joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100018b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0x100018c5
xor eax, eax
pop ebp
ret
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_CreateProcessA]
pop ebp
ret

Function at 0x10001bc3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
mov ebx, dword [ebp + 0x798]
push esi
mov esi, dword [ebp + 0x79c]
push edi
mov edi, dword [ebp + 0x794]
push 0x3ff
lea eax, [ebp + 0x389]
push 0
push eax
mov byte [ebp + 0x388], 0
call fcn.10004d20
push edi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov edi, 0x400
lea eax, [ebp + 0x388]
push edi
push eax
call fcn.10007d28
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
neg esi
push 0
lea eax, [ebp + 0x388]
sbb esi, esi
push eax
add esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001c5b
xor ecx, ecx
cmp eax, 2
sete cl
mov eax, ecx
jmp 0x10001c9d
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x10019282
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x10001c85
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10001c9d
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push ebx
call fcn.10007d28
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0x78c
leave
ret

Function at 0x10001e92
Capabilities:
Query environment variable

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
je 0x10001eb3
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.USER_JPI_PROFILE
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x10001eb3
inc esi
mov eax, esi
pop esi
ret
Function at 0x100028fc
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183ad
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x1a
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002956
push edi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10007d28
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002973
call fcn.100035cd
jmp 0x10002975
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10007d28
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x100029c0
call fcn.1000390e
jmp 0x100029c0
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret

Function at 0x100029ea
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0xc
mov eax, 0x100183dd
call fcn.10005580
mov esi, dword [ebp + 0x214]
xor ebx, ebx
lea eax, [ebp]
push eax
push ebx
push ebx
push 0x23
push ebx
mov byte [esi], bl
mov dword [ebp - 4], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edi, eax
cmp edi, ebx
jge 0x10002a44
push edi
push str.Error:_08x_in_::SHGetFolderPathW_0__CSIDL_COMMON_APPDATA__NULL__SHGFP_TYPE_CURRENT__szPath_
call fcn.10003e12
pop ecx
pop ecx
push ebx
push edi
call fcn.10007d28
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x14]
call fcn.1000373b
mov ecx, dword [eax]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x10002a61
call fcn.100035cd
jmp 0x10002a63
xor eax, eax
push 0x104
push eax
push dword [ebp + 0x218]
push esi
call fcn.10007d28
mov ecx, dword [ebp - 0x14]
add esp, 0x10
cmp ecx, ebx
je 0x10002aae
call fcn.1000390e
jmp 0x10002aae
xor eax, eax
cmp edi, ebx
setge al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10004d10
add ebp, 0x20c
leave
ret
Function at 0x1000319d
Capabilities:
Get common file path

Disassembly:
push 0x14
mov eax, 0x1001843d
call fcn.10005580
mov esi, dword [ebp + 8]
xor eax, eax
xor edi, edi
xor ebx, ebx
mov word [esi], ax
mov dword [ebp - 4], edi
call fcn.10007d28
test eax, eax
je 0x100031c8
call fcn.1000318e
mov ebx, eax
push 0x104
push esi
push ebx
push edi
push 0x1001a0a8
call dword [sym.imp.SHELL32.dll_SHGetFolderPathEx]
mov esi, eax
cmp esi, edi
jge 0x10003223
push esi
push str.Error:_08x_in_SHGetFolderPathEx_FOLDERID_LocalAppDataLow__0__hToken__pPath__MAX_PATH_
call fcn.10003e12
pop ecx
pop ecx
push edi
push esi
call fcn.10007d28
mov ecx, dword [ebp - 0x18]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x14], esi
call fcn.10003873
push eax
push esi
push 0x10019474
call fcn.10003e12
or dword [ebp - 4], 0xffffffff
add esp, 0xc
mov eax, 0x1000321c
ret
cmp ebx, edi
je 0x1000322e
push ebx
call dword [sym.imp.kernel32.dll_CloseHandle]
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push dword [ebp + 8]
mov dword [ebp - 4], 2
push edi
push edi
push 0x1a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x1000328b
push esi
push str.Error:_08x_in_SHGetFolderPathW_NULL__CSIDL_APPDATA__NULL__0__pPath_
jmp 0x100031e7
or dword [ebp - 4], 0xffffffff
cmp esi, edi
jge 0x100032df
push 1
push 0x1a
push dword [ebp + 8]
mov dword [ebp - 4], 4
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, eax
cmp esi, edi
jge 0x100032df
push esi
push str.Error:_08x_in_SHGetSpecialFolderPathW_NULL__pPath__CSIDL_APPDATA__TRUE_
jmp 0x100031e7
mov eax, esi
call fcn.100055b6
ret

Function at 0x10003623
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xa0]
sub esp, 0x120
mov eax, dword [0x1001e08c]
xor eax, ebp
mov dword [ebp + 0x9c], eax
mov eax, dword [ebp + 0xa8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.10007d28
mov ebx, eax
cmp ebx, esi
je 0x10003696
lea ecx, [ebp - 0x74]
call fcn.10001115
mov eax, ebx
mov ecx, dword [ebp + 0x9c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10004d10
add ebp, 0xa0
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036ae
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.10003623
cmp eax, esi
jne 0x100036e0
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x68], 0x100
call ebx
test eax, eax
je 0x1000369e
lea ecx, [ebp - 0x74]
call fcn.10001115
push dword [ebp - 0x78]
mov ecx, edi
call fcn.100010a6
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.10001115
mov eax, esi
jmp 0x1000367c

Function at 0x10004d10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001e08c]
jne 0x10004d1a
repz ret
jmp fcn.1000a8a3
Function at 0x10007d28
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x10007d37
pop dword [ebp - 4]
mov eax, 0x4c964231
sub eax, 0x3c95c4fa
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0xa03b9f0f
sub dword [ebp - 0x14], 0x51e959c4
mov dword [ebp - 0x10], 0x2f549f85
add dword [ebp - 0x10], 0x2deacc0
mov dword [ebp - 0xc], 0xce6c8a0f
sub dword [ebp - 0xc], 0x822045e1
mov dword [ebp - 8], 0x1260f88e
sub dword [ebp - 8], 0x1260f88e
lea eax, [ebp - 0x14]
push eax
mov eax, 0x5060a5c1
sub eax, 0x405f15a9
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0x681db755
add dword [ebp - 0x14], 0xc54b201
mov dword [ebp - 0x10], 0x3f4c5f44
sub dword [ebp - 0x10], 0xfddffdcf
mov dword [ebp - 0xc], 0x4e2dca34
add dword [ebp - 0xc], 0x1541a238
mov dword [ebp - 8], 0xac3fe6f
add dword [ebp - 8], 0xf53c0191
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, 0xe93b6bdc
add eax, 0x26c62438
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x3df53
push 0
call eax
mov ecx, 0x677c7419
sub ecx, 0x677c21ba
mov esi, eax
mov edx, 0xb8f91032
add edx, 0x5709adce
add edx, dword [ebp - 4]
mov edi, 0x7db91a72
mov ebx, dword [edx]
xor ebx, edi
mov dword [esi], ebx
add esi, 4
add edx, 0x7b23609e
sub edx, 0x7b23609a
loop 0x10007e53
add eax, 0xa752f3f4
add eax, 0x58ae485b
mov ebx, eax
add eax, 0x408af6fa
sub eax, 0x408af6f5
mov ecx, 0x10000000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x406291
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4261d0]
jne 0x40629b
repz ret
jmp fcn.0040871c

Function at 0x40adfc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4261d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004074b2
and dword [ebp - 0x14], 0
cmp dword [0x427a30], 0
mov dword [ebp - 0x18], eax
jne 0x40aeaf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40af57
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40af57
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x427a30], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x427a34], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x427a38], eax
call edi
push eax
call esi
mov dword [0x427a40], eax
test eax, eax
je 0x40aeaf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x427a3c], eax
mov eax, dword [0x427a3c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40af08
cmp dword [0x427a40], ecx
je 0x40af08
push eax
call esi
push dword [0x427a40]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40af08
test ebx, ebx
je 0x40af08
call edi
test eax, eax
je 0x40aeff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40aeff
test byte [ebp - 8], 1
jne 0x40af08
or dword [ebp + 0x10], 0x200000
jmp 0x40af3b
mov eax, dword [0x427a34]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40af3b
mov eax, dword [0x427a38]
cmp eax, dword [ebp - 0x18]
je 0x40af3b
push eax
call esi
test eax, eax
je 0x40af3b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x427a30]
call esi
test eax, eax
je 0x40af57
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40af59
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406291
leave
ret

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410284]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401ea2
leave
ret

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53
Function at 0x4239a5
Capabilities:
Encode data using xor

Disassembly:
inc esi
and ecx, dword [edi - 0x148466b8]
das
pop esi
cmc
jg 0x423a17
xor ecx, dword [edx - 0x31]
or bl, dh
salc
salc
je 0x4239ba
mov dh, dl
invalid
xor esi, dword [ebx - 0xaae4988]
inc edi
shr byte [0x871f7604], cl
mov edi, 0x58f7de06
add al, 0x76
pop ds
xchg dword [edi + 0x58f7de06], edi
pushfd
pop ss
mov ah, 0x25
inc ebp
jp 0x4239b1
mov bh, 0xf5
push ss
cmp al, 0x63
pop ebp
test dword [esi + 0x70], ebp
jo 0x423994
pop esp
adc al, 7
invalid
cmp eax, 0x897b1481
ja 0x423a81
loop 0x423a12
pop fs
mov dword [0xdbd6af71], eax
and byte [edx + 0x6843ee1a], dl
ret 0xeed6
int 0x58
sub byte [esi + 0x6a678713], bh
inc ebx
nop
push edx
push esi
pop ecx
das
mov ebx, 0x5729a9d2
and edi, dword [edx - 0x7d]
out 0x70, al
xor ecx, dword [edx + 0x352325b4]
and eax, 0xca4b6ef2
int3

Function at 0x43aec9
Capabilities:
Encode data using xor

Disassembly:
xchg esi, eax
rcl dword [eax], 0xe5
mov ch, 9
inc esp
push es
pop ebp
js 0x43ae8d
push esi
cld
adc edx, dword [esi + 0x34]
test dword [edi], esi
stosb byte es:[edi], al
push ebx
not byte [edx]
aad 0xcc
mov byte [0xf3122702], al
xor dword [ecx - 0x4a4d1b89], eax
mov dword [0x1f56b1b4], eax
mov byte [0xb60e6d44], al
mov dl, 0xed
lds edi, [edx + 0x3e]
and byte [edx + ebx*4 - 0x43392645], dh
and ecx, ebx
adc eax, ebp
jl 0x43aeb4
xchg ecx, eax
push eax
jo 0x43ae22
nop
mov ebp, 0x2545a0f2
mov dword [esi], ebp
pop eax
xor eax, 0x57a7b3b5
push eax
xor byte [eax - 0x11283828], 0x1a
xchg edi, eax
mov edx, 0xd9eec6bf
mov cl, 0x82
lahf
cmpsb byte [esi], byte es:[edi]
mov dl, 0xd5
loop 0x43ae36
fcmovnbe st(0), st(1)
idiv dword ds:[eax]
mov ecx, 0x84e25c34
sbb dl, byte [edi - 0x5fdd3b9a]
xor dl, bl
jl 0x43ae90
mov edi, 0x2a2bb01e
retf 0xb3f1
dec esi
xchg ebx, eax
popal
lcall 0xf015, 0x3359dbb1
xchg edi, eax
mov al, byte [0x765d1ef4]
std
pop ecx
xor edx, dword [0xf4a097f0]
push ds
hlt
pop ebp
jbe 0x43aebc
mov byte [0x368875fb], al
cmp esi, edx
in al, 0x32
jge 0x43aeae
invalid
in al, 0x7d
pop esp
jge 0x43af28
jl 0x43aeba
std
setp byte [esp + esi*2 + 0x70]
mov ebp, 0x6ddd9bfa
daa
xchg edi, eax
std
sub ebp, edx
pop ebx
mov bl, 0xbf
sbb bl, byte gs:[edi]
out dx, eax
sub esp, dword [eax]
std
stosb byte es:[edi], al
pop ebx
jl 0x43ae82
test al, 0x76
in al, dx
adc eax, 0x24f2921
dec dword [bx]
jle 0x43af0a
xchg byte [ecx + 0x7b], bh
lodsd eax, dword [esi]
out 0xcb, al
or al, bl
invalid
pop esp
adc dl, cl
scasd eax, dword es:[edi]
test eax, 0xfb73d5dd
and bh, byte [eax + esi*8 - 0x5d]
add dl, ch
and ch, byte [ebx + 0x27]
test byte [esi + 0x2c], dh
bound edx, qword [eax - 0x26]
cmp cl, byte fs:[edi + ebx*4 + 0x1dde2652]
lodsb al, byte [esi]
mov dl, 0x49
nop
ficomp word [0x9049b2ac]
mov cl, 0x35
je 0x43afa2
jae 0x43af68
pop dword [edx + 1]
adc esi, dword [eax - 0x2024e288]
xchg byte [esi - 0x2f4c5169], bh
mov bh, 0x94
push edi
add edx, ebp
ljmp 0x29b1
cdq
retf 0xbff5
push 0x253a2448
pop eax
iretd
Function at 0x43bf2a
Capabilities:
Encode data using xor

Disassembly:
or ebx, dword [ebp - 0x5cc54306]
in eax, 3
popfd
cli
mov esp, 0x3e5a33a
fstp dword [ebx + 0x209adb42]
fld dword [ebx + 0x74]
wait
inc edx
fistp dword [edx + 0x7443d920]
cmpsd dword [esi], dword es:[edi]
push ds
rcr dword [edx - 0x1edac1da], cl
and eax, dword [edx - 5]
test al, 0x40
xor byte [edx - 0x74e55de3], cl
xor ah, byte [ebp - 0x92751c4]
rcr byte [ebx - 0x2c], cl
jge 0x43bf03
inc ebx
jno 0x43befb
jo 0x43bf5d
mov bh, 0xd3
rol bl, 1
pop edx
xchg dword [edi - 0x17], edi
das
xchg ebp, eax
mov ah, 0x41
mov byte [0xb3c68fd4], bl
pop edx
push ebx
aad 0xa3
sbb al, 1
cdq
and ebx, edx
jecxz 0x43bfb5
xor eax, 0x5d1e83bc
or al, 0xb8
pop ds
and ecx, dword [edx - 0x78b0d0a5]
mov eax, 0x2959200c
adc eax, 0x8f37db23
sub dword [0x8f37db23], edx
jle 0x43befa
neg byte [edx + 0x63]
sub al, 0xb5
lcall 0x1ef6, 0x9e8c7fd6
inc ecx
pop edx
sal byte [ecx + 0x12], 1
jge 0x43bfaa
jnp 0x43bfd5
retf
aaa
mov word [edx - 0x3e08a594], ds
enter 0x28d8, 0x5f
ret
push esp
in al, 0x43
in al, 0xf3
jnp 0x43c021
int3
mov ebp, 0xbb8482fc
mov cl, byte [edi - 0x66]
mov edx, 0xb4fb735b
mov ebx, 0x649a4f8a
mov edx, 0xb4fb735b
cmp byte [ecx + 0x22], 0
aad 0x21
pop ss
sbb al, byte [ecx + 0x74015455]
xchg ebp, eax
retf 0xbf05
mov esi, 0x15f21d8a
hlt
sbb eax, 0x5bf415f2
fmul qword [esi]
jbe 0x43c01f
push ebp
in eax, 0x81
jecxz 0x43c075
mov al, byte [0xa970f256]
xor bh, byte [eax + 0x7b9d41a8]
invalid
test eax, 0x41a8b832
popfd
jnp 0x43c001
jl 0x43bffd
inc esp
push esi
iretd
scasd eax, dword es:[edi]
adc bh, 0xf6
shl byte [ecx - 0x2d20dbb5], 1
push edx
xchg ecx, eax
push eax
xchg esp, eax
cmp eax, 0x90d4f994
ja 0x43c033
ficom dword [ecx]
xchg esp, eax
sbb ebx, dword [eax + edx + 0x3d5cf1c]
lahf
pop edi
rol ebx, 0xc0
pop es
dec eax
fcmovnbe st(0), st(5)
js 0x43c094
inc ebx
shl bl, 0x97
push eax
out 0xd3, al
jno 0x43c04b
inc ecx
les eax, [eax + 0x2a69136a]
mov ch, 0x31
popfd
inc ecx
or byte [edx], bl
push 0x7d
dec ebx
je 0x43c0d0
mov ah, 0x43
xor esp, ebx
rcr byte [ebp + 0x1a], 1
adc ebx, edx
and dword [0x964a029a], edx
pop ss
or esp, dword [esi + 0x45]
push edi
salc
push ebp
adc eax, 0x481b7d17
invalid
adc esi, eax
ret
add eax, 0x162b5d63
push ebp
inc ecx
pop es
inc eax
cmpsb byte [esi], byte es:[edi]
xchg byte [edi - 0x44], bl
sbb ch, byte [edi + 0x19ac4fd7]
enter 0xffffffffffffd103, 0x32
aad 0x56
aas
pushfd
jmp 0x43c130
adc edi, dword [ecx - 0x6a850f9e]
dec edx
sti
push esi
dec ebp
jb 0x43c0b3
outsb dx, byte [esi]
adc byte [ecx + 0x51], 0xa7
xchg esi, eax
mov edi, 0xa744a600
inc esi
pop es
js 0x43c123
test al, 0xb8
mov ch, 0xde
mov eax, dword [0x4b0837d3]
ret
Function at 0x44e6f5
Capabilities:
Encode data using xor

Disassembly:
pop es
outsb dx, byte [esi]
jl 0x44e763
add byte [ecx - 0x41b31d49], 0x84
pop ecx
xor eax, 0xac81d4ae
dec esp
mov esi, 0xae355984
aam 0x81
lodsb al, byte [esi]
jg 0x44e71c
fist dword [ecx + 0x74]
lds ebx, ds:[edx + edx*2 - 0x7f4559e2]
pushfd
push edx
push ds
cmpsb byte [esi], byte es:[edi]
mov edx, 0xf9eb6180
push ds
cmpsb byte [esi], byte es:[edi]
mov edx, 0xf9eb6180
fmul qword [edi]
cdq
wait
shl byte [esi], 1
in eax, 0x86
mov ecx, 0x96c15491
mov dword [0x3b47fec], eax
rol edi, 0xb0
cdq
dec eax
je 0x44e6ed
invalid
mov eax, 0x5d22a0c6
bound esi, qword [esi - 0x2a69e672]
call dword [esi + ecx*4]
invalid
xchg esi, eax
invalid
invalid

Function at 0x452d6a
Capabilities:
Encode data using xor

Disassembly:
add dword [edx], edx
adc eax, 0xb8ecb184
scasb al, byte es:[edi]
mov ecx, 0x8ccb918d
inc esp
xchg ebx, eax
invalid
mov esp, 0x8713854b
adc byte [edi - 0x1b919bb0], al
inc esp
xchg ebp, eax
mov bl, 0xb9
out dx, al
insd dword es:[edi], dx
js 0x452d53
clc
cld
test byte [esi + 0x77], bl
xor eax, dword [ecx]
add eax, 0x3b852215
add dword [eax - 0x5c37435e], esp
cmpsb byte [esi], byte es:[edi]
pop ds
rcr byte [edi + 0x1f], 0x19
cmp byte [edi], 0x27
add ecx, dword [ebx + 0x51]
pop edi
inc edx
mov edx, 0x195661cb
xor dword [ecx], edx
sub byte [eax + 0x11], bl
push ecx
daa
jne 0x452d9e
dec ebp
mov byte [edx], dl
mov dl, 0xef
invalid

Function at 0x48473c
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx + edx*2 - 0x25], ebp
mov word [ebx + 0x71f739b5], cs
fisttp dword [ebx + ecx*4 + 0x71f739b5]
call [eax]
fidivr word [esi]
loopne 0x484739
jo 0x48478f
push eax
stosb byte es:[edi], al
into
fdivr st(1), st(0)
js fcn.0048473c
pop ebx
xor byte [esi], bh
ret 0x818f
ret 0x5b08

Function at 0x48655d
Capabilities:
Encode data using xor

Disassembly:
pop ebx
das
add byte [esi], dl
mov ah, 0x3f
mov cl, 0x16
outsd dx, dword [esi]
mov ebp, 0x61bb6444
xor dl, dh
inc eax
inc dword [ebx + edx + 0x7f]
fistp qword [ebx + 0x74]
pop ds
pop eax
rol byte [edx - 0x35636875], 1
pop ebx
aas
xor byte [edi + 0x14677da2], 0xa
fnstcw word [esi + 0x61]
inc edi
jae 0x486529
arpl word [ebx - 0x19], dx
or al, 0x5d
stc
cmp dword [ebx - 0xe648c8e], ebx
adc byte [0x285828a8], al
lea edx, [0xcd0269b7]
mov ebx, 0x7217b3f8
mov bl, 0x17
jb 0x486544
invalid
xchg edx, eax
or ebp, edx
imul esp, dword [edx + 0x311d5ea6], 0x52
mov bl, cl
ljmp 0x311d:0x5ea6a26b
mov dl, 0x56
pop esp
cdq
push es
test dword [ebx - 0x2733a551], esi
dec ebp
mov eax, 0x3b9b709d
ror dword [esi - 0x33], 0xf3
test byte ds:[ebx - 0x31], dh
jecxz 0x486514
stosd dword es:[edi], eax
cli
adc byte [eax], 0xd4
invalid
Function at 0x486bfd
Capabilities:
Encode data using xor

Disassembly:
sub byte [edx], 0xb5
out 0xb0, al
xor bl, cl
mov al, 0x35
jecxz 0x486c00
shl dword [ebp + 0x5c810be6], 0xc1
or dword [edx], edx
lahf
sahf
inc ebp
adc eax, 0x78834bc
sbb esp, dword [esi - 0x52]
pop edi
mov ebx, 0xf52ac8a2
lodsb al, byte [esi]
xor dword [ebp + 0x48e59655], 0xf0bc358a
and al, 0x6c
add ebx, dword [eax + 0x477b97cb]
xchg edi, eax
jnp 0x486c4a
wait
push ebx
idiv byte [edi + edx*4]
wait
xchg byte [edi + ecx], bh
test byte [ecx], dl
div dword [esi - 0x5c]
push ebx
xor ah, ah
loope 0x486bc9
cmc
enter 0xffffffffffffbb27, 0xffffffffffffffb1
mov bl, 0xaf
mov eax, 0xc4d530f3
mov eax, dword [0x426495d9]
invalid
in eax, dx
and al, 0x55
ret

Function at 0x49797d
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
adc byte [ebx + esi*4 + 0x2142ee6f], bl
mov ecx, 0x8e30a13c
mov esi, 0x76542a94
mov ss, word [edx]
mov ecx, 0xf76dba67
invalid
fstp qword [ebx - 0x57]
jecxz 0x4979f3
rcl byte [ecx + 0x731652c0], 0x72
xchg ebx, eax
mov ch, 0xa7
lds ebp, [ecx + ebx + 0x54]
in eax, dx
inc edx
std
lahf
xor cl, byte [esi + ecx]
push esi
jo 0x497945
adc eax, 0x21f259f3
rol byte [ebp - 0x28], 4
push dword [edi]
insb byte es:[edi], dx
inc bp
insd dword es:[edi], dx
retf 0xe215
shl byte [esi], cl
invalid

Function at 0x4ab105
Capabilities:
Encode data using xor

Disassembly:
inc esi
sbb esi, dword [eax + eax*8 + 0x72456f5c]
push ebp
ret
add ebp, edi
adc eax, dword [ebp - 0x2b]
fsub qword [edi - 0x656c4020]
and esi, dword [esp + eax + 0x6e54340e]
push esp
outsb dx, byte [esi]
test esp, ebp
jle 0x4ab0ee
adc ecx, dword [ecx + ebx + 0x3253aded]
xchg ebx, eax
mov byte [0xa9507524], al
sar dh, 0x6e
outsb dx, byte [esi]
mov word [ecx], ds
in eax, dx
lodsd eax, dword [esi]
push ebx
xor dl, byte [ebx + 0x507524a2]
push eax
test eax, 0x1a6efec0
stc
sbb bh, cl
into
pop esp
std
push ss
in eax, dx
ficomp dword [eax + edi*2]
loopne 0x4ab0e4
jns 0x4ab09f
fisttp dword gs:[edx]
inc ecx
frstor dword [0x29251de5]
xor dword [edi], ebp
adc eax, 0xb1770963
cmp ebx, dword [eax - 0x745c0c14]
fdiv qword [0xe0b9a5b5]
scasb al, byte es:[edi]
loopne 0x4ab0cd
lds ebx, [edx + 0x24]
mov cs, word [esi + 0x64233637]
push edx
outsb dx, byte [esi]
sbb eax, 0xaba5ebdb
movsd dword es:[edi], dword [esi]
stosd dword es:[edi], eax
sub eax, 0xc0836ecf
jp 0x4ab10b
jnp 0x4ab11d
push esi
bound ecx, qword [eax - 0x2e181f34]
push cs
push ebp
out dx, eax
insd dword es:[edi], dx
fsub dword [ebp - 0x1e]
and edx, dword [ebx + 0x71848bd0]
push ecx
stosd dword es:[edi], eax
xchg edx, eax
xchg ebx, eax
jle 0x4ab0dd
sub esp, dword [edi + 0x6b06abb3]
movsb byte es:[edi], byte [esi]
mov byte [ebp + esi*8 - 0x25], dh
popal
leave
lcall 0xde57, 0x885b
and dl, byte es:[ebx]
mov ebp, 0x9893adbc
xor eax, dword [esi + ecx*2]
xor al, 6
sub al, 0x97
aad 0x99
adc edi, dword [eax]
adc eax, 0x4043a4fc
add ebx, dword [ebx]
sub ah, byte [ebp + 0x42]
test dword [ebx], edx
inc ebx
insb byte es:[edi], dx
in eax, 0x5b
mov eax, 0x71daf3
insb byte es:[edi], dx
sub eax, 0x6759da6f
inc ebp
add dword [ecx + ebp + 0x4e], 0x29
push ebp
stc
and ebp, dword [ecx + ebx]
jne 0x4ab12d
invalid