp byte [ebp - 0x62], 0x26
add ebp, dword [edx + 0x688ee673]
iretd

Function at 0x49e135
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0x35
xor dword [edx], 0x71
shr byte [ebx + edi*8 + 0x4a], cl
cmc
or esp, dword [eax]
push ebx
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
sbb ch, al
xchg esp, eax
imul byte [edx - 0x350cfb0c]
hlt
ja 0x49e0a6
rol byte [ebp - 0x753e3587], 1
sbb byte [esi - 0x5ae7d1de], ch
invalid
jl 0x49e110
jle 0x49e19f
loopne 0x49e161
dec esp
xchg ecx, eax
push esi
add dh, ch
mov dh, dl
popal
and byte [0x248be0b], ch
pop esp
or edx, dword [ebx + 0xa]
mov eax, 0xbe078058
lcall 0x7637, 0x7df35fc9
mov cl, 0x7f
pushfd
dec ecx
adc byte [ecx + esi - 0x7f], cl
sbb esp, dword [edi + ecx*2]
dec edx
in eax, dx
fsubr st(1)
insb byte es:[edi], dx
adc byte [ebx - 0x14], al
cmp byte [ebx], dl
mov dl, 0xe9
sub esi, dword [eax + 0x79]
mov dl, byte [ebp + 0x6c851cf0]
xor dword [esi], esi
mov esi, esi
push es
clc
ja 0x49e16d
call [edx - 0x19d8eaca]
jo 0x49e207
pop ebp
push 0xfffffffffffffff3
adc bl, byte [edx + 0x24142bf0]
cmp dl, byte [eax]
add eax, 0x89fffdd9
invalid
ror byte [0xddf72d7a], 1
dec ecx
cmpsb byte [esi], byte es:[edi]
aaa
pop ebx
invalid