joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ead5
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004eb0ee
call fcn.0042a56c
cmp dword [eax + 0x14], 0
jne 0x46eaf2
mov ecx, esi
pop esi
jmp fcn.0046e5da
pop esi
ret

Function at 0x4720c4
Capabilities:
Get common file path
Get file system object information

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.004f61d7
call fcn.0042a56c
cmp dword [eax + 0x14], 0
jne 0x4720e1
mov ecx, esi
pop esi
jmp fcn.00471a97
pop esi
ret

Function at 0x4f3136
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x4f314e
mov edi, dword [esi + 0xc]
jmp 0x4f318e
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x4f3167
call fcn.00428fbf
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4f317c
call fcn.00428fbf
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4f318e
call fcn.00428fbf
call fcn.0042ab3b
cmp dword [eax + 0x3c], 0
je 0x4f31a3
push edi
mov ecx, ebx
call fcn.004f1f6a
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004f3050
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x4f31c1
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x4f31cd
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x50f8ec
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x5897b0]
jne 0x50f8f6
repz ret
jmp fcn.005193e4
Function at 0x528998
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5897b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0051a3e5
and dword [ebp - 0x14], 0
cmp dword [0x59140c], 0
mov dword [ebp - 0x18], eax
jne 0x528a4b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x528af3
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x528af3
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x568d58
push ebx
mov dword [0x59140c], eax
call edi
push eax
call esi
push 0x568d44
push ebx
mov dword [0x591410], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x591414], eax
call edi
push eax
call esi
mov dword [0x59141c], eax
test eax, eax
je 0x528a4b
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x591418], eax
mov eax, dword [0x591418]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x528aa4
cmp dword [0x59141c], ecx
je 0x528aa4
push eax
call esi
push dword [0x59141c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x528aa4
test ebx, ebx
je 0x528aa4
call edi
test eax, eax
je 0x528a9b
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x528a9b
test byte [ebp - 8], 1
jne 0x528aa4
or dword [ebp + 0x10], 0x200000
jmp 0x528ad7
mov eax, dword [0x591410]
cmp eax, dword [ebp - 0x18]
je 0x528ad7
push eax
call esi
test eax, eax
je 0x528ad7
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x528ad7
mov eax, dword [0x591414]
cmp eax, dword [ebp - 0x18]
je 0x528ad7
push eax
call esi
test eax, eax
je 0x528ad7
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x59140c]
call esi
test eax, eax
je 0x528af3
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x528af5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050f8ec
leave
ret
Function at 0x401711
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.0040a720
mov dword [esp + 0x28], 0
test esi, esi
jne 0x401757
xor eax, eax
jmp 0x40175a
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.0040ad55
lea eax, [edi + 0x7c]
test eax, eax
je 0x401775
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b0ba
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4017b3
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call fcn.0040b0ba
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.0040a43a
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.0040add6
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40ab8a
Capabilities:
Encode data using xor

Disassembly:
or al, 0xaf
test byte [ecx], 0x17
lahf
mov al, 0xcd
adc al, 0x64
and eax, 0x931cf934
adc ecx, dword [ecx]
dec eax
movsd dword es:[edi], dword [esi]
add al, 0xf3
xor edi, ecx
scasb al, byte es:[edi]
not dword [edi + 0x6a171759]
xchg edi, eax
pop ecx
pop ss
pop ss
push 0x59
xchg edi, eax
pop ecx
pop ss
pop ss
push 0x59
imul ebp, dword [edx + 0x60], 0x73
push esi
xchg ebp, eax
mov dl, 0x11
aam 0x1d
loope 0x40ab70
wait
or byte [0x1cc6ff00], dh
xor al, 0x28
jb 0x40ac1d
adc eax, 0x821dd3f0
out dx, al
mov al, 0x39
out 0x65, al
arpl word [eax], sp
mov dword [0xb6db4001], eax
cmp byte [ebx + 0x2f], 6
xor bh, byte [ebp - 0x2fbc6169]
mov edi, 0x487738db
cmp eax, dword [edi + 0x67efa13b]
push ss
pop ebx
in eax, dx
mov edx, 0x55097636
loope 0x40ac1d
xlatb
xor dl, 0x60
pushfd
jne 0x40abe0
jbe 0x40aba4
invalid
nop
inc esp
push ebx
xchg ebx, eax
cmp eax, 0x9ad6ac55
dec eax
cwde
movsd dword es:[edi], dword [esi]
xchg edi, eax
in al, 0x36
popfd
sbb dword [edx], esi
invalid
Function at 0x40e860
Capabilities:
Encode data using xor

Disassembly:
push 0x67
jl 0x40e8e1
pop eax
mov eax, dword [0x7989bb99]
js 0x40e8d4
mov al, byte [esi + 0x2214d1cb]
lodsd eax, dword [esi]
cwde
outsb dx, byte [esi]
cmp byte [ecx + 0x10], ah
sub dword [ebp + 0x78], edx
in al, 0xed
out dx, al
rcr ah, 0x33
sub al, 0xa6
rcr dword [edx], cl
fldcw word es:[ebx - 0x7b]
enter 0x3671, 0x6b
pop ebp
push ebp
add dword [edi], 0x26
adc eax, 0x17d626f5
xchg sp, ax
jge 0x40e86c
jbe 0x40e8f0
adc byte [esi], bh
in eax, dx
invalid
lodsd eax, dword [esi]
hlt
mov byte ss:[ecx + 0x13], ch
invalid
sub ebx, dword [0x8914dac0]
invalid

Function at 0x45d64b
Capabilities:
Encode data using xor

Disassembly:
or byte [ecx - 0x6c14bbb6], dl
add dword [eax + 0xa], edx
rcl dword [0x3f9de82f], 0x47
mov al, byte [0x62798599]
loop 0x45d6bd
cli
test eax, 0x1a8f91aa
add edx, esp
nop
invalid
cdq
invalid

Function at 0x45ecb0
Capabilities:
Encode data using xor

Disassembly:
inc ebp
invalid
cmc
inc esi
or eax, 0xa7093a28
sbb al, 0xb6
and eax, 0xfc91f13c
leave
mov byte [0x52954809], al
outsb dx, byte [esi]
int 0x7e
cli
inc ebp
adc al, 0xe1
jnp 0x45ec37
test dword [ecx + 0x64170733], eax
mov edi, 0xa627a36c
cdq
pop edx
mov dh, 0x52
in al, 0xe7
jno 0x45ebc3
lahf
push ecx
xchg ecx, eax
movsd dword es:[edi], dword [esi]
das
and byte [eax + 0x586a688f], 3
rol ecx, 1
adc eax, 0xd14b8487
arpl word [edi], sp
jb 0x45ec50
salc
nop
invalid
cld
pop edx
push eax
inc edx
iretd
xor al, byte [ebp - 0x1f145df3]
jno 0x45ec10
sub al, 0xb6
cmp al, byte [ebx + 0x41b0f146]
inc ecx
das
push esp
int1
sbb edi, dword [esi]
xchg byte [eax + 0x31bfb1a6], al
add al, 0x3b
inc edi
sub al, 0xa1
mov al, byte [0xf3d187c0]
xchg edx, eax
fsubr st(1), st(0)
fcomp qword [ebp - 0x357b6059]
xor byte [ecx - 0x3e], 0xb7
dec esi
push dword [0xe5d21fef]
popfd
aaa
bound esi, qword [edx]
call 0xfcb29472
pop esp
or dword [edi], 0xffffff82
ja 0x45ec5f
push eax
jae 0x45ecea
cmp dword [ebx + 0x72], ebx
mov fs, word [0x798e1321]
mov byte [0x8a61230e], al
mov edx, 0x3ab05b32
mov al, 0x3a
inc edx
or edx, dword [edi]
xchg ecx, eax
cmp byte [eax + 0x67], al
in al, 0x57
in eax, dx
sub byte [0x719274b4], 0xc4
xor eax, 0xf52979da
rcr byte [ebx + edx*8 - 0x2b], cl
sbb eax, 0x2523c6bc
ror dword [ebx], 0xb7
and ch, dh
and ch, byte [edx]
nop
jl 0x45ed19
inc eax
and byte [edi], 1
xor cl, al
nop
push esi
pop ss
fcos
cmp ecx, dword [ecx + ecx*8 - 0x36]
xor edx, 0xffffff81
in al, 0xda
and esi, ecx
invalid
retf 0xf283
jp 0x45ed6d
adc dword [edx + 0xe], 0x2de1324b
inc esi
invalid
adc al, bh
add dword [ebx], esi
adc dword [eax + 0x6bd2e04f], eax
insd dword es:[edi], dx
mov eax, dword ss:[0x91ba6067]
sbb eax, 0x825ebb70
and esp, dword [ebx - 0x1c2d0c57]
scasb al, byte es:[edi]
fbstp tbyte [eax - 0x56a42706]
inc edx
mov cl, 0xf2
rcl dword [edx - 0x12736e00], 0x51
mov dl, 0xa0
mov edx, 0x22b2108a
or eax, 0x7671a250
xchg ah, ch
int1
invalid
Function at 0x45eecb
Capabilities:
Encode data using xor

Disassembly:
invalid
add dword [ebp - 0x1b3c07d0], 0xc30fe761
sal byte [esi + 0x57], 0x46
scasb al, byte es:[edi]
push 0xffffffffffffffa6
pop ss
pushal
xor ebx, ecx
arpl word [0x508fd378], bp
movsd dword es:[edi], dword [esi]
neg edi
xchg esp, eax
sbb byte [ebp - 6], 0x53
clc
aam 0xad
stc
sbb ebx, dword [edi]
mov edx, 0xb31e0485
jle 0x45eede
xchg ecx, eax
bound edi, qword [esi]
xor dh, byte [ecx]
inc ecx
rcl byte [edi - 0x3dd1b12f], 0xb7
xor byte [edx + 0x323ec287], dh
adc byte [eax + edx*4 + 0x12], al
ja 0x45eeac
cmc
lahf
cmpsb byte [esi], byte es:[edi]
dec edx
loope 0x45ef84
inc esi
rcl byte [eax], cl
xchg ebx, eax
fidivr word [ebp + 0x4a4f4664]
ror dword [ebx + 0x22], 0xfa
and al, 0xec
add dword [edi + 0x318c4364], eax
salc
or ch, byte [eax + 0x23]
invalid
jnp 0x45ef74
pushfd
lodsd eax, dword [esi]
add ebp, ebx
wait
xchg ecx, eax
mov al, 0x4b
ret 0x447d
push ds
sbb ebx, esp
sal dword [ecx], 0xef
out dx, eax
sbb byte [eax], ah
cmp dword [ebx], 0xf0291cb
lcall 0x537b, 0xe232e241
loop 0x45efb8
loop 0x45f003
push ebx
push ebp
lock add dword [eax], ecx
pop esi
loopne 0x45ef79
int1
adc bh, ch
insd dword es:[edi], dx
xor bl, bh
push ebx
and cl, byte [esi - 0x6e5cf010]
sbb cl, ch
sbb esi, dword [ecx - 0x22f3bb30]
mov ebp, 0x7766892f
idiv dword [ebp + edi*4 - 0x39]
test al, 0xa
inc ebp
sbb esi, eax
retf 0x8a4a
jle 0x45efbe
push cs
lodsd eax, dword [esi]
imul esi, dword [esi + 7], 0x93785c7a
pop es
jp 0x45f01d
js 0x45ef56
invalid
int3
pop esi
xchg dword [ecx], edx
push edx
and byte [ebx - 0x325317cf], 0x69
mov esi, 0xf31c181c
sal dword [edx - 0x64], cl
add eax, 0x85778ee4
add dword [edi], esi
mov bh, 0x49
lds edi, [esi - 0x75]
sbb al, 0x67
mov dh, 0x88
cmp al, 0xba
rcl dword [ecx - 0x3e876562], cl
xor esi, dword [0x1682bcd2]
cmp eax, 0xf607c2ed
mov dword [0x2ee9c318], eax
fistp word [edi - 4]
out 0x41, al
test edx, esi
xchg ebp, eax
mov dword [0x4c2e5274], eax
cmp esi, dword [edi - 0x2a605a9f]
mov edi, 0x8381f7b9
pop es
sub eax, 0x92f80f8e
mov ebx, 0xe352bd73
and byte [eax - 0xe], ah
popal
or cl, ah
fistp qword [esi - 0x42]
xchg esp, eax
push es
push cs
pop ebp
jg 0x45f0d5
add dword [edx - 0x30], edx
adc bh, byte [edi - 0x5a]
dec ecx
mov bl, 0xfd
dec ebx
lcall 0xdf83, 0xfe1f6ead
xchg byte [ecx], bh
xor ch, byte [ebx + 0x3fbb6867]
inc esi
popal
insb byte es:[edi], dx
mov al, 0x5d
or al, 0x9e
push cs
out 0x77, al
mov al, byte [0xf0f27c2]
sal dword [edx - 0x5ff9a2da], cl
or al, 0x93
adc edi, dword [edi]
invalid
and byte [ebx - 0x23dc870c], dh
rcr byte [ebx], cl
xor dword [eax + 0x51396e5], 0xffffff92
fisttp dword [esi - 7]
xor dl, byte cs:[edx + eax*4 + 0xe]
pop edx
bound esi, qword [ebx]
loope 0x45f170
mov eax, dword [0x1c929c8]
or dword [eax], esp
lodsb al, byte [esi]
sub al, 0xd8
push edx
iretd
aas
invalid
Function at 0x4be3a8
Capabilities:
Encode data using xor

Disassembly:
or ecx, dword [edx]
xor dword [esi - 0x37940a07], ebx
cld
xchg esp, eax
mov ecx, 0x392a9e6d
xor cl, byte [esi - 1]
mov ch, 0xb2
idiv dword [eax + 0x1c79b8ea]
adc eax, 0x39781d9c
cwde
stosd dword es:[edi], eax
insd dword es:[edi], dx
push ss
adc ch, cl
jb 0x4be3b7
mov bh, 0x2b
cmp al, byte [edx]
cli
jp 0x4be3d4
cwde
invalid

Function at 0x4e1aba
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5193a8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x5624e0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [esp + 0xc]
call fcn.004eaac9
mov dword [esp + 0x28], 0
test esi, esi
jne 0x4e1b00
xor eax, eax
jmp 0x4e1b03
mov eax, dword [esi + 4]
push eax
call dword [0x51b1ac]
push eax
lea ecx, [esp + 0x10]
call fcn.004eb0fe
lea eax, [edi + 0x7c]
test eax, eax
je 0x4e1b1e
mov eax, dword [eax + 4]
push eax
mov eax, dword [esp + 0x14]
push eax
call int.004eb463
mov edx, dword [esp + 0x10]
mov ecx, dword [edi + 0xbc]
push 0xcc0020
push 0
push 0
push edx
mov ebx, eax
mov eax, dword [edi + 0xc0]
push eax
mov eax, dword [esi + 4]
push ecx
push 0
push 0
push eax
call dword [0x51b194]
test ebx, ebx
je 0x4e1b5c
mov ebx, dword [ebx + 4]
mov ecx, dword [esp + 0x10]
push ebx
push ecx
call int.004eb463
mov edx, dword [esi]
mov edx, dword [edx + 0x28]
lea eax, [edi + 0x84]
push eax
mov ecx, esi
call edx
push 1
mov ecx, esi
call fcn.004ea7e3
mov ecx, dword [edi + 0xb8]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xb4]
mov eax, dword [edi + 0xa0]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
lea ecx, [edi + 0xa4]
push ecx
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0x28]
lea ecx, [edi + 0x8c]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe4]
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
push ecx
mov ecx, esi
call edx
mov ecx, dword [edi + 0xe0]
mov eax, dword [edi + 0xcc]
mov edx, dword [esi]
mov edx, dword [edx + 0x68]
push ecx
add edi, 0xd0
push edi
push 0xffffffffffffffff
push eax
mov ecx, esi
call edx
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004eb17f
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4eaf33
Capabilities:
Encode data using xor

Disassembly:
ljmp 0x65af:0x3bb0b786
daa
nop
pop edx
push 0x72
mov dh, 0xe2
mov ecx, dword [esi]
int1
wait
xor dh, byte [ebp - 0x69f06bc0]
push eax
xor eax, 0xa9c6f330
pop ss
das
mov dword [ebp + 0x76], edx
mov ch, 0x7d
dec ebx
xlatb
pop esi
rol byte [edx], 1
shl dword [edx + 0x3d], 1
aad 0x3a
jb 0x4eaf02
ja 0x4eaef1
push 0xffffffffffffff8d
loop fcn.004eaf33
jb 0x4eaf96
loope 0x4eaea8
daa
jecxz 0x4eaf09
inc edx
and cl, byte [esp + edx*8 + 0x63]
mov dl, 0x42
pop ecx
and ecx, dword [eax + ebp*4 + 0x1c0c6368]
test al, 0x68
arpl word [esp + ebx], cx
test al, 0x68
arpl word [esp + ebx], cx
movsb byte es:[edi], byte [esi]
or eax, 0x5cab1ca2
jl 0x4eaf52
adc edx, dword [esi + 0x25a2e117]
mov bh, 0xc9
pop ss
adc ah, al
jno 0x4eaf1c
jno 0x4eafb6
push ebx
dec edi
xor bl, 0xdd
xlatb
fst st(7)
arpl ax, cx
insb byte es:[edi], dx
xchg ebx, eax
lodsb al, byte [esi]
mov cl, byte [edx - 0xc1b14db]
std
inc eax
xchg edi, eax
push esi
pop ss
loopne 0x4eaf50
push 0xffffffffffffffd2
invalid
sal dl, cl
stosd dword es:[edi], eax
and dword [ecx - 0x7080a2b9], 0x6f93eeb8
mov eax, dword [0x8f7f5d47]
mov eax, 0x296f93ee
jl 0x4eafd0
xchg ebx, eax
outsd dx, dword [esi]
sub dword [esi], esp
jl 0x4eafd0
jge 0x4eaf8f
jb 0x4eaf8b
lodsb al, byte [esi]
xchg edx, eax
and al, 0xb1
adc ah, byte [esi + eax + 0x14]
hlt
inc eax
push 0xfffffffffffffffa
adc edi, dword [ebx + 0x20f297a6]
mov byte [ebx + 0x15], bl
sub esp, edi
adc bh, byte [eax + 0x74023018]
ret 0x8e63
dec ebp
xchg ecx, eax
push cs
xor bh, ah
jno 0x4eb03c
xor dword [edx], edx
test al, 0x91
and byte [edi - 0x71a2750f], 0x33
sbb dl, byte [ebx + 0x431bebe4]
push cs
push eax
and dword [edi - 0x68], esi
cmc
sahf
pop ss
xor eax, 0xf3c2296e
invalid
mov edx, gs
dec ebx
dec esi
pop ebp
mov ch, 0xf3
wait
cmpsb byte [esi], byte es:[edi]
imul edx, ebx, 0x7fbf523a
adc eax, 0x4bea976f
invalid
Function at 0x4ec9bd
Capabilities:
Encode data using xor

Disassembly:
sub al, 0xdc
xchg ebp, eax
invalid
movsb byte es:[edi], byte [esi]
sal al, cl
outsd dx, dword [esi]
push 0x9a4363c2
mov ah, 0x34
inc edx
xor byte [edx], cl
ja 0x4eca41
shl byte [ebx], cl
xchg edx, eax
dec ecx
xchg edx, eax
jbe 0x4ec9b7
adc ah, ah
mov al, dh
cmp byte [edi - 2], 0xbe
inc edi
fidiv dword [edx - 0x51e01138]
wait
xchg edx, eax
salc
inc esp
mov edx, 0x33665f78
movsb byte es:[edi], byte [esi]
cmp edx, dword [ebx]
add eax, dword [esi + 0x33]
xor esp, dword [ebx + edi + 0x33460313]
xor esi, dword [esi + 0x6b0c7121]
push ss
out 0xc6, eax
jecxz 0x4ec9ec
xchg ebx, eax
sahf
push cs
push ecx
imul esp, dword ds:[esi], 0xffffffe7
add ebx, dword ss:[esi]
push esi
aaa
push es
xor ecx, dword [esi + 0x43]
pop esi
fdisi8087_nop
jmp 0x4eca10
pop esi
rol dword [edx + 0x68e2aed2], cl
invalid
push ss
arpl word [esi - 0x68], bp
push ds
xchg dword [edx - 0x29], ecx
jl 0x4ecaab
jae 0x4eca1d
sbb dword [esi - 0x65de51e8], 0x51
in al, dx
xchg esi, eax
xor dword [esi + 0xef316e3], 0xffffff88
push ds
mov ah, 0x66
jecxz 0x4eca5b
push cs
mov byte [esi], bl
xchg ebx, eax
les esp, [ebx]
mov dl, 0xf8
ret 0xe73
xor ah, byte [ebx + 0x3090f043]
mov dword [0xb2e231e2], eax
push esp
push cs
clc
pop ecx
pop ds
inc ebx
add ecx, dword [0x4e1344f2]
pop esp
loopne 0x4eca2b
xchg edx, eax
int 0x5b
mov dword [edx - 0x2d0bd063], 0x74023684
cmpsd dword [esi], dword es:[edi]
jmp 0x6398fd81
and esi, 0x63
inc esi
outsb dx, byte [esi]
xchg edx, eax
scasb al, byte es:[edi]
add byte [ebx - 0x6d1f6d23], 0xb6
xor esi, 0xeaeca090
into
sar byte [esi - 0x4e], 0xa
cmp dword [edx + 0x22fd750e], 0x51
mov edx, 0x22fd750e
push ecx
outsb dx, byte [esi]
jns 0x4eca37
dec eax
loop 0x4ecae9
lahf
jb 0x4eca90
jno 0x4ecac9
push edx
out 0x3b, eax
insd dword es:[edi], dx
mov edi, 0x60a0f286
adc dword [eax], 0xffffffeb
add byte [edx + 0x72], bl
js 0x4ecb23
pop edx
jb 0x4ecb30
js 0x4ecb23
sub al, 0xdf
xchg edx, eax
adc eax, 0x27634766
sub dword [edi], ecx
arpl word [ebx + edx*8 - 0x7e], di
cmpsd dword [esi], dword es:[edi]
cwde
rcl byte [ebx - 0x1d], cl
xchg edx, eax
mov dl, 0xfa
retf 0xe1c2
adc edx, dword [ebx]
insd dword es:[edi], dx
mov ch, 0xe6
pop esi
add eax, 0xb64a2282
pop edi
lodsb al, byte [esi]
mov edx, 0xf652c1ce
jo 0x4ecb27
into
rcl dword [edx - 0xa], 0x70
sub ch, dh
out dx, al
into
invalid
insb byte es:[edi], dx
bound ebx, qword [esi + edx + 0x4a]
dec edx
sbb eax, 0xc2619081
jno 0x4ecb47
adc edx, dword [esi]
push ss
mov esp, 0x2e6d3cdf
jle 0x4ecaf7
test edi, edx
push es
clc
ret 0x8f3c
jae 0x4ecb70
sbb al, 0x73
jne 0x4ecb73
push esp
fadd st(3)
push cx
mov bl, 0x26
inc ebp
and byte [eax], bl
inc ebx
lodsd eax, dword [esi]
and esp, 0xa08e70d6
sal bh, cl
xchg dh, ah
std
sub eax, 0x63209b6
aaa
mov ebp, 0x623bf4d
cmpsd dword [esi], dword es:[edi]
jmp 0x671ce44e
into
frstor dword [edi - 0xc]
retf 0xb3ac
Function at 0x4f378d
Capabilities:
Encode data using xor

Disassembly:
mov ebp, 0x92972fc0
add esi, edx
mov esp, 0x93ef468a
hlt
int1
jecxz 0x4f3784
ror byte [esi + ecx + 0x78], cl
or al, 0xae
mov word [eax + 0x42], es
xor al, byte [edx + 0x1e7062f5]
dec esi
add bl, ch
push eax
inc esp
inc ecx
xchg ebp, eax
xor al, byte [esi]
ret 0xae82
mov byte [0x63b98875], al
je 0x4f373d
mov cr2, edx
jge 0x4f37ae
invalid
push edx
pop es
fbstp tbyte [ebx - 0xf7a2cce]
invalid

Function at 0x53837c
Capabilities:
Encode data using xor

Disassembly:
scasb al, byte es:[edi]
ret 0x8680
xchg edx, eax
movsd dword es:[edi], dword [esi]
insd dword es:[edi], dx
sbb dword [ebx + 0xc1ce73d], 0x78d66b4e
salc
push ebp
test cl, dl
mov ch, 0x3c
xchg byte [esi], cl
mov edi, dword [eax + 0x2b647396]
inc ecx
jle 0x53834d
sti
into
movsb byte es:[edi], byte [esi]
mov ah, 0xda
xchg ecx, eax
into
push ss
or byte [ecx + 0x5a], 0x8c
mov ss, word [ebp + ebx*4 - 0x53]
fucom st(7)
inc ebp
invalid

Function at 0x5431ca
Capabilities:
Encode data using xor

Disassembly:
cmp al, 0x14
sbb esp, edi
sahf
scasb al, byte es:[edi]
xchg dword [ecx], ebp
pop esi
add al, 0xa8
xchg esp, eax
sar dword [edx - 0x48d1db04], 0x74
aam 0x24
adc byte [ecx], ah
les ebx, [edx]
xor al, 0x48
sub byte [esi - 0x1f], ah
push ss
xlatb
adc byte [ecx - 0x6bea2ef6], bl
xchg ecx, eax
mov byte [0x9f9a54ea], al
aam 0xc
in eax, 0x65
popal
les edi, [edx]
mov byte [edi], al
xor al, 0x66
or eax, 0xc87b9146
fldcw word [esi]
jbe 0x5431fa
pop ebx
sub eax, 0x6331d55b
fidiv dword [esi + 0x25bd1484]
enter 0x35ce, 0xffffffffffffff86
cmp byte [ecx], 0x27
sbb byte [eax], bl
imul ecx, ebx, 0xffffffb3
dec edx
lds ecx, [ebx + 0x45]
lcall 0x6b7, 0x1684b79f

Function at 0x583788
Capabilities:
Encode data using xor

Disassembly:
pop ebx
lodsb al, byte [esi]
mov ebp, 0xabf94521
sub al, 0x30
jae 0x5837df
add edi, edx
fild qword [edi]
stc
salc
push es
pop ebp
invalid
sbb byte [edx - 0x3d], bl
out 0xe3, eax
rol byte [ecx + 0x7de1c341], cl
lodsb al, byte [esi]
nop
rol byte [eax + 0x6bda8a52], cl
xchg ecx, eax
les esi, [esi - 0x19]
and ebp, dword [edi - 0x61d2b291]
push ecx
or edx, dword [esi - 0x790a00c3]
inc ecx
cmpsb byte [esi], byte es:[edi]
push ebp
xchg byte [ecx - 0x5a], al
pop ebp
idiv dword [0x327]
sub ah, ch
xor bl, byte [ecx]
and al, 0x3e
adc edx, dword cs:[edx - 0x7e]
pushal
pop esp
jno 0x583800
rcl byte [edx - 0x6b340df9], cl
invalid