joyce8/EMBER2024-capa huggingface dataset:
Function at 0x481294
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x481405
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x9c], 1
mov eax, dword [ebp - 4]
test byte [eax + 0x1c], 0x10
jne 0x4813ea
lea eax, [ebp - 0x10d]
push eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 8]
lea eax, [ebp - 0x10d]
call fcn.00409364
mov dl, 1
mov eax, dword [0x45a500]
call fcn.0045a558
mov edx, dword [ebp - 4]
mov dword [edx + 0x94], eax
mov dl, 1
mov eax, dword [0x4134ac]
call fcn.00403b0c
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x98]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.0045a5d4
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4813e7
mov dl, 1
mov eax, dword [0x45b8f0]
call fcn.0045b958
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
mov edx, 0x48141c
call fcn.0045ab98
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404bd4
xor eax, eax
push ebp
push 0x4813e0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
xor ecx, ecx
xor edx, edx
mov ebx, dword [eax]
call dword [ebx + 0x14]
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.0045bc58
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00481424
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4813e7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
call fcn.00403b3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
call fcn.00403b3c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
call fcn.00403b3c
ret
mov bl, byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48140c
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004048ec
ret
Function at 0x41eb30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x41eb83
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x41eb6a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x48e880
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x453648
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push esi
mov esi, ecx
lea eax, [esp + 0xc]
mov ecx, dword [esi + 0x20]
push eax
push ecx
call fcn.005c4d2c
inc esp
push 0
lea ecx, [esp + 0x20]
call fcn.005c253b
mov eax, dword [esi + 0xd4]
lea edx, [esp + 0x1c]
push eax
push eax
push edx
mov dword [esp + 0x44], 0
call fcn.0048e1b0
mov eax, dword [esi + 0x50]
mov ecx, dword [esi + 0x4c]
add eax, 0x64
add esp, 0xc
add ecx, 0x64
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov dword [esp + 4], ecx
push eax
lea ecx, [esp + 0x20]
call 0x5ed5a5
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
push 1
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
lea eax, [edx + ecx + 1]
xor edx, edx
test eax, eax
setl dl
dec edx
mov ecx, esi
and eax, edx
push eax
push 0
push 0
call 0x5edc60
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 8]
sub ecx, eax
add ecx, edx
mov eax, 0x88888889
imul ecx
add edx, ecx
xor ecx, ecx
sar edx, 4
mov eax, edx
push 1
shr eax, 0x1f
lea eax, [edx + eax + 1]
test eax, eax
setl cl
dec ecx
and eax, ecx
mov ecx, esi
push eax
push 0
push 1
call 0x5edc60
push 1
push 0
push 0
mov ecx, esi
call 0x5ede84
push 1
push 0
push 1
mov ecx, esi
call 0x5ede84
lea ecx, [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffff
call fcn.005c2c75
mov ecx, dword [esp + 0x30]
pop esi
mov dword fs:[0], ecx
add esp, 0x38
ret
Function at 0x4916c0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x4916f3
push esi
call fcn.00494810
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x4916ec
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x491779
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x491762
mov eax, dword [esi + 8]
test eax, eax
je 0x491717
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x49175e
cmp eax, 2
je 0x491762
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x49170a
cmp eax, 3
je 0x49173d
cmp eax, 1
jne 0x49170a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x49170a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x49170a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.004917a0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x491788
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.004917a0
add esp, 4
pop esi
ret

Function at 0x49ddf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453bf1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
lea ecx, [esi + 4]
call fcn.0049dbd0
xor edi, edi
lea ecx, [esi + 0xc]
mov dword [esp + 0x14], edi
call fcn.005bb6a7
lea ecx, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.005bb6a7
lea ecx, [esi + 0x14]
mov byte [esp + 0x14], 2
call fcn.0049dbd0
mov ecx, dword [esp + 0xc]
mov eax, 0x45b128
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x50], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x58], 0x45b114
mov dword [esi + 0x5c], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x60], edi
mov dword [esi], 0x45b110
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x4fe17b
Capabilities:
Check for trap flag exception

Disassembly:
pop dword [esp + 0x12]
lea esp, [esp + 0x1c]
call fcn.004fe0ff
pushal
jmp 0x4fe122
Function at 0x52c35c
Capabilities:
Encode data using xor

Disassembly:
dec ebx
add eax, 0x3d46c387
and ebp, dword [ebp - 0x483ce302]
ja 0x52c37f
mov bh, 0x77
outsb dx, byte [esi]
salc
pop ds
jl 0x52c342
and al, 0xbe
jle 0x52c38e
cmc
xor cl, byte [edi + 0xbd9123a]
add dh, byte [esi + 0x35]
cmp eax, 0xb140bd62
ficomp word [esp + edi*2]
jle 0x52c30e
popfd
adc dword [ebp - 0x4128746c], edi
adc eax, 0x526ad4e5
invalid
pop dword [esp + 1]
lea esp, [esp + 2]
jmp 0x52c405
pop word [esp + 1]
push word [esp + 5]
call fcn.0052c3f4
sbb byte [0x9427d48d], 0xec
inc esi
jno 0x52c303
and al, 0x52
fcos
invalid
dec esp
lea esp, [esp + 4]
sub dl, al
setle al
lea eax, [esi + edi]
lea eax, [ebp*4]
call fcn.0052c47a
salc
inc ecx
ret

Function at 0x56cba3
Capabilities:
Encode data using xor

Disassembly:
invalid
jno 0x56cb25
inc ebx
mov ecx, 0x47b4ad3d
cmc
mov dword [esi], ecx
pushfd
sti
push ss
rcr dword [ecx], cl
mov dword [0x13a55633], eax
popal
in al, 0x7a
sbb eax, 0x119959ec
and eax, 0x9219a213
add byte [edi - 0x6e], ah
and al, 0x99
pop ss
xchg edx, esp
adc dword [esi + 0x791e8801], ebp
mov byte [edx], bh
test eax, 0x2fdcb525
lcall 0xe85e, 0xa3c456d9
dec ecx
retf

Function at 0x5702e3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov fs, word [edi - 8]
outsb dx, byte [esi]
or eax, edi
inc esi
dec ebx
aad 0x45
sub al, 0xdf
sbb bl, bl
inc esi
aam 0xb3
dec esi
call dword [edi - 5]
imul ecx, dword [esi], 0xfffffffd
jl 0x57035b
fdiv qword [edx + 0x15]
in al, 0x25
test al, 0x29
mov ecx, 0xca992bd8
dec edx
fdivr dword [edi - 0x109702b6]
jg 0x57032c
jmp 0x9657894b
out dx, al
cli
popfd
insb byte es:[edi], dx
fistp word [eax]
xchg ecx, eax
add dword [eax - 0x6d], esp
daa
lcall 0x18a3, 0x12e78012
xchg edi, eax
pop es
bound edx, qword [ecx - 0x61f779d3]
stc
or byte [edi + 0x5c35a528], bh
sub byte [ebp + 0x1baf5c35], ah
pop edx
salc
pop esp
scasd eax, dword es:[edi]
sbb ebx, dword [edx - 0x2a]
inc esp
and ebx, esi
imul ecx, eax, 0x4dbedb4b
cld
jle 0x57034a
bound eax, qword [0xf9684af4]
imul ecx, dword [eax], 0xda4a3cfb
dec eax
das
ficomp dword [eax]
mov ebx, 0xef9c0d92
and dword [eax - 0xdafc444], esp
xchg ebx, eax
inc ebp
pop ss
xchg dword [edx + 0x54], edx
ficomp word [edx + 0x27]
cmp eax, 0x50beb93d
cmp al, 0x3a
nop
pop eax
dec ecx
std
cwde
cmpsd dword [esi], dword es:[edi]
xor dl, bh
jp 0x57034d
and al, 0xff
sub edx, ebx
fidiv word [esi - 0x3cdea093]
stosd dword es:[edi], eax
or edx, dword [edi]
jne 0x57038d
bound ebp, qword [esi]
stosd dword es:[edi], eax
or ebp, dword [0xaea242e4]
or al, 0xf4
and eax, 0x72bb0ffe
aad 0x35
inc ecx
mov cl, 0xc
inc eax
jge 0x570425
add dword [esi], ebp
invalid
sbb bh, byte [ebp - 0x74]
cmp esi, dword [edx + 0x33c0a131]
mov ah, 0x32
mov al, byte [0xb68232c7]
aaa
cmpsd dword [esi], dword es:[edi]
ret 0xfa31
Function at 0x572926
Capabilities:
Encode data using xor

Disassembly:
sbb dword [edi], edx
insd dword es:[edi], dx
xor eax, 0xc485da26
rcr byte [edi + ebx*8 - 0x1071d415], 0x25
pop ds
cld
test eax, 0x2b8262a0
mov ecx, dword [ebp - 0x56799910]
xchg byte es:[eax + 0x1a18b855], ch
jge 0x5729b1
dec edx
outsd dx, dword [esi]
and byte [edx + 0x3836d648], 0xad
or dh, bl
dec edx
cwde
push ss
mov bh, 0xfb
pushal
not byte [ecx - 0x62f859a0]
or eax, 0x7710a754
out dx, al
jl 0x572986
test byte [edi + 0x63], 3
xchg ebx, eax
test byte [0x5ac45bc2], 0x3d
int3
ret
ja 0x57296f
xor byte [ecx - 8], 0xea
push 0xa96899fe
add al, 0x85
adc eax, 0xb63d8f7c
movsb byte es:[edi], byte ss:[esi]
ret
test al, 0xcf
cmp cl, byte [edx - 0x1570e064]
sbb dword [edx - 0x7e198f06], edx
jo 0x572984
in al, 0x6d
std
test byte [edi - 0x3d], dh
idiv byte [esi - 0x14]
mov eax, dword [esi - 0x3cac3bc9]
cmpsb byte [esi], byte es:[edi]
push ebp
loope 0x572a2e
aam 0x4a
sub eax, 0x41cc6bdc
imul ecx, esp, 0x41
sal dword [eax + 0x28ef743], 1
nop
test dword [edx], 0x57c74cb5
mov al, 0x43
test dword [esi + 0x2f79002], 0x57c74cb5
xor al, cl
js 0x5729d6
js 0x5729dc
mov dword [eax - 0x3a], edi
les edx, [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
cwde
push esi
invalid
imul eax, ebx, 0x7116801a
add byte [esp + 0x3d], 0xad
mov ah, 0x47
adc dword [esi + 0x16fb9c0e], 0xffffffa3
add al, 0xa3
xor edx, dword [esi - 0x5b]
inc esp
movsb byte es:[edi], byte [esi]
cmp eax, 0x8347b4ad
xchg esi, eax
push cs
pushfd
sti
push ss
mov dword [0x5633a304], eax
movsd dword es:[edi], dword [esi]
mov dword [0x12a55633], eax
jp 0x572a19
adc bh, byte [edx - 0x1c]
jp 0x572a54
in al, dx
sub eax, 0xe081118c
adc ebp, dword [edi + 0x6700920e]
xchg edx, eax
push edi
mov word [edi], ss
xchg edx, esp
adc dword [esi + 0x791e882a], ebp
mov byte [edi], cl
movsd dword es:[edi], dword [esi]
and eax, 0xec2fdcb5
mov byte [esi], bl
jns 0x5729d8
shld dword [0xec2fdcb5], esp, cl
fsubr qword [edi]
das
in al, dx
aad 0x56
les esp, [ebx - 0x34ba11a2]
pop ebx
int 0x7c
in eax, dx
insb byte es:[edi], dx
loop 0x5729ec
je 0x572a20
std
jns 0x572a55
mov byte [ebx - 0x37], bh
fstp qword [edx - 0x38]
scasd eax, dword es:[edi]
pop edx
lahf
cmp eax, 0xb94a2fbf
ja 0x572a91
nop
push es
popal
nop
and eax, 0xe49d0d85
pop ss
cmpsb byte [esi], byte es:[edi]
adc eax, 0xa66b0c9e
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
adc byte [ebp - 0xd], ah
arpl word [esi], ax
cmc
inc edx
jge 0x572a89
push 0xd
cld
dec esi
insd dword es:[edi], dx
loope 0x572b0d
adc bl, ah
push esi
lodsd eax, dword [esi]
and dh, byte [eax - 0x126bdd29]
not dword [bp + si - 0x279f]
adc eax, 0x98690e98
das
cmc
or al, 0xff
inc ebx
jne 0x572a9f
je 0x572ace
out dx, al
sub eax, dword [ebp + 0x1dee8b1b]
fldln2
jl 0x572ad8
jne 0x572a4c
xor ch, bl
dec ecx
fnstcw word [eax - 0x158200b5]
js 0x572af2
invalid
ljmp 0x9fa:0x9f0f9d2b
cli
or dword [edi + 0x5136a035], esp
mov al, byte [0x4ddd4514]
adc al, 0xe7
and dword [ebp + 0x36dbbc2e], esi
invalid
neg byte [ebp + 0xcfd9a04]
mov ebp, 0x4021b12d
mov bl, 0x70
sub eax, 0xb24720b2
or al, 0x2d
mov bh, 0x27
inc edx
mov cl, 0x7a
xor eax, 0xa8593ea8
sbb dword [ebp - 0x3b], esp
push ebp
cmp al, 0xcf
dec edx
hlt
pop ecx
test al, 0x19
lds edx, gs:[ebp + 0x3c]
iretd
Function at 0x576154
Capabilities:
Encode data using xor

Disassembly:
mov al, 0x43
inc ebx
mov dword [edx], eax
nop
test dword [edx], 0x57c749b4
xor al, cl
jle 0x576147
js 0x576146
mov dword [eax - 0x36], edi
fst dword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
ljmp 0x78ce

Function at 0x576ec4
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x240cbf4c
push edi
mov esi, 0x71f22889
insd dword es:[edi], dx
lock sbb word cs:[esi - 0x35], si
xor edx, dword [edi]
push ds
push esi
out dx, al
cmp byte [edi], cl
mov esp, dword [ecx]
pop ss
lock or byte [edx + eax*4 + 0x3051987], 0x59
and dword [edx], edx
invalid

Function at 0x577eb8
Capabilities:
Encode data using xor

Disassembly:
mov word [edx + 0x29ffd8db], ss
inc esp
mov dl, 9
salc
test byte [esi + 0x2a62abbb], cl
int3
xlatb
pop es
mov dword [0x67a55633], eax
jg 0x577ea5
jp 0x577ee0
in al, dx
sub cl, byte [ebx + 0x13e08111]
movsb byte es:[edi], byte [esi]
or edx, dword [edx + 0x23926700]
invalid
fsubr qword [edi]
call 0xa41bd5b2
pop esi
out dx, eax
retf

Function at 0x58344b
Capabilities:
Encode data using xor

Disassembly:
fisttp qword [ebp + 0x14]
out 0x20, eax
stosb byte es:[edi], al
mov esp, 0xb88636db
inc ebx
sal dword [esi + 0x48ef645], cl
lcall 0x21b1, 0x38bf0cfd
inc eax
mov bl, 7
cmp dh, byte [edx + 0x3b24720]
cmp byte [edi + 0xdb14227], dh
sub al, byte [ebp - 0xc]
out 0xe, eax
test eax, 0x2a28b955
inc ebx
xor dword [ebp + 0x34], 0xcc1e2586
pushfd
push 7
rol dword [ebx + 0x62], 0xab
xchg ebp, eax
sbb dword [ecx - 0xa51e418], ecx
jp 0x58347e
invalid

Function at 0x585e9d
Capabilities:
Encode data using xor

Disassembly:
push 0x7c
add esi, dword [ebx]
push esp
inc esp
bound ebx, qword [edi + edi*2]
or byte [ebp - 0x45], 0x1b
std
invalid
Function at 0x590e3b
Capabilities:
Encode data using xor

Disassembly:
test byte [edi - 0x3d], dh
idiv byte [esi - 0x14]
mov eax, dword [esi - 0x3cac3bc9]
cmpsb byte [esi], byte es:[edi]
push ebp
loope 0x590e33
aam 0x4a
sub eax, 0x41cc6bdc
sal dword [eax + 0x28ef743], 1
nop
test dword [edx], 0x57c74cb5
mov al, 0x43
test dword [esi + 0x2f79002], 0x57c74cb5
xor al, cl
js 0x590ddb
js 0x590de1
mov dword [eax - 0x3a], edi
les edx, [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
cwde
push esi
invalid
inc ebx
cmp bl, dl
dec ebx
cmp dword cs:[edi - 0x40], ecx
in eax, 0x67
push ebx
push ecx
cmpsd dword [esi], dword es:[edi]
outsd dx, dword [esi]
pushal
adc al, 0xc1
out dx, al
rcr dword [edx + ebx - 0x106ddd90], 0x85
sub ecx, edx
and dl, byte [edx - 0x2ed67a11]
test dword [ecx], ebp
rcr dword [eax + 0x7a], 1
pop esp
pop eax
jp 0x590e95
inc edx
and al, 0x8c
loopne 0x590dc9
loopne 0x590dc9
sbb dl, byte [eax - 0x4faf2c94]
nop
insb byte es:[edi], dx
rcl dword [eax - 0x50], cl
jb 0x590e3e
xchg edi, esp
xchg ebx, eax
and dword [ecx], ecx
xor byte [ebx], dl
and al, 0x70
ja 0x590e1a
sub dl, dh
jbe 0x590de1
jmp 0xaaa612ce
salc
sub al, al
mov word [eax - 0x7c44b957], es
pop es
push esi
jp 0x590ee9
jo 0x590e3d
fidiv dword [eax - 0x3e29010b]
pushfd
int 0xb2
and al, 0xa4
add byte [eax - 0x36bc743], al
or esp, ecx
les esp, [edi]
xchg dword [edi + 0x66354987], edi
dec ebp
jle 0x590eee
mov edi, 0x505b84bc
bound esi, qword [ecx]
invalid
xor esi, edi
loopne 0x590f11
dec ecx
jb 0x590e30
sub ebp, dword [ebp + 0x6265138b]
and cl, byte cs:[ebx - 0x18]
pop ebx
movsb byte es:[edi], byte [esi]
sub byte [edi - 0x51], dh
movsd dword es:[edi], dword [esi]
test dword [esi + ecx*4 + 0x52], ebp
wait
js 0x590e62
rcr dword [ebp + ebx*2 + 0x77ebf984], 6
dec edi
in al, dx
pop edi
jmp 0x590e62
cmpsd dword gs:[esi], dword es:[edi]
mov byte [eax + 0x33], al
xor eax, 0xd91a75d7
rcr dword [edx + edi*4 + 0x5083a737], 0x62
add bl, bl
shl byte [esi + 0x38], cl
mov eax, 0xbe5684f5
cmpsd dword [esi], dword es:[edi]
adc dword [eax + 0x62], 0
fcmovnbe st(0), st(2)
cmp byte [eax - 0x41a97b0b], bh
loope 0x590f34
test byte [0xd917d98d], ch
xor eax, 0xe0f0ddf6
in al, 0xab
loopne 0x590ef7
stosd dword es:[edi], eax
mov esp, esp
pop ebx
or byte [ebp + ecx*8 - 0x11], al
mov al, 0x9d
cdq
xchg edx, eax
in al, 0x5c
retf 0x3f58
imul esi, dword [esi + 0x71168014], 0x3daa3080
lodsd eax, dword [esi]
mov ah, 0x47
int1
xchg esp, eax
push cs
pushfd
sti
push ss
rol byte [esi], cl
mov dword [0x65a55633], eax
jl 0x590f2a
jp 0x590f65
in al, dx
pop ecx
mov dl, byte [ecx]
and eax, 0x920ca013
add byte [edi - 0x6e], ah
push ebx
mov ss, word [edi]
xchg edx, esp
adc dword [ecx + 0x791e8814], esp
mov byte [ebp - 0x46], cl
and eax, 0x9c2fdcb5
fsubr qword [edi]
pushfd
hlt

Function at 0x5916c0
Capabilities:
Encode data using xor

Disassembly:
invalid
push ds
jns 0x59164b
dec ebx
mov eax, dword [0x2fdcb525]
popfd
rcl dword [esi - 0x3c]
mov dword [0xcb419b5e], eax
pop ebx
int 0x7b
jmp 0x74def947
Function at 0x5990ae
Capabilities:
Encode data using xor

Disassembly:
fst dword [ebx - 0x3d]
cmpsb byte [esi], byte es:[edi]
push ebp
jecxz 0x5990b4
aam 0x4a
sub eax, 0x41d968dc
sal dword [eax + 0x2998543], 1
nop
test dword [edx], 0x57c759c4
mov al, 0x43
test dword [ecx + 0x2f79002], ebx
les ebx, [ecx - 0x39]
push edi
xor al, cl
jp 0x59906c
loope 0x599104
js 0x59907b
out dx, al
mov dword [eax - 0x37], edi
leave
push ebp
lds ebp, [edi + ebx*2 + 0x54c6599c]
xor ecx, esi
jo 0x599086
jnp 0x59908a
invalid
fld qword [ecx + 0x243922ab]
jns 0x59906c
retf 0xd881
bound esi, qword [esi - 0x35a89bcb]
pop eax
aas
retf 0xcb7b

Function at 0x5a048c
Capabilities:
Encode data using xor

Disassembly:
and dl, cl
imul eax, esp, 0x48b9de48
jmp [edx - 0x1b]
jne 0x5a04aa
out dx, eax
pop edx
test byte [esi], dl
test bl, ah
push ds
mov al, byte [0x7e1b8b16]
lea ecx, [esi - 0x44]
sub al, 0xa2
lds esi, [esi + esi*8]
xor al, 0xf6
stosb byte es:[edi], al
cmp dword [ecx - 0x7372c438], ebp
sbb cl, byte [eax - 0x1153e511]
jg 0x5a04a0
mov bh, ch
sbb ch, byte [esi + ebp*8 + 0x798aef7f]
inc esi
mov bh, byte [ecx + 0x46]
les edx, [eax - 0x3a]
mov eax, dword [0xcd5ae050]
pop ebp
and al, 0xd7
popal
fsubr qword [edi]
and dword ss:[eax + 0x7c], esp
sti
div eax
inc edx
imul edx, dword [0xf465c07e], 0xbd3eeacc
fistp dword [edx - 0x106d28f6]
jo 0x5a04f0
cmpsb byte [esi], byte es:[edi]
mov byte [0x26ea91eb], al
push cs
mov edi, dword [ebp + eax*2 - 0x2f079619]
out dx, al
salc
cmc
je 0x5a0481
push ecx
add edi, esi
push ebx
add dword [edi - 0x48986634], eax
pushfd
xchg byte [ecx - 0x7a], ah
mov bl, 0x7b
push edx
push ecx
bound ebp, qword [eax]
jg 0x5a0501
push ds
add byte [ebp + ecx*2 + 0x6be76b4], ah
pop eax
scasd eax, dword es:[edi]
or esp, dword [esp + ecx + 0x3e]
mov ebx, 0x27bb75ec
mov bh, 0xd2
and ebx, ebp
ret
Function at 0x5a0918
Capabilities:
Encode data using xor

Disassembly:
outsd dx, dword [esi]
or bh, cl
mov dh, 0x72
rol byte [esi + 0x21], 1
rcl byte [edi - 0x33]
dec ebp
frstor dword [edi + edx*2 + 0x4cde5d94]
sub esp, esi
push esi
lodsd eax, dword [esi]
xor esp, dword [ebx - 0x4a7bca3a]
xor al, 0xaa
int 0x3c
jmp dword [ebp + 0x23d0b121]
invalid
mov edi, dword [esi]
movsd dword es:[edi], dword [esi]
sub bh, byte [eax - 0x3a63d521]
dec edi
fistp qword [edx - 0x1f921fb7]
jbe 0x5a093b
loopne 0x5a0983
lea ebx, [0x9b27d48d]
std
outsb dx, byte [esi]
cld
wait
jbe 0x5a08eb
in eax, dx
adc dword [ebx], 0x76
test dword [ecx - 0x2b], eax
inc esp
jbe 0x5a08c2
inc ecx
aad 0x44
fidivr dword [ebp - 0xe9a07b4]
popal
add bl, dh
inc edi
pushal
pop es
xor esp, dword [ebp - 9]
add dh, cl
dec edi
jge 0x5a0940
jle 0x5a0973
call 0x955fa6bb
cld
bswap ecx
sub eax, 0xbe4324b6
js 0x5a09a6
stosd dword es:[edi], eax
cmp ebx, dword [esi - 0x53]
push ds
push ebp
int3
lds ebx, gs:[ecx - 0x37]
test al, 0x5b
cwde
and eax, 0xba4f28ba
add al, 5
lahf
punpckhdq mm3, qword [ecx + 0x66f06d62]
add eax, esi
push 0xffffffffffffff99
bound ebp, qword [ebp - 0x10]
add ax, si
inc ecx
dec ebp
in eax, dx
jge 0x5a0994
div dword [edx + 0x7c]
dec edi
dec edx
div dword [edx + 0x172c4274]
or dword [ebx + 0x32120c1f], esi
sahf
mov dword [0x751f2135], eax
cmp eax, 0xbb15e22e
daa
cmpsd dword [esi], dword es:[edi]
stosd dword es:[edi], eax
xor bl, byte [esi + 0x1f2135a3]
jne 0x5a09e5
loop 0x5a09c0
adc eax, 0xaba727bb
mov ebx, 0xb1aba727
push esi
mov cl, 0x56
push es
cli
outsb dx, byte [esi]
push 0xabe9f245
popal
mov edi, 0xfa84211f
xchg esi, eax
cmp eax, 0xe93c1aba
dec esp
lodsb al, byte [esi]
scasb al, byte es:[edi]
adc ecx, edi
pop ecx
add edx, dword [esi + esi]
cmp al, 0x9a
cli
cld
jno 0x5a09a0
loopne 0x5a0983
cmp dword [eax - 0x7c6dafd6], eax
salc
push esp
retf 0x5cad
xor bl, al
jno 0x5a09aa
inc edi
xlatb
mov dl, 0x41
clc
jp 0x5a0a45
les esi, [edi + 0x5e]
test eax, 0x84e00e8f
int 0xb5
mov eax, 0xb7950a8a
mov ch, 0x26
mov eax, 0xb7950a8a
add dword [ebp - 0x43df9fd6], ebx
rcl dword [ebx + 0x3f], 0x3d
xchg ebx, eax
pop ebx
dec esp
add byte [edi - 0x3d], cl
cdq
loope 0x5a0a6a
cdq
pop ecx
js 0x5a0a4b
mov eax, 0x87bab906
dec ecx
fisttp word [ebp - 0x53]
add edi, dword [edx + esi*4]
cwde
cmc
jb 0x5a09f9
hlt
mov eax, dword [0xd7df2dde]
push edi
push ecx
bound ebp, qword [ebx + ecx*8 + 0x4a]
xchg esi, eax
and edx, dword [edi + 0x25d6b323]
nop
Function at 0x5a47f6
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x5a4816
test eax, 0x7e1b8b0a
lea edi, [0xc5a22ca0]
xor al, 0x83
mov dh, 0x39
test eax, 0x888e3bc8
sbb cl, byte [eax - 0x155be511]
jg 0x5a4803
mov bh, byte [ecx + 0x42]
inc edx
rcl byte [eax - 0x3a], 0xa1
push eax
xchg edx, eax
pop esi
int 0x5d
invalid
pop ebp
and al, 0xd7
popal
enter 0xffffffffffffcc5e, 0xffffffffffffffab
sar byte [edx], 1
mov bl, 0x23
inc esi
mov ch, 0x72
and byte [edx + ebp + 0x360cbc4d], dh
mov eax, dword [0x15a35031]
js 0x5a481f
jo 0x5a4856
loop 0x5a4867
mov edx, 0x21d2b727
jmp 0xaa28a10b
push ebx
scasb al, byte es:[edi]
outsd dx, dword [esi]
dec edx
fisttp dword [ebx + 0x2e]
frstor dword [ebp - 0x60]
frstor dword cs:[ebp - 0x60]
cmp al, 0xd2
mov ch, 0x44
adc dword [esi + 0xbf89909], 0x38aa08b8
pop edi
cdq
clc
or edi, dword [eax + 0x5f38aa08]
stosb byte es:[edi], al
sub eax, 0x3a5fcf4b
leave
push ss
jecxz 0x5a48d9
not byte [ecx - 0x62e02fa0]
or eax, 0x6f12a754
out dx, al
jl 0x5a48a2
div byte [0xf693037b]
add eax, 0x5ac443b3
cmp eax, 0x71f709cc
loope 0x5a4819
xchg ebx, eax
test byte [0x5ac443b3], 0x3d
int3
jae 0x5a485c
div dword [edx - 0x20]
xchg dword [edx - 0x39], esi
sti
ja 0x5a488b
xor byte [ecx - 0x34], 0xea
add eax, 0x59cea7b4
add dword [eax], 0xd55aabfc
mov bh, 0xe8
sahf
jnp 0x5a4923
cmpsd dword [esi], dword es:[edi]
dec edi
sub esi, dword [0xeae38cd7]
invalid
sbb al, 4
mov dh, 0xe
push cs
pop ds
xchg ecx, eax
aad 0x68
or byte [edx - 0x633c1f9e], bh
lahf
jbe 0x5a4913
adc byte [eax - 0x799b2621], ch
sbb eax, 0xaedbce85
fiadd word [ebp - 0xbfdc70f]
lodsb al, byte [esi]
xchg ebp, eax
sub dword es:[ebp - 0x2d999b93], 0x737b340f
loopne 0x5a495c
bound ecx, qword [eax]
pop edi
xor ch, byte [ecx]
loope 0x5a48dc
pop ebx
lodsb al, byte [esi]
insd dword es:[edi], dx
inc ebp
invalid
invalid
add al, ah
fadd qword [ebx - 0x31]
invalid