joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10071ae1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10071b19
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1006fb95
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.1006fb6d
jmp 0x10071b25
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100731d3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10073215
call fcn.10078c9d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10073215
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x1007320c
xor eax, eax
jmp 0x1007321d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10073223
pop edi
pop esi
pop ebx
ret 4
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x45b8f8]
xor eax, esp
mov dword [esp + 0x208], eax
test ebx, ebx
je 0x4010de
cmp word [ebx], 0
je 0x4010de
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
call ebp
cmp eax, 0xffffffff
je 0x40103d
test al, 0x10
jne 0x4010c6
lea edx, [esp + 4]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401045
cmp word [esp + 4], 0x2f
push esi
push edi
lea esi, [esp + 0xc]
jne 0x401066
lea esi, [esp + 0xe]
cmp word [esi], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
je 0x401094
cmp word [esi], 0x5c
jne 0x40108b
push 0
lea eax, [esp + 0x10]
push eax
mov word [esi], 0
call edi
mov word [esi], 0x5c
add esi, 2
cmp word [esi], 0
jne 0x401072
push 0
lea ecx, [esp + 0x10]
push ecx
call edi
push ebx
call ebp
cmp eax, 0xffffffff
pop edi
pop esi
je 0x4010c6
test al, 0x10
je 0x4010c6
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042bfb5
add esp, 0x20c
ret
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0042bfb5
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
mov eax, 0x80070057
call fcn.0042bfb5
add esp, 0x20c
ret

Function at 0x4011e0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x446c58
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x45b8f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x14], ebx
call fcn.0040c808
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40122a
push 0x80004005
call fcn.00401bb0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
push edi
lea esi, [esp + 0x14]
mov dword [esp + 0x28], ebx
call fcn.00401100
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
add esp, 4
push ebx
push 0x42000000
push 3
push ebx
mov ebx, dword [esp + 0x20]
push 5
push 1
push ebx
call esi
cmp eax, 0xffffffff
jne 0x40126f
call section..text
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
call esi
mov esi, eax
cmp esi, 0xffffffff
jne 0x401290
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4012c3
mov edx, dword [ebp]
mov eax, dword [esp + 0x2c]
push 0
lea ecx, [esp + 0x1c]
push ecx
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4012bc
mov ecx, dword [esp + 0x18]
cmp ecx, dword [ebp]
jne 0x4012bc
mov dword [esp + 0x14], 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4012e7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x403160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403179
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4031b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4031b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4031b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4031a0
cmp esi, eax
jb 0x4031ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40aa30
Capabilities:
Timestomp file

Disassembly:
sub esp, 0x2c
push esi
push edi
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
lea ecx, [esp + 0x20]
push ecx
mov edi, eax
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea ecx, [esp + 0x10]
push ecx
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
mov eax, ecx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x40aea0
Capabilities:
Link many functions at runtime
Terminate process

Disassembly:
sub esp, 0x208
mov eax, dword [0x45b8f8]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
push ebp
mov ebp, dword [esp + 0x214]
push esi
push edi
push str..ZLIB.DLL
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.unzOpen
push esi
call edi
push str.unzGetGlobalInfo
push esi
mov dword [0x460fb4], eax
call edi
push str.unzGetCurrentFileInfo
push esi
mov dword [0x460fa4], eax
call edi
push str.unzGoToNextFile
push esi
mov dword [0x460fac], eax
call edi
push str.unzOpenCurrentFile
push esi
mov dword [0x460fa8], eax
call edi
push str.unzReadCurrentFile
push esi
mov dword [0x460fb0], eax
call edi
push str.unzCloseCurrentFile
push esi
mov dword [0x460f98], eax
call edi
push str.unzLocateFile
push esi
mov dword [0x460f9c], eax
call edi
push str.unzClose
push esi
mov dword [0x460fa0], eax
call edi
test ebp, ebp
mov dword [0x460fb8], eax
je 0x40afa1
lea edx, [esp + 0x10]
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40af55
push ebp
call dword [0x460fb4]
mov edi, eax
test edi, edi
jne 0x40afa8
lea eax, [esp + 0x10]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x40af75
mov ecx, dword [str..zip]
mov dl, byte [0x450164]
mov dword [eax], ecx
mov byte [eax + 4], dl
lea eax, [esp + 0x10]
push eax
call dword [0x460fb4]
mov edi, eax
test edi, edi
jne 0x40afa8
push 1
call fcn.0042d42a
call fcn.0040ae40
push edi
call dword [0x460fb8]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0042bfb5
add esp, 0x208
ret

Function at 0x40b91f
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x40b948
call fcn.00418aaa
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenW]
test eax, eax
mov dword [esi + 8], eax
jne 0x40b96b
push eax
push dword [esi + 4]
call fcn.0040b8aa
push esi
push eax
mov ecx, 0x45cf84
call fcn.0040b550
mov eax, esi
pop esi
pop ebp
ret 0x18
Function at 0x40c270
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x444b7a
call fcn.0042dd4b
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040c232
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00401f40
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectW]
test eax, eax
mov dword [esi + 4], eax
jne 0x40c2d6
push eax
push dword [esi + 8]
call fcn.0040b8aa
push dword [esi + 0xc]
mov ecx, 0x45cf84
push eax
call fcn.0040b550
mov eax, esi
call fcn.0042de23
ret 0x18

Function at 0x412275
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x4122b8
call fcn.00418aaa
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4122b8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4122d3
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00411e2f
test ebx, ebx
mov esi, eax
je 0x4122d1
test edi, edi
je 0x4122d1
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x412a5f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x444e99
call fcn.0042dd7e
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00418aaa
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x412aaa
call fcn.00418aaa
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x412abb
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x412ac8
or eax, 0xffffffff
jmp 0x412c24
mov ecx, esi
call fcn.004125a6
mov dword [ebp - 0x14], eax
call fcn.0040f80c
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x412b46
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x412b46
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x412b46
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0040e3cd
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x412b46
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x412b46
mov ecx, ebx
call fcn.00418c98
test eax, eax
je 0x412b46
push 0
mov ecx, ebx
call fcn.00418cb3
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041115b
push dword [ebp - 0x14]
call fcn.0040f764
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00412867
xor edi, edi
cmp eax, edi
je 0x412ba3
test byte [esi + 0x3c], 0x10
je 0x412b8d
push 4
pop edi
mov ecx, esi
call fcn.00418ba9
test ax, 0x100
je 0x412b83
push 5
pop edi
push edi
mov ecx, esi
call fcn.0040f2fa
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x412ba3
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00418e61
or dword [ebp - 4], 0xffffffff
jmp 0x412bce
cmp dword [ebp - 0x28], edi
je 0x412bdc
push 1
mov ecx, ebx
call fcn.00418cb3
cmp dword [ebp - 0x2c], edi
je 0x412bec
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x412c05
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x412c05
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.004125e0
cmp dword [esi + 0x58], edi
je 0x412c21
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0042de23
ret
Function at 0x4172d5
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx], dh
xor dword [eax], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
cwde
pop ebp
pushal
inc ecx
xchg esp, eax
cmp eax, 0x1f8fc15b
mov edx, 0x179bea81
or eax, 0x30313231
xor bh, byte [ecx]
xor byte [ecx], dh
xor byte [eax], dh
xor esi, dword [eax]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
cdq
out dx, eax
pop ebx
in al, 0
fimul word [edi + 0x4db431dc]
popal
sub eax, 0xd17c330
xor dword [ecx], esi
xor byte [ebx], dh
xor dh, byte [0x36333731]
xor dword [edi], esi
xor esi, dword [esi]
xor dh, byte [ecx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lcall 0xe4ba, 0xfe1b02ec
jl 0x417302
jecxz 0x417319
imul ebx, dword [edi + 0xd17ac58], 0x31
xor dword [ecx], esi
xor byte [ecx], dh
xor esi, dword [ecx]
xor esi, dword [0x5a353338]
xor byte [ecx], ah
add dl, byte [eax]
dec esi
wait
mov cl, 0xdd
xlatb
or dword [esp + eax*8 - 0x4560d858], ebp
scasd eax, dword es:[edi]
and dword [esi], ecx
jmp 0x41736f
das
test dword [eax - 0x2f], ebp
xchg edi, eax
inc ebx
loope 0x4173bd
xchg al, bl
outsb dx, byte [esi]
pop ss
or eax, 0x33303131
xor dword [eax], esi
xor esi, dword [eax]
xor esi, dword [ecx]
xor eax, 0x39333230
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
sahf
xchg ebx, eax
sub byte [eax + 0x3acf284a], 0x33
jp 0x4173fc
and edi, dword [edx + 0xd17451d]
xor dword [eax + esi], esi
xor al, 0x31
xor byte [eax], dh
xor dword [eax], esi
cmp dword [ecx + edi], esi
xor byte [ecx], bh
xor al, 0x39
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lahf
loop 0x4173a7
jecxz 0x4173e8
invalid
lodsd eax, dword [esi]
insd dword es:[edi], dx
xchg edx, eax
pop ss
or eax, 0x33303431
xor dh, byte [ebx]
xor byte [edi], dh
xor dword [edx], esi
xor byte [edx], dh
pop edx
xor byte [ecx], ah
xor al, 0x32
xor al, 0x31
Function at 0x41737d
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx], dh
xor dword [eax], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
cwde
pop ebp
pushal
inc ecx
xchg esp, eax
cmp eax, 0x1f8fc15b
mov edx, 0x179bea81
or eax, 0x30313231
xor bh, byte [ecx]
xor byte [ecx], dh
xor byte [eax], dh
xor esi, dword [eax]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
cdq
out dx, eax
pop ebx
in al, 0
fimul word [edi + 0x4db431dc]
popal
sub eax, 0xd17c330
xor dword [ecx], esi
xor byte [ebx], dh
xor dh, byte [0x36333731]
xor dword [edi], esi
xor esi, dword [esi]
xor dh, byte [ecx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lcall 0xe4ba, 0xfe1b02ec
jl 0x417302
jecxz 0x417319
imul ebx, dword [edi + 0xd17ac58], 0x31
xor dword [ecx], esi
xor byte [ecx], dh
xor esi, dword [ecx]
xor esi, dword [0x5a353338]
xor byte [ecx], ah
add dl, byte [eax]
dec esi
wait
mov cl, 0xdd
xlatb
or dword [esp + eax*8 - 0x4560d858], ebp
scasd eax, dword es:[edi]
and dword [esi], ecx
jmp 0x41736f
das
test dword [eax - 0x2f], ebp
xchg edi, eax
inc ebx
loope 0x4173bd
xchg al, bl
outsb dx, byte [esi]
pop ss
or eax, 0x33303131
xor dword [eax], esi
xor esi, dword [eax]
xor esi, dword [ecx]
xor eax, 0x39333230
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
sahf
xchg ebx, eax
sub byte [eax + 0x3acf284a], 0x33
jp 0x4173fc
and edi, dword [edx + 0xd17451d]
xor dword [eax + esi], esi
xor al, 0x31
xor byte [eax], dh
xor dword [eax], esi
cmp dword [ecx + edi], esi
xor byte [ecx], bh
xor al, 0x39
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lahf
loop 0x4173a7
jecxz 0x4173e8
invalid
lodsd eax, dword [esi]
insd dword es:[edi], dx
xchg edx, eax
pop ss
or eax, 0x33303431
xor dh, byte [ebx]
xor byte [edi], dh
xor dword [edx], esi
xor byte [edx], dh
pop edx
xor byte [ecx], ah
xor al, 0x32
xor al, 0x31
Function at 0x417522
Capabilities:
Encode data using xor

Disassembly:
xor dh, byte [eax]
xor byte ss:[edi], dh
xor dh, byte [edx]
xor bh, byte [ecx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov bh, 0xb
fdivr qword [esi + ecx - 0x31f5f2ab]
cmp ebp, dword [edi]
add al, al
or ch, byte [ebp + 0x32310d17]
xor dword [edx], esi
xor dword [edi], esi
xor byte [ecx], dh
xor eax, 0x5a343032
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov bh, 0x1c
mov cl, 0x26
rol bh, 0xb
invalid
or edi, dword [edi]
or edi, dword [edi]
and cl, byte [edx - 0x62377c1f]
not byte [edi]
or eax, 0x32313331
xor dword [edx], esi
xor byte [ecx], bh
xor dword [edx], esi
xor eax, 0x5a303237
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov bh, 0x71
cmpsd dword [esi], dword es:[edi]
inc ebx
jl 0x4174dd
fidiv dword [ebp + 0x270246ff]
loop 0x41753f
inc dword [edi]
pop es
pop ss
or eax, 0x37303331
xor byte [ebx], dh
xor dword [ebx], esi
xor esi, dword [ebx]
xor dword [ecx], edi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov bh, 0xe4
lodsb al, byte [esi]
mov edx, 0x8480e98e
lcall 0x743b, 0x49010dc6
pop ss
or eax, 0x39303331
xor dh, byte [ebx]
xor dword [0x34343334], esi
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov ecx, 0xf6b65464
leave
push ebp
and ch, byte [ecx]
jmp 0x4175f7
or eax, 0x36303131
xor byte [ecx], bh
xor dword [eax], edi
xor al, 0x36
xor byte [ecx], bh
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov esi, 0x2873b39e
pushfd
pop edx
sbb eax, esi
jo 0x417644
push edi
jl 0x4175ce
dec edx
pop ss
or eax, 0x31313131
xor byte [eax], bh
xor dword [0x33333334], esi
cmp byte [ecx], dh
xor eax, 0x33333334
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
mov edi, 0x55648648
outsb dx, byte [esi]
in al, 0x28
and bh, byte [ebp + 0x385b2f77]
or dl, byte [edi]
or eax, 0x32303231
xor dword [0x35313132], esi
xor dh, byte [ebx]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
ror dword [esi + 0x44], 0xdb
mov byte [0x3248322e], al
jno 0x4175ec
xor eax, esp
movsb byte es:[edi], byte [esi]
sbb edx, dword [edi]
or eax, 0x32303431
xor dh, byte [edx]
xor byte [ecx], dh
xor byte [esi], dh
xor dh, byte [edx + ebx*2]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lds esp, [edi + 0x13675890]
mov edx, 0x43be35b2
xchg esp, eax
add al, 0xb5
scasb al, byte es:[edi]
pop ss
or eax, 0x34303431
xor dword [eax + esi], esi
xor dword [eax], esi
cmp byte [edx], dh
aaa
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec esi
lds ebp, [ebp - 0x1050e948]
add al, 0x60
mov ebx, 0x5cddd537
invalid
invalid
pop ss

Function at 0x417c10
Capabilities:
Encode data using xor

Disassembly:
in al, 0xd3
lcall 0xd17, 0x857b314
xor dword [ebx], esi
xor byte [edi], dh
Function at 0x418ba9
Capabilities:
Encode data using xor

Disassembly:
xor byte [ecx], bh
xor byte [ecx], dh
xor byte [ecx], dh
xor edi, dword [ecx]
pop edx
mov edi, 0x17f8cb1a
or eax, 0x30313231
xor dh, byte [0x30303130]
xor bh, byte [eax]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec edi
mov dword [0xea393a2e], eax
cmp bh, byte [ecx]
invalid
jo 0x418b4a
sbb bh, dl
lodsb al, byte [esi]
dec esp
dec edx
sbb dword [0x310d17c2], ebx
xor esi, dword [eax]
cmp dword [ecx], esi
cmp dword [eax], esi
cmp byte [edx], dh
xor esi, dword [eax]

Function at 0x418c77
Capabilities:
Encode data using xor

Disassembly:
je 0x418cb4
push ebp
inc eax
dec ebx
je fcn.00418cf5
mov dword [0x33310d17], eax
xor byte [edx], dh
xor dh, byte [edx]
xor byte [esi], dh
xor esi, dword [edi]
xor dh, byte [eax]
xor esi, dword ss:[edi]
xor al, 0x31
pop edx
xor byte [ecx], ah
add dl, byte [eax]
dec edi
scasd eax, dword es:[edi]
jno 0x418c86
pop edi
invalid

Function at 0x41a99f
Capabilities:
Encode data using xor

Disassembly:
add dl, byte [eax]
push eax
aam 0xa0
inc edi
das
imul edi, eax, 0x15
shl byte [ebp + 0xc], cl
cdq
xor byte [ebp + 0xd17b662], 0x31
or eax, 0x31303431
xor byte [ecx], bh
xor dword [eax], esi
xor eax, 0x5a353033
invalid
invalid
pop edx
or eax, 0x31303431
xor byte [ecx], bh
xor dword [eax], esi
xor eax, 0x5a353033
invalid
invalid
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push eax
aad 0x2c
out 0xe4, al
push eax
sub al, 0x81
mov ch, 0x6d
push ebp
lodsb al, byte [esi]
out dx, al
stc
add dl, byte [edi]
or eax, 0x37303431
xor dword [eax], esi
xor byte [edi], dh
xor eax, 0x5a303039
xor byte [ecx], ah
add dl, byte [eax]
push eax
salc
xchg ecx, eax
test ecx, esp
mov cl, 0x62
cli
in al, 0xb0
jb 0x41a9c0
mov byte [0xd175c0b], al
xor dword [eax + esi], esi
xor al, 0x31
xor esi, dword [ecx]
xor eax, 0x32353532
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push eax
xlatb
bnd jl 0x41a98c
daa
pushal
pop esi
fdiv dword [ebp + 0x5f]
adc dword [eax + 0xd17a4ce], 0x36303331
xor dword [eax + esi], esi
xor dword [eax], esi
xor dword [eax], esi
xor ebx, dword [edx + 0x30]
and dword [edx], eax
adc byte [eax - 0x28], dl
xchg dword [edi + eax*8 - 0x4cef6fb8], ebp
test dword [edx], eax
sub ch, byte [edx]
mov word [edi + 0x34310d17], ss
xor byte [esi], dh
xor byte [0x37303431], dh
xor dh, byte [edi]
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push eax
fldenv [0x5cbf6935]
sub esp, edx
jecxz 0x41aa92
jge 0x41a9f7
pop ebx
and al, 0x17
or eax, 0x39303331
xor byte [esi], dh
xor byte [edx], dh
xor dword [esi + 0x21305a39], esi
add dl, byte [eax]
push eax
fnstenv [ebp - 0x475577d1]
push ds
cmp eax, 0xcc077581
test eax, 0xd177e87
xor dword [ecx], esi
xor byte [ecx], bh
xor dh, byte [ebx]
xor dword [edx + esi], esi
xor al, 0x31
pop edx
xor byte [ecx], ah
add dl, byte [eax]
push eax
fisttp dword [esi]
inc eax
lodsd eax, dword [esi]
xor dword [edx - 0x50], edx
loop 0x41aae8
in al, 0xdf
cmp eax, 0x17d35431
rcl dword [edi], cl
or eax, 0x33303331
xor byte [0x32343032], dh
xor eax, 0x21305a30
add dl, byte [eax]
push eax
fstp xword [ecx + 0x112da417]
and al, 0x7e
push ss
xor byte [ecx - 0x23], ah
hlt